@aglyn/tenant-data-admin 1.0.0-beta.261 → 1.0.0-beta.263

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/tenant-data-admin",
-  "version": "1.0.0-beta.261",
+  "version": "1.0.0-beta.263",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,12 +25,12 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/aglyn": "1.0.0-beta.261",
-    "@aglyn/shared-util-email": "1.0.0-beta.261",
-    "@aglyn/shared-util-fbserver": "1.0.0-beta.261",
-    "@aglyn/shared-util-first-touch": "1.0.0-beta.261",
-    "@aglyn/shared-util-http": "1.0.0-beta.261",
-    "@aglyn/shared-util-tools": "1.0.0-beta.261",
+    "@aglyn/aglyn": "1.0.0-beta.263",
+    "@aglyn/shared-util-email": "1.0.0-beta.263",
+    "@aglyn/shared-util-fbserver": "1.0.0-beta.263",
+    "@aglyn/shared-util-first-touch": "1.0.0-beta.263",
+    "@aglyn/shared-util-http": "1.0.0-beta.263",
+    "@aglyn/shared-util-tools": "1.0.0-beta.263",
     "@msgpack/msgpack": "^3.1.3",
     "@swc/helpers": "0.5.23",
     "sharp": "^0.35.5",

package/src/lib/server/figure-readers.d.ts

@@ -0,0 +1,44 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginFigureReader, type ResolvedPluginFigureReader } from '@aglyn/aglyn/plugin-manager/plugin-figures';
+/**
+ * The figure readers a caller may read for one workspace or one site
+ * (AGL-2915): the caller's half of the `plugin-figures` contract.
+ *
+ * The registry carries no authorization, so before a reader is read this
+ * establishes that the workspace's plan includes the feature the figures are
+ * sold under, and that the plugin whose records they are runs here: past its
+ * release flag, on for the workspace and not switched off for the site. The
+ * site belonging to the workspace, and the person's reach, are the caller's
+ * own checks.
+ */
+/** Which of a set of plugins are past their release flags for an org; the platform's flags by default. */
+export type ReleasedFigurePlugins = (pluginIds: string[], orgId: string) => Promise<string[]>;
+export interface FigureReaderContext {
+    orgId: string;
+    /** The site the figures are about; `null` for the workspace as a whole. */
+    hostId: string | null;
+    /** The org document. */
+    org: object | null;
+    /** The site's host document, already checked to belong to the org; `null` with no site. */
+    host: Record<string, unknown> | null;
+    /** Which readers the caller asks about at all, before the gates. */
+    accept: (reader: PluginFigureReader) => boolean;
+    released?: ReleasedFigurePlugins;
+}
+/** The readers that pass the gates, ordered by id so a list of them is the same on every call. */
+export declare function eligibleFigureReaders(context: FigureReaderContext): Promise<ResolvedPluginFigureReader[]>;

package/src/lib/server/figure-readers.js

@@ -0,0 +1,45 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { checkEntitlement } from "@aglyn/aglyn/app-utils/plan-entitlements";
+import { isHostPluginEnabled, isPluginEnabled } from "@aglyn/aglyn/plugin-manager/enabled-plugins";
+import { listPluginFigureReaders, pluginFigureReaderPlugin } from "@aglyn/aglyn/plugin-manager/plugin-figures";
+import { filterEnabledPluginsByReleaseFlags } from "./release-flags.js";
+const releasedByFlags = (pluginIds, orgId)=>filterEnabledPluginsByReleaseFlags(pluginIds, {
+        orgId,
+        authorization: null
+    });
+/** The readers that pass the gates, ordered by id so a list of them is the same on every call. */ export async function eligibleFigureReaders(context) {
+    var _context_released;
+    const org = context.org;
+    const candidates = listPluginFigureReaders().filter(({ reader })=>{
+        if (!context.accept(reader)) return false;
+        // A site reader needs a site; a workspace reader reads with or without one.
+        if (reader.scope === 'site' && !context.hostId) return false;
+        return !reader.feature || checkEntitlement(org, reader.feature);
+    });
+    const plugins = [
+        ...new Set(candidates.map(pluginFigureReaderPlugin).filter((id)=>Boolean(id)))
+    ];
+    const released = new Set(plugins.length ? await ((_context_released = context.released) != null ? _context_released : releasedByFlags)(plugins, context.orgId) : []);
+    return candidates.filter((resolved)=>{
+        const plugin = pluginFigureReaderPlugin(resolved);
+        if (!plugin) return true;
+        if (!released.has(plugin)) return false;
+        return context.hostId ? isHostPluginEnabled(org, context.host, plugin) : isPluginEnabled(org, plugin);
+    });
+}
+
+//# sourceMappingURL=figure-readers.js.map

package/src/lib/server/figure-readers.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/figure-readers.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { checkEntitlement } from '@aglyn/aglyn/app-utils/plan-entitlements'\nimport { isHostPluginEnabled, isPluginEnabled } from '@aglyn/aglyn/plugin-manager/enabled-plugins'\nimport {\n  listPluginFigureReaders,\n  pluginFigureReaderPlugin,\n  type PluginFigureReader,\n  type ResolvedPluginFigureReader,\n} from '@aglyn/aglyn/plugin-manager/plugin-figures'\nimport { filterEnabledPluginsByReleaseFlags } from './release-flags'\n\n/**\n * The figure readers a caller may read for one workspace or one site\n * (AGL-2915): the caller's half of the `plugin-figures` contract.\n *\n * The registry carries no authorization, so before a reader is read this\n * establishes that the workspace's plan includes the feature the figures are\n * sold under, and that the plugin whose records they are runs here: past its\n * release flag, on for the workspace and not switched off for the site. The\n * site belonging to the workspace, and the person's reach, are the caller's\n * own checks.\n */\n\n/** Which of a set of plugins are past their release flags for an org; the platform's flags by default. */\nexport type ReleasedFigurePlugins = (pluginIds: string[], orgId: string) => Promise<string[]>\n\nconst releasedByFlags: ReleasedFigurePlugins = (pluginIds, orgId) =>\n  filterEnabledPluginsByReleaseFlags(pluginIds, { orgId, authorization: null })\n\nexport interface FigureReaderContext {\n  orgId: string\n  /** The site the figures are about; `null` for the workspace as a whole. */\n  hostId: string | null\n  /** The org document. */\n  org: object | null\n  /** The site's host document, already checked to belong to the org; `null` with no site. */\n  host: Record<string, unknown> | null\n  /** Which readers the caller asks about at all, before the gates. */\n  accept: (reader: PluginFigureReader) => boolean\n  released?: ReleasedFigurePlugins\n}\n\n/** The readers that pass the gates, ordered by id so a list of them is the same on every call. */\nexport async function eligibleFigureReaders(\n  context: FigureReaderContext,\n): Promise<ResolvedPluginFigureReader[]> {\n  const org = context.org as { enabledPlugins?: string[] } | null\n  const candidates = listPluginFigureReaders().filter(({ reader }) => {\n    if (!context.accept(reader)) return false\n    // A site reader needs a site; a workspace reader reads with or without one.\n    if (reader.scope === 'site' && !context.hostId) return false\n    return !reader.feature || checkEntitlement(org as never, reader.feature)\n  })\n  const plugins = [\n    ...new Set(candidates.map(pluginFigureReaderPlugin).filter((id): id is string => Boolean(id))),\n  ]\n  const released = new Set(\n    plugins.length ? await (context.released ?? releasedByFlags)(plugins, context.orgId) : [],\n  )\n  return candidates.filter((resolved) => {\n    const plugin = pluginFigureReaderPlugin(resolved)\n    if (!plugin) return true\n    if (!released.has(plugin)) return false\n    return context.hostId\n      ? isHostPluginEnabled(org, context.host as { disabledPlugins?: string[] } | null, plugin)\n      : isPluginEnabled(org, plugin)\n  })\n}\n"],"names":["checkEntitlement","isHostPluginEnabled","isPluginEnabled","listPluginFigureReaders","pluginFigureReaderPlugin","filterEnabledPluginsByReleaseFlags","releasedByFlags","pluginIds","orgId","authorization","eligibleFigureReaders","context","org","candidates","filter","reader","accept","scope","hostId","feature","plugins","Set","map","id","Boolean","released","length","resolved","plugin","has","host"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,gBAAgB,QAAQ,2CAA0C;AAC3E,SAASC,mBAAmB,EAAEC,eAAe,QAAQ,8CAA6C;AAClG,SACEC,uBAAuB,EACvBC,wBAAwB,QAGnB,6CAA4C;AACnD,SAASC,kCAAkC,QAAQ,qBAAiB;AAiBpE,MAAMC,kBAAyC,CAACC,WAAWC,QACzDH,mCAAmCE,WAAW;QAAEC;QAAOC,eAAe;IAAK;AAe7E,gGAAgG,GAChG,OAAO,eAAeC,sBACpBC,OAA4B;QAaFA;IAX1B,MAAMC,MAAMD,QAAQC,GAAG;IACvB,MAAMC,aAAaV,0BAA0BW,MAAM,CAAC,CAAC,EAAEC,MAAM,EAAE;QAC7D,IAAI,CAACJ,QAAQK,MAAM,CAACD,SAAS,OAAO;QACpC,4EAA4E;QAC5E,IAAIA,OAAOE,KAAK,KAAK,UAAU,CAACN,QAAQO,MAAM,EAAE,OAAO;QACvD,OAAO,CAACH,OAAOI,OAAO,IAAInB,iBAAiBY,KAAcG,OAAOI,OAAO;IACzE;IACA,MAAMC,UAAU;WACX,IAAIC,IAAIR,WAAWS,GAAG,CAAClB,0BAA0BU,MAAM,CAAC,CAACS,KAAqBC,QAAQD;KAC1F;IACD,MAAME,WAAW,IAAIJ,IACnBD,QAAQM,MAAM,GAAG,MAAM,EAACf,oBAAAA,QAAQc,QAAQ,YAAhBd,oBAAoBL,iBAAiBc,SAAST,QAAQH,KAAK,IAAI,EAAE;IAE3F,OAAOK,WAAWC,MAAM,CAAC,CAACa;QACxB,MAAMC,SAASxB,yBAAyBuB;QACxC,IAAI,CAACC,QAAQ,OAAO;QACpB,IAAI,CAACH,SAASI,GAAG,CAACD,SAAS,OAAO;QAClC,OAAOjB,QAAQO,MAAM,GACjBjB,oBAAoBW,KAAKD,QAAQmB,IAAI,EAA2CF,UAChF1B,gBAAgBU,KAAKgB;IAC3B;AACF"}

package/src/lib/server/keep-alive.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** Returns `work` unchanged, after asking the platform to wait for it. */
+export declare function keepAlive<T>(work: Promise<T>): Promise<T>;

package/src/lib/server/keep-alive.js

@@ -0,0 +1,59 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Keeps fire-and-forget work alive after the response is sent.
+ *
+ * A serverless function may be frozen the moment its handler returns, and a
+ * notification is usually started with `void notify…()` beside the mutation
+ * it reports. The feed write lands first, so the console shows it, while the
+ * push and the email after it are cut off part way: the native apps then miss
+ * notifications the browser shows. Handing the promise to the platform's
+ * `waitUntil` keeps the invocation alive until it settles.
+ *
+ * Next reads `waitUntil` from the `@next/request-context` slot, and Vercel's
+ * own helpers read `@vercel/request-context`; both are asked. Outside a
+ * request (a script, a test, a cron worker that awaits anyway) there is no
+ * context and the work simply runs as it would have.
+ */ const CONTEXT_SLOTS = [
+    Symbol.for('@next/request-context'),
+    Symbol.for('@vercel/request-context')
+];
+function platformWaitUntil() {
+    const scope = globalThis;
+    for (const slot of CONTEXT_SLOTS){
+        try {
+            var _scope_slot_get, _scope_slot_get1, _scope_slot;
+            const waitUntil = (_scope_slot = scope[slot]) == null ? void 0 : (_scope_slot_get1 = _scope_slot.get) == null ? void 0 : (_scope_slot_get = _scope_slot_get1.call(_scope_slot)) == null ? void 0 : _scope_slot_get.waitUntil;
+            if (typeof waitUntil === 'function') return waitUntil;
+        } catch (unused) {
+        // A slot that cannot answer is treated as absent.
+        }
+    }
+    return undefined;
+}
+/** Returns `work` unchanged, after asking the platform to wait for it. */ export function keepAlive(work) {
+    const waitUntil = platformWaitUntil();
+    if (waitUntil) {
+        try {
+            waitUntil(work.catch(()=>undefined));
+        } catch (unused) {
+        // The platform refused the promise: the work still runs.
+        }
+    }
+    return work;
+}
+
+//# sourceMappingURL=keep-alive.js.map

package/src/lib/server/keep-alive.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/keep-alive.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Keeps fire-and-forget work alive after the response is sent.\n *\n * A serverless function may be frozen the moment its handler returns, and a\n * notification is usually started with `void notify…()` beside the mutation\n * it reports. The feed write lands first, so the console shows it, while the\n * push and the email after it are cut off part way: the native apps then miss\n * notifications the browser shows. Handing the promise to the platform's\n * `waitUntil` keeps the invocation alive until it settles.\n *\n * Next reads `waitUntil` from the `@next/request-context` slot, and Vercel's\n * own helpers read `@vercel/request-context`; both are asked. Outside a\n * request (a script, a test, a cron worker that awaits anyway) there is no\n * context and the work simply runs as it would have.\n */\n\ntype WaitUntil = (promise: Promise<unknown>) => void\n\ninterface RequestContextSlot {\n  get?: () => { waitUntil?: WaitUntil } | undefined\n}\n\nconst CONTEXT_SLOTS = [Symbol.for('@next/request-context'), Symbol.for('@vercel/request-context')]\n\nfunction platformWaitUntil(): WaitUntil | undefined {\n  const scope = globalThis as unknown as Record<symbol, RequestContextSlot | undefined>\n  for (const slot of CONTEXT_SLOTS) {\n    try {\n      const waitUntil = scope[slot]?.get?.()?.waitUntil\n      if (typeof waitUntil === 'function') return waitUntil\n    } catch {\n      // A slot that cannot answer is treated as absent.\n    }\n  }\n  return undefined\n}\n\n/** Returns `work` unchanged, after asking the platform to wait for it. */\nexport function keepAlive<T>(work: Promise<T>): Promise<T> {\n  const waitUntil = platformWaitUntil()\n  if (waitUntil) {\n    try {\n      waitUntil(work.catch(() => undefined))\n    } catch {\n      // The platform refused the promise: the work still runs.\n    }\n  }\n  return work\n}\n"],"names":["CONTEXT_SLOTS","Symbol","for","platformWaitUntil","scope","globalThis","slot","waitUntil","get","undefined","keepAlive","work","catch"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;CAcC,GAQD,MAAMA,gBAAgB;IAACC,OAAOC,GAAG,CAAC;IAA0BD,OAAOC,GAAG,CAAC;CAA2B;AAElG,SAASC;IACP,MAAMC,QAAQC;IACd,KAAK,MAAMC,QAAQN,cAAe;QAChC,IAAI;gBACgBI,iBAAAA,kBAAAA;YAAlB,MAAMG,aAAYH,cAAAA,KAAK,CAACE,KAAK,sBAAXF,mBAAAA,YAAaI,GAAG,sBAAhBJ,kBAAAA,sBAAAA,iCAAAA,gBAAsBG,SAAS;YACjD,IAAI,OAAOA,cAAc,YAAY,OAAOA;QAC9C,EAAE,eAAM;QACN,kDAAkD;QACpD;IACF;IACA,OAAOE;AACT;AAEA,wEAAwE,GACxE,OAAO,SAASC,UAAaC,IAAgB;IAC3C,MAAMJ,YAAYJ;IAClB,IAAII,WAAW;QACb,IAAI;YACFA,UAAUI,KAAKC,KAAK,CAAC,IAAMH;QAC7B,EAAE,eAAM;QACN,yDAAyD;QAC3D;IACF;IACA,OAAOE;AACT"}

package/src/lib/server/mobile-push-switch.js

@@ -24,21 +24,34 @@
     var _env_MOBILE_PUSH_ENABLED;
     return ((_env_MOBILE_PUSH_ENABLED = env['MOBILE_PUSH_ENABLED']) != null ? _env_MOBILE_PUSH_ENABLED : '').trim() !== '0';
 }
-const senders = new Set();
+/*
+ * The registry lives on `globalThis`, not in this module: `instrumentation.ts`
+ * registers the senders in its own copy of this module, and a route handler's
+ * `notifyUsers` reads another one (AGL-3412). A module-scoped set is empty
+ * where it is read, and every push is silently skipped.
+ */ const SENDERS_KEY = Symbol.for('@aglyn/tenant-data-admin:mobile-push-senders');
+const globalScope = globalThis;
+function senders() {
+    const existing = globalScope[SENDERS_KEY];
+    if (existing) return existing;
+    const created = new Set();
+    globalScope[SENDERS_KEY] = created;
+    return created;
+}
 /**
  * Adds a push transport to the fan-out. `notifyUsers` hands every registered
  * sender the recipients whose preferences say push, after the feed entries
  * are committed and only while the kill switch is up. With none registered,
  * nothing is pushed. Returns the unregister function.
  */ export function registerMobilePushSender(sender) {
-    senders.add(sender);
+    senders().add(sender);
     return ()=>{
-        senders.delete(sender);
+        senders().delete(sender);
     };
 }
 /** The registered push transports, in registration order. */ export function mobilePushSenders() {
     return [
-        ...senders
+        ...senders()
     ];
 }
 

package/src/lib/server/mobile-push-switch.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/mobile-push-switch.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { AglynNotification } from '@aglyn/aglyn/server'\nimport type { Firestore } from 'firebase-admin/firestore'\n\n/**\n * Whether this deployment sends mobile push (AGL-3648).\n *\n * On unless `MOBILE_PUSH_ENABLED=0`: the variable is a kill switch, not an\n * opt-in, and it governs every push sender. Kept apart from the senders so\n * `notifyUsers` can ask before it calls one, and every caller reads the same\n * answer.\n */\nexport function mobilePushEnabled(env: Record<string, string | undefined> = process.env): boolean {\n  return (env['MOBILE_PUSH_ENABLED'] ?? '').trim() !== '0'\n}\n\n/** The notification a push sender is handed, as the fan-out wrote it. */\nexport type MobilePushPayload = Omit<AglynNotification, '$id' | 'createdAt' | 'readAt'>\n\n/**\n * A push transport (APNs, FCM): sends one notification to the registered\n * devices (`users/{uid}/devices`) of `uids`. Must not throw on a delivery\n * failure; the console notification is the record and a push is a courtesy.\n */\nexport type MobilePushSender = (\n  uids: readonly string[],\n  payload: MobilePushPayload,\n  context: { db: Firestore },\n) => Promise<void>\n\nconst senders = new Set<MobilePushSender>()\n\n/**\n * Adds a push transport to the fan-out. `notifyUsers` hands every registered\n * sender the recipients whose preferences say push, after the feed entries\n * are committed and only while the kill switch is up. With none registered,\n * nothing is pushed. Returns the unregister function.\n */\nexport function registerMobilePushSender(sender: MobilePushSender): () => void {\n  senders.add(sender)\n  return () => {\n    senders.delete(sender)\n  }\n}\n\n/** The registered push transports, in registration order. */\nexport function mobilePushSenders(): MobilePushSender[] {\n  return [...senders]\n}\n"],"names":["mobilePushEnabled","env","process","trim","senders","Set","registerMobilePushSender","sender","add","delete","mobilePushSenders"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAKD;;;;;;;CAOC,GACD,OAAO,SAASA,kBAAkBC,MAA0CC,QAAQD,GAAG;QAC7EA;IAAR,OAAO,EAACA,2BAAAA,GAAG,CAAC,sBAAsB,YAA1BA,2BAA8B,IAAIE,IAAI,OAAO;AACvD;AAgBA,MAAMC,UAAU,IAAIC;AAEpB;;;;;CAKC,GACD,OAAO,SAASC,yBAAyBC,MAAwB;IAC/DH,QAAQI,GAAG,CAACD;IACZ,OAAO;QACLH,QAAQK,MAAM,CAACF;IACjB;AACF;AAEA,2DAA2D,GAC3D,OAAO,SAASG;IACd,OAAO;WAAIN;KAAQ;AACrB"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/mobile-push-switch.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { AglynNotification } from '@aglyn/aglyn/server'\nimport type { Firestore } from 'firebase-admin/firestore'\n\n/**\n * Whether this deployment sends mobile push (AGL-3648).\n *\n * On unless `MOBILE_PUSH_ENABLED=0`: the variable is a kill switch, not an\n * opt-in, and it governs every push sender. Kept apart from the senders so\n * `notifyUsers` can ask before it calls one, and every caller reads the same\n * answer.\n */\nexport function mobilePushEnabled(env: Record<string, string | undefined> = process.env): boolean {\n  return (env['MOBILE_PUSH_ENABLED'] ?? '').trim() !== '0'\n}\n\n/** The notification a push sender is handed, as the fan-out wrote it. */\nexport type MobilePushPayload = Omit<AglynNotification, '$id' | 'createdAt' | 'readAt'>\n\n/**\n * A push transport (APNs, FCM): sends one notification to the registered\n * devices (`users/{uid}/devices`) of `uids`. Must not throw on a delivery\n * failure; the console notification is the record and a push is a courtesy.\n */\nexport type MobilePushSender = (\n  uids: readonly string[],\n  payload: MobilePushPayload,\n  context: { db: Firestore },\n) => Promise<void>\n\n/*\n * The registry lives on `globalThis`, not in this module: `instrumentation.ts`\n * registers the senders in its own copy of this module, and a route handler's\n * `notifyUsers` reads another one (AGL-3412). A module-scoped set is empty\n * where it is read, and every push is silently skipped.\n */\nconst SENDERS_KEY = Symbol.for('@aglyn/tenant-data-admin:mobile-push-senders')\n\nconst globalScope = globalThis as typeof globalThis & {\n  [SENDERS_KEY]?: Set<MobilePushSender>\n}\n\nfunction senders(): Set<MobilePushSender> {\n  const existing = globalScope[SENDERS_KEY]\n  if (existing) return existing\n  const created = new Set<MobilePushSender>()\n  globalScope[SENDERS_KEY] = created\n  return created\n}\n\n/**\n * Adds a push transport to the fan-out. `notifyUsers` hands every registered\n * sender the recipients whose preferences say push, after the feed entries\n * are committed and only while the kill switch is up. With none registered,\n * nothing is pushed. Returns the unregister function.\n */\nexport function registerMobilePushSender(sender: MobilePushSender): () => void {\n  senders().add(sender)\n  return () => {\n    senders().delete(sender)\n  }\n}\n\n/** The registered push transports, in registration order. */\nexport function mobilePushSenders(): MobilePushSender[] {\n  return [...senders()]\n}\n"],"names":["mobilePushEnabled","env","process","trim","SENDERS_KEY","Symbol","for","globalScope","globalThis","senders","existing","created","Set","registerMobilePushSender","sender","add","delete","mobilePushSenders"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAKD;;;;;;;CAOC,GACD,OAAO,SAASA,kBAAkBC,MAA0CC,QAAQD,GAAG;QAC7EA;IAAR,OAAO,EAACA,2BAAAA,GAAG,CAAC,sBAAsB,YAA1BA,2BAA8B,IAAIE,IAAI,OAAO;AACvD;AAgBA;;;;;CAKC,GACD,MAAMC,cAAcC,OAAOC,GAAG,CAAC;AAE/B,MAAMC,cAAcC;AAIpB,SAASC;IACP,MAAMC,WAAWH,WAAW,CAACH,YAAY;IACzC,IAAIM,UAAU,OAAOA;IACrB,MAAMC,UAAU,IAAIC;IACpBL,WAAW,CAACH,YAAY,GAAGO;IAC3B,OAAOA;AACT;AAEA;;;;;CAKC,GACD,OAAO,SAASE,yBAAyBC,MAAwB;IAC/DL,UAAUM,GAAG,CAACD;IACd,OAAO;QACLL,UAAUO,MAAM,CAACF;IACnB;AACF;AAEA,2DAA2D,GAC3D,OAAO,SAASG;IACd,OAAO;WAAIR;KAAU;AACvB"}

package/src/lib/server/native-push.js

@@ -22,10 +22,13 @@
  * `push-delivery.ts`, and through it each transport, only when a
  * notification has push recipients.
  */ import { registerMobilePushSender } from "./mobile-push-switch.js";
-let registered = false;
+// On `globalThis` for the same reason as the registry itself: a second
+// module copy must not register a second sender and push everything twice.
+const REGISTERED_KEY = Symbol.for('@aglyn/tenant-data-admin:native-push-registered');
+const globalScope = globalThis;
 export function registerNativePushSenders() {
-    if (registered) return;
-    registered = true;
+    if (globalScope[REGISTERED_KEY]) return;
+    globalScope[REGISTERED_KEY] = true;
     registerMobilePushSender(async (uids, payload, context)=>{
         const { nativePushSender } = await import("./push-delivery.js");
         await nativePushSender(uids, payload, context);

package/src/lib/server/native-push.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/native-push.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Registers the native apps' push delivery (APNs and FCM, AGL-3651) with the\n * fan-out, once per server instance. A deployment's server entry calls it at\n * boot (the console's and the tenant's `instrumentation.ts`).\n *\n * This file imports nothing heavy: the sender it registers imports\n * `push-delivery.ts`, and through it each transport, only when a\n * notification has push recipients.\n */\n\nimport { registerMobilePushSender } from './mobile-push-switch'\n\nlet registered = false\n\nexport function registerNativePushSenders(): void {\n  if (registered) return\n  registered = true\n  registerMobilePushSender(async (uids, payload, context) => {\n    const { nativePushSender } = await import('./push-delivery')\n    await nativePushSender(uids, payload, context)\n  })\n}\n"],"names":["registerMobilePushSender","registered","registerNativePushSenders","uids","payload","context","nativePushSender"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;CAQC,GAED,SAASA,wBAAwB,QAAQ,0BAAsB;AAE/D,IAAIC,aAAa;AAEjB,OAAO,SAASC;IACd,IAAID,YAAY;IAChBA,aAAa;IACbD,yBAAyB,OAAOG,MAAMC,SAASC;QAC7C,MAAM,EAAEC,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC;QAC1C,MAAMA,iBAAiBH,MAAMC,SAASC;IACxC;AACF"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/native-push.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Registers the native apps' push delivery (APNs and FCM, AGL-3651) with the\n * fan-out, once per server instance. A deployment's server entry calls it at\n * boot (the console's and the tenant's `instrumentation.ts`).\n *\n * This file imports nothing heavy: the sender it registers imports\n * `push-delivery.ts`, and through it each transport, only when a\n * notification has push recipients.\n */\n\nimport { registerMobilePushSender } from './mobile-push-switch'\n\n// On `globalThis` for the same reason as the registry itself: a second\n// module copy must not register a second sender and push everything twice.\nconst REGISTERED_KEY = Symbol.for('@aglyn/tenant-data-admin:native-push-registered')\n\nconst globalScope = globalThis as typeof globalThis & { [REGISTERED_KEY]?: true }\n\nexport function registerNativePushSenders(): void {\n  if (globalScope[REGISTERED_KEY]) return\n  globalScope[REGISTERED_KEY] = true\n  registerMobilePushSender(async (uids, payload, context) => {\n    const { nativePushSender } = await import('./push-delivery')\n    await nativePushSender(uids, payload, context)\n  })\n}\n"],"names":["registerMobilePushSender","REGISTERED_KEY","Symbol","for","globalScope","globalThis","registerNativePushSenders","uids","payload","context","nativePushSender"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;CAQC,GAED,SAASA,wBAAwB,QAAQ,0BAAsB;AAE/D,uEAAuE;AACvE,2EAA2E;AAC3E,MAAMC,iBAAiBC,OAAOC,GAAG,CAAC;AAElC,MAAMC,cAAcC;AAEpB,OAAO,SAASC;IACd,IAAIF,WAAW,CAACH,eAAe,EAAE;IACjCG,WAAW,CAACH,eAAe,GAAG;IAC9BD,yBAAyB,OAAOO,MAAMC,SAASC;QAC7C,MAAM,EAAEC,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC;QAC1C,MAAMA,iBAAiBH,MAAMC,SAASC;IACxC;AACF"}

package/src/lib/server/notifications.d.ts

@@ -77,7 +77,7 @@ export declare function formatNotificationEmailDetails(details: readonly Notific
  * (AGL-3224) — sends one email beside it. Never throws: a notification miss,
  * or a send that failed, must not break the mutation that emitted it.
  */
-export declare function notifyUsers(uids: Iterable<string>, payload: NotificationPayload, options?: NotifyUsersOptions): Promise<void>;
+declare function notifyUsersNow(uids: Iterable<string>, payload: NotificationPayload, options?: NotifyUsersOptions): Promise<void>;
 /**
  * Notifies every staff-claim holder (AGL-850) — the support-desk audience.
  * Staff are not org members, so `notifyOrgAdmins`/`notifyHostManagers` never
@@ -90,13 +90,13 @@ export declare function notifyUsers(uids: Iterable<string>, payload: Notificatio
  * instead: the same console notification, plus staff's switches, the
  * operator email or digest, and the webhook. See `raiseOperatorAlert`.
  */
-export declare function notifyStaff(payload: NotificationPayload): Promise<void>;
+declare function notifyStaffNow(payload: NotificationPayload): Promise<void>;
 /**
  * The staff console notification alone, with the per-person email channel
  * it carries: what `notifyStaff` did before the registry, and what
  * `raiseOperatorAlert` writes as its first step. Never throws.
  */
-export declare function notifyStaffConsole(payload: NotificationPayload, options?: {
+declare function notifyStaffConsoleNow(payload: NotificationPayload, options?: {
     skipEmail?: boolean;
 }): Promise<void>;
 /**
@@ -106,7 +106,7 @@ export declare function notifyStaffConsole(payload: NotificationPayload, options
  * itself — the usage alerts do (AGL-3431) — so an admin who switched the
  * email channel on is not sent it twice.
  */
-export declare function notifyOrgAdmins(orgId: string, payload: NotificationPayload, options?: Pick<NotifyUsersOptions, 'skipEmail'>): Promise<void>;
+declare function notifyOrgAdminsNow(orgId: string, payload: NotificationPayload, options?: Pick<NotifyUsersOptions, 'skipEmail'>): Promise<void>;
 /**
  * The name a site's managers know it by: the name they gave it, then its
  * address, then — for a doc with neither — its id.
@@ -141,7 +141,7 @@ export declare function withSiteName(text: string, site: string): string;
  * read. Spread conditionally: the field is optional on the host model and
  * Firestore rejects `undefined`.
  */
-export declare function notifyHostManagers(hostId: string, payload: NotificationPayload, options?: {
+declare function notifyHostManagersNow(hostId: string, payload: NotificationPayload, options?: {
     /**
      * Mail the workspace owner nothing through the email channel, because
      * the caller sends them their own email about the same event.
@@ -150,3 +150,14 @@ export declare function notifyHostManagers(hostId: string, payload: Notification
     /** What the email alone carries; see {@link NotifyUsersOptions.emailDetails}. */
     emailDetails?: readonly NotificationEmailDetail[];
 }): Promise<void>;
+/** {@link notifyUsersNow}, kept alive past the response. */
+export declare function notifyUsers(...args: Parameters<typeof notifyUsersNow>): Promise<void>;
+/** {@link notifyStaffNow}, kept alive past the response. */
+export declare function notifyStaff(...args: Parameters<typeof notifyStaffNow>): Promise<void>;
+/** {@link notifyStaffConsoleNow}, kept alive past the response. */
+export declare function notifyStaffConsole(...args: Parameters<typeof notifyStaffConsoleNow>): Promise<void>;
+/** {@link notifyOrgAdminsNow}, kept alive past the response. */
+export declare function notifyOrgAdmins(...args: Parameters<typeof notifyOrgAdminsNow>): Promise<void>;
+/** {@link notifyHostManagersNow}, kept alive past the response. */
+export declare function notifyHostManagers(...args: Parameters<typeof notifyHostManagersNow>): Promise<void>;
+export {};

package/src/lib/server/notifications.js

@@ -25,6 +25,7 @@ import { findUserByUidAcrossPools, listStaffUidsAcrossPools } from "./auth-pools
 import { filterSuppressedEmails } from "./email-suppression.js";
 import { meterOrgEmail, meterPlatformEmail } from "./email-metering.js";
 import firebaseAdmin from "./firebase-admin.js";
+import { keepAlive } from "./keep-alive.js";
 import { mobilePushEnabled, mobilePushSenders } from "./mobile-push-switch.js";
 import { listOrgMembers } from "./organizations.js";
 import { loadSystemEmail, renderLoadedSystemEmail, systemEmailBrand, systemEmailContent } from "./render-system-email.js";
@@ -47,10 +48,10 @@ const firestore = ()=>firebaseAdmin.app().firestore();
  * At most this many directory lookups per fan-out, and at most this many
  * notification emails.
  *
- * Both ceilings only ever bite on a fan-out where many recipients have
- * OPTED IN — the email channel defaults off outside a site's transactions
- * (`NOTIFICATION_TYPE_CHANNEL_DEFAULTS`), so the ordinary notification
- * costs exactly what it cost before this existed. They are here because a
+ * Both ceilings bite only on a fan-out where many recipients are emailed —
+ * the email channel defaults off outside the types in
+ * `NOTIFICATION_TYPE_CHANNEL_DEFAULTS`, and every fan-out goes to one
+ * workspace's or one site's people, or to staff. They are here because a
  * fan-out takes up to 400 uids and `notifyUsers` runs inside the mutation
  * that emitted it: a notification must not be able to turn one write into
  * four hundred directory reads and four hundred sends.
@@ -199,7 +200,7 @@ const NOTIFY_EMAIL_MAX_SENDS = 50;
  * `users/{uid}/notifications`, and — for recipients who asked for it
  * (AGL-3224) — sends one email beside it. Never throws: a notification miss,
  * or a send that failed, must not break the mutation that emitted it.
- */ export async function notifyUsers(uids, payload, options = {}) {
+ */ async function notifyUsersNow(uids, payload, options = {}) {
     try {
         const db = firestore();
         const targets = [
@@ -315,7 +316,7 @@ async function listStaffUids() {
  * alert, a dispute nobody owns, a support ticket — is raised as that alert
  * instead: the same console notification, plus staff's switches, the
  * operator email or digest, and the webhook. See `raiseOperatorAlert`.
- */ export async function notifyStaff(payload) {
+ */ async function notifyStaffNow(payload) {
     try {
         const alert = operatorAlertForNotificationType(payload.type);
         if (alert) {
@@ -344,7 +345,7 @@ async function listStaffUids() {
  * The staff console notification alone, with the per-person email channel
  * it carries: what `notifyStaff` did before the registry, and what
  * `raiseOperatorAlert` writes as its first step. Never throws.
- */ export async function notifyStaffConsole(payload, options = {}) {
+ */ async function notifyStaffConsoleNow(payload, options = {}) {
     try {
         await notifyUsers(await listStaffUids(), payload, _extends({
             audience: 'staff'
@@ -361,7 +362,7 @@ async function listStaffUids() {
  * `skipEmail` is for a caller that emails the same notice to the same people
  * itself — the usage alerts do (AGL-3431) — so an admin who switched the
  * email channel on is not sent it twice.
- */ export async function notifyOrgAdmins(orgId, payload, options = {}) {
+ */ async function notifyOrgAdminsNow(orgId, payload, options = {}) {
     try {
         const members = await listOrgMembers(orgId);
         const admins = members.filter((member)=>member.role === 'owner' || member.role === 'admin');
@@ -423,7 +424,7 @@ async function listStaffUids() {
  * The host doc already carries `orgId` (AGL-233), so this costs no extra
  * read. Spread conditionally: the field is optional on the host model and
  * Firestore rejects `undefined`.
- */ export async function notifyHostManagers(hostId, payload, options = {}) {
+ */ async function notifyHostManagersNow(hostId, payload, options = {}) {
     try {
         var _host_get, _payload_orgId;
         const host = await firestore().collection('hosts').doc(hostId).get();
@@ -451,5 +452,25 @@ async function listStaffUids() {
         console.error('host manager notification failed', error);
     }
 }
+/*
+ * The fan-out's public doors. Most callers start a notification with
+ * `void notify…()` beside the mutation it reports, so each door hands its
+ * work to the platform's `waitUntil` (`keep-alive.ts`): the push and the email
+ * after the feed write are no longer cut off when the response goes out.
+ */ /** {@link notifyUsersNow}, kept alive past the response. */ export function notifyUsers(...args) {
+    return keepAlive(notifyUsersNow(...args));
+}
+/** {@link notifyStaffNow}, kept alive past the response. */ export function notifyStaff(...args) {
+    return keepAlive(notifyStaffNow(...args));
+}
+/** {@link notifyStaffConsoleNow}, kept alive past the response. */ export function notifyStaffConsole(...args) {
+    return keepAlive(notifyStaffConsoleNow(...args));
+}
+/** {@link notifyOrgAdminsNow}, kept alive past the response. */ export function notifyOrgAdmins(...args) {
+    return keepAlive(notifyOrgAdminsNow(...args));
+}
+/** {@link notifyHostManagersNow}, kept alive past the response. */ export function notifyHostManagers(...args) {
+    return keepAlive(notifyHostManagersNow(...args));
+}
 
 //# sourceMappingURL=notifications.js.map