@aglyn/tenant-data-admin 1.0.0-beta.217 → 1.0.0-beta.219

package/src/lib/server/email-unsubscribe-link.d.ts

@@ -39,9 +39,9 @@ export declare function unsubscribeLinkSecret(): string;
  * liked — a small forgery, and a completely gratuitous one, since the
  * campaign is already known at the moment the link is minted.
  */
-export declare function unsubscribeSignatureSubject(hostId: string, email: string, campaignId?: string, topicId?: string): string;
+export declare function unsubscribeSignatureSubject(hostId: string, email: string, sendId?: string, topicId?: string): string;
 /** HMAC for unsubscribe links; env-gated on the shared secret. */
-export declare function unsubscribeSignature(hostId: string, email: string, secret: string, campaignId?: string, topicId?: string): string;
+export declare function unsubscribeSignature(hostId: string, email: string, secret: string, sendId?: string, topicId?: string): string;
 /**
  * Whether a signature is this link's.
  *
@@ -60,7 +60,7 @@ export declare function unsubscribeSignature(hostId: string, email: string, secr
 export declare function unsubscribeSignatureMatches(args: {
     hostId: string;
     email: string;
-    campaignId?: string;
+    sendId?: string;
     signature: string;
     secret: string;
 }): boolean;
@@ -138,8 +138,11 @@ export declare function buildUnsubscribeUrl(input: {
     siteBase: string;
     hostId: string;
     email: string;
-    /** The campaign this link rides in, when there is one. */
-    campaignId?: string;
+    /**
+     * The bulk send this link rides in, when there is one (`cid`): the id of
+     * the send document an unsubscribe is counted against.
+     */
+    sendId?: string;
     /** The topic the message belonged to, when it belonged to one. */
     topicId?: string;
     /**

package/src/lib/server/email-unsubscribe-link.js

@@ -63,7 +63,7 @@
  * attribution anybody holding one valid link could point at any campaign they
  * liked — a small forgery, and a completely gratuitous one, since the
  * campaign is already known at the moment the link is minted.
- */ export function unsubscribeSignatureSubject(hostId, email, campaignId, topicId) {
+ */ export function unsubscribeSignatureSubject(hostId, email, sendId, topicId) {
     const address = String(email != null ? email : '').trim().toLowerCase();
     /*
    * A colon in either id is refused outright, because the forms are joined
@@ -77,15 +77,15 @@
    * four-part subject with an empty middle, which would make
    * `host:email::t` and a campaign id of `:t` the same string. The sender
    * always has a campaign, so this is a guard rather than a path.
-   */ const campaign = String(campaignId != null ? campaignId : '');
+   */ const campaign = String(sendId != null ? sendId : '');
     const topic = String(topicId != null ? topicId : '');
     if (campaign.includes(':') || topic.includes(':')) return '';
     if (topic && campaign) return `${hostId}:${address}:${campaign}:${topic}`;
     if (campaign) return `${hostId}:${address}:${campaign}`;
     return `${hostId}:${address}`;
 }
-/** HMAC for unsubscribe links; env-gated on the shared secret. */ export function unsubscribeSignature(hostId, email, secret, campaignId, topicId) {
-    const subject = unsubscribeSignatureSubject(hostId, email, campaignId, topicId);
+/** HMAC for unsubscribe links; env-gated on the shared secret. */ export function unsubscribeSignature(hostId, email, secret, sendId, topicId) {
+    const subject = unsubscribeSignatureSubject(hostId, email, sendId, topicId);
     // An unsignable subject yields no signature rather than a signature over the
     // empty string, which would verify for every caller that also passed one.
     if (!subject) return '';
@@ -106,7 +106,7 @@
  * is not a secret, both digests are fixed-width hex, and the call throws on a
  * mismatch rather than returning false.
  */ export function unsubscribeSignatureMatches(args) {
-    const expected = unsubscribeSignature(args.hostId, args.email, args.secret, args.campaignId || undefined);
+    const expected = unsubscribeSignature(args.hostId, args.email, args.secret, args.sendId || undefined);
     return expected.length === args.signature.length && timingSafeEqual(new Uint8Array(Buffer.from(expected)), new Uint8Array(Buffer.from(args.signature)));
 }
 /**
@@ -193,10 +193,10 @@
     const siteBase = String((_input_siteBase = input.siteBase) != null ? _input_siteBase : '').replace(/\/+$/, '');
     const address = String((_input_email = input.email) != null ? _input_email : '').trim().toLowerCase();
     if (!secret || !siteBase || !input.hostId || !address) return '';
-    const signature = unsubscribeSignature(input.hostId, address, secret, input.campaignId, input.topicId);
+    const signature = unsubscribeSignature(input.hostId, address, secret, input.sendId, input.topicId);
     if (!signature) return '';
     const route = input.surface === 'preferences' ? '/api/email/preferences' : '/api/email/unsubscribe';
-    return `${siteBase}${route}` + `?hostId=${encodeURIComponent(input.hostId)}` + `&email=${encodeURIComponent(address)}` + `&sig=${signature}` + (input.campaignId ? `&cid=${encodeURIComponent(input.campaignId)}` : '') + (input.topicId ? `&tid=${encodeURIComponent(input.topicId)}` : '');
+    return `${siteBase}${route}` + `?hostId=${encodeURIComponent(input.hostId)}` + `&email=${encodeURIComponent(address)}` + `&sig=${signature}` + (input.sendId ? `&cid=${encodeURIComponent(input.sendId)}` : '') + (input.topicId ? `&tid=${encodeURIComponent(input.topicId)}` : '');
 }
 /*==========================================
  * A SIGNED LINK OF A SENDER'S OWN (AGL-2981).

package/src/lib/server/email-unsubscribe-link.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/email-unsubscribe-link.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * THE UNSUBSCRIBE LINK — one signer, one URL shape, one verifier.\n *\n * A signed `/api/email/unsubscribe` URL was minted in exactly one place, the\n * campaign sender, and verified in another, the unsubscribe handler. Two\n * copies of an HMAC subject is a shape that only stays correct while nobody\n * adds a third caller — and the marketing gate is the third caller, so the\n * subject moved here and both existing sides now read it from one place.\n *\n * ## The address is lowercased in the subject AND in the URL\n *\n * This is the property that makes one derivation work rather than two that\n * agree by luck. The campaign sender lowercases every address far upstream,\n * so its links have always carried a lowercase address and its signature has\n * always covered one; the handler's verifier does not lowercase, and did not\n * need to. Marketing mail reaches addresses that no upstream step\n * normalized — a checkout's `customerEmail`, a form payload's `email` — so a\n * link minted over `Bob@Example.com` would sign the lowercase form and put\n * the mixed-case form on the URL, and the verifier would answer 403 to a\n * recipient pressing Unsubscribe.\n *\n * So {@link buildUnsubscribeUrl} writes the lowercased address into the query\n * as well as into the subject, and the two agree by construction rather than\n * by every caller remembering.\n */\n\nimport { createHmac, timingSafeEqual } from 'crypto'\n\n/**\n * The shared secret, or empty when the deployment has none.\n *\n * `CRON_SECRET` is the documented fallback, matching what the campaign sender\n * and the unsubscribe handler already resolve. Read per call rather than at\n * module load: these run in serverless handlers where the module may be\n * evaluated during a build, long before the runtime env exists.\n */\nexport function unsubscribeLinkSecret(): string {\n  return process.env.EMAIL_UNSUBSCRIBE_SECRET || process.env.CRON_SECRET || ''\n}\n\n/**\n * The signed subject for an unsubscribe link.\n *\n * ## Two signed forms, and why the campaign id is additive\n *\n * Every email already sitting in an inbox carries a two-part signature over\n * `hostId:email`, and those links must go on working forever — an unsubscribe\n * link that stops honoring itself is the one bug in this area with a legal\n * edge on it. So the campaign is appended only when it is present, and the\n * verifier chooses which form to check by whether the link carries a `cid`.\n *\n * SIGNED rather than passed alongside. An unsigned `cid` would be an\n * attribution anybody holding one valid link could point at any campaign they\n * liked — a small forgery, and a completely gratuitous one, since the\n * campaign is already known at the moment the link is minted.\n */\nexport function unsubscribeSignatureSubject(\n  hostId: string,\n  email: string,\n  campaignId?: string,\n  topicId?: string,\n): string {\n  const address = String(email ?? '')\n    .trim()\n    .toLowerCase()\n  /*\n   * A colon in either id is refused outright, because the forms are joined\n   * with one. A four-part `host:email:c:t` is byte-identical to a three-part\n   * subject whose campaign id is `c:t`, so one signature would verify two\n   * different parameter tuples and a topic link could be re-presented as a\n   * campaign link with the topic spliced in. It costs nothing real: ids come\n   * from `createResourceUid()`, whose alphabet has no colon.\n   *\n   * A topic with no campaign DROPS the topic rather than producing a\n   * four-part subject with an empty middle, which would make\n   * `host:email::t` and a campaign id of `:t` the same string. The sender\n   * always has a campaign, so this is a guard rather than a path.\n   */\n  const campaign = String(campaignId ?? '')\n  const topic = String(topicId ?? '')\n  if (campaign.includes(':') || topic.includes(':')) return ''\n  if (topic && campaign) return `${hostId}:${address}:${campaign}:${topic}`\n  if (campaign) return `${hostId}:${address}:${campaign}`\n  return `${hostId}:${address}`\n}\n\n/** HMAC for unsubscribe links; env-gated on the shared secret. */\nexport function unsubscribeSignature(\n  hostId: string,\n  email: string,\n  secret: string,\n  campaignId?: string,\n  topicId?: string,\n): string {\n  const subject = unsubscribeSignatureSubject(hostId, email, campaignId, topicId)\n  // An unsignable subject yields no signature rather than a signature over the\n  // empty string, which would verify for every caller that also passed one.\n  if (!subject) return ''\n  return createHmac('sha256', secret).update(subject).digest('hex')\n}\n\n/**\n * Whether a signature is this link's.\n *\n * Which form is checked is decided by the LINK, not by the signature: a link\n * carrying no `cid` is checked against the two-part form and a link carrying\n * one against the three-part form. There is no fallback between them, and\n * that is what stops this being a downgrade — an attacker cannot take a\n * three-part link, drop the `cid` and have it verify, because the two-part\n * check over the same `hostId:email` produces a different digest. Nor can\n * they bolt a `cid` onto a two-part link: the three-part check then fails.\n *\n * `timingSafeEqual` needs equal lengths, so the length is compared first — it\n * is not a secret, both digests are fixed-width hex, and the call throws on a\n * mismatch rather than returning false.\n */\nexport function unsubscribeSignatureMatches(args: {\n  hostId: string\n  email: string\n  campaignId?: string\n  signature: string\n  secret: string\n}): boolean {\n  const expected = unsubscribeSignature(\n    args.hostId,\n    args.email,\n    args.secret,\n    args.campaignId || undefined,\n  )\n  return (\n    expected.length === args.signature.length &&\n    timingSafeEqual(\n      new Uint8Array(Buffer.from(expected)),\n      new Uint8Array(Buffer.from(args.signature)),\n    )\n  )\n}\n\n/**\n * The purpose component that distinguishes a CONFIRMATION subject.\n *\n * See {@link confirmSignatureSubject}. Exported because the plugin's verifier\n * imports it rather than restating the literal.\n */\nexport const CONFIRM_SUBJECT_PREFIX = 'confirm'\n\n/**\n * The signed subject for a double opt-in confirmation link.\n *\n * ## Why it is not one of the three forms above\n *\n * A confirmation names a host, an address and a topic, and it has NO\n * campaign — nobody is unsubscribing from a message, they are joining a\n * stream. The forms above refuse exactly that combination: a topic with no\n * campaign would leave an empty middle component, and `host:email::t` is the\n * same string as a three-part subject whose campaign id is `:t`.\n *\n * So it gets a leading PURPOSE component. That is a fourth form of the same\n * scheme, not a second scheme: the digest, the secret and the comparison are\n * unchanged.\n *\n * ## The one collision, and the guard for it\n *\n * `confirm:H:E:T` is byte-identical to the four-part unsubscribe subject\n * `A:B:C:D` when the site's id is literally `confirm`, which would let one\n * signature verify as both. Ids are not ours to constrain after the fact, so\n * the subject is refused for that host rather than the collision being\n * reasoned about: the cost is one unusable document id, and the alternative\n * is a signature that means two things.\n *\n * @returns the subject, or `''` for a combination it cannot sign\n *          unambiguously. Empty rather than a partial subject, so\n *          {@link confirmSignature} yields no signature rather than one over\n *          the empty string — which would verify for every other caller that\n *          also produced one.\n */\nexport function confirmSignatureSubject(\n  hostId: string,\n  email: string,\n  topicId: string,\n): string {\n  const address = String(email ?? '')\n    .trim()\n    .toLowerCase()\n  const host = String(hostId ?? '')\n  const topic = String(topicId ?? '')\n  if (!host || !address || !topic) return ''\n  if (host === CONFIRM_SUBJECT_PREFIX) return ''\n  if (host.includes(':') || topic.includes(':')) return ''\n  return `${CONFIRM_SUBJECT_PREFIX}:${host}:${address}:${topic}`\n}\n\n/** HMAC for a confirmation link; empty for an unsignable subject. */\nexport function confirmSignature(\n  hostId: string,\n  email: string,\n  topicId: string,\n  secret: string,\n): string {\n  const subject = confirmSignatureSubject(hostId, email, topicId)\n  if (!subject || !secret) return ''\n  return createHmac('sha256', secret).update(subject).digest('hex')\n}\n\n/**\n * The absolute confirmation URL for one address and one topic.\n *\n * Minted where the signup happens, because the message carrying it is sent\n * from there — and that message is TRANSACTIONAL, not marketing: the person\n * just asked for this, so asking them to confirm it is the transaction they\n * started. It carries no unsubscribe header for the same reason a receipt\n * does not.\n *\n * Empty when there is no secret or no origin, for the reason\n * {@link buildUnsubscribeUrl} gives: a link pointing at nothing is worse than\n * no link, because the recipient believes they have confirmed.\n */\nexport function buildConfirmUrl(input: {\n  siteBase: string\n  hostId: string\n  email: string\n  topicId: string\n  /** Defaults to {@link unsubscribeLinkSecret} — the same signing secret. */\n  secret?: string\n}): string {\n  const secret = input.secret ?? unsubscribeLinkSecret()\n  const siteBase = String(input.siteBase ?? '').replace(/\\/+$/, '')\n  const address = String(input.email ?? '')\n    .trim()\n    .toLowerCase()\n  const signature = confirmSignature(\n    input.hostId,\n    address,\n    input.topicId,\n    secret,\n  )\n  if (!siteBase || !signature) return ''\n  return (\n    `${siteBase}/api/email/confirm` +\n    `?hostId=${encodeURIComponent(input.hostId)}` +\n    `&email=${encodeURIComponent(address)}` +\n    `&tid=${encodeURIComponent(input.topicId)}` +\n    `&sig=${signature}`\n  )\n}\n\n/**\n * The absolute unsubscribe URL for one recipient of one site's mail.\n *\n * @returns the URL, or empty string when there is no secret to sign with or\n *          no origin to resolve against. Empty rather than a half-built URL:\n *          a caller can tell it does not have a link, and a link pointing at\n *          nothing is worse than an absent header, because the recipient\n *          believes they have unsubscribed.\n */\nexport function buildUnsubscribeUrl(input: {\n  siteBase: string\n  hostId: string\n  email: string\n  /** The campaign this link rides in, when there is one. */\n  campaignId?: string\n  /** The topic the message belonged to, when it belonged to one. */\n  topicId?: string\n  /**\n   * Which of the two URLs over this one signature to build.\n   *\n   * `one-click` is what the `List-Unsubscribe` header names: a mailbox\n   * provider POSTs it with no human present and expects the act to have\n   * happened when it reads the 200, so it points at the route whose POST\n   * writes immediately and must never point at a page somebody has to submit.\n   * `preferences` is the link a PERSON clicks in the footer, where the topic\n   * this message belonged to is one of the things they can stop instead of\n   * all of it. Defaults to `one-click`, which is what a sender with no topic\n   * — every non-campaign marketing path — wants.\n   */\n  surface?: 'one-click' | 'preferences'\n  /** Defaults to {@link unsubscribeLinkSecret}. */\n  secret?: string\n}): string {\n  const secret = input.secret ?? unsubscribeLinkSecret()\n  const siteBase = String(input.siteBase ?? '').replace(/\\/+$/, '')\n  const address = String(input.email ?? '')\n    .trim()\n    .toLowerCase()\n  if (!secret || !siteBase || !input.hostId || !address) return ''\n  const signature = unsubscribeSignature(\n    input.hostId,\n    address,\n    secret,\n    input.campaignId,\n    input.topicId,\n  )\n  if (!signature) return ''\n  const route =\n    input.surface === 'preferences'\n      ? '/api/email/preferences'\n      : '/api/email/unsubscribe'\n  return (\n    `${siteBase}${route}` +\n    `?hostId=${encodeURIComponent(input.hostId)}` +\n    `&email=${encodeURIComponent(address)}` +\n    `&sig=${signature}` +\n    (input.campaignId ? `&cid=${encodeURIComponent(input.campaignId)}` : '') +\n    (input.topicId ? `&tid=${encodeURIComponent(input.topicId)}` : '')\n  )\n}\n\n/*==========================================\n * A SIGNED LINK OF A SENDER'S OWN (AGL-2981).\n *\n * The forms above are the platform's own unsubscribe and confirmation\n * links, each a subject over a site and an address. A sender that mails\n * from somewhere else — a plugin sending from a person's own mailbox, whose\n * link carries its own facts — signs its link here instead, over a payload\n * of its own and under a PURPOSE of its own.\n *\n * The purpose is not a prefix of the subject, which is how the confirmation\n * form had to guard a collision by hand. It selects the KEY: every purpose's\n * links are signed with an HMAC key derived from the shared secret and the\n * purpose, so a signature minted for one purpose verifies for no other and\n * for none of the platform's own forms above, whatever the payloads spell.\n * The secret, the digest and the constant-time comparison are the same.\n *==========================================*/\n\n/** The key one purpose's links are signed with: derived from the secret, bound to the purpose. */\nfunction signedLinkKey(purpose: string, secret: string): Buffer {\n  return createHmac('sha256', secret).update(`aglyn-signed-link:${purpose}`).digest()\n}\n\n/**\n * The signature of a payload for one purpose, base64url — or `''` when there\n * is no secret, no purpose or no payload to sign, so a caller can tell it has\n * no link rather than one that verifies for anybody.\n */\nexport function signedLinkSignature(\n  purpose: string,\n  payload: string,\n  secret: string = unsubscribeLinkSecret(),\n): string {\n  const name = String(purpose ?? '').trim()\n  const body = String(payload ?? '')\n  if (!secret || !name || !body) return ''\n  return createHmac('sha256', signedLinkKey(name, secret)).update(body).digest('base64url')\n}\n\n/** Whether a signature is this payload's, for this purpose, in constant time. */\nexport function signedLinkSignatureMatches(args: {\n  purpose: string\n  payload: string\n  signature: string\n  /** Defaults to {@link unsubscribeLinkSecret}. */\n  secret?: string\n}): boolean {\n  const expected = signedLinkSignature(args.purpose, args.payload, args.secret ?? unsubscribeLinkSecret())\n  const presented = String(args.signature ?? '')\n  return (\n    expected.length > 0 &&\n    expected.length === presented.length &&\n    timingSafeEqual(new Uint8Array(Buffer.from(expected)), new Uint8Array(Buffer.from(presented)))\n  )\n}\n"],"names":["createHmac","timingSafeEqual","unsubscribeLinkSecret","process","env","EMAIL_UNSUBSCRIBE_SECRET","CRON_SECRET","unsubscribeSignatureSubject","hostId","email","campaignId","topicId","address","String","trim","toLowerCase","campaign","topic","includes","unsubscribeSignature","secret","subject","update","digest","unsubscribeSignatureMatches","args","expected","undefined","length","signature","Uint8Array","Buffer","from","CONFIRM_SUBJECT_PREFIX","confirmSignatureSubject","host","confirmSignature","buildConfirmUrl","input","siteBase","replace","encodeURIComponent","buildUnsubscribeUrl","route","surface","signedLinkKey","purpose","signedLinkSignature","payload","name","body","signedLinkSignatureMatches","presented"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GAED,SAASA,UAAU,EAAEC,eAAe,QAAQ,SAAQ;AAEpD;;;;;;;CAOC,GACD,OAAO,SAASC;IACd,OAAOC,QAAQC,GAAG,CAACC,wBAAwB,IAAIF,QAAQC,GAAG,CAACE,WAAW,IAAI;AAC5E;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASC,4BACdC,MAAc,EACdC,KAAa,EACbC,UAAmB,EACnBC,OAAgB;IAEhB,MAAMC,UAAUC,OAAOJ,gBAAAA,QAAS,IAC7BK,IAAI,GACJC,WAAW;IACd;;;;;;;;;;;;GAYC,GACD,MAAMC,WAAWH,OAAOH,qBAAAA,aAAc;IACtC,MAAMO,QAAQJ,OAAOF,kBAAAA,UAAW;IAChC,IAAIK,SAASE,QAAQ,CAAC,QAAQD,MAAMC,QAAQ,CAAC,MAAM,OAAO;IAC1D,IAAID,SAASD,UAAU,OAAO,GAAGR,OAAO,CAAC,EAAEI,QAAQ,CAAC,EAAEI,SAAS,CAAC,EAAEC,OAAO;IACzE,IAAID,UAAU,OAAO,GAAGR,OAAO,CAAC,EAAEI,QAAQ,CAAC,EAAEI,UAAU;IACvD,OAAO,GAAGR,OAAO,CAAC,EAAEI,SAAS;AAC/B;AAEA,gEAAgE,GAChE,OAAO,SAASO,qBACdX,MAAc,EACdC,KAAa,EACbW,MAAc,EACdV,UAAmB,EACnBC,OAAgB;IAEhB,MAAMU,UAAUd,4BAA4BC,QAAQC,OAAOC,YAAYC;IACvE,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,CAACU,SAAS,OAAO;IACrB,OAAOrB,WAAW,UAAUoB,QAAQE,MAAM,CAACD,SAASE,MAAM,CAAC;AAC7D;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASC,4BAA4BC,IAM3C;IACC,MAAMC,WAAWP,qBACfM,KAAKjB,MAAM,EACXiB,KAAKhB,KAAK,EACVgB,KAAKL,MAAM,EACXK,KAAKf,UAAU,IAAIiB;IAErB,OACED,SAASE,MAAM,KAAKH,KAAKI,SAAS,CAACD,MAAM,IACzC3B,gBACE,IAAI6B,WAAWC,OAAOC,IAAI,CAACN,YAC3B,IAAII,WAAWC,OAAOC,IAAI,CAACP,KAAKI,SAAS;AAG/C;AAEA;;;;;CAKC,GACD,OAAO,MAAMI,yBAAyB,UAAS;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BC,GACD,OAAO,SAASC,wBACd1B,MAAc,EACdC,KAAa,EACbE,OAAe;IAEf,MAAMC,UAAUC,OAAOJ,gBAAAA,QAAS,IAC7BK,IAAI,GACJC,WAAW;IACd,MAAMoB,OAAOtB,OAAOL,iBAAAA,SAAU;IAC9B,MAAMS,QAAQJ,OAAOF,kBAAAA,UAAW;IAChC,IAAI,CAACwB,QAAQ,CAACvB,WAAW,CAACK,OAAO,OAAO;IACxC,IAAIkB,SAASF,wBAAwB,OAAO;IAC5C,IAAIE,KAAKjB,QAAQ,CAAC,QAAQD,MAAMC,QAAQ,CAAC,MAAM,OAAO;IACtD,OAAO,GAAGe,uBAAuB,CAAC,EAAEE,KAAK,CAAC,EAAEvB,QAAQ,CAAC,EAAEK,OAAO;AAChE;AAEA,mEAAmE,GACnE,OAAO,SAASmB,iBACd5B,MAAc,EACdC,KAAa,EACbE,OAAe,EACfS,MAAc;IAEd,MAAMC,UAAUa,wBAAwB1B,QAAQC,OAAOE;IACvD,IAAI,CAACU,WAAW,CAACD,QAAQ,OAAO;IAChC,OAAOpB,WAAW,UAAUoB,QAAQE,MAAM,CAACD,SAASE,MAAM,CAAC;AAC7D;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,SAASc,gBAAgBC,KAO/B;QACgBA,eACSA,iBACDA;IAFvB,MAAMlB,UAASkB,gBAAAA,MAAMlB,MAAM,YAAZkB,gBAAgBpC;IAC/B,MAAMqC,WAAW1B,QAAOyB,kBAAAA,MAAMC,QAAQ,YAAdD,kBAAkB,IAAIE,OAAO,CAAC,QAAQ;IAC9D,MAAM5B,UAAUC,QAAOyB,eAAAA,MAAM7B,KAAK,YAAX6B,eAAe,IACnCxB,IAAI,GACJC,WAAW;IACd,MAAMc,YAAYO,iBAChBE,MAAM9B,MAAM,EACZI,SACA0B,MAAM3B,OAAO,EACbS;IAEF,IAAI,CAACmB,YAAY,CAACV,WAAW,OAAO;IACpC,OACE,GAAGU,SAAS,kBAAkB,CAAC,GAC/B,CAAC,QAAQ,EAAEE,mBAAmBH,MAAM9B,MAAM,GAAG,GAC7C,CAAC,OAAO,EAAEiC,mBAAmB7B,UAAU,GACvC,CAAC,KAAK,EAAE6B,mBAAmBH,MAAM3B,OAAO,GAAG,GAC3C,CAAC,KAAK,EAAEkB,WAAW;AAEvB;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASa,oBAAoBJ,KAuBnC;QACgBA,eACSA,iBACDA;IAFvB,MAAMlB,UAASkB,gBAAAA,MAAMlB,MAAM,YAAZkB,gBAAgBpC;IAC/B,MAAMqC,WAAW1B,QAAOyB,kBAAAA,MAAMC,QAAQ,YAAdD,kBAAkB,IAAIE,OAAO,CAAC,QAAQ;IAC9D,MAAM5B,UAAUC,QAAOyB,eAAAA,MAAM7B,KAAK,YAAX6B,eAAe,IACnCxB,IAAI,GACJC,WAAW;IACd,IAAI,CAACK,UAAU,CAACmB,YAAY,CAACD,MAAM9B,MAAM,IAAI,CAACI,SAAS,OAAO;IAC9D,MAAMiB,YAAYV,qBAChBmB,MAAM9B,MAAM,EACZI,SACAQ,QACAkB,MAAM5B,UAAU,EAChB4B,MAAM3B,OAAO;IAEf,IAAI,CAACkB,WAAW,OAAO;IACvB,MAAMc,QACJL,MAAMM,OAAO,KAAK,gBACd,2BACA;IACN,OACE,GAAGL,WAAWI,OAAO,GACrB,CAAC,QAAQ,EAAEF,mBAAmBH,MAAM9B,MAAM,GAAG,GAC7C,CAAC,OAAO,EAAEiC,mBAAmB7B,UAAU,GACvC,CAAC,KAAK,EAAEiB,WAAW,GAClBS,CAAAA,MAAM5B,UAAU,GAAG,CAAC,KAAK,EAAE+B,mBAAmBH,MAAM5B,UAAU,GAAG,GAAG,EAAC,IACrE4B,CAAAA,MAAM3B,OAAO,GAAG,CAAC,KAAK,EAAE8B,mBAAmBH,MAAM3B,OAAO,GAAG,GAAG,EAAC;AAEpE;AAEA;;;;;;;;;;;;;;;4CAe4C,GAE5C,gGAAgG,GAChG,SAASkC,cAAcC,OAAe,EAAE1B,MAAc;IACpD,OAAOpB,WAAW,UAAUoB,QAAQE,MAAM,CAAC,CAAC,kBAAkB,EAAEwB,SAAS,EAAEvB,MAAM;AACnF;AAEA;;;;CAIC,GACD,OAAO,SAASwB,oBACdD,OAAe,EACfE,OAAe,EACf5B,SAAiBlB,uBAAuB;IAExC,MAAM+C,OAAOpC,OAAOiC,kBAAAA,UAAW,IAAIhC,IAAI;IACvC,MAAMoC,OAAOrC,OAAOmC,kBAAAA,UAAW;IAC/B,IAAI,CAAC5B,UAAU,CAAC6B,QAAQ,CAACC,MAAM,OAAO;IACtC,OAAOlD,WAAW,UAAU6C,cAAcI,MAAM7B,SAASE,MAAM,CAAC4B,MAAM3B,MAAM,CAAC;AAC/E;AAEA,+EAA+E,GAC/E,OAAO,SAAS4B,2BAA2B1B,IAM1C;QACkEA,cACxCA;IADzB,MAAMC,WAAWqB,oBAAoBtB,KAAKqB,OAAO,EAAErB,KAAKuB,OAAO,GAAEvB,eAAAA,KAAKL,MAAM,YAAXK,eAAevB;IAChF,MAAMkD,YAAYvC,QAAOY,kBAAAA,KAAKI,SAAS,YAAdJ,kBAAkB;IAC3C,OACEC,SAASE,MAAM,GAAG,KAClBF,SAASE,MAAM,KAAKwB,UAAUxB,MAAM,IACpC3B,gBAAgB,IAAI6B,WAAWC,OAAOC,IAAI,CAACN,YAAY,IAAII,WAAWC,OAAOC,IAAI,CAACoB;AAEtF"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/email-unsubscribe-link.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * THE UNSUBSCRIBE LINK — one signer, one URL shape, one verifier.\n *\n * A signed `/api/email/unsubscribe` URL was minted in exactly one place, the\n * campaign sender, and verified in another, the unsubscribe handler. Two\n * copies of an HMAC subject is a shape that only stays correct while nobody\n * adds a third caller — and the marketing gate is the third caller, so the\n * subject moved here and both existing sides now read it from one place.\n *\n * ## The address is lowercased in the subject AND in the URL\n *\n * This is the property that makes one derivation work rather than two that\n * agree by luck. The campaign sender lowercases every address far upstream,\n * so its links have always carried a lowercase address and its signature has\n * always covered one; the handler's verifier does not lowercase, and did not\n * need to. Marketing mail reaches addresses that no upstream step\n * normalized — a checkout's `customerEmail`, a form payload's `email` — so a\n * link minted over `Bob@Example.com` would sign the lowercase form and put\n * the mixed-case form on the URL, and the verifier would answer 403 to a\n * recipient pressing Unsubscribe.\n *\n * So {@link buildUnsubscribeUrl} writes the lowercased address into the query\n * as well as into the subject, and the two agree by construction rather than\n * by every caller remembering.\n */\n\nimport { createHmac, timingSafeEqual } from 'crypto'\n\n/**\n * The shared secret, or empty when the deployment has none.\n *\n * `CRON_SECRET` is the documented fallback, matching what the campaign sender\n * and the unsubscribe handler already resolve. Read per call rather than at\n * module load: these run in serverless handlers where the module may be\n * evaluated during a build, long before the runtime env exists.\n */\nexport function unsubscribeLinkSecret(): string {\n  return process.env.EMAIL_UNSUBSCRIBE_SECRET || process.env.CRON_SECRET || ''\n}\n\n/**\n * The signed subject for an unsubscribe link.\n *\n * ## Two signed forms, and why the campaign id is additive\n *\n * Every email already sitting in an inbox carries a two-part signature over\n * `hostId:email`, and those links must go on working forever — an unsubscribe\n * link that stops honoring itself is the one bug in this area with a legal\n * edge on it. So the campaign is appended only when it is present, and the\n * verifier chooses which form to check by whether the link carries a `cid`.\n *\n * SIGNED rather than passed alongside. An unsigned `cid` would be an\n * attribution anybody holding one valid link could point at any campaign they\n * liked — a small forgery, and a completely gratuitous one, since the\n * campaign is already known at the moment the link is minted.\n */\nexport function unsubscribeSignatureSubject(\n  hostId: string,\n  email: string,\n  sendId?: string,\n  topicId?: string,\n): string {\n  const address = String(email ?? '')\n    .trim()\n    .toLowerCase()\n  /*\n   * A colon in either id is refused outright, because the forms are joined\n   * with one. A four-part `host:email:c:t` is byte-identical to a three-part\n   * subject whose campaign id is `c:t`, so one signature would verify two\n   * different parameter tuples and a topic link could be re-presented as a\n   * campaign link with the topic spliced in. It costs nothing real: ids come\n   * from `createResourceUid()`, whose alphabet has no colon.\n   *\n   * A topic with no campaign DROPS the topic rather than producing a\n   * four-part subject with an empty middle, which would make\n   * `host:email::t` and a campaign id of `:t` the same string. The sender\n   * always has a campaign, so this is a guard rather than a path.\n   */\n  const campaign = String(sendId ?? '')\n  const topic = String(topicId ?? '')\n  if (campaign.includes(':') || topic.includes(':')) return ''\n  if (topic && campaign) return `${hostId}:${address}:${campaign}:${topic}`\n  if (campaign) return `${hostId}:${address}:${campaign}`\n  return `${hostId}:${address}`\n}\n\n/** HMAC for unsubscribe links; env-gated on the shared secret. */\nexport function unsubscribeSignature(\n  hostId: string,\n  email: string,\n  secret: string,\n  sendId?: string,\n  topicId?: string,\n): string {\n  const subject = unsubscribeSignatureSubject(hostId, email, sendId, topicId)\n  // An unsignable subject yields no signature rather than a signature over the\n  // empty string, which would verify for every caller that also passed one.\n  if (!subject) return ''\n  return createHmac('sha256', secret).update(subject).digest('hex')\n}\n\n/**\n * Whether a signature is this link's.\n *\n * Which form is checked is decided by the LINK, not by the signature: a link\n * carrying no `cid` is checked against the two-part form and a link carrying\n * one against the three-part form. There is no fallback between them, and\n * that is what stops this being a downgrade — an attacker cannot take a\n * three-part link, drop the `cid` and have it verify, because the two-part\n * check over the same `hostId:email` produces a different digest. Nor can\n * they bolt a `cid` onto a two-part link: the three-part check then fails.\n *\n * `timingSafeEqual` needs equal lengths, so the length is compared first — it\n * is not a secret, both digests are fixed-width hex, and the call throws on a\n * mismatch rather than returning false.\n */\nexport function unsubscribeSignatureMatches(args: {\n  hostId: string\n  email: string\n  sendId?: string\n  signature: string\n  secret: string\n}): boolean {\n  const expected = unsubscribeSignature(\n    args.hostId,\n    args.email,\n    args.secret,\n    args.sendId || undefined,\n  )\n  return (\n    expected.length === args.signature.length &&\n    timingSafeEqual(\n      new Uint8Array(Buffer.from(expected)),\n      new Uint8Array(Buffer.from(args.signature)),\n    )\n  )\n}\n\n/**\n * The purpose component that distinguishes a CONFIRMATION subject.\n *\n * See {@link confirmSignatureSubject}. Exported because the plugin's verifier\n * imports it rather than restating the literal.\n */\nexport const CONFIRM_SUBJECT_PREFIX = 'confirm'\n\n/**\n * The signed subject for a double opt-in confirmation link.\n *\n * ## Why it is not one of the three forms above\n *\n * A confirmation names a host, an address and a topic, and it has NO\n * campaign — nobody is unsubscribing from a message, they are joining a\n * stream. The forms above refuse exactly that combination: a topic with no\n * campaign would leave an empty middle component, and `host:email::t` is the\n * same string as a three-part subject whose campaign id is `:t`.\n *\n * So it gets a leading PURPOSE component. That is a fourth form of the same\n * scheme, not a second scheme: the digest, the secret and the comparison are\n * unchanged.\n *\n * ## The one collision, and the guard for it\n *\n * `confirm:H:E:T` is byte-identical to the four-part unsubscribe subject\n * `A:B:C:D` when the site's id is literally `confirm`, which would let one\n * signature verify as both. Ids are not ours to constrain after the fact, so\n * the subject is refused for that host rather than the collision being\n * reasoned about: the cost is one unusable document id, and the alternative\n * is a signature that means two things.\n *\n * @returns the subject, or `''` for a combination it cannot sign\n *          unambiguously. Empty rather than a partial subject, so\n *          {@link confirmSignature} yields no signature rather than one over\n *          the empty string — which would verify for every other caller that\n *          also produced one.\n */\nexport function confirmSignatureSubject(\n  hostId: string,\n  email: string,\n  topicId: string,\n): string {\n  const address = String(email ?? '')\n    .trim()\n    .toLowerCase()\n  const host = String(hostId ?? '')\n  const topic = String(topicId ?? '')\n  if (!host || !address || !topic) return ''\n  if (host === CONFIRM_SUBJECT_PREFIX) return ''\n  if (host.includes(':') || topic.includes(':')) return ''\n  return `${CONFIRM_SUBJECT_PREFIX}:${host}:${address}:${topic}`\n}\n\n/** HMAC for a confirmation link; empty for an unsignable subject. */\nexport function confirmSignature(\n  hostId: string,\n  email: string,\n  topicId: string,\n  secret: string,\n): string {\n  const subject = confirmSignatureSubject(hostId, email, topicId)\n  if (!subject || !secret) return ''\n  return createHmac('sha256', secret).update(subject).digest('hex')\n}\n\n/**\n * The absolute confirmation URL for one address and one topic.\n *\n * Minted where the signup happens, because the message carrying it is sent\n * from there — and that message is TRANSACTIONAL, not marketing: the person\n * just asked for this, so asking them to confirm it is the transaction they\n * started. It carries no unsubscribe header for the same reason a receipt\n * does not.\n *\n * Empty when there is no secret or no origin, for the reason\n * {@link buildUnsubscribeUrl} gives: a link pointing at nothing is worse than\n * no link, because the recipient believes they have confirmed.\n */\nexport function buildConfirmUrl(input: {\n  siteBase: string\n  hostId: string\n  email: string\n  topicId: string\n  /** Defaults to {@link unsubscribeLinkSecret} — the same signing secret. */\n  secret?: string\n}): string {\n  const secret = input.secret ?? unsubscribeLinkSecret()\n  const siteBase = String(input.siteBase ?? '').replace(/\\/+$/, '')\n  const address = String(input.email ?? '')\n    .trim()\n    .toLowerCase()\n  const signature = confirmSignature(\n    input.hostId,\n    address,\n    input.topicId,\n    secret,\n  )\n  if (!siteBase || !signature) return ''\n  return (\n    `${siteBase}/api/email/confirm` +\n    `?hostId=${encodeURIComponent(input.hostId)}` +\n    `&email=${encodeURIComponent(address)}` +\n    `&tid=${encodeURIComponent(input.topicId)}` +\n    `&sig=${signature}`\n  )\n}\n\n/**\n * The absolute unsubscribe URL for one recipient of one site's mail.\n *\n * @returns the URL, or empty string when there is no secret to sign with or\n *          no origin to resolve against. Empty rather than a half-built URL:\n *          a caller can tell it does not have a link, and a link pointing at\n *          nothing is worse than an absent header, because the recipient\n *          believes they have unsubscribed.\n */\nexport function buildUnsubscribeUrl(input: {\n  siteBase: string\n  hostId: string\n  email: string\n  /**\n   * The bulk send this link rides in, when there is one (`cid`): the id of\n   * the send document an unsubscribe is counted against.\n   */\n  sendId?: string\n  /** The topic the message belonged to, when it belonged to one. */\n  topicId?: string\n  /**\n   * Which of the two URLs over this one signature to build.\n   *\n   * `one-click` is what the `List-Unsubscribe` header names: a mailbox\n   * provider POSTs it with no human present and expects the act to have\n   * happened when it reads the 200, so it points at the route whose POST\n   * writes immediately and must never point at a page somebody has to submit.\n   * `preferences` is the link a PERSON clicks in the footer, where the topic\n   * this message belonged to is one of the things they can stop instead of\n   * all of it. Defaults to `one-click`, which is what a sender with no topic\n   * — every non-campaign marketing path — wants.\n   */\n  surface?: 'one-click' | 'preferences'\n  /** Defaults to {@link unsubscribeLinkSecret}. */\n  secret?: string\n}): string {\n  const secret = input.secret ?? unsubscribeLinkSecret()\n  const siteBase = String(input.siteBase ?? '').replace(/\\/+$/, '')\n  const address = String(input.email ?? '')\n    .trim()\n    .toLowerCase()\n  if (!secret || !siteBase || !input.hostId || !address) return ''\n  const signature = unsubscribeSignature(\n    input.hostId,\n    address,\n    secret,\n    input.sendId,\n    input.topicId,\n  )\n  if (!signature) return ''\n  const route =\n    input.surface === 'preferences'\n      ? '/api/email/preferences'\n      : '/api/email/unsubscribe'\n  return (\n    `${siteBase}${route}` +\n    `?hostId=${encodeURIComponent(input.hostId)}` +\n    `&email=${encodeURIComponent(address)}` +\n    `&sig=${signature}` +\n    (input.sendId ? `&cid=${encodeURIComponent(input.sendId)}` : '') +\n    (input.topicId ? `&tid=${encodeURIComponent(input.topicId)}` : '')\n  )\n}\n\n/*==========================================\n * A SIGNED LINK OF A SENDER'S OWN (AGL-2981).\n *\n * The forms above are the platform's own unsubscribe and confirmation\n * links, each a subject over a site and an address. A sender that mails\n * from somewhere else — a plugin sending from a person's own mailbox, whose\n * link carries its own facts — signs its link here instead, over a payload\n * of its own and under a PURPOSE of its own.\n *\n * The purpose is not a prefix of the subject, which is how the confirmation\n * form had to guard a collision by hand. It selects the KEY: every purpose's\n * links are signed with an HMAC key derived from the shared secret and the\n * purpose, so a signature minted for one purpose verifies for no other and\n * for none of the platform's own forms above, whatever the payloads spell.\n * The secret, the digest and the constant-time comparison are the same.\n *==========================================*/\n\n/** The key one purpose's links are signed with: derived from the secret, bound to the purpose. */\nfunction signedLinkKey(purpose: string, secret: string): Buffer {\n  return createHmac('sha256', secret).update(`aglyn-signed-link:${purpose}`).digest()\n}\n\n/**\n * The signature of a payload for one purpose, base64url — or `''` when there\n * is no secret, no purpose or no payload to sign, so a caller can tell it has\n * no link rather than one that verifies for anybody.\n */\nexport function signedLinkSignature(\n  purpose: string,\n  payload: string,\n  secret: string = unsubscribeLinkSecret(),\n): string {\n  const name = String(purpose ?? '').trim()\n  const body = String(payload ?? '')\n  if (!secret || !name || !body) return ''\n  return createHmac('sha256', signedLinkKey(name, secret)).update(body).digest('base64url')\n}\n\n/** Whether a signature is this payload's, for this purpose, in constant time. */\nexport function signedLinkSignatureMatches(args: {\n  purpose: string\n  payload: string\n  signature: string\n  /** Defaults to {@link unsubscribeLinkSecret}. */\n  secret?: string\n}): boolean {\n  const expected = signedLinkSignature(args.purpose, args.payload, args.secret ?? unsubscribeLinkSecret())\n  const presented = String(args.signature ?? '')\n  return (\n    expected.length > 0 &&\n    expected.length === presented.length &&\n    timingSafeEqual(new Uint8Array(Buffer.from(expected)), new Uint8Array(Buffer.from(presented)))\n  )\n}\n"],"names":["createHmac","timingSafeEqual","unsubscribeLinkSecret","process","env","EMAIL_UNSUBSCRIBE_SECRET","CRON_SECRET","unsubscribeSignatureSubject","hostId","email","sendId","topicId","address","String","trim","toLowerCase","campaign","topic","includes","unsubscribeSignature","secret","subject","update","digest","unsubscribeSignatureMatches","args","expected","undefined","length","signature","Uint8Array","Buffer","from","CONFIRM_SUBJECT_PREFIX","confirmSignatureSubject","host","confirmSignature","buildConfirmUrl","input","siteBase","replace","encodeURIComponent","buildUnsubscribeUrl","route","surface","signedLinkKey","purpose","signedLinkSignature","payload","name","body","signedLinkSignatureMatches","presented"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GAED,SAASA,UAAU,EAAEC,eAAe,QAAQ,SAAQ;AAEpD;;;;;;;CAOC,GACD,OAAO,SAASC;IACd,OAAOC,QAAQC,GAAG,CAACC,wBAAwB,IAAIF,QAAQC,GAAG,CAACE,WAAW,IAAI;AAC5E;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASC,4BACdC,MAAc,EACdC,KAAa,EACbC,MAAe,EACfC,OAAgB;IAEhB,MAAMC,UAAUC,OAAOJ,gBAAAA,QAAS,IAC7BK,IAAI,GACJC,WAAW;IACd;;;;;;;;;;;;GAYC,GACD,MAAMC,WAAWH,OAAOH,iBAAAA,SAAU;IAClC,MAAMO,QAAQJ,OAAOF,kBAAAA,UAAW;IAChC,IAAIK,SAASE,QAAQ,CAAC,QAAQD,MAAMC,QAAQ,CAAC,MAAM,OAAO;IAC1D,IAAID,SAASD,UAAU,OAAO,GAAGR,OAAO,CAAC,EAAEI,QAAQ,CAAC,EAAEI,SAAS,CAAC,EAAEC,OAAO;IACzE,IAAID,UAAU,OAAO,GAAGR,OAAO,CAAC,EAAEI,QAAQ,CAAC,EAAEI,UAAU;IACvD,OAAO,GAAGR,OAAO,CAAC,EAAEI,SAAS;AAC/B;AAEA,gEAAgE,GAChE,OAAO,SAASO,qBACdX,MAAc,EACdC,KAAa,EACbW,MAAc,EACdV,MAAe,EACfC,OAAgB;IAEhB,MAAMU,UAAUd,4BAA4BC,QAAQC,OAAOC,QAAQC;IACnE,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,CAACU,SAAS,OAAO;IACrB,OAAOrB,WAAW,UAAUoB,QAAQE,MAAM,CAACD,SAASE,MAAM,CAAC;AAC7D;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASC,4BAA4BC,IAM3C;IACC,MAAMC,WAAWP,qBACfM,KAAKjB,MAAM,EACXiB,KAAKhB,KAAK,EACVgB,KAAKL,MAAM,EACXK,KAAKf,MAAM,IAAIiB;IAEjB,OACED,SAASE,MAAM,KAAKH,KAAKI,SAAS,CAACD,MAAM,IACzC3B,gBACE,IAAI6B,WAAWC,OAAOC,IAAI,CAACN,YAC3B,IAAII,WAAWC,OAAOC,IAAI,CAACP,KAAKI,SAAS;AAG/C;AAEA;;;;;CAKC,GACD,OAAO,MAAMI,yBAAyB,UAAS;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BC,GACD,OAAO,SAASC,wBACd1B,MAAc,EACdC,KAAa,EACbE,OAAe;IAEf,MAAMC,UAAUC,OAAOJ,gBAAAA,QAAS,IAC7BK,IAAI,GACJC,WAAW;IACd,MAAMoB,OAAOtB,OAAOL,iBAAAA,SAAU;IAC9B,MAAMS,QAAQJ,OAAOF,kBAAAA,UAAW;IAChC,IAAI,CAACwB,QAAQ,CAACvB,WAAW,CAACK,OAAO,OAAO;IACxC,IAAIkB,SAASF,wBAAwB,OAAO;IAC5C,IAAIE,KAAKjB,QAAQ,CAAC,QAAQD,MAAMC,QAAQ,CAAC,MAAM,OAAO;IACtD,OAAO,GAAGe,uBAAuB,CAAC,EAAEE,KAAK,CAAC,EAAEvB,QAAQ,CAAC,EAAEK,OAAO;AAChE;AAEA,mEAAmE,GACnE,OAAO,SAASmB,iBACd5B,MAAc,EACdC,KAAa,EACbE,OAAe,EACfS,MAAc;IAEd,MAAMC,UAAUa,wBAAwB1B,QAAQC,OAAOE;IACvD,IAAI,CAACU,WAAW,CAACD,QAAQ,OAAO;IAChC,OAAOpB,WAAW,UAAUoB,QAAQE,MAAM,CAACD,SAASE,MAAM,CAAC;AAC7D;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,SAASc,gBAAgBC,KAO/B;QACgBA,eACSA,iBACDA;IAFvB,MAAMlB,UAASkB,gBAAAA,MAAMlB,MAAM,YAAZkB,gBAAgBpC;IAC/B,MAAMqC,WAAW1B,QAAOyB,kBAAAA,MAAMC,QAAQ,YAAdD,kBAAkB,IAAIE,OAAO,CAAC,QAAQ;IAC9D,MAAM5B,UAAUC,QAAOyB,eAAAA,MAAM7B,KAAK,YAAX6B,eAAe,IACnCxB,IAAI,GACJC,WAAW;IACd,MAAMc,YAAYO,iBAChBE,MAAM9B,MAAM,EACZI,SACA0B,MAAM3B,OAAO,EACbS;IAEF,IAAI,CAACmB,YAAY,CAACV,WAAW,OAAO;IACpC,OACE,GAAGU,SAAS,kBAAkB,CAAC,GAC/B,CAAC,QAAQ,EAAEE,mBAAmBH,MAAM9B,MAAM,GAAG,GAC7C,CAAC,OAAO,EAAEiC,mBAAmB7B,UAAU,GACvC,CAAC,KAAK,EAAE6B,mBAAmBH,MAAM3B,OAAO,GAAG,GAC3C,CAAC,KAAK,EAAEkB,WAAW;AAEvB;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASa,oBAAoBJ,KA0BnC;QACgBA,eACSA,iBACDA;IAFvB,MAAMlB,UAASkB,gBAAAA,MAAMlB,MAAM,YAAZkB,gBAAgBpC;IAC/B,MAAMqC,WAAW1B,QAAOyB,kBAAAA,MAAMC,QAAQ,YAAdD,kBAAkB,IAAIE,OAAO,CAAC,QAAQ;IAC9D,MAAM5B,UAAUC,QAAOyB,eAAAA,MAAM7B,KAAK,YAAX6B,eAAe,IACnCxB,IAAI,GACJC,WAAW;IACd,IAAI,CAACK,UAAU,CAACmB,YAAY,CAACD,MAAM9B,MAAM,IAAI,CAACI,SAAS,OAAO;IAC9D,MAAMiB,YAAYV,qBAChBmB,MAAM9B,MAAM,EACZI,SACAQ,QACAkB,MAAM5B,MAAM,EACZ4B,MAAM3B,OAAO;IAEf,IAAI,CAACkB,WAAW,OAAO;IACvB,MAAMc,QACJL,MAAMM,OAAO,KAAK,gBACd,2BACA;IACN,OACE,GAAGL,WAAWI,OAAO,GACrB,CAAC,QAAQ,EAAEF,mBAAmBH,MAAM9B,MAAM,GAAG,GAC7C,CAAC,OAAO,EAAEiC,mBAAmB7B,UAAU,GACvC,CAAC,KAAK,EAAEiB,WAAW,GAClBS,CAAAA,MAAM5B,MAAM,GAAG,CAAC,KAAK,EAAE+B,mBAAmBH,MAAM5B,MAAM,GAAG,GAAG,EAAC,IAC7D4B,CAAAA,MAAM3B,OAAO,GAAG,CAAC,KAAK,EAAE8B,mBAAmBH,MAAM3B,OAAO,GAAG,GAAG,EAAC;AAEpE;AAEA;;;;;;;;;;;;;;;4CAe4C,GAE5C,gGAAgG,GAChG,SAASkC,cAAcC,OAAe,EAAE1B,MAAc;IACpD,OAAOpB,WAAW,UAAUoB,QAAQE,MAAM,CAAC,CAAC,kBAAkB,EAAEwB,SAAS,EAAEvB,MAAM;AACnF;AAEA;;;;CAIC,GACD,OAAO,SAASwB,oBACdD,OAAe,EACfE,OAAe,EACf5B,SAAiBlB,uBAAuB;IAExC,MAAM+C,OAAOpC,OAAOiC,kBAAAA,UAAW,IAAIhC,IAAI;IACvC,MAAMoC,OAAOrC,OAAOmC,kBAAAA,UAAW;IAC/B,IAAI,CAAC5B,UAAU,CAAC6B,QAAQ,CAACC,MAAM,OAAO;IACtC,OAAOlD,WAAW,UAAU6C,cAAcI,MAAM7B,SAASE,MAAM,CAAC4B,MAAM3B,MAAM,CAAC;AAC/E;AAEA,+EAA+E,GAC/E,OAAO,SAAS4B,2BAA2B1B,IAM1C;QACkEA,cACxCA;IADzB,MAAMC,WAAWqB,oBAAoBtB,KAAKqB,OAAO,EAAErB,KAAKuB,OAAO,GAAEvB,eAAAA,KAAKL,MAAM,YAAXK,eAAevB;IAChF,MAAMkD,YAAYvC,QAAOY,kBAAAA,KAAKI,SAAS,YAAdJ,kBAAkB;IAC3C,OACEC,SAASE,MAAM,GAAG,KAClBF,SAASE,MAAM,KAAKwB,UAAUxB,MAAM,IACpC3B,gBAAgB,IAAI6B,WAAWC,OAAOC,IAAI,CAACN,YAAY,IAAII,WAAWC,OAAOC,IAAI,CAACoB;AAEtF"}

package/src/lib/server/erase.d.ts

@@ -86,15 +86,6 @@ export declare function eraseHost(hostId: string, options?: EraseHostOptions): P
  * Authorization belongs to the caller — this only walks the tree.
  */
 export declare function eraseSubtree(path: readonly [string, string, string, string]): Promise<void>;
-/**
- * What an erasure did with `publisherProfiles/{orgId}` (AGL-1970).
- *
- * Three outcomes rather than a boolean, because the third one is a decision
- * the audit row has to be able to state: a listing the erased org published
- * can outlive it, and a listing whose publisher document is simply gone is
- * unattributable in a way nobody chose.
- */
-export type PublisherProfileDisposition = 'absent' | 'deleted' | 'tombstoned';
 /**
  * The two things an OPERATOR needs that a served caller does not (AGL-1481).
  *
@@ -180,10 +171,13 @@ export interface EraseOrgResult {
      * each eraser's count of what it would do.
      */
     plugins?: Record<string, PluginOrgErasureReport | null>;
-    /** Outreach mailbox grants destroyed (AGL-2974) — outside the org path. */
-    outreachMailboxCredentials?: number;
-    /** Outreach short tracking links destroyed (AGL-3297). */
-    outreachLinks?: number;
+    /**
+     * Rows destroyed from each plugin's top-level collection keyed by the org
+     * (AGL-3080), keyed by collection: a connected mailbox's grant (AGL-2974),
+     * a sequence email's tracking links (AGL-3297). Outside the org path, and
+     * declared by their owners rather than named here.
+     */
+    pluginCollections?: Record<string, number>;
     /** Public SSO routing docs destroyed (AGL-1448) — outside the org path. */
     ssoDomains?: number;
     /** Custom console domains released (AGL-1448) — outside the org path. */
@@ -209,17 +203,6 @@ export interface EraseOrgResult {
      * same number as one that reached it and found nothing.
      */
     hostMemberships?: number | null;
-    /** Marketplace handle reservations released (AGL-1970) — id-keyed, public. */
-    publisherHandles?: number;
-    /** What became of the org's public publisher profile (AGL-1970). */
-    publisherProfile?: PublisherProfileDisposition;
-    /**
-     * Marketplace listings that OUTLIVE this erasure and still name the org
-     * (AGL-1970/AGL-1448 Tier 3). Reported rather than deleted: an erasure that
-     * leaves something standing has to say so, and this is the number that makes
-     * the parked listing-survival decision cost something measurable.
-     */
-    listingsRetained?: number;
     /**
      * Support threads destroyed, each with its `messages` subtree (AGL-1971) —
      * the highest-PII-density collection outside the org path.
@@ -262,15 +245,18 @@ export interface EraseOrgResult {
  *   2. Nothing is written. This step used to persist a final JSON export of
  *      the org and host trees to `erasures/{orgId}/…` and abort if it could
  *      not — see the note below for why it is gone (AGL-1443).
- *   3. Revoke the org's API credentials (AGL-1444), its public routing — SSO
- *      domains and custom console domains (AGL-1448) — and its public
- *      marketplace identity: the publisher profile and every handle it
- *      reserved (AGL-1970); and destroy the OAuth grants behind its reps'
- *      Outreach mailboxes (AGL-2974). All of them are top-level collections
- *      keyed by something other than a path under the org, so the org-tree
- *      delete cannot reach them; doing them before the content delete also
- *      closes the mid-erasure window, in which a credential, a domain or a
- *      public publisher page still resolves to a half-deleted workspace.
+ *   3. The plugins' erasers first (AGL-2978), while everything they may need
+ *      to act through still exists — a REQUIRED one (the marketplace's, which
+ *      erases the org's public publisher identity, AGL-1970) fails the step
+ *      rather than recording its share as undone. Then revoke the org's API
+ *      credentials (AGL-1444), its public routing — SSO domains and custom
+ *      console domains (AGL-1448) — and sweep every plugin collection keyed
+ *      by the org that its owner declared (a connected mailbox's OAuth grant,
+ *      AGL-2974). All of them are top-level collections keyed by something
+ *      other than a path under the org, so the org-tree delete cannot reach
+ *      them; doing them before the content delete also closes the mid-erasure
+ *      window, in which a credential, a domain or a public publisher page
+ *      still resolves to a half-deleted workspace.
  *   4. Delete each host (eraseHost), org-level Storage, the Stripe customer
  *      AND its local reverse index, member back-references, then the org tree
  *      and every slug the org ever held — tombstones included (AGL-1448).

package/src/lib/server/erase.js

@@ -26,7 +26,7 @@ import { resolveAccountAddresses } from "./account-addresses.js";
 import { EMAIL_IDENTITY_INDEX_COLLECTION } from "./account-emails.js";
 import { removeOrgMember } from "./organizations.js";
 import { runPluginUserErasers } from "@aglyn/aglyn/plugin-manager/plugin-user-erasure";
-import { runPluginOrgErasers } from "@aglyn/aglyn/plugin-manager/plugin-org-erasure";
+import { PLUGIN_ORG_KEYED_COLLECTIONS, runPluginOrgErasers } from "@aglyn/aglyn/plugin-manager/plugin-org-erasure";
 import { isBillingSubscription } from "@aglyn/aglyn/server";
 // The module path rather than the barrel: this module's specs substitute the
 // barrel, and which sites a consent group still needs is the rule itself.
@@ -55,31 +55,6 @@ import { addAdminAudit } from "./admin-audit-write.js";
  * emulator spec asserts the two spellings still agree by reading that file,
  * so a rename fails a test rather than silently un-wiring this sweep.
  */ const SUPPLIER_DELIVERY_COLLECTION = 'supplierDeliveries';
-/**
- * `outreachMailboxCredentials` — the OAuth grant behind each mailbox a rep
- * connects to Outreach, keyed by the mailbox id and carrying `orgId` as a
- * FIELD.
- *
- * The literal rather than an import, for `SUPPLIER_DELIVERY_COLLECTION`'s
- * reason: the collection belongs to `libs/plugins/outreach`
- * (`OUTREACH_COLLECTIONS.mailboxCredentials` in
- * `src/lib/model/outreach.types.ts`), and this `scope:data` library may not
- * import a plugin. The plugin's own spec asserts the two spellings agree, so
- * a rename fails a test rather than silently un-wiring the sweep.
- *
- * A static sweep here, not a hook the plugin registers, because an erasure
- * cannot rely on the plugin being present. An org that switched Outreach off
- * still holds the tokens its reps granted, and the process running the
- * erasure — the cron, the operator script, a replay — may never have loaded
- * the plugin's bundle at all. A credential's lifetime cannot depend on which
- * bundles an erasing process happened to load.
- */ const OUTREACH_MAILBOX_CREDENTIALS_COLLECTION = 'outreachMailboxCredentials';
-/**
- * `outreachLinks` — Outreach's short tracking links (AGL-3297), one document
- * per link in a sent sequence email, keyed by the link's random id and
- * carrying `orgId` as a FIELD. A literal for the reason above, held to the
- * plugin's spelling by the same spec.
- */ const OUTREACH_LINKS_COLLECTION = 'outreachLinks';
 /**
  * Destroy the site's DEAD-LETTERED supplier deliveries (AGL-1448).
  *
@@ -331,27 +306,21 @@ export async function eraseHost(hostId, options = {}) {
     return deleteDocsByOrgId('apiKeys', orgId, dryRun);
 }
 /**
- * Delete every Outreach mailbox credential the org holds (AGL-2974).
- *
- * `outreachMailboxCredentials` is a TOP-LEVEL collection keyed by the mailbox
- * id and carrying `orgId` as a FIELD, so `recursiveDelete(orgRef)` cannot see
- * it — the blindness `eraseOrgApiKeys` answers, on a more dangerous document.
- * Left standing, the OAuth grant a rep gave for their own mailbox would
- * outlive the workspace it was given to: tokens that can still send as that
- * person, held for an organization that no longer exists and that nobody can
- * ask to disconnect them.
- *
- * This destroys the platform's copy of the grant; it does not call the
- * provider's revocation endpoint, which needs the plugin's provider adapter.
- * With the tokens gone the grant has nothing left to act through.
- *
- * Bounded by the `orgId` field, never a collection sweep: this collection
- * holds every other workspace's connected mailboxes too.
- *
- * Returns the number destroyed, for the audit row — an erasure trail that
- * understates what it removed is the one record that has to be right.
- */ async function eraseOrgOutreachMailboxCredentials(orgId, dryRun = false) {
-    return deleteDocsByOrgId(OUTREACH_MAILBOX_CREDENTIALS_COLLECTION, orgId, dryRun);
+ * Sweep every top-level plugin collection keyed by this org (AGL-3080).
+ *
+ * The collections are the plugins' own, DECLARED by each owner in
+ * `plugins.config.json` (`orgKeyedCollections`) and compiled into core, so the
+ * sweep names none of them and runs in every process whether or not the
+ * owner is loaded. Sequential and field-bounded like every other org-keyed
+ * sweep: each of these collections holds every other workspace's rows too.
+ *
+ * Returns the count destroyed per collection, for the audit row.
+ */ async function erasePluginOrgKeyedCollections(orgId, dryRun = false) {
+    const counts = {};
+    for (const { name, orgField } of PLUGIN_ORG_KEYED_COLLECTIONS){
+        counts[name] = await deleteDocsByOrgId(name, orgId, dryRun, orgField);
+    }
+    return counts;
 }
 /**
  * Delete every document in a TOP-LEVEL collection that names this org in its
@@ -390,10 +359,10 @@ export async function eraseHost(hostId, options = {}) {
  * including the tax a `mode: 'stripe'` store collects under AGLYN's own
  * Texas registration, which Aglyn must be able to account for long after the
  * merchant has gone.
- */ async function deleteDocsByOrgId(collection, orgId, dryRun = false) {
+ */ async function deleteDocsByOrgId(collection, orgId, dryRun = false, orgField = 'orgId') {
     if (!orgId) return 0;
     const firestore = firebaseAdmin.app().firestore();
-    const rows = await firestore.collection(collection).where('orgId', '==', orgId).get();
+    const rows = await firestore.collection(collection).where(orgField, '==', orgId).get();
     if (dryRun) return rows.size;
     for(let index = 0; index < rows.docs.length; index += 400){
         const batch = firestore.batch();
@@ -645,99 +614,6 @@ export async function eraseHost(hostId, options = {}) {
         return null;
     }
 }
-/**
- * Drop the org's PUBLIC marketplace identity — the profile and every handle
- * it reserved (AGL-1970).
- *
- * Both survived every erasure until now, and both are `allow read: if true`
- * (`cloud/firebase-firestore.rules`, `match /publisherProfiles/{orgId}`). This
- * is the AGL-1448 shape with one twist that is the whole reason it was missed:
- * `publisherProfiles` is keyed by the org id **as the document id**, so it is
- * invisible to `deleteDocsByOrgId` *and* to a reader scanning this file for
- * the field-keyed sweep list. Nothing prompts you to notice it.
- *
- * What survived is not cosmetic. `stripeAccountId` is a **payout
- * destination** — written server-side only after Connect onboarding/KYC and
- * trusted by every checkout path — so an erased org stayed world-readable with
- * a live payment-account identifier attached to a dead identity. That is the
- * `stripeCustomers` correlation AGL-1448 removed, pointing the other way.
- *
- * `publisherHandles` is the easy half and goes unconditionally: it carries
- * `orgId` as a FIELD, so `deleteDocsByOrgId` fits exactly, and it is a **live
- * reservation** — `claimPublisherHandle` refuses a handle another org's row
- * names, so a ghost holds a marketplace name against a real customer with no
- * way to appeal. That is the `ssoDomains` argument verbatim, and absence is
- * again the only state that both stops the read and releases the name. Rename
- * tombstones (`{ orgId, movedTo }`) carry the same `orgId` and go with it, and
- * the field bound is what makes that safe: re-claiming a tombstone FULL-
- * REPLACES it with the new owner's `{ orgId }`, so a handle this org renamed
- * away from and somebody else has since taken does not match the query.
- *
- * **The profile is the half with a genuine tension, and it is resolved here
- * rather than deferred.** `marketplaceListings` outlives an erasure — that is
- * AGL-1448's parked Tier 3 product decision, an erased org's listing being
- * something buyers paid for — so deleting the publisher document outright can
- * leave a listing attributed to nothing. So:
- *
- *   - **No surviving listing** → `recursiveDelete` the profile. `deleted`.
- *     `recursiveDelete` and not `delete`: `publish-plugin` keeps its daily
- *     publish-rate window at `publisherProfiles/{orgId}/meta/publishWindow`,
- *     and a document delete would orphan it under a path with no owner.
- *   - **A listing survives** → the same `recursiveDelete`, then a minimal
- *     `{ erased: true, erasedAt }` in its place. `tombstoned`. The tombstone
- *     carries no `handle`, no `displayName`, no `bio`/`avatarUrl`/`website`,
- *     no `publisherAgreement` and — the point — no `stripeAccountId`. It is
- *     "an internal record that the erasure happened", which is exactly what
- *     the Privacy Policy §5 sentence reserves; every byte the sentence calls
- *     content is gone either way. Readers already handle it: with no `handle`,
- *     `resolvePublisherProfile` returns `null`, which is the pre-existing
- *     "this org has no profile" path.
- *
- * The count of surviving listings is returned either way, so an erasure that
- * left something standing SAYS SO in its audit row instead of reporting a
- * clean success — the Tier 3 decision is still open, and an erasure is the
- * one place its cost is measurable.
- */ async function eraseOrgPublisherIdentity(orgId, dryRun = false) {
-    const firestore = firebaseAdmin.app().firestore();
-    const handles = await deleteDocsByOrgId('publisherHandles', orgId, dryRun);
-    const profileRef = firestore.collection('publisherProfiles').doc(orgId);
-    const [profileSnapshot, listings] = await Promise.all([
-        profileRef.get(),
-        // `profileId` is the listing's publishing-org id (AGL-652) — the same
-        // value as this profile's document id, under the older field name.
-        firestore.collection('marketplaceListings').where('profileId', '==', orgId).get()
-    ]);
-    const listingsRetained = listings.size;
-    if (!profileSnapshot.exists) {
-        return {
-            handles,
-            profile: 'absent',
-            listingsRetained
-        };
-    }
-    if (dryRun) {
-        return {
-            handles,
-            profile: listingsRetained ? 'tombstoned' : 'deleted',
-            listingsRetained
-        };
-    }
-    await firestore.recursiveDelete(profileRef);
-    if (!listingsRetained) return {
-        handles,
-        profile: 'deleted',
-        listingsRetained
-    };
-    await profileRef.set({
-        erased: true,
-        erasedAt: FieldValue.serverTimestamp()
-    });
-    return {
-        handles,
-        profile: 'tombstoned',
-        listingsRetained
-    };
-}
 /**
  * Destroy every support ticket the org opened, and the messages under each
  * (AGL-1971).
@@ -864,15 +740,18 @@ export async function eraseHost(hostId, options = {}) {
  *   2. Nothing is written. This step used to persist a final JSON export of
  *      the org and host trees to `erasures/{orgId}/…` and abort if it could
  *      not — see the note below for why it is gone (AGL-1443).
- *   3. Revoke the org's API credentials (AGL-1444), its public routing — SSO
- *      domains and custom console domains (AGL-1448) — and its public
- *      marketplace identity: the publisher profile and every handle it
- *      reserved (AGL-1970); and destroy the OAuth grants behind its reps'
- *      Outreach mailboxes (AGL-2974). All of them are top-level collections
- *      keyed by something other than a path under the org, so the org-tree
- *      delete cannot reach them; doing them before the content delete also
- *      closes the mid-erasure window, in which a credential, a domain or a
- *      public publisher page still resolves to a half-deleted workspace.
+ *   3. The plugins' erasers first (AGL-2978), while everything they may need
+ *      to act through still exists — a REQUIRED one (the marketplace's, which
+ *      erases the org's public publisher identity, AGL-1970) fails the step
+ *      rather than recording its share as undone. Then revoke the org's API
+ *      credentials (AGL-1444), its public routing — SSO domains and custom
+ *      console domains (AGL-1448) — and sweep every plugin collection keyed
+ *      by the org that its owner declared (a connected mailbox's OAuth grant,
+ *      AGL-2974). All of them are top-level collections keyed by something
+ *      other than a path under the org, so the org-tree delete cannot reach
+ *      them; doing them before the content delete also closes the mid-erasure
+ *      window, in which a credential, a domain or a public publisher page
+ *      still resolves to a half-deleted workspace.
  *   4. Delete each host (eraseHost), org-level Storage, the Stripe customer
  *      AND its local reverse index, member back-references, then the org tree
  *      and every slug the org ever held — tombstones included (AGL-1448).
@@ -986,20 +865,16 @@ export async function eraseHost(hostId, options = {}) {
         // pass the org gate and reach a half-deleted workspace. Revoking first
         // closes that window as well as the permanent one.
         progress.apiKeys = await eraseOrgApiKeys(orgId, dryRun);
-        progress.outreachMailboxCredentials = await eraseOrgOutreachMailboxCredentials(orgId, dryRun);
-        progress.outreachLinks = await deleteDocsByOrgId(OUTREACH_LINKS_COLLECTION, orgId, dryRun);
+        // The plugins' top-level collections keyed by this org (AGL-3080) — a
+        // connected mailbox's OAuth grant, a sequence email's tracking links.
+        // Declared by the owning plugin and swept HERE, statically, not by its
+        // eraser: an erasure cannot rely on a plugin being loaded, and a grant
+        // that can still send as a person must not outlive the workspace it was
+        // given to because an erasing process never loaded that plugin's bundle.
+        progress.pluginCollections = await erasePluginOrgKeyedCollections(orgId, dryRun);
         progress.ssoDomains = await eraseOrgSsoDomains(orgId, dryRun);
         progress.consoleDomains = await releaseOrgConsoleDomains(orgId, dryRun);
         progress.apiIdempotency = await eraseOrgIdempotencyKeys(orgId, dryRun);
-        // The org's PUBLIC marketplace identity (AGL-1970). Here rather than with
-        // the Stripe step, though it carries a payout id, because `publisherHandles`
-        // is a live name reservation and belongs with the other reservations this
-        // step releases — and because the profile is world-readable, so the sooner
-        // it stops resolving the smaller the mid-erasure window.
-        const publisher = await eraseOrgPublisherIdentity(orgId, dryRun);
-        progress.publisherHandles = publisher.handles;
-        progress.publisherProfile = publisher.profile;
-        progress.listingsRetained = publisher.listingsRetained;
         // Support threads (AGL-1971). Its own step because it is the only sweep
         // here that walks a subtree per row, so it is the one most likely to be
         // where a large workspace's erasure runs out of time — and a failure that