@aglyn/tenant-data-admin 1.0.0-beta.219 → 1.0.0-beta.220

package/src/lib/server/platform-marketing-consent.d.ts

@@ -63,7 +63,7 @@
  * verified account asks the plugin that keeps the site's preferences to
  * reopen that list and nothing else (`plugin-email-streams`).
  */
-import { type TopicSubscriptionState } from '@aglyn/aglyn/app-utils/email-topics';
+import { type TopicSubscriptionState } from '@aglyn/aglyn/app-utils/subscription-topics';
 import { type PlatformMarketingConsentDecision, type PlatformMarketingConsoleSourceKind, type PlatformMarketingConsentState } from '@aglyn/aglyn/app-utils/platform-marketing-consent';
 import { type MarketingBasis, type MarketingConsentAssertedBy, type MarketingConsentReason, type MarketingConsentVerdict } from '@aglyn/aglyn/app-utils/marketing-consent';
 import { type EmailStreamRejoinOutcome, rejoinEmailStream } from '@aglyn/aglyn/plugin-manager/plugin-email-streams';

package/src/lib/server/platform-marketing-consent.js

@@ -62,7 +62,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * The console's switch undoes it the same way, one list wide: a Yes from a
  * verified account asks the plugin that keeps the site's preferences to
  * reopen that list and nothing else (`plugin-email-streams`).
- */ import { readTopicSubscriptionState, TOPIC_OPT_OUTS_SUBCOLLECTION } from "@aglyn/aglyn/app-utils/email-topics";
+ */ import { readTopicSubscriptionState, TOPIC_OPT_OUTS_SUBCOLLECTION } from "@aglyn/aglyn/app-utils/subscription-topics";
 import { isPlatformMarketingConsentDecision, isPlatformMarketingConsoleSourceKind, isPlatformMarketingEmailSourceKind, platformMarketingConsentSource, platformMarketingEmailSource, PLATFORM_MARKETING_TOPIC_ID, platformMarketingUserFields, readPlatformMarketingConsent, USER_MARKETING_PROMPT_DISMISSED_AT_FIELD } from "@aglyn/aglyn/app-utils/platform-marketing-consent";
 import { marketingConsentDecision, readMarketingBasis, resolveMarketingConsentPolicy } from "@aglyn/aglyn/app-utils/marketing-consent";
 import { rejoinEmailStream } from "@aglyn/aglyn/plugin-manager/plugin-email-streams";

package/src/lib/server/platform-marketing-consent.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/platform-marketing-consent.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The record a console door writes when a person decides about the\n * platform's own product email (AGL-3185).\n *\n * ## Two documents, one decision\n *\n * The decision goes onto the person's own `users/{uid}` first — the console\n * shows the preference from there, and it must not depend on the operator's\n * CRM accepting a row — and then onto the operator's marketing contact for\n * the same address through `upsertHostContact`, which is every other capture\n * door's path and the only one the send-time consent join reads. The contact\n * half carries the decision AND its provenance, so a campaign's audience\n * count reports this basis as the person's own click and never as something\n * asserted on their behalf.\n *\n * ## Server-side, because the client cannot and should not\n *\n * The sign-up page is a client of the person's own project; the operator's\n * marketing org is somebody else's data. Only the Admin SDK writes there, and\n * only after the person's ID token has been verified by the route in front\n * of this module. The user-document half could be a client write — the rules\n * make it owner-writable — but a mirror the client writes and the server\n * reads back is two writers of one fact, so both halves are written here.\n *\n * ## Which host, and why it is a setting\n *\n * The marketing host is the deployment's, not the code's: this repository is\n * what a self-hosted install runs, and an install with no product audience of\n * its own has nowhere for a contact to go. `PLATFORM_MARKETING_HOST_ID` names\n * it, and when it is unset the decision is recorded on the person's document\n * alone. No hostname or document id is hardcoded here for the same reason\n * `platform-marketing-host.ts` gives: nothing in the code knows which site\n * is the operator's.\n *\n * ## The site's own pages answer the same question, for one list (AGL-3305)\n *\n * The marketing site's emails carry their own way out, and it writes the\n * site's lists, not either consent record. An unsubscribe that was about the\n * list the console's question stands for — `PLATFORM_MARKETING_TOPIC_ID`, or\n * everything the site sends — is mirrored onto the ACCOUNT here, through an\n * email door; an unsubscribe from any other list is not, because the person\n * said nothing about product updates. The contact is left alone on purpose:\n * its basis covers every list the site sends, and declining it would stop the\n * newsletter for somebody who only left product updates.\n *\n * The console's switch undoes it the same way, one list wide: a Yes from a\n * verified account asks the plugin that keeps the site's preferences to\n * reopen that list and nothing else (`plugin-email-streams`).\n */\n\nimport {\n  readTopicSubscriptionState,\n  TOPIC_OPT_OUTS_SUBCOLLECTION,\n  type TopicSubscriptionEntry,\n  type TopicSubscriptionState,\n} from '@aglyn/aglyn/app-utils/email-topics'\nimport {\n  isPlatformMarketingConsentDecision,\n  isPlatformMarketingConsoleSourceKind,\n  isPlatformMarketingEmailSourceKind,\n  type PlatformMarketingConsentDecision,\n  type PlatformMarketingConsoleSourceKind,\n  type PlatformMarketingConsentState,\n  platformMarketingConsentSource,\n  platformMarketingEmailSource,\n  PLATFORM_MARKETING_TOPIC_ID,\n  platformMarketingUserFields,\n  readPlatformMarketingConsent,\n  USER_MARKETING_PROMPT_DISMISSED_AT_FIELD,\n} from '@aglyn/aglyn/app-utils/platform-marketing-consent'\nimport {\n  marketingConsentDecision,\n  type MarketingBasis,\n  type MarketingConsentAssertedBy,\n  type MarketingConsentReason,\n  type MarketingConsentVerdict,\n  readMarketingBasis,\n  resolveMarketingConsentPolicy,\n} from '@aglyn/aglyn/app-utils/marketing-consent'\nimport {\n  type EmailStreamRejoinOutcome,\n  rejoinEmailStream,\n} from '@aglyn/aglyn/plugin-manager/plugin-email-streams'\nimport { attributableAccountForAddress } from './account-addresses'\nimport { findContactByEmail } from './contact-email-index'\nimport {\n  EMAIL_SUPPRESSIONS_COLLECTION,\n  emailSuppressionKey,\n  HOST_SUPPRESSIONS_SUBCOLLECTION,\n} from './email-suppression'\nimport firebaseAdmin from './firebase-admin'\nimport {\n  consentGroupForSite,\n  getOrgForHost,\n  orgDataCollectionForHost,\n} from './organizations'\nimport { upsertHostContact } from './upsert-contact'\n\nconst firestore = () => firebaseAdmin.app().firestore()\n\n/**\n * The variable naming the host whose contacts receive product-marketing\n * consent — the operator's own marketing site. Unset on a self-hosted\n * install, and honored as \"record the preference, capture no contact\".\n */\nexport const PLATFORM_MARKETING_HOST_ID_ENV = 'PLATFORM_MARKETING_HOST_ID'\n\n/**\n * The configured marketing host, or `null` when the deployment names none.\n *\n * Read at call time rather than at module load, so a test can set it and a\n * process that started without it picks up a later value the same way every\n * other runtime setting here does.\n */\nexport function platformMarketingHostId(): string | null {\n  const value = String(process.env.PLATFORM_MARKETING_HOST_ID ?? '').trim()\n  return value || null\n}\n\n/** What became of the contact half of the record. */\nexport type PlatformMarketingContactOutcome =\n  | { status: 'recorded'; contactId: string; created: boolean }\n  /** No marketing host is configured — a self-hosted install. */\n  | { status: 'unconfigured' }\n  /** The account carries no address a contact could be keyed on. */\n  | { status: 'no-email' }\n  /** The capture door refused the row — its band, an erasure, or an error. */\n  | { status: 'refused'; reason: string }\n\nexport interface RecordPlatformMarketingConsentInput {\n  uid: string\n  /** The account's address, from the verified token. */\n  email: string | null | undefined\n  /** The name the token carries, for an account whose document holds none. */\n  name?: string | null\n  decision: PlatformMarketingConsentDecision\n  /** A console door. An email door is recorded by the site's own pages. */\n  source: PlatformMarketingConsoleSourceKind\n  /** The wording version the door showed, stamped by the route. */\n  textVersion: string\n  /**\n   * Whether the token proves the caller holds the mailbox — its email is\n   * verified (AGL-3305). Only then does a Yes reopen the list on the\n   * marketing site, because reopening it reverses what somebody did from\n   * that mailbox; an unverified account could name a stranger's address.\n   */\n  mailboxVerified?: boolean\n  /** Injectable for tests; defaults to the clock. */\n  now?: number\n  /** Injectable for tests; defaults to the admin app's Firestore. */\n  firestore?: any\n  /** Injectable for tests; defaults to {@link platformMarketingHostId}. */\n  hostId?: string | null\n  /** Injectable for tests; defaults to the real capture door. */\n  upsert?: typeof upsertHostContact\n  /** Injectable for tests; defaults to the `plugin-email-streams` slot. */\n  rejoin?: typeof rejoinEmailStream\n}\n\n/**\n * What a Yes did to the marketing site's own lists (AGL-3305). Absent for a\n * No, and whenever there is no site or no address to reopen a list for.\n */\nexport type PlatformMarketingStreamOutcome =\n  | EmailStreamRejoinOutcome\n  /** The token does not prove the mailbox, so nothing was reopened. */\n  | { status: 'unverified' }\n\nexport interface RecordPlatformMarketingConsentResult {\n  /** The timestamp both documents carry. */\n  atMs: number\n  contact: PlatformMarketingContactOutcome\n  stream?: PlatformMarketingStreamOutcome\n}\n\n/**\n * The name the person's own document holds, else the one the caller has.\n *\n * The sign-up form writes `firstName`/`lastName` onto the document; a Google\n * account carries its name on the token instead. Either is the name the\n * contact row should show, and a blank is left blank rather than invented.\n */\nfunction accountName(\n  snapshot: { get?: (field: string) => unknown } | null | undefined,\n  fallback: string | null | undefined,\n): string | undefined {\n  const first = String(snapshot?.get?.('firstName') ?? '').trim()\n  const last = String(snapshot?.get?.('lastName') ?? '').trim()\n  const stored = [first, last].filter(Boolean).join(' ')\n  return stored || String(fallback ?? '').trim() || undefined\n}\n\n/**\n * Records a decision on both documents.\n *\n * Loud on bad input, like `recordLegalAcceptance`: a decision that cannot be\n * attributed to an account, a door and a wording is not a record of anything.\n * Quiet on the contact half — a refused row is returned, not thrown — because\n * the person's own preference has already been recorded by then, and the\n * operator's CRM band is not a reason to tell them their choice failed.\n */\nexport async function recordPlatformMarketingConsent(\n  input: RecordPlatformMarketingConsentInput,\n): Promise<RecordPlatformMarketingConsentResult> {\n  const uid = String(input.uid ?? '').trim()\n  if (!uid) throw new Error('recordPlatformMarketingConsent: uid is required')\n  if (!isPlatformMarketingConsentDecision(input.decision)) {\n    throw new Error('recordPlatformMarketingConsent: decision is required')\n  }\n  if (!isPlatformMarketingConsoleSourceKind(input.source)) {\n    throw new Error('recordPlatformMarketingConsent: a console source is required')\n  }\n  const textVersion = String(input.textVersion ?? '').trim()\n  if (!textVersion) {\n    throw new Error('recordPlatformMarketingConsent: textVersion is required')\n  }\n\n  const atMs = input.now ?? Date.now()\n  const source = platformMarketingConsentSource({\n    kind: input.source,\n    decision: input.decision,\n    uid,\n    atMs,\n    textVersion,\n  })\n\n  const userRef = (input.firestore ?? firestore()).collection('users').doc(uid)\n  const snapshot = await userRef.get()\n  await userRef.set(\n    platformMarketingUserFields({ decision: input.decision, atMs, source }),\n    { merge: true },\n  )\n\n  const hostId =\n    input.hostId === undefined ? platformMarketingHostId() : input.hostId\n  if (!hostId) return { atMs, contact: { status: 'unconfigured' } }\n  const email = String(input.email ?? '').trim()\n  if (!email) return { atMs, contact: { status: 'no-email' } }\n\n  const name = accountName(snapshot, input.name)\n  const verdict = await (input.upsert ?? upsertHostContact)({\n    hostId,\n    email,\n    ...(name ? { name } : {}),\n    source: 'account',\n    // The sentence the provenance carries is also the timeline row's: what\n    // the person did, in the words an auditor reads.\n    interaction: { atMs, summary: source.reason },\n    ...(input.decision === 'granted'\n      ? { marketingConsent: true }\n      : { declineMarketingConsent: true }),\n    marketingConsentSource: source,\n    // An account on the platform is at least a lead for the platform's own\n    // CRM, whichever way the marketing decision went; the floor never moves\n    // a customer back.\n    initialLifecycleStage: 'lead',\n  })\n  const contact: PlatformMarketingContactOutcome =\n    'refused' in verdict\n      ? { status: 'refused', reason: verdict.refused }\n      : { status: 'recorded', contactId: verdict.contactId, created: verdict.created }\n  if (input.decision !== 'granted') return { atMs, contact }\n\n  /*\n   * A Yes reopens the one list it stands for (AGL-3305).\n   *\n   * After the contact, whatever the contact's outcome: an erasure that\n   * refused the row also left a suppression the plugin will not lift, and it\n   * says so. One list wide, never \"resubscribe to everything\" — somebody who\n   * left every list and now asks for product updates has asked for product\n   * updates.\n   */\n  const stream: PlatformMarketingStreamOutcome = input.mailboxVerified\n    ? await (input.rejoin ?? rejoinEmailStream)({\n        hostId,\n        email,\n        topicId: PLATFORM_MARKETING_TOPIC_ID,\n      })\n    : { status: 'unverified' }\n  return { atMs, contact, stream }\n}\n\n/**\n * Stamps a prompt dismissal — no decision — so the console stays quiet for\n * the snooze window and asks once more after it.\n */\nexport async function snoozePlatformMarketingPrompt(\n  uid: string,\n  options: { now?: number; firestore?: any } = {},\n): Promise<{ atMs: number }> {\n  const trimmed = String(uid ?? '').trim()\n  if (!trimmed) throw new Error('snoozePlatformMarketingPrompt: uid is required')\n  const atMs = options.now ?? Date.now()\n  await (options.firestore ?? firestore())\n    .collection('users')\n    .doc(trimmed)\n    .set({ [USER_MARKETING_PROMPT_DISMISSED_AT_FIELD]: atMs }, { merge: true })\n  return { atMs }\n}\n\n/** The decision the person's own document holds, for the console to show. */\nexport async function readPlatformMarketingConsentForUser(\n  uid: string,\n  options: { firestore?: any } = {},\n): Promise<PlatformMarketingConsentState> {\n  const trimmed = String(uid ?? '').trim()\n  if (!trimmed) throw new Error('readPlatformMarketingConsentForUser: uid is required')\n  const snapshot = await (options.firestore ?? firestore())\n    .collection('users')\n    .doc(trimmed)\n    .get()\n  return readPlatformMarketingConsent(\n    (snapshot?.data?.() as Record<string, unknown> | undefined) ?? null,\n  )\n}\n\n/** An entry on one of the two lists every campaign send passes. */\nexport interface PlatformMarketingSuppression {\n  /** `site`: the marketing site's own list. `platform`: every sender's. */\n  list: 'site' | 'platform'\n  /** `unsubscribe` on the site list; `bounce`, `complaint` or `staff` platform-wide. */\n  reason: string\n}\n\n/**\n * What the operator's own product email would decide about one address\n * (AGL-3292), read the way a campaign from the marketing site reads it.\n *\n * The decision the person made lives on `users/{uid}`, and nothing a send\n * does looks there. A campaign from the configured marketing site reads the\n * CONTACT `recordPlatformMarketingConsent` wrote into that site's\n * organization — its basis for the site, under the organization's policy —\n * and then drops anybody on either suppression list, and a campaign on the\n * product-updates list anybody who left it. An unsubscribe writes those\n * lists; since AGL-3305 one about product updates also turns the account's\n * answer to No, but the contact's basis stays as it was, because it covers\n * every list the site sends. So a staff reader asking \"may we email them?\"\n * needs this half, and needs it from the sender's own readers — the same\n * basis read, consent group, policy and lists — or it answers a question no\n * send asks.\n */\nexport type PlatformMarketingReach =\n  /** No marketing site is configured — a self-hosted install. */\n  | { status: 'unconfigured' }\n  /** The account carries no address a contact could be keyed on. */\n  | { status: 'no-email' }\n  /** A read failed. Nothing about the person follows from it. */\n  | { status: 'unreadable'; hostId: string }\n  | {\n      status: 'read'\n      hostId: string\n      orgId: string\n      orgSlug: string | null\n      /** `null` when the operator's CRM holds no contact for the address. */\n      contactId: string | null\n      basis: MarketingBasis\n      basisAtMs: number | null\n      /** Whose act the basis is — a person's own, or an operator's assertion. */\n      assertedBy: MarketingConsentAssertedBy | null\n      /** Which door recorded the basis (`console-signup`, a form, a backfill). */\n      basisKind: string | null\n      /** The consent rule's answer alone, before either list is consulted. */\n      verdict: MarketingConsentVerdict\n      reason: MarketingConsentReason\n      /** The list that stops every send to the address, when one does. */\n      suppression: PlatformMarketingSuppression | null\n      /**\n       * The address on the list the account's answer stands for (AGL-3305):\n       * `opted-out` when they left product updates, `pending` while a\n       * confirmation is unanswered. A campaign on that list drops both.\n       */\n      topic: PlatformMarketingTopicState\n    }\n\n/** One address on {@link PLATFORM_MARKETING_TOPIC_ID}, as the site stores it. */\nexport interface PlatformMarketingTopicState {\n  id: string\n  state: TopicSubscriptionState\n  /** When they left it, for an `opted-out` state; else `null`. */\n  leftAtMs: number | null\n}\n\n/**\n * The entry that suppresses `email` for sends from `hostId`, if any.\n *\n * The site's own list first, because it is the one a person puts themselves\n * on from this sender's footer; the platform list second. The same two reads\n * `filterSendableForHost` makes: a site entry suppresses by existing, and a\n * platform entry until it is released.\n */\nasync function readPlatformMarketingSuppression(\n  db: any,\n  hostId: string,\n  email: string,\n): Promise<PlatformMarketingSuppression | null> {\n  const key = emailSuppressionKey(email)\n  if (!key) return null\n  const [site, platform] = await Promise.all([\n    db\n      .collection('hosts')\n      .doc(hostId)\n      .collection(HOST_SUPPRESSIONS_SUBCOLLECTION)\n      .doc(key)\n      .get(),\n    db.collection(EMAIL_SUPPRESSIONS_COLLECTION).doc(key).get(),\n  ])\n  if (site?.exists) {\n    return { list: 'site', reason: String(site.get('reason') ?? 'unsubscribe') }\n  }\n  if (platform?.exists && !platform.get('releasedAt')) {\n    return { list: 'platform', reason: String(platform.get('reason') ?? 'staff') }\n  }\n  return null\n}\n\n/** Milliseconds from a stored Firestore timestamp or a number, else `null`. */\nfunction storedMs(value: unknown): number | null {\n  if (typeof value === 'number' && Number.isFinite(value)) return value\n  const toMillis = (value as { toMillis?: () => number } | null)?.toMillis\n  return typeof toMillis === 'function' ? toMillis.call(value) : null\n}\n\n/**\n * Where the address stands on {@link PLATFORM_MARKETING_TOPIC_ID}.\n *\n * The site's per-topic record, read by key and through the one function that\n * knows its three states — the same read `filterTopicSendable` makes before\n * a campaign on that list goes out. No record is `subscribed`: nobody has\n * left a list they were never taken off.\n */\nasync function readPlatformMarketingTopic(\n  db: any,\n  hostId: string,\n  email: string,\n): Promise<PlatformMarketingTopicState> {\n  const key = emailSuppressionKey(email)\n  const unrecorded = { id: PLATFORM_MARKETING_TOPIC_ID, state: 'subscribed' as const, leftAtMs: null }\n  if (!key) return unrecorded\n  const snapshot = await db\n    .collection('hosts')\n    .doc(hostId)\n    .collection(TOPIC_OPT_OUTS_SUBCOLLECTION)\n    .doc(key)\n    .get()\n  if (!snapshot?.exists) return unrecorded\n  const entry = ((snapshot.get('topics') ?? {}) as Record<string, TopicSubscriptionEntry | undefined>)[\n    PLATFORM_MARKETING_TOPIC_ID\n  ]\n  const state = readTopicSubscriptionState(entry)\n  return {\n    id: PLATFORM_MARKETING_TOPIC_ID,\n    state,\n    leftAtMs: state === 'opted-out' ? storedMs(entry?.optedOutAt) : null,\n  }\n}\n\n/**\n * Reads {@link PlatformMarketingReach} for an address.\n *\n * Never throws: a failed read is `unreadable`, which the staff page shows as\n * unknown — never as \"no consent\", which would be a claim about the person.\n */\nexport async function readPlatformMarketingReach(input: {\n  email: string | null | undefined\n  /** Injectable for tests; defaults to {@link platformMarketingHostId}. */\n  hostId?: string | null\n  /** Injectable for tests; defaults to the admin app's Firestore. */\n  firestore?: any\n}): Promise<PlatformMarketingReach> {\n  const hostId =\n    input.hostId === undefined ? platformMarketingHostId() : input.hostId\n  if (!hostId) return { status: 'unconfigured' }\n  const email = String(input.email ?? '').trim().toLowerCase()\n  if (!email) return { status: 'no-email' }\n  const db = input.firestore ?? firestore()\n  try {\n    const owner = await getOrgForHost(hostId)\n    if (!owner) return { status: 'unreadable', hostId }\n    const org = owner.org as Record<string, unknown>\n    const [contact, group, suppression, topic] = await Promise.all([\n      // Through the org-data seam, as the capture door finds the same row.\n      orgDataCollectionForHost(hostId, 'contacts').then((contacts) =>\n        findContactByEmail(contacts, email),\n      ),\n      consentGroupForSite(hostId, org),\n      readPlatformMarketingSuppression(db, hostId, email),\n      readPlatformMarketingTopic(db, hostId, email),\n    ])\n    const record = readMarketingBasis(\n      (contact?.data?.() as Record<string, unknown> | undefined) ?? null,\n      group,\n    )\n    const decision = marketingConsentDecision(\n      record,\n      resolveMarketingConsentPolicy(org['marketingConsentPolicy']),\n    )\n    return {\n      status: 'read',\n      hostId,\n      orgId: owner.orgId,\n      orgSlug: typeof org['slug'] === 'string' ? org['slug'] : null,\n      contactId: contact?.id ?? null,\n      basis: record.basis,\n      basisAtMs: record.basisAtMs,\n      assertedBy: record.assertedBy,\n      basisKind: record.source?.kind ?? null,\n      verdict: decision.verdict,\n      reason: decision.reason,\n      suppression,\n      topic,\n    }\n  } catch (error) {\n    console.error('[platform-marketing-consent] reach read failed', error)\n    return { status: 'unreadable', hostId }\n  }\n}\n\n/**\n * Why somebody who said Yes will not receive product updates, in the terms\n * of what they can do about it (AGL-3305) — or `null` when nothing on the\n * marketing site's lists stands in the way.\n *\n * - `unsubscribed`: they left everything, or left product updates, from an\n *   email. Theirs to undo, and a Yes from a verified account does.\n * - `unconfirmed`: a confirmation for the list was asked and not answered.\n * - `paused`: a bounce, a complaint, an erasure or a staff hold. Not a\n *   preference, so no switch of theirs lifts it.\n *\n * The consent basis is not judged here: the Yes this is asked about is the\n * basis. Only the lists a Yes cannot overrule are.\n */\nexport type PlatformMarketingHold =\n  | { kind: 'unsubscribed' }\n  | { kind: 'unconfirmed' }\n  | { kind: 'paused'; reason: string }\n\nexport function platformMarketingHold(\n  reach: PlatformMarketingReach,\n): PlatformMarketingHold | null {\n  if (reach.status !== 'read') return null\n  if (reach.suppression) {\n    return reach.suppression.list === 'site' && reach.suppression.reason === 'unsubscribe'\n      ? { kind: 'unsubscribed' }\n      : { kind: 'paused', reason: reach.suppression.reason }\n  }\n  if (reach.topic.state === 'opted-out') return { kind: 'unsubscribed' }\n  if (reach.topic.state === 'pending') return { kind: 'unconfirmed' }\n  return null\n}\n\n/** What mirroring an email-side change onto the account did (AGL-3305). */\nexport type PlatformMarketingMirrorOutcome =\n  /** Another site's list. An account is never touched from one. */\n  | { status: 'not-platform' }\n  /** A list the account's answer is not about. */\n  | { status: 'other-list' }\n  /** No account holds the address — or more than one does. */\n  | { status: 'no-account' }\n  /** The account already says so, or the rule leaves it where it is. */\n  | { status: 'unchanged' }\n  | { status: 'recorded'; uid: string; decision: PlatformMarketingConsentDecision }\n  /** Logged; the site's own write, which is what stops the mail, stands. */\n  | { status: 'failed' }\n\nexport interface PlatformMarketingMirrorInput {\n  /** The site whose page the person used. */\n  hostId: string\n  /** The address the signed link was for. */\n  email: string\n  /** Injectable for tests; defaults to the clock. */\n  now?: number\n  /** Injectable for tests; defaults to the admin app's Firestore. */\n  firestore?: any\n  /** Injectable for tests; defaults to {@link platformMarketingHostId}. */\n  platformHostId?: string | null\n  /**\n   * Injectable for tests; defaults to `attributableAccountForAddress`, which\n   * answers `null` for nobody AND for more than one account. Changing the\n   * wrong person's answer is worse than changing nobody's.\n   */\n  findAccount?: (email: string) => Promise<string | null>\n}\n\n/** The account a mirror would write, or the reason there is none. */\nasync function mirrorTarget(\n  input: PlatformMarketingMirrorInput,\n): Promise<{ uid: string; ref: any; state: PlatformMarketingConsentState } | PlatformMarketingMirrorOutcome> {\n  const platformHost =\n    input.platformHostId === undefined ? platformMarketingHostId() : input.platformHostId\n  if (!platformHost || input.hostId !== platformHost) return { status: 'not-platform' }\n  const uid = await (input.findAccount ?? ((email: string) => attributableAccountForAddress(email)))(\n    input.email,\n  )\n  if (!uid) return { status: 'no-account' }\n  const ref = (input.firestore ?? firestore()).collection('users').doc(uid)\n  const snapshot = await ref.get()\n  return {\n    uid,\n    ref,\n    state: readPlatformMarketingConsent(\n      (snapshot?.data?.() as Record<string, unknown> | undefined) ?? null,\n    ),\n  }\n}\n\n/**\n * Mirrors an unsubscribe from the marketing site onto the account's answer.\n *\n * Called by the site's own pages AFTER their write, with what the person\n * left: `'everything'` for the site's list, or the topics left on the\n * preference page. Only the platform's marketing site counts, and only a\n * list the answer is about — {@link PLATFORM_MARKETING_TOPIC_ID}, which\n * everything includes. The first No keeps its date and its door: a second\n * unsubscribe is not a later decision.\n *\n * Never throws. The page has already stopped the mail; this is the account\n * catching up with it.\n */\nexport async function mirrorPlatformUnsubscribe(\n  input: PlatformMarketingMirrorInput & { left: 'everything' | readonly string[] },\n): Promise<PlatformMarketingMirrorOutcome> {\n  try {\n    const everything = input.left === 'everything'\n    if (!everything && !input.left.includes(PLATFORM_MARKETING_TOPIC_ID)) {\n      // Cheaper to answer before the account lookup, and the answer does not\n      // depend on the site: no other list is this one on any site.\n      const platformHost =\n        input.platformHostId === undefined ? platformMarketingHostId() : input.platformHostId\n      return input.hostId === platformHost ? { status: 'other-list' } : { status: 'not-platform' }\n    }\n    const target = await mirrorTarget(input)\n    if ('status' in target) return target\n    if (target.state.decision === 'declined') return { status: 'unchanged' }\n    const atMs = input.now ?? Date.now()\n    const source = platformMarketingEmailSource(\n      everything\n        ? { kind: 'email-unsubscribe', decision: 'declined', uid: target.uid, atMs }\n        : { kind: 'email-preferences', decision: 'declined', uid: target.uid, atMs },\n    )\n    await target.ref.set(\n      platformMarketingUserFields({ decision: 'declined', atMs, source }),\n      { merge: true },\n    )\n    return { status: 'recorded', uid: target.uid, decision: 'declined' }\n  } catch (error) {\n    console.error('[platform-marketing-consent] could not mirror an unsubscribe onto the account', error)\n    return { status: 'failed' }\n  }\n}\n\n/**\n * Mirrors a way back in from the marketing site: the resubscribe link, or\n * the list ticked again on the preference page.\n *\n * Narrower than the unsubscribe on purpose. It restores only a No that an\n * email door recorded — a No given in the console is the person's answer in\n * the console, and a link in an email does not overturn it — and only once\n * product updates would really reach them: nothing on either suppression\n * list, and the list itself not left. A resubscribe that lifted the site's\n * list while product updates stay unticked restores nothing.\n */\nexport async function mirrorPlatformResubscribe(\n  input: PlatformMarketingMirrorInput & { via: 'email-resubscribe' | 'email-preferences' },\n): Promise<PlatformMarketingMirrorOutcome> {\n  try {\n    const target = await mirrorTarget(input)\n    if ('status' in target) return target\n    if (\n      target.state.decision !== 'declined' ||\n      !isPlatformMarketingEmailSourceKind(target.state.sourceKind)\n    ) {\n      return { status: 'unchanged' }\n    }\n    const db = input.firestore ?? firestore()\n    const [suppression, topic] = await Promise.all([\n      readPlatformMarketingSuppression(db, input.hostId, input.email),\n      readPlatformMarketingTopic(db, input.hostId, input.email),\n    ])\n    if (suppression || topic.state !== 'subscribed') return { status: 'unchanged' }\n    const atMs = input.now ?? Date.now()\n    const source = platformMarketingEmailSource({\n      kind: input.via,\n      decision: 'granted',\n      uid: target.uid,\n      atMs,\n    })\n    await target.ref.set(\n      platformMarketingUserFields({ decision: 'granted', atMs, source }),\n      { merge: true },\n    )\n    return { status: 'recorded', uid: target.uid, decision: 'granted' }\n  } catch (error) {\n    console.error('[platform-marketing-consent] could not mirror a resubscribe onto the account', error)\n    return { status: 'failed' }\n  }\n}\n"],"names":["readTopicSubscriptionState","TOPIC_OPT_OUTS_SUBCOLLECTION","isPlatformMarketingConsentDecision","isPlatformMarketingConsoleSourceKind","isPlatformMarketingEmailSourceKind","platformMarketingConsentSource","platformMarketingEmailSource","PLATFORM_MARKETING_TOPIC_ID","platformMarketingUserFields","readPlatformMarketingConsent","USER_MARKETING_PROMPT_DISMISSED_AT_FIELD","marketingConsentDecision","readMarketingBasis","resolveMarketingConsentPolicy","rejoinEmailStream","attributableAccountForAddress","findContactByEmail","EMAIL_SUPPRESSIONS_COLLECTION","emailSuppressionKey","HOST_SUPPRESSIONS_SUBCOLLECTION","firebaseAdmin","consentGroupForSite","getOrgForHost","orgDataCollectionForHost","upsertHostContact","firestore","app","PLATFORM_MARKETING_HOST_ID_ENV","platformMarketingHostId","process","value","String","env","PLATFORM_MARKETING_HOST_ID","trim","accountName","snapshot","fallback","first","get","last","stored","filter","Boolean","join","undefined","recordPlatformMarketingConsent","input","uid","Error","decision","source","textVersion","atMs","now","Date","kind","userRef","collection","doc","set","merge","hostId","contact","status","email","name","verdict","upsert","interaction","summary","reason","marketingConsent","declineMarketingConsent","marketingConsentSource","initialLifecycleStage","refused","contactId","created","stream","mailboxVerified","rejoin","topicId","snoozePlatformMarketingPrompt","options","trimmed","readPlatformMarketingConsentForUser","data","readPlatformMarketingSuppression","db","key","site","platform","Promise","all","exists","list","storedMs","Number","isFinite","toMillis","call","readPlatformMarketingTopic","unrecorded","id","state","leftAtMs","entry","optedOutAt","readPlatformMarketingReach","toLowerCase","record","owner","org","group","suppression","topic","then","contacts","orgId","orgSlug","basis","basisAtMs","assertedBy","basisKind","error","console","platformMarketingHold","reach","mirrorTarget","platformHost","platformHostId","findAccount","ref","mirrorPlatformUnsubscribe","everything","left","includes","target","mirrorPlatformResubscribe","sourceKind","via"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDC,GAED,SACEA,0BAA0B,EAC1BC,4BAA4B,QAGvB,sCAAqC;AAC5C,SACEC,kCAAkC,EAClCC,oCAAoC,EACpCC,kCAAkC,EAIlCC,8BAA8B,EAC9BC,4BAA4B,EAC5BC,2BAA2B,EAC3BC,2BAA2B,EAC3BC,4BAA4B,EAC5BC,wCAAwC,QACnC,oDAAmD;AAC1D,SACEC,wBAAwB,EAKxBC,kBAAkB,EAClBC,6BAA6B,QACxB,2CAA0C;AACjD,SAEEC,iBAAiB,QACZ,mDAAkD;AACzD,SAASC,6BAA6B,QAAQ,yBAAqB;AACnE,SAASC,kBAAkB,QAAQ,2BAAuB;AAC1D,SACEC,6BAA6B,EAC7BC,mBAAmB,EACnBC,+BAA+B,QAC1B,yBAAqB;AAC5B,OAAOC,mBAAmB,sBAAkB;AAC5C,SACEC,mBAAmB,EACnBC,aAAa,EACbC,wBAAwB,QACnB,qBAAiB;AACxB,SAASC,iBAAiB,QAAQ,sBAAkB;AAEpD,MAAMC,YAAY,IAAML,cAAcM,GAAG,GAAGD,SAAS;AAErD;;;;CAIC,GACD,OAAO,MAAME,iCAAiC,6BAA4B;AAE1E;;;;;;CAMC,GACD,OAAO,SAASC;QACOC;IAArB,MAAMC,QAAQC,QAAOF,0CAAAA,QAAQG,GAAG,CAACC,0BAA0B,YAAtCJ,0CAA0C,IAAIK,IAAI;IACvE,OAAOJ,SAAS;AAClB;AA0DA;;;;;;CAMC,GACD,SAASK,YACPC,QAAiE,EACjEC,QAAmC;;QAEdD,eACDA;IADpB,MAAME,QAAQP,eAAOK,6BAAAA,gBAAAA,SAAUG,GAAG,qBAAbH,mBAAAA,UAAgB,+BAAgB,IAAIF,IAAI;IAC7D,MAAMM,OAAOT,gBAAOK,6BAAAA,iBAAAA,SAAUG,GAAG,qBAAbH,oBAAAA,UAAgB,+BAAe,IAAIF,IAAI;IAC3D,MAAMO,SAAS;QAACH;QAAOE;KAAK,CAACE,MAAM,CAACC,SAASC,IAAI,CAAC;IAClD,OAAOH,UAAUV,OAAOM,mBAAAA,WAAY,IAAIH,IAAI,MAAMW;AACpD;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeC,+BACpBC,KAA0C;QAEvBA,YAQQA,oBAKdA,YASIA,kBAUIA,cAIEA,eAiCZA;IArEX,MAAMC,MAAMjB,QAAOgB,aAAAA,MAAMC,GAAG,YAATD,aAAa,IAAIb,IAAI;IACxC,IAAI,CAACc,KAAK,MAAM,IAAIC,MAAM;IAC1B,IAAI,CAAC/C,mCAAmC6C,MAAMG,QAAQ,GAAG;QACvD,MAAM,IAAID,MAAM;IAClB;IACA,IAAI,CAAC9C,qCAAqC4C,MAAMI,MAAM,GAAG;QACvD,MAAM,IAAIF,MAAM;IAClB;IACA,MAAMG,cAAcrB,QAAOgB,qBAAAA,MAAMK,WAAW,YAAjBL,qBAAqB,IAAIb,IAAI;IACxD,IAAI,CAACkB,aAAa;QAChB,MAAM,IAAIH,MAAM;IAClB;IAEA,MAAMI,QAAON,aAAAA,MAAMO,GAAG,YAATP,aAAaQ,KAAKD,GAAG;IAClC,MAAMH,SAAS9C,+BAA+B;QAC5CmD,MAAMT,MAAMI,MAAM;QAClBD,UAAUH,MAAMG,QAAQ;QACxBF;QACAK;QACAD;IACF;IAEA,MAAMK,UAAU,EAACV,mBAAAA,MAAMtB,SAAS,YAAfsB,mBAAmBtB,aAAaiC,UAAU,CAAC,SAASC,GAAG,CAACX;IACzE,MAAMZ,WAAW,MAAMqB,QAAQlB,GAAG;IAClC,MAAMkB,QAAQG,GAAG,CACfpD,4BAA4B;QAAE0C,UAAUH,MAAMG,QAAQ;QAAEG;QAAMF;IAAO,IACrE;QAAEU,OAAO;IAAK;IAGhB,MAAMC,SACJf,MAAMe,MAAM,KAAKjB,YAAYjB,4BAA4BmB,MAAMe,MAAM;IACvE,IAAI,CAACA,QAAQ,OAAO;QAAET;QAAMU,SAAS;YAAEC,QAAQ;QAAe;IAAE;IAChE,MAAMC,QAAQlC,QAAOgB,eAAAA,MAAMkB,KAAK,YAAXlB,eAAe,IAAIb,IAAI;IAC5C,IAAI,CAAC+B,OAAO,OAAO;QAAEZ;QAAMU,SAAS;YAAEC,QAAQ;QAAW;IAAE;IAE3D,MAAME,OAAO/B,YAAYC,UAAUW,MAAMmB,IAAI;IAC7C,MAAMC,UAAU,MAAM,EAACpB,gBAAAA,MAAMqB,MAAM,YAAZrB,gBAAgBvB,mBAAmB;QACxDsC;QACAG;OACIC,OAAO;QAAEA;IAAK,IAAI,CAAC;QACvBf,QAAQ;QACR,uEAAuE;QACvE,iDAAiD;QACjDkB,aAAa;YAAEhB;YAAMiB,SAASnB,OAAOoB,MAAM;QAAC;OACxCxB,MAAMG,QAAQ,KAAK,YACnB;QAAEsB,kBAAkB;IAAK,IACzB;QAAEC,yBAAyB;IAAK;QACpCC,wBAAwBvB;QACxB,uEAAuE;QACvE,wEAAwE;QACxE,mBAAmB;QACnBwB,uBAAuB;;IAEzB,MAAMZ,UACJ,aAAaI,UACT;QAAEH,QAAQ;QAAWO,QAAQJ,QAAQS,OAAO;IAAC,IAC7C;QAAEZ,QAAQ;QAAYa,WAAWV,QAAQU,SAAS;QAAEC,SAASX,QAAQW,OAAO;IAAC;IACnF,IAAI/B,MAAMG,QAAQ,KAAK,WAAW,OAAO;QAAEG;QAAMU;IAAQ;IAEzD;;;;;;;;GAQC,GACD,MAAMgB,SAAyChC,MAAMiC,eAAe,GAChE,MAAM,EAACjC,gBAAAA,MAAMkC,MAAM,YAAZlC,gBAAgBjC,mBAAmB;QACxCgD;QACAG;QACAiB,SAAS3E;IACX,KACA;QAAEyD,QAAQ;IAAa;IAC3B,OAAO;QAAEX;QAAMU;QAASgB;IAAO;AACjC;AAEA;;;CAGC,GACD,OAAO,eAAeI,8BACpBnC,GAAW,EACXoC,UAA6C,CAAC,CAAC;QAIlCA,cACNA;IAHP,MAAMC,UAAUtD,OAAOiB,cAAAA,MAAO,IAAId,IAAI;IACtC,IAAI,CAACmD,SAAS,MAAM,IAAIpC,MAAM;IAC9B,MAAMI,QAAO+B,eAAAA,QAAQ9B,GAAG,YAAX8B,eAAe7B,KAAKD,GAAG;IACpC,MAAM,EAAC8B,qBAAAA,QAAQ3D,SAAS,YAAjB2D,qBAAqB3D,aACzBiC,UAAU,CAAC,SACXC,GAAG,CAAC0B,SACJzB,GAAG,CAAC;QAAE,CAAClD,yCAAyC,EAAE2C;IAAK,GAAG;QAAEQ,OAAO;IAAK;IAC3E,OAAO;QAAER;IAAK;AAChB;AAEA,2EAA2E,GAC3E,OAAO,eAAeiC,oCACpBtC,GAAW,EACXoC,UAA+B,CAAC,CAAC;QAITA;QAKrBhD;IAPH,MAAMiD,UAAUtD,OAAOiB,cAAAA,MAAO,IAAId,IAAI;IACtC,IAAI,CAACmD,SAAS,MAAM,IAAIpC,MAAM;IAC9B,MAAMb,WAAW,MAAM,EAACgD,qBAAAA,QAAQ3D,SAAS,YAAjB2D,qBAAqB3D,aAC1CiC,UAAU,CAAC,SACXC,GAAG,CAAC0B,SACJ9C,GAAG;IACN,OAAO9B,qCACJ2B,6BAAAA,iBAAAA,SAAUmD,IAAI,qBAAdnD,oBAAAA,4BAA8D;AAEnE;AAoEA;;;;;;;CAOC,GACD,eAAeoD,iCACbC,EAAO,EACP3B,MAAc,EACdG,KAAa;IAEb,MAAMyB,MAAMxE,oBAAoB+C;IAChC,IAAI,CAACyB,KAAK,OAAO;IACjB,MAAM,CAACC,MAAMC,SAAS,GAAG,MAAMC,QAAQC,GAAG,CAAC;QACzCL,GACG/B,UAAU,CAAC,SACXC,GAAG,CAACG,QACJJ,UAAU,CAACvC,iCACXwC,GAAG,CAAC+B,KACJnD,GAAG;QACNkD,GAAG/B,UAAU,CAACzC,+BAA+B0C,GAAG,CAAC+B,KAAKnD,GAAG;KAC1D;IACD,IAAIoD,wBAAAA,KAAMI,MAAM,EAAE;YACsBJ;QAAtC,OAAO;YAAEK,MAAM;YAAQzB,QAAQxC,QAAO4D,YAAAA,KAAKpD,GAAG,CAAC,qBAAToD,YAAsB;QAAe;IAC7E;IACA,IAAIC,CAAAA,4BAAAA,SAAUG,MAAM,KAAI,CAACH,SAASrD,GAAG,CAAC,eAAe;YACTqD;QAA1C,OAAO;YAAEI,MAAM;YAAYzB,QAAQxC,QAAO6D,gBAAAA,SAASrD,GAAG,CAAC,qBAAbqD,gBAA0B;QAAS;IAC/E;IACA,OAAO;AACT;AAEA,6EAA6E,GAC7E,SAASK,SAASnE,KAAc;IAC9B,IAAI,OAAOA,UAAU,YAAYoE,OAAOC,QAAQ,CAACrE,QAAQ,OAAOA;IAChE,MAAMsE,WAAYtE,yBAAD,AAACA,MAA8CsE,QAAQ;IACxE,OAAO,OAAOA,aAAa,aAAaA,SAASC,IAAI,CAACvE,SAAS;AACjE;AAEA;;;;;;;CAOC,GACD,eAAewE,2BACbb,EAAO,EACP3B,MAAc,EACdG,KAAa;QAYG7B;IAVhB,MAAMsD,MAAMxE,oBAAoB+C;IAChC,MAAMsC,aAAa;QAAEC,IAAIjG;QAA6BkG,OAAO;QAAuBC,UAAU;IAAK;IACnG,IAAI,CAAChB,KAAK,OAAOa;IACjB,MAAMnE,WAAW,MAAMqD,GACpB/B,UAAU,CAAC,SACXC,GAAG,CAACG,QACJJ,UAAU,CAACzD,8BACX0D,GAAG,CAAC+B,KACJnD,GAAG;IACN,IAAI,EAACH,4BAAAA,SAAU2D,MAAM,GAAE,OAAOQ;IAC9B,MAAMI,QAAQ,EAAEvE,gBAAAA,SAASG,GAAG,CAAC,qBAAbH,gBAA0B,CAAC,EAAyD,CAClG7B,4BACD;IACD,MAAMkG,QAAQzG,2BAA2B2G;IACzC,OAAO;QACLH,IAAIjG;QACJkG;QACAC,UAAUD,UAAU,cAAcR,SAASU,yBAAAA,MAAOC,UAAU,IAAI;IAClE;AACF;AAEA;;;;;CAKC,GACD,OAAO,eAAeC,2BAA2B9D,KAMhD;QAIsBA,cAEVA;IALX,MAAMe,SACJf,MAAMe,MAAM,KAAKjB,YAAYjB,4BAA4BmB,MAAMe,MAAM;IACvE,IAAI,CAACA,QAAQ,OAAO;QAAEE,QAAQ;IAAe;IAC7C,MAAMC,QAAQlC,QAAOgB,eAAAA,MAAMkB,KAAK,YAAXlB,eAAe,IAAIb,IAAI,GAAG4E,WAAW;IAC1D,IAAI,CAAC7C,OAAO,OAAO;QAAED,QAAQ;IAAW;IACxC,MAAMyB,MAAK1C,mBAAAA,MAAMtB,SAAS,YAAfsB,mBAAmBtB;IAC9B,IAAI;;YAcCsC,eAgBUgD;QA7Bb,MAAMC,QAAQ,MAAM1F,cAAcwC;QAClC,IAAI,CAACkD,OAAO,OAAO;YAAEhD,QAAQ;YAAcF;QAAO;QAClD,MAAMmD,MAAMD,MAAMC,GAAG;QACrB,MAAM,CAAClD,SAASmD,OAAOC,aAAaC,MAAM,GAAG,MAAMvB,QAAQC,GAAG,CAAC;YAC7D,qEAAqE;YACrEvE,yBAAyBuC,QAAQ,YAAYuD,IAAI,CAAC,CAACC,WACjDtG,mBAAmBsG,UAAUrD;YAE/B5C,oBAAoByC,QAAQmD;YAC5BzB,iCAAiCC,IAAI3B,QAAQG;YAC7CqC,2BAA2Bb,IAAI3B,QAAQG;SACxC;QACD,MAAM8C,SAASnG,2BACZmD,4BAAAA,gBAAAA,QAASwB,IAAI,qBAAbxB,mBAAAA,2BAA6D,MAC9DmD;QAEF,MAAMhE,WAAWvC,yBACfoG,QACAlG,8BAA8BoG,GAAG,CAAC,yBAAyB;QAE7D,OAAO;YACLjD,QAAQ;YACRF;YACAyD,OAAOP,MAAMO,KAAK;YAClBC,SAAS,OAAOP,GAAG,CAAC,OAAO,KAAK,WAAWA,GAAG,CAAC,OAAO,GAAG;YACzDpC,SAAS,WAAEd,2BAAAA,QAASyC,EAAE,oBAAI;YAC1BiB,OAAOV,OAAOU,KAAK;YACnBC,WAAWX,OAAOW,SAAS;YAC3BC,YAAYZ,OAAOY,UAAU;YAC7BC,SAAS,YAAEb,iBAAAA,OAAO5D,MAAM,qBAAb4D,eAAevD,IAAI,oBAAI;YAClCW,SAASjB,SAASiB,OAAO;YACzBI,QAAQrB,SAASqB,MAAM;YACvB4C;YACAC;QACF;IACF,EAAE,OAAOS,OAAO;QACdC,QAAQD,KAAK,CAAC,kDAAkDA;QAChE,OAAO;YAAE7D,QAAQ;YAAcF;QAAO;IACxC;AACF;AAqBA,OAAO,SAASiE,sBACdC,KAA6B;IAE7B,IAAIA,MAAMhE,MAAM,KAAK,QAAQ,OAAO;IACpC,IAAIgE,MAAMb,WAAW,EAAE;QACrB,OAAOa,MAAMb,WAAW,CAACnB,IAAI,KAAK,UAAUgC,MAAMb,WAAW,CAAC5C,MAAM,KAAK,gBACrE;YAAEf,MAAM;QAAe,IACvB;YAAEA,MAAM;YAAUe,QAAQyD,MAAMb,WAAW,CAAC5C,MAAM;QAAC;IACzD;IACA,IAAIyD,MAAMZ,KAAK,CAACX,KAAK,KAAK,aAAa,OAAO;QAAEjD,MAAM;IAAe;IACrE,IAAIwE,MAAMZ,KAAK,CAACX,KAAK,KAAK,WAAW,OAAO;QAAEjD,MAAM;IAAc;IAClE,OAAO;AACT;AAmCA,mEAAmE,GACnE,eAAeyE,aACblF,KAAmC;QAKhBA,oBAINA;QAMRX;IAbL,MAAM8F,eACJnF,MAAMoF,cAAc,KAAKtF,YAAYjB,4BAA4BmB,MAAMoF,cAAc;IACvF,IAAI,CAACD,gBAAgBnF,MAAMe,MAAM,KAAKoE,cAAc,OAAO;QAAElE,QAAQ;IAAe;IACpF,MAAMhB,MAAM,MAAM,EAACD,qBAAAA,MAAMqF,WAAW,YAAjBrF,qBAAsB,CAACkB,QAAkBlD,8BAA8BkD,QACxFlB,MAAMkB,KAAK;IAEb,IAAI,CAACjB,KAAK,OAAO;QAAEgB,QAAQ;IAAa;IACxC,MAAMqE,MAAM,EAACtF,mBAAAA,MAAMtB,SAAS,YAAfsB,mBAAmBtB,aAAaiC,UAAU,CAAC,SAASC,GAAG,CAACX;IACrE,MAAMZ,WAAW,MAAMiG,IAAI9F,GAAG;IAC9B,OAAO;QACLS;QACAqF;QACA5B,OAAOhG,qCACJ2B,6BAAAA,iBAAAA,SAAUmD,IAAI,qBAAdnD,oBAAAA,4BAA8D;IAEnE;AACF;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,eAAekG,0BACpBvF,KAAgF;IAEhF,IAAI;YAYWA;QAXb,MAAMwF,aAAaxF,MAAMyF,IAAI,KAAK;QAClC,IAAI,CAACD,cAAc,CAACxF,MAAMyF,IAAI,CAACC,QAAQ,CAAClI,8BAA8B;YACpE,uEAAuE;YACvE,6DAA6D;YAC7D,MAAM2H,eACJnF,MAAMoF,cAAc,KAAKtF,YAAYjB,4BAA4BmB,MAAMoF,cAAc;YACvF,OAAOpF,MAAMe,MAAM,KAAKoE,eAAe;gBAAElE,QAAQ;YAAa,IAAI;gBAAEA,QAAQ;YAAe;QAC7F;QACA,MAAM0E,SAAS,MAAMT,aAAalF;QAClC,IAAI,YAAY2F,QAAQ,OAAOA;QAC/B,IAAIA,OAAOjC,KAAK,CAACvD,QAAQ,KAAK,YAAY,OAAO;YAAEc,QAAQ;QAAY;QACvE,MAAMX,QAAON,aAAAA,MAAMO,GAAG,YAATP,aAAaQ,KAAKD,GAAG;QAClC,MAAMH,SAAS7C,6BACbiI,aACI;YAAE/E,MAAM;YAAqBN,UAAU;YAAYF,KAAK0F,OAAO1F,GAAG;YAAEK;QAAK,IACzE;YAAEG,MAAM;YAAqBN,UAAU;YAAYF,KAAK0F,OAAO1F,GAAG;YAAEK;QAAK;QAE/E,MAAMqF,OAAOL,GAAG,CAACzE,GAAG,CAClBpD,4BAA4B;YAAE0C,UAAU;YAAYG;YAAMF;QAAO,IACjE;YAAEU,OAAO;QAAK;QAEhB,OAAO;YAAEG,QAAQ;YAAYhB,KAAK0F,OAAO1F,GAAG;YAAEE,UAAU;QAAW;IACrE,EAAE,OAAO2E,OAAO;QACdC,QAAQD,KAAK,CAAC,iFAAiFA;QAC/F,OAAO;YAAE7D,QAAQ;QAAS;IAC5B;AACF;AAEA;;;;;;;;;;CAUC,GACD,OAAO,eAAe2E,0BACpB5F,KAAwF;IAExF,IAAI;YASSA,kBAMEA;QAdb,MAAM2F,SAAS,MAAMT,aAAalF;QAClC,IAAI,YAAY2F,QAAQ,OAAOA;QAC/B,IACEA,OAAOjC,KAAK,CAACvD,QAAQ,KAAK,cAC1B,CAAC9C,mCAAmCsI,OAAOjC,KAAK,CAACmC,UAAU,GAC3D;YACA,OAAO;gBAAE5E,QAAQ;YAAY;QAC/B;QACA,MAAMyB,MAAK1C,mBAAAA,MAAMtB,SAAS,YAAfsB,mBAAmBtB;QAC9B,MAAM,CAAC0F,aAAaC,MAAM,GAAG,MAAMvB,QAAQC,GAAG,CAAC;YAC7CN,iCAAiCC,IAAI1C,MAAMe,MAAM,EAAEf,MAAMkB,KAAK;YAC9DqC,2BAA2Bb,IAAI1C,MAAMe,MAAM,EAAEf,MAAMkB,KAAK;SACzD;QACD,IAAIkD,eAAeC,MAAMX,KAAK,KAAK,cAAc,OAAO;YAAEzC,QAAQ;QAAY;QAC9E,MAAMX,QAAON,aAAAA,MAAMO,GAAG,YAATP,aAAaQ,KAAKD,GAAG;QAClC,MAAMH,SAAS7C,6BAA6B;YAC1CkD,MAAMT,MAAM8F,GAAG;YACf3F,UAAU;YACVF,KAAK0F,OAAO1F,GAAG;YACfK;QACF;QACA,MAAMqF,OAAOL,GAAG,CAACzE,GAAG,CAClBpD,4BAA4B;YAAE0C,UAAU;YAAWG;YAAMF;QAAO,IAChE;YAAEU,OAAO;QAAK;QAEhB,OAAO;YAAEG,QAAQ;YAAYhB,KAAK0F,OAAO1F,GAAG;YAAEE,UAAU;QAAU;IACpE,EAAE,OAAO2E,OAAO;QACdC,QAAQD,KAAK,CAAC,gFAAgFA;QAC9F,OAAO;YAAE7D,QAAQ;QAAS;IAC5B;AACF"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/platform-marketing-consent.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The record a console door writes when a person decides about the\n * platform's own product email (AGL-3185).\n *\n * ## Two documents, one decision\n *\n * The decision goes onto the person's own `users/{uid}` first — the console\n * shows the preference from there, and it must not depend on the operator's\n * CRM accepting a row — and then onto the operator's marketing contact for\n * the same address through `upsertHostContact`, which is every other capture\n * door's path and the only one the send-time consent join reads. The contact\n * half carries the decision AND its provenance, so a campaign's audience\n * count reports this basis as the person's own click and never as something\n * asserted on their behalf.\n *\n * ## Server-side, because the client cannot and should not\n *\n * The sign-up page is a client of the person's own project; the operator's\n * marketing org is somebody else's data. Only the Admin SDK writes there, and\n * only after the person's ID token has been verified by the route in front\n * of this module. The user-document half could be a client write — the rules\n * make it owner-writable — but a mirror the client writes and the server\n * reads back is two writers of one fact, so both halves are written here.\n *\n * ## Which host, and why it is a setting\n *\n * The marketing host is the deployment's, not the code's: this repository is\n * what a self-hosted install runs, and an install with no product audience of\n * its own has nowhere for a contact to go. `PLATFORM_MARKETING_HOST_ID` names\n * it, and when it is unset the decision is recorded on the person's document\n * alone. No hostname or document id is hardcoded here for the same reason\n * `platform-marketing-host.ts` gives: nothing in the code knows which site\n * is the operator's.\n *\n * ## The site's own pages answer the same question, for one list (AGL-3305)\n *\n * The marketing site's emails carry their own way out, and it writes the\n * site's lists, not either consent record. An unsubscribe that was about the\n * list the console's question stands for — `PLATFORM_MARKETING_TOPIC_ID`, or\n * everything the site sends — is mirrored onto the ACCOUNT here, through an\n * email door; an unsubscribe from any other list is not, because the person\n * said nothing about product updates. The contact is left alone on purpose:\n * its basis covers every list the site sends, and declining it would stop the\n * newsletter for somebody who only left product updates.\n *\n * The console's switch undoes it the same way, one list wide: a Yes from a\n * verified account asks the plugin that keeps the site's preferences to\n * reopen that list and nothing else (`plugin-email-streams`).\n */\n\nimport {\n  readTopicSubscriptionState,\n  TOPIC_OPT_OUTS_SUBCOLLECTION,\n  type TopicSubscriptionEntry,\n  type TopicSubscriptionState,\n} from '@aglyn/aglyn/app-utils/subscription-topics'\nimport {\n  isPlatformMarketingConsentDecision,\n  isPlatformMarketingConsoleSourceKind,\n  isPlatformMarketingEmailSourceKind,\n  type PlatformMarketingConsentDecision,\n  type PlatformMarketingConsoleSourceKind,\n  type PlatformMarketingConsentState,\n  platformMarketingConsentSource,\n  platformMarketingEmailSource,\n  PLATFORM_MARKETING_TOPIC_ID,\n  platformMarketingUserFields,\n  readPlatformMarketingConsent,\n  USER_MARKETING_PROMPT_DISMISSED_AT_FIELD,\n} from '@aglyn/aglyn/app-utils/platform-marketing-consent'\nimport {\n  marketingConsentDecision,\n  type MarketingBasis,\n  type MarketingConsentAssertedBy,\n  type MarketingConsentReason,\n  type MarketingConsentVerdict,\n  readMarketingBasis,\n  resolveMarketingConsentPolicy,\n} from '@aglyn/aglyn/app-utils/marketing-consent'\nimport {\n  type EmailStreamRejoinOutcome,\n  rejoinEmailStream,\n} from '@aglyn/aglyn/plugin-manager/plugin-email-streams'\nimport { attributableAccountForAddress } from './account-addresses'\nimport { findContactByEmail } from './contact-email-index'\nimport {\n  EMAIL_SUPPRESSIONS_COLLECTION,\n  emailSuppressionKey,\n  HOST_SUPPRESSIONS_SUBCOLLECTION,\n} from './email-suppression'\nimport firebaseAdmin from './firebase-admin'\nimport {\n  consentGroupForSite,\n  getOrgForHost,\n  orgDataCollectionForHost,\n} from './organizations'\nimport { upsertHostContact } from './upsert-contact'\n\nconst firestore = () => firebaseAdmin.app().firestore()\n\n/**\n * The variable naming the host whose contacts receive product-marketing\n * consent — the operator's own marketing site. Unset on a self-hosted\n * install, and honored as \"record the preference, capture no contact\".\n */\nexport const PLATFORM_MARKETING_HOST_ID_ENV = 'PLATFORM_MARKETING_HOST_ID'\n\n/**\n * The configured marketing host, or `null` when the deployment names none.\n *\n * Read at call time rather than at module load, so a test can set it and a\n * process that started without it picks up a later value the same way every\n * other runtime setting here does.\n */\nexport function platformMarketingHostId(): string | null {\n  const value = String(process.env.PLATFORM_MARKETING_HOST_ID ?? '').trim()\n  return value || null\n}\n\n/** What became of the contact half of the record. */\nexport type PlatformMarketingContactOutcome =\n  | { status: 'recorded'; contactId: string; created: boolean }\n  /** No marketing host is configured — a self-hosted install. */\n  | { status: 'unconfigured' }\n  /** The account carries no address a contact could be keyed on. */\n  | { status: 'no-email' }\n  /** The capture door refused the row — its band, an erasure, or an error. */\n  | { status: 'refused'; reason: string }\n\nexport interface RecordPlatformMarketingConsentInput {\n  uid: string\n  /** The account's address, from the verified token. */\n  email: string | null | undefined\n  /** The name the token carries, for an account whose document holds none. */\n  name?: string | null\n  decision: PlatformMarketingConsentDecision\n  /** A console door. An email door is recorded by the site's own pages. */\n  source: PlatformMarketingConsoleSourceKind\n  /** The wording version the door showed, stamped by the route. */\n  textVersion: string\n  /**\n   * Whether the token proves the caller holds the mailbox — its email is\n   * verified (AGL-3305). Only then does a Yes reopen the list on the\n   * marketing site, because reopening it reverses what somebody did from\n   * that mailbox; an unverified account could name a stranger's address.\n   */\n  mailboxVerified?: boolean\n  /** Injectable for tests; defaults to the clock. */\n  now?: number\n  /** Injectable for tests; defaults to the admin app's Firestore. */\n  firestore?: any\n  /** Injectable for tests; defaults to {@link platformMarketingHostId}. */\n  hostId?: string | null\n  /** Injectable for tests; defaults to the real capture door. */\n  upsert?: typeof upsertHostContact\n  /** Injectable for tests; defaults to the `plugin-email-streams` slot. */\n  rejoin?: typeof rejoinEmailStream\n}\n\n/**\n * What a Yes did to the marketing site's own lists (AGL-3305). Absent for a\n * No, and whenever there is no site or no address to reopen a list for.\n */\nexport type PlatformMarketingStreamOutcome =\n  | EmailStreamRejoinOutcome\n  /** The token does not prove the mailbox, so nothing was reopened. */\n  | { status: 'unverified' }\n\nexport interface RecordPlatformMarketingConsentResult {\n  /** The timestamp both documents carry. */\n  atMs: number\n  contact: PlatformMarketingContactOutcome\n  stream?: PlatformMarketingStreamOutcome\n}\n\n/**\n * The name the person's own document holds, else the one the caller has.\n *\n * The sign-up form writes `firstName`/`lastName` onto the document; a Google\n * account carries its name on the token instead. Either is the name the\n * contact row should show, and a blank is left blank rather than invented.\n */\nfunction accountName(\n  snapshot: { get?: (field: string) => unknown } | null | undefined,\n  fallback: string | null | undefined,\n): string | undefined {\n  const first = String(snapshot?.get?.('firstName') ?? '').trim()\n  const last = String(snapshot?.get?.('lastName') ?? '').trim()\n  const stored = [first, last].filter(Boolean).join(' ')\n  return stored || String(fallback ?? '').trim() || undefined\n}\n\n/**\n * Records a decision on both documents.\n *\n * Loud on bad input, like `recordLegalAcceptance`: a decision that cannot be\n * attributed to an account, a door and a wording is not a record of anything.\n * Quiet on the contact half — a refused row is returned, not thrown — because\n * the person's own preference has already been recorded by then, and the\n * operator's CRM band is not a reason to tell them their choice failed.\n */\nexport async function recordPlatformMarketingConsent(\n  input: RecordPlatformMarketingConsentInput,\n): Promise<RecordPlatformMarketingConsentResult> {\n  const uid = String(input.uid ?? '').trim()\n  if (!uid) throw new Error('recordPlatformMarketingConsent: uid is required')\n  if (!isPlatformMarketingConsentDecision(input.decision)) {\n    throw new Error('recordPlatformMarketingConsent: decision is required')\n  }\n  if (!isPlatformMarketingConsoleSourceKind(input.source)) {\n    throw new Error('recordPlatformMarketingConsent: a console source is required')\n  }\n  const textVersion = String(input.textVersion ?? '').trim()\n  if (!textVersion) {\n    throw new Error('recordPlatformMarketingConsent: textVersion is required')\n  }\n\n  const atMs = input.now ?? Date.now()\n  const source = platformMarketingConsentSource({\n    kind: input.source,\n    decision: input.decision,\n    uid,\n    atMs,\n    textVersion,\n  })\n\n  const userRef = (input.firestore ?? firestore()).collection('users').doc(uid)\n  const snapshot = await userRef.get()\n  await userRef.set(\n    platformMarketingUserFields({ decision: input.decision, atMs, source }),\n    { merge: true },\n  )\n\n  const hostId =\n    input.hostId === undefined ? platformMarketingHostId() : input.hostId\n  if (!hostId) return { atMs, contact: { status: 'unconfigured' } }\n  const email = String(input.email ?? '').trim()\n  if (!email) return { atMs, contact: { status: 'no-email' } }\n\n  const name = accountName(snapshot, input.name)\n  const verdict = await (input.upsert ?? upsertHostContact)({\n    hostId,\n    email,\n    ...(name ? { name } : {}),\n    source: 'account',\n    // The sentence the provenance carries is also the timeline row's: what\n    // the person did, in the words an auditor reads.\n    interaction: { atMs, summary: source.reason },\n    ...(input.decision === 'granted'\n      ? { marketingConsent: true }\n      : { declineMarketingConsent: true }),\n    marketingConsentSource: source,\n    // An account on the platform is at least a lead for the platform's own\n    // CRM, whichever way the marketing decision went; the floor never moves\n    // a customer back.\n    initialLifecycleStage: 'lead',\n  })\n  const contact: PlatformMarketingContactOutcome =\n    'refused' in verdict\n      ? { status: 'refused', reason: verdict.refused }\n      : { status: 'recorded', contactId: verdict.contactId, created: verdict.created }\n  if (input.decision !== 'granted') return { atMs, contact }\n\n  /*\n   * A Yes reopens the one list it stands for (AGL-3305).\n   *\n   * After the contact, whatever the contact's outcome: an erasure that\n   * refused the row also left a suppression the plugin will not lift, and it\n   * says so. One list wide, never \"resubscribe to everything\" — somebody who\n   * left every list and now asks for product updates has asked for product\n   * updates.\n   */\n  const stream: PlatformMarketingStreamOutcome = input.mailboxVerified\n    ? await (input.rejoin ?? rejoinEmailStream)({\n        hostId,\n        email,\n        topicId: PLATFORM_MARKETING_TOPIC_ID,\n      })\n    : { status: 'unverified' }\n  return { atMs, contact, stream }\n}\n\n/**\n * Stamps a prompt dismissal — no decision — so the console stays quiet for\n * the snooze window and asks once more after it.\n */\nexport async function snoozePlatformMarketingPrompt(\n  uid: string,\n  options: { now?: number; firestore?: any } = {},\n): Promise<{ atMs: number }> {\n  const trimmed = String(uid ?? '').trim()\n  if (!trimmed) throw new Error('snoozePlatformMarketingPrompt: uid is required')\n  const atMs = options.now ?? Date.now()\n  await (options.firestore ?? firestore())\n    .collection('users')\n    .doc(trimmed)\n    .set({ [USER_MARKETING_PROMPT_DISMISSED_AT_FIELD]: atMs }, { merge: true })\n  return { atMs }\n}\n\n/** The decision the person's own document holds, for the console to show. */\nexport async function readPlatformMarketingConsentForUser(\n  uid: string,\n  options: { firestore?: any } = {},\n): Promise<PlatformMarketingConsentState> {\n  const trimmed = String(uid ?? '').trim()\n  if (!trimmed) throw new Error('readPlatformMarketingConsentForUser: uid is required')\n  const snapshot = await (options.firestore ?? firestore())\n    .collection('users')\n    .doc(trimmed)\n    .get()\n  return readPlatformMarketingConsent(\n    (snapshot?.data?.() as Record<string, unknown> | undefined) ?? null,\n  )\n}\n\n/** An entry on one of the two lists every campaign send passes. */\nexport interface PlatformMarketingSuppression {\n  /** `site`: the marketing site's own list. `platform`: every sender's. */\n  list: 'site' | 'platform'\n  /** `unsubscribe` on the site list; `bounce`, `complaint` or `staff` platform-wide. */\n  reason: string\n}\n\n/**\n * What the operator's own product email would decide about one address\n * (AGL-3292), read the way a campaign from the marketing site reads it.\n *\n * The decision the person made lives on `users/{uid}`, and nothing a send\n * does looks there. A campaign from the configured marketing site reads the\n * CONTACT `recordPlatformMarketingConsent` wrote into that site's\n * organization — its basis for the site, under the organization's policy —\n * and then drops anybody on either suppression list, and a campaign on the\n * product-updates list anybody who left it. An unsubscribe writes those\n * lists; since AGL-3305 one about product updates also turns the account's\n * answer to No, but the contact's basis stays as it was, because it covers\n * every list the site sends. So a staff reader asking \"may we email them?\"\n * needs this half, and needs it from the sender's own readers — the same\n * basis read, consent group, policy and lists — or it answers a question no\n * send asks.\n */\nexport type PlatformMarketingReach =\n  /** No marketing site is configured — a self-hosted install. */\n  | { status: 'unconfigured' }\n  /** The account carries no address a contact could be keyed on. */\n  | { status: 'no-email' }\n  /** A read failed. Nothing about the person follows from it. */\n  | { status: 'unreadable'; hostId: string }\n  | {\n      status: 'read'\n      hostId: string\n      orgId: string\n      orgSlug: string | null\n      /** `null` when the operator's CRM holds no contact for the address. */\n      contactId: string | null\n      basis: MarketingBasis\n      basisAtMs: number | null\n      /** Whose act the basis is — a person's own, or an operator's assertion. */\n      assertedBy: MarketingConsentAssertedBy | null\n      /** Which door recorded the basis (`console-signup`, a form, a backfill). */\n      basisKind: string | null\n      /** The consent rule's answer alone, before either list is consulted. */\n      verdict: MarketingConsentVerdict\n      reason: MarketingConsentReason\n      /** The list that stops every send to the address, when one does. */\n      suppression: PlatformMarketingSuppression | null\n      /**\n       * The address on the list the account's answer stands for (AGL-3305):\n       * `opted-out` when they left product updates, `pending` while a\n       * confirmation is unanswered. A campaign on that list drops both.\n       */\n      topic: PlatformMarketingTopicState\n    }\n\n/** One address on {@link PLATFORM_MARKETING_TOPIC_ID}, as the site stores it. */\nexport interface PlatformMarketingTopicState {\n  id: string\n  state: TopicSubscriptionState\n  /** When they left it, for an `opted-out` state; else `null`. */\n  leftAtMs: number | null\n}\n\n/**\n * The entry that suppresses `email` for sends from `hostId`, if any.\n *\n * The site's own list first, because it is the one a person puts themselves\n * on from this sender's footer; the platform list second. The same two reads\n * `filterSendableForHost` makes: a site entry suppresses by existing, and a\n * platform entry until it is released.\n */\nasync function readPlatformMarketingSuppression(\n  db: any,\n  hostId: string,\n  email: string,\n): Promise<PlatformMarketingSuppression | null> {\n  const key = emailSuppressionKey(email)\n  if (!key) return null\n  const [site, platform] = await Promise.all([\n    db\n      .collection('hosts')\n      .doc(hostId)\n      .collection(HOST_SUPPRESSIONS_SUBCOLLECTION)\n      .doc(key)\n      .get(),\n    db.collection(EMAIL_SUPPRESSIONS_COLLECTION).doc(key).get(),\n  ])\n  if (site?.exists) {\n    return { list: 'site', reason: String(site.get('reason') ?? 'unsubscribe') }\n  }\n  if (platform?.exists && !platform.get('releasedAt')) {\n    return { list: 'platform', reason: String(platform.get('reason') ?? 'staff') }\n  }\n  return null\n}\n\n/** Milliseconds from a stored Firestore timestamp or a number, else `null`. */\nfunction storedMs(value: unknown): number | null {\n  if (typeof value === 'number' && Number.isFinite(value)) return value\n  const toMillis = (value as { toMillis?: () => number } | null)?.toMillis\n  return typeof toMillis === 'function' ? toMillis.call(value) : null\n}\n\n/**\n * Where the address stands on {@link PLATFORM_MARKETING_TOPIC_ID}.\n *\n * The site's per-topic record, read by key and through the one function that\n * knows its three states — the same read `filterTopicSendable` makes before\n * a campaign on that list goes out. No record is `subscribed`: nobody has\n * left a list they were never taken off.\n */\nasync function readPlatformMarketingTopic(\n  db: any,\n  hostId: string,\n  email: string,\n): Promise<PlatformMarketingTopicState> {\n  const key = emailSuppressionKey(email)\n  const unrecorded = { id: PLATFORM_MARKETING_TOPIC_ID, state: 'subscribed' as const, leftAtMs: null }\n  if (!key) return unrecorded\n  const snapshot = await db\n    .collection('hosts')\n    .doc(hostId)\n    .collection(TOPIC_OPT_OUTS_SUBCOLLECTION)\n    .doc(key)\n    .get()\n  if (!snapshot?.exists) return unrecorded\n  const entry = ((snapshot.get('topics') ?? {}) as Record<string, TopicSubscriptionEntry | undefined>)[\n    PLATFORM_MARKETING_TOPIC_ID\n  ]\n  const state = readTopicSubscriptionState(entry)\n  return {\n    id: PLATFORM_MARKETING_TOPIC_ID,\n    state,\n    leftAtMs: state === 'opted-out' ? storedMs(entry?.optedOutAt) : null,\n  }\n}\n\n/**\n * Reads {@link PlatformMarketingReach} for an address.\n *\n * Never throws: a failed read is `unreadable`, which the staff page shows as\n * unknown — never as \"no consent\", which would be a claim about the person.\n */\nexport async function readPlatformMarketingReach(input: {\n  email: string | null | undefined\n  /** Injectable for tests; defaults to {@link platformMarketingHostId}. */\n  hostId?: string | null\n  /** Injectable for tests; defaults to the admin app's Firestore. */\n  firestore?: any\n}): Promise<PlatformMarketingReach> {\n  const hostId =\n    input.hostId === undefined ? platformMarketingHostId() : input.hostId\n  if (!hostId) return { status: 'unconfigured' }\n  const email = String(input.email ?? '').trim().toLowerCase()\n  if (!email) return { status: 'no-email' }\n  const db = input.firestore ?? firestore()\n  try {\n    const owner = await getOrgForHost(hostId)\n    if (!owner) return { status: 'unreadable', hostId }\n    const org = owner.org as Record<string, unknown>\n    const [contact, group, suppression, topic] = await Promise.all([\n      // Through the org-data seam, as the capture door finds the same row.\n      orgDataCollectionForHost(hostId, 'contacts').then((contacts) =>\n        findContactByEmail(contacts, email),\n      ),\n      consentGroupForSite(hostId, org),\n      readPlatformMarketingSuppression(db, hostId, email),\n      readPlatformMarketingTopic(db, hostId, email),\n    ])\n    const record = readMarketingBasis(\n      (contact?.data?.() as Record<string, unknown> | undefined) ?? null,\n      group,\n    )\n    const decision = marketingConsentDecision(\n      record,\n      resolveMarketingConsentPolicy(org['marketingConsentPolicy']),\n    )\n    return {\n      status: 'read',\n      hostId,\n      orgId: owner.orgId,\n      orgSlug: typeof org['slug'] === 'string' ? org['slug'] : null,\n      contactId: contact?.id ?? null,\n      basis: record.basis,\n      basisAtMs: record.basisAtMs,\n      assertedBy: record.assertedBy,\n      basisKind: record.source?.kind ?? null,\n      verdict: decision.verdict,\n      reason: decision.reason,\n      suppression,\n      topic,\n    }\n  } catch (error) {\n    console.error('[platform-marketing-consent] reach read failed', error)\n    return { status: 'unreadable', hostId }\n  }\n}\n\n/**\n * Why somebody who said Yes will not receive product updates, in the terms\n * of what they can do about it (AGL-3305) — or `null` when nothing on the\n * marketing site's lists stands in the way.\n *\n * - `unsubscribed`: they left everything, or left product updates, from an\n *   email. Theirs to undo, and a Yes from a verified account does.\n * - `unconfirmed`: a confirmation for the list was asked and not answered.\n * - `paused`: a bounce, a complaint, an erasure or a staff hold. Not a\n *   preference, so no switch of theirs lifts it.\n *\n * The consent basis is not judged here: the Yes this is asked about is the\n * basis. Only the lists a Yes cannot overrule are.\n */\nexport type PlatformMarketingHold =\n  | { kind: 'unsubscribed' }\n  | { kind: 'unconfirmed' }\n  | { kind: 'paused'; reason: string }\n\nexport function platformMarketingHold(\n  reach: PlatformMarketingReach,\n): PlatformMarketingHold | null {\n  if (reach.status !== 'read') return null\n  if (reach.suppression) {\n    return reach.suppression.list === 'site' && reach.suppression.reason === 'unsubscribe'\n      ? { kind: 'unsubscribed' }\n      : { kind: 'paused', reason: reach.suppression.reason }\n  }\n  if (reach.topic.state === 'opted-out') return { kind: 'unsubscribed' }\n  if (reach.topic.state === 'pending') return { kind: 'unconfirmed' }\n  return null\n}\n\n/** What mirroring an email-side change onto the account did (AGL-3305). */\nexport type PlatformMarketingMirrorOutcome =\n  /** Another site's list. An account is never touched from one. */\n  | { status: 'not-platform' }\n  /** A list the account's answer is not about. */\n  | { status: 'other-list' }\n  /** No account holds the address — or more than one does. */\n  | { status: 'no-account' }\n  /** The account already says so, or the rule leaves it where it is. */\n  | { status: 'unchanged' }\n  | { status: 'recorded'; uid: string; decision: PlatformMarketingConsentDecision }\n  /** Logged; the site's own write, which is what stops the mail, stands. */\n  | { status: 'failed' }\n\nexport interface PlatformMarketingMirrorInput {\n  /** The site whose page the person used. */\n  hostId: string\n  /** The address the signed link was for. */\n  email: string\n  /** Injectable for tests; defaults to the clock. */\n  now?: number\n  /** Injectable for tests; defaults to the admin app's Firestore. */\n  firestore?: any\n  /** Injectable for tests; defaults to {@link platformMarketingHostId}. */\n  platformHostId?: string | null\n  /**\n   * Injectable for tests; defaults to `attributableAccountForAddress`, which\n   * answers `null` for nobody AND for more than one account. Changing the\n   * wrong person's answer is worse than changing nobody's.\n   */\n  findAccount?: (email: string) => Promise<string | null>\n}\n\n/** The account a mirror would write, or the reason there is none. */\nasync function mirrorTarget(\n  input: PlatformMarketingMirrorInput,\n): Promise<{ uid: string; ref: any; state: PlatformMarketingConsentState } | PlatformMarketingMirrorOutcome> {\n  const platformHost =\n    input.platformHostId === undefined ? platformMarketingHostId() : input.platformHostId\n  if (!platformHost || input.hostId !== platformHost) return { status: 'not-platform' }\n  const uid = await (input.findAccount ?? ((email: string) => attributableAccountForAddress(email)))(\n    input.email,\n  )\n  if (!uid) return { status: 'no-account' }\n  const ref = (input.firestore ?? firestore()).collection('users').doc(uid)\n  const snapshot = await ref.get()\n  return {\n    uid,\n    ref,\n    state: readPlatformMarketingConsent(\n      (snapshot?.data?.() as Record<string, unknown> | undefined) ?? null,\n    ),\n  }\n}\n\n/**\n * Mirrors an unsubscribe from the marketing site onto the account's answer.\n *\n * Called by the site's own pages AFTER their write, with what the person\n * left: `'everything'` for the site's list, or the topics left on the\n * preference page. Only the platform's marketing site counts, and only a\n * list the answer is about — {@link PLATFORM_MARKETING_TOPIC_ID}, which\n * everything includes. The first No keeps its date and its door: a second\n * unsubscribe is not a later decision.\n *\n * Never throws. The page has already stopped the mail; this is the account\n * catching up with it.\n */\nexport async function mirrorPlatformUnsubscribe(\n  input: PlatformMarketingMirrorInput & { left: 'everything' | readonly string[] },\n): Promise<PlatformMarketingMirrorOutcome> {\n  try {\n    const everything = input.left === 'everything'\n    if (!everything && !input.left.includes(PLATFORM_MARKETING_TOPIC_ID)) {\n      // Cheaper to answer before the account lookup, and the answer does not\n      // depend on the site: no other list is this one on any site.\n      const platformHost =\n        input.platformHostId === undefined ? platformMarketingHostId() : input.platformHostId\n      return input.hostId === platformHost ? { status: 'other-list' } : { status: 'not-platform' }\n    }\n    const target = await mirrorTarget(input)\n    if ('status' in target) return target\n    if (target.state.decision === 'declined') return { status: 'unchanged' }\n    const atMs = input.now ?? Date.now()\n    const source = platformMarketingEmailSource(\n      everything\n        ? { kind: 'email-unsubscribe', decision: 'declined', uid: target.uid, atMs }\n        : { kind: 'email-preferences', decision: 'declined', uid: target.uid, atMs },\n    )\n    await target.ref.set(\n      platformMarketingUserFields({ decision: 'declined', atMs, source }),\n      { merge: true },\n    )\n    return { status: 'recorded', uid: target.uid, decision: 'declined' }\n  } catch (error) {\n    console.error('[platform-marketing-consent] could not mirror an unsubscribe onto the account', error)\n    return { status: 'failed' }\n  }\n}\n\n/**\n * Mirrors a way back in from the marketing site: the resubscribe link, or\n * the list ticked again on the preference page.\n *\n * Narrower than the unsubscribe on purpose. It restores only a No that an\n * email door recorded — a No given in the console is the person's answer in\n * the console, and a link in an email does not overturn it — and only once\n * product updates would really reach them: nothing on either suppression\n * list, and the list itself not left. A resubscribe that lifted the site's\n * list while product updates stay unticked restores nothing.\n */\nexport async function mirrorPlatformResubscribe(\n  input: PlatformMarketingMirrorInput & { via: 'email-resubscribe' | 'email-preferences' },\n): Promise<PlatformMarketingMirrorOutcome> {\n  try {\n    const target = await mirrorTarget(input)\n    if ('status' in target) return target\n    if (\n      target.state.decision !== 'declined' ||\n      !isPlatformMarketingEmailSourceKind(target.state.sourceKind)\n    ) {\n      return { status: 'unchanged' }\n    }\n    const db = input.firestore ?? firestore()\n    const [suppression, topic] = await Promise.all([\n      readPlatformMarketingSuppression(db, input.hostId, input.email),\n      readPlatformMarketingTopic(db, input.hostId, input.email),\n    ])\n    if (suppression || topic.state !== 'subscribed') return { status: 'unchanged' }\n    const atMs = input.now ?? Date.now()\n    const source = platformMarketingEmailSource({\n      kind: input.via,\n      decision: 'granted',\n      uid: target.uid,\n      atMs,\n    })\n    await target.ref.set(\n      platformMarketingUserFields({ decision: 'granted', atMs, source }),\n      { merge: true },\n    )\n    return { status: 'recorded', uid: target.uid, decision: 'granted' }\n  } catch (error) {\n    console.error('[platform-marketing-consent] could not mirror a resubscribe onto the account', error)\n    return { status: 'failed' }\n  }\n}\n"],"names":["readTopicSubscriptionState","TOPIC_OPT_OUTS_SUBCOLLECTION","isPlatformMarketingConsentDecision","isPlatformMarketingConsoleSourceKind","isPlatformMarketingEmailSourceKind","platformMarketingConsentSource","platformMarketingEmailSource","PLATFORM_MARKETING_TOPIC_ID","platformMarketingUserFields","readPlatformMarketingConsent","USER_MARKETING_PROMPT_DISMISSED_AT_FIELD","marketingConsentDecision","readMarketingBasis","resolveMarketingConsentPolicy","rejoinEmailStream","attributableAccountForAddress","findContactByEmail","EMAIL_SUPPRESSIONS_COLLECTION","emailSuppressionKey","HOST_SUPPRESSIONS_SUBCOLLECTION","firebaseAdmin","consentGroupForSite","getOrgForHost","orgDataCollectionForHost","upsertHostContact","firestore","app","PLATFORM_MARKETING_HOST_ID_ENV","platformMarketingHostId","process","value","String","env","PLATFORM_MARKETING_HOST_ID","trim","accountName","snapshot","fallback","first","get","last","stored","filter","Boolean","join","undefined","recordPlatformMarketingConsent","input","uid","Error","decision","source","textVersion","atMs","now","Date","kind","userRef","collection","doc","set","merge","hostId","contact","status","email","name","verdict","upsert","interaction","summary","reason","marketingConsent","declineMarketingConsent","marketingConsentSource","initialLifecycleStage","refused","contactId","created","stream","mailboxVerified","rejoin","topicId","snoozePlatformMarketingPrompt","options","trimmed","readPlatformMarketingConsentForUser","data","readPlatformMarketingSuppression","db","key","site","platform","Promise","all","exists","list","storedMs","Number","isFinite","toMillis","call","readPlatformMarketingTopic","unrecorded","id","state","leftAtMs","entry","optedOutAt","readPlatformMarketingReach","toLowerCase","record","owner","org","group","suppression","topic","then","contacts","orgId","orgSlug","basis","basisAtMs","assertedBy","basisKind","error","console","platformMarketingHold","reach","mirrorTarget","platformHost","platformHostId","findAccount","ref","mirrorPlatformUnsubscribe","everything","left","includes","target","mirrorPlatformResubscribe","sourceKind","via"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDC,GAED,SACEA,0BAA0B,EAC1BC,4BAA4B,QAGvB,6CAA4C;AACnD,SACEC,kCAAkC,EAClCC,oCAAoC,EACpCC,kCAAkC,EAIlCC,8BAA8B,EAC9BC,4BAA4B,EAC5BC,2BAA2B,EAC3BC,2BAA2B,EAC3BC,4BAA4B,EAC5BC,wCAAwC,QACnC,oDAAmD;AAC1D,SACEC,wBAAwB,EAKxBC,kBAAkB,EAClBC,6BAA6B,QACxB,2CAA0C;AACjD,SAEEC,iBAAiB,QACZ,mDAAkD;AACzD,SAASC,6BAA6B,QAAQ,yBAAqB;AACnE,SAASC,kBAAkB,QAAQ,2BAAuB;AAC1D,SACEC,6BAA6B,EAC7BC,mBAAmB,EACnBC,+BAA+B,QAC1B,yBAAqB;AAC5B,OAAOC,mBAAmB,sBAAkB;AAC5C,SACEC,mBAAmB,EACnBC,aAAa,EACbC,wBAAwB,QACnB,qBAAiB;AACxB,SAASC,iBAAiB,QAAQ,sBAAkB;AAEpD,MAAMC,YAAY,IAAML,cAAcM,GAAG,GAAGD,SAAS;AAErD;;;;CAIC,GACD,OAAO,MAAME,iCAAiC,6BAA4B;AAE1E;;;;;;CAMC,GACD,OAAO,SAASC;QACOC;IAArB,MAAMC,QAAQC,QAAOF,0CAAAA,QAAQG,GAAG,CAACC,0BAA0B,YAAtCJ,0CAA0C,IAAIK,IAAI;IACvE,OAAOJ,SAAS;AAClB;AA0DA;;;;;;CAMC,GACD,SAASK,YACPC,QAAiE,EACjEC,QAAmC;;QAEdD,eACDA;IADpB,MAAME,QAAQP,eAAOK,6BAAAA,gBAAAA,SAAUG,GAAG,qBAAbH,mBAAAA,UAAgB,+BAAgB,IAAIF,IAAI;IAC7D,MAAMM,OAAOT,gBAAOK,6BAAAA,iBAAAA,SAAUG,GAAG,qBAAbH,oBAAAA,UAAgB,+BAAe,IAAIF,IAAI;IAC3D,MAAMO,SAAS;QAACH;QAAOE;KAAK,CAACE,MAAM,CAACC,SAASC,IAAI,CAAC;IAClD,OAAOH,UAAUV,OAAOM,mBAAAA,WAAY,IAAIH,IAAI,MAAMW;AACpD;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeC,+BACpBC,KAA0C;QAEvBA,YAQQA,oBAKdA,YASIA,kBAUIA,cAIEA,eAiCZA;IArEX,MAAMC,MAAMjB,QAAOgB,aAAAA,MAAMC,GAAG,YAATD,aAAa,IAAIb,IAAI;IACxC,IAAI,CAACc,KAAK,MAAM,IAAIC,MAAM;IAC1B,IAAI,CAAC/C,mCAAmC6C,MAAMG,QAAQ,GAAG;QACvD,MAAM,IAAID,MAAM;IAClB;IACA,IAAI,CAAC9C,qCAAqC4C,MAAMI,MAAM,GAAG;QACvD,MAAM,IAAIF,MAAM;IAClB;IACA,MAAMG,cAAcrB,QAAOgB,qBAAAA,MAAMK,WAAW,YAAjBL,qBAAqB,IAAIb,IAAI;IACxD,IAAI,CAACkB,aAAa;QAChB,MAAM,IAAIH,MAAM;IAClB;IAEA,MAAMI,QAAON,aAAAA,MAAMO,GAAG,YAATP,aAAaQ,KAAKD,GAAG;IAClC,MAAMH,SAAS9C,+BAA+B;QAC5CmD,MAAMT,MAAMI,MAAM;QAClBD,UAAUH,MAAMG,QAAQ;QACxBF;QACAK;QACAD;IACF;IAEA,MAAMK,UAAU,EAACV,mBAAAA,MAAMtB,SAAS,YAAfsB,mBAAmBtB,aAAaiC,UAAU,CAAC,SAASC,GAAG,CAACX;IACzE,MAAMZ,WAAW,MAAMqB,QAAQlB,GAAG;IAClC,MAAMkB,QAAQG,GAAG,CACfpD,4BAA4B;QAAE0C,UAAUH,MAAMG,QAAQ;QAAEG;QAAMF;IAAO,IACrE;QAAEU,OAAO;IAAK;IAGhB,MAAMC,SACJf,MAAMe,MAAM,KAAKjB,YAAYjB,4BAA4BmB,MAAMe,MAAM;IACvE,IAAI,CAACA,QAAQ,OAAO;QAAET;QAAMU,SAAS;YAAEC,QAAQ;QAAe;IAAE;IAChE,MAAMC,QAAQlC,QAAOgB,eAAAA,MAAMkB,KAAK,YAAXlB,eAAe,IAAIb,IAAI;IAC5C,IAAI,CAAC+B,OAAO,OAAO;QAAEZ;QAAMU,SAAS;YAAEC,QAAQ;QAAW;IAAE;IAE3D,MAAME,OAAO/B,YAAYC,UAAUW,MAAMmB,IAAI;IAC7C,MAAMC,UAAU,MAAM,EAACpB,gBAAAA,MAAMqB,MAAM,YAAZrB,gBAAgBvB,mBAAmB;QACxDsC;QACAG;OACIC,OAAO;QAAEA;IAAK,IAAI,CAAC;QACvBf,QAAQ;QACR,uEAAuE;QACvE,iDAAiD;QACjDkB,aAAa;YAAEhB;YAAMiB,SAASnB,OAAOoB,MAAM;QAAC;OACxCxB,MAAMG,QAAQ,KAAK,YACnB;QAAEsB,kBAAkB;IAAK,IACzB;QAAEC,yBAAyB;IAAK;QACpCC,wBAAwBvB;QACxB,uEAAuE;QACvE,wEAAwE;QACxE,mBAAmB;QACnBwB,uBAAuB;;IAEzB,MAAMZ,UACJ,aAAaI,UACT;QAAEH,QAAQ;QAAWO,QAAQJ,QAAQS,OAAO;IAAC,IAC7C;QAAEZ,QAAQ;QAAYa,WAAWV,QAAQU,SAAS;QAAEC,SAASX,QAAQW,OAAO;IAAC;IACnF,IAAI/B,MAAMG,QAAQ,KAAK,WAAW,OAAO;QAAEG;QAAMU;IAAQ;IAEzD;;;;;;;;GAQC,GACD,MAAMgB,SAAyChC,MAAMiC,eAAe,GAChE,MAAM,EAACjC,gBAAAA,MAAMkC,MAAM,YAAZlC,gBAAgBjC,mBAAmB;QACxCgD;QACAG;QACAiB,SAAS3E;IACX,KACA;QAAEyD,QAAQ;IAAa;IAC3B,OAAO;QAAEX;QAAMU;QAASgB;IAAO;AACjC;AAEA;;;CAGC,GACD,OAAO,eAAeI,8BACpBnC,GAAW,EACXoC,UAA6C,CAAC,CAAC;QAIlCA,cACNA;IAHP,MAAMC,UAAUtD,OAAOiB,cAAAA,MAAO,IAAId,IAAI;IACtC,IAAI,CAACmD,SAAS,MAAM,IAAIpC,MAAM;IAC9B,MAAMI,QAAO+B,eAAAA,QAAQ9B,GAAG,YAAX8B,eAAe7B,KAAKD,GAAG;IACpC,MAAM,EAAC8B,qBAAAA,QAAQ3D,SAAS,YAAjB2D,qBAAqB3D,aACzBiC,UAAU,CAAC,SACXC,GAAG,CAAC0B,SACJzB,GAAG,CAAC;QAAE,CAAClD,yCAAyC,EAAE2C;IAAK,GAAG;QAAEQ,OAAO;IAAK;IAC3E,OAAO;QAAER;IAAK;AAChB;AAEA,2EAA2E,GAC3E,OAAO,eAAeiC,oCACpBtC,GAAW,EACXoC,UAA+B,CAAC,CAAC;QAITA;QAKrBhD;IAPH,MAAMiD,UAAUtD,OAAOiB,cAAAA,MAAO,IAAId,IAAI;IACtC,IAAI,CAACmD,SAAS,MAAM,IAAIpC,MAAM;IAC9B,MAAMb,WAAW,MAAM,EAACgD,qBAAAA,QAAQ3D,SAAS,YAAjB2D,qBAAqB3D,aAC1CiC,UAAU,CAAC,SACXC,GAAG,CAAC0B,SACJ9C,GAAG;IACN,OAAO9B,qCACJ2B,6BAAAA,iBAAAA,SAAUmD,IAAI,qBAAdnD,oBAAAA,4BAA8D;AAEnE;AAoEA;;;;;;;CAOC,GACD,eAAeoD,iCACbC,EAAO,EACP3B,MAAc,EACdG,KAAa;IAEb,MAAMyB,MAAMxE,oBAAoB+C;IAChC,IAAI,CAACyB,KAAK,OAAO;IACjB,MAAM,CAACC,MAAMC,SAAS,GAAG,MAAMC,QAAQC,GAAG,CAAC;QACzCL,GACG/B,UAAU,CAAC,SACXC,GAAG,CAACG,QACJJ,UAAU,CAACvC,iCACXwC,GAAG,CAAC+B,KACJnD,GAAG;QACNkD,GAAG/B,UAAU,CAACzC,+BAA+B0C,GAAG,CAAC+B,KAAKnD,GAAG;KAC1D;IACD,IAAIoD,wBAAAA,KAAMI,MAAM,EAAE;YACsBJ;QAAtC,OAAO;YAAEK,MAAM;YAAQzB,QAAQxC,QAAO4D,YAAAA,KAAKpD,GAAG,CAAC,qBAAToD,YAAsB;QAAe;IAC7E;IACA,IAAIC,CAAAA,4BAAAA,SAAUG,MAAM,KAAI,CAACH,SAASrD,GAAG,CAAC,eAAe;YACTqD;QAA1C,OAAO;YAAEI,MAAM;YAAYzB,QAAQxC,QAAO6D,gBAAAA,SAASrD,GAAG,CAAC,qBAAbqD,gBAA0B;QAAS;IAC/E;IACA,OAAO;AACT;AAEA,6EAA6E,GAC7E,SAASK,SAASnE,KAAc;IAC9B,IAAI,OAAOA,UAAU,YAAYoE,OAAOC,QAAQ,CAACrE,QAAQ,OAAOA;IAChE,MAAMsE,WAAYtE,yBAAD,AAACA,MAA8CsE,QAAQ;IACxE,OAAO,OAAOA,aAAa,aAAaA,SAASC,IAAI,CAACvE,SAAS;AACjE;AAEA;;;;;;;CAOC,GACD,eAAewE,2BACbb,EAAO,EACP3B,MAAc,EACdG,KAAa;QAYG7B;IAVhB,MAAMsD,MAAMxE,oBAAoB+C;IAChC,MAAMsC,aAAa;QAAEC,IAAIjG;QAA6BkG,OAAO;QAAuBC,UAAU;IAAK;IACnG,IAAI,CAAChB,KAAK,OAAOa;IACjB,MAAMnE,WAAW,MAAMqD,GACpB/B,UAAU,CAAC,SACXC,GAAG,CAACG,QACJJ,UAAU,CAACzD,8BACX0D,GAAG,CAAC+B,KACJnD,GAAG;IACN,IAAI,EAACH,4BAAAA,SAAU2D,MAAM,GAAE,OAAOQ;IAC9B,MAAMI,QAAQ,EAAEvE,gBAAAA,SAASG,GAAG,CAAC,qBAAbH,gBAA0B,CAAC,EAAyD,CAClG7B,4BACD;IACD,MAAMkG,QAAQzG,2BAA2B2G;IACzC,OAAO;QACLH,IAAIjG;QACJkG;QACAC,UAAUD,UAAU,cAAcR,SAASU,yBAAAA,MAAOC,UAAU,IAAI;IAClE;AACF;AAEA;;;;;CAKC,GACD,OAAO,eAAeC,2BAA2B9D,KAMhD;QAIsBA,cAEVA;IALX,MAAMe,SACJf,MAAMe,MAAM,KAAKjB,YAAYjB,4BAA4BmB,MAAMe,MAAM;IACvE,IAAI,CAACA,QAAQ,OAAO;QAAEE,QAAQ;IAAe;IAC7C,MAAMC,QAAQlC,QAAOgB,eAAAA,MAAMkB,KAAK,YAAXlB,eAAe,IAAIb,IAAI,GAAG4E,WAAW;IAC1D,IAAI,CAAC7C,OAAO,OAAO;QAAED,QAAQ;IAAW;IACxC,MAAMyB,MAAK1C,mBAAAA,MAAMtB,SAAS,YAAfsB,mBAAmBtB;IAC9B,IAAI;;YAcCsC,eAgBUgD;QA7Bb,MAAMC,QAAQ,MAAM1F,cAAcwC;QAClC,IAAI,CAACkD,OAAO,OAAO;YAAEhD,QAAQ;YAAcF;QAAO;QAClD,MAAMmD,MAAMD,MAAMC,GAAG;QACrB,MAAM,CAAClD,SAASmD,OAAOC,aAAaC,MAAM,GAAG,MAAMvB,QAAQC,GAAG,CAAC;YAC7D,qEAAqE;YACrEvE,yBAAyBuC,QAAQ,YAAYuD,IAAI,CAAC,CAACC,WACjDtG,mBAAmBsG,UAAUrD;YAE/B5C,oBAAoByC,QAAQmD;YAC5BzB,iCAAiCC,IAAI3B,QAAQG;YAC7CqC,2BAA2Bb,IAAI3B,QAAQG;SACxC;QACD,MAAM8C,SAASnG,2BACZmD,4BAAAA,gBAAAA,QAASwB,IAAI,qBAAbxB,mBAAAA,2BAA6D,MAC9DmD;QAEF,MAAMhE,WAAWvC,yBACfoG,QACAlG,8BAA8BoG,GAAG,CAAC,yBAAyB;QAE7D,OAAO;YACLjD,QAAQ;YACRF;YACAyD,OAAOP,MAAMO,KAAK;YAClBC,SAAS,OAAOP,GAAG,CAAC,OAAO,KAAK,WAAWA,GAAG,CAAC,OAAO,GAAG;YACzDpC,SAAS,WAAEd,2BAAAA,QAASyC,EAAE,oBAAI;YAC1BiB,OAAOV,OAAOU,KAAK;YACnBC,WAAWX,OAAOW,SAAS;YAC3BC,YAAYZ,OAAOY,UAAU;YAC7BC,SAAS,YAAEb,iBAAAA,OAAO5D,MAAM,qBAAb4D,eAAevD,IAAI,oBAAI;YAClCW,SAASjB,SAASiB,OAAO;YACzBI,QAAQrB,SAASqB,MAAM;YACvB4C;YACAC;QACF;IACF,EAAE,OAAOS,OAAO;QACdC,QAAQD,KAAK,CAAC,kDAAkDA;QAChE,OAAO;YAAE7D,QAAQ;YAAcF;QAAO;IACxC;AACF;AAqBA,OAAO,SAASiE,sBACdC,KAA6B;IAE7B,IAAIA,MAAMhE,MAAM,KAAK,QAAQ,OAAO;IACpC,IAAIgE,MAAMb,WAAW,EAAE;QACrB,OAAOa,MAAMb,WAAW,CAACnB,IAAI,KAAK,UAAUgC,MAAMb,WAAW,CAAC5C,MAAM,KAAK,gBACrE;YAAEf,MAAM;QAAe,IACvB;YAAEA,MAAM;YAAUe,QAAQyD,MAAMb,WAAW,CAAC5C,MAAM;QAAC;IACzD;IACA,IAAIyD,MAAMZ,KAAK,CAACX,KAAK,KAAK,aAAa,OAAO;QAAEjD,MAAM;IAAe;IACrE,IAAIwE,MAAMZ,KAAK,CAACX,KAAK,KAAK,WAAW,OAAO;QAAEjD,MAAM;IAAc;IAClE,OAAO;AACT;AAmCA,mEAAmE,GACnE,eAAeyE,aACblF,KAAmC;QAKhBA,oBAINA;QAMRX;IAbL,MAAM8F,eACJnF,MAAMoF,cAAc,KAAKtF,YAAYjB,4BAA4BmB,MAAMoF,cAAc;IACvF,IAAI,CAACD,gBAAgBnF,MAAMe,MAAM,KAAKoE,cAAc,OAAO;QAAElE,QAAQ;IAAe;IACpF,MAAMhB,MAAM,MAAM,EAACD,qBAAAA,MAAMqF,WAAW,YAAjBrF,qBAAsB,CAACkB,QAAkBlD,8BAA8BkD,QACxFlB,MAAMkB,KAAK;IAEb,IAAI,CAACjB,KAAK,OAAO;QAAEgB,QAAQ;IAAa;IACxC,MAAMqE,MAAM,EAACtF,mBAAAA,MAAMtB,SAAS,YAAfsB,mBAAmBtB,aAAaiC,UAAU,CAAC,SAASC,GAAG,CAACX;IACrE,MAAMZ,WAAW,MAAMiG,IAAI9F,GAAG;IAC9B,OAAO;QACLS;QACAqF;QACA5B,OAAOhG,qCACJ2B,6BAAAA,iBAAAA,SAAUmD,IAAI,qBAAdnD,oBAAAA,4BAA8D;IAEnE;AACF;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,eAAekG,0BACpBvF,KAAgF;IAEhF,IAAI;YAYWA;QAXb,MAAMwF,aAAaxF,MAAMyF,IAAI,KAAK;QAClC,IAAI,CAACD,cAAc,CAACxF,MAAMyF,IAAI,CAACC,QAAQ,CAAClI,8BAA8B;YACpE,uEAAuE;YACvE,6DAA6D;YAC7D,MAAM2H,eACJnF,MAAMoF,cAAc,KAAKtF,YAAYjB,4BAA4BmB,MAAMoF,cAAc;YACvF,OAAOpF,MAAMe,MAAM,KAAKoE,eAAe;gBAAElE,QAAQ;YAAa,IAAI;gBAAEA,QAAQ;YAAe;QAC7F;QACA,MAAM0E,SAAS,MAAMT,aAAalF;QAClC,IAAI,YAAY2F,QAAQ,OAAOA;QAC/B,IAAIA,OAAOjC,KAAK,CAACvD,QAAQ,KAAK,YAAY,OAAO;YAAEc,QAAQ;QAAY;QACvE,MAAMX,QAAON,aAAAA,MAAMO,GAAG,YAATP,aAAaQ,KAAKD,GAAG;QAClC,MAAMH,SAAS7C,6BACbiI,aACI;YAAE/E,MAAM;YAAqBN,UAAU;YAAYF,KAAK0F,OAAO1F,GAAG;YAAEK;QAAK,IACzE;YAAEG,MAAM;YAAqBN,UAAU;YAAYF,KAAK0F,OAAO1F,GAAG;YAAEK;QAAK;QAE/E,MAAMqF,OAAOL,GAAG,CAACzE,GAAG,CAClBpD,4BAA4B;YAAE0C,UAAU;YAAYG;YAAMF;QAAO,IACjE;YAAEU,OAAO;QAAK;QAEhB,OAAO;YAAEG,QAAQ;YAAYhB,KAAK0F,OAAO1F,GAAG;YAAEE,UAAU;QAAW;IACrE,EAAE,OAAO2E,OAAO;QACdC,QAAQD,KAAK,CAAC,iFAAiFA;QAC/F,OAAO;YAAE7D,QAAQ;QAAS;IAC5B;AACF;AAEA;;;;;;;;;;CAUC,GACD,OAAO,eAAe2E,0BACpB5F,KAAwF;IAExF,IAAI;YASSA,kBAMEA;QAdb,MAAM2F,SAAS,MAAMT,aAAalF;QAClC,IAAI,YAAY2F,QAAQ,OAAOA;QAC/B,IACEA,OAAOjC,KAAK,CAACvD,QAAQ,KAAK,cAC1B,CAAC9C,mCAAmCsI,OAAOjC,KAAK,CAACmC,UAAU,GAC3D;YACA,OAAO;gBAAE5E,QAAQ;YAAY;QAC/B;QACA,MAAMyB,MAAK1C,mBAAAA,MAAMtB,SAAS,YAAfsB,mBAAmBtB;QAC9B,MAAM,CAAC0F,aAAaC,MAAM,GAAG,MAAMvB,QAAQC,GAAG,CAAC;YAC7CN,iCAAiCC,IAAI1C,MAAMe,MAAM,EAAEf,MAAMkB,KAAK;YAC9DqC,2BAA2Bb,IAAI1C,MAAMe,MAAM,EAAEf,MAAMkB,KAAK;SACzD;QACD,IAAIkD,eAAeC,MAAMX,KAAK,KAAK,cAAc,OAAO;YAAEzC,QAAQ;QAAY;QAC9E,MAAMX,QAAON,aAAAA,MAAMO,GAAG,YAATP,aAAaQ,KAAKD,GAAG;QAClC,MAAMH,SAAS7C,6BAA6B;YAC1CkD,MAAMT,MAAM8F,GAAG;YACf3F,UAAU;YACVF,KAAK0F,OAAO1F,GAAG;YACfK;QACF;QACA,MAAMqF,OAAOL,GAAG,CAACzE,GAAG,CAClBpD,4BAA4B;YAAE0C,UAAU;YAAWG;YAAMF;QAAO,IAChE;YAAEU,OAAO;QAAK;QAEhB,OAAO;YAAEG,QAAQ;YAAYhB,KAAK0F,OAAO1F,GAAG;YAAEE,UAAU;QAAU;IACpE,EAAE,OAAO2E,OAAO;QACdC,QAAQD,KAAK,CAAC,gFAAgFA;QAC9F,OAAO;YAAE7D,QAAQ;QAAS;IAC5B;AACF"}

package/src/lib/server/risk-notice.d.ts

@@ -14,7 +14,8 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { type ResolvedRiskAction, type RiskEventKind } from '@aglyn/shared-util-email/risk-notice-catalog';
+import { type ResolvedRiskAction, type RiskEventKind, type RiskNoticeSeverity } from '@aglyn/shared-util-email/risk-notice-catalog';
+import type { NotificationLevel } from '@aglyn/aglyn/server';
 import { type SendEmailOptions, type SendEmailResult } from '@aglyn/shared-util-email';
 import { type HeldPageSubject, type HeldPageTarget, type PageHoldNoticeKind } from '@aglyn/shared-util-email/held-page';
 import { type NotificationPayload, type NotifyUsersOptions } from './notifications';
@@ -25,6 +26,11 @@ export declare const RISK_NOTICE_COLLECTION = "riskNotices";
 export declare const RISK_NOTICE_LEDGER_COLLECTION = "riskNoticeLedger";
 /** The in-app notification type every owner notice is written as. */
 export declare const RISK_NOTICE_NOTIFICATION_TYPE: "system.riskNotice";
+/**
+ * The level an owner notice is drawn at (AGL-3437), from its kind's
+ * severity: a release or a lift is `info`, not the red of the hold it ends.
+ */
+export declare const RISK_NOTICE_LEVELS: Record<RiskNoticeSeverity, NotificationLevel>;
 /**
  * The burst allowance: how many notices one workspace's owners, and staff
  * about one workspace, receive one by one in {@link RISK_NOTICE_BURST.windowMs}
@@ -66,7 +72,20 @@ export interface RiskEventInput {
     occurredAtMs?: number;
     /** `$56.00 USD`. */
     amount?: string | null;
+    /**
+     * What happened to the payment, finishing "the payment was …"
+     * (`RISK_PAYMENT_EVENTS`): a fraud report, a review, a dispute.
+     */
+    paymentEvent?: string | null;
     evidenceDueByMs?: number | null;
+    /**
+     * A new publisher's payout schedule: how many days each payout waits, and
+     * the workspace age it waits until.
+     */
+    payout?: {
+        delayDays: number;
+        untilWorkspaceAgeDays: number;
+    } | null;
     /** Staff only: the Stripe Dashboard page for the charge, review or dispute. */
     stripeUrl?: string | null;
     lock?: {
@@ -87,6 +106,11 @@ export interface RiskEventInput {
     staffEvidence?: string | null;
     /** Overrides the default dedupe key. */
     dedupeKey?: string | null;
+    /**
+     * A closing notice's opening kind. The closing goes to the people the
+     * opening went to: the site's managers too, when the opening told them.
+     */
+    openedAs?: RiskEventKind | null;
     /**
      * `false` to send no owner EMAIL for this event (a lock placed under a
      * legal hold). The in-app notice and the record are still written.
@@ -178,6 +202,13 @@ export interface RenderedRiskNoticeEmail {
  * platform does (holds, locks, lifts, cancellations, reviews).
  */
 export declare function riskNoticeEmailBrand(kind: RiskEventKind | null, orgId: string | null): Promise<SystemEmailBrand>;
+/**
+ * The product name a notice's own words use (`your Aglyn account`): the one
+ * the email it rides in is branded with, so the sentence and the header
+ * never disagree — the platform's for platform mail, a white-label
+ * workspace's own for the notices sent in its brand.
+ */
+export declare function riskNoticeProductName(brand: SystemEmailBrand): string;
 /**
  * Renders one notice email through the System emails seam (AGL-3367): the
  * published design for the kind's own `risk-…` key, or its built-in copy,

package/src/lib/server/risk-notice.js

@@ -57,8 +57,8 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * short "more are arriving" note in-app; when the hour closes,
  * {@link flushRiskNoticeDigests} (hourly cron, and the next notice after the
  * window) sends ONE summary. A workspace under attack gets a digest, not
- * five hundred emails. Locks, lifts and cancellations (`neverDigest`) always
- * go out on their own.
+ * five hundred emails. Locks, lifts, cancellations, disputes and card-testing
+ * warnings (`neverDigest`) always go out on their own.
  *
  * ## Never throws
  *
@@ -68,7 +68,8 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  *=========================================*/ import { createHash } from "crypto";
 import { ABUSE_REPORT_COLLECTION, abuseReportContactEmail } from "@aglyn/aglyn/app-utils/abuse-report";
 import { DOCS_BASE_URL } from "@aglyn/aglyn/app-utils/docs-help";
-import { isRiskEventKind, renderOwnerRiskNotice, renderRiskNoticeText, renderStaffRiskNotice, resolveOwnerRiskActions, RISK_NOTICE_CATALOG, RISK_NOTICE_CLOSING_KINDS, RISK_NOTICE_DIGEST_EMAIL_KEY, RISK_NOTICE_HELP_PATH, RISK_NOTICE_WORKSPACE_BRANDED, riskNoticeEmailKey } from "@aglyn/shared-util-email/risk-notice-catalog";
+import { PLATFORM_BRAND_MERGE_TOKENS } from "@aglyn/aglyn/app-utils/system-email-chrome";
+import { isRiskEventKind, renderOwnerRiskNotice, renderRiskNoticeText, renderStaffRiskNotice, resolveOwnerRiskActions, RISK_NOTICE_CATALOG, RISK_NOTICE_CLOSING_KINDS, RISK_NOTICE_DIGEST_EMAIL_KEY, RISK_NOTICE_HELP_PATH, RISK_NOTICE_WORKSPACE_BRANDED, riskNoticeEmailKey, riskPayoutDelayText } from "@aglyn/shared-util-email/risk-notice-catalog";
 import { sendEmail as sendEmailImpl } from "@aglyn/shared-util-email";
 import { heldPageDetails, heldPageLabel, heldPageTargets, heldPageVisitorSentence, isOpenPageHoldStatus, isPageHoldNoticeKind, PAGE_HOLD_NOTICE_KINDS, pageHoldChip, parseHeldPageItemPath } from "@aglyn/shared-util-email/held-page";
 import { FieldValue } from "firebase-admin/firestore";
@@ -82,6 +83,14 @@ import { RISK_REVIEW_REQUESTED_EMAIL_KEY } from "@aglyn/shared-util-email/risk-n
 /** Admin-SDK only; no client rule opens it. One document per notice. */ export const RISK_NOTICE_COLLECTION = 'riskNotices';
 /** Admin-SDK only: each workspace's burst window and folded notices. */ export const RISK_NOTICE_LEDGER_COLLECTION = 'riskNoticeLedger';
 /** The in-app notification type every owner notice is written as. */ export const RISK_NOTICE_NOTIFICATION_TYPE = 'system.riskNotice';
+/**
+ * The level an owner notice is drawn at (AGL-3437), from its kind's
+ * severity: a release or a lift is `info`, not the red of the hold it ends.
+ */ export const RISK_NOTICE_LEVELS = {
+    urgent: 'critical',
+    warning: 'warning',
+    info: 'info'
+};
 /**
  * The burst allowance: how many notices one workspace's owners, and staff
  * about one workspace, receive one by one in {@link RISK_NOTICE_BURST.windowMs}
@@ -249,12 +258,19 @@ function consoleOrigin() {
     var _input_orgId;
     let orgId = (_input_orgId = input.orgId) != null ? _input_orgId : null;
     let hostSubdomain = null;
+    let siteLabel = null;
     let siteManagerUids = [];
     if (input.hostId) {
         const host = await firestore.collection('hosts').doc(input.hostId).get().catch(()=>null);
         if (host == null ? void 0 : host.exists) {
-            var _host_get, _host_get1, _host_get2;
+            var _host_get, _map_find, _host_get1, _host_get2;
             hostSubdomain = String((_host_get = host.get('subdomain')) != null ? _host_get : '') || null;
+            const siteName = (_map_find = [
+                host.get('displayName'),
+                host.get('name'),
+                hostSubdomain
+            ].map((value)=>typeof value === 'string' ? value.trim() : '').find(Boolean)) != null ? _map_find : '';
+            siteLabel = siteName ? `the site "${siteName.replace(/"/g, '”')}"` : null;
             orgId = orgId != null ? orgId : String((_host_get1 = host.get('orgId')) != null ? _host_get1 : '') || null;
             const roles = (_host_get2 = host.get('memberRoles')) != null ? _host_get2 : {};
             siteManagerUids = Object.entries(roles).filter(([, role])=>role === 'admin' || role === 'editor').map(([uid])=>uid);
@@ -275,6 +291,7 @@ function consoleOrigin() {
         orgName,
         orgSlug,
         hostSubdomain,
+        siteLabel,
         siteManagerUids
     };
 }
@@ -285,6 +302,15 @@ function consoleOrigin() {
  */ export async function riskNoticeEmailBrand(kind, orgId) {
     return kind && RISK_NOTICE_WORKSPACE_BRANDED.has(kind) ? orgSystemEmailBrand(orgId) : systemEmailBrand(null);
 }
+/**
+ * The product name a notice's own words use (`your Aglyn account`): the one
+ * the email it rides in is branded with, so the sentence and the header
+ * never disagree — the platform's for platform mail, a white-label
+ * workspace's own for the notices sent in its brand.
+ */ export function riskNoticeProductName(brand) {
+    var _brand_merge_brandproductName, _PLATFORM_BRAND_MERGE_TOKENS_brandproductName;
+    return String((_brand_merge_brandproductName = brand.merge['brand.productName']) != null ? _brand_merge_brandproductName : '').trim() || String((_PLATFORM_BRAND_MERGE_TOKENS_brandproductName = PLATFORM_BRAND_MERGE_TOKENS['brand.productName']) != null ? _PLATFORM_BRAND_MERGE_TOKENS_brandproductName : '').trim();
+}
 /**
  * Renders one notice email through the System emails seam (AGL-3367): the
  * published design for the kind's own `risk-…` key, or its built-in copy,
@@ -429,7 +455,11 @@ function emptyDelivery(skipped = null) {
             if (owner.email) emails[owner.uid] = owner.email;
         }
     }
-    if (definition.includeSiteManagers) for (const uid of siteManagerUids)uids.add(uid);
+    // A closing kind is shared by openings with different audiences, so it
+    // follows the one it closes: a site manager told a review opened is told
+    // it closed.
+    const audience = isRiskEventKind(input.openedAs) ? RISK_NOTICE_CATALOG[input.openedAs] : definition;
+    if (audience.includeSiteManagers) for (const uid of siteManagerUids)uids.add(uid);
     return {
         uids: [
             ...uids
@@ -469,7 +499,7 @@ function emptyDelivery(skipped = null) {
     const noticeId = riskNoticeId(riskNoticeDedupeKey(input, occurredAtMs));
     result.noticeId = noticeId;
     try {
-        var _abuseReportContactEmail, _ref1, _input_reference, _ref2, _ref3, _input_amount, _context_orgName, _input_staffEvidence, _ref4, _input_reviewId, _input_hostId, _input_stripeUrl, _ref5, _ref6, _ownerActions_find;
+        var _abuseReportContactEmail, _ref1, _input_reference, _ref2, _ref3, _input_amount, _input_paymentEvent, _context_orgName, _input_staffEvidence, _ref4, _input_reviewId, _input_hostId, _input_stripeUrl, _ref5, _ref6, _ownerActions_find;
         var _input_item, _input_lock, _input_lock1, _input_item1, _input_lock2, _input_lock3;
         const context = await readContext(deps.firestore, input);
         const orgId = context.orgId;
@@ -480,8 +510,12 @@ function emptyDelivery(skipped = null) {
      * The values the OWNER half renders with. `staff.evidence` is absent by
      * construction: the owner record and the owner channels never hold it.
      */ const supportEmail = (_abuseReportContactEmail = abuseReportContactEmail('support')) != null ? _abuseReportContactEmail : '';
+        // The brand the email is sent in, read once: its product name is also a
+        // word in the notice (an account lock says whose account it is).
+        const brand = await riskNoticeEmailBrand(input.kind, orgId);
         const ownerValues = {
             'workspace.name': context.orgName,
+            'site.label': context.siteLabel,
             'item.label': (_ref1 = (_input_item = input.item) == null ? void 0 : _input_item.label) != null ? _ref1 : null,
             occurredAt: formatRiskNoticeTime(occurredAtMs),
             reference: (_input_reference = input.reference) != null ? _input_reference : null,
@@ -489,7 +523,11 @@ function emptyDelivery(skipped = null) {
             'lock.message': (_ref2 = (_input_lock = input.lock) == null ? void 0 : _input_lock.message) != null ? _ref2 : null,
             'lock.affected': (_ref3 = (_input_lock1 = input.lock) == null ? void 0 : _input_lock1.affected) != null ? _ref3 : null,
             amount: (_input_amount = input.amount) != null ? _input_amount : null,
-            'evidence.dueBy': input.evidenceDueByMs ? formatRiskNoticeTime(input.evidenceDueByMs) : null
+            'payment.event': (_input_paymentEvent = input.paymentEvent) != null ? _input_paymentEvent : null,
+            'evidence.dueBy': input.evidenceDueByMs ? formatRiskNoticeTime(input.evidenceDueByMs) : null,
+            'payout.delay': input.payout ? riskPayoutDelayText(input.payout) : null,
+            'page.visitors': input.page ? heldPageVisitorSentence(input.page) : null,
+            'brand.productName': riskNoticeProductName(brand) || null
         };
         const staffValues = _extends({}, ownerValues, {
             'workspace.name': (_context_orgName = context.orgName) != null ? _context_orgName : orgId,
@@ -578,6 +616,7 @@ function emptyDelivery(skipped = null) {
                     type: RISK_NOTICE_NOTIFICATION_TYPE,
                     title: owner.title,
                     body: `${owner.summary} ${owner.meaning}`.slice(0, 1000),
+                    level: RISK_NOTICE_LEVELS[definition.severity],
                     link: (_ref9 = primary == null ? void 0 : primary.href) != null ? _ref9 : riskHoldsPath(noticeId)
                 }, orgId ? {
                     orgId
@@ -613,7 +652,7 @@ function emptyDelivery(skipped = null) {
                     workspaceName: context.orgName,
                     lockMessage: (_ref10 = (_input_lock4 = input.lock) == null ? void 0 : _input_lock4.message) != null ? _ref10 : null
                 });
-                const rendered = await renderRiskNoticeEmail(riskNoticeEmailKey(input.kind), merge, await riskNoticeEmailBrand(input.kind, orgId));
+                const rendered = await renderRiskNoticeEmail(riskNoticeEmailKey(input.kind), merge, brand);
                 const delivery = await emailPeople(deps, recipients, rendered, supportEmail, {
                     lockNotice: LOCK_NOTICE_KINDS.has(input.kind)
                 });
@@ -629,6 +668,7 @@ function emptyDelivery(skipped = null) {
                 await deps.notifyUsers(recipients.uids, _extends({
                     type: RISK_NOTICE_NOTIFICATION_TYPE,
                     title: 'More account notices are arriving',
+                    level: 'warning',
                     body: 'Several items on your workspace were held or flagged in the last hour. ' + 'We will send one summary instead of a message for each. Every item is listed on Holds & reviews.',
                     link: riskHoldsPath()
                 }, orgId ? {
@@ -818,18 +858,17 @@ function isAlreadyExists(error) {
         if (count > listed) lines.push(`• …and ${count - listed} more`);
         return lines.join('\n');
     };
+    // The workspace by name, for both halves: staff read a digest about
+    // `Harbor View`, not about a ledger key.
+    const context = orgId ? await readContext(deps.firestore, {
+        kind: 'email-held',
+        orgId
+    }) : {
+        orgName: null,
+        orgSlug: null
+    };
     if (taken.ownerCount > 0) {
         var _context_orgName;
-        const context = orgId ? await readContext(deps.firestore, {
-            kind: 'email-held',
-            orgId
-        }) : {
-            orgName: null,
-            orgSlug: null,
-            siteManagerUids: [],
-            orgId: null,
-            hostSubdomain: null
-        };
         const recipients = scope === 'user' ? {
             uids: [
                 id
@@ -842,7 +881,7 @@ function isAlreadyExists(error) {
             uids: [],
             emails: {}
         };
-        const title = `Summary: more items on ${(_context_orgName = context.orgName) != null ? _context_orgName : 'your workspace'} were held or flagged`;
+        const title = `Summary: more notices about ${(_context_orgName = context.orgName) != null ? _context_orgName : 'your workspace'} in the last hour`;
         const summary = summarize(taken.owners, taken.ownerCount);
         if (recipients.uids.length) {
             var _context_orgName1, _abuseReportContactEmail;
@@ -850,6 +889,7 @@ function isAlreadyExists(error) {
                 type: RISK_NOTICE_NOTIFICATION_TYPE,
                 title,
                 body: summary.slice(0, 1000),
+                level: 'warning',
                 link: riskHoldsPath()
             }, orgId ? {
                 orgId
@@ -863,7 +903,7 @@ function isAlreadyExists(error) {
             });
             const rendered = await renderRiskNoticeEmail(RISK_NOTICE_DIGEST_EMAIL_KEY, {
                 'notice.title': title,
-                'notice.summary': renderRiskNoticeText('In the last hour, more items on {{workspace.name}} were held or flagged than we send one by one:', {
+                'notice.summary': renderRiskNoticeText('In the last hour, {{workspace.name}} had more notices than we send one by one. Each one, with its status and anything that is due, is listed on Holds & reviews. By title:', {
                     'workspace.name': context.orgName
                 }),
                 'notice.meaning': summary,
@@ -881,10 +921,12 @@ function isAlreadyExists(error) {
         }
     }
     if (taken.staffCount > 0) {
+        var _context_orgName2;
+        const about = context.orgName ? `workspace ${context.orgName} (${orgId})` : scope === 'user' ? `account ${id}` : scope === 'host' ? `site ${id}` : ledgerId;
         await deps.notifyStaff({
             type: 'system.abuseReportUrgent',
-            title: `Digest: ${taken.staffCount} more risk alerts on ${ledgerId}`,
-            body: summarize(taken.staff, taken.staffCount).slice(0, 1000),
+            title: `Digest: ${taken.staffCount} more risk alerts on ${(_context_orgName2 = context.orgName) != null ? _context_orgName2 : ledgerId}`,
+            body: (`${taken.staffCount} more risk alerts on ${about} arrived in the last hour ` + `and were batched here instead of sent one by one:\n` + summarize(taken.staff, taken.staffCount)).slice(0, 1000),
             link: '/admin/abuse-reports'
         });
     }
@@ -942,7 +984,8 @@ function isAlreadyExists(error) {
                 label: stamp.itemLabel,
                 path: (_stamp_itemPath = stamp.itemPath) != null ? _stamp_itemPath : null
             } : null,
-            dedupeKey: `${closing}:${input.reviewId}`
+            dedupeKey: `${closing}:${input.reviewId}`,
+            openedAs: stamp.kind
         }, overrides);
     } catch (error) {
         console.error('[risk-notice] the closing notice failed', error);
@@ -957,7 +1000,8 @@ function isAlreadyExists(error) {
  * here, so no request can release a hold or lift a lock. Staff see the
  * request as a note on the row, and are notified with a link to it.
  */ export async function requestRiskReview(input, overrides = {}) {
-    var _input_note, _notice_get;
+    var _input_note, _notice_get, _ref, _ref1, _ref2;
+    var _notice_get1;
     const deps = resolveDeps(overrides);
     const note = String((_input_note = input.note) != null ? _input_note : '').trim().slice(0, RISK_REVIEW_NOTE_MAX);
     if (note.length < 10) {
@@ -1031,23 +1075,41 @@ function isAlreadyExists(error) {
             error: 'We already have a request on this. You can add another in a few minutes.'
         };
     }
+    // What the request is about, by name, for staff and for the person who
+    // asked: the item in the owner's words and the workspace.
+    const itemLabel = String((_ref = (_notice_get1 = notice.get('ownerValues')) == null ? void 0 : _notice_get1['item.label']) != null ? _ref : '').trim() || null;
+    const org = await deps.firestore.collection('orgs').doc(input.orgId).get().catch(()=>null);
+    const orgName = String((_ref1 = org == null ? void 0 : org.get('name')) != null ? _ref1 : '').trim() || null;
+    const orgSlug = String((_ref2 = org == null ? void 0 : org.get('slug')) != null ? _ref2 : '').trim() || null;
     await deps.notifyStaff({
         type: 'system.abuseReportUrgent',
         title: `Review requested${outcome.reference ? ` — ${outcome.reference}` : ''}`,
-        body: `A workspace owner or admin asked for a review: "${note.slice(0, 280)}"`,
+        body: `An owner or admin of ${orgName ? `${orgName} (${input.orgId})` : `workspace ${input.orgId}`} ` + `asked for a review of ${itemLabel != null ? itemLabel : 'a held or flagged item'} (${kind}): "${note.slice(0, 280)}"`,
         link: staffAbuseRowPath(reviewId)
     });
     // The person who asked is told it arrived — account mail, platform brand.
     if (input.email) {
         var _outcome_reference, _abuseReportContactEmail;
+        const holdsPath = emailPath(riskHoldsPath(input.noticeId), {
+            orgSlug,
+            hostId: null,
+            hostSubdomain: null
+        });
+        const holdsUrl = holdsPath ? absolute(holdsPath) : '';
+        const about = `${itemLabel != null ? itemLabel : 'the held or flagged item'}${orgName ? ` on ${orgName}` : ''}`;
         const rendered = await renderRiskNoticeEmail(RISK_REVIEW_REQUESTED_EMAIL_KEY, {
             'notice.title': 'We received your review request',
-            'notice.summary': 'Your request reached our review team' + (outcome.reference ? ` under the reference ${outcome.reference}` : '') + '. A person reads every request.',
-            'notice.meaning': 'Nothing changes until the review is done; you will get a notice either way.',
+            'notice.summary': `We received your request to review ${about}` + (outcome.reference ? ` (reference ${outcome.reference})` : '') + '. A person on our review team reads every request.',
+            'notice.meaning': 'Nothing changes until the review is done, and you will get a notice either way.',
             'notice.steps': numbered([
                 'Nothing more is needed.',
-                'You can follow the item\'s status on Holds & reviews.'
+                'You can follow its status on Holds & reviews.'
             ]),
+            'notice.actions': holdsUrl ? `View holds and reviews: ${holdsUrl}` : '',
+            'notice.primaryActionLabel': holdsUrl ? 'View holds and reviews' : '',
+            'notice.primaryActionUrl': holdsUrl,
+            'holds.url': holdsUrl,
+            'workspace.name': orgName != null ? orgName : '',
             reference: (_outcome_reference = outcome.reference) != null ? _outcome_reference : '',
             'help.url': riskNoticeHelpUrl('requesting-a-review')
         });