@aglyn/plugins-outreach 1.0.0-beta.221 → 1.0.0-beta.223

package/src/lib/constants/transfer-resources.d.ts

@@ -0,0 +1,33 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { MatchKeySpec } from '@aglyn/aglyn/data-transfer';
+/**
+ * What the console's boot and the console registrar name the do-not-contact
+ * transfer resource by, kept apart from the resource itself
+ * (`transfer/do-not-contact-transfer.ts`) so registering it loads nothing.
+ */
+/** The resource key, as `plugins.config.json` declares it. */
+export declare const OUTREACH_DO_NOT_CONTACT_TRANSFER_KEY = "outreach.do-not-contact";
+/** What the hub and the wizard call it. */
+export declare const OUTREACH_DO_NOT_CONTACT_TRANSFER_LABEL = "Do-not-contact list";
+/**
+ * The keys a row finds its entry by, read synchronously at registration: the
+ * Aglyn ID (`id`, the core's `TRANSFER_ID_FIELD`), then the entry itself —
+ * an address or a domain, which the resource's `lookup` resolves to the
+ * document it names.
+ */
+export declare const OUTREACH_DNC_MATCH_KEYS: readonly MatchKeySpec[];

package/src/lib/constants/transfer-resources.js

@@ -0,0 +1,38 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * What the console's boot and the console registrar name the do-not-contact
+ * transfer resource by, kept apart from the resource itself
+ * (`transfer/do-not-contact-transfer.ts`) so registering it loads nothing.
+ */ /** The resource key, as `plugins.config.json` declares it. */ export const OUTREACH_DO_NOT_CONTACT_TRANSFER_KEY = 'outreach.do-not-contact';
+/** What the hub and the wizard call it. */ export const OUTREACH_DO_NOT_CONTACT_TRANSFER_LABEL = 'Do-not-contact list';
+/**
+ * The keys a row finds its entry by, read synchronously at registration: the
+ * Aglyn ID (`id`, the core's `TRANSFER_ID_FIELD`), then the entry itself —
+ * an address or a domain, which the resource's `lookup` resolves to the
+ * document it names.
+ */ export const OUTREACH_DNC_MATCH_KEYS = [
+    {
+        fieldId: 'id',
+        normalizer: 'aglynId'
+    },
+    {
+        fieldId: 'entry',
+        normalizer: 'caseless'
+    }
+];
+
+//# sourceMappingURL=transfer-resources.js.map

package/src/lib/constants/transfer-resources.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/constants/transfer-resources.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { MatchKeySpec } from '@aglyn/aglyn/data-transfer'\n\n/**\n * What the console's boot and the console registrar name the do-not-contact\n * transfer resource by, kept apart from the resource itself\n * (`transfer/do-not-contact-transfer.ts`) so registering it loads nothing.\n */\n\n/** The resource key, as `plugins.config.json` declares it. */\nexport const OUTREACH_DO_NOT_CONTACT_TRANSFER_KEY = 'outreach.do-not-contact'\n\n/** What the hub and the wizard call it. */\nexport const OUTREACH_DO_NOT_CONTACT_TRANSFER_LABEL = 'Do-not-contact list'\n\n/**\n * The keys a row finds its entry by, read synchronously at registration: the\n * Aglyn ID (`id`, the core's `TRANSFER_ID_FIELD`), then the entry itself —\n * an address or a domain, which the resource's `lookup` resolves to the\n * document it names.\n */\nexport const OUTREACH_DNC_MATCH_KEYS: readonly MatchKeySpec[] = [\n  { fieldId: 'id', normalizer: 'aglynId' },\n  { fieldId: 'entry', normalizer: 'caseless' },\n]\n"],"names":["OUTREACH_DO_NOT_CONTACT_TRANSFER_KEY","OUTREACH_DO_NOT_CONTACT_TRANSFER_LABEL","OUTREACH_DNC_MATCH_KEYS","fieldId","normalizer"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAID;;;;CAIC,GAED,4DAA4D,GAC5D,OAAO,MAAMA,uCAAuC,0BAAyB;AAE7E,yCAAyC,GACzC,OAAO,MAAMC,yCAAyC,sBAAqB;AAE3E;;;;;CAKC,GACD,OAAO,MAAMC,0BAAmD;IAC9D;QAAEC,SAAS;QAAMC,YAAY;IAAU;IACvC;QAAED,SAAS;QAASC,YAAY;IAAW;CAC5C,CAAA"}

package/src/lib/declarations.console-server.d.ts

@@ -32,7 +32,13 @@
  * console's `plugin-console-crons` tick and nowhere else, and the person
  * eraser removes the enrollments a workspace kept about someone it erases.
  *
+ * The do-not-contact list's transfer resource (`outreach.do-not-contact`) is
+ * declared here as well: its import writes the list as a member would, and
+ * its export reads it, through the Admin SDK the console's transfer routes
+ * run on.
+ *
  * Light at boot: every module that does the work is imported when a job, an
- * erasure or a tick first asks for it, so the boot cost is the registration.
+ * erasure, a tick or a transfer first asks for it, so the boot cost is the
+ * registration.
  */
 export declare function registerOutreachConsoleServerDeclarations(): void;

package/src/lib/declarations.console-server.js

@@ -21,9 +21,12 @@ import { listPluginMembershipDetachers, registerPluginMembershipDetacher } from
 import { listPluginOrgErasers, registerPluginOrgEraser } from "@aglyn/aglyn/plugin-manager/plugin-org-erasure";
 import { listPluginLeadConversionListeners, registerPluginLeadConversionListener } from "@aglyn/aglyn/plugin-manager/plugin-lead-conversion";
 import { registerPluginPersonEraser } from "@aglyn/aglyn/plugin-manager/plugin-person-erasure";
+import { registerPluginTransferResource } from "@aglyn/aglyn/plugin-manager/plugin-transfer-resources";
 import { listPluginUserErasers, registerPluginUserEraser } from "@aglyn/aglyn/plugin-manager/plugin-user-erasure";
 import { OUTREACH_PLUGIN_ID } from "./constants/bundle-common.js";
+import { OUTREACH_SEQUENCE_PACKAGE_RULES, OUTREACH_SEQUENCES_TRANSFER_KEY, outreachSequenceDependencies, remapOutreachSequenceIds } from "./transfer/sequences-package.js";
 import { OUTREACH_SEND_JOB_ID, OUTREACH_SYNC_JOB_ID } from "./constants/runtime-jobs.js";
+import { OUTREACH_DNC_MATCH_KEYS, OUTREACH_DO_NOT_CONTACT_TRANSFER_KEY } from "./constants/transfer-resources.js";
 /**
  * Outreach's CONSOLE-ONLY server declarations (AGL-2978), named under
  * `consoleServerDeclarations` in `plugins.config.json` and run at the
@@ -42,9 +45,16 @@ import { OUTREACH_SEND_JOB_ID, OUTREACH_SYNC_JOB_ID } from "./constants/runtime-
  * console's `plugin-console-crons` tick and nowhere else, and the person
  * eraser removes the enrollments a workspace kept about someone it erases.
  *
+ * The do-not-contact list's transfer resource (`outreach.do-not-contact`) is
+ * declared here as well: its import writes the list as a member would, and
+ * its export reads it, through the Admin SDK the console's transfer routes
+ * run on.
+ *
  * Light at boot: every module that does the work is imported when a job, an
- * erasure or a tick first asks for it, so the boot cost is the registration.
+ * erasure, a tick or a transfer first asks for it, so the boot cost is the
+ * registration.
  */ export function registerOutreachConsoleServerDeclarations() {
+    registerOutreachTransferResources();
     // Idempotent against the REGISTRY, so a reset (a spec) registers again.
     if (!listPluginOrgErasers().includes(OUTREACH_PLUGIN_ID)) {
         registerPluginOrgEraser(async (request)=>{
@@ -131,6 +141,61 @@ import { OUTREACH_SEND_JOB_ID, OUTREACH_SYNC_JOB_ID } from "./constants/runtime-
     }, {
         pluginId: OUTREACH_PLUGIN_ID
     });
+    // The do-not-contact list as a file: an import adds domains and
+    // addresses, an export reads the domains. Each hook loads the resource
+    // and the Admin SDK the first time a transfer asks.
+    registerPluginTransferResource(OUTREACH_DO_NOT_CONTACT_TRANSFER_KEY, lazyDoNotContactTransfer(), {
+        pluginId: OUTREACH_PLUGIN_ID
+    });
+}
+/**
+ * The do-not-contact resource with every hook deferred to its module; the
+ * match keys are read at registration, so they come from the light constants.
+ */ function lazyDoNotContactTransfer() {
+    const load = async ()=>{
+        const [{ createOutreachDoNotContactTransferResource }, { platformOutreachTransferDeps }] = await Promise.all([
+            import("./transfer/do-not-contact-transfer.js"),
+            import("./transfer/platform-transfer-deps.js")
+        ]);
+        return createOutreachDoNotContactTransferResource(platformOutreachTransferDeps());
+    };
+    return {
+        matchKeys: OUTREACH_DNC_MATCH_KEYS,
+        planGate: outreachTransferPlanGate,
+        fields: async (ctx)=>(await load()).fields(ctx),
+        count: async (ctx, options)=>(await load()).count(ctx, options),
+        readPage: async (ctx, cursor, fieldIds, options)=>(await load()).readPage(ctx, cursor, fieldIds, options),
+        lookup: async (ctx, requests)=>(await load()).lookup(ctx, requests),
+        plan: async (ctx, input)=>(await load()).plan(ctx, input),
+        lockedRules: async (ctx)=>(await load()).lockedRules(ctx),
+        apply: async (ctx, chunk, writer)=>(await load()).apply(ctx, chunk, writer),
+        revert: async (ctx, snapshot, decisions)=>(await load()).revert(ctx, snapshot, decisions)
+    };
+}
+/**
+ * Sequences' entitlement, asked by the transfer gate for both resources and
+ * every intent (AGL-3548); the answer's module loads with the first ask.
+ */ const outreachTransferPlanGate = async (subject, intent)=>(await import("./transfer/plan-gate.js")).outreachTransferPlanGate(subject, intent);
+/** The sequences package's server half (AGL-3535), loaded when an import or export first asks. */ const sequencesPackage = async ()=>(await import("./transfer/sequences-package.server.js")).createOutreachSequencesPackage();
+/**
+ * Sequences in a workspace package (AGL-3535): what a sequence names and
+ * how a reference moves are answered here; reading and writing load the
+ * server half on first use.
+ */ function registerOutreachTransferResources() {
+    registerPluginTransferResource(OUTREACH_SEQUENCES_TRANSFER_KEY, {
+        items: async (ctx)=>(await sequencesPackage()).items(ctx),
+        dependencies: (item)=>outreachSequenceDependencies(item),
+        remapIds: (item, idMap)=>remapOutreachSequenceIds(item, idMap),
+        readItems: async (ctx, ids)=>(await sequencesPackage()).readItems(ctx, ids),
+        writeItems: async (ctx, items, writer)=>(await sequencesPackage()).writeItems(ctx, items, writer),
+        revertItems: async (ctx, steps)=>(await sequencesPackage()).revertItems(ctx, steps),
+        problems: async (ctx, write)=>(await sequencesPackage()).problems(ctx, write),
+        referenceTargets: async (ctx, kinds)=>(await sequencesPackage()).referenceTargets(ctx, kinds),
+        rules: OUTREACH_SEQUENCE_PACKAGE_RULES,
+        planGate: outreachTransferPlanGate
+    }, {
+        pluginId: OUTREACH_PLUGIN_ID
+    });
 }
 /** The runtime's platform reach, loaded when a job or an erasure first runs. */ const runtime = ()=>import("./runtime/platform-runtime-deps.js");
 

package/src/lib/declarations.console-server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/plugins/outreach/src/lib/declarations.console-server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// Each registry from its own module, not the `@aglyn/aglyn/server` barrel:\n// boot needs one registry, not the whole server surface.\nimport { registerPluginConsoleCron } from '@aglyn/aglyn/plugin-manager/plugin-console-crons'\nimport {\n  listPluginMembershipDetachers,\n  registerPluginMembershipDetacher,\n} from '@aglyn/aglyn/plugin-manager/plugin-membership-detach'\nimport {\n  listPluginOrgErasers,\n  registerPluginOrgEraser,\n} from '@aglyn/aglyn/plugin-manager/plugin-org-erasure'\nimport {\n  listPluginLeadConversionListeners,\n  registerPluginLeadConversionListener,\n} from '@aglyn/aglyn/plugin-manager/plugin-lead-conversion'\nimport { registerPluginPersonEraser } from '@aglyn/aglyn/plugin-manager/plugin-person-erasure'\nimport {\n  listPluginUserErasers,\n  registerPluginUserEraser,\n} from '@aglyn/aglyn/plugin-manager/plugin-user-erasure'\nimport { OUTREACH_PLUGIN_ID } from './constants/bundle-common'\nimport { OUTREACH_SEND_JOB_ID, OUTREACH_SYNC_JOB_ID } from './constants/runtime-jobs'\n\n/**\n * Outreach's CONSOLE-ONLY server declarations (AGL-2978), named under\n * `consoleServerDeclarations` in `plugins.config.json` and run at the\n * console's boot.\n *\n * The erasers are registered here rather than from `serverDeclarations`,\n * which the tenant runtime also loads: the workspace eraser revokes each\n * rep's Google grant, and the account eraser (AGL-3106) revokes and deletes\n * the person's own, and both open a sealed token with `OUTREACH_TOKEN_KEY`,\n * which only the console holds. The tenant may not so much as bundle the code\n * that does (`outreach-credential-isolation.spec.ts`). Every erasure runs in\n * the console, so this is where the erasers are needed.\n *\n * The sending runtime (AGL-2981) is declared here too, for the same reason:\n * the send and sync jobs open each rep's sealed grant, so they run on the\n * console's `plugin-console-crons` tick and nowhere else, and the person\n * eraser removes the enrollments a workspace kept about someone it erases.\n *\n * Light at boot: every module that does the work is imported when a job, an\n * erasure or a tick first asks for it, so the boot cost is the registration.\n */\nexport function registerOutreachConsoleServerDeclarations(): void {\n  // Idempotent against the REGISTRY, so a reset (a spec) registers again.\n  if (!listPluginOrgErasers().includes(OUTREACH_PLUGIN_ID)) {\n    registerPluginOrgEraser(\n      async (request) => {\n        const { createOutreachOrgEraser, defaultOutreachErasureDeps } = await import(\n          './mailboxes/mailbox-erasure'\n        )\n        return createOutreachOrgEraser(defaultOutreachErasureDeps())(request)\n      },\n      { pluginId: OUTREACH_PLUGIN_ID },\n    )\n  }\n  if (!listPluginUserErasers().includes(OUTREACH_PLUGIN_ID)) {\n    registerPluginUserEraser(\n      async (request) => {\n        const { createOutreachUserEraser, defaultOutreachErasureDeps } = await import(\n          './mailboxes/mailbox-erasure'\n        )\n        return createOutreachUserEraser(defaultOutreachErasureDeps())(request)\n      },\n      { pluginId: OUTREACH_PLUGIN_ID },\n    )\n  }\n  // A person erased from a workspace takes their enrollments with them; the\n  // do-not-contact entry stays, stripped of anything that names them.\n  registerPluginPersonEraser(\n    async (request) => (await runtime()).platformOutreachPersonEraser()(request),\n    { pluginId: OUTREACH_PLUGIN_ID },\n  )\n  // A lead that converts takes its enrollments to the contact it became\n  // (AGL-3234): the same document, now naming the contact — and every\n  // enrollment made on it credits `converted` to its campaigns (AGL-3254).\n  if (!listPluginLeadConversionListeners().includes(OUTREACH_PLUGIN_ID)) {\n    registerPluginLeadConversionListener(\n      async (request) => {\n        const [{ followOutreachLeadToContact }, { creditOutreachLeadConversion }, platform] = await Promise.all([\n          import('./runtime/lead-records'),\n          import('./runtime/campaign-credit'),\n          runtime(),\n        ])\n        const deps = platform.platformOutreachRuntimeDeps()\n        const credited = await creditOutreachLeadConversion(deps, request)\n        const followed = await followOutreachLeadToContact(deps.firestore(), request)\n        return { ...followed, campaignsCredited: credited }\n      },\n      { pluginId: OUTREACH_PLUGIN_ID },\n    )\n  }\n  // A deleted campaign comes off every sequence and enrollment naming it\n  // (AGL-3254), before the marketing plugin removes the container.\n  if (!listPluginMembershipDetachers().includes(OUTREACH_PLUGIN_ID)) {\n    registerPluginMembershipDetacher(\n      async (request) => {\n        const [{ createOutreachCampaignDetacher }, platform] = await Promise.all([\n          import('./runtime/campaign-detach'),\n          runtime(),\n        ])\n        return createOutreachCampaignDetacher({ firestore: platform.platformOutreachRuntimeDeps().firestore })(\n          request,\n        )\n      },\n      { pluginId: OUTREACH_PLUGIN_ID },\n    )\n  }\n  // The sending runtime, on the console's fifteen-minute tick.\n  registerPluginConsoleCron(\n    {\n      id: OUTREACH_SEND_JOB_ID,\n      label: 'Sequence sends',\n      drives:\n        'Sends every sequence step that has come due, from the rep’s own connected mailbox, and files each on the contact’s timeline. If it stops, no sequence sends anything and every task step waits.',\n      run: async (context) => {\n        const [{ runOutreachSendJob }, platform] = await Promise.all([import('./runtime/send-job'), runtime()])\n        return runOutreachSendJob(platform.platformOutreachRuntimeDeps(), context)\n      },\n    },\n    { pluginId: OUTREACH_PLUGIN_ID },\n  )\n  registerPluginConsoleCron(\n    {\n      id: OUTREACH_SYNC_JOB_ID,\n      label: 'Sequence replies and bounces',\n      drives:\n        'Reads each connected mailbox for replies, out-of-office answers, opt-outs and bounces, and stops or postpones the sequence each one is about. If it stops, a person who replied or asked to be left alone keeps getting follow-ups, and a mailbox that bounces never pauses itself.',\n      run: async (context) => {\n        const [{ runOutreachSyncJob }, platform] = await Promise.all([import('./runtime/sync-job'), runtime()])\n        return runOutreachSyncJob(platform.platformOutreachRuntimeDeps(), context)\n      },\n    },\n    { pluginId: OUTREACH_PLUGIN_ID },\n  )\n}\n\n/** The runtime's platform reach, loaded when a job or an erasure first runs. */\nconst runtime = () => import('./runtime/platform-runtime-deps')\n"],"names":["registerPluginConsoleCron","listPluginMembershipDetachers","registerPluginMembershipDetacher","listPluginOrgErasers","registerPluginOrgEraser","listPluginLeadConversionListeners","registerPluginLeadConversionListener","registerPluginPersonEraser","listPluginUserErasers","registerPluginUserEraser","OUTREACH_PLUGIN_ID","OUTREACH_SEND_JOB_ID","OUTREACH_SYNC_JOB_ID","registerOutreachConsoleServerDeclarations","includes","request","createOutreachOrgEraser","defaultOutreachErasureDeps","pluginId","createOutreachUserEraser","runtime","platformOutreachPersonEraser","followOutreachLeadToContact","creditOutreachLeadConversion","platform","Promise","all","deps","platformOutreachRuntimeDeps","credited","followed","firestore","campaignsCredited","createOutreachCampaignDetacher","id","label","drives","run","context","runOutreachSendJob","runOutreachSyncJob"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,2EAA2E;AAC3E,yDAAyD;AACzD,SAASA,yBAAyB,QAAQ,mDAAkD;AAC5F,SACEC,6BAA6B,EAC7BC,gCAAgC,QAC3B,uDAAsD;AAC7D,SACEC,oBAAoB,EACpBC,uBAAuB,QAClB,iDAAgD;AACvD,SACEC,iCAAiC,EACjCC,oCAAoC,QAC/B,qDAAoD;AAC3D,SAASC,0BAA0B,QAAQ,oDAAmD;AAC9F,SACEC,qBAAqB,EACrBC,wBAAwB,QACnB,kDAAiD;AACxD,SAASC,kBAAkB,QAAQ,+BAA2B;AAC9D,SAASC,oBAAoB,EAAEC,oBAAoB,QAAQ,8BAA0B;AAErF;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,OAAO,SAASC;IACd,wEAAwE;IACxE,IAAI,CAACV,uBAAuBW,QAAQ,CAACJ,qBAAqB;QACxDN,wBACE,OAAOW;YACL,MAAM,EAAEC,uBAAuB,EAAEC,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAC1E;YAEF,OAAOD,wBAAwBC,8BAA8BF;QAC/D,GACA;YAAEG,UAAUR;QAAmB;IAEnC;IACA,IAAI,CAACF,wBAAwBM,QAAQ,CAACJ,qBAAqB;QACzDD,yBACE,OAAOM;YACL,MAAM,EAAEI,wBAAwB,EAAEF,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAC3E;YAEF,OAAOE,yBAAyBF,8BAA8BF;QAChE,GACA;YAAEG,UAAUR;QAAmB;IAEnC;IACA,0EAA0E;IAC1E,oEAAoE;IACpEH,2BACE,OAAOQ,UAAY,AAAC,CAAA,MAAMK,SAAQ,EAAGC,4BAA4B,GAAGN,UACpE;QAAEG,UAAUR;IAAmB;IAEjC,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,IAAI,CAACL,oCAAoCS,QAAQ,CAACJ,qBAAqB;QACrEJ,qCACE,OAAOS;YACL,MAAM,CAAC,EAAEO,2BAA2B,EAAE,EAAE,EAAEC,4BAA4B,EAAE,EAAEC,SAAS,GAAG,MAAMC,QAAQC,GAAG,CAAC;gBACtG,MAAM,CAAC;gBACP,MAAM,CAAC;gBACPN;aACD;YACD,MAAMO,OAAOH,SAASI,2BAA2B;YACjD,MAAMC,WAAW,MAAMN,6BAA6BI,MAAMZ;YAC1D,MAAMe,WAAW,MAAMR,4BAA4BK,KAAKI,SAAS,IAAIhB;YACrE,OAAO,aAAKe;gBAAUE,mBAAmBH;;QAC3C,GACA;YAAEX,UAAUR;QAAmB;IAEnC;IACA,uEAAuE;IACvE,iEAAiE;IACjE,IAAI,CAACT,gCAAgCa,QAAQ,CAACJ,qBAAqB;QACjER,iCACE,OAAOa;YACL,MAAM,CAAC,EAAEkB,8BAA8B,EAAE,EAAET,SAAS,GAAG,MAAMC,QAAQC,GAAG,CAAC;gBACvE,MAAM,CAAC;gBACPN;aACD;YACD,OAAOa,+BAA+B;gBAAEF,WAAWP,SAASI,2BAA2B,GAAGG,SAAS;YAAC,GAClGhB;QAEJ,GACA;YAAEG,UAAUR;QAAmB;IAEnC;IACA,6DAA6D;IAC7DV,0BACE;QACEkC,IAAIvB;QACJwB,OAAO;QACPC,QACE;QACFC,KAAK,OAAOC;YACV,MAAM,CAAC,EAAEC,kBAAkB,EAAE,EAAEf,SAAS,GAAG,MAAMC,QAAQC,GAAG,CAAC;gBAAC,MAAM,CAAC;gBAAuBN;aAAU;YACtG,OAAOmB,mBAAmBf,SAASI,2BAA2B,IAAIU;QACpE;IACF,GACA;QAAEpB,UAAUR;IAAmB;IAEjCV,0BACE;QACEkC,IAAItB;QACJuB,OAAO;QACPC,QACE;QACFC,KAAK,OAAOC;YACV,MAAM,CAAC,EAAEE,kBAAkB,EAAE,EAAEhB,SAAS,GAAG,MAAMC,QAAQC,GAAG,CAAC;gBAAC,MAAM,CAAC;gBAAuBN;aAAU;YACtG,OAAOoB,mBAAmBhB,SAASI,2BAA2B,IAAIU;QACpE;IACF,GACA;QAAEpB,UAAUR;IAAmB;AAEnC;AAEA,8EAA8E,GAC9E,MAAMU,UAAU,IAAM,MAAM,CAAC"}
+{"version":3,"sources":["../../../../../../libs/plugins/outreach/src/lib/declarations.console-server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// Each registry from its own module, not the `@aglyn/aglyn/server` barrel:\n// boot needs one registry, not the whole server surface.\nimport { registerPluginConsoleCron } from '@aglyn/aglyn/plugin-manager/plugin-console-crons'\nimport {\n  listPluginMembershipDetachers,\n  registerPluginMembershipDetacher,\n} from '@aglyn/aglyn/plugin-manager/plugin-membership-detach'\nimport {\n  listPluginOrgErasers,\n  registerPluginOrgEraser,\n} from '@aglyn/aglyn/plugin-manager/plugin-org-erasure'\nimport {\n  listPluginLeadConversionListeners,\n  registerPluginLeadConversionListener,\n} from '@aglyn/aglyn/plugin-manager/plugin-lead-conversion'\nimport { registerPluginPersonEraser } from '@aglyn/aglyn/plugin-manager/plugin-person-erasure'\nimport {\n  registerPluginTransferResource,\n  type PluginTransferResource,\n} from '@aglyn/aglyn/plugin-manager/plugin-transfer-resources'\nimport {\n  listPluginUserErasers,\n  registerPluginUserEraser,\n} from '@aglyn/aglyn/plugin-manager/plugin-user-erasure'\nimport { OUTREACH_PLUGIN_ID } from './constants/bundle-common'\nimport {\n  OUTREACH_SEQUENCE_PACKAGE_RULES,\n  OUTREACH_SEQUENCES_TRANSFER_KEY,\n  outreachSequenceDependencies,\n  remapOutreachSequenceIds,\n  type OutreachSequencePackageContent,\n} from './transfer/sequences-package'\nimport { OUTREACH_SEND_JOB_ID, OUTREACH_SYNC_JOB_ID } from './constants/runtime-jobs'\nimport { OUTREACH_DNC_MATCH_KEYS, OUTREACH_DO_NOT_CONTACT_TRANSFER_KEY } from './constants/transfer-resources'\n\n/**\n * Outreach's CONSOLE-ONLY server declarations (AGL-2978), named under\n * `consoleServerDeclarations` in `plugins.config.json` and run at the\n * console's boot.\n *\n * The erasers are registered here rather than from `serverDeclarations`,\n * which the tenant runtime also loads: the workspace eraser revokes each\n * rep's Google grant, and the account eraser (AGL-3106) revokes and deletes\n * the person's own, and both open a sealed token with `OUTREACH_TOKEN_KEY`,\n * which only the console holds. The tenant may not so much as bundle the code\n * that does (`outreach-credential-isolation.spec.ts`). Every erasure runs in\n * the console, so this is where the erasers are needed.\n *\n * The sending runtime (AGL-2981) is declared here too, for the same reason:\n * the send and sync jobs open each rep's sealed grant, so they run on the\n * console's `plugin-console-crons` tick and nowhere else, and the person\n * eraser removes the enrollments a workspace kept about someone it erases.\n *\n * The do-not-contact list's transfer resource (`outreach.do-not-contact`) is\n * declared here as well: its import writes the list as a member would, and\n * its export reads it, through the Admin SDK the console's transfer routes\n * run on.\n *\n * Light at boot: every module that does the work is imported when a job, an\n * erasure, a tick or a transfer first asks for it, so the boot cost is the\n * registration.\n */\nexport function registerOutreachConsoleServerDeclarations(): void {\n  registerOutreachTransferResources()\n  // Idempotent against the REGISTRY, so a reset (a spec) registers again.\n  if (!listPluginOrgErasers().includes(OUTREACH_PLUGIN_ID)) {\n    registerPluginOrgEraser(\n      async (request) => {\n        const { createOutreachOrgEraser, defaultOutreachErasureDeps } = await import(\n          './mailboxes/mailbox-erasure'\n        )\n        return createOutreachOrgEraser(defaultOutreachErasureDeps())(request)\n      },\n      { pluginId: OUTREACH_PLUGIN_ID },\n    )\n  }\n  if (!listPluginUserErasers().includes(OUTREACH_PLUGIN_ID)) {\n    registerPluginUserEraser(\n      async (request) => {\n        const { createOutreachUserEraser, defaultOutreachErasureDeps } = await import(\n          './mailboxes/mailbox-erasure'\n        )\n        return createOutreachUserEraser(defaultOutreachErasureDeps())(request)\n      },\n      { pluginId: OUTREACH_PLUGIN_ID },\n    )\n  }\n  // A person erased from a workspace takes their enrollments with them; the\n  // do-not-contact entry stays, stripped of anything that names them.\n  registerPluginPersonEraser(\n    async (request) => (await runtime()).platformOutreachPersonEraser()(request),\n    { pluginId: OUTREACH_PLUGIN_ID },\n  )\n  // A lead that converts takes its enrollments to the contact it became\n  // (AGL-3234): the same document, now naming the contact — and every\n  // enrollment made on it credits `converted` to its campaigns (AGL-3254).\n  if (!listPluginLeadConversionListeners().includes(OUTREACH_PLUGIN_ID)) {\n    registerPluginLeadConversionListener(\n      async (request) => {\n        const [{ followOutreachLeadToContact }, { creditOutreachLeadConversion }, platform] = await Promise.all([\n          import('./runtime/lead-records'),\n          import('./runtime/campaign-credit'),\n          runtime(),\n        ])\n        const deps = platform.platformOutreachRuntimeDeps()\n        const credited = await creditOutreachLeadConversion(deps, request)\n        const followed = await followOutreachLeadToContact(deps.firestore(), request)\n        return { ...followed, campaignsCredited: credited }\n      },\n      { pluginId: OUTREACH_PLUGIN_ID },\n    )\n  }\n  // A deleted campaign comes off every sequence and enrollment naming it\n  // (AGL-3254), before the marketing plugin removes the container.\n  if (!listPluginMembershipDetachers().includes(OUTREACH_PLUGIN_ID)) {\n    registerPluginMembershipDetacher(\n      async (request) => {\n        const [{ createOutreachCampaignDetacher }, platform] = await Promise.all([\n          import('./runtime/campaign-detach'),\n          runtime(),\n        ])\n        return createOutreachCampaignDetacher({ firestore: platform.platformOutreachRuntimeDeps().firestore })(\n          request,\n        )\n      },\n      { pluginId: OUTREACH_PLUGIN_ID },\n    )\n  }\n  // The sending runtime, on the console's fifteen-minute tick.\n  registerPluginConsoleCron(\n    {\n      id: OUTREACH_SEND_JOB_ID,\n      label: 'Sequence sends',\n      drives:\n        'Sends every sequence step that has come due, from the rep’s own connected mailbox, and files each on the contact’s timeline. If it stops, no sequence sends anything and every task step waits.',\n      run: async (context) => {\n        const [{ runOutreachSendJob }, platform] = await Promise.all([import('./runtime/send-job'), runtime()])\n        return runOutreachSendJob(platform.platformOutreachRuntimeDeps(), context)\n      },\n    },\n    { pluginId: OUTREACH_PLUGIN_ID },\n  )\n  registerPluginConsoleCron(\n    {\n      id: OUTREACH_SYNC_JOB_ID,\n      label: 'Sequence replies and bounces',\n      drives:\n        'Reads each connected mailbox for replies, out-of-office answers, opt-outs and bounces, and stops or postpones the sequence each one is about. If it stops, a person who replied or asked to be left alone keeps getting follow-ups, and a mailbox that bounces never pauses itself.',\n      run: async (context) => {\n        const [{ runOutreachSyncJob }, platform] = await Promise.all([import('./runtime/sync-job'), runtime()])\n        return runOutreachSyncJob(platform.platformOutreachRuntimeDeps(), context)\n      },\n    },\n    { pluginId: OUTREACH_PLUGIN_ID },\n  )\n  // The do-not-contact list as a file: an import adds domains and\n  // addresses, an export reads the domains. Each hook loads the resource\n  // and the Admin SDK the first time a transfer asks.\n  registerPluginTransferResource(OUTREACH_DO_NOT_CONTACT_TRANSFER_KEY, lazyDoNotContactTransfer(), {\n    pluginId: OUTREACH_PLUGIN_ID,\n  })\n}\n\n/**\n * The do-not-contact resource with every hook deferred to its module; the\n * match keys are read at registration, so they come from the light constants.\n */\nfunction lazyDoNotContactTransfer(): PluginTransferResource {\n  const load = async () => {\n    const [{ createOutreachDoNotContactTransferResource }, { platformOutreachTransferDeps }] = await Promise.all([\n      import('./transfer/do-not-contact-transfer'),\n      import('./transfer/platform-transfer-deps'),\n    ])\n    return createOutreachDoNotContactTransferResource(platformOutreachTransferDeps())\n  }\n  return {\n    matchKeys: OUTREACH_DNC_MATCH_KEYS,\n    planGate: outreachTransferPlanGate,\n    fields: async (ctx) => (await load()).fields(ctx),\n    count: async (ctx, options) => (await load()).count(ctx, options),\n    readPage: async (ctx, cursor, fieldIds, options) => (await load()).readPage(ctx, cursor, fieldIds, options),\n    lookup: async (ctx, requests) => (await load()).lookup(ctx, requests),\n    plan: async (ctx, input) => (await load()).plan(ctx, input),\n    lockedRules: async (ctx) => (await load()).lockedRules(ctx),\n    apply: async (ctx, chunk, writer) => (await load()).apply(ctx, chunk, writer),\n    revert: async (ctx, snapshot, decisions) => (await load()).revert(ctx, snapshot, decisions),\n  }\n}\n\n/**\n * Sequences' entitlement, asked by the transfer gate for both resources and\n * every intent (AGL-3548); the answer's module loads with the first ask.\n */\nconst outreachTransferPlanGate: NonNullable<PluginTransferResource['planGate']> = async (subject, intent) =>\n  (await import('./transfer/plan-gate')).outreachTransferPlanGate(subject, intent)\n\n/** The sequences package's server half (AGL-3535), loaded when an import or export first asks. */\nconst sequencesPackage = async () => (await import('./transfer/sequences-package.server')).createOutreachSequencesPackage()\n\n/**\n * Sequences in a workspace package (AGL-3535): what a sequence names and\n * how a reference moves are answered here; reading and writing load the\n * server half on first use.\n */\nfunction registerOutreachTransferResources(): void {\n  registerPluginTransferResource(\n    OUTREACH_SEQUENCES_TRANSFER_KEY,\n    {\n      items: async (ctx) => (await sequencesPackage()).items(ctx),\n      dependencies: (item) => outreachSequenceDependencies(item as OutreachSequencePackageContent),\n      remapIds: (item, idMap) => remapOutreachSequenceIds(item as OutreachSequencePackageContent, idMap),\n      readItems: async (ctx, ids) => (await sequencesPackage()).readItems(ctx, ids),\n      writeItems: async (ctx, items, writer) => (await sequencesPackage()).writeItems(ctx, items as never, writer),\n      revertItems: async (ctx, steps) => (await sequencesPackage()).revertItems(ctx, steps as never),\n      problems: async (ctx, write) => (await sequencesPackage()).problems(ctx, write as never),\n      referenceTargets: async (ctx, kinds) => (await sequencesPackage()).referenceTargets(ctx, kinds),\n      rules: OUTREACH_SEQUENCE_PACKAGE_RULES,\n      planGate: outreachTransferPlanGate,\n    },\n    { pluginId: OUTREACH_PLUGIN_ID },\n  )\n}\n\n/** The runtime's platform reach, loaded when a job or an erasure first runs. */\nconst runtime = () => import('./runtime/platform-runtime-deps')\n"],"names":["registerPluginConsoleCron","listPluginMembershipDetachers","registerPluginMembershipDetacher","listPluginOrgErasers","registerPluginOrgEraser","listPluginLeadConversionListeners","registerPluginLeadConversionListener","registerPluginPersonEraser","registerPluginTransferResource","listPluginUserErasers","registerPluginUserEraser","OUTREACH_PLUGIN_ID","OUTREACH_SEQUENCE_PACKAGE_RULES","OUTREACH_SEQUENCES_TRANSFER_KEY","outreachSequenceDependencies","remapOutreachSequenceIds","OUTREACH_SEND_JOB_ID","OUTREACH_SYNC_JOB_ID","OUTREACH_DNC_MATCH_KEYS","OUTREACH_DO_NOT_CONTACT_TRANSFER_KEY","registerOutreachConsoleServerDeclarations","registerOutreachTransferResources","includes","request","createOutreachOrgEraser","defaultOutreachErasureDeps","pluginId","createOutreachUserEraser","runtime","platformOutreachPersonEraser","followOutreachLeadToContact","creditOutreachLeadConversion","platform","Promise","all","deps","platformOutreachRuntimeDeps","credited","followed","firestore","campaignsCredited","createOutreachCampaignDetacher","id","label","drives","run","context","runOutreachSendJob","runOutreachSyncJob","lazyDoNotContactTransfer","load","createOutreachDoNotContactTransferResource","platformOutreachTransferDeps","matchKeys","planGate","outreachTransferPlanGate","fields","ctx","count","options","readPage","cursor","fieldIds","lookup","requests","plan","input","lockedRules","apply","chunk","writer","revert","snapshot","decisions","subject","intent","sequencesPackage","createOutreachSequencesPackage","items","dependencies","item","remapIds","idMap","readItems","ids","writeItems","revertItems","steps","problems","write","referenceTargets","kinds","rules"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,2EAA2E;AAC3E,yDAAyD;AACzD,SAASA,yBAAyB,QAAQ,mDAAkD;AAC5F,SACEC,6BAA6B,EAC7BC,gCAAgC,QAC3B,uDAAsD;AAC7D,SACEC,oBAAoB,EACpBC,uBAAuB,QAClB,iDAAgD;AACvD,SACEC,iCAAiC,EACjCC,oCAAoC,QAC/B,qDAAoD;AAC3D,SAASC,0BAA0B,QAAQ,oDAAmD;AAC9F,SACEC,8BAA8B,QAEzB,wDAAuD;AAC9D,SACEC,qBAAqB,EACrBC,wBAAwB,QACnB,kDAAiD;AACxD,SAASC,kBAAkB,QAAQ,+BAA2B;AAC9D,SACEC,+BAA+B,EAC/BC,+BAA+B,EAC/BC,4BAA4B,EAC5BC,wBAAwB,QAEnB,kCAA8B;AACrC,SAASC,oBAAoB,EAAEC,oBAAoB,QAAQ,8BAA0B;AACrF,SAASC,uBAAuB,EAAEC,oCAAoC,QAAQ,oCAAgC;AAE9G;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GACD,OAAO,SAASC;IACdC;IACA,wEAAwE;IACxE,IAAI,CAAClB,uBAAuBmB,QAAQ,CAACX,qBAAqB;QACxDP,wBACE,OAAOmB;YACL,MAAM,EAAEC,uBAAuB,EAAEC,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAC1E;YAEF,OAAOD,wBAAwBC,8BAA8BF;QAC/D,GACA;YAAEG,UAAUf;QAAmB;IAEnC;IACA,IAAI,CAACF,wBAAwBa,QAAQ,CAACX,qBAAqB;QACzDD,yBACE,OAAOa;YACL,MAAM,EAAEI,wBAAwB,EAAEF,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAC3E;YAEF,OAAOE,yBAAyBF,8BAA8BF;QAChE,GACA;YAAEG,UAAUf;QAAmB;IAEnC;IACA,0EAA0E;IAC1E,oEAAoE;IACpEJ,2BACE,OAAOgB,UAAY,AAAC,CAAA,MAAMK,SAAQ,EAAGC,4BAA4B,GAAGN,UACpE;QAAEG,UAAUf;IAAmB;IAEjC,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,IAAI,CAACN,oCAAoCiB,QAAQ,CAACX,qBAAqB;QACrEL,qCACE,OAAOiB;YACL,MAAM,CAAC,EAAEO,2BAA2B,EAAE,EAAE,EAAEC,4BAA4B,EAAE,EAAEC,SAAS,GAAG,MAAMC,QAAQC,GAAG,CAAC;gBACtG,MAAM,CAAC;gBACP,MAAM,CAAC;gBACPN;aACD;YACD,MAAMO,OAAOH,SAASI,2BAA2B;YACjD,MAAMC,WAAW,MAAMN,6BAA6BI,MAAMZ;YAC1D,MAAMe,WAAW,MAAMR,4BAA4BK,KAAKI,SAAS,IAAIhB;YACrE,OAAO,aAAKe;gBAAUE,mBAAmBH;;QAC3C,GACA;YAAEX,UAAUf;QAAmB;IAEnC;IACA,uEAAuE;IACvE,iEAAiE;IACjE,IAAI,CAACV,gCAAgCqB,QAAQ,CAACX,qBAAqB;QACjET,iCACE,OAAOqB;YACL,MAAM,CAAC,EAAEkB,8BAA8B,EAAE,EAAET,SAAS,GAAG,MAAMC,QAAQC,GAAG,CAAC;gBACvE,MAAM,CAAC;gBACPN;aACD;YACD,OAAOa,+BAA+B;gBAAEF,WAAWP,SAASI,2BAA2B,GAAGG,SAAS;YAAC,GAClGhB;QAEJ,GACA;YAAEG,UAAUf;QAAmB;IAEnC;IACA,6DAA6D;IAC7DX,0BACE;QACE0C,IAAI1B;QACJ2B,OAAO;QACPC,QACE;QACFC,KAAK,OAAOC;YACV,MAAM,CAAC,EAAEC,kBAAkB,EAAE,EAAEf,SAAS,GAAG,MAAMC,QAAQC,GAAG,CAAC;gBAAC,MAAM,CAAC;gBAAuBN;aAAU;YACtG,OAAOmB,mBAAmBf,SAASI,2BAA2B,IAAIU;QACpE;IACF,GACA;QAAEpB,UAAUf;IAAmB;IAEjCX,0BACE;QACE0C,IAAIzB;QACJ0B,OAAO;QACPC,QACE;QACFC,KAAK,OAAOC;YACV,MAAM,CAAC,EAAEE,kBAAkB,EAAE,EAAEhB,SAAS,GAAG,MAAMC,QAAQC,GAAG,CAAC;gBAAC,MAAM,CAAC;gBAAuBN;aAAU;YACtG,OAAOoB,mBAAmBhB,SAASI,2BAA2B,IAAIU;QACpE;IACF,GACA;QAAEpB,UAAUf;IAAmB;IAEjC,gEAAgE;IAChE,uEAAuE;IACvE,oDAAoD;IACpDH,+BAA+BW,sCAAsC8B,4BAA4B;QAC/FvB,UAAUf;IACZ;AACF;AAEA;;;CAGC,GACD,SAASsC;IACP,MAAMC,OAAO;QACX,MAAM,CAAC,EAAEC,0CAA0C,EAAE,EAAE,EAAEC,4BAA4B,EAAE,CAAC,GAAG,MAAMnB,QAAQC,GAAG,CAAC;YAC3G,MAAM,CAAC;YACP,MAAM,CAAC;SACR;QACD,OAAOiB,2CAA2CC;IACpD;IACA,OAAO;QACLC,WAAWnC;QACXoC,UAAUC;QACVC,QAAQ,OAAOC,MAAQ,AAAC,CAAA,MAAMP,MAAK,EAAGM,MAAM,CAACC;QAC7CC,OAAO,OAAOD,KAAKE,UAAY,AAAC,CAAA,MAAMT,MAAK,EAAGQ,KAAK,CAACD,KAAKE;QACzDC,UAAU,OAAOH,KAAKI,QAAQC,UAAUH,UAAY,AAAC,CAAA,MAAMT,MAAK,EAAGU,QAAQ,CAACH,KAAKI,QAAQC,UAAUH;QACnGI,QAAQ,OAAON,KAAKO,WAAa,AAAC,CAAA,MAAMd,MAAK,EAAGa,MAAM,CAACN,KAAKO;QAC5DC,MAAM,OAAOR,KAAKS,QAAU,AAAC,CAAA,MAAMhB,MAAK,EAAGe,IAAI,CAACR,KAAKS;QACrDC,aAAa,OAAOV,MAAQ,AAAC,CAAA,MAAMP,MAAK,EAAGiB,WAAW,CAACV;QACvDW,OAAO,OAAOX,KAAKY,OAAOC,SAAW,AAAC,CAAA,MAAMpB,MAAK,EAAGkB,KAAK,CAACX,KAAKY,OAAOC;QACtEC,QAAQ,OAAOd,KAAKe,UAAUC,YAAc,AAAC,CAAA,MAAMvB,MAAK,EAAGqB,MAAM,CAACd,KAAKe,UAAUC;IACnF;AACF;AAEA;;;CAGC,GACD,MAAMlB,2BAA4E,OAAOmB,SAASC,SAChG,AAAC,CAAA,MAAM,MAAM,CAAC,0BAAsB,EAAGpB,wBAAwB,CAACmB,SAASC;AAE3E,gGAAgG,GAChG,MAAMC,mBAAmB,UAAY,AAAC,CAAA,MAAM,MAAM,CAAC,yCAAqC,EAAGC,8BAA8B;AAEzH;;;;CAIC,GACD,SAASxD;IACPb,+BACEK,iCACA;QACEiE,OAAO,OAAOrB,MAAQ,AAAC,CAAA,MAAMmB,kBAAiB,EAAGE,KAAK,CAACrB;QACvDsB,cAAc,CAACC,OAASlE,6BAA6BkE;QACrDC,UAAU,CAACD,MAAME,QAAUnE,yBAAyBiE,MAAwCE;QAC5FC,WAAW,OAAO1B,KAAK2B,MAAQ,AAAC,CAAA,MAAMR,kBAAiB,EAAGO,SAAS,CAAC1B,KAAK2B;QACzEC,YAAY,OAAO5B,KAAKqB,OAAOR,SAAW,AAAC,CAAA,MAAMM,kBAAiB,EAAGS,UAAU,CAAC5B,KAAKqB,OAAgBR;QACrGgB,aAAa,OAAO7B,KAAK8B,QAAU,AAAC,CAAA,MAAMX,kBAAiB,EAAGU,WAAW,CAAC7B,KAAK8B;QAC/EC,UAAU,OAAO/B,KAAKgC,QAAU,AAAC,CAAA,MAAMb,kBAAiB,EAAGY,QAAQ,CAAC/B,KAAKgC;QACzEC,kBAAkB,OAAOjC,KAAKkC,QAAU,AAAC,CAAA,MAAMf,kBAAiB,EAAGc,gBAAgB,CAACjC,KAAKkC;QACzFC,OAAOhF;QACP0C,UAAUC;IACZ,GACA;QAAE7B,UAAUf;IAAmB;AAEnC;AAEA,8EAA8E,GAC9E,MAAMiB,UAAU,IAAM,MAAM,CAAC"}

package/src/lib/engine/click-tracking.js

@@ -27,7 +27,7 @@
  * an HTML part. Giving cold one-to-one email a multipart HTML body is the
  * deliverability posture this plugin was built to avoid, so opens are not
  * measured at all — and the report SAYS SO rather than rendering 0%, exactly
- * as `campaign-report.ts` withholds a rate whose denominator was never
+ * as `send-report.ts` withholds a rate whose denominator was never
  * recorded. A zero that could only ever have been zero measures our sending
  * code, not the recipient.
  *

package/src/lib/engine/click-tracking.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/engine/click-tracking.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * CLICKS, IN A PLAIN-TEXT EMAIL (AGL-3239).\n *\n * A marketing campaign gets its opens and clicks from Resend, which rewrites\n * the links and injects a pixel into the HTML part before the message leaves.\n * A sequence has neither half of that: it goes out through the rep's own\n * Gmail, and it goes out as plain text on purpose.\n *\n * ## Why there is no open rate here, and never a zero one\n *\n * An open is measured by a pixel, a pixel is an `<img>`, and an `<img>` needs\n * an HTML part. Giving cold one-to-one email a multipart HTML body is the\n * deliverability posture this plugin was built to avoid, so opens are not\n * measured at all — and the report SAYS SO rather than rendering 0%, exactly\n * as `campaign-report.ts` withholds a rate whose denominator was never\n * recorded. A zero that could only ever have been zero measures our sending\n * code, not the recipient.\n *\n * A click needs no HTML. It needs the destination in the body to be a link of\n * ours that forwards to theirs, which is what this module writes.\n *\n * ## What it will and will not rewrite\n *\n * Only bare `http:`/`https:` URLs, and only in the STEP'S OWN BODY — the\n * rewrite runs on the rendered body before the footer is appended, so the\n * organization's legal name, its postal address and the way out are never\n * touched. `mailto:` is left alone: the opt-out address is the one link in a\n * cold email that must not route through us.\n *==========================================*/\n\n/**\n * A URL as it appears in a plain-text body, with where it was found.\n *\n * `end` is exclusive, so `text.slice(start, end)` is exactly `url`.\n */\nexport interface OutreachBodyLink {\n  url: string\n  start: number\n  end: number\n}\n\n/**\n * Trailing characters a sentence puts after a URL that are not part of it.\n *\n * A plain-text body is prose, so a link is routinely followed by a full stop,\n * a comma or a closing bracket. Taking those into the URL would rewrite a\n * destination nobody wrote and forward the recipient to a 404.\n */\nconst TRAILING_PUNCTUATION = /[.,;:!?'\"]+$/\n\n/**\n * A bare http(s) URL, up to the first whitespace or bracket that never\n * belongs in one.\n *\n * `(` and `)` are NOT excluded, because a real path can contain them — a\n * Wikipedia article is the everyday example — and {@link trimUrlEnd}\n * decides which trailing one is the URL's and which is the sentence's.\n */\nconst URL_PATTERN = /https?:\\/\\/[^\\s<>[\\]{}\"']+/gi\n\n/**\n * Trims what the sentence put after the URL, not what the URL contains.\n *\n * A closing bracket is the URL's when the URL opened one, and the\n * sentence's when it did not — which is the usual case, a link inside a\n * parenthetical. Counted rather than merely looked for, so a link that is\n * both parenthesised AND contains brackets loses exactly the outer one.\n */\nfunction trimUrlEnd(raw: string): string {\n  let url = raw.replace(TRAILING_PUNCTUATION, '')\n  while (url.endsWith(')')) {\n    const opened = url.split('(').length - 1\n    const closed = url.split(')').length - 1\n    if (closed <= opened) break\n    url = url.slice(0, -1).replace(TRAILING_PUNCTUATION, '')\n  }\n  return url\n}\n\n/**\n * Every http(s) URL in a plain-text body, in the order they appear.\n *\n * Duplicates are returned as the separate occurrences they are: the same\n * destination written twice is two links to rewrite, and each gets its own\n * index so a click says which one was followed.\n */\nexport function outreachBodyLinks(text: string): OutreachBodyLink[] {\n  const body = String(text ?? '')\n  const links: OutreachBodyLink[] = []\n  for (const match of body.matchAll(URL_PATTERN)) {\n    const start = match.index ?? 0\n    const url = trimUrlEnd(match[0])\n    if (!url) continue\n    let parsed: URL\n    try {\n      parsed = new URL(url)\n    } catch {\n      continue\n    }\n    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') continue\n    links.push({ url, start, end: start + url.length })\n  }\n  return links\n}\n\n/** What {@link rewriteOutreachBodyLinks} produced. */\nexport interface OutreachRewrittenBody {\n  text: string\n  /**\n   * The destinations that were rewritten, in the order their tracking links\n   * were minted — the index a click token names.\n   *\n   * Empty when nothing was rewritten, which is what a body with no links, a\n   * sequence with tracking off, and a minter that could not sign all read as.\n   */\n  links: string[]\n}\n\n/**\n * Rewrites every link in a plain-text body to a tracking link.\n *\n * @param text The rendered step body, footer NOT yet appended.\n * @param mint Answers the tracking URL for the link at `index`, or `null` to\n *   leave that one alone. A minter that cannot sign returns `null` for every\n *   link and the body goes out exactly as it was written — an email whose\n *   links do not work is far worse than an email we cannot measure.\n */\nexport function rewriteOutreachBodyLinks(\n  text: string,\n  mint: (link: { url: string; index: number }) => string | null,\n): OutreachRewrittenBody {\n  const body = String(text ?? '')\n  const found = outreachBodyLinks(body)\n  if (!found.length) return { text: body, links: [] }\n  const links: string[] = []\n  let out = ''\n  let cursor = 0\n  for (const link of found) {\n    // The index a token carries is the index in `links`, which counts only\n    // the links that were actually rewritten. A minter that skips one must\n    // not shift the numbering of the ones after it.\n    const tracked = mint({ url: link.url, index: links.length })\n    out += body.slice(cursor, link.start)\n    if (tracked) {\n      out += tracked\n      links.push(link.url)\n    } else {\n      out += link.url\n    }\n    cursor = link.end\n  }\n  return { text: out + body.slice(cursor), links }\n}\n\n/*==========================================\n * WHO CLICKED: A PERSON, OR A MACHINE.\n *\n * Every corporate mailbox now runs the links in an incoming email before the\n * recipient ever sees it — Microsoft Defender's Safe Links, Proofpoint,\n * Mimecast, Barracuda, and Gmail's own scanning. Each of those fetches is a\n * click by any definition a redirect handler can apply, and on cold B2B mail\n * they outnumber the human ones.\n *\n * Counting them is how a sequence reports a 60% click rate on an email\n * nobody read. So they are counted APART: `clicks` and `uniqueClicks` are\n * the human ones and carry the rate, `machineClicks` is kept beside them and\n * shown, because a number withheld silently is the other way to mislead.\n *\n * This is the same judgement `campaign-revenue.ts` records about Apple's Mail\n * Privacy Protection inflating opens — stated on the screen rather than\n * quietly corrected away.\n *==========================================*/\n\n/**\n * How soon after a send a click is a machine's however it identifies itself.\n *\n * A scanner fetches as the message is delivered. A person has to receive the\n * mail, notice it and read it, and thirty seconds is faster than anyone does\n * that on a cold email — while being long enough to stay wrong only in the\n * rarest case, which is a rate that reads a little low rather than a rate\n * that reads triple.\n */\nexport const OUTREACH_CLICK_HUMAN_DELAY_MS = 30_000\n\n/**\n * Agents that say what they are. Matched case-insensitively as substrings of\n * the user agent, so a version bump does not un-match one.\n *\n * Absence from this list is not evidence of a person — most scanners\n * impersonate a browser, which is what {@link OUTREACH_CLICK_HUMAN_DELAY_MS}\n * is for.\n */\nexport const OUTREACH_MACHINE_AGENTS: readonly string[] = [\n  'bot',\n  'crawler',\n  'spider',\n  'slurp',\n  'preview',\n  'scanner',\n  'curl',\n  'wget',\n  'python-requests',\n  'java/',\n  'go-http-client',\n  'okhttp',\n  'headlesschrome',\n  'phantomjs',\n  'proofpoint',\n  'mimecast',\n  'barracuda',\n  'symantec',\n  'forcepoint',\n  'microsoft office',\n  'ms-office',\n  'bingpreview',\n  'skypeuripreview',\n  'google-safety',\n  'googleimageproxy',\n  'apache-httpclient',\n  'axios',\n  'node-fetch',\n  'urlresolver',\n  'safelinks',\n]\n\n/** Why a click was read as a machine's, or `null` when it was a person's. */\nexport type OutreachClickMachineReason = 'agent' | 'too_soon' | 'method'\n\n/** What one request to a tracking link was. */\nexport interface OutreachClickJudgement {\n  /** Whether it counts toward the click rate. */\n  human: boolean\n  /** Why it does not; `null` when it does. */\n  machineReason: OutreachClickMachineReason | null\n}\n\n/**\n * Whether one request to a tracking link is a person's.\n *\n * Read before the redirect is *recorded*, never before it is *answered*: a\n * machine is forwarded to the destination exactly as a person is, because a\n * scanner that gets a refusal reports the link as broken and the mail as\n * suspicious.\n *\n * @param input.method The HTTP method. A `HEAD` is a fetch of the headers\n *   alone, which no mail client does for a person following a link.\n * @param input.userAgent The request's agent, `''` when it sent none — which\n *   is itself a machine, since every browser sends one.\n * @param input.sinceSentMs Milliseconds between the send and this request,\n *   or `null` when the send it belongs to could not be found.\n */\nexport function judgeOutreachClick(input: {\n  method: string\n  userAgent: string | null | undefined\n  sinceSentMs: number | null\n}): OutreachClickJudgement {\n  const machine = (machineReason: OutreachClickMachineReason): OutreachClickJudgement => ({\n    human: false,\n    machineReason,\n  })\n  if (String(input.method ?? '').toUpperCase() === 'HEAD') return machine('method')\n  const agent = String(input.userAgent ?? '').trim().toLowerCase()\n  if (!agent) return machine('agent')\n  if (OUTREACH_MACHINE_AGENTS.some((needle) => agent.includes(needle))) return machine('agent')\n  /*\n   * A click that arrives BEFORE the send it belongs to is a clock disagreeing\n   * with itself, not a time traveller, and it is read as a person's: the one\n   * thing worse than counting a scanner is refusing to count a real reply to\n   * an email because two machines are a second apart.\n   */\n  if (input.sinceSentMs !== null && input.sinceSentMs >= 0 && input.sinceSentMs < OUTREACH_CLICK_HUMAN_DELAY_MS) {\n    return machine('too_soon')\n  }\n  return { human: true, machineReason: null }\n}\n"],"names":["TRAILING_PUNCTUATION","URL_PATTERN","trimUrlEnd","raw","url","replace","endsWith","opened","split","length","closed","slice","outreachBodyLinks","text","body","String","links","match","matchAll","start","index","parsed","URL","protocol","push","end","rewriteOutreachBodyLinks","mint","found","out","cursor","link","tracked","OUTREACH_CLICK_HUMAN_DELAY_MS","OUTREACH_MACHINE_AGENTS","judgeOutreachClick","input","machine","machineReason","human","method","toUpperCase","agent","userAgent","trim","toLowerCase","some","needle","includes","sinceSentMs"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;4CA4B4C,GAE5C;;;;CAIC,GAOD;;;;;;CAMC,GACD,MAAMA,uBAAuB;AAE7B;;;;;;;CAOC,GACD,MAAMC,cAAc;AAEpB;;;;;;;CAOC,GACD,SAASC,WAAWC,GAAW;IAC7B,IAAIC,MAAMD,IAAIE,OAAO,CAACL,sBAAsB;IAC5C,MAAOI,IAAIE,QAAQ,CAAC,KAAM;QACxB,MAAMC,SAASH,IAAII,KAAK,CAAC,KAAKC,MAAM,GAAG;QACvC,MAAMC,SAASN,IAAII,KAAK,CAAC,KAAKC,MAAM,GAAG;QACvC,IAAIC,UAAUH,QAAQ;QACtBH,MAAMA,IAAIO,KAAK,CAAC,GAAG,CAAC,GAAGN,OAAO,CAACL,sBAAsB;IACvD;IACA,OAAOI;AACT;AAEA;;;;;;CAMC,GACD,OAAO,SAASQ,kBAAkBC,IAAY;IAC5C,MAAMC,OAAOC,OAAOF,eAAAA,OAAQ;IAC5B,MAAMG,QAA4B,EAAE;IACpC,KAAK,MAAMC,SAASH,KAAKI,QAAQ,CAACjB,aAAc;YAChCgB;QAAd,MAAME,SAAQF,eAAAA,MAAMG,KAAK,YAAXH,eAAe;QAC7B,MAAMb,MAAMF,WAAWe,KAAK,CAAC,EAAE;QAC/B,IAAI,CAACb,KAAK;QACV,IAAIiB;QACJ,IAAI;YACFA,SAAS,IAAIC,IAAIlB;QACnB,EAAE,eAAM;YACN;QACF;QACA,IAAIiB,OAAOE,QAAQ,KAAK,WAAWF,OAAOE,QAAQ,KAAK,UAAU;QACjEP,MAAMQ,IAAI,CAAC;YAAEpB;YAAKe;YAAOM,KAAKN,QAAQf,IAAIK,MAAM;QAAC;IACnD;IACA,OAAOO;AACT;AAeA;;;;;;;;CAQC,GACD,OAAO,SAASU,yBACdb,IAAY,EACZc,IAA6D;IAE7D,MAAMb,OAAOC,OAAOF,eAAAA,OAAQ;IAC5B,MAAMe,QAAQhB,kBAAkBE;IAChC,IAAI,CAACc,MAAMnB,MAAM,EAAE,OAAO;QAAEI,MAAMC;QAAME,OAAO,EAAE;IAAC;IAClD,MAAMA,QAAkB,EAAE;IAC1B,IAAIa,MAAM;IACV,IAAIC,SAAS;IACb,KAAK,MAAMC,QAAQH,MAAO;QACxB,uEAAuE;QACvE,uEAAuE;QACvE,gDAAgD;QAChD,MAAMI,UAAUL,KAAK;YAAEvB,KAAK2B,KAAK3B,GAAG;YAAEgB,OAAOJ,MAAMP,MAAM;QAAC;QAC1DoB,OAAOf,KAAKH,KAAK,CAACmB,QAAQC,KAAKZ,KAAK;QACpC,IAAIa,SAAS;YACXH,OAAOG;YACPhB,MAAMQ,IAAI,CAACO,KAAK3B,GAAG;QACrB,OAAO;YACLyB,OAAOE,KAAK3B,GAAG;QACjB;QACA0B,SAASC,KAAKN,GAAG;IACnB;IACA,OAAO;QAAEZ,MAAMgB,MAAMf,KAAKH,KAAK,CAACmB;QAASd;IAAM;AACjD;AAEA;;;;;;;;;;;;;;;;;4CAiB4C,GAE5C;;;;;;;;CAQC,GACD,OAAO,MAAMiB,gCAAgC,MAAM;AAEnD;;;;;;;CAOC,GACD,OAAO,MAAMC,0BAA6C;IACxD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAaD;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASC,mBAAmBC,KAIlC;QAKYA,eACUA;IALrB,MAAMC,UAAU,CAACC,gBAAuE,CAAA;YACtFC,OAAO;YACPD;QACF,CAAA;IACA,IAAIvB,QAAOqB,gBAAAA,MAAMI,MAAM,YAAZJ,gBAAgB,IAAIK,WAAW,OAAO,QAAQ,OAAOJ,QAAQ;IACxE,MAAMK,QAAQ3B,QAAOqB,mBAAAA,MAAMO,SAAS,YAAfP,mBAAmB,IAAIQ,IAAI,GAAGC,WAAW;IAC9D,IAAI,CAACH,OAAO,OAAOL,QAAQ;IAC3B,IAAIH,wBAAwBY,IAAI,CAAC,CAACC,SAAWL,MAAMM,QAAQ,CAACD,UAAU,OAAOV,QAAQ;IACrF;;;;;GAKC,GACD,IAAID,MAAMa,WAAW,KAAK,QAAQb,MAAMa,WAAW,IAAI,KAAKb,MAAMa,WAAW,GAAGhB,+BAA+B;QAC7G,OAAOI,QAAQ;IACjB;IACA,OAAO;QAAEE,OAAO;QAAMD,eAAe;IAAK;AAC5C"}
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/engine/click-tracking.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * CLICKS, IN A PLAIN-TEXT EMAIL (AGL-3239).\n *\n * A marketing campaign gets its opens and clicks from Resend, which rewrites\n * the links and injects a pixel into the HTML part before the message leaves.\n * A sequence has neither half of that: it goes out through the rep's own\n * Gmail, and it goes out as plain text on purpose.\n *\n * ## Why there is no open rate here, and never a zero one\n *\n * An open is measured by a pixel, a pixel is an `<img>`, and an `<img>` needs\n * an HTML part. Giving cold one-to-one email a multipart HTML body is the\n * deliverability posture this plugin was built to avoid, so opens are not\n * measured at all — and the report SAYS SO rather than rendering 0%, exactly\n * as `send-report.ts` withholds a rate whose denominator was never\n * recorded. A zero that could only ever have been zero measures our sending\n * code, not the recipient.\n *\n * A click needs no HTML. It needs the destination in the body to be a link of\n * ours that forwards to theirs, which is what this module writes.\n *\n * ## What it will and will not rewrite\n *\n * Only bare `http:`/`https:` URLs, and only in the STEP'S OWN BODY — the\n * rewrite runs on the rendered body before the footer is appended, so the\n * organization's legal name, its postal address and the way out are never\n * touched. `mailto:` is left alone: the opt-out address is the one link in a\n * cold email that must not route through us.\n *==========================================*/\n\n/**\n * A URL as it appears in a plain-text body, with where it was found.\n *\n * `end` is exclusive, so `text.slice(start, end)` is exactly `url`.\n */\nexport interface OutreachBodyLink {\n  url: string\n  start: number\n  end: number\n}\n\n/**\n * Trailing characters a sentence puts after a URL that are not part of it.\n *\n * A plain-text body is prose, so a link is routinely followed by a full stop,\n * a comma or a closing bracket. Taking those into the URL would rewrite a\n * destination nobody wrote and forward the recipient to a 404.\n */\nconst TRAILING_PUNCTUATION = /[.,;:!?'\"]+$/\n\n/**\n * A bare http(s) URL, up to the first whitespace or bracket that never\n * belongs in one.\n *\n * `(` and `)` are NOT excluded, because a real path can contain them — a\n * Wikipedia article is the everyday example — and {@link trimUrlEnd}\n * decides which trailing one is the URL's and which is the sentence's.\n */\nconst URL_PATTERN = /https?:\\/\\/[^\\s<>[\\]{}\"']+/gi\n\n/**\n * Trims what the sentence put after the URL, not what the URL contains.\n *\n * A closing bracket is the URL's when the URL opened one, and the\n * sentence's when it did not — which is the usual case, a link inside a\n * parenthetical. Counted rather than merely looked for, so a link that is\n * both parenthesised AND contains brackets loses exactly the outer one.\n */\nfunction trimUrlEnd(raw: string): string {\n  let url = raw.replace(TRAILING_PUNCTUATION, '')\n  while (url.endsWith(')')) {\n    const opened = url.split('(').length - 1\n    const closed = url.split(')').length - 1\n    if (closed <= opened) break\n    url = url.slice(0, -1).replace(TRAILING_PUNCTUATION, '')\n  }\n  return url\n}\n\n/**\n * Every http(s) URL in a plain-text body, in the order they appear.\n *\n * Duplicates are returned as the separate occurrences they are: the same\n * destination written twice is two links to rewrite, and each gets its own\n * index so a click says which one was followed.\n */\nexport function outreachBodyLinks(text: string): OutreachBodyLink[] {\n  const body = String(text ?? '')\n  const links: OutreachBodyLink[] = []\n  for (const match of body.matchAll(URL_PATTERN)) {\n    const start = match.index ?? 0\n    const url = trimUrlEnd(match[0])\n    if (!url) continue\n    let parsed: URL\n    try {\n      parsed = new URL(url)\n    } catch {\n      continue\n    }\n    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') continue\n    links.push({ url, start, end: start + url.length })\n  }\n  return links\n}\n\n/** What {@link rewriteOutreachBodyLinks} produced. */\nexport interface OutreachRewrittenBody {\n  text: string\n  /**\n   * The destinations that were rewritten, in the order their tracking links\n   * were minted — the index a click token names.\n   *\n   * Empty when nothing was rewritten, which is what a body with no links, a\n   * sequence with tracking off, and a minter that could not sign all read as.\n   */\n  links: string[]\n}\n\n/**\n * Rewrites every link in a plain-text body to a tracking link.\n *\n * @param text The rendered step body, footer NOT yet appended.\n * @param mint Answers the tracking URL for the link at `index`, or `null` to\n *   leave that one alone. A minter that cannot sign returns `null` for every\n *   link and the body goes out exactly as it was written — an email whose\n *   links do not work is far worse than an email we cannot measure.\n */\nexport function rewriteOutreachBodyLinks(\n  text: string,\n  mint: (link: { url: string; index: number }) => string | null,\n): OutreachRewrittenBody {\n  const body = String(text ?? '')\n  const found = outreachBodyLinks(body)\n  if (!found.length) return { text: body, links: [] }\n  const links: string[] = []\n  let out = ''\n  let cursor = 0\n  for (const link of found) {\n    // The index a token carries is the index in `links`, which counts only\n    // the links that were actually rewritten. A minter that skips one must\n    // not shift the numbering of the ones after it.\n    const tracked = mint({ url: link.url, index: links.length })\n    out += body.slice(cursor, link.start)\n    if (tracked) {\n      out += tracked\n      links.push(link.url)\n    } else {\n      out += link.url\n    }\n    cursor = link.end\n  }\n  return { text: out + body.slice(cursor), links }\n}\n\n/*==========================================\n * WHO CLICKED: A PERSON, OR A MACHINE.\n *\n * Every corporate mailbox now runs the links in an incoming email before the\n * recipient ever sees it — Microsoft Defender's Safe Links, Proofpoint,\n * Mimecast, Barracuda, and Gmail's own scanning. Each of those fetches is a\n * click by any definition a redirect handler can apply, and on cold B2B mail\n * they outnumber the human ones.\n *\n * Counting them is how a sequence reports a 60% click rate on an email\n * nobody read. So they are counted APART: `clicks` and `uniqueClicks` are\n * the human ones and carry the rate, `machineClicks` is kept beside them and\n * shown, because a number withheld silently is the other way to mislead.\n *\n * This is the same judgement `campaign-revenue.ts` records about Apple's Mail\n * Privacy Protection inflating opens — stated on the screen rather than\n * quietly corrected away.\n *==========================================*/\n\n/**\n * How soon after a send a click is a machine's however it identifies itself.\n *\n * A scanner fetches as the message is delivered. A person has to receive the\n * mail, notice it and read it, and thirty seconds is faster than anyone does\n * that on a cold email — while being long enough to stay wrong only in the\n * rarest case, which is a rate that reads a little low rather than a rate\n * that reads triple.\n */\nexport const OUTREACH_CLICK_HUMAN_DELAY_MS = 30_000\n\n/**\n * Agents that say what they are. Matched case-insensitively as substrings of\n * the user agent, so a version bump does not un-match one.\n *\n * Absence from this list is not evidence of a person — most scanners\n * impersonate a browser, which is what {@link OUTREACH_CLICK_HUMAN_DELAY_MS}\n * is for.\n */\nexport const OUTREACH_MACHINE_AGENTS: readonly string[] = [\n  'bot',\n  'crawler',\n  'spider',\n  'slurp',\n  'preview',\n  'scanner',\n  'curl',\n  'wget',\n  'python-requests',\n  'java/',\n  'go-http-client',\n  'okhttp',\n  'headlesschrome',\n  'phantomjs',\n  'proofpoint',\n  'mimecast',\n  'barracuda',\n  'symantec',\n  'forcepoint',\n  'microsoft office',\n  'ms-office',\n  'bingpreview',\n  'skypeuripreview',\n  'google-safety',\n  'googleimageproxy',\n  'apache-httpclient',\n  'axios',\n  'node-fetch',\n  'urlresolver',\n  'safelinks',\n]\n\n/** Why a click was read as a machine's, or `null` when it was a person's. */\nexport type OutreachClickMachineReason = 'agent' | 'too_soon' | 'method'\n\n/** What one request to a tracking link was. */\nexport interface OutreachClickJudgement {\n  /** Whether it counts toward the click rate. */\n  human: boolean\n  /** Why it does not; `null` when it does. */\n  machineReason: OutreachClickMachineReason | null\n}\n\n/**\n * Whether one request to a tracking link is a person's.\n *\n * Read before the redirect is *recorded*, never before it is *answered*: a\n * machine is forwarded to the destination exactly as a person is, because a\n * scanner that gets a refusal reports the link as broken and the mail as\n * suspicious.\n *\n * @param input.method The HTTP method. A `HEAD` is a fetch of the headers\n *   alone, which no mail client does for a person following a link.\n * @param input.userAgent The request's agent, `''` when it sent none — which\n *   is itself a machine, since every browser sends one.\n * @param input.sinceSentMs Milliseconds between the send and this request,\n *   or `null` when the send it belongs to could not be found.\n */\nexport function judgeOutreachClick(input: {\n  method: string\n  userAgent: string | null | undefined\n  sinceSentMs: number | null\n}): OutreachClickJudgement {\n  const machine = (machineReason: OutreachClickMachineReason): OutreachClickJudgement => ({\n    human: false,\n    machineReason,\n  })\n  if (String(input.method ?? '').toUpperCase() === 'HEAD') return machine('method')\n  const agent = String(input.userAgent ?? '').trim().toLowerCase()\n  if (!agent) return machine('agent')\n  if (OUTREACH_MACHINE_AGENTS.some((needle) => agent.includes(needle))) return machine('agent')\n  /*\n   * A click that arrives BEFORE the send it belongs to is a clock disagreeing\n   * with itself, not a time traveller, and it is read as a person's: the one\n   * thing worse than counting a scanner is refusing to count a real reply to\n   * an email because two machines are a second apart.\n   */\n  if (input.sinceSentMs !== null && input.sinceSentMs >= 0 && input.sinceSentMs < OUTREACH_CLICK_HUMAN_DELAY_MS) {\n    return machine('too_soon')\n  }\n  return { human: true, machineReason: null }\n}\n"],"names":["TRAILING_PUNCTUATION","URL_PATTERN","trimUrlEnd","raw","url","replace","endsWith","opened","split","length","closed","slice","outreachBodyLinks","text","body","String","links","match","matchAll","start","index","parsed","URL","protocol","push","end","rewriteOutreachBodyLinks","mint","found","out","cursor","link","tracked","OUTREACH_CLICK_HUMAN_DELAY_MS","OUTREACH_MACHINE_AGENTS","judgeOutreachClick","input","machine","machineReason","human","method","toUpperCase","agent","userAgent","trim","toLowerCase","some","needle","includes","sinceSentMs"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;4CA4B4C,GAE5C;;;;CAIC,GAOD;;;;;;CAMC,GACD,MAAMA,uBAAuB;AAE7B;;;;;;;CAOC,GACD,MAAMC,cAAc;AAEpB;;;;;;;CAOC,GACD,SAASC,WAAWC,GAAW;IAC7B,IAAIC,MAAMD,IAAIE,OAAO,CAACL,sBAAsB;IAC5C,MAAOI,IAAIE,QAAQ,CAAC,KAAM;QACxB,MAAMC,SAASH,IAAII,KAAK,CAAC,KAAKC,MAAM,GAAG;QACvC,MAAMC,SAASN,IAAII,KAAK,CAAC,KAAKC,MAAM,GAAG;QACvC,IAAIC,UAAUH,QAAQ;QACtBH,MAAMA,IAAIO,KAAK,CAAC,GAAG,CAAC,GAAGN,OAAO,CAACL,sBAAsB;IACvD;IACA,OAAOI;AACT;AAEA;;;;;;CAMC,GACD,OAAO,SAASQ,kBAAkBC,IAAY;IAC5C,MAAMC,OAAOC,OAAOF,eAAAA,OAAQ;IAC5B,MAAMG,QAA4B,EAAE;IACpC,KAAK,MAAMC,SAASH,KAAKI,QAAQ,CAACjB,aAAc;YAChCgB;QAAd,MAAME,SAAQF,eAAAA,MAAMG,KAAK,YAAXH,eAAe;QAC7B,MAAMb,MAAMF,WAAWe,KAAK,CAAC,EAAE;QAC/B,IAAI,CAACb,KAAK;QACV,IAAIiB;QACJ,IAAI;YACFA,SAAS,IAAIC,IAAIlB;QACnB,EAAE,eAAM;YACN;QACF;QACA,IAAIiB,OAAOE,QAAQ,KAAK,WAAWF,OAAOE,QAAQ,KAAK,UAAU;QACjEP,MAAMQ,IAAI,CAAC;YAAEpB;YAAKe;YAAOM,KAAKN,QAAQf,IAAIK,MAAM;QAAC;IACnD;IACA,OAAOO;AACT;AAeA;;;;;;;;CAQC,GACD,OAAO,SAASU,yBACdb,IAAY,EACZc,IAA6D;IAE7D,MAAMb,OAAOC,OAAOF,eAAAA,OAAQ;IAC5B,MAAMe,QAAQhB,kBAAkBE;IAChC,IAAI,CAACc,MAAMnB,MAAM,EAAE,OAAO;QAAEI,MAAMC;QAAME,OAAO,EAAE;IAAC;IAClD,MAAMA,QAAkB,EAAE;IAC1B,IAAIa,MAAM;IACV,IAAIC,SAAS;IACb,KAAK,MAAMC,QAAQH,MAAO;QACxB,uEAAuE;QACvE,uEAAuE;QACvE,gDAAgD;QAChD,MAAMI,UAAUL,KAAK;YAAEvB,KAAK2B,KAAK3B,GAAG;YAAEgB,OAAOJ,MAAMP,MAAM;QAAC;QAC1DoB,OAAOf,KAAKH,KAAK,CAACmB,QAAQC,KAAKZ,KAAK;QACpC,IAAIa,SAAS;YACXH,OAAOG;YACPhB,MAAMQ,IAAI,CAACO,KAAK3B,GAAG;QACrB,OAAO;YACLyB,OAAOE,KAAK3B,GAAG;QACjB;QACA0B,SAASC,KAAKN,GAAG;IACnB;IACA,OAAO;QAAEZ,MAAMgB,MAAMf,KAAKH,KAAK,CAACmB;QAASd;IAAM;AACjD;AAEA;;;;;;;;;;;;;;;;;4CAiB4C,GAE5C;;;;;;;;CAQC,GACD,OAAO,MAAMiB,gCAAgC,MAAM;AAEnD;;;;;;;CAOC,GACD,OAAO,MAAMC,0BAA6C;IACxD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAaD;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASC,mBAAmBC,KAIlC;QAKYA,eACUA;IALrB,MAAMC,UAAU,CAACC,gBAAuE,CAAA;YACtFC,OAAO;YACPD;QACF,CAAA;IACA,IAAIvB,QAAOqB,gBAAAA,MAAMI,MAAM,YAAZJ,gBAAgB,IAAIK,WAAW,OAAO,QAAQ,OAAOJ,QAAQ;IACxE,MAAMK,QAAQ3B,QAAOqB,mBAAAA,MAAMO,SAAS,YAAfP,mBAAmB,IAAIQ,IAAI,GAAGC,WAAW;IAC9D,IAAI,CAACH,OAAO,OAAOL,QAAQ;IAC3B,IAAIH,wBAAwBY,IAAI,CAAC,CAACC,SAAWL,MAAMM,QAAQ,CAACD,UAAU,OAAOV,QAAQ;IACrF;;;;;GAKC,GACD,IAAID,MAAMa,WAAW,KAAK,QAAQb,MAAMa,WAAW,IAAI,KAAKb,MAAMa,WAAW,GAAGhB,+BAA+B;QAC7G,OAAOI,QAAQ;IACjB;IACA,OAAO;QAAEE,OAAO;QAAMD,eAAe;IAAK;AAC5C"}

package/src/lib/engine/ip-range.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** A parsed block, so a list of them is read once rather than per address. */
+export interface OutreachIpBlock {
+    network: bigint;
+    prefix: number;
+    bits: 32 | 128;
+}
+/** A block from its `address/prefix` text; throws on one that is not, since the lists are hard-coded. */
+export declare function outreachIpBlock(cidr: string): OutreachIpBlock;
+/** Whether `address` is inside any of `blocks`; `false` for an address that is not one. */
+export declare function outreachIpInBlocks(address: string | null | undefined, blocks: readonly OutreachIpBlock[]): boolean;

package/src/lib/engine/ip-range.js

@@ -0,0 +1,78 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Whether an address falls inside a CIDR block, for IPv4 and IPv6 alike
+ * (AGL-3488). Small on purpose: the open judgement asks only "is this one of
+ * a mail provider's blocks?", over a handful of hard-coded ranges, and an
+ * address or a block it cannot read is simply not in it.
+ */ /** An address as a number and its width in bits, or `null` when it is not one. */ function parseAddress(raw) {
+    const text = raw.trim().toLowerCase();
+    if (!text) return null;
+    if (/^\d{1,3}(\.\d{1,3}){3}$/.test(text)) {
+        const parts = text.split('.').map(Number);
+        if (parts.some((part)=>part > 255)) return null;
+        return {
+            value: parts.reduce((total, part)=>total << 8n | BigInt(part), 0n),
+            bits: 32
+        };
+    }
+    if (!text.includes(':')) return null;
+    // An IPv4-mapped IPv6 address (`::ffff:1.2.3.4`) is the IPv4 address.
+    const mapped = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(text);
+    if (mapped) return parseAddress(mapped[1]);
+    const halves = text.split('::');
+    if (halves.length > 2) return null;
+    const groups = (half)=>half ? half.split(':') : [];
+    const head = groups(halves[0]);
+    const tail = halves.length === 2 ? groups(halves[1]) : [];
+    const missing = 8 - head.length - tail.length;
+    if (halves.length === 2 ? missing < 1 : missing !== 0) return null;
+    const all = [
+        ...head,
+        ...Array(halves.length === 2 ? missing : 0).fill('0'),
+        ...tail
+    ];
+    if (all.some((group)=>!/^[0-9a-f]{1,4}$/.test(group))) return null;
+    return {
+        value: all.reduce((total, group)=>total << 16n | BigInt(parseInt(group, 16)), 0n),
+        bits: 128
+    };
+}
+/** A block from its `address/prefix` text; throws on one that is not, since the lists are hard-coded. */ export function outreachIpBlock(cidr) {
+    const [address, prefixText] = cidr.split('/');
+    const parsed = parseAddress(address != null ? address : '');
+    const prefix = Number(prefixText);
+    if (!parsed || !Number.isInteger(prefix) || prefix < 0 || prefix > parsed.bits) {
+        throw new Error(`Not a CIDR block: ${cidr}`);
+    }
+    const shift = BigInt(parsed.bits - prefix);
+    return {
+        network: parsed.value >> shift << shift,
+        prefix,
+        bits: parsed.bits
+    };
+}
+/** Whether `address` is inside any of `blocks`; `false` for an address that is not one. */ export function outreachIpInBlocks(address, blocks) {
+    const parsed = parseAddress(String(address != null ? address : ''));
+    if (!parsed) return false;
+    return blocks.some((block)=>{
+        if (block.bits !== parsed.bits) return false;
+        const shift = BigInt(block.bits - block.prefix);
+        return parsed.value >> shift << shift === block.network;
+    });
+}
+
+//# sourceMappingURL=ip-range.js.map

package/src/lib/engine/ip-range.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/engine/ip-range.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Whether an address falls inside a CIDR block, for IPv4 and IPv6 alike\n * (AGL-3488). Small on purpose: the open judgement asks only \"is this one of\n * a mail provider's blocks?\", over a handful of hard-coded ranges, and an\n * address or a block it cannot read is simply not in it.\n */\n\n/** An address as a number and its width in bits, or `null` when it is not one. */\nfunction parseAddress(raw: string): { value: bigint; bits: 32 | 128 } | null {\n  const text = raw.trim().toLowerCase()\n  if (!text) return null\n  if (/^\\d{1,3}(\\.\\d{1,3}){3}$/.test(text)) {\n    const parts = text.split('.').map(Number)\n    if (parts.some((part) => part > 255)) return null\n    return { value: parts.reduce((total, part) => (total << 8n) | BigInt(part), 0n), bits: 32 }\n  }\n  if (!text.includes(':')) return null\n  // An IPv4-mapped IPv6 address (`::ffff:1.2.3.4`) is the IPv4 address.\n  const mapped = /^::ffff:(\\d{1,3}(?:\\.\\d{1,3}){3})$/.exec(text)\n  if (mapped) return parseAddress(mapped[1])\n  const halves = text.split('::')\n  if (halves.length > 2) return null\n  const groups = (half: string) => (half ? half.split(':') : [])\n  const head = groups(halves[0])\n  const tail = halves.length === 2 ? groups(halves[1]) : []\n  const missing = 8 - head.length - tail.length\n  if (halves.length === 2 ? missing < 1 : missing !== 0) return null\n  const all = [...head, ...Array<string>(halves.length === 2 ? missing : 0).fill('0'), ...tail]\n  if (all.some((group) => !/^[0-9a-f]{1,4}$/.test(group))) return null\n  return { value: all.reduce((total, group) => (total << 16n) | BigInt(parseInt(group, 16)), 0n), bits: 128 }\n}\n\n/** A parsed block, so a list of them is read once rather than per address. */\nexport interface OutreachIpBlock {\n  network: bigint\n  prefix: number\n  bits: 32 | 128\n}\n\n/** A block from its `address/prefix` text; throws on one that is not, since the lists are hard-coded. */\nexport function outreachIpBlock(cidr: string): OutreachIpBlock {\n  const [address, prefixText] = cidr.split('/')\n  const parsed = parseAddress(address ?? '')\n  const prefix = Number(prefixText)\n  if (!parsed || !Number.isInteger(prefix) || prefix < 0 || prefix > parsed.bits) {\n    throw new Error(`Not a CIDR block: ${cidr}`)\n  }\n  const shift = BigInt(parsed.bits - prefix)\n  return { network: (parsed.value >> shift) << shift, prefix, bits: parsed.bits }\n}\n\n/** Whether `address` is inside any of `blocks`; `false` for an address that is not one. */\nexport function outreachIpInBlocks(address: string | null | undefined, blocks: readonly OutreachIpBlock[]): boolean {\n  const parsed = parseAddress(String(address ?? ''))\n  if (!parsed) return false\n  return blocks.some((block) => {\n    if (block.bits !== parsed.bits) return false\n    const shift = BigInt(block.bits - block.prefix)\n    return (parsed.value >> shift) << shift === block.network\n  })\n}\n"],"names":["parseAddress","raw","text","trim","toLowerCase","test","parts","split","map","Number","some","part","value","reduce","total","BigInt","bits","includes","mapped","exec","halves","length","groups","half","head","tail","missing","all","Array","fill","group","parseInt","outreachIpBlock","cidr","address","prefixText","parsed","prefix","isInteger","Error","shift","network","outreachIpInBlocks","blocks","String","block"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;CAKC,GAED,gFAAgF,GAChF,SAASA,aAAaC,GAAW;IAC/B,MAAMC,OAAOD,IAAIE,IAAI,GAAGC,WAAW;IACnC,IAAI,CAACF,MAAM,OAAO;IAClB,IAAI,0BAA0BG,IAAI,CAACH,OAAO;QACxC,MAAMI,QAAQJ,KAAKK,KAAK,CAAC,KAAKC,GAAG,CAACC;QAClC,IAAIH,MAAMI,IAAI,CAAC,CAACC,OAASA,OAAO,MAAM,OAAO;QAC7C,OAAO;YAAEC,OAAON,MAAMO,MAAM,CAAC,CAACC,OAAOH,OAAS,AAACG,SAAS,EAAE,GAAIC,OAAOJ,OAAO,EAAE;YAAGK,MAAM;QAAG;IAC5F;IACA,IAAI,CAACd,KAAKe,QAAQ,CAAC,MAAM,OAAO;IAChC,sEAAsE;IACtE,MAAMC,SAAS,qCAAqCC,IAAI,CAACjB;IACzD,IAAIgB,QAAQ,OAAOlB,aAAakB,MAAM,CAAC,EAAE;IACzC,MAAME,SAASlB,KAAKK,KAAK,CAAC;IAC1B,IAAIa,OAAOC,MAAM,GAAG,GAAG,OAAO;IAC9B,MAAMC,SAAS,CAACC,OAAkBA,OAAOA,KAAKhB,KAAK,CAAC,OAAO,EAAE;IAC7D,MAAMiB,OAAOF,OAAOF,MAAM,CAAC,EAAE;IAC7B,MAAMK,OAAOL,OAAOC,MAAM,KAAK,IAAIC,OAAOF,MAAM,CAAC,EAAE,IAAI,EAAE;IACzD,MAAMM,UAAU,IAAIF,KAAKH,MAAM,GAAGI,KAAKJ,MAAM;IAC7C,IAAID,OAAOC,MAAM,KAAK,IAAIK,UAAU,IAAIA,YAAY,GAAG,OAAO;IAC9D,MAAMC,MAAM;WAAIH;WAASI,MAAcR,OAAOC,MAAM,KAAK,IAAIK,UAAU,GAAGG,IAAI,CAAC;WAASJ;KAAK;IAC7F,IAAIE,IAAIjB,IAAI,CAAC,CAACoB,QAAU,CAAC,kBAAkBzB,IAAI,CAACyB,SAAS,OAAO;IAChE,OAAO;QAAElB,OAAOe,IAAId,MAAM,CAAC,CAACC,OAAOgB,QAAU,AAAChB,SAAS,GAAG,GAAIC,OAAOgB,SAASD,OAAO,MAAM,EAAE;QAAGd,MAAM;IAAI;AAC5G;AASA,uGAAuG,GACvG,OAAO,SAASgB,gBAAgBC,IAAY;IAC1C,MAAM,CAACC,SAASC,WAAW,GAAGF,KAAK1B,KAAK,CAAC;IACzC,MAAM6B,SAASpC,aAAakC,kBAAAA,UAAW;IACvC,MAAMG,SAAS5B,OAAO0B;IACtB,IAAI,CAACC,UAAU,CAAC3B,OAAO6B,SAAS,CAACD,WAAWA,SAAS,KAAKA,SAASD,OAAOpB,IAAI,EAAE;QAC9E,MAAM,IAAIuB,MAAM,CAAC,kBAAkB,EAAEN,MAAM;IAC7C;IACA,MAAMO,QAAQzB,OAAOqB,OAAOpB,IAAI,GAAGqB;IACnC,OAAO;QAAEI,SAAS,AAACL,OAAOxB,KAAK,IAAI4B,SAAUA;QAAOH;QAAQrB,MAAMoB,OAAOpB,IAAI;IAAC;AAChF;AAEA,yFAAyF,GACzF,OAAO,SAAS0B,mBAAmBR,OAAkC,EAAES,MAAkC;IACvG,MAAMP,SAASpC,aAAa4C,OAAOV,kBAAAA,UAAW;IAC9C,IAAI,CAACE,QAAQ,OAAO;IACpB,OAAOO,OAAOjC,IAAI,CAAC,CAACmC;QAClB,IAAIA,MAAM7B,IAAI,KAAKoB,OAAOpB,IAAI,EAAE,OAAO;QACvC,MAAMwB,QAAQzB,OAAO8B,MAAM7B,IAAI,GAAG6B,MAAMR,MAAM;QAC9C,OAAO,AAACD,OAAOxB,KAAK,IAAI4B,SAAUA,UAAUK,MAAMJ,OAAO;IAC3D;AACF"}

package/src/lib/engine/open-source.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** The networks a fetch is told apart by; `other` is every address that is none of them. */
+export type OutreachOpenSource = 'google' | 'microsoft_filter' | 'microsoft' | 'apple' | 'yahoo' | 'other';
+export declare const OUTREACH_OPEN_SOURCES: readonly OutreachOpenSource[];
+/**
+ * The network a fetch came from, or `null` when no address could be read —
+ * which is "unknown", a different answer from `other`.
+ */
+export declare function outreachOpenSourceOf(address: string | null | undefined): OutreachOpenSource | null;

package/src/lib/engine/open-source.js

@@ -0,0 +1,130 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { outreachIpBlock, outreachIpInBlocks } from "./ip-range.js";
+export const OUTREACH_OPEN_SOURCES = [
+    'google',
+    'microsoft_filter',
+    'microsoft',
+    'apple',
+    'yahoo',
+    'other'
+];
+const blocks = (cidrs)=>cidrs.map(outreachIpBlock);
+const GOOGLE = blocks([
+    '64.233.160.0/19',
+    '66.102.0.0/20',
+    '66.249.64.0/19',
+    '72.14.192.0/18',
+    '74.125.0.0/16',
+    '108.170.192.0/18',
+    '108.177.0.0/17',
+    '142.250.0.0/15',
+    '172.217.0.0/16',
+    '172.253.0.0/16',
+    '173.194.0.0/16',
+    '209.85.128.0/17',
+    '216.58.192.0/19',
+    '216.239.32.0/19',
+    '2001:4860::/32',
+    '2404:6800::/32',
+    '2a00:1450::/32'
+]);
+const MICROSOFT_FILTER = blocks([
+    '40.92.0.0/15',
+    '40.107.0.0/16',
+    '52.100.0.0/14',
+    '104.47.0.0/17',
+    '2a01:111:f400::/48',
+    '2a01:111:f403::/48'
+]);
+const MICROSOFT = blocks([
+    '13.107.128.0/22',
+    '23.103.160.0/20',
+    '40.96.0.0/13',
+    '40.104.0.0/15',
+    '52.96.0.0/14',
+    '132.245.0.0/16',
+    '150.171.32.0/22',
+    '2603:1000::/24',
+    '2620:1ec:8f0::/46',
+    '2620:1ec:900::/46'
+]);
+const APPLE = blocks([
+    '17.0.0.0/8',
+    '104.28.0.0/16',
+    '140.248.0.0/16',
+    '146.75.0.0/16',
+    '172.224.0.0/15',
+    '172.226.0.0/16',
+    '2606:54c0::/32',
+    '2606:54c3::/32',
+    '2a02:26f7::/32',
+    '2a04:4e41::/32',
+    '2a09:bac2::/31'
+]);
+const YAHOO = blocks([
+    '27.123.32.0/19',
+    '67.195.0.0/16',
+    '69.147.64.0/18',
+    '87.248.96.0/19',
+    '98.138.0.0/15',
+    '106.10.128.0/17',
+    '115.178.0.0/20',
+    '119.161.0.0/19',
+    '200.152.160.0/20',
+    '202.43.192.0/19',
+    '209.73.160.0/19',
+    '212.82.96.0/19',
+    '216.115.96.0/20',
+    '2001:4998::/32',
+    '2406:2000::/32',
+    '2406:6e00::/32',
+    '2804:1bc::/32',
+    '2a00:1288::/32'
+]);
+/** Checked in this order; the filter before the rest of Microsoft, which does not contain it. */ const SOURCES = [
+    [
+        'google',
+        GOOGLE
+    ],
+    [
+        'microsoft_filter',
+        MICROSOFT_FILTER
+    ],
+    [
+        'microsoft',
+        MICROSOFT
+    ],
+    [
+        'apple',
+        APPLE
+    ],
+    [
+        'yahoo',
+        YAHOO
+    ]
+];
+/**
+ * The network a fetch came from, or `null` when no address could be read —
+ * which is "unknown", a different answer from `other`.
+ */ export function outreachOpenSourceOf(address) {
+    const text = String(address != null ? address : '').trim();
+    if (!text) return null;
+    for (const [source, ranges] of SOURCES)if (outreachIpInBlocks(text, ranges)) return source;
+    return 'other';
+}
+
+//# sourceMappingURL=open-source.js.map