@aglyn/tenant-data-admin 1.0.0-beta.203 → 1.0.0-beta.205

package/src/lib/server/staff-alert-email.js

@@ -16,33 +16,113 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * limitations under the License.
  */ import { sendEmail } from "@aglyn/shared-util-email";
 /**
- * A staff alert by email, from LIBRARY code (AGL-2925).
+ * Staff alerts by email, from LIBRARY code (AGL-2925).
  *
- * `STAFF_ALERT_EMAIL` is the one inbox every subsystem's alert lands in —
- * the console's `emailStaffAlert` in `apps/console/app/api/_lib/
- * usage-alert-email.ts` sends the cron's alerts there. A library cannot
- * call that, because a library cannot import from an app. So a library's
- * own alert — the AI meter's platform-wide free-spend ceiling is one —
- * sends through this, to the same address, with the same posture: unset is
- * the ordinary answer outside production and reports `unconfigured`, and
- * nothing here throws, because the mail is a courtesy and the refusal it
- * announces is the control.
+ * One destination for every subsystem's alarm — the console's
+ * `emailStaffAlert` in `apps/console/app/api/_lib/usage-alert-email.ts` sends
+ * through here too — resolved by {@link resolveStaffAlertRecipients}
+ * (AGL-3375). Nothing here throws, because the mail is a courtesy and the
+ * refusal it announces is the control; with no address anywhere the answer
+ * is `unconfigured`.
  *
  * Platform email metering is loaded lazily and only after a send, so that
  * importing this module — which every unit test of the meter does — never
  * pulls the Firestore-backed meter, and with it the admin app, into a test
- * that only wanted to count credits. The system-email renderer, which reads
- * its template through the same admin app, is loaded the same way.
- */ export async function sendStaffAlertEmail(input) {
-    var _process_env_STAFF_ALERT_EMAIL;
-    const to = String((_process_env_STAFF_ALERT_EMAIL = process.env.STAFF_ALERT_EMAIL) != null ? _process_env_STAFF_ALERT_EMAIL : '').trim();
-    if (!to.includes('@')) return {
+ * that only wanted to count credits. The system-email renderer and the staff
+ * roster, which read through the same admin app, are loaded the same way.
+ */ /** At most this many staff accounts are mailed when no inbox is configured. */ const STAFF_FALLBACK_MAX = 10;
+/**
+ * Where a staff alarm goes (AGL-3375), first answer wins:
+ *
+ * 1. `STAFF_ALERT_EMAIL`, the operator's one alerts inbox.
+ * 2. The operator's published support address,
+ *    `NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL`, which every self-hosted install is
+ *    asked for and most set.
+ * 3. Every staff account's own address, up to {@link STAFF_FALLBACK_MAX}.
+ *
+ * Only the first applies on a preview or development deployment.
+ *
+ * The chain exists because the alarms that matter most are the ones an
+ * install nobody tuned would otherwise send to no one: card testing on its
+ * checkout, a stolen card on its first subscription, a phishing campaign
+ * held on its sending domain. An unset variable used to mean silence.
+ *
+ * Empty only when none of the three yields an address.
+ */ export async function resolveStaffAlertRecipients() {
+    var _process_env_STAFF_ALERT_EMAIL, _process_env_VERCEL_ENV, _process_env_NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL;
+    const configured = String((_process_env_STAFF_ALERT_EMAIL = process.env.STAFF_ALERT_EMAIL) != null ? _process_env_STAFF_ALERT_EMAIL : '').trim().toLowerCase();
+    if (configured.includes('@')) return [
+        configured
+    ];
+    // A preview or development deployment says what it is; only a production
+    // one, or a self-hosted install that sets no such thing, falls back. A
+    // preview's alarms reaching the operator's real inbox would be noise.
+    const deployment = String((_process_env_VERCEL_ENV = process.env.VERCEL_ENV) != null ? _process_env_VERCEL_ENV : '').trim();
+    if (deployment && deployment !== 'production') return [];
+    const operator = String((_process_env_NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL = process.env.NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL) != null ? _process_env_NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL : '').trim().toLowerCase();
+    if (operator.includes('@')) return [
+        operator
+    ];
+    try {
+        const { findUserByUidAcrossPools, listStaffUidsAcrossPools } = await import("./auth-pools.js");
+        const uids = (await listStaffUidsAcrossPools()).slice(0, STAFF_FALLBACK_MAX);
+        const addresses = new Set();
+        for (const uid of uids){
+            var _ref;
+            var _pooled_record;
+            const pooled = await findUserByUidAcrossPools(uid).catch(()=>null);
+            const address = String((_ref = pooled == null ? void 0 : (_pooled_record = pooled.record) == null ? void 0 : _pooled_record.email) != null ? _ref : '').trim().toLowerCase();
+            if (address.includes('@')) addresses.add(address);
+        }
+        return [
+            ...addresses
+        ];
+    } catch (error) {
+        console.error('[staff-alert-email] staff roster unavailable', error);
+        return [];
+    }
+}
+/**
+ * Sends one rendered alert to each operator recipient, one message each so
+ * no staff member is shown another's address. Metered to the platform: our
+ * own alarm is our own cost (AGL-1438). Never throws.
+ */ async function sendToOperators(content, context) {
+    const recipients = await resolveStaffAlertRecipients();
+    if (!recipients.length) return {
         sent: false,
         reason: 'unconfigured'
     };
+    let delivered = null;
+    let failure = {
+        sent: false,
+        reason: 'unconfigured'
+    };
+    let sent = 0;
+    for (const to of recipients){
+        const result = await sendEmail(_extends({
+            to
+        }, content, {
+            context
+        }));
+        if (result.sent) {
+            sent += 1;
+            delivered != null ? delivered : delivered = result;
+        } else {
+            failure = result;
+        }
+    }
+    if (sent) {
+        const { meterPlatformEmail } = await import("./email-metering.js");
+        await meterPlatformEmail(sent).catch(()=>undefined);
+    }
+    // Delivered to anyone is delivered: one dead staff mailbox does not make
+    // the alert a failure for the caller.
+    return delivered != null ? delivered : failure;
+}
+export async function sendStaffAlertEmail(input) {
     try {
         // In the platform's header and footer, as the `staff-alert` system email
-        // (AGL-3367). Loaded lazily for the reason the meter below is.
+        // (AGL-3367). Loaded lazily for the reason the meter is.
         const { renderSystemEmailContent, systemEmailBrand } = await import("./render-system-email.js");
         const content = await renderSystemEmailContent('staff-alert', {
             'alert.subject': input.subject,
@@ -51,17 +131,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
             subject: input.subject,
             text: input.text
         });
-        const result = await sendEmail(_extends({
-            to
-        }, content, {
-            context: input.context
-        }));
-        if (result.sent) {
-            // Platform-scoped (AGL-1438): our own alert is our own cost.
-            const { meterPlatformEmail } = await import("./email-metering.js");
-            await meterPlatformEmail().catch(()=>undefined);
-        }
-        return result;
+        return await sendToOperators(content, input.context);
     } catch (error) {
         console.error('[staff-alert-email] send failed', error);
         return {
@@ -70,5 +140,38 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
         };
     }
 }
+/**
+ * A fraud or risk alert for the operator (AGL-3375), as the `operator-alert`
+ * system email: the alert, a button to the item it is about, in the
+ * operator's own brand. Sent by `notifyStaff` for every
+ * `OPERATOR_ALERT_NOTIFICATION_TYPES` notification, beside the console one.
+ * Never throws.
+ */ export async function sendOperatorAlertEmail(input) {
+    try {
+        var _input_body, _input_url;
+        const { renderSystemEmailContent, systemEmailBrand } = await import("./render-system-email.js");
+        const body = String((_input_body = input.body) != null ? _input_body : '').trim();
+        const url = String((_input_url = input.url) != null ? _input_url : '').trim();
+        const content = await renderSystemEmailContent('operator-alert', {
+            'alert.title': input.title,
+            'alert.body': body,
+            'alert.url': url
+        }, systemEmailBrand(null), {
+            subject: input.title,
+            text: [
+                input.title,
+                body,
+                url
+            ].filter(Boolean).join('\n\n')
+        });
+        return await sendToOperators(content, input.context);
+    } catch (error) {
+        console.error('[staff-alert-email] operator alert failed', error);
+        return {
+            sent: false,
+            reason: 'network'
+        };
+    }
+}
 
 //# sourceMappingURL=staff-alert-email.js.map

package/src/lib/server/staff-alert-email.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/staff-alert-email.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { sendEmail, type SendEmailResult } from '@aglyn/shared-util-email'\n\n/**\n * A staff alert by email, from LIBRARY code (AGL-2925).\n *\n * `STAFF_ALERT_EMAIL` is the one inbox every subsystem's alert lands in —\n * the console's `emailStaffAlert` in `apps/console/app/api/_lib/\n * usage-alert-email.ts` sends the cron's alerts there. A library cannot\n * call that, because a library cannot import from an app. So a library's\n * own alert — the AI meter's platform-wide free-spend ceiling is one —\n * sends through this, to the same address, with the same posture: unset is\n * the ordinary answer outside production and reports `unconfigured`, and\n * nothing here throws, because the mail is a courtesy and the refusal it\n * announces is the control.\n *\n * Platform email metering is loaded lazily and only after a send, so that\n * importing this module — which every unit test of the meter does — never\n * pulls the Firestore-backed meter, and with it the admin app, into a test\n * that only wanted to count credits. The system-email renderer, which reads\n * its template through the same admin app, is loaded the same way.\n */\nexport async function sendStaffAlertEmail(input: {\n  subject: string\n  text: string\n  /** Resend tag / log label. */\n  context: string\n}): Promise<SendEmailResult> {\n  const to = String(process.env.STAFF_ALERT_EMAIL ?? '').trim()\n  if (!to.includes('@')) return { sent: false, reason: 'unconfigured' }\n  try {\n    // In the platform's header and footer, as the `staff-alert` system email\n    // (AGL-3367). Loaded lazily for the reason the meter below is.\n    const { renderSystemEmailContent, systemEmailBrand } = await import(\n      './render-system-email'\n    )\n    const content = await renderSystemEmailContent(\n      'staff-alert',\n      { 'alert.subject': input.subject, 'alert.body': input.text },\n      systemEmailBrand(null),\n      { subject: input.subject, text: input.text },\n    )\n    const result = await sendEmail({ to, ...content, context: input.context })\n    if (result.sent) {\n      // Platform-scoped (AGL-1438): our own alert is our own cost.\n      const { meterPlatformEmail } = await import('./email-metering')\n      await meterPlatformEmail().catch(() => undefined)\n    }\n    return result\n  } catch (error) {\n    console.error('[staff-alert-email] send failed', error)\n    return { sent: false, reason: 'network' }\n  }\n}\n"],"names":["sendEmail","sendStaffAlertEmail","input","process","to","String","env","STAFF_ALERT_EMAIL","trim","includes","sent","reason","renderSystemEmailContent","systemEmailBrand","content","subject","text","result","context","meterPlatformEmail","catch","undefined","error","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,SAAS,QAA8B,2BAA0B;AAE1E;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,eAAeC,oBAAoBC,KAKzC;QACmBC;IAAlB,MAAMC,KAAKC,QAAOF,iCAAAA,QAAQG,GAAG,CAACC,iBAAiB,YAA7BJ,iCAAiC,IAAIK,IAAI;IAC3D,IAAI,CAACJ,GAAGK,QAAQ,CAAC,MAAM,OAAO;QAAEC,MAAM;QAAOC,QAAQ;IAAe;IACpE,IAAI;QACF,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,EAAEC,wBAAwB,EAAEC,gBAAgB,EAAE,GAAG,MAAM,MAAM,CACjE;QAEF,MAAMC,UAAU,MAAMF,yBACpB,eACA;YAAE,iBAAiBV,MAAMa,OAAO;YAAE,cAAcb,MAAMc,IAAI;QAAC,GAC3DH,iBAAiB,OACjB;YAAEE,SAASb,MAAMa,OAAO;YAAEC,MAAMd,MAAMc,IAAI;QAAC;QAE7C,MAAMC,SAAS,MAAMjB,UAAU;YAAEI;WAAOU;YAASI,SAAShB,MAAMgB,OAAO;;QACvE,IAAID,OAAOP,IAAI,EAAE;YACf,6DAA6D;YAC7D,MAAM,EAAES,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC;YAC5C,MAAMA,qBAAqBC,KAAK,CAAC,IAAMC;QACzC;QACA,OAAOJ;IACT,EAAE,OAAOK,OAAO;QACdC,QAAQD,KAAK,CAAC,mCAAmCA;QACjD,OAAO;YAAEZ,MAAM;YAAOC,QAAQ;QAAU;IAC1C;AACF"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/staff-alert-email.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { sendEmail, type SendEmailResult } from '@aglyn/shared-util-email'\n\n/**\n * Staff alerts by email, from LIBRARY code (AGL-2925).\n *\n * One destination for every subsystem's alarm — the console's\n * `emailStaffAlert` in `apps/console/app/api/_lib/usage-alert-email.ts` sends\n * through here too — resolved by {@link resolveStaffAlertRecipients}\n * (AGL-3375). Nothing here throws, because the mail is a courtesy and the\n * refusal it announces is the control; with no address anywhere the answer\n * is `unconfigured`.\n *\n * Platform email metering is loaded lazily and only after a send, so that\n * importing this module — which every unit test of the meter does — never\n * pulls the Firestore-backed meter, and with it the admin app, into a test\n * that only wanted to count credits. The system-email renderer and the staff\n * roster, which read through the same admin app, are loaded the same way.\n */\n\n/** At most this many staff accounts are mailed when no inbox is configured. */\nconst STAFF_FALLBACK_MAX = 10\n\n/**\n * Where a staff alarm goes (AGL-3375), first answer wins:\n *\n * 1. `STAFF_ALERT_EMAIL`, the operator's one alerts inbox.\n * 2. The operator's published support address,\n *    `NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL`, which every self-hosted install is\n *    asked for and most set.\n * 3. Every staff account's own address, up to {@link STAFF_FALLBACK_MAX}.\n *\n * Only the first applies on a preview or development deployment.\n *\n * The chain exists because the alarms that matter most are the ones an\n * install nobody tuned would otherwise send to no one: card testing on its\n * checkout, a stolen card on its first subscription, a phishing campaign\n * held on its sending domain. An unset variable used to mean silence.\n *\n * Empty only when none of the three yields an address.\n */\nexport async function resolveStaffAlertRecipients(): Promise<string[]> {\n  const configured = String(process.env.STAFF_ALERT_EMAIL ?? '').trim().toLowerCase()\n  if (configured.includes('@')) return [configured]\n  // A preview or development deployment says what it is; only a production\n  // one, or a self-hosted install that sets no such thing, falls back. A\n  // preview's alarms reaching the operator's real inbox would be noise.\n  const deployment = String(process.env.VERCEL_ENV ?? '').trim()\n  if (deployment && deployment !== 'production') return []\n  const operator = String(process.env.NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL ?? '')\n    .trim()\n    .toLowerCase()\n  if (operator.includes('@')) return [operator]\n  try {\n    const { findUserByUidAcrossPools, listStaffUidsAcrossPools } = await import(\n      './auth-pools'\n    )\n    const uids = (await listStaffUidsAcrossPools()).slice(0, STAFF_FALLBACK_MAX)\n    const addresses = new Set<string>()\n    for (const uid of uids) {\n      const pooled = await findUserByUidAcrossPools(uid).catch(() => null)\n      const address = String(pooled?.record?.email ?? '').trim().toLowerCase()\n      if (address.includes('@')) addresses.add(address)\n    }\n    return [...addresses]\n  } catch (error) {\n    console.error('[staff-alert-email] staff roster unavailable', error)\n    return []\n  }\n}\n\n/**\n * Sends one rendered alert to each operator recipient, one message each so\n * no staff member is shown another's address. Metered to the platform: our\n * own alarm is our own cost (AGL-1438). Never throws.\n */\nasync function sendToOperators(\n  content: { subject: string; text: string; html?: string },\n  context: string,\n): Promise<SendEmailResult> {\n  const recipients = await resolveStaffAlertRecipients()\n  if (!recipients.length) return { sent: false, reason: 'unconfigured' }\n  let delivered: SendEmailResult | null = null\n  let failure: SendEmailResult = { sent: false, reason: 'unconfigured' }\n  let sent = 0\n  for (const to of recipients) {\n    const result = await sendEmail({ to, ...content, context })\n    if (result.sent) {\n      sent += 1\n      delivered ??= result\n    } else {\n      failure = result\n    }\n  }\n  if (sent) {\n    const { meterPlatformEmail } = await import('./email-metering')\n    await meterPlatformEmail(sent).catch(() => undefined)\n  }\n  // Delivered to anyone is delivered: one dead staff mailbox does not make\n  // the alert a failure for the caller.\n  return delivered ?? failure\n}\n\nexport async function sendStaffAlertEmail(input: {\n  subject: string\n  text: string\n  /** Resend tag / log label. */\n  context: string\n}): Promise<SendEmailResult> {\n  try {\n    // In the platform's header and footer, as the `staff-alert` system email\n    // (AGL-3367). Loaded lazily for the reason the meter is.\n    const { renderSystemEmailContent, systemEmailBrand } = await import(\n      './render-system-email'\n    )\n    const content = await renderSystemEmailContent(\n      'staff-alert',\n      { 'alert.subject': input.subject, 'alert.body': input.text },\n      systemEmailBrand(null),\n      { subject: input.subject, text: input.text },\n    )\n    return await sendToOperators(content, input.context)\n  } catch (error) {\n    console.error('[staff-alert-email] send failed', error)\n    return { sent: false, reason: 'network' }\n  }\n}\n\n/**\n * A fraud or risk alert for the operator (AGL-3375), as the `operator-alert`\n * system email: the alert, a button to the item it is about, in the\n * operator's own brand. Sent by `notifyStaff` for every\n * `OPERATOR_ALERT_NOTIFICATION_TYPES` notification, beside the console one.\n * Never throws.\n */\nexport async function sendOperatorAlertEmail(input: {\n  title: string\n  body?: string | null\n  /** Absolute link to the item, when there is one. */\n  url?: string | null\n  context: string\n}): Promise<SendEmailResult> {\n  try {\n    const { renderSystemEmailContent, systemEmailBrand } = await import(\n      './render-system-email'\n    )\n    const body = String(input.body ?? '').trim()\n    const url = String(input.url ?? '').trim()\n    const content = await renderSystemEmailContent(\n      'operator-alert',\n      { 'alert.title': input.title, 'alert.body': body, 'alert.url': url },\n      systemEmailBrand(null),\n      { subject: input.title, text: [input.title, body, url].filter(Boolean).join('\\n\\n') },\n    )\n    return await sendToOperators(content, input.context)\n  } catch (error) {\n    console.error('[staff-alert-email] operator alert failed', error)\n    return { sent: false, reason: 'network' }\n  }\n}\n"],"names":["sendEmail","STAFF_FALLBACK_MAX","resolveStaffAlertRecipients","process","configured","String","env","STAFF_ALERT_EMAIL","trim","toLowerCase","includes","deployment","VERCEL_ENV","operator","NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL","findUserByUidAcrossPools","listStaffUidsAcrossPools","uids","slice","addresses","Set","uid","pooled","catch","address","record","email","add","error","console","sendToOperators","content","context","recipients","length","sent","reason","delivered","failure","to","result","meterPlatformEmail","undefined","sendStaffAlertEmail","input","renderSystemEmailContent","systemEmailBrand","subject","text","sendOperatorAlertEmail","body","url","title","filter","Boolean","join"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,SAAS,QAA8B,2BAA0B;AAE1E;;;;;;;;;;;;;;;CAeC,GAED,6EAA6E,GAC7E,MAAMC,qBAAqB;AAE3B;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,eAAeC;QACMC,gCAKAA,yBAEFA;IAPxB,MAAMC,aAAaC,QAAOF,iCAAAA,QAAQG,GAAG,CAACC,iBAAiB,YAA7BJ,iCAAiC,IAAIK,IAAI,GAAGC,WAAW;IACjF,IAAIL,WAAWM,QAAQ,CAAC,MAAM,OAAO;QAACN;KAAW;IACjD,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,MAAMO,aAAaN,QAAOF,0BAAAA,QAAQG,GAAG,CAACM,UAAU,YAAtBT,0BAA0B,IAAIK,IAAI;IAC5D,IAAIG,cAAcA,eAAe,cAAc,OAAO,EAAE;IACxD,MAAME,WAAWR,QAAOF,kDAAAA,QAAQG,GAAG,CAACQ,kCAAkC,YAA9CX,kDAAkD,IACvEK,IAAI,GACJC,WAAW;IACd,IAAII,SAASH,QAAQ,CAAC,MAAM,OAAO;QAACG;KAAS;IAC7C,IAAI;QACF,MAAM,EAAEE,wBAAwB,EAAEC,wBAAwB,EAAE,GAAG,MAAM,MAAM,CACzE;QAEF,MAAMC,OAAO,AAAC,CAAA,MAAMD,0BAAyB,EAAGE,KAAK,CAAC,GAAGjB;QACzD,MAAMkB,YAAY,IAAIC;QACtB,KAAK,MAAMC,OAAOJ,KAAM;;gBAECK;YADvB,MAAMA,SAAS,MAAMP,yBAAyBM,KAAKE,KAAK,CAAC,IAAM;YAC/D,MAAMC,UAAUnB,eAAOiB,2BAAAA,iBAAAA,OAAQG,MAAM,qBAAdH,eAAgBI,KAAK,mBAAI,IAAIlB,IAAI,GAAGC,WAAW;YACtE,IAAIe,QAAQd,QAAQ,CAAC,MAAMS,UAAUQ,GAAG,CAACH;QAC3C;QACA,OAAO;eAAIL;SAAU;IACvB,EAAE,OAAOS,OAAO;QACdC,QAAQD,KAAK,CAAC,gDAAgDA;QAC9D,OAAO,EAAE;IACX;AACF;AAEA;;;;CAIC,GACD,eAAeE,gBACbC,OAAyD,EACzDC,OAAe;IAEf,MAAMC,aAAa,MAAM/B;IACzB,IAAI,CAAC+B,WAAWC,MAAM,EAAE,OAAO;QAAEC,MAAM;QAAOC,QAAQ;IAAe;IACrE,IAAIC,YAAoC;IACxC,IAAIC,UAA2B;QAAEH,MAAM;QAAOC,QAAQ;IAAe;IACrE,IAAID,OAAO;IACX,KAAK,MAAMI,MAAMN,WAAY;QAC3B,MAAMO,SAAS,MAAMxC,UAAU;YAAEuC;WAAOR;YAASC;;QACjD,IAAIQ,OAAOL,IAAI,EAAE;YACfA,QAAQ;YACRE,oBAAAA,YAAAA,YAAcG;QAChB,OAAO;YACLF,UAAUE;QACZ;IACF;IACA,IAAIL,MAAM;QACR,MAAM,EAAEM,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC;QAC5C,MAAMA,mBAAmBN,MAAMZ,KAAK,CAAC,IAAMmB;IAC7C;IACA,yEAAyE;IACzE,sCAAsC;IACtC,OAAOL,oBAAAA,YAAaC;AACtB;AAEA,OAAO,eAAeK,oBAAoBC,KAKzC;IACC,IAAI;QACF,yEAAyE;QACzE,yDAAyD;QACzD,MAAM,EAAEC,wBAAwB,EAAEC,gBAAgB,EAAE,GAAG,MAAM,MAAM,CACjE;QAEF,MAAMf,UAAU,MAAMc,yBACpB,eACA;YAAE,iBAAiBD,MAAMG,OAAO;YAAE,cAAcH,MAAMI,IAAI;QAAC,GAC3DF,iBAAiB,OACjB;YAAEC,SAASH,MAAMG,OAAO;YAAEC,MAAMJ,MAAMI,IAAI;QAAC;QAE7C,OAAO,MAAMlB,gBAAgBC,SAASa,MAAMZ,OAAO;IACrD,EAAE,OAAOJ,OAAO;QACdC,QAAQD,KAAK,CAAC,mCAAmCA;QACjD,OAAO;YAAEO,MAAM;YAAOC,QAAQ;QAAU;IAC1C;AACF;AAEA;;;;;;CAMC,GACD,OAAO,eAAea,uBAAuBL,KAM5C;IACC,IAAI;YAIkBA,aACDA;QAJnB,MAAM,EAAEC,wBAAwB,EAAEC,gBAAgB,EAAE,GAAG,MAAM,MAAM,CACjE;QAEF,MAAMI,OAAO7C,QAAOuC,cAAAA,MAAMM,IAAI,YAAVN,cAAc,IAAIpC,IAAI;QAC1C,MAAM2C,MAAM9C,QAAOuC,aAAAA,MAAMO,GAAG,YAATP,aAAa,IAAIpC,IAAI;QACxC,MAAMuB,UAAU,MAAMc,yBACpB,kBACA;YAAE,eAAeD,MAAMQ,KAAK;YAAE,cAAcF;YAAM,aAAaC;QAAI,GACnEL,iBAAiB,OACjB;YAAEC,SAASH,MAAMQ,KAAK;YAAEJ,MAAM;gBAACJ,MAAMQ,KAAK;gBAAEF;gBAAMC;aAAI,CAACE,MAAM,CAACC,SAASC,IAAI,CAAC;QAAQ;QAEtF,OAAO,MAAMzB,gBAAgBC,SAASa,MAAMZ,OAAO;IACrD,EAAE,OAAOJ,OAAO;QACdC,QAAQD,KAAK,CAAC,6CAA6CA;QAC3D,OAAO;YAAEO,MAAM;YAAOC,QAAQ;QAAU;IAC1C;AACF"}

package/src/lib/server/test-firestore.js

@@ -101,6 +101,7 @@ export function fakeFirestore(seed = {}) {
                     }),
                 // Ordering and limits are not what these specs are about; the queue
                 // read just needs to return everything it stored.
+                where: ()=>api,
                 orderBy: ()=>api,
                 limit: ()=>api,
                 get: async ()=>({

package/src/lib/server/test-firestore.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/test-firestore.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * A Firestore stand-in for specs that span MORE THAN ONE COLLECTION\n * (AGL-1592). Test-only; deliberately not exported from the barrel.\n *\n * The one-collection fakes elsewhere in this directory return the same\n * document whatever collection name they are handed, which is fine when the\n * code under test touches one document and actively misleading when it does\n * not: the phone opt-out path reads `users/{uid}` and `contactSuppressions/{n}`\n * and the whole point is that they are different records. A fake that conflated\n * them would pass while the real thing wrote the marker on top of the\n * suppression.\n *\n * `FieldValue.delete()` is honoured for real, because \"the field is gone\" and\n * \"the field holds a sentinel object\" are different states and only the first\n * one makes `seedUserProfile`'s blank check fire.\n */\n\nimport { FieldValue } from 'firebase-admin/firestore'\n\nconst DELETE = FieldValue.delete()\n\nexport interface FakeFirestore {\n  /**\n   * Every document in a collection, keyed by id.\n   *\n   * A SUBcollection is addressed by its full path — `hosts/host-1/suppressions`\n   * — which is also how it is seeded.\n   */\n  docs: (collection: string) => Record<string, any>\n  collection: (name: string) => any\n  /**\n   * Several documents in one round trip, the shape the real `getAll` has:\n   * the results come back POSITIONALLY, one per reference, so a caller that\n   * zips them back against its own input list gets what it asked for.\n   */\n  getAll: (...refs: any[]) => Promise<any[]>\n  /**\n   * A transaction, real enough for a read-then-write body.\n   *\n   * Reads pass straight through and writes are held until the body resolves,\n   * which is the property the code under test depends on: a writer that\n   * decides what to store FROM what it read must not observe its own\n   * half-finished write. It does not model contention or retries — nothing in\n   * this repo's transaction bodies branches on a retry, and a fake that\n   * pretended to would be asserting the fake.\n   */\n  runTransaction: <T>(body: (transaction: any) => Promise<T>) => Promise<T>\n}\n\nexport function fakeFirestore(\n  seed: Record<string, Record<string, any>> = {},\n): FakeFirestore {\n  const store: Record<string, Record<string, any>> = JSON.parse(\n    JSON.stringify(seed),\n  )\n\n  const snapshotFor = (collection: string, id: string) => {\n    const data = store[collection]?.[id]\n    return {\n      id,\n      exists: data !== undefined,\n      get: (field: string) => data?.[field],\n      data: () => data,\n    }\n  }\n\n  const fake: FakeFirestore = {\n    docs: (collection: string) => store[collection] ?? {},\n    getAll: async (...refs: any[]) =>\n      refs.map((ref) => snapshotFor(ref.collectionPath, ref.id)),\n    async runTransaction<T>(body: (transaction: any) => Promise<T>): Promise<T> {\n      const pending: Array<() => Promise<void>> = []\n      const transaction = {\n        get: (ref: any) => ref.get(),\n        set: (ref: any, data: Record<string, any>, options?: { merge?: boolean }) => {\n          pending.push(() => ref.set(data, options))\n          return transaction\n        },\n      }\n      const result = await body(transaction)\n      for (const write of pending) await write()\n      return result\n    },\n    collection(name: string) {\n      store[name] = store[name] ?? {}\n      const api: any = {\n        doc: (id: string) => ({\n          id,\n          /**\n           * Which collection this reference came from, so `getAll` can resolve\n           * a bare reference the way the real client does.\n           */\n          collectionPath: name,\n          /**\n           * A subcollection is a collection at the joined path, so the fake\n           * stays one flat map. Nesting matters here because a per-site list\n           * lives under the site — a fake that returned the same documents for\n           * `hosts/a/suppressions` and `hosts/b/suppressions` would certify a\n           * sender that leaks one site's unsubscribes into another's.\n           */\n          collection: (sub: string) => fake.collection(`${name}/${id}/${sub}`),\n          get: async () => snapshotFor(name, id),\n          set: async (data: Record<string, any>, options?: { merge?: boolean }) => {\n            const base = options?.merge ? (store[name][id] ?? {}) : {}\n            const next: Record<string, any> = { ...base }\n            for (const [key, value] of Object.entries(data)) {\n              // A real delete, not a stored sentinel — see the header.\n              if (value && typeof value === 'object' && DELETE.isEqual(value as any)) {\n                delete next[key]\n                continue\n              }\n              // Server timestamps arrive as sentinels too. Freeze them into\n              // something a spec can assert on and a date can be read from.\n              next[key] =\n                value && typeof value === 'object' && typeof (value as any).isEqual === 'function'\n                  ? { seconds: Math.floor(Date.now() / 1000) }\n                  : value\n            }\n            store[name][id] = next\n          },\n        }),\n        // Ordering and limits are not what these specs are about; the queue\n        // read just needs to return everything it stored.\n        orderBy: () => api,\n        limit: () => api,\n        get: async () => ({\n          docs: Object.keys(store[name]).map((id) => snapshotFor(name, id)),\n        }),\n        add: async (data: Record<string, any>) => {\n          const id = `auto-${Object.keys(store[name]).length + 1}`\n          store[name][id] = data\n          return { id }\n        },\n      }\n      return api\n    },\n  }\n  return fake\n}\n\nexport default fakeFirestore\n"],"names":["FieldValue","DELETE","delete","fakeFirestore","seed","store","JSON","parse","stringify","snapshotFor","collection","id","data","exists","undefined","get","field","fake","docs","getAll","refs","map","ref","collectionPath","runTransaction","body","pending","transaction","set","options","push","result","write","name","api","doc","sub","base","merge","next","key","value","Object","entries","isEqual","seconds","Math","floor","Date","now","orderBy","limit","keys","add","length"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,QAAQ,2BAA0B;AAErD,MAAMC,SAASD,WAAWE,MAAM;AA8BhC,OAAO,SAASC,cACdC,OAA4C,CAAC,CAAC;IAE9C,MAAMC,QAA6CC,KAAKC,KAAK,CAC3DD,KAAKE,SAAS,CAACJ;IAGjB,MAAMK,cAAc,CAACC,YAAoBC;YAC1BN;QAAb,MAAMO,QAAOP,oBAAAA,KAAK,CAACK,WAAW,qBAAjBL,iBAAmB,CAACM,GAAG;QACpC,OAAO;YACLA;YACAE,QAAQD,SAASE;YACjBC,KAAK,CAACC,QAAkBJ,wBAAAA,IAAM,CAACI,MAAM;YACrCJ,MAAM,IAAMA;QACd;IACF;IAEA,MAAMK,OAAsB;QAC1BC,MAAM,CAACR;gBAAuBL;oBAAAA,oBAAAA,KAAK,CAACK,WAAW,YAAjBL,oBAAqB,CAAC;;QACpDc,QAAQ,OAAO,GAAGC,OAChBA,KAAKC,GAAG,CAAC,CAACC,MAAQb,YAAYa,IAAIC,cAAc,EAAED,IAAIX,EAAE;QAC1D,MAAMa,gBAAkBC,IAAsC;YAC5D,MAAMC,UAAsC,EAAE;YAC9C,MAAMC,cAAc;gBAClBZ,KAAK,CAACO,MAAaA,IAAIP,GAAG;gBAC1Ba,KAAK,CAACN,KAAUV,MAA2BiB;oBACzCH,QAAQI,IAAI,CAAC,IAAMR,IAAIM,GAAG,CAAChB,MAAMiB;oBACjC,OAAOF;gBACT;YACF;YACA,MAAMI,SAAS,MAAMN,KAAKE;YAC1B,KAAK,MAAMK,SAASN,QAAS,MAAMM;YACnC,OAAOD;QACT;QACArB,YAAWuB,IAAY;gBACP5B;YAAdA,KAAK,CAAC4B,KAAK,IAAG5B,cAAAA,KAAK,CAAC4B,KAAK,YAAX5B,cAAe,CAAC;YAC9B,MAAM6B,MAAW;gBACfC,KAAK,CAACxB,KAAgB,CAAA;wBACpBA;wBACA;;;WAGC,GACDY,gBAAgBU;wBAChB;;;;;;WAMC,GACDvB,YAAY,CAAC0B,MAAgBnB,KAAKP,UAAU,CAAC,GAAGuB,KAAK,CAAC,EAAEtB,GAAG,CAAC,EAAEyB,KAAK;wBACnErB,KAAK,UAAYN,YAAYwB,MAAMtB;wBACnCiB,KAAK,OAAOhB,MAA2BiB;gCACNxB;4BAA/B,MAAMgC,OAAOR,CAAAA,2BAAAA,QAASS,KAAK,KAAIjC,iBAAAA,KAAK,CAAC4B,KAAK,CAACtB,GAAG,YAAfN,iBAAmB,CAAC,IAAK,CAAC;4BACzD,MAAMkC,OAA4B,aAAKF;4BACvC,KAAK,MAAM,CAACG,KAAKC,MAAM,IAAIC,OAAOC,OAAO,CAAC/B,MAAO;gCAC/C,yDAAyD;gCACzD,IAAI6B,SAAS,OAAOA,UAAU,YAAYxC,OAAO2C,OAAO,CAACH,QAAe;oCACtE,OAAOF,IAAI,CAACC,IAAI;oCAChB;gCACF;gCACA,8DAA8D;gCAC9D,8DAA8D;gCAC9DD,IAAI,CAACC,IAAI,GACPC,SAAS,OAAOA,UAAU,YAAY,OAAO,AAACA,MAAcG,OAAO,KAAK,aACpE;oCAAEC,SAASC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK;gCAAM,IACzCR;4BACR;4BACApC,KAAK,CAAC4B,KAAK,CAACtB,GAAG,GAAG4B;wBACpB;oBACF,CAAA;gBACA,oEAAoE;gBACpE,kDAAkD;gBAClDW,SAAS,IAAMhB;gBACfiB,OAAO,IAAMjB;gBACbnB,KAAK,UAAa,CAAA;wBAChBG,MAAMwB,OAAOU,IAAI,CAAC/C,KAAK,CAAC4B,KAAK,EAAEZ,GAAG,CAAC,CAACV,KAAOF,YAAYwB,MAAMtB;oBAC/D,CAAA;gBACA0C,KAAK,OAAOzC;oBACV,MAAMD,KAAK,CAAC,KAAK,EAAE+B,OAAOU,IAAI,CAAC/C,KAAK,CAAC4B,KAAK,EAAEqB,MAAM,GAAG,GAAG;oBACxDjD,KAAK,CAAC4B,KAAK,CAACtB,GAAG,GAAGC;oBAClB,OAAO;wBAAED;oBAAG;gBACd;YACF;YACA,OAAOuB;QACT;IACF;IACA,OAAOjB;AACT;AAEA,eAAed,cAAa"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/test-firestore.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * A Firestore stand-in for specs that span MORE THAN ONE COLLECTION\n * (AGL-1592). Test-only; deliberately not exported from the barrel.\n *\n * The one-collection fakes elsewhere in this directory return the same\n * document whatever collection name they are handed, which is fine when the\n * code under test touches one document and actively misleading when it does\n * not: the phone opt-out path reads `users/{uid}` and `contactSuppressions/{n}`\n * and the whole point is that they are different records. A fake that conflated\n * them would pass while the real thing wrote the marker on top of the\n * suppression.\n *\n * `FieldValue.delete()` is honoured for real, because \"the field is gone\" and\n * \"the field holds a sentinel object\" are different states and only the first\n * one makes `seedUserProfile`'s blank check fire.\n */\n\nimport { FieldValue } from 'firebase-admin/firestore'\n\nconst DELETE = FieldValue.delete()\n\nexport interface FakeFirestore {\n  /**\n   * Every document in a collection, keyed by id.\n   *\n   * A SUBcollection is addressed by its full path — `hosts/host-1/suppressions`\n   * — which is also how it is seeded.\n   */\n  docs: (collection: string) => Record<string, any>\n  collection: (name: string) => any\n  /**\n   * Several documents in one round trip, the shape the real `getAll` has:\n   * the results come back POSITIONALLY, one per reference, so a caller that\n   * zips them back against its own input list gets what it asked for.\n   */\n  getAll: (...refs: any[]) => Promise<any[]>\n  /**\n   * A transaction, real enough for a read-then-write body.\n   *\n   * Reads pass straight through and writes are held until the body resolves,\n   * which is the property the code under test depends on: a writer that\n   * decides what to store FROM what it read must not observe its own\n   * half-finished write. It does not model contention or retries — nothing in\n   * this repo's transaction bodies branches on a retry, and a fake that\n   * pretended to would be asserting the fake.\n   */\n  runTransaction: <T>(body: (transaction: any) => Promise<T>) => Promise<T>\n}\n\nexport function fakeFirestore(\n  seed: Record<string, Record<string, any>> = {},\n): FakeFirestore {\n  const store: Record<string, Record<string, any>> = JSON.parse(\n    JSON.stringify(seed),\n  )\n\n  const snapshotFor = (collection: string, id: string) => {\n    const data = store[collection]?.[id]\n    return {\n      id,\n      exists: data !== undefined,\n      get: (field: string) => data?.[field],\n      data: () => data,\n    }\n  }\n\n  const fake: FakeFirestore = {\n    docs: (collection: string) => store[collection] ?? {},\n    getAll: async (...refs: any[]) =>\n      refs.map((ref) => snapshotFor(ref.collectionPath, ref.id)),\n    async runTransaction<T>(body: (transaction: any) => Promise<T>): Promise<T> {\n      const pending: Array<() => Promise<void>> = []\n      const transaction = {\n        get: (ref: any) => ref.get(),\n        set: (ref: any, data: Record<string, any>, options?: { merge?: boolean }) => {\n          pending.push(() => ref.set(data, options))\n          return transaction\n        },\n      }\n      const result = await body(transaction)\n      for (const write of pending) await write()\n      return result\n    },\n    collection(name: string) {\n      store[name] = store[name] ?? {}\n      const api: any = {\n        doc: (id: string) => ({\n          id,\n          /**\n           * Which collection this reference came from, so `getAll` can resolve\n           * a bare reference the way the real client does.\n           */\n          collectionPath: name,\n          /**\n           * A subcollection is a collection at the joined path, so the fake\n           * stays one flat map. Nesting matters here because a per-site list\n           * lives under the site — a fake that returned the same documents for\n           * `hosts/a/suppressions` and `hosts/b/suppressions` would certify a\n           * sender that leaks one site's unsubscribes into another's.\n           */\n          collection: (sub: string) => fake.collection(`${name}/${id}/${sub}`),\n          get: async () => snapshotFor(name, id),\n          set: async (data: Record<string, any>, options?: { merge?: boolean }) => {\n            const base = options?.merge ? (store[name][id] ?? {}) : {}\n            const next: Record<string, any> = { ...base }\n            for (const [key, value] of Object.entries(data)) {\n              // A real delete, not a stored sentinel — see the header.\n              if (value && typeof value === 'object' && DELETE.isEqual(value as any)) {\n                delete next[key]\n                continue\n              }\n              // Server timestamps arrive as sentinels too. Freeze them into\n              // something a spec can assert on and a date can be read from.\n              next[key] =\n                value && typeof value === 'object' && typeof (value as any).isEqual === 'function'\n                  ? { seconds: Math.floor(Date.now() / 1000) }\n                  : value\n            }\n            store[name][id] = next\n          },\n        }),\n        // Ordering and limits are not what these specs are about; the queue\n        // read just needs to return everything it stored.\n        where: () => api,\n        orderBy: () => api,\n        limit: () => api,\n        get: async () => ({\n          docs: Object.keys(store[name]).map((id) => snapshotFor(name, id)),\n        }),\n        add: async (data: Record<string, any>) => {\n          const id = `auto-${Object.keys(store[name]).length + 1}`\n          store[name][id] = data\n          return { id }\n        },\n      }\n      return api\n    },\n  }\n  return fake\n}\n\nexport default fakeFirestore\n"],"names":["FieldValue","DELETE","delete","fakeFirestore","seed","store","JSON","parse","stringify","snapshotFor","collection","id","data","exists","undefined","get","field","fake","docs","getAll","refs","map","ref","collectionPath","runTransaction","body","pending","transaction","set","options","push","result","write","name","api","doc","sub","base","merge","next","key","value","Object","entries","isEqual","seconds","Math","floor","Date","now","where","orderBy","limit","keys","add","length"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,QAAQ,2BAA0B;AAErD,MAAMC,SAASD,WAAWE,MAAM;AA8BhC,OAAO,SAASC,cACdC,OAA4C,CAAC,CAAC;IAE9C,MAAMC,QAA6CC,KAAKC,KAAK,CAC3DD,KAAKE,SAAS,CAACJ;IAGjB,MAAMK,cAAc,CAACC,YAAoBC;YAC1BN;QAAb,MAAMO,QAAOP,oBAAAA,KAAK,CAACK,WAAW,qBAAjBL,iBAAmB,CAACM,GAAG;QACpC,OAAO;YACLA;YACAE,QAAQD,SAASE;YACjBC,KAAK,CAACC,QAAkBJ,wBAAAA,IAAM,CAACI,MAAM;YACrCJ,MAAM,IAAMA;QACd;IACF;IAEA,MAAMK,OAAsB;QAC1BC,MAAM,CAACR;gBAAuBL;oBAAAA,oBAAAA,KAAK,CAACK,WAAW,YAAjBL,oBAAqB,CAAC;;QACpDc,QAAQ,OAAO,GAAGC,OAChBA,KAAKC,GAAG,CAAC,CAACC,MAAQb,YAAYa,IAAIC,cAAc,EAAED,IAAIX,EAAE;QAC1D,MAAMa,gBAAkBC,IAAsC;YAC5D,MAAMC,UAAsC,EAAE;YAC9C,MAAMC,cAAc;gBAClBZ,KAAK,CAACO,MAAaA,IAAIP,GAAG;gBAC1Ba,KAAK,CAACN,KAAUV,MAA2BiB;oBACzCH,QAAQI,IAAI,CAAC,IAAMR,IAAIM,GAAG,CAAChB,MAAMiB;oBACjC,OAAOF;gBACT;YACF;YACA,MAAMI,SAAS,MAAMN,KAAKE;YAC1B,KAAK,MAAMK,SAASN,QAAS,MAAMM;YACnC,OAAOD;QACT;QACArB,YAAWuB,IAAY;gBACP5B;YAAdA,KAAK,CAAC4B,KAAK,IAAG5B,cAAAA,KAAK,CAAC4B,KAAK,YAAX5B,cAAe,CAAC;YAC9B,MAAM6B,MAAW;gBACfC,KAAK,CAACxB,KAAgB,CAAA;wBACpBA;wBACA;;;WAGC,GACDY,gBAAgBU;wBAChB;;;;;;WAMC,GACDvB,YAAY,CAAC0B,MAAgBnB,KAAKP,UAAU,CAAC,GAAGuB,KAAK,CAAC,EAAEtB,GAAG,CAAC,EAAEyB,KAAK;wBACnErB,KAAK,UAAYN,YAAYwB,MAAMtB;wBACnCiB,KAAK,OAAOhB,MAA2BiB;gCACNxB;4BAA/B,MAAMgC,OAAOR,CAAAA,2BAAAA,QAASS,KAAK,KAAIjC,iBAAAA,KAAK,CAAC4B,KAAK,CAACtB,GAAG,YAAfN,iBAAmB,CAAC,IAAK,CAAC;4BACzD,MAAMkC,OAA4B,aAAKF;4BACvC,KAAK,MAAM,CAACG,KAAKC,MAAM,IAAIC,OAAOC,OAAO,CAAC/B,MAAO;gCAC/C,yDAAyD;gCACzD,IAAI6B,SAAS,OAAOA,UAAU,YAAYxC,OAAO2C,OAAO,CAACH,QAAe;oCACtE,OAAOF,IAAI,CAACC,IAAI;oCAChB;gCACF;gCACA,8DAA8D;gCAC9D,8DAA8D;gCAC9DD,IAAI,CAACC,IAAI,GACPC,SAAS,OAAOA,UAAU,YAAY,OAAO,AAACA,MAAcG,OAAO,KAAK,aACpE;oCAAEC,SAASC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK;gCAAM,IACzCR;4BACR;4BACApC,KAAK,CAAC4B,KAAK,CAACtB,GAAG,GAAG4B;wBACpB;oBACF,CAAA;gBACA,oEAAoE;gBACpE,kDAAkD;gBAClDW,OAAO,IAAMhB;gBACbiB,SAAS,IAAMjB;gBACfkB,OAAO,IAAMlB;gBACbnB,KAAK,UAAa,CAAA;wBAChBG,MAAMwB,OAAOW,IAAI,CAAChD,KAAK,CAAC4B,KAAK,EAAEZ,GAAG,CAAC,CAACV,KAAOF,YAAYwB,MAAMtB;oBAC/D,CAAA;gBACA2C,KAAK,OAAO1C;oBACV,MAAMD,KAAK,CAAC,KAAK,EAAE+B,OAAOW,IAAI,CAAChD,KAAK,CAAC4B,KAAK,EAAEsB,MAAM,GAAG,GAAG;oBACxDlD,KAAK,CAAC4B,KAAK,CAACtB,GAAG,GAAGC;oBAClB,OAAO;wBAAED;oBAAG;gBACd;YACF;YACA,OAAOuB;QACT;IACF;IACA,OAAOjB;AACT;AAEA,eAAed,cAAa"}

package/src/lib/server/upsert-contact.js

@@ -20,6 +20,7 @@ import { firebaseAdmin } from "./firebase-admin.js";
 import { countCrmRecords, restampCrmListFieldsAt } from "./crm-records.js";
 import { attributeOrderToEmail } from "./email-revenue-attribution.js";
 import { hostRefusesCaptureForErasure } from "./email-suppression.js";
+import { scheduleCapturedEmailCheck } from "./capture-email-check.js";
 import { attributeCampaignConversion } from "./campaign-conversion-attribution.js";
 import { nameSearchFields } from "@aglyn/aglyn/app-utils/name-search";
 import { consentGroupForGrant } from "@aglyn/aglyn/app-utils/consent-groups";
@@ -117,8 +118,8 @@ import { consentGroupForSite, getOrgForHost, orgDataCollectionForHost } from "./
 }
 export async function upsertHostContact(options) {
     try {
-        var _options_interaction_atMs, _options_campaignIds, _ref, _contactsRef_parent, _ref1, _ref2;
-        var _options_facet, _orgBilling_org;
+        var _options_interaction_atMs, _options_campaignIds, _ref, _contactsRef_parent, _ref1, _ref2, _ref3;
+        var _options_facet, _orgBilling_org, _contactsRef_parent1;
         const email = normalizeContactEmail(options.email);
         if (!email) return {
             refused: 'invalid-email'
@@ -246,7 +247,8 @@ export async function upsertHostContact(options) {
      * read once and needs no backfill.
      *=========================================*/ const docSnapshot = await findContactByEmail(contactsRef, email);
         if (docSnapshot) {
-            var _facet_name, _profile_lifecycleStage;
+            var _facet_name, _profile_lifecycleStage, _ref4;
+            var _contactsRef_parent2;
             /*
        * MERGED INTO THIS GROUP'S FACET, not into the top of the document.
        *
@@ -365,6 +367,13 @@ export async function upsertHostContact(options) {
             // The merged facet, name and scope are what the Contacts list
             // searches and filters by (AGL-3321): restamped from the stored row.
             await restampCrmListFieldsAt(docSnapshot.ref, 'contacts');
+            // The address's domain, checked after the response (AGL-3328).
+            scheduleCapturedEmailCheck({
+                orgId: (_ref4 = (_contactsRef_parent2 = contactsRef.parent) == null ? void 0 : _contactsRef_parent2.id) != null ? _ref4 : null,
+                hostId: options.hostId,
+                email,
+                predicted: docSnapshot.get('emailStatus') === 'undeliverable'
+            });
             return {
                 contactId: docSnapshot.id,
                 created: false
@@ -556,6 +565,13 @@ export async function upsertHostContact(options) {
                 console.error('upsertHostContact onCreated failed', error);
             });
         }
+        // A new person's address, checked after the response (AGL-3328): a
+        // domain that takes no mail reads "Would bounce" on the record.
+        scheduleCapturedEmailCheck({
+            orgId: (_ref3 = (_contactsRef_parent1 = contactsRef.parent) == null ? void 0 : _contactsRef_parent1.id) != null ? _ref3 : null,
+            hostId: options.hostId,
+            email
+        });
         return {
             contactId: created.id,
             created: true