@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/workspace-domains.js

@@ -0,0 +1,271 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+var _process_env_NEXT_PUBLIC_WORKSPACE_DOMAIN;
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Attach and detach names for the console (AGL-1136).
+ *
+ * Two layers. The bottom one — `attachProjectDomain` / `detachProjectDomain` —
+ * takes a fully-qualified name and is what a custom **console** domain uses
+ * (AGL-1373). The top one is the workspace-subdomain pair below, which is that
+ * primitive with `{slug}.aglyn.com` built for it.
+ *
+ * The hosting vendor is no longer either of them. Registering a name goes
+ * through `domain-provider.ts`, so the same workspace subdomain is created by
+ * Vercel's API on Aglyn's own hosting, by a wildcard record on a Docker
+ * install, or by whatever an operator put behind the webhook driver. What
+ * stays here is everything that is Aglyn's own policy rather than a vendor's:
+ * the slug arithmetic, the upload-CORS reconcile, and the three properties
+ * below.
+ *
+ * AGL-1135 removed the `*.aglyn.com` wildcard, because it meant every
+ * hostname under the domain served a real console sign-in page —
+ * `billing-security-update.aglyn.com` returned 200 with a valid certificate.
+ * Removing it made unregistered names 404, and made **registered** names
+ * something that has to be registered: a slug only resolves if that exact
+ * domain is attached.
+ *
+ * Nothing did that, so every workspace created after AGL-1135 had a subdomain
+ * that 404s. AGL-1115 then made signup provision an org, which turned a latent
+ * gap into one every new account hits.
+ *
+ * ## Three properties, in the order they matter
+ *
+ * 1. **It can never fail an org.** Every entry point swallows its errors and
+ *    returns a verdict instead of throwing. The console is path-routed
+ *    (`app.aglyn.com/{slug}`) and that is the canonical form, so a workspace
+ *    with no subdomain is fully usable — while an org creation that rolled
+ *    back because a DNS API was slow would not be.
+ * 2. **Unconfigured is a no-op, not an error.** With no provider this reports
+ *    `skipped`. A deployment that registers names some other way must not log
+ *    an error per signup forever.
+ * 3. **A rename ADDS without removing.** The old slug keeps a tombstone that
+ *    308s to the new one (AGL-585/236), and a redirect can only run on a
+ *    hostname that still resolves. Detaching the old domain would break the
+ *    very redirect the tombstone exists to serve.
+ */ import { domainProvider, redirectHostname } from "./domain-provider.js";
+import { reconcileUploadCors, releaseUploadCors } from "./upload-cors-reconcile.js";
+export { domainStateServes, redirectHostname } from "./domain-provider.js";
+const WORKSPACE_DOMAIN = (_process_env_NEXT_PUBLIC_WORKSPACE_DOMAIN = process.env.NEXT_PUBLIC_WORKSPACE_DOMAIN) != null ? _process_env_NEXT_PUBLIC_WORKSPACE_DOMAIN : 'aglyn.com';
+function domainFor(slug) {
+    return `${String(slug != null ? slug : '').trim().toLowerCase()}.${WORKSPACE_DOMAIN}`;
+}
+/**
+ * Attach one fully-qualified name to the console.
+ *
+ * Idempotent by contract: a name already registered comes back as
+ * `already-exists`, which is success — the reconcile script and the create
+ * path can both run without coordinating.
+ *
+ * ⚠️ Tolerating `already-exists` is only safe while **every** name this
+ * function is asked to attach is also claimed in Firestore. Without that, a
+ * second org attaches a name someone else already holds, reads it as success,
+ * and gets a console that looks healthy while its visitors are served — or
+ * redirected — somewhere else. That is the AGL-743 shape, and
+ * `console-domains.ts` is where the claim is kept in step.
+ */ export async function attachProjectDomain(name, options = {}, scope = 'console') {
+    const result = await domainProvider().attach(scope, name, options);
+    if (result.outcome !== 'attached' && result.outcome !== 'already-exists') {
+        return result;
+    }
+    const redirect = options.redirectTo ? redirectHostname(options.redirectTo) : null;
+    return _extends({}, result, await uploadCorsFor(result.domain, redirect, scope));
+}
+/**
+ * The upload-CORS verdict for a name this call just registered.
+ *
+ * Nothing for a REDIRECT: the browser is already at the redirect target before
+ * it uploads, so that name is never an origin, and an entry for it would be
+ * permission granted for nothing. Every unnecessary origin is one more site
+ * that could spend a leaked signed URL.
+ *
+ * Nothing for a TENANT name either, for the same reason one step further out:
+ * a published site is not a page that uploads. The signed direct-to-GCS path
+ * has exactly one client — the console's media library, which mints at
+ * `/api/media/upload-url` and `PUT`s the returned URL for files over 3 MB —
+ * and that component ships only in the console bundle. The besigner reaches
+ * media through a picker seam whose one implementation is also console-side,
+ * and no tenant surface carries a file input at all. So a customer's
+ * `shop.acme.com` issues no signed `PUT`, and an entry for it is permission
+ * that buys nothing on a bucket where the signed URL IS the authorization —
+ * held, for a white-label domain, by a host somebody else controls.
+ *
+ * The shape of the system says the same thing independently: a platform
+ * subdomain with no custom domain is never registered at all, because the
+ * wildcard already serves it. It has therefore never had a bucket entry. Were
+ * tenant pages really uploading, every such site would already be failing on
+ * large files, and none is.
+ *
+ * Console scope keeps the grant, and needs it: `app.<domain>` and every
+ * workspace subdomain (`acme.<domain>`) serve the console itself, media
+ * library included.
+ *
+ * ⚠️ The release side is deliberately NOT scoped to match — see
+ * {@link uploadCorsReleaseFor}.
+ *
+ * Swallows its own failures for the same reason everything else in this file
+ * does: a domain must not fail to attach because a storage API was slow.
+ */ async function uploadCorsFor(domain, redirect, scope) {
+    if (redirect || scope !== 'console') return {};
+    try {
+        const verdict = await reconcileUploadCors(domain);
+        // The key appears only when there is something to say. A deployment with
+        // no media bucket configured — a fresh self-host install — has nothing,
+        // and reporting `uploadCors: null` on every attach would be noise about a
+        // feature the operator is not using.
+        return verdict ? {
+            uploadCors: verdict
+        } : {};
+    } catch (error) {
+        console.error('[workspace-domains] upload CORS reconcile threw', domain, error);
+        return {};
+    }
+}
+/**
+ * Reclaim the origin a just-detached name leaves on the bucket.
+ *
+ * Called unconditionally on a successful detach rather than only for names we
+ * believe were serving: the redirect flag is the provider's state at ATTACH
+ * time and a name can have been changed since, and `releaseUploadCors` is a
+ * no-op for an origin that is not on the bucket anyway. Guessing wrong in the
+ * other direction leaves the permission standing.
+ *
+ * Unconditional across SCOPE too, and that asymmetry with
+ * {@link uploadCorsFor} is the point rather than an oversight. Attach stopped
+ * granting to tenant names, but bucket state outlives a release: every tenant
+ * origin an earlier build added is still on the allowlist, and this is the
+ * only path that takes one back off. Narrowing release to console scope to
+ * mirror the grant would strand exactly the entries the narrowing was meant to
+ * be rid of. A release for a name that never held an entry costs one read and
+ * reports `revoked` on an origin that was already absent.
+ *
+ * Swallows its own failures like everything else here — a domain must not fail
+ * to detach because a storage API was slow — but reports them, because an
+ * operator who has just removed a customer needs to see that their permission
+ * outlived them.
+ */ async function uploadCorsReleaseFor(domain) {
+    try {
+        const release = await releaseUploadCors(domain);
+        return release ? {
+            uploadCorsRelease: release
+        } : {};
+    } catch (error) {
+        console.error('[workspace-domains] upload CORS release threw', domain, error);
+        return {};
+    }
+}
+/**
+ * The command still owed after a set of attaches, or null when nothing is
+ * (AGL-1452).
+ *
+ * One remedy rather than a list: every verdict names the same bucket and the
+ * same command, and a caller that has to render five copies of it renders
+ * none.
+ */ export function pendingUploadCorsRemedy(results) {
+    var _ref;
+    var _results_find_uploadCors, _results_find;
+    return (_ref = (_results_find = results.find((result)=>result.uploadCors && !result.uploadCors.permitted)) == null ? void 0 : (_results_find_uploadCors = _results_find.uploadCors) == null ? void 0 : _results_find_uploadCors.remedy) != null ? _ref : null;
+}
+/** Detach one fully-qualified name from the console. */ export async function detachProjectDomain(name, scope = 'console') {
+    const result = await domainProvider().detach(scope, name);
+    // A name that was never registered has no origin of ours to reclaim.
+    if (result.outcome !== 'detached') return result;
+    return _extends({}, result, await uploadCorsReleaseFor(result.domain));
+}
+/**
+ * Attach `{slug}.<workspace domain>` so the workspace subdomain resolves.
+ *
+ * The `!slug` guard is not redundant with the one inside `attachProjectDomain`:
+ * an empty slug still produces the well-formed `.aglyn.com`, and on the detach
+ * side that is a request to delete the apex.
+ */ export async function attachWorkspaceDomain(slug) {
+    if (!slug) return {
+        outcome: 'skipped',
+        domain: domainFor(slug)
+    };
+    noteUnmanagedWorkspaceDomains();
+    return attachProjectDomain(domainFor(slug));
+}
+/**
+ * Has this instance already said that it does not manage workspace subdomains?
+ *
+ * Once per instance, not once per org: on a deployment that will never have
+ * this integration the condition is permanent, and a line per workspace
+ * creation is noise an operator learns to scroll past.
+ */ let loggedUnmanagedDomains = false;
+/**
+ * Say ONCE that `{slug}.<workspace domain>` is nobody's job on this deployment.
+ *
+ * `createOrg` awaits the attach and discards the result, which is fine when
+ * the outcome is `attached` or `already-exists`. With no provider the outcome
+ * is `skipped` and the org is still created, with the console going on to
+ * advertise `{slug}.<workspace domain>` as the workspace URL. That address
+ * resolves only if the operator independently runs wildcard DNS and a proxy
+ * rule for it, and nothing in the product would otherwise tell them so: the
+ * workspace simply has a URL that does not load.
+ *
+ * A log line rather than a refusal, because the operator's proxy is a
+ * legitimate way to serve those names — `AGLYN_DOMAIN_PROVIDER=wildcard` is
+ * how they say so — and failing org creation over a missing credential would
+ * be far worse than the gap it closes.
+ */ function noteUnmanagedWorkspaceDomains() {
+    if (loggedUnmanagedDomains || workspaceDomainsConfigured()) return;
+    loggedUnmanagedDomains = true;
+    console.info('[workspace-domains] no domain provider — workspace subdomains are not ' + 'registered by this deployment. Point a wildcard DNS record for ' + `*.${WORKSPACE_DOMAIN} at your console, route it there, and set ` + 'AGLYN_DOMAIN_PROVIDER=wildcard — or the workspace URL the console ' + 'shows will not resolve.');
+}
+/**
+ * Detach the domain, for org erasure.
+ *
+ * NOT called on rename: the previous slug keeps serving a 308 to the new one,
+ * and a redirect needs a hostname that still resolves.
+ */ export async function detachWorkspaceDomain(slug) {
+    if (!slug) return {
+        outcome: 'skipped',
+        domain: domainFor(slug)
+    };
+    return detachProjectDomain(domainFor(slug));
+}
+/**
+ * Whether the workspace-domain integration is configured at all.
+ *
+ * Exposed so a reconcile script can say "not configured" once instead of
+ * reporting every workspace as skipped, which reads like a failure.
+ */ export function workspaceDomainsConfigured() {
+    return domainProvider().configured('console');
+}
+/**
+ * What a name is ACTUALLY doing, right now.
+ *
+ * `attachProjectDomain` answers "did the registration succeed", which is a
+ * different question and a much weaker one. A domain can be registered and
+ * still serve nothing — ownership unproven, DNS not yet pointed, certificate
+ * not yet issued — and all three return a perfectly successful attach.
+ *
+ * That is the gap this closes (AGL-1913): the site custom-domain wizard
+ * reported `attached: true` off the attach alone, so "certificate is still
+ * issuing" and "this will never work" rendered as the same green chip, and the
+ * only advice the docs could give was to press retry again.
+ *
+ * `scope` picks which app should be answering for the name — `tenant` for a
+ * published site's custom domain, `console` for a workspace subdomain or a
+ * white-label console domain. It was a raw project id before the provider
+ * seam, which only ever meant anything to one vendor.
+ */ export async function projectDomainStatus(name, options = {}) {
+    var _options_scope;
+    return domainProvider().status((_options_scope = options.scope) != null ? _options_scope : 'console', name);
+}
+
+//# sourceMappingURL=workspace-domains.js.map

package/src/lib/server/workspace-domains.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/workspace-domains.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Attach and detach names for the console (AGL-1136).\n *\n * Two layers. The bottom one — `attachProjectDomain` / `detachProjectDomain` —\n * takes a fully-qualified name and is what a custom **console** domain uses\n * (AGL-1373). The top one is the workspace-subdomain pair below, which is that\n * primitive with `{slug}.aglyn.com` built for it.\n *\n * The hosting vendor is no longer either of them. Registering a name goes\n * through `domain-provider.ts`, so the same workspace subdomain is created by\n * Vercel's API on Aglyn's own hosting, by a wildcard record on a Docker\n * install, or by whatever an operator put behind the webhook driver. What\n * stays here is everything that is Aglyn's own policy rather than a vendor's:\n * the slug arithmetic, the upload-CORS reconcile, and the three properties\n * below.\n *\n * AGL-1135 removed the `*.aglyn.com` wildcard, because it meant every\n * hostname under the domain served a real console sign-in page —\n * `billing-security-update.aglyn.com` returned 200 with a valid certificate.\n * Removing it made unregistered names 404, and made **registered** names\n * something that has to be registered: a slug only resolves if that exact\n * domain is attached.\n *\n * Nothing did that, so every workspace created after AGL-1135 had a subdomain\n * that 404s. AGL-1115 then made signup provision an org, which turned a latent\n * gap into one every new account hits.\n *\n * ## Three properties, in the order they matter\n *\n * 1. **It can never fail an org.** Every entry point swallows its errors and\n *    returns a verdict instead of throwing. The console is path-routed\n *    (`app.aglyn.com/{slug}`) and that is the canonical form, so a workspace\n *    with no subdomain is fully usable — while an org creation that rolled\n *    back because a DNS API was slow would not be.\n * 2. **Unconfigured is a no-op, not an error.** With no provider this reports\n *    `skipped`. A deployment that registers names some other way must not log\n *    an error per signup forever.\n * 3. **A rename ADDS without removing.** The old slug keeps a tombstone that\n *    308s to the new one (AGL-585/236), and a redirect can only run on a\n *    hostname that still resolves. Detaching the old domain would break the\n *    very redirect the tombstone exists to serve.\n */\n\nimport {\n  domainProvider,\n  redirectHostname,\n  type DomainAttachOptions,\n  type DomainOutcome,\n  type DomainScope,\n  type ProjectDomainStatus,\n} from './domain-provider'\nimport {\n  reconcileUploadCors,\n  releaseUploadCors,\n  type UploadCorsRelease,\n  type UploadCorsVerdict,\n} from './upload-cors-reconcile'\n\nexport {\n  domainStateServes,\n  redirectHostname,\n  type ProjectDomainState,\n  type ProjectDomainStatus,\n  type ProjectDomainVerification,\n} from './domain-provider'\n\nexport type WorkspaceDomainOutcome = DomainOutcome\n\nexport interface WorkspaceDomainResult {\n  outcome: WorkspaceDomainOutcome\n  domain: string\n  detail?: string\n  /**\n   * Whether a browser at this name can complete a signed direct-to-GCS upload\n   * (AGL-1452).\n   *\n   * Present only when the attach made the name a SERVING origin — a redirect\n   * never becomes one. `permitted: false` carries the exact command a human\n   * must run, so the gap is legible here rather than days later as a large\n   * upload that fails behind a generic snackbar.\n   */\n  uploadCors?: UploadCorsVerdict | null\n  /**\n   * What a DETACH did about the origin the name leaves behind (AGL-1452).\n   *\n   * The attach half without this one only ever grows the allowlist. A stale\n   * origin is a standing permission to complete a signed upload, held by a host\n   * we no longer serve — and for a white-label console domain, one the customer\n   * still controls.\n   */\n  uploadCorsRelease?: UploadCorsRelease | null\n}\n\nconst WORKSPACE_DOMAIN =\n  process.env.NEXT_PUBLIC_WORKSPACE_DOMAIN ?? 'aglyn.com'\n\nfunction domainFor(slug: string): string {\n  return `${String(slug ?? '').trim().toLowerCase()}.${WORKSPACE_DOMAIN}`\n}\n\nexport type ProjectDomainOptions = DomainAttachOptions\n\n/**\n * Attach one fully-qualified name to the console.\n *\n * Idempotent by contract: a name already registered comes back as\n * `already-exists`, which is success — the reconcile script and the create\n * path can both run without coordinating.\n *\n * ⚠️ Tolerating `already-exists` is only safe while **every** name this\n * function is asked to attach is also claimed in Firestore. Without that, a\n * second org attaches a name someone else already holds, reads it as success,\n * and gets a console that looks healthy while its visitors are served — or\n * redirected — somewhere else. That is the AGL-743 shape, and\n * `console-domains.ts` is where the claim is kept in step.\n */\nexport async function attachProjectDomain(\n  name: string,\n  options: ProjectDomainOptions = {},\n  scope: DomainScope = 'console',\n): Promise<WorkspaceDomainResult> {\n  const result = await domainProvider().attach(scope, name, options)\n  if (result.outcome !== 'attached' && result.outcome !== 'already-exists') {\n    return result\n  }\n  const redirect = options.redirectTo ? redirectHostname(options.redirectTo) : null\n  return { ...result, ...(await uploadCorsFor(result.domain, redirect, scope)) }\n}\n\n/**\n * The upload-CORS verdict for a name this call just registered.\n *\n * Nothing for a REDIRECT: the browser is already at the redirect target before\n * it uploads, so that name is never an origin, and an entry for it would be\n * permission granted for nothing. Every unnecessary origin is one more site\n * that could spend a leaked signed URL.\n *\n * Nothing for a TENANT name either, for the same reason one step further out:\n * a published site is not a page that uploads. The signed direct-to-GCS path\n * has exactly one client — the console's media library, which mints at\n * `/api/media/upload-url` and `PUT`s the returned URL for files over 3 MB —\n * and that component ships only in the console bundle. The besigner reaches\n * media through a picker seam whose one implementation is also console-side,\n * and no tenant surface carries a file input at all. So a customer's\n * `shop.acme.com` issues no signed `PUT`, and an entry for it is permission\n * that buys nothing on a bucket where the signed URL IS the authorization —\n * held, for a white-label domain, by a host somebody else controls.\n *\n * The shape of the system says the same thing independently: a platform\n * subdomain with no custom domain is never registered at all, because the\n * wildcard already serves it. It has therefore never had a bucket entry. Were\n * tenant pages really uploading, every such site would already be failing on\n * large files, and none is.\n *\n * Console scope keeps the grant, and needs it: `app.<domain>` and every\n * workspace subdomain (`acme.<domain>`) serve the console itself, media\n * library included.\n *\n * ⚠️ The release side is deliberately NOT scoped to match — see\n * {@link uploadCorsReleaseFor}.\n *\n * Swallows its own failures for the same reason everything else in this file\n * does: a domain must not fail to attach because a storage API was slow.\n */\nasync function uploadCorsFor(\n  domain: string,\n  redirect: string | null,\n  scope: DomainScope,\n): Promise<{ uploadCors?: UploadCorsVerdict | null }> {\n  if (redirect || scope !== 'console') return {}\n  try {\n    const verdict = await reconcileUploadCors(domain)\n    // The key appears only when there is something to say. A deployment with\n    // no media bucket configured — a fresh self-host install — has nothing,\n    // and reporting `uploadCors: null` on every attach would be noise about a\n    // feature the operator is not using.\n    return verdict ? { uploadCors: verdict } : {}\n  } catch (error) {\n    console.error('[workspace-domains] upload CORS reconcile threw', domain, error)\n    return {}\n  }\n}\n\n/**\n * Reclaim the origin a just-detached name leaves on the bucket.\n *\n * Called unconditionally on a successful detach rather than only for names we\n * believe were serving: the redirect flag is the provider's state at ATTACH\n * time and a name can have been changed since, and `releaseUploadCors` is a\n * no-op for an origin that is not on the bucket anyway. Guessing wrong in the\n * other direction leaves the permission standing.\n *\n * Unconditional across SCOPE too, and that asymmetry with\n * {@link uploadCorsFor} is the point rather than an oversight. Attach stopped\n * granting to tenant names, but bucket state outlives a release: every tenant\n * origin an earlier build added is still on the allowlist, and this is the\n * only path that takes one back off. Narrowing release to console scope to\n * mirror the grant would strand exactly the entries the narrowing was meant to\n * be rid of. A release for a name that never held an entry costs one read and\n * reports `revoked` on an origin that was already absent.\n *\n * Swallows its own failures like everything else here — a domain must not fail\n * to detach because a storage API was slow — but reports them, because an\n * operator who has just removed a customer needs to see that their permission\n * outlived them.\n */\nasync function uploadCorsReleaseFor(\n  domain: string,\n): Promise<{ uploadCorsRelease?: UploadCorsRelease | null }> {\n  try {\n    const release = await releaseUploadCors(domain)\n    return release ? { uploadCorsRelease: release } : {}\n  } catch (error) {\n    console.error('[workspace-domains] upload CORS release threw', domain, error)\n    return {}\n  }\n}\n\n/**\n * The command still owed after a set of attaches, or null when nothing is\n * (AGL-1452).\n *\n * One remedy rather than a list: every verdict names the same bucket and the\n * same command, and a caller that has to render five copies of it renders\n * none.\n */\nexport function pendingUploadCorsRemedy(\n  results: WorkspaceDomainResult[],\n): string | null {\n  return (\n    results.find((result) => result.uploadCors && !result.uploadCors.permitted)\n      ?.uploadCors?.remedy ?? null\n  )\n}\n\n/** Detach one fully-qualified name from the console. */\nexport async function detachProjectDomain(\n  name: string,\n  scope: DomainScope = 'console',\n): Promise<WorkspaceDomainResult> {\n  const result = await domainProvider().detach(scope, name)\n  // A name that was never registered has no origin of ours to reclaim.\n  if (result.outcome !== 'detached') return result\n  return { ...result, ...(await uploadCorsReleaseFor(result.domain)) }\n}\n\n/**\n * Attach `{slug}.<workspace domain>` so the workspace subdomain resolves.\n *\n * The `!slug` guard is not redundant with the one inside `attachProjectDomain`:\n * an empty slug still produces the well-formed `.aglyn.com`, and on the detach\n * side that is a request to delete the apex.\n */\nexport async function attachWorkspaceDomain(\n  slug: string,\n): Promise<WorkspaceDomainResult> {\n  if (!slug) return { outcome: 'skipped', domain: domainFor(slug) }\n  noteUnmanagedWorkspaceDomains()\n  return attachProjectDomain(domainFor(slug))\n}\n\n/**\n * Has this instance already said that it does not manage workspace subdomains?\n *\n * Once per instance, not once per org: on a deployment that will never have\n * this integration the condition is permanent, and a line per workspace\n * creation is noise an operator learns to scroll past.\n */\nlet loggedUnmanagedDomains = false\n\n/**\n * Say ONCE that `{slug}.<workspace domain>` is nobody's job on this deployment.\n *\n * `createOrg` awaits the attach and discards the result, which is fine when\n * the outcome is `attached` or `already-exists`. With no provider the outcome\n * is `skipped` and the org is still created, with the console going on to\n * advertise `{slug}.<workspace domain>` as the workspace URL. That address\n * resolves only if the operator independently runs wildcard DNS and a proxy\n * rule for it, and nothing in the product would otherwise tell them so: the\n * workspace simply has a URL that does not load.\n *\n * A log line rather than a refusal, because the operator's proxy is a\n * legitimate way to serve those names — `AGLYN_DOMAIN_PROVIDER=wildcard` is\n * how they say so — and failing org creation over a missing credential would\n * be far worse than the gap it closes.\n */\nfunction noteUnmanagedWorkspaceDomains(): void {\n  if (loggedUnmanagedDomains || workspaceDomainsConfigured()) return\n  loggedUnmanagedDomains = true\n  console.info(\n    '[workspace-domains] no domain provider — workspace subdomains are not ' +\n      'registered by this deployment. Point a wildcard DNS record for ' +\n      `*.${WORKSPACE_DOMAIN} at your console, route it there, and set ` +\n      'AGLYN_DOMAIN_PROVIDER=wildcard — or the workspace URL the console ' +\n      'shows will not resolve.',\n  )\n}\n\n/**\n * Detach the domain, for org erasure.\n *\n * NOT called on rename: the previous slug keeps serving a 308 to the new one,\n * and a redirect needs a hostname that still resolves.\n */\nexport async function detachWorkspaceDomain(\n  slug: string,\n): Promise<WorkspaceDomainResult> {\n  if (!slug) return { outcome: 'skipped', domain: domainFor(slug) }\n  return detachProjectDomain(domainFor(slug))\n}\n\n/**\n * Whether the workspace-domain integration is configured at all.\n *\n * Exposed so a reconcile script can say \"not configured\" once instead of\n * reporting every workspace as skipped, which reads like a failure.\n */\nexport function workspaceDomainsConfigured(): boolean {\n  return domainProvider().configured('console')\n}\n\n/**\n * What a name is ACTUALLY doing, right now.\n *\n * `attachProjectDomain` answers \"did the registration succeed\", which is a\n * different question and a much weaker one. A domain can be registered and\n * still serve nothing — ownership unproven, DNS not yet pointed, certificate\n * not yet issued — and all three return a perfectly successful attach.\n *\n * That is the gap this closes (AGL-1913): the site custom-domain wizard\n * reported `attached: true` off the attach alone, so \"certificate is still\n * issuing\" and \"this will never work\" rendered as the same green chip, and the\n * only advice the docs could give was to press retry again.\n *\n * `scope` picks which app should be answering for the name — `tenant` for a\n * published site's custom domain, `console` for a workspace subdomain or a\n * white-label console domain. It was a raw project id before the provider\n * seam, which only ever meant anything to one vendor.\n */\nexport async function projectDomainStatus(\n  name: string,\n  options: { scope?: DomainScope } = {},\n): Promise<ProjectDomainStatus> {\n  return domainProvider().status(options.scope ?? 'console', name)\n}\n"],"names":["process","domainProvider","redirectHostname","reconcileUploadCors","releaseUploadCors","domainStateServes","WORKSPACE_DOMAIN","env","NEXT_PUBLIC_WORKSPACE_DOMAIN","domainFor","slug","String","trim","toLowerCase","attachProjectDomain","name","options","scope","result","attach","outcome","redirect","redirectTo","uploadCorsFor","domain","verdict","uploadCors","error","console","uploadCorsReleaseFor","release","uploadCorsRelease","pendingUploadCorsRemedy","results","find","permitted","remedy","detachProjectDomain","detach","attachWorkspaceDomain","noteUnmanagedWorkspaceDomains","loggedUnmanagedDomains","workspaceDomainsConfigured","info","detachWorkspaceDomain","configured","projectDomainStatus","status"],"mappings":";IA+GEA;AA/GF;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCC,GAED,SACEC,cAAc,EACdC,gBAAgB,QAKX,uBAAmB;AAC1B,SACEC,mBAAmB,EACnBC,iBAAiB,QAGZ,6BAAyB;AAEhC,SACEC,iBAAiB,EACjBH,gBAAgB,QAIX,uBAAmB;AA6B1B,MAAMI,oBACJN,4CAAAA,QAAQO,GAAG,CAACC,4BAA4B,YAAxCR,4CAA4C;AAE9C,SAASS,UAAUC,IAAY;IAC7B,OAAO,GAAGC,OAAOD,eAAAA,OAAQ,IAAIE,IAAI,GAAGC,WAAW,GAAG,CAAC,EAAEP,kBAAkB;AACzE;AAIA;;;;;;;;;;;;;CAaC,GACD,OAAO,eAAeQ,oBACpBC,IAAY,EACZC,UAAgC,CAAC,CAAC,EAClCC,QAAqB,SAAS;IAE9B,MAAMC,SAAS,MAAMjB,iBAAiBkB,MAAM,CAACF,OAAOF,MAAMC;IAC1D,IAAIE,OAAOE,OAAO,KAAK,cAAcF,OAAOE,OAAO,KAAK,kBAAkB;QACxE,OAAOF;IACT;IACA,MAAMG,WAAWL,QAAQM,UAAU,GAAGpB,iBAAiBc,QAAQM,UAAU,IAAI;IAC7E,OAAO,aAAKJ,QAAY,MAAMK,cAAcL,OAAOM,MAAM,EAAEH,UAAUJ;AACvE;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCC,GACD,eAAeM,cACbC,MAAc,EACdH,QAAuB,EACvBJ,KAAkB;IAElB,IAAII,YAAYJ,UAAU,WAAW,OAAO,CAAC;IAC7C,IAAI;QACF,MAAMQ,UAAU,MAAMtB,oBAAoBqB;QAC1C,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,qCAAqC;QACrC,OAAOC,UAAU;YAAEC,YAAYD;QAAQ,IAAI,CAAC;IAC9C,EAAE,OAAOE,OAAO;QACdC,QAAQD,KAAK,CAAC,mDAAmDH,QAAQG;QACzE,OAAO,CAAC;IACV;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,eAAeE,qBACbL,MAAc;IAEd,IAAI;QACF,MAAMM,UAAU,MAAM1B,kBAAkBoB;QACxC,OAAOM,UAAU;YAAEC,mBAAmBD;QAAQ,IAAI,CAAC;IACrD,EAAE,OAAOH,OAAO;QACdC,QAAQD,KAAK,CAAC,iDAAiDH,QAAQG;QACvE,OAAO,CAAC;IACV;AACF;AAEA;;;;;;;CAOC,GACD,OAAO,SAASK,wBACdC,OAAgC;;QAG9BA,0BAAAA;IADF,gBACEA,gBAAAA,QAAQC,IAAI,CAAC,CAAChB,SAAWA,OAAOQ,UAAU,IAAI,CAACR,OAAOQ,UAAU,CAACS,SAAS,uBAA1EF,2BAAAA,cACIP,UAAU,qBADdO,yBACgBG,MAAM,mBAAI;AAE9B;AAEA,sDAAsD,GACtD,OAAO,eAAeC,oBACpBtB,IAAY,EACZE,QAAqB,SAAS;IAE9B,MAAMC,SAAS,MAAMjB,iBAAiBqC,MAAM,CAACrB,OAAOF;IACpD,qEAAqE;IACrE,IAAIG,OAAOE,OAAO,KAAK,YAAY,OAAOF;IAC1C,OAAO,aAAKA,QAAY,MAAMW,qBAAqBX,OAAOM,MAAM;AAClE;AAEA;;;;;;CAMC,GACD,OAAO,eAAee,sBACpB7B,IAAY;IAEZ,IAAI,CAACA,MAAM,OAAO;QAAEU,SAAS;QAAWI,QAAQf,UAAUC;IAAM;IAChE8B;IACA,OAAO1B,oBAAoBL,UAAUC;AACvC;AAEA;;;;;;CAMC,GACD,IAAI+B,yBAAyB;AAE7B;;;;;;;;;;;;;;;CAeC,GACD,SAASD;IACP,IAAIC,0BAA0BC,8BAA8B;IAC5DD,yBAAyB;IACzBb,QAAQe,IAAI,CACV,2EACE,oEACA,CAAC,EAAE,EAAErC,iBAAiB,0CAA0C,CAAC,GACjE,uEACA;AAEN;AAEA;;;;;CAKC,GACD,OAAO,eAAesC,sBACpBlC,IAAY;IAEZ,IAAI,CAACA,MAAM,OAAO;QAAEU,SAAS;QAAWI,QAAQf,UAAUC;IAAM;IAChE,OAAO2B,oBAAoB5B,UAAUC;AACvC;AAEA;;;;;CAKC,GACD,OAAO,SAASgC;IACd,OAAOzC,iBAAiB4C,UAAU,CAAC;AACrC;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,eAAeC,oBACpB/B,IAAY,EACZC,UAAmC,CAAC,CAAC;QAENA;IAA/B,OAAOf,iBAAiB8C,MAAM,EAAC/B,iBAAAA,QAAQC,KAAK,YAAbD,iBAAiB,WAAWD;AAC7D"}

package/src/tenancy.d.ts

@@ -0,0 +1,115 @@
+/**
+ * @license
+ * Copyright 2022 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export * from './lib/server/analytics-retention';
+export * from './lib/server/api-http';
+export * from './lib/server/api-keys';
+export * from './lib/server/account-emails';
+export * from './lib/server/auth-pools';
+export * from './lib/server/client-error-report';
+export * from './lib/server/connect-account-status';
+export * from './lib/server/connect-payout-failure';
+export * from './lib/server/stripe-account-mode';
+export * from './lib/server/auth-handoff';
+export * from './lib/server/console-domains';
+export * from './lib/server/dns-probe';
+export * from './lib/server/sending-domains';
+export * from './lib/server/host-sending-domain';
+export * from './lib/server/sending-domain-debt';
+export * from './lib/server/sending-domain-recheck';
+export { domainProvider } from './lib/server/domain-provider';
+export type { DomainProvider, DomainProviderId, DomainScope, } from './lib/server/domain-provider';
+export * from './lib/server/platform-domain-names';
+export * from './lib/server/consume-once';
+export * from './lib/server/csp-aggregate';
+export * from './lib/server/data-storage-gate';
+export * from './lib/server/contact-suppression';
+export * from './lib/server/email-suppression';
+export * from './lib/server/email-topic-confirmation';
+export * from './lib/server/email-unsubscribe-link';
+export * from './lib/server/email-flow-gate';
+export * from './lib/server/email-marketing-gate';
+export * from './lib/server/sms-keywords';
+export * from './lib/server/document-id';
+export * from './lib/server/edit-access-authz';
+export * from './lib/server/edit-access-token';
+export * from './lib/server/edit-hint-token';
+export * from './lib/server/email-metering';
+export * from './lib/server/campaign-conversion-attribution';
+export * from './lib/server/email-send-rate';
+export * from './lib/server/email-sender-reputation';
+export * from './lib/server/erase';
+export * from './lib/server/erase-person';
+export * from './lib/server/dynamic-list-materialize';
+export * from './lib/server/firebase-admin';
+export * from './lib/server/free-workspace-cap';
+export * from './lib/server/ga4-measurement-protocol';
+export * from './lib/server/host-memberships';
+export * from './lib/server/host-visitor-records';
+export * from './lib/server/list-members';
+export * from './lib/server/lockdown';
+export * from './lib/server/token-revocation';
+export * from './lib/server/tenant-write-lockdown';
+export * from './lib/server/host-email-tokens';
+export * from './lib/server/notifications';
+export * from './lib/server/org-billing';
+export * from './lib/server/organizations';
+export * from './lib/server/duplicate-activity';
+export * from './lib/server/duplicate-resource';
+export * from './lib/server/workspace-domains';
+export * from './lib/server/membership-recover-throttle';
+export * from './lib/server/password-reset-throttle';
+export * from './lib/server/rate-limit-store';
+export * from './lib/server/verify-email-cooldown';
+export * from './lib/server/vercel-drain-signature';
+export * from './lib/server/vercel-log-drain';
+export * from './lib/server/visitor-write-rate-limit';
+export * from './lib/server/console-api-rate-limit';
+export * from './lib/server/realm-plugins';
+export * from './lib/server/release-flags';
+export * from './lib/server/resolve-people';
+export * from './lib/server/member-photo';
+export * from './lib/server/personal-data-export';
+export * from './lib/server/media-delivery';
+export * from './lib/server/media-download-tokens';
+export * from './lib/server/media-quarantine';
+export * from './lib/server/media-signing';
+export * from './lib/server/media-storage-path';
+export * from './lib/server/safe-equal';
+export * from './lib/server/media-strong-digest';
+export * from './lib/server/media-tombstone';
+export * from './lib/server/media-variants';
+export * from './lib/server/serve-media-cdn';
+export * from './lib/server/serve-plugin-fetch';
+export * from './lib/server/sso-break-glass-owners';
+export * from './lib/server/sso-domain-policy';
+export * from './lib/server/sso-enforcement';
+export * from './lib/server/sso-provisioning';
+export * from './lib/server/update-existing';
+export * from './lib/server/contact-company-link';
+export * from './lib/server/contact-email-index';
+export * from './lib/server/contact-merge';
+export * from './lib/server/upsert-contact';
+export * from './lib/server/contact-lifecycle-floor';
+export * from './lib/server/crm-records';
+export * from './lib/server/crm-next-activity';
+export * from './lib/server/crm-email-activity';
+export * from './lib/server/crm-booking-activity';
+export * from './lib/server/crm-inbound-email';
+export * from './lib/server/member-email-aliases';
+export * from './lib/server/user-profiles';
+export * from './lib/server/legal-acceptance';
+export * from './lib/server/platform-marketing-consent';

package/src/tenancy.js

@@ -0,0 +1,142 @@
+/**
+ * @license
+ * Copyright 2022 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ export * from "./lib/server/analytics-retention.js";
+export * from "./lib/server/api-http.js";
+export * from "./lib/server/api-keys.js";
+export * from "./lib/server/account-emails.js";
+export * from "./lib/server/auth-pools.js";
+export * from "./lib/server/client-error-report.js";
+export * from "./lib/server/connect-account-status.js";
+export * from "./lib/server/connect-payout-failure.js";
+export * from "./lib/server/stripe-account-mode.js";
+export * from "./lib/server/auth-handoff.js";
+export * from "./lib/server/console-domains.js";
+export * from "./lib/server/dns-probe.js";
+export * from "./lib/server/sending-domains.js";
+export * from "./lib/server/host-sending-domain.js";
+export * from "./lib/server/sending-domain-debt.js";
+export * from "./lib/server/sending-domain-recheck.js";
+// The hosting seam itself, so a door can ask whether this deployment is able
+// to register a name at all before it promises the caller one.
+// `workspace-domains` re-exports the pieces its own callers share with it; the
+// provider behind it is not among them.
+export { domainProvider } from "./lib/server/domain-provider.js";
+export * from "./lib/server/platform-domain-names.js";
+export * from "./lib/server/consume-once.js";
+export * from "./lib/server/csp-aggregate.js";
+export * from "./lib/server/data-storage-gate.js";
+export * from "./lib/server/contact-suppression.js";
+export * from "./lib/server/email-suppression.js";
+// The double opt-in quarantine, after the module whose keying it shares and
+// whose `filterTopicSendable` is the reader that makes it a quarantine rather
+// than a stored fact.
+export * from "./lib/server/email-topic-confirmation.js";
+export * from "./lib/server/email-unsubscribe-link.js";
+export * from "./lib/server/email-flow-gate.js";
+// Side-effecting on purpose, for the reason `email-send-rate` below is:
+// evaluating this module INSTALLS the marketing gate on `sendEmail`, so the
+// unsubscribe header, the suppression check and the frequency ceiling reach
+// every bulk sender without a call at each server entrypoint.
+export * from "./lib/server/email-marketing-gate.js";
+export * from "./lib/server/sms-keywords.js";
+export * from "./lib/server/document-id.js";
+export * from "./lib/server/edit-access-authz.js";
+export * from "./lib/server/edit-access-token.js";
+export * from "./lib/server/edit-hint-token.js";
+export * from "./lib/server/email-metering.js";
+// Side-effecting on purpose (AGL-2409): evaluating this module INSTALLS the
+// platform send-rate governor on `sendEmail`. Every server surface already
+// imports this barrel, so nothing has to remember to call an installer.
+export * from "./lib/server/campaign-conversion-attribution.js";
+export * from "./lib/server/email-send-rate.js";
+export * from "./lib/server/email-sender-reputation.js";
+export * from "./lib/server/erase.js";
+export * from "./lib/server/erase-person.js";
+export * from "./lib/server/dynamic-list-materialize.js";
+export * from "./lib/server/firebase-admin.js";
+export * from "./lib/server/free-workspace-cap.js";
+export * from "./lib/server/ga4-measurement-protocol.js";
+export * from "./lib/server/host-memberships.js";
+export * from "./lib/server/host-visitor-records.js";
+export * from "./lib/server/list-members.js";
+export * from "./lib/server/lockdown.js";
+export * from "./lib/server/token-revocation.js";
+export * from "./lib/server/tenant-write-lockdown.js";
+export * from "./lib/server/host-email-tokens.js";
+export * from "./lib/server/notifications.js";
+export * from "./lib/server/org-billing.js";
+export * from "./lib/server/organizations.js";
+export * from "./lib/server/duplicate-activity.js";
+export * from "./lib/server/duplicate-resource.js";
+export * from "./lib/server/workspace-domains.js";
+export * from "./lib/server/membership-recover-throttle.js";
+export * from "./lib/server/password-reset-throttle.js";
+export * from "./lib/server/rate-limit-store.js";
+export * from "./lib/server/verify-email-cooldown.js";
+export * from "./lib/server/vercel-drain-signature.js";
+export * from "./lib/server/vercel-log-drain.js";
+export * from "./lib/server/visitor-write-rate-limit.js";
+export * from "./lib/server/console-api-rate-limit.js";
+export * from "./lib/server/realm-plugins.js";
+export * from "./lib/server/release-flags.js";
+export * from "./lib/server/resolve-people.js";
+export * from "./lib/server/member-photo.js";
+export * from "./lib/server/personal-data-export.js";
+export * from "./lib/server/media-delivery.js";
+export * from "./lib/server/media-download-tokens.js";
+export * from "./lib/server/media-quarantine.js";
+export * from "./lib/server/media-signing.js";
+export * from "./lib/server/media-storage-path.js";
+export * from "./lib/server/safe-equal.js";
+export * from "./lib/server/media-strong-digest.js";
+export * from "./lib/server/media-tombstone.js";
+export * from "./lib/server/media-variants.js";
+export * from "./lib/server/serve-media-cdn.js";
+export * from "./lib/server/serve-plugin-fetch.js";
+export * from "./lib/server/sso-break-glass-owners.js";
+export * from "./lib/server/sso-domain-policy.js";
+export * from "./lib/server/sso-enforcement.js";
+export * from "./lib/server/sso-provisioning.js";
+export * from "./lib/server/update-existing.js";
+export * from "./lib/server/contact-company-link.js";
+export * from "./lib/server/contact-email-index.js";
+export * from "./lib/server/contact-merge.js";
+export * from "./lib/server/upsert-contact.js";
+// The stage floor a won deal applies to its contact (AGL-2641).
+export * from "./lib/server/contact-lifecycle-floor.js";
+export * from "./lib/server/crm-records.js";
+// The `nextTaskAtMs` a contact, a company and a deal carry, recomputed from
+// their open tasks by every server-side task writer (AGL-2661).
+export * from "./lib/server/crm-next-activity.js";
+// Where a one-to-one email's activity row lives and how the delivery
+// webhook advances it (AGL-2615).
+export * from "./lib/server/crm-email-activity.js";
+// What a confirmed booking files on the CRM record — the meeting and the
+// follow-up (AGL-2660).
+export * from "./lib/server/crm-booking-activity.js";
+// The org's email capture token and the filing of one received message
+// on the record it was with (AGL-2657).
+export * from "./lib/server/crm-inbound-email.js";
+// A member's own addresses in a workspace, and the signed link that
+// confirms one (AGL-2975).
+export * from "./lib/server/member-email-aliases.js";
+export * from "./lib/server/user-profiles.js";
+export * from "./lib/server/legal-acceptance.js";
+// The person's decision about the platform's own product email, on their
+// document and on the operator's marketing contact (AGL-3185).
+export * from "./lib/server/platform-marketing-consent.js";
+
+//# sourceMappingURL=tenancy.js.map

package/src/tenancy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/tenant/data/admin/src/tenancy.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2022 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport * from './lib/server/analytics-retention'\nexport * from './lib/server/api-http'\nexport * from './lib/server/api-keys'\nexport * from './lib/server/account-emails'\nexport * from './lib/server/auth-pools'\nexport * from './lib/server/client-error-report'\nexport * from './lib/server/connect-account-status'\nexport * from './lib/server/connect-payout-failure'\nexport * from './lib/server/stripe-account-mode'\nexport * from './lib/server/auth-handoff'\nexport * from './lib/server/console-domains'\nexport * from './lib/server/dns-probe'\nexport * from './lib/server/sending-domains'\nexport * from './lib/server/host-sending-domain'\nexport * from './lib/server/sending-domain-debt'\nexport * from './lib/server/sending-domain-recheck'\n// The hosting seam itself, so a door can ask whether this deployment is able\n// to register a name at all before it promises the caller one.\n// `workspace-domains` re-exports the pieces its own callers share with it; the\n// provider behind it is not among them.\nexport { domainProvider } from './lib/server/domain-provider'\nexport type {\n  DomainProvider,\n  DomainProviderId,\n  DomainScope,\n} from './lib/server/domain-provider'\nexport * from './lib/server/platform-domain-names'\nexport * from './lib/server/consume-once'\nexport * from './lib/server/csp-aggregate'\nexport * from './lib/server/data-storage-gate'\nexport * from './lib/server/contact-suppression'\nexport * from './lib/server/email-suppression'\n// The double opt-in quarantine, after the module whose keying it shares and\n// whose `filterTopicSendable` is the reader that makes it a quarantine rather\n// than a stored fact.\nexport * from './lib/server/email-topic-confirmation'\nexport * from './lib/server/email-unsubscribe-link'\nexport * from './lib/server/email-flow-gate'\n// Side-effecting on purpose, for the reason `email-send-rate` below is:\n// evaluating this module INSTALLS the marketing gate on `sendEmail`, so the\n// unsubscribe header, the suppression check and the frequency ceiling reach\n// every bulk sender without a call at each server entrypoint.\nexport * from './lib/server/email-marketing-gate'\nexport * from './lib/server/sms-keywords'\nexport * from './lib/server/document-id'\nexport * from './lib/server/edit-access-authz'\nexport * from './lib/server/edit-access-token'\nexport * from './lib/server/edit-hint-token'\nexport * from './lib/server/email-metering'\n// Side-effecting on purpose (AGL-2409): evaluating this module INSTALLS the\n// platform send-rate governor on `sendEmail`. Every server surface already\n// imports this barrel, so nothing has to remember to call an installer.\nexport * from './lib/server/campaign-conversion-attribution'\nexport * from './lib/server/email-send-rate'\nexport * from './lib/server/email-sender-reputation'\nexport * from './lib/server/erase'\nexport * from './lib/server/erase-person'\nexport * from './lib/server/dynamic-list-materialize'\nexport * from './lib/server/firebase-admin'\nexport * from './lib/server/free-workspace-cap'\nexport * from './lib/server/ga4-measurement-protocol'\nexport * from './lib/server/host-memberships'\nexport * from './lib/server/host-visitor-records'\nexport * from './lib/server/list-members'\nexport * from './lib/server/lockdown'\nexport * from './lib/server/token-revocation'\nexport * from './lib/server/tenant-write-lockdown'\nexport * from './lib/server/host-email-tokens'\nexport * from './lib/server/notifications'\nexport * from './lib/server/org-billing'\nexport * from './lib/server/organizations'\nexport * from './lib/server/duplicate-activity'\nexport * from './lib/server/duplicate-resource'\nexport * from './lib/server/workspace-domains'\nexport * from './lib/server/membership-recover-throttle'\nexport * from './lib/server/password-reset-throttle'\nexport * from './lib/server/rate-limit-store'\nexport * from './lib/server/verify-email-cooldown'\nexport * from './lib/server/vercel-drain-signature'\nexport * from './lib/server/vercel-log-drain'\nexport * from './lib/server/visitor-write-rate-limit'\nexport * from './lib/server/console-api-rate-limit'\nexport * from './lib/server/realm-plugins'\nexport * from './lib/server/release-flags'\nexport * from './lib/server/resolve-people'\nexport * from './lib/server/member-photo'\nexport * from './lib/server/personal-data-export'\nexport * from './lib/server/media-delivery'\nexport * from './lib/server/media-download-tokens'\nexport * from './lib/server/media-quarantine'\nexport * from './lib/server/media-signing'\nexport * from './lib/server/media-storage-path'\nexport * from './lib/server/safe-equal'\nexport * from './lib/server/media-strong-digest'\nexport * from './lib/server/media-tombstone'\nexport * from './lib/server/media-variants'\nexport * from './lib/server/serve-media-cdn'\nexport * from './lib/server/serve-plugin-fetch'\nexport * from './lib/server/sso-break-glass-owners'\nexport * from './lib/server/sso-domain-policy'\nexport * from './lib/server/sso-enforcement'\nexport * from './lib/server/sso-provisioning'\nexport * from './lib/server/update-existing'\nexport * from './lib/server/contact-company-link'\nexport * from './lib/server/contact-email-index'\nexport * from './lib/server/contact-merge'\nexport * from './lib/server/upsert-contact'\n// The stage floor a won deal applies to its contact (AGL-2641).\nexport * from './lib/server/contact-lifecycle-floor'\nexport * from './lib/server/crm-records'\n// The `nextTaskAtMs` a contact, a company and a deal carry, recomputed from\n// their open tasks by every server-side task writer (AGL-2661).\nexport * from './lib/server/crm-next-activity'\n// Where a one-to-one email's activity row lives and how the delivery\n// webhook advances it (AGL-2615).\nexport * from './lib/server/crm-email-activity'\n// What a confirmed booking files on the CRM record — the meeting and the\n// follow-up (AGL-2660).\nexport * from './lib/server/crm-booking-activity'\n// The org's email capture token and the filing of one received message\n// on the record it was with (AGL-2657).\nexport * from './lib/server/crm-inbound-email'\n// A member's own addresses in a workspace, and the signed link that\n// confirms one (AGL-2975).\nexport * from './lib/server/member-email-aliases'\nexport * from './lib/server/user-profiles'\nexport * from './lib/server/legal-acceptance'\n// The person's decision about the platform's own product email, on their\n// document and on the operator's marketing contact (AGL-3185).\nexport * from './lib/server/platform-marketing-consent'\n"],"names":["domainProvider"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,cAAc,sCAAkC;AAChD,cAAc,2BAAuB;AACrC,cAAc,2BAAuB;AACrC,cAAc,iCAA6B;AAC3C,cAAc,6BAAyB;AACvC,cAAc,sCAAkC;AAChD,cAAc,yCAAqC;AACnD,cAAc,yCAAqC;AACnD,cAAc,sCAAkC;AAChD,cAAc,+BAA2B;AACzC,cAAc,kCAA8B;AAC5C,cAAc,4BAAwB;AACtC,cAAc,kCAA8B;AAC5C,cAAc,sCAAkC;AAChD,cAAc,sCAAkC;AAChD,cAAc,yCAAqC;AACnD,6EAA6E;AAC7E,+DAA+D;AAC/D,+EAA+E;AAC/E,wCAAwC;AACxC,SAASA,cAAc,QAAQ,kCAA8B;AAM7D,cAAc,wCAAoC;AAClD,cAAc,+BAA2B;AACzC,cAAc,gCAA4B;AAC1C,cAAc,oCAAgC;AAC9C,cAAc,sCAAkC;AAChD,cAAc,oCAAgC;AAC9C,4EAA4E;AAC5E,8EAA8E;AAC9E,sBAAsB;AACtB,cAAc,2CAAuC;AACrD,cAAc,yCAAqC;AACnD,cAAc,kCAA8B;AAC5C,wEAAwE;AACxE,4EAA4E;AAC5E,4EAA4E;AAC5E,8DAA8D;AAC9D,cAAc,uCAAmC;AACjD,cAAc,+BAA2B;AACzC,cAAc,8BAA0B;AACxC,cAAc,oCAAgC;AAC9C,cAAc,oCAAgC;AAC9C,cAAc,kCAA8B;AAC5C,cAAc,iCAA6B;AAC3C,4EAA4E;AAC5E,2EAA2E;AAC3E,wEAAwE;AACxE,cAAc,kDAA8C;AAC5D,cAAc,kCAA8B;AAC5C,cAAc,0CAAsC;AACpD,cAAc,wBAAoB;AAClC,cAAc,+BAA2B;AACzC,cAAc,2CAAuC;AACrD,cAAc,iCAA6B;AAC3C,cAAc,qCAAiC;AAC/C,cAAc,2CAAuC;AACrD,cAAc,mCAA+B;AAC7C,cAAc,uCAAmC;AACjD,cAAc,+BAA2B;AACzC,cAAc,2BAAuB;AACrC,cAAc,mCAA+B;AAC7C,cAAc,wCAAoC;AAClD,cAAc,oCAAgC;AAC9C,cAAc,gCAA4B;AAC1C,cAAc,8BAA0B;AACxC,cAAc,gCAA4B;AAC1C,cAAc,qCAAiC;AAC/C,cAAc,qCAAiC;AAC/C,cAAc,oCAAgC;AAC9C,cAAc,8CAA0C;AACxD,cAAc,0CAAsC;AACpD,cAAc,mCAA+B;AAC7C,cAAc,wCAAoC;AAClD,cAAc,yCAAqC;AACnD,cAAc,mCAA+B;AAC7C,cAAc,2CAAuC;AACrD,cAAc,yCAAqC;AACnD,cAAc,gCAA4B;AAC1C,cAAc,gCAA4B;AAC1C,cAAc,iCAA6B;AAC3C,cAAc,+BAA2B;AACzC,cAAc,uCAAmC;AACjD,cAAc,iCAA6B;AAC3C,cAAc,wCAAoC;AAClD,cAAc,mCAA+B;AAC7C,cAAc,gCAA4B;AAC1C,cAAc,qCAAiC;AAC/C,cAAc,6BAAyB;AACvC,cAAc,sCAAkC;AAChD,cAAc,kCAA8B;AAC5C,cAAc,iCAA6B;AAC3C,cAAc,kCAA8B;AAC5C,cAAc,qCAAiC;AAC/C,cAAc,yCAAqC;AACnD,cAAc,oCAAgC;AAC9C,cAAc,kCAA8B;AAC5C,cAAc,mCAA+B;AAC7C,cAAc,kCAA8B;AAC5C,cAAc,uCAAmC;AACjD,cAAc,sCAAkC;AAChD,cAAc,gCAA4B;AAC1C,cAAc,iCAA6B;AAC3C,gEAAgE;AAChE,cAAc,0CAAsC;AACpD,cAAc,8BAA0B;AACxC,4EAA4E;AAC5E,gEAAgE;AAChE,cAAc,oCAAgC;AAC9C,qEAAqE;AACrE,kCAAkC;AAClC,cAAc,qCAAiC;AAC/C,yEAAyE;AACzE,wBAAwB;AACxB,cAAc,uCAAmC;AACjD,uEAAuE;AACvE,wCAAwC;AACxC,cAAc,oCAAgC;AAC9C,oEAAoE;AACpE,2BAA2B;AAC3B,cAAc,uCAAmC;AACjD,cAAc,gCAA4B;AAC1C,cAAc,mCAA+B;AAC7C,yEAAyE;AACzE,+DAA+D;AAC/D,cAAc,6CAAyC"}