@aglyn/tenant-data-admin 1.0.0-beta.217 → 1.0.0-beta.218

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/tenant-data-admin",
-  "version": "1.0.0-beta.217",
+  "version": "1.0.0-beta.218",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,16 +25,16 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/aglyn": "1.0.0-beta.217",
-    "@aglyn/shared-util-email": "1.0.0-beta.217",
-    "@aglyn/shared-util-fbserver": "1.0.0-beta.217",
-    "@aglyn/shared-util-first-touch": "1.0.0-beta.217",
-    "@aglyn/shared-util-http": "1.0.0-beta.217",
-    "@aglyn/shared-util-tools": "1.0.0-beta.217",
+    "@aglyn/aglyn": "1.0.0-beta.218",
+    "@aglyn/shared-util-email": "1.0.0-beta.218",
+    "@aglyn/shared-util-fbserver": "1.0.0-beta.218",
+    "@aglyn/shared-util-first-touch": "1.0.0-beta.218",
+    "@aglyn/shared-util-http": "1.0.0-beta.218",
+    "@aglyn/shared-util-tools": "1.0.0-beta.218",
     "@msgpack/msgpack": "^3.1.3",
     "@swc/helpers": "0.5.23",
-    "sharp": "^0.35.3",
-    "undici": "^7.29.0"
+    "sharp": "^0.35.5",
+    "undici": "^8.11.2"
   },
   "peerDependencies": {
     "firebase-admin": "^14.3.0",

package/src/lib/server/account-lock-mail.d.ts

@@ -0,0 +1,74 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * WHAT AN ACCOUNT LOCK DOES TO MAIL ADDRESSED BY EMAIL (AGL-3420).
+ *
+ * The uid-keyed fan-outs already skip a locked account
+ * (`isAccountMailWithheld`, AGL-3418). What they cannot reach is mail
+ * addressed by email alone — a campaign to a list, a sequence to a contact —
+ * so the lock is written onto the suppression lists, keyed by every address
+ * the account holds:
+ *
+ *  - **Every lock:** each of the house workspace's sites, `account_lock`, so
+ *    Aglyn's own campaigns and sequences stop. Other workspaces are not ours
+ *    to speak for.
+ *  - **A ban** (`abuse`): the platform list as well, `account_ban`, which
+ *    the preflight on `sendEmail` refuses on every send by any sender. The
+ *    account is kept only so the address cannot sign up again; after its
+ *    notice it is sent nothing.
+ *
+ * Called after the lock is durable and after its notices have gone, and it
+ * never undoes the lock: a failure is reported beside the lock, not instead
+ * of it.
+ */
+export interface AccountLockMailReport {
+    /** The addresses the account holds that were written or lifted. */
+    addresses: number;
+    /** A source of addresses failed; the set may be short. */
+    incomplete: boolean;
+    /** Platform ban rows filed (lock) or released (lift). */
+    banRows: number;
+    /** House sites the per-site rows were written on or lifted from. */
+    houseSites: number;
+    /** Per-site rows written (lock) or deleted (lift). */
+    houseRows: number;
+    /** Writes that threw. */
+    failed: number;
+}
+interface AccountLockMailInput {
+    uid: string;
+    /** The Auth record, for its addresses. */
+    record: {
+        email?: string | null;
+        providerData?: readonly {
+            email?: string | null;
+        }[];
+    } | null;
+    firestore?: any;
+}
+/** Write a lock onto the lists. `ban` files the platform rows as well. */
+export declare function applyAccountLockToMail(input: AccountLockMailInput & {
+    ban: boolean;
+}): Promise<AccountLockMailReport>;
+/**
+ * Take a lift off the lists: the account's ban rows (restoring any
+ * suppression a ban was filed over) and its house rows.
+ */
+export declare function liftAccountLockFromMail(input: AccountLockMailInput & {
+    releasedByUid?: string | null;
+}): Promise<AccountLockMailReport>;
+export {};

package/src/lib/server/account-lock-mail.js

@@ -0,0 +1,139 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { resolveAccountAddresses } from "./account-addresses.js";
+import { releaseAccountBanSuppressions, releaseAccountLockSuppression, suppressEmail, suppressEmailForAccountLock } from "./email-suppression.js";
+import { getOrgForHost } from "./organizations.js";
+import { platformMarketingHostId } from "./platform-marketing-consent.js";
+/** The house workspace's site ids, or none on an install without one. */ async function houseSiteIds() {
+    var _ref;
+    var _house_org;
+    const houseHostId = platformMarketingHostId();
+    if (!houseHostId) return [];
+    const house = await getOrgForHost(houseHostId);
+    const directory = (_ref = house == null ? void 0 : (_house_org = house.org) == null ? void 0 : _house_org.hosts) != null ? _ref : {};
+    const ids = Object.keys(directory).filter((id)=>Boolean(directory[id]));
+    return ids.includes(houseHostId) ? ids : [
+        houseHostId,
+        ...ids
+    ];
+}
+async function addressesOf(input) {
+    const set = await resolveAccountAddresses(_extends({
+        uid: input.uid,
+        record: input.record
+    }, input.firestore ? {
+        firestore: input.firestore
+    } : {}));
+    return {
+        emails: set.addresses.map((entry)=>entry.address),
+        incomplete: set.incomplete
+    };
+}
+/** Write a lock onto the lists. `ban` files the platform rows as well. */ export async function applyAccountLockToMail(input) {
+    const { emails, incomplete } = await addressesOf(input);
+    const sites = await houseSiteIds();
+    const report = {
+        addresses: emails.length,
+        incomplete,
+        banRows: 0,
+        houseSites: sites.length,
+        houseRows: 0,
+        failed: 0
+    };
+    for (const email of emails){
+        if (input.ban) {
+            try {
+                await suppressEmail(_extends({
+                    email,
+                    reason: 'account_ban',
+                    subjectUid: input.uid,
+                    context: 'account-ban',
+                    stampRecord: false
+                }, input.firestore ? {
+                    firestore: input.firestore
+                } : {}));
+                report.banRows += 1;
+            } catch (error) {
+                console.error('[account-lock-mail] ban row failed', input.uid, error);
+                report.failed += 1;
+            }
+        }
+        for (const hostId of sites){
+            try {
+                const wrote = await suppressEmailForAccountLock(_extends({
+                    hostId,
+                    email,
+                    uid: input.uid
+                }, input.firestore ? {
+                    firestore: input.firestore
+                } : {}));
+                if (wrote) report.houseRows += 1;
+            } catch (error) {
+                console.error('[account-lock-mail] house row failed', input.uid, hostId, error);
+                report.failed += 1;
+            }
+        }
+    }
+    return report;
+}
+/**
+ * Take a lift off the lists: the account's ban rows (restoring any
+ * suppression a ban was filed over) and its house rows.
+ */ export async function liftAccountLockFromMail(input) {
+    const { emails, incomplete } = await addressesOf(input);
+    const sites = await houseSiteIds();
+    const report = {
+        addresses: emails.length,
+        incomplete,
+        banRows: 0,
+        houseSites: sites.length,
+        houseRows: 0,
+        failed: 0
+    };
+    try {
+        var _input_releasedByUid;
+        report.banRows = await releaseAccountBanSuppressions(_extends({
+            uid: input.uid,
+            releasedByUid: (_input_releasedByUid = input.releasedByUid) != null ? _input_releasedByUid : null
+        }, input.firestore ? {
+            firestore: input.firestore
+        } : {}));
+    } catch (error) {
+        console.error('[account-lock-mail] ban release failed', input.uid, error);
+        report.failed += 1;
+    }
+    for (const email of emails){
+        for (const hostId of sites){
+            try {
+                const deleted = await releaseAccountLockSuppression(_extends({
+                    hostId,
+                    email,
+                    uid: input.uid
+                }, input.firestore ? {
+                    firestore: input.firestore
+                } : {}));
+                if (deleted) report.houseRows += 1;
+            } catch (error) {
+                console.error('[account-lock-mail] house release failed', input.uid, hostId, error);
+                report.failed += 1;
+            }
+        }
+    }
+    return report;
+}
+
+//# sourceMappingURL=account-lock-mail.js.map

package/src/lib/server/account-lock-mail.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/account-lock-mail.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { resolveAccountAddresses } from './account-addresses'\nimport {\n  releaseAccountBanSuppressions,\n  releaseAccountLockSuppression,\n  suppressEmail,\n  suppressEmailForAccountLock,\n} from './email-suppression'\nimport { getOrgForHost } from './organizations'\nimport { platformMarketingHostId } from './platform-marketing-consent'\n\n/**\n * WHAT AN ACCOUNT LOCK DOES TO MAIL ADDRESSED BY EMAIL (AGL-3420).\n *\n * The uid-keyed fan-outs already skip a locked account\n * (`isAccountMailWithheld`, AGL-3418). What they cannot reach is mail\n * addressed by email alone — a campaign to a list, a sequence to a contact —\n * so the lock is written onto the suppression lists, keyed by every address\n * the account holds:\n *\n *  - **Every lock:** each of the house workspace's sites, `account_lock`, so\n *    Aglyn's own campaigns and sequences stop. Other workspaces are not ours\n *    to speak for.\n *  - **A ban** (`abuse`): the platform list as well, `account_ban`, which\n *    the preflight on `sendEmail` refuses on every send by any sender. The\n *    account is kept only so the address cannot sign up again; after its\n *    notice it is sent nothing.\n *\n * Called after the lock is durable and after its notices have gone, and it\n * never undoes the lock: a failure is reported beside the lock, not instead\n * of it.\n */\n\nexport interface AccountLockMailReport {\n  /** The addresses the account holds that were written or lifted. */\n  addresses: number\n  /** A source of addresses failed; the set may be short. */\n  incomplete: boolean\n  /** Platform ban rows filed (lock) or released (lift). */\n  banRows: number\n  /** House sites the per-site rows were written on or lifted from. */\n  houseSites: number\n  /** Per-site rows written (lock) or deleted (lift). */\n  houseRows: number\n  /** Writes that threw. */\n  failed: number\n}\n\ninterface AccountLockMailInput {\n  uid: string\n  /** The Auth record, for its addresses. */\n  record: {\n    email?: string | null\n    providerData?: readonly { email?: string | null }[]\n  } | null\n  firestore?: any\n}\n\n/** The house workspace's site ids, or none on an install without one. */\nasync function houseSiteIds(): Promise<string[]> {\n  const houseHostId = platformMarketingHostId()\n  if (!houseHostId) return []\n  const house = await getOrgForHost(houseHostId)\n  const directory = (house?.org as { hosts?: Record<string, unknown> } | undefined)?.hosts ?? {}\n  const ids = Object.keys(directory).filter((id) => Boolean(directory[id]))\n  return ids.includes(houseHostId) ? ids : [houseHostId, ...ids]\n}\n\nasync function addressesOf(input: AccountLockMailInput) {\n  const set = await resolveAccountAddresses({\n    uid: input.uid,\n    record: input.record,\n    ...(input.firestore ? { firestore: input.firestore } : {}),\n  })\n  return { emails: set.addresses.map((entry) => entry.address), incomplete: set.incomplete }\n}\n\n/** Write a lock onto the lists. `ban` files the platform rows as well. */\nexport async function applyAccountLockToMail(\n  input: AccountLockMailInput & { ban: boolean },\n): Promise<AccountLockMailReport> {\n  const { emails, incomplete } = await addressesOf(input)\n  const sites = await houseSiteIds()\n  const report: AccountLockMailReport = {\n    addresses: emails.length,\n    incomplete,\n    banRows: 0,\n    houseSites: sites.length,\n    houseRows: 0,\n    failed: 0,\n  }\n  for (const email of emails) {\n    if (input.ban) {\n      try {\n        await suppressEmail({\n          email,\n          reason: 'account_ban',\n          subjectUid: input.uid,\n          context: 'account-ban',\n          stampRecord: false,\n          ...(input.firestore ? { firestore: input.firestore } : {}),\n        })\n        report.banRows += 1\n      } catch (error) {\n        console.error('[account-lock-mail] ban row failed', input.uid, error)\n        report.failed += 1\n      }\n    }\n    for (const hostId of sites) {\n      try {\n        const wrote = await suppressEmailForAccountLock({\n          hostId,\n          email,\n          uid: input.uid,\n          ...(input.firestore ? { firestore: input.firestore } : {}),\n        })\n        if (wrote) report.houseRows += 1\n      } catch (error) {\n        console.error('[account-lock-mail] house row failed', input.uid, hostId, error)\n        report.failed += 1\n      }\n    }\n  }\n  return report\n}\n\n/**\n * Take a lift off the lists: the account's ban rows (restoring any\n * suppression a ban was filed over) and its house rows.\n */\nexport async function liftAccountLockFromMail(\n  input: AccountLockMailInput & { releasedByUid?: string | null },\n): Promise<AccountLockMailReport> {\n  const { emails, incomplete } = await addressesOf(input)\n  const sites = await houseSiteIds()\n  const report: AccountLockMailReport = {\n    addresses: emails.length,\n    incomplete,\n    banRows: 0,\n    houseSites: sites.length,\n    houseRows: 0,\n    failed: 0,\n  }\n  try {\n    report.banRows = await releaseAccountBanSuppressions({\n      uid: input.uid,\n      releasedByUid: input.releasedByUid ?? null,\n      ...(input.firestore ? { firestore: input.firestore } : {}),\n    })\n  } catch (error) {\n    console.error('[account-lock-mail] ban release failed', input.uid, error)\n    report.failed += 1\n  }\n  for (const email of emails) {\n    for (const hostId of sites) {\n      try {\n        const deleted = await releaseAccountLockSuppression({\n          hostId,\n          email,\n          uid: input.uid,\n          ...(input.firestore ? { firestore: input.firestore } : {}),\n        })\n        if (deleted) report.houseRows += 1\n      } catch (error) {\n        console.error('[account-lock-mail] house release failed', input.uid, hostId, error)\n        report.failed += 1\n      }\n    }\n  }\n  return report\n}\n"],"names":["resolveAccountAddresses","releaseAccountBanSuppressions","releaseAccountLockSuppression","suppressEmail","suppressEmailForAccountLock","getOrgForHost","platformMarketingHostId","houseSiteIds","house","houseHostId","directory","org","hosts","ids","Object","keys","filter","id","Boolean","includes","addressesOf","input","set","uid","record","firestore","emails","addresses","map","entry","address","incomplete","applyAccountLockToMail","sites","report","length","banRows","houseSites","houseRows","failed","email","ban","reason","subjectUid","context","stampRecord","error","console","hostId","wrote","liftAccountLockFromMail","releasedByUid","deleted"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,uBAAuB,QAAQ,yBAAqB;AAC7D,SACEC,6BAA6B,EAC7BC,6BAA6B,EAC7BC,aAAa,EACbC,2BAA2B,QACtB,yBAAqB;AAC5B,SAASC,aAAa,QAAQ,qBAAiB;AAC/C,SAASC,uBAAuB,QAAQ,kCAA8B;AAiDtE,uEAAuE,GACvE,eAAeC;;QAIMC;IAHnB,MAAMC,cAAcH;IACpB,IAAI,CAACG,aAAa,OAAO,EAAE;IAC3B,MAAMD,QAAQ,MAAMH,cAAcI;IAClC,MAAMC,oBAAaF,0BAAAA,aAAAA,MAAOG,GAAG,qBAAX,AAACH,WAAgEI,KAAK,mBAAI,CAAC;IAC7F,MAAMC,MAAMC,OAAOC,IAAI,CAACL,WAAWM,MAAM,CAAC,CAACC,KAAOC,QAAQR,SAAS,CAACO,GAAG;IACvE,OAAOJ,IAAIM,QAAQ,CAACV,eAAeI,MAAM;QAACJ;WAAgBI;KAAI;AAChE;AAEA,eAAeO,YAAYC,KAA2B;IACpD,MAAMC,MAAM,MAAMtB,wBAAwB;QACxCuB,KAAKF,MAAME,GAAG;QACdC,QAAQH,MAAMG,MAAM;OAChBH,MAAMI,SAAS,GAAG;QAAEA,WAAWJ,MAAMI,SAAS;IAAC,IAAI,CAAC;IAE1D,OAAO;QAAEC,QAAQJ,IAAIK,SAAS,CAACC,GAAG,CAAC,CAACC,QAAUA,MAAMC,OAAO;QAAGC,YAAYT,IAAIS,UAAU;IAAC;AAC3F;AAEA,wEAAwE,GACxE,OAAO,eAAeC,uBACpBX,KAA8C;IAE9C,MAAM,EAAEK,MAAM,EAAEK,UAAU,EAAE,GAAG,MAAMX,YAAYC;IACjD,MAAMY,QAAQ,MAAM1B;IACpB,MAAM2B,SAAgC;QACpCP,WAAWD,OAAOS,MAAM;QACxBJ;QACAK,SAAS;QACTC,YAAYJ,MAAME,MAAM;QACxBG,WAAW;QACXC,QAAQ;IACV;IACA,KAAK,MAAMC,SAASd,OAAQ;QAC1B,IAAIL,MAAMoB,GAAG,EAAE;YACb,IAAI;gBACF,MAAMtC,cAAc;oBAClBqC;oBACAE,QAAQ;oBACRC,YAAYtB,MAAME,GAAG;oBACrBqB,SAAS;oBACTC,aAAa;mBACTxB,MAAMI,SAAS,GAAG;oBAAEA,WAAWJ,MAAMI,SAAS;gBAAC,IAAI,CAAC;gBAE1DS,OAAOE,OAAO,IAAI;YACpB,EAAE,OAAOU,OAAO;gBACdC,QAAQD,KAAK,CAAC,sCAAsCzB,MAAME,GAAG,EAAEuB;gBAC/DZ,OAAOK,MAAM,IAAI;YACnB;QACF;QACA,KAAK,MAAMS,UAAUf,MAAO;YAC1B,IAAI;gBACF,MAAMgB,QAAQ,MAAM7C,4BAA4B;oBAC9C4C;oBACAR;oBACAjB,KAAKF,MAAME,GAAG;mBACVF,MAAMI,SAAS,GAAG;oBAAEA,WAAWJ,MAAMI,SAAS;gBAAC,IAAI,CAAC;gBAE1D,IAAIwB,OAAOf,OAAOI,SAAS,IAAI;YACjC,EAAE,OAAOQ,OAAO;gBACdC,QAAQD,KAAK,CAAC,wCAAwCzB,MAAME,GAAG,EAAEyB,QAAQF;gBACzEZ,OAAOK,MAAM,IAAI;YACnB;QACF;IACF;IACA,OAAOL;AACT;AAEA;;;CAGC,GACD,OAAO,eAAegB,wBACpB7B,KAA+D;IAE/D,MAAM,EAAEK,MAAM,EAAEK,UAAU,EAAE,GAAG,MAAMX,YAAYC;IACjD,MAAMY,QAAQ,MAAM1B;IACpB,MAAM2B,SAAgC;QACpCP,WAAWD,OAAOS,MAAM;QACxBJ;QACAK,SAAS;QACTC,YAAYJ,MAAME,MAAM;QACxBG,WAAW;QACXC,QAAQ;IACV;IACA,IAAI;YAGelB;QAFjBa,OAAOE,OAAO,GAAG,MAAMnC,8BAA8B;YACnDsB,KAAKF,MAAME,GAAG;YACd4B,aAAa,GAAE9B,uBAAAA,MAAM8B,aAAa,YAAnB9B,uBAAuB;WAClCA,MAAMI,SAAS,GAAG;YAAEA,WAAWJ,MAAMI,SAAS;QAAC,IAAI,CAAC;IAE5D,EAAE,OAAOqB,OAAO;QACdC,QAAQD,KAAK,CAAC,0CAA0CzB,MAAME,GAAG,EAAEuB;QACnEZ,OAAOK,MAAM,IAAI;IACnB;IACA,KAAK,MAAMC,SAASd,OAAQ;QAC1B,KAAK,MAAMsB,UAAUf,MAAO;YAC1B,IAAI;gBACF,MAAMmB,UAAU,MAAMlD,8BAA8B;oBAClD8C;oBACAR;oBACAjB,KAAKF,MAAME,GAAG;mBACVF,MAAMI,SAAS,GAAG;oBAAEA,WAAWJ,MAAMI,SAAS;gBAAC,IAAI,CAAC;gBAE1D,IAAI2B,SAASlB,OAAOI,SAAS,IAAI;YACnC,EAAE,OAAOQ,OAAO;gBACdC,QAAQD,KAAK,CAAC,4CAA4CzB,MAAME,GAAG,EAAEyB,QAAQF;gBAC7EZ,OAAOK,MAAM,IAAI;YACnB;QACF;IACF;IACA,OAAOL;AACT"}

package/src/lib/server/account-mail.d.ts

@@ -0,0 +1,41 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * WHETHER AUTOMATED PLATFORM MAIL TO ONE ACCOUNT IS WITHHELD (AGL-3418).
+ *
+ * True for an account under an active user lock (`lockdowns/user--{uid}`)
+ * or whose Auth record is disabled. Such an account cannot sign in to act on
+ * a usage alert, a digest or a notification, and for a risk lock the mail is
+ * worse than useless: it keeps a suspected bad actor informed about the
+ * workspace it was locked out of.
+ *
+ * Discretionary mail only. The lock and unlock notices, security alerts,
+ * password and verification mail, erasure confirmations and receipts do not
+ * ask this, and must not — they are how the person learns what happened.
+ *
+ * Pass `authDisabled` when the caller already holds the Auth record, to skip
+ * the pool lookup. A lookup that fails reads as "not disabled": the lock
+ * record is the authoritative signal, and an outage must not silence mail.
+ */
+export declare function isAccountMailWithheld(uid: string | null | undefined, options?: {
+    authDisabled?: boolean;
+}): Promise<boolean>;
+/**
+ * `uids` minus every account {@link isAccountMailWithheld} withholds, in
+ * the order given. The checks run concurrently.
+ */
+export declare function withoutMailWithheldAccounts(uids: readonly string[]): Promise<string[]>;

package/src/lib/server/account-mail.js

@@ -0,0 +1,52 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { isLockdownActive } from "@aglyn/aglyn/server";
+import { findUserByUidAcrossPools } from "./auth-pools.js";
+import { getUserLockdown } from "./lockdown.js";
+/**
+ * WHETHER AUTOMATED PLATFORM MAIL TO ONE ACCOUNT IS WITHHELD (AGL-3418).
+ *
+ * True for an account under an active user lock (`lockdowns/user--{uid}`)
+ * or whose Auth record is disabled. Such an account cannot sign in to act on
+ * a usage alert, a digest or a notification, and for a risk lock the mail is
+ * worse than useless: it keeps a suspected bad actor informed about the
+ * workspace it was locked out of.
+ *
+ * Discretionary mail only. The lock and unlock notices, security alerts,
+ * password and verification mail, erasure confirmations and receipts do not
+ * ask this, and must not — they are how the person learns what happened.
+ *
+ * Pass `authDisabled` when the caller already holds the Auth record, to skip
+ * the pool lookup. A lookup that fails reads as "not disabled": the lock
+ * record is the authoritative signal, and an outage must not silence mail.
+ */ export async function isAccountMailWithheld(uid, options = {}) {
+    var _pooled_record;
+    if (!uid) return false;
+    if (options.authDisabled) return true;
+    if (isLockdownActive(await getUserLockdown(uid), Date.now())) return true;
+    if (options.authDisabled === false) return false;
+    const pooled = await findUserByUidAcrossPools(uid).catch(()=>null);
+    return (pooled == null ? void 0 : (_pooled_record = pooled.record) == null ? void 0 : _pooled_record.disabled) === true;
+}
+/**
+ * `uids` minus every account {@link isAccountMailWithheld} withholds, in
+ * the order given. The checks run concurrently.
+ */ export async function withoutMailWithheldAccounts(uids) {
+    const withheld = await Promise.all(uids.map((uid)=>isAccountMailWithheld(uid).catch(()=>false)));
+    return uids.filter((_, index)=>!withheld[index]);
+}
+
+//# sourceMappingURL=account-mail.js.map

package/src/lib/server/account-mail.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/account-mail.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { isLockdownActive } from '@aglyn/aglyn/server'\nimport { findUserByUidAcrossPools } from './auth-pools'\nimport { getUserLockdown } from './lockdown'\n\n/**\n * WHETHER AUTOMATED PLATFORM MAIL TO ONE ACCOUNT IS WITHHELD (AGL-3418).\n *\n * True for an account under an active user lock (`lockdowns/user--{uid}`)\n * or whose Auth record is disabled. Such an account cannot sign in to act on\n * a usage alert, a digest or a notification, and for a risk lock the mail is\n * worse than useless: it keeps a suspected bad actor informed about the\n * workspace it was locked out of.\n *\n * Discretionary mail only. The lock and unlock notices, security alerts,\n * password and verification mail, erasure confirmations and receipts do not\n * ask this, and must not — they are how the person learns what happened.\n *\n * Pass `authDisabled` when the caller already holds the Auth record, to skip\n * the pool lookup. A lookup that fails reads as \"not disabled\": the lock\n * record is the authoritative signal, and an outage must not silence mail.\n */\nexport async function isAccountMailWithheld(\n  uid: string | null | undefined,\n  options: { authDisabled?: boolean } = {},\n): Promise<boolean> {\n  if (!uid) return false\n  if (options.authDisabled) return true\n  if (isLockdownActive(await getUserLockdown(uid), Date.now())) return true\n  if (options.authDisabled === false) return false\n  const pooled = await findUserByUidAcrossPools(uid).catch(() => null)\n  return pooled?.record?.disabled === true\n}\n\n/**\n * `uids` minus every account {@link isAccountMailWithheld} withholds, in\n * the order given. The checks run concurrently.\n */\nexport async function withoutMailWithheldAccounts(\n  uids: readonly string[],\n): Promise<string[]> {\n  const withheld = await Promise.all(\n    uids.map((uid) => isAccountMailWithheld(uid).catch(() => false)),\n  )\n  return uids.filter((_, index) => !withheld[index])\n}\n"],"names":["isLockdownActive","findUserByUidAcrossPools","getUserLockdown","isAccountMailWithheld","uid","options","pooled","authDisabled","Date","now","catch","record","disabled","withoutMailWithheldAccounts","uids","withheld","Promise","all","map","filter","_","index"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,gBAAgB,QAAQ,sBAAqB;AACtD,SAASC,wBAAwB,QAAQ,kBAAc;AACvD,SAASC,eAAe,QAAQ,gBAAY;AAE5C;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,eAAeC,sBACpBC,GAA8B,EAC9BC,UAAsC,CAAC,CAAC;QAOjCC;IALP,IAAI,CAACF,KAAK,OAAO;IACjB,IAAIC,QAAQE,YAAY,EAAE,OAAO;IACjC,IAAIP,iBAAiB,MAAME,gBAAgBE,MAAMI,KAAKC,GAAG,KAAK,OAAO;IACrE,IAAIJ,QAAQE,YAAY,KAAK,OAAO,OAAO;IAC3C,MAAMD,SAAS,MAAML,yBAAyBG,KAAKM,KAAK,CAAC,IAAM;IAC/D,OAAOJ,CAAAA,2BAAAA,iBAAAA,OAAQK,MAAM,qBAAdL,eAAgBM,QAAQ,MAAK;AACtC;AAEA;;;CAGC,GACD,OAAO,eAAeC,4BACpBC,IAAuB;IAEvB,MAAMC,WAAW,MAAMC,QAAQC,GAAG,CAChCH,KAAKI,GAAG,CAAC,CAACd,MAAQD,sBAAsBC,KAAKM,KAAK,CAAC,IAAM;IAE3D,OAAOI,KAAKK,MAAM,CAAC,CAACC,GAAGC,QAAU,CAACN,QAAQ,CAACM,MAAM;AACnD"}

package/src/lib/server/email-deliverability.js

@@ -54,7 +54,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
 import { applyMailGatewayOutcome, assessEmailDeliverability, decidingDeliverabilityFinding, getEmailConfig, isDeliverabilityDomain, isMailDomainIntelFresh, isMailGatewayBlock, isSharedSendingDomain, mailGatewayLedgerKey, mailGatewayOfHost, mailGatewayStanding, mailDomainRefusesMail, MAIL_GATEWAY_DAILY_DELIVERY_CAP, mailGatewayDay, mailGatewayHolds, mailGatewayHoldSentence, MAIL_GATEWAY_LABELS, MAIL_GATEWAY_WINDOW_DAYS, normalizeDeliverabilityEmail, normalizeLedgerSendingDomain, readBounceText, readStoredMailDomainIntel, readStoredMailGatewayLedger, resolveMailDomain, scrubBounceDiagnostic, setEmailDeliverabilityPreflight, bareSenderAddress } from "@aglyn/shared-util-email";
 import { promises as dns } from "dns";
 import { isConclusiveDnsCode, lookupAddress, lookupMx } from "./dns-probe.js";
-import { suppressEmail } from "./email-suppression.js";
+import { accountBannedRecipients, suppressEmail } from "./email-suppression.js";
 import { firebaseAdmin } from "./firebase-admin.js";
 /** The platform MX cache, keyed by recipient domain. */ export const MAIL_DOMAINS_COLLECTION = 'mailDomains';
 /** The gateway ledger, at the top level and under an organization — see the module note. */ export const MAIL_GATEWAY_LEDGER_COLLECTION = 'mailGatewayLedger';
@@ -432,16 +432,31 @@ function ledgerPath(scope, key) {
  * reason; holds bulk mail behind a gateway that refused this sending domain
  * twice. The Resend path's ledger is keyed by the sending domain alone.
  */ export async function runEmailDeliverabilityPreflight(request, deps = {}) {
+    const answer = {
+        refused: [],
+        held: []
+    };
+    /*
+   * A BANNED ACCOUNT FIRST (AGL-3420), and for every purpose: after its ban
+   * notice it is sent nothing — no receipt, no reset, no site's mail —
+   * which is the one refusal on this path that transactional mail does not
+   * get past. Only a lock or lift notice says it is exempt.
+   */ const banned = request.accountBanExempt ? new Set() : await accountBannedRecipients(request.recipients, deps.firestore);
+    for (const email of banned){
+        answer.refused.push({
+            email,
+            code: 'account_banned',
+            reason: 'This address belongs to a closed account and is not sent mail.'
+        });
+    }
+    const recipients = request.recipients.filter((email)=>!banned.has(email));
+    if (!recipients.length) return answer;
     const verdicts = await readMailDeliverability({
-        emails: request.recipients,
+        emails: recipients,
         purpose: request.purpose,
         sendingDomain: request.sendingDomain,
         scope: null
     }, deps);
-    const answer = {
-        refused: [],
-        held: []
-    };
     for (const [email, verdict] of verdicts){
         const deciding = decidingDeliverabilityFinding(verdict);
         if (!deciding) continue;