@aglyn/tenant-data-admin 1.0.0-beta.203 → 1.0.0-beta.204

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/tenant-data-admin",
-  "version": "1.0.0-beta.203",
+  "version": "1.0.0-beta.204",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,12 +25,12 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/aglyn": "1.0.0-beta.203",
-    "@aglyn/shared-util-email": "1.0.0-beta.203",
-    "@aglyn/shared-util-fbserver": "1.0.0-beta.203",
-    "@aglyn/shared-util-first-touch": "1.0.0-beta.203",
-    "@aglyn/shared-util-http": "1.0.0-beta.203",
-    "@aglyn/shared-util-tools": "1.0.0-beta.203",
+    "@aglyn/aglyn": "1.0.0-beta.204",
+    "@aglyn/shared-util-email": "1.0.0-beta.204",
+    "@aglyn/shared-util-fbserver": "1.0.0-beta.204",
+    "@aglyn/shared-util-first-touch": "1.0.0-beta.204",
+    "@aglyn/shared-util-http": "1.0.0-beta.204",
+    "@aglyn/shared-util-tools": "1.0.0-beta.204",
     "@msgpack/msgpack": "^3.1.3",
     "@swc/helpers": "0.5.23",
     "sharp": "^0.35.3",

package/src/lib/server/capture-email-check.d.ts

@@ -0,0 +1,109 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type EmailDeliverabilityCode, type MailGateway, type MailGatewayChip } from '@aglyn/shared-util-email';
+import { type MailDeliverabilityDeps } from './email-deliverability';
+/** One captured address, and whose records it lands on. */
+export interface CapturedEmail {
+    /** The organization whose records carry it; or `hostId`, which the writer reads the organization off. */
+    orgId?: string | null;
+    hostId?: string | null;
+    email: string;
+    /**
+     * The record already holds the check's own `undeliverable` verdict: a
+     * domain that answers now withdraws it, and one that still takes no mail
+     * writes nothing again.
+     */
+    predicted?: boolean;
+}
+/** What one run of the check did. */
+export interface CapturedEmailCheckReport {
+    /** Addresses whose domain was answered for. */
+    checked: number;
+    /** Addresses whose domain takes no mail. */
+    undeliverable: number;
+    /** Records the seam moved to "Would bounce". */
+    stamped: number;
+    /** Records whose "Would bounce" was withdrawn. */
+    withdrawn: number;
+}
+/**
+ * How long an import waits, past its last write, for its addresses' mail
+ * servers before it answers without the count (see `settleWithin`).
+ */
+export declare const IMPORT_MAIL_CHECK_GRACE_MS = 5000;
+/**
+ * Checks the addresses and writes what was found onto their records: "Would
+ * bounce" for a domain that takes no mail, the withdrawal of a standing
+ * "Would bounce" for one that does again. Never throws — the capture has
+ * already happened, and a record left unstamped is what the backfill is for.
+ */
+export declare function checkCapturedEmails(items: readonly CapturedEmail[], deps?: MailDeliverabilityDeps): Promise<CapturedEmailCheckReport>;
+/** Runs whatever is queued. Exported for the spec; production reaches it through `after()`. */
+export declare function flushCapturedEmailChecks(deps?: MailDeliverabilityDeps): Promise<CapturedEmailCheckReport>;
+/**
+ * Queues one captured address for the check, which runs once the response
+ * has been sent — see the module note. Returns at once, never throws, and
+ * costs the caller nothing but the push.
+ */
+export declare function scheduleCapturedEmailCheck(item: CapturedEmail): void;
+/** Test seam: drop anything queued. */
+export declare function resetCapturedEmailChecksForTests(): void;
+/** What is queued, for the spec. */
+export declare function queuedCapturedEmailsForTests(): readonly CapturedEmail[];
+/**
+ * Which of these addresses (normalized) have a domain that takes no mail,
+ * from the same cache the check writes — what an import's result counts.
+ * Never rejects: `null` when the answer could not be had, and the import
+ * says nothing rather than something untrue.
+ */
+export declare function findUndeliverableEmails(emails: readonly string[], deps?: MailDeliverabilityDeps): Promise<Set<string> | null>;
+/**
+ * `promise`'s answer, or `null` when it has not arrived within `ms`. An
+ * import starts its lookups with its first row and waits this long past its
+ * last write for them; a slower answer still stamps the records, through the
+ * check the writes queued, and only the count is left unsaid.
+ */
+export declare function settleWithin<T>(promise: Promise<T>, ms: number): Promise<T | null>;
+/** How many of `emails` a {@link findUndeliverableEmails} answer names; `undefined` without an answer. */
+export declare function countUndeliverableEmails(emails: readonly string[], undeliverable: ReadonlySet<string> | null): number | undefined;
+/** What a surface shows for one address before somebody writes to it. */
+export interface AddressDeliverability {
+    /** The address, normalized; `null` when it is not one. */
+    email: string | null;
+    /** Whether the domain's MX was read; `false` means nothing is known, and nothing is warned. */
+    checked: boolean;
+    /** The finding a composer warns with — a domain with no mail server, or a gateway holding this sender. */
+    code: Extract<EmailDeliverabilityCode, 'no_mx' | 'null_mx' | 'gateway_held'> | null;
+    /** That finding in a sentence, as the engine words it. */
+    message: string | null;
+    /** The gateway in front of the address, when its MX names one. */
+    gateway: MailGateway | null;
+    /** The chip beside the address: the gateway, and what it did with this sender's mail this week. */
+    chip: MailGatewayChip | null;
+}
+/**
+ * One address's standing for the site mail would leave from: the platform
+ * MX cache (looked up, server side, when cold) and the sending domain's
+ * gateway ledger. Read, never written onto a record — a composer asks it
+ * before a send and a record page before it draws the address. `from` is
+ * the sending identity's address; without one, no ledger is read and
+ * nothing is held.
+ */
+export declare function readAddressDeliverability(input: {
+    email: string;
+    from?: string | null;
+}, deps?: MailDeliverabilityDeps): Promise<AddressDeliverability>;

package/src/lib/server/capture-email-check.js

@@ -0,0 +1,362 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * THE DELIVERABILITY CHECK AT CAPTURE (AGL-3328).
+ *
+ * A person arrives — a form, an import, the New lead drawer, `POST
+ * /v1/contacts`, a list add — and the address they gave is looked at
+ * before anybody writes to it: the domain's MX, from the platform cache
+ * `email-deliverability.ts` keeps. A domain that takes no mail (no MX, or
+ * RFC 7505's null MX) puts `undeliverable` — "Would bounce" — on every
+ * record the address is, through the core's record email-state seam, so the
+ * record a person opens says so and the lists' `emailStatus` filter finds
+ * it.
+ *
+ * ## Never on the write's time
+ *
+ * The writers that call this — `addHostLead`, `upsertHostContact`,
+ * `enrollListMember`, the API's contact create — have finished their own
+ * write when they do, and they do not wait: {@link scheduleCapturedEmailCheck}
+ * queues the address and runs the queue in `after()`, once the response
+ * has gone. One flush per invocation, however many rows an import wrote,
+ * so a file of five hundred people from forty domains asks forty domains.
+ *
+ * `after()` rather than a bare promise (AGL-2327): a serverless invocation
+ * is frozen the moment its response is sent, and work scheduled any other
+ * way does not run. Outside a request — a script, a spec — there is nothing
+ * to defer to, and nothing is checked; the backfill covers what those
+ * write.
+ *
+ * ## The check's own verdict, and only that, is taken back
+ *
+ * `undeliverable` is the weakest refusal (`email-state.ts`): any real bounce
+ * or block replaces it. The check withdraws it when the domain takes mail
+ * again — a typo'd domain somebody since registered, a company that set up
+ * its mail — and only when the record's standing verdict is that one; a
+ * bounce is never cleared by DNS. A writer that knows the record held it
+ * says so (`predicted`), which is what lets every other capture skip the
+ * read a withdrawal costs.
+ *==========================================*/ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { isPublicMailboxDomain } from "@aglyn/aglyn/app-utils/crm";
+import { stampRecordEmailState } from "@aglyn/aglyn/plugin-manager/plugin-record-email-state";
+import { bareSenderAddress, decidingDeliverabilityFinding, mailDomainRefusesMail, mailGatewayChip, mailGatewayStanding, normalizeDeliverabilityEmail } from "@aglyn/shared-util-email";
+import { isGatewayHeldVerdict, isNoMailServerVerdict, readMailDeliverability } from "./email-deliverability.js";
+/**
+ * How long an import waits, past its last write, for its addresses' mail
+ * servers before it answers without the count (see `settleWithin`).
+ */ export const IMPORT_MAIL_CHECK_GRACE_MS = 5000;
+/** The seam's writes in flight at once. */ const STAMP_CONCURRENCY = 8;
+/** Addresses one invocation may hold for its flush; past it, the backfill catches up. */ const QUEUE_MAX = 20000;
+/** Runs `work` over `items`, at most `limit` at a time. */ async function eachLimited(items, limit, work) {
+    let next = 0;
+    const runners = Array.from({
+        length: Math.min(limit, items.length)
+    }, async ()=>{
+        while(next < items.length){
+            const item = items[next];
+            next += 1;
+            await work(item);
+        }
+    });
+    await Promise.all(runners);
+}
+/**
+ * The detail a "Would bounce" carries. A missing mail server is what the
+ * chip already says; a null MX is the domain saying it outright, which is
+ * worth the words.
+ */ function undeliverableDetail(verdict) {
+    var _verdict_intel;
+    return ((_verdict_intel = verdict.intel) == null ? void 0 : _verdict_intel.status) === 'null_mx' ? `${verdict.domain} publishes a null MX record: it says it accepts no email.` : null;
+}
+/** The address a verdict answers for, as the seam keys it. */ function stampTarget(item) {
+    var _item_orgId, _item_hostId;
+    const orgId = String((_item_orgId = item.orgId) != null ? _item_orgId : '').trim();
+    if (orgId) return {
+        orgId
+    };
+    const hostId = String((_item_hostId = item.hostId) != null ? _item_hostId : '').trim();
+    return hostId ? {
+        hostId
+    } : null;
+}
+/**
+ * Checks the addresses and writes what was found onto their records: "Would
+ * bounce" for a domain that takes no mail, the withdrawal of a standing
+ * "Would bounce" for one that does again. Never throws — the capture has
+ * already happened, and a record left unstamped is what the backfill is for.
+ */ export async function checkCapturedEmails(items, deps = {}) {
+    var _deps_nowMs;
+    const report = {
+        checked: 0,
+        undeliverable: 0,
+        stamped: 0,
+        withdrawn: 0
+    };
+    // One entry per record set: the same address captured twice for one
+    // organization in one flush is asked about once, and a `predicted` on
+    // either capture stands.
+    const unique = new Map();
+    for (const item of items){
+        var _target_orgId;
+        const email = normalizeDeliverabilityEmail(item == null ? void 0 : item.email);
+        const target = item ? stampTarget(item) : null;
+        if (!email || !target) continue;
+        const key = `${(_target_orgId = target.orgId) != null ? _target_orgId : `host:${target.hostId}`}|${email}`;
+        const held = unique.get(key);
+        unique.set(key, _extends({}, target, {
+            email,
+            predicted: Boolean((held == null ? void 0 : held.predicted) || item.predicted)
+        }));
+    }
+    if (!unique.size) return report;
+    const nowMs = (_deps_nowMs = deps.nowMs) != null ? _deps_nowMs : Date.now();
+    let verdicts;
+    try {
+        verdicts = await readMailDeliverability({
+            emails: [
+                ...new Set([
+                    ...unique.values()
+                ].map((item)=>item.email))
+            ],
+            purpose: 'bulk',
+            sendingDomain: null,
+            scope: null
+        }, _extends({}, deps, {
+            nowMs
+        }));
+    } catch (error) {
+        console.error('[deliverability] captured addresses could not be checked', error);
+        return report;
+    }
+    const writes = [];
+    for (const item of unique.values()){
+        var _item_hostId;
+        const verdict = verdicts.get(item.email);
+        if (!verdict || verdict.outcome === 'unchecked') continue;
+        report.checked += 1;
+        const target = _extends({}, item.orgId ? {
+            orgId: item.orgId
+        } : {
+            hostId: (_item_hostId = item.hostId) != null ? _item_hostId : ''
+        });
+        if (isNoMailServerVerdict(verdict)) {
+            report.undeliverable += 1;
+            if (item.predicted) continue;
+            const state = {
+                status: 'undeliverable',
+                atMs: nowMs,
+                source: 'check',
+                detail: undeliverableDetail(verdict)
+            };
+            writes.push(async ()=>{
+                var _ref;
+                const stamped = await stampRecordEmailState(_extends({}, target, {
+                    email: item.email,
+                    state
+                }));
+                report.stamped += (_ref = stamped == null ? void 0 : stamped.records) != null ? _ref : 0;
+            });
+        } else if (item.predicted && verdict.intel && !mailDomainRefusesMail(verdict.intel.status)) {
+            const state = {
+                status: 'undeliverable',
+                atMs: nowMs,
+                source: 'check',
+                detail: null
+            };
+            writes.push(async ()=>{
+                var _ref;
+                const withdrawn = await stampRecordEmailState(_extends({}, target, {
+                    email: item.email,
+                    state,
+                    withdraw: true
+                }));
+                report.withdrawn += (_ref = withdrawn == null ? void 0 : withdrawn.records) != null ? _ref : 0;
+            });
+        }
+    }
+    await eachLimited(writes, STAMP_CONCURRENCY, (write)=>write());
+    return report;
+}
+/*==========================================
+ * THE QUEUE, FLUSHED AFTER THE RESPONSE
+ *==========================================*/ const queued = [];
+let flushScheduled = false;
+/**
+ * Next's `after()`, required when first asked for rather than imported:
+ * `next/server` evaluates web `Request` classes at load, which a jsdom spec
+ * reaching one of the writers cannot, and this module rides every writer's
+ * import. `null` where it cannot be loaded.
+ */ function afterResponse() {
+    try {
+        const loaded = require('next/server');
+        return typeof (loaded == null ? void 0 : loaded.after) === 'function' ? loaded.after : null;
+    } catch (unused) {
+        return null;
+    }
+}
+/** Runs whatever is queued. Exported for the spec; production reaches it through `after()`. */ export async function flushCapturedEmailChecks(deps = {}) {
+    flushScheduled = false;
+    const batch = queued.splice(0);
+    if (!batch.length) return {
+        checked: 0,
+        undeliverable: 0,
+        stamped: 0,
+        withdrawn: 0
+    };
+    return checkCapturedEmails(batch, deps);
+}
+/**
+ * Queues one captured address for the check, which runs once the response
+ * has been sent — see the module note. Returns at once, never throws, and
+ * costs the caller nothing but the push.
+ */ export function scheduleCapturedEmailCheck(item) {
+    try {
+        if (!item || !normalizeDeliverabilityEmail(item.email) || !stampTarget(item)) return;
+        if (queued.length >= QUEUE_MAX) return;
+        queued.push(_extends({}, item));
+        if (flushScheduled) return;
+        try {
+            const after = afterResponse();
+            if (!after) throw new Error('no request to run after');
+            after(()=>flushCapturedEmailChecks().then(()=>undefined));
+            flushScheduled = true;
+        } catch (unused) {
+            // No request to run after: a script or a spec. Nothing is checked.
+            queued.length = 0;
+        }
+    } catch (error) {
+        console.error('[deliverability] a captured address could not be queued', error);
+    }
+}
+/** Test seam: drop anything queued. */ export function resetCapturedEmailChecksForTests() {
+    queued.length = 0;
+    flushScheduled = false;
+}
+/** What is queued, for the spec. */ export function queuedCapturedEmailsForTests() {
+    return queued;
+}
+/*==========================================
+ * WHAT AN IMPORT REPORTS
+ *==========================================*/ /**
+ * Which of these addresses (normalized) have a domain that takes no mail,
+ * from the same cache the check writes — what an import's result counts.
+ * Never rejects: `null` when the answer could not be had, and the import
+ * says nothing rather than something untrue.
+ */ export async function findUndeliverableEmails(emails, deps = {}) {
+    const wanted = [
+        ...new Set(emails.map((email)=>normalizeDeliverabilityEmail(email)).filter((email)=>Boolean(email)))
+    ];
+    if (!wanted.length) return new Set();
+    try {
+        const verdicts = await readMailDeliverability({
+            emails: wanted,
+            purpose: 'bulk',
+            sendingDomain: null,
+            scope: null
+        }, deps);
+        const found = new Set();
+        for (const [email, verdict] of verdicts)if (isNoMailServerVerdict(verdict)) found.add(email);
+        return found;
+    } catch (error) {
+        console.error('[deliverability] an import’s addresses could not be checked', error);
+        return null;
+    }
+}
+/**
+ * `promise`'s answer, or `null` when it has not arrived within `ms`. An
+ * import starts its lookups with its first row and waits this long past its
+ * last write for them; a slower answer still stamps the records, through the
+ * check the writes queued, and only the count is left unsaid.
+ */ export async function settleWithin(promise, ms) {
+    let timer;
+    const late = new Promise((resolve)=>{
+        timer = setTimeout(()=>resolve(null), Math.max(0, ms));
+    });
+    try {
+        return await Promise.race([
+            promise,
+            late
+        ]);
+    } finally{
+        if (timer) clearTimeout(timer);
+    }
+}
+/** How many of `emails` a {@link findUndeliverableEmails} answer names; `undefined` without an answer. */ export function countUndeliverableEmails(emails, undeliverable) {
+    if (!undeliverable) return undefined;
+    let count = 0;
+    for (const email of new Set(emails.map((entry)=>normalizeDeliverabilityEmail(entry)))){
+        if (email && undeliverable.has(email)) count += 1;
+    }
+    return count;
+}
+/**
+ * One address's standing for the site mail would leave from: the platform
+ * MX cache (looked up, server side, when cold) and the sending domain's
+ * gateway ledger. Read, never written onto a record — a composer asks it
+ * before a send and a record page before it draws the address. `from` is
+ * the sending identity's address; without one, no ledger is read and
+ * nothing is held.
+ */ export async function readAddressDeliverability(input, deps = {}) {
+    var _input_from, _deps_nowMs, _verdict_gateway;
+    const email = normalizeDeliverabilityEmail(input.email);
+    const none = {
+        email,
+        checked: false,
+        code: null,
+        message: null,
+        gateway: null,
+        chip: null
+    };
+    if (!email) return none;
+    const sender = bareSenderAddress((_input_from = input.from) != null ? _input_from : null);
+    const sendingDomain = sender ? sender.slice(sender.lastIndexOf('@') + 1) : null;
+    const nowMs = (_deps_nowMs = deps.nowMs) != null ? _deps_nowMs : Date.now();
+    let verdict;
+    try {
+        verdict = (await readMailDeliverability({
+            emails: [
+                email
+            ],
+            purpose: 'bulk',
+            sendingDomain,
+            scope: null
+        }, _extends({}, deps, {
+            nowMs
+        }))).get(email);
+    } catch (error) {
+        console.error('[deliverability] an address could not be checked', error);
+        return none;
+    }
+    if (!(verdict == null ? void 0 : verdict.intel)) return none;
+    const deciding = decidingDeliverabilityFinding(verdict);
+    const warns = isNoMailServerVerdict(verdict) || isGatewayHeldVerdict(verdict);
+    const standing = (_verdict_gateway = verdict.gateway) != null ? _verdict_gateway : mailGatewayStanding(verdict.intel.gateway, null, nowMs);
+    let chip = mailGatewayChip(standing);
+    // A public mailbox provider's MX is the provider's, not a gateway the
+    // person's company chose: "Google Workspace" beside a gmail.com address
+    // says something untrue. It keeps a chip only for a verdict this week.
+    if ((chip == null ? void 0 : chip.tone) === 'neutral' && isPublicMailboxDomain(verdict.domain)) chip = null;
+    return {
+        email,
+        checked: true,
+        code: warns && deciding ? deciding.code : null,
+        message: warns && deciding ? deciding.message : null,
+        gateway: verdict.intel.gateway === 'none' ? null : verdict.intel.gateway,
+        chip
+    };
+}
+
+//# sourceMappingURL=capture-email-check.js.map

package/src/lib/server/capture-email-check.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/capture-email-check.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * THE DELIVERABILITY CHECK AT CAPTURE (AGL-3328).\n *\n * A person arrives — a form, an import, the New lead drawer, `POST\n * /v1/contacts`, a list add — and the address they gave is looked at\n * before anybody writes to it: the domain's MX, from the platform cache\n * `email-deliverability.ts` keeps. A domain that takes no mail (no MX, or\n * RFC 7505's null MX) puts `undeliverable` — \"Would bounce\" — on every\n * record the address is, through the core's record email-state seam, so the\n * record a person opens says so and the lists' `emailStatus` filter finds\n * it.\n *\n * ## Never on the write's time\n *\n * The writers that call this — `addHostLead`, `upsertHostContact`,\n * `enrollListMember`, the API's contact create — have finished their own\n * write when they do, and they do not wait: {@link scheduleCapturedEmailCheck}\n * queues the address and runs the queue in `after()`, once the response\n * has gone. One flush per invocation, however many rows an import wrote,\n * so a file of five hundred people from forty domains asks forty domains.\n *\n * `after()` rather than a bare promise (AGL-2327): a serverless invocation\n * is frozen the moment its response is sent, and work scheduled any other\n * way does not run. Outside a request — a script, a spec — there is nothing\n * to defer to, and nothing is checked; the backfill covers what those\n * write.\n *\n * ## The check's own verdict, and only that, is taken back\n *\n * `undeliverable` is the weakest refusal (`email-state.ts`): any real bounce\n * or block replaces it. The check withdraws it when the domain takes mail\n * again — a typo'd domain somebody since registered, a company that set up\n * its mail — and only when the record's standing verdict is that one; a\n * bounce is never cleared by DNS. A writer that knows the record held it\n * says so (`predicted`), which is what lets every other capture skip the\n * read a withdrawal costs.\n *==========================================*/\n\nimport type { EmailState } from '@aglyn/aglyn/app-utils/email-state'\nimport { isPublicMailboxDomain } from '@aglyn/aglyn/app-utils/crm'\nimport { stampRecordEmailState } from '@aglyn/aglyn/plugin-manager/plugin-record-email-state'\nimport {\n  bareSenderAddress,\n  decidingDeliverabilityFinding,\n  type EmailDeliverabilityCode,\n  type EmailDeliverabilityVerdict,\n  type MailGateway,\n  type MailGatewayChip,\n  mailDomainRefusesMail,\n  mailGatewayChip,\n  mailGatewayStanding,\n  normalizeDeliverabilityEmail,\n} from '@aglyn/shared-util-email'\nimport {\n  isGatewayHeldVerdict,\n  isNoMailServerVerdict,\n  type MailDeliverabilityDeps,\n  readMailDeliverability,\n} from './email-deliverability'\n\n/** One captured address, and whose records it lands on. */\nexport interface CapturedEmail {\n  /** The organization whose records carry it; or `hostId`, which the writer reads the organization off. */\n  orgId?: string | null\n  hostId?: string | null\n  email: string\n  /**\n   * The record already holds the check's own `undeliverable` verdict: a\n   * domain that answers now withdraws it, and one that still takes no mail\n   * writes nothing again.\n   */\n  predicted?: boolean\n}\n\n/** What one run of the check did. */\nexport interface CapturedEmailCheckReport {\n  /** Addresses whose domain was answered for. */\n  checked: number\n  /** Addresses whose domain takes no mail. */\n  undeliverable: number\n  /** Records the seam moved to \"Would bounce\". */\n  stamped: number\n  /** Records whose \"Would bounce\" was withdrawn. */\n  withdrawn: number\n}\n\n/**\n * How long an import waits, past its last write, for its addresses' mail\n * servers before it answers without the count (see `settleWithin`).\n */\nexport const IMPORT_MAIL_CHECK_GRACE_MS = 5_000\n\n/** The seam's writes in flight at once. */\nconst STAMP_CONCURRENCY = 8\n\n/** Addresses one invocation may hold for its flush; past it, the backfill catches up. */\nconst QUEUE_MAX = 20_000\n\n/** Runs `work` over `items`, at most `limit` at a time. */\nasync function eachLimited<T>(items: readonly T[], limit: number, work: (item: T) => Promise<void>): Promise<void> {\n  let next = 0\n  const runners = Array.from({ length: Math.min(limit, items.length) }, async () => {\n    while (next < items.length) {\n      const item = items[next]\n      next += 1\n      await work(item)\n    }\n  })\n  await Promise.all(runners)\n}\n\n/**\n * The detail a \"Would bounce\" carries. A missing mail server is what the\n * chip already says; a null MX is the domain saying it outright, which is\n * worth the words.\n */\nfunction undeliverableDetail(verdict: EmailDeliverabilityVerdict): string | null {\n  return verdict.intel?.status === 'null_mx'\n    ? `${verdict.domain} publishes a null MX record: it says it accepts no email.`\n    : null\n}\n\n/** The address a verdict answers for, as the seam keys it. */\nfunction stampTarget(item: CapturedEmail): { orgId?: string; hostId?: string } | null {\n  const orgId = String(item.orgId ?? '').trim()\n  if (orgId) return { orgId }\n  const hostId = String(item.hostId ?? '').trim()\n  return hostId ? { hostId } : null\n}\n\n/**\n * Checks the addresses and writes what was found onto their records: \"Would\n * bounce\" for a domain that takes no mail, the withdrawal of a standing\n * \"Would bounce\" for one that does again. Never throws — the capture has\n * already happened, and a record left unstamped is what the backfill is for.\n */\nexport async function checkCapturedEmails(\n  items: readonly CapturedEmail[],\n  deps: MailDeliverabilityDeps = {},\n): Promise<CapturedEmailCheckReport> {\n  const report: CapturedEmailCheckReport = { checked: 0, undeliverable: 0, stamped: 0, withdrawn: 0 }\n  // One entry per record set: the same address captured twice for one\n  // organization in one flush is asked about once, and a `predicted` on\n  // either capture stands.\n  const unique = new Map<string, CapturedEmail & { email: string }>()\n  for (const item of items) {\n    const email = normalizeDeliverabilityEmail(item?.email)\n    const target = item ? stampTarget(item) : null\n    if (!email || !target) continue\n    const key = `${target.orgId ?? `host:${target.hostId}`}|${email}`\n    const held = unique.get(key)\n    unique.set(key, { ...target, email, predicted: Boolean(held?.predicted || item.predicted) })\n  }\n  if (!unique.size) return report\n\n  const nowMs = deps.nowMs ?? Date.now()\n  let verdicts: Map<string, EmailDeliverabilityVerdict>\n  try {\n    verdicts = await readMailDeliverability(\n      {\n        emails: [...new Set([...unique.values()].map((item) => item.email))],\n        purpose: 'bulk',\n        sendingDomain: null,\n        scope: null,\n      },\n      { ...deps, nowMs },\n    )\n  } catch (error) {\n    console.error('[deliverability] captured addresses could not be checked', error)\n    return report\n  }\n\n  const writes: Array<() => Promise<void>> = []\n  for (const item of unique.values()) {\n    const verdict = verdicts.get(item.email)\n    if (!verdict || verdict.outcome === 'unchecked') continue\n    report.checked += 1\n    const target = { ...(item.orgId ? { orgId: item.orgId } : { hostId: item.hostId ?? '' }) }\n    if (isNoMailServerVerdict(verdict)) {\n      report.undeliverable += 1\n      if (item.predicted) continue\n      const state: EmailState = {\n        status: 'undeliverable',\n        atMs: nowMs,\n        source: 'check',\n        detail: undeliverableDetail(verdict),\n      }\n      writes.push(async () => {\n        const stamped = await stampRecordEmailState({ ...target, email: item.email, state })\n        report.stamped += stamped?.records ?? 0\n      })\n    } else if (item.predicted && verdict.intel && !mailDomainRefusesMail(verdict.intel.status)) {\n      const state: EmailState = { status: 'undeliverable', atMs: nowMs, source: 'check', detail: null }\n      writes.push(async () => {\n        const withdrawn = await stampRecordEmailState({ ...target, email: item.email, state, withdraw: true })\n        report.withdrawn += withdrawn?.records ?? 0\n      })\n    }\n  }\n  await eachLimited(writes, STAMP_CONCURRENCY, (write) => write())\n  return report\n}\n\n/*==========================================\n * THE QUEUE, FLUSHED AFTER THE RESPONSE\n *==========================================*/\n\nconst queued: CapturedEmail[] = []\nlet flushScheduled = false\n\ntype AfterResponse = (task: () => Promise<void>) => void\n\n/**\n * Next's `after()`, required when first asked for rather than imported:\n * `next/server` evaluates web `Request` classes at load, which a jsdom spec\n * reaching one of the writers cannot, and this module rides every writer's\n * import. `null` where it cannot be loaded.\n */\nfunction afterResponse(): AfterResponse | null {\n  try {\n    const loaded = require('next/server') as { after?: AfterResponse }\n    return typeof loaded?.after === 'function' ? loaded.after : null\n  } catch {\n    return null\n  }\n}\n\n/** Runs whatever is queued. Exported for the spec; production reaches it through `after()`. */\nexport async function flushCapturedEmailChecks(deps: MailDeliverabilityDeps = {}): Promise<CapturedEmailCheckReport> {\n  flushScheduled = false\n  const batch = queued.splice(0)\n  if (!batch.length) return { checked: 0, undeliverable: 0, stamped: 0, withdrawn: 0 }\n  return checkCapturedEmails(batch, deps)\n}\n\n/**\n * Queues one captured address for the check, which runs once the response\n * has been sent — see the module note. Returns at once, never throws, and\n * costs the caller nothing but the push.\n */\nexport function scheduleCapturedEmailCheck(item: CapturedEmail): void {\n  try {\n    if (!item || !normalizeDeliverabilityEmail(item.email) || !stampTarget(item)) return\n    if (queued.length >= QUEUE_MAX) return\n    queued.push({ ...item })\n    if (flushScheduled) return\n    try {\n      const after = afterResponse()\n      if (!after) throw new Error('no request to run after')\n      after(() => flushCapturedEmailChecks().then(() => undefined))\n      flushScheduled = true\n    } catch {\n      // No request to run after: a script or a spec. Nothing is checked.\n      queued.length = 0\n    }\n  } catch (error) {\n    console.error('[deliverability] a captured address could not be queued', error)\n  }\n}\n\n/** Test seam: drop anything queued. */\nexport function resetCapturedEmailChecksForTests(): void {\n  queued.length = 0\n  flushScheduled = false\n}\n\n/** What is queued, for the spec. */\nexport function queuedCapturedEmailsForTests(): readonly CapturedEmail[] {\n  return queued\n}\n\n/*==========================================\n * WHAT AN IMPORT REPORTS\n *==========================================*/\n\n/**\n * Which of these addresses (normalized) have a domain that takes no mail,\n * from the same cache the check writes — what an import's result counts.\n * Never rejects: `null` when the answer could not be had, and the import\n * says nothing rather than something untrue.\n */\nexport async function findUndeliverableEmails(\n  emails: readonly string[],\n  deps: MailDeliverabilityDeps = {},\n): Promise<Set<string> | null> {\n  const wanted = [\n    ...new Set(emails.map((email) => normalizeDeliverabilityEmail(email)).filter((email): email is string => Boolean(email))),\n  ]\n  if (!wanted.length) return new Set()\n  try {\n    const verdicts = await readMailDeliverability(\n      { emails: wanted, purpose: 'bulk', sendingDomain: null, scope: null },\n      deps,\n    )\n    const found = new Set<string>()\n    for (const [email, verdict] of verdicts) if (isNoMailServerVerdict(verdict)) found.add(email)\n    return found\n  } catch (error) {\n    console.error('[deliverability] an import’s addresses could not be checked', error)\n    return null\n  }\n}\n\n/**\n * `promise`'s answer, or `null` when it has not arrived within `ms`. An\n * import starts its lookups with its first row and waits this long past its\n * last write for them; a slower answer still stamps the records, through the\n * check the writes queued, and only the count is left unsaid.\n */\nexport async function settleWithin<T>(promise: Promise<T>, ms: number): Promise<T | null> {\n  let timer: ReturnType<typeof setTimeout> | undefined\n  const late = new Promise<null>((resolve) => {\n    timer = setTimeout(() => resolve(null), Math.max(0, ms))\n  })\n  try {\n    return await Promise.race([promise, late])\n  } finally {\n    if (timer) clearTimeout(timer)\n  }\n}\n\n/** How many of `emails` a {@link findUndeliverableEmails} answer names; `undefined` without an answer. */\nexport function countUndeliverableEmails(\n  emails: readonly string[],\n  undeliverable: ReadonlySet<string> | null,\n): number | undefined {\n  if (!undeliverable) return undefined\n  let count = 0\n  for (const email of new Set(emails.map((entry) => normalizeDeliverabilityEmail(entry)))) {\n    if (email && undeliverable.has(email)) count += 1\n  }\n  return count\n}\n\n/*==========================================\n * ONE ADDRESS, AS A RECORD PAGE AND A COMPOSER READ IT\n *==========================================*/\n\n/** What a surface shows for one address before somebody writes to it. */\nexport interface AddressDeliverability {\n  /** The address, normalized; `null` when it is not one. */\n  email: string | null\n  /** Whether the domain's MX was read; `false` means nothing is known, and nothing is warned. */\n  checked: boolean\n  /** The finding a composer warns with — a domain with no mail server, or a gateway holding this sender. */\n  code: Extract<EmailDeliverabilityCode, 'no_mx' | 'null_mx' | 'gateway_held'> | null\n  /** That finding in a sentence, as the engine words it. */\n  message: string | null\n  /** The gateway in front of the address, when its MX names one. */\n  gateway: MailGateway | null\n  /** The chip beside the address: the gateway, and what it did with this sender's mail this week. */\n  chip: MailGatewayChip | null\n}\n\n/**\n * One address's standing for the site mail would leave from: the platform\n * MX cache (looked up, server side, when cold) and the sending domain's\n * gateway ledger. Read, never written onto a record — a composer asks it\n * before a send and a record page before it draws the address. `from` is\n * the sending identity's address; without one, no ledger is read and\n * nothing is held.\n */\nexport async function readAddressDeliverability(\n  input: { email: string; from?: string | null },\n  deps: MailDeliverabilityDeps = {},\n): Promise<AddressDeliverability> {\n  const email = normalizeDeliverabilityEmail(input.email)\n  const none: AddressDeliverability = { email, checked: false, code: null, message: null, gateway: null, chip: null }\n  if (!email) return none\n  const sender = bareSenderAddress(input.from ?? null)\n  const sendingDomain = sender ? sender.slice(sender.lastIndexOf('@') + 1) : null\n  const nowMs = deps.nowMs ?? Date.now()\n  let verdict: EmailDeliverabilityVerdict | undefined\n  try {\n    verdict = (\n      await readMailDeliverability(\n        { emails: [email], purpose: 'bulk', sendingDomain, scope: null },\n        { ...deps, nowMs },\n      )\n    ).get(email)\n  } catch (error) {\n    console.error('[deliverability] an address could not be checked', error)\n    return none\n  }\n  if (!verdict?.intel) return none\n  const deciding = decidingDeliverabilityFinding(verdict)\n  const warns = isNoMailServerVerdict(verdict) || isGatewayHeldVerdict(verdict)\n  const standing = verdict.gateway ?? mailGatewayStanding(verdict.intel.gateway, null, nowMs)\n  let chip = mailGatewayChip(standing)\n  // A public mailbox provider's MX is the provider's, not a gateway the\n  // person's company chose: \"Google Workspace\" beside a gmail.com address\n  // says something untrue. It keeps a chip only for a verdict this week.\n  if (chip?.tone === 'neutral' && isPublicMailboxDomain(verdict.domain)) chip = null\n  return {\n    email,\n    checked: true,\n    code: warns && deciding ? (deciding.code as AddressDeliverability['code']) : null,\n    message: warns && deciding ? deciding.message : null,\n    gateway: verdict.intel.gateway === 'none' ? null : verdict.intel.gateway,\n    chip,\n  }\n}\n"],"names":["isPublicMailboxDomain","stampRecordEmailState","bareSenderAddress","decidingDeliverabilityFinding","mailDomainRefusesMail","mailGatewayChip","mailGatewayStanding","normalizeDeliverabilityEmail","isGatewayHeldVerdict","isNoMailServerVerdict","readMailDeliverability","IMPORT_MAIL_CHECK_GRACE_MS","STAMP_CONCURRENCY","QUEUE_MAX","eachLimited","items","limit","work","next","runners","Array","from","length","Math","min","item","Promise","all","undeliverableDetail","verdict","intel","status","domain","stampTarget","orgId","String","trim","hostId","checkCapturedEmails","deps","report","checked","undeliverable","stamped","withdrawn","unique","Map","target","email","key","held","get","set","predicted","Boolean","size","nowMs","Date","now","verdicts","emails","Set","values","map","purpose","sendingDomain","scope","error","console","writes","outcome","state","atMs","source","detail","push","records","withdraw","write","queued","flushScheduled","afterResponse","loaded","require","after","flushCapturedEmailChecks","batch","splice","scheduleCapturedEmailCheck","Error","then","undefined","resetCapturedEmailChecksForTests","queuedCapturedEmailsForTests","findUndeliverableEmails","wanted","filter","found","add","settleWithin","promise","ms","timer","late","resolve","setTimeout","max","race","clearTimeout","countUndeliverableEmails","count","entry","has","readAddressDeliverability","input","none","code","message","gateway","chip","sender","slice","lastIndexOf","deciding","warns","standing","tone"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4CAoC4C;AAG5C,SAASA,qBAAqB,QAAQ,6BAA4B;AAClE,SAASC,qBAAqB,QAAQ,wDAAuD;AAC7F,SACEC,iBAAiB,EACjBC,6BAA6B,EAK7BC,qBAAqB,EACrBC,eAAe,EACfC,mBAAmB,EACnBC,4BAA4B,QACvB,2BAA0B;AACjC,SACEC,oBAAoB,EACpBC,qBAAqB,EAErBC,sBAAsB,QACjB,4BAAwB;AA4B/B;;;CAGC,GACD,OAAO,MAAMC,6BAA6B,KAAK;AAE/C,yCAAyC,GACzC,MAAMC,oBAAoB;AAE1B,uFAAuF,GACvF,MAAMC,YAAY;AAElB,yDAAyD,GACzD,eAAeC,YAAeC,KAAmB,EAAEC,KAAa,EAAEC,IAAgC;IAChG,IAAIC,OAAO;IACX,MAAMC,UAAUC,MAAMC,IAAI,CAAC;QAAEC,QAAQC,KAAKC,GAAG,CAACR,OAAOD,MAAMO,MAAM;IAAE,GAAG;QACpE,MAAOJ,OAAOH,MAAMO,MAAM,CAAE;YAC1B,MAAMG,OAAOV,KAAK,CAACG,KAAK;YACxBA,QAAQ;YACR,MAAMD,KAAKQ;QACb;IACF;IACA,MAAMC,QAAQC,GAAG,CAACR;AACpB;AAEA;;;;CAIC,GACD,SAASS,oBAAoBC,OAAmC;QACvDA;IAAP,OAAOA,EAAAA,iBAAAA,QAAQC,KAAK,qBAAbD,eAAeE,MAAM,MAAK,YAC7B,GAAGF,QAAQG,MAAM,CAAC,yDAAyD,CAAC,GAC5E;AACN;AAEA,4DAA4D,GAC5D,SAASC,YAAYR,IAAmB;QACjBA,aAECA;IAFtB,MAAMS,QAAQC,QAAOV,cAAAA,KAAKS,KAAK,YAAVT,cAAc,IAAIW,IAAI;IAC3C,IAAIF,OAAO,OAAO;QAAEA;IAAM;IAC1B,MAAMG,SAASF,QAAOV,eAAAA,KAAKY,MAAM,YAAXZ,eAAe,IAAIW,IAAI;IAC7C,OAAOC,SAAS;QAAEA;IAAO,IAAI;AAC/B;AAEA;;;;;CAKC,GACD,OAAO,eAAeC,oBACpBvB,KAA+B,EAC/BwB,OAA+B,CAAC,CAAC;QAiBnBA;IAfd,MAAMC,SAAmC;QAAEC,SAAS;QAAGC,eAAe;QAAGC,SAAS;QAAGC,WAAW;IAAE;IAClG,oEAAoE;IACpE,sEAAsE;IACtE,yBAAyB;IACzB,MAAMC,SAAS,IAAIC;IACnB,KAAK,MAAMrB,QAAQV,MAAO;YAITgC;QAHf,MAAMC,QAAQzC,6BAA6BkB,wBAAAA,KAAMuB,KAAK;QACtD,MAAMD,SAAStB,OAAOQ,YAAYR,QAAQ;QAC1C,IAAI,CAACuB,SAAS,CAACD,QAAQ;QACvB,MAAME,MAAM,IAAGF,gBAAAA,OAAOb,KAAK,YAAZa,gBAAgB,CAAC,KAAK,EAAEA,OAAOV,MAAM,EAAE,CAAC,CAAC,EAAEW,OAAO;QACjE,MAAME,OAAOL,OAAOM,GAAG,CAACF;QACxBJ,OAAOO,GAAG,CAACH,KAAK,aAAKF;YAAQC;YAAOK,WAAWC,QAAQJ,CAAAA,wBAAAA,KAAMG,SAAS,KAAI5B,KAAK4B,SAAS;;IAC1F;IACA,IAAI,CAACR,OAAOU,IAAI,EAAE,OAAOf;IAEzB,MAAMgB,SAAQjB,cAAAA,KAAKiB,KAAK,YAAVjB,cAAckB,KAAKC,GAAG;IACpC,IAAIC;IACJ,IAAI;QACFA,WAAW,MAAMjD,uBACf;YACEkD,QAAQ;mBAAI,IAAIC,IAAI;uBAAIhB,OAAOiB,MAAM;iBAAG,CAACC,GAAG,CAAC,CAACtC,OAASA,KAAKuB,KAAK;aAAG;YACpEgB,SAAS;YACTC,eAAe;YACfC,OAAO;QACT,GACA,aAAK3B;YAAMiB;;IAEf,EAAE,OAAOW,OAAO;QACdC,QAAQD,KAAK,CAAC,4DAA4DA;QAC1E,OAAO3B;IACT;IAEA,MAAM6B,SAAqC,EAAE;IAC7C,KAAK,MAAM5C,QAAQoB,OAAOiB,MAAM,GAAI;YAIkCrC;QAHpE,MAAMI,UAAU8B,SAASR,GAAG,CAAC1B,KAAKuB,KAAK;QACvC,IAAI,CAACnB,WAAWA,QAAQyC,OAAO,KAAK,aAAa;QACjD9B,OAAOC,OAAO,IAAI;QAClB,MAAMM,SAAS,aAAMtB,KAAKS,KAAK,GAAG;YAAEA,OAAOT,KAAKS,KAAK;QAAC,IAAI;YAAEG,MAAM,GAAEZ,eAAAA,KAAKY,MAAM,YAAXZ,eAAe;QAAG;QACtF,IAAIhB,sBAAsBoB,UAAU;YAClCW,OAAOE,aAAa,IAAI;YACxB,IAAIjB,KAAK4B,SAAS,EAAE;YACpB,MAAMkB,QAAoB;gBACxBxC,QAAQ;gBACRyC,MAAMhB;gBACNiB,QAAQ;gBACRC,QAAQ9C,oBAAoBC;YAC9B;YACAwC,OAAOM,IAAI,CAAC;;gBACV,MAAMhC,UAAU,MAAM1C,sBAAsB,aAAK8C;oBAAQC,OAAOvB,KAAKuB,KAAK;oBAAEuB;;gBAC5E/B,OAAOG,OAAO,YAAIA,2BAAAA,QAASiC,OAAO,mBAAI;YACxC;QACF,OAAO,IAAInD,KAAK4B,SAAS,IAAIxB,QAAQC,KAAK,IAAI,CAAC1B,sBAAsByB,QAAQC,KAAK,CAACC,MAAM,GAAG;YAC1F,MAAMwC,QAAoB;gBAAExC,QAAQ;gBAAiByC,MAAMhB;gBAAOiB,QAAQ;gBAASC,QAAQ;YAAK;YAChGL,OAAOM,IAAI,CAAC;;gBACV,MAAM/B,YAAY,MAAM3C,sBAAsB,aAAK8C;oBAAQC,OAAOvB,KAAKuB,KAAK;oBAAEuB;oBAAOM,UAAU;;gBAC/FrC,OAAOI,SAAS,YAAIA,6BAAAA,UAAWgC,OAAO,mBAAI;YAC5C;QACF;IACF;IACA,MAAM9D,YAAYuD,QAAQzD,mBAAmB,CAACkE,QAAUA;IACxD,OAAOtC;AACT;AAEA;;4CAE4C,GAE5C,MAAMuC,SAA0B,EAAE;AAClC,IAAIC,iBAAiB;AAIrB;;;;;CAKC,GACD,SAASC;IACP,IAAI;QACF,MAAMC,SAASC,QAAQ;QACvB,OAAO,QAAOD,0BAAAA,OAAQE,KAAK,MAAK,aAAaF,OAAOE,KAAK,GAAG;IAC9D,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA,6FAA6F,GAC7F,OAAO,eAAeC,yBAAyB9C,OAA+B,CAAC,CAAC;IAC9EyC,iBAAiB;IACjB,MAAMM,QAAQP,OAAOQ,MAAM,CAAC;IAC5B,IAAI,CAACD,MAAMhE,MAAM,EAAE,OAAO;QAAEmB,SAAS;QAAGC,eAAe;QAAGC,SAAS;QAAGC,WAAW;IAAE;IACnF,OAAON,oBAAoBgD,OAAO/C;AACpC;AAEA;;;;CAIC,GACD,OAAO,SAASiD,2BAA2B/D,IAAmB;IAC5D,IAAI;QACF,IAAI,CAACA,QAAQ,CAAClB,6BAA6BkB,KAAKuB,KAAK,KAAK,CAACf,YAAYR,OAAO;QAC9E,IAAIsD,OAAOzD,MAAM,IAAIT,WAAW;QAChCkE,OAAOJ,IAAI,CAAC,aAAKlD;QACjB,IAAIuD,gBAAgB;QACpB,IAAI;YACF,MAAMI,QAAQH;YACd,IAAI,CAACG,OAAO,MAAM,IAAIK,MAAM;YAC5BL,MAAM,IAAMC,2BAA2BK,IAAI,CAAC,IAAMC;YAClDX,iBAAiB;QACnB,EAAE,eAAM;YACN,mEAAmE;YACnED,OAAOzD,MAAM,GAAG;QAClB;IACF,EAAE,OAAO6C,OAAO;QACdC,QAAQD,KAAK,CAAC,2DAA2DA;IAC3E;AACF;AAEA,qCAAqC,GACrC,OAAO,SAASyB;IACdb,OAAOzD,MAAM,GAAG;IAChB0D,iBAAiB;AACnB;AAEA,kCAAkC,GAClC,OAAO,SAASa;IACd,OAAOd;AACT;AAEA;;4CAE4C,GAE5C;;;;;CAKC,GACD,OAAO,eAAee,wBACpBlC,MAAyB,EACzBrB,OAA+B,CAAC,CAAC;IAEjC,MAAMwD,SAAS;WACV,IAAIlC,IAAID,OAAOG,GAAG,CAAC,CAACf,QAAUzC,6BAA6ByC,QAAQgD,MAAM,CAAC,CAAChD,QAA2BM,QAAQN;KAClH;IACD,IAAI,CAAC+C,OAAOzE,MAAM,EAAE,OAAO,IAAIuC;IAC/B,IAAI;QACF,MAAMF,WAAW,MAAMjD,uBACrB;YAAEkD,QAAQmC;YAAQ/B,SAAS;YAAQC,eAAe;YAAMC,OAAO;QAAK,GACpE3B;QAEF,MAAM0D,QAAQ,IAAIpC;QAClB,KAAK,MAAM,CAACb,OAAOnB,QAAQ,IAAI8B,SAAU,IAAIlD,sBAAsBoB,UAAUoE,MAAMC,GAAG,CAAClD;QACvF,OAAOiD;IACT,EAAE,OAAO9B,OAAO;QACdC,QAAQD,KAAK,CAAC,+DAA+DA;QAC7E,OAAO;IACT;AACF;AAEA;;;;;CAKC,GACD,OAAO,eAAegC,aAAgBC,OAAmB,EAAEC,EAAU;IACnE,IAAIC;IACJ,MAAMC,OAAO,IAAI7E,QAAc,CAAC8E;QAC9BF,QAAQG,WAAW,IAAMD,QAAQ,OAAOjF,KAAKmF,GAAG,CAAC,GAAGL;IACtD;IACA,IAAI;QACF,OAAO,MAAM3E,QAAQiF,IAAI,CAAC;YAACP;YAASG;SAAK;IAC3C,SAAU;QACR,IAAID,OAAOM,aAAaN;IAC1B;AACF;AAEA,wGAAwG,GACxG,OAAO,SAASO,yBACdjD,MAAyB,EACzBlB,aAAyC;IAEzC,IAAI,CAACA,eAAe,OAAOiD;IAC3B,IAAImB,QAAQ;IACZ,KAAK,MAAM9D,SAAS,IAAIa,IAAID,OAAOG,GAAG,CAAC,CAACgD,QAAUxG,6BAA6BwG,SAAU;QACvF,IAAI/D,SAASN,cAAcsE,GAAG,CAAChE,QAAQ8D,SAAS;IAClD;IACA,OAAOA;AACT;AAsBA;;;;;;;CAOC,GACD,OAAO,eAAeG,0BACpBC,KAA8C,EAC9C3E,OAA+B,CAAC,CAAC;QAKA2E,aAEnB3E,aAgBGV;IArBjB,MAAMmB,QAAQzC,6BAA6B2G,MAAMlE,KAAK;IACtD,MAAMmE,OAA8B;QAAEnE;QAAOP,SAAS;QAAO2E,MAAM;QAAMC,SAAS;QAAMC,SAAS;QAAMC,MAAM;IAAK;IAClH,IAAI,CAACvE,OAAO,OAAOmE;IACnB,MAAMK,SAAStH,mBAAkBgH,cAAAA,MAAM7F,IAAI,YAAV6F,cAAc;IAC/C,MAAMjD,gBAAgBuD,SAASA,OAAOC,KAAK,CAACD,OAAOE,WAAW,CAAC,OAAO,KAAK;IAC3E,MAAMlE,SAAQjB,cAAAA,KAAKiB,KAAK,YAAVjB,cAAckB,KAAKC,GAAG;IACpC,IAAI7B;IACJ,IAAI;QACFA,UAAU,AACR,CAAA,MAAMnB,uBACJ;YAAEkD,QAAQ;gBAACZ;aAAM;YAAEgB,SAAS;YAAQC;YAAeC,OAAO;QAAK,GAC/D,aAAK3B;YAAMiB;WACb,EACAL,GAAG,CAACH;IACR,EAAE,OAAOmB,OAAO;QACdC,QAAQD,KAAK,CAAC,oDAAoDA;QAClE,OAAOgD;IACT;IACA,IAAI,EAACtF,2BAAAA,QAASC,KAAK,GAAE,OAAOqF;IAC5B,MAAMQ,WAAWxH,8BAA8B0B;IAC/C,MAAM+F,QAAQnH,sBAAsBoB,YAAYrB,qBAAqBqB;IACrE,MAAMgG,YAAWhG,mBAAAA,QAAQyF,OAAO,YAAfzF,mBAAmBvB,oBAAoBuB,QAAQC,KAAK,CAACwF,OAAO,EAAE,MAAM9D;IACrF,IAAI+D,OAAOlH,gBAAgBwH;IAC3B,sEAAsE;IACtE,wEAAwE;IACxE,uEAAuE;IACvE,IAAIN,CAAAA,wBAAAA,KAAMO,IAAI,MAAK,aAAa9H,sBAAsB6B,QAAQG,MAAM,GAAGuF,OAAO;IAC9E,OAAO;QACLvE;QACAP,SAAS;QACT2E,MAAMQ,SAASD,WAAYA,SAASP,IAAI,GAAqC;QAC7EC,SAASO,SAASD,WAAWA,SAASN,OAAO,GAAG;QAChDC,SAASzF,QAAQC,KAAK,CAACwF,OAAO,KAAK,SAAS,OAAOzF,QAAQC,KAAK,CAACwF,OAAO;QACxEC;IACF;AACF"}

package/src/lib/server/card-payment-velocity.d.ts

@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { notifyHostManagers, notifyStaff } from './notifications';
+import { type RiskEventInput } from './risk-notice';
 export interface CardPaymentVelocityOptions {
     /** Dispatcher path, for the staff row. */
     path: string;
@@ -33,29 +33,25 @@ export interface CardPaymentVelocityOptions {
     nowMs?: number;
     /** Injectable for tests; defaults to the Admin SDK's Firestore. */
     firestore?: unknown;
-    /** Injectable for tests; defaults to `notifyStaff`. */
-    notify?: typeof notifyStaff;
-    /** Injectable for tests; defaults to `notifyHostManagers`. */
-    notifyManagers?: typeof notifyHostManagers;
+    /** Injectable for tests; defaults to `notifyRiskEvent` (AGL-3368). */
+    notifyRisk?: (input: RiskEventInput) => Promise<unknown>;
 }
 /** The abuse-queue row id for a site's alarm on one day. Hex, like every row. */
 export declare function cardPaymentAlarmReviewId(hostId: string, day: string): string;
 /**
- * Tell staff and the site's managers, once per site per day, that its payment
- * doors crossed the card-testing alarm (AGL-3363). The one notifier for this
- * kind of signal, so a shared risk-notice seam can take it over whole.
- *
- * The merchant's sentence names the outcome and what to do, never the rule
- * or its numbers: a merchant who is the card tester must not learn how to
- * pace under it. Never throws.
+ * Tell staff and the site's managers and the workspace's owners that a site
+ * crossed the card-payment window (AGL-3363), through the risk notice seam
+ * (AGL-3368): the owners read the catalog's `card-testing` words — what was
+ * seen and what to do, never the window or its numbers; staff get the row.
+ * Never throws.
  */
 export declare function notifyCardTestingVelocity(input: {
     hostId: string;
     orgId: string | null;
     reference: string;
+    reviewId?: string | null;
 }, deps: {
-    notifyStaff: typeof notifyStaff;
-    notifyManagers: typeof notifyHostManagers;
+    notifyRisk: (input: RiskEventInput) => Promise<unknown>;
 }): Promise<void>;
 /**
  * File (or count) the day's alarm row for a site whose payment doors crossed
@@ -69,8 +65,7 @@ export declare function recordCardPaymentAlarm(input: {
     young: boolean;
     nowMs: number;
     firestore: any;
-    notify: typeof notifyStaff;
-    notifyManagers: typeof notifyHostManagers;
+    notifyRisk: (input: RiskEventInput) => Promise<unknown>;
 }): Promise<{
     reviewId: string;
     first: boolean;