@omega.js/backend 0.1.0

package/test/email/fixtures/field-report.json

@@ -0,0 +1,53 @@
+{
+  "_comment": "Predefined fixture for the `field-report` template. Loaded via NEWSLETTER_FIXTURE=field-report. Wire-service content shape: tldr + dateline + dispatches[{kicker, headline, byline, location, lede, dispatch, dataPoints, image_prompt}].",
+  "subject": "LinkedIn tightens identity — operators document everything",
+  "preheader": "Three filings from this week's platform front lines.",
+  "summary": "Wire from the platform front: LinkedIn is rolling identity verification across every business profile, YouTube is piloting upload-time attribution metadata, and the operators with clean documentation are outrunning everyone else.",
+  "tags": ["linkedin", "youtube", "platform-policy", "verification", "operator-playbook"],
+  "tldr": "LinkedIn is rolling out verified-account scrutiny across every business profile. Operators with paper trails will outrun the rest. Documentation is the new growth lever.",
+  "dateline": "OAKLAND",
+  "signoff": "— Stay sharp,\nThe Somiibo Desk",
+  "citations": [
+    { "note": "LinkedIn flagged 12,000 impersonation attempts in the verified-profile beta.", "source": "Reported by LinkedIn product team, May 2026" },
+    { "note": "Operator playbook adoption up 38% week-over-week in Q2.", "source": "Per platform analytics, May 2026" }
+  ],
+  "dispatches": [
+    {
+      "kicker": "LEAD DISPATCH",
+      "headline": "LinkedIn ships verified-profile gates for every business account",
+      "byline": "Filed by The Somiibo platform desk",
+      "location": "OAKLAND",
+      "lede": "A wave of identity-verification gates is rolling out across LinkedIn business profiles this week — and the platform is not asking politely.",
+      "dispatch": "LinkedIn now requires verified identity attestations on any business profile claiming more than 500 followers. The rollout is fast and uneven: some accounts hit the gate inside two days of profile activity, others sit unchallenged for weeks. The pattern that matters is this — accounts with documented attribution histories sail through verification in under twelve hours. Accounts without get queued. The practical implication is to lock down your attribution log this week, not next.",
+      "dataPoints": [
+        { "label": "PROFILES FLAGGED", "value": "12.4K" },
+        { "label": "AVG REVIEW TIME", "value": "14HR" },
+        { "label": "WoW APPROVAL", "value": "+38%" }
+      ],
+      "image_prompt": "Abstract geometric illustration of a verification checkmark inside a layered profile card."
+    },
+    {
+      "kicker": "FIELD NOTES",
+      "headline": "Documentation is the new operator moat",
+      "byline": "Filed by The Somiibo growth desk",
+      "location": "REMOTE",
+      "lede": "The teams surviving this round of platform scrutiny share one habit: they write everything down.",
+      "dispatch": "Operator playbooks — once dismissed as overhead — are now the difference between an account that recovers from a flag and one that gets permanently restricted. The teams already running on documented processes recover in days. The ones without burn weeks negotiating with support queues. Treat your playbook as a compliance artifact, not a knowledge-management nice-to-have.",
+      "dataPoints": [
+        { "label": "RECOVERY (DOCUMENTED)", "value": "4D" },
+        { "label": "RECOVERY (UNDOC)", "value": "21D" }
+      ],
+      "image_prompt": "Stack of geometric document layers casting clean shadows on a flat surface."
+    },
+    {
+      "kicker": "WATCH",
+      "headline": "YouTube tests creator-attribution metadata on uploads",
+      "byline": "Filed by The Somiibo signals desk",
+      "location": "NEW YORK",
+      "lede": "A small pilot suggests YouTube will soon ask creators to declare automated tooling and cross-posting workflows at upload time.",
+      "dispatch": "A subset of channels saw a new upload checkbox this week asking whether content was assisted by automation. The checkbox is optional today. Reading the room: it will not stay optional. Creators with clear internal workflows already labeled will adapt in an afternoon. Everyone else will spend a quarter retrofitting.",
+      "dataPoints": [],
+      "image_prompt": "Minimalist play button morphing into a label tag, flat geometric style."
+    }
+  ]
+}

package/test/email/identity.test.js

@@ -0,0 +1,321 @@
+/**
+ * Email identity test — every human/company identity in outbound email comes from
+ * config, and a missing one fails LOUDLY.
+ *
+ * The framework used to ship its author's name, headshot, personal links and the
+ * parent company's wordmark/BCC addresses as hardcoded fallbacks, so any brand that
+ * had not configured its own identity silently mailed its users as someone else.
+ * These checks pin the replacement: config-driven, or a thrown error — never a
+ * substituted identity.
+ *
+ * Plain-node unit test (no emulator, no network).
+ */
+const assert = require('node:assert');
+const { resolvePerson, resolveSignoff } = require('../../dist/manager/libraries/email/prepare.js');
+const { footer } = require('../../dist/manager/libraries/email/generators/lib/templates/base.js');
+const feedbackTemplate = require('../../dist/manager/libraries/email/generators/lib/templates/feedback.js');
+const defineCases = require('../../dist/vendor/devkit/test/define-cases.js');
+
+// The identity the framework used to hardcode. Nothing may ever emit these again.
+const FRAMEWORK_IDENTITY = /Ian Wiedenman|ianwiedenman|ianwieds|ITW Creative Works|itwcreativeworks/i;
+
+const brandWithPerson = {
+  name: 'Acme',
+  company: 'Acme Holdings Inc',
+  url: 'https://acme.example',
+  contact: {
+    email: 'support@acme.example',
+    person: {
+      name: 'Jane Doe, CEO',
+      image: 'https://acme.example/jane.jpg',
+      url: 'https://jane.example',
+      urlText: '@janedoe',
+    },
+  },
+  images: { companyWordmark: 'https://acme.example/holdings-wordmark.png' },
+};
+
+const brandWithoutPerson = { name: 'Acme', contact: { email: 'support@acme.example' } };
+
+// The audit-BCC checks go through the REAL transactional build — a resolver-only test
+// would still pass if build() stopped reading the config. Each build runs once and is
+// shared by its assertions.
+function buildWith(brand, settings) {
+  process.env.UNSUBSCRIBE_HMAC_KEY = process.env.UNSUBSCRIBE_HMAC_KEY || 'test-key';
+
+  const Transactional = require('../../dist/manager/libraries/email/transactional/index.js');
+  const Manager = {
+    config: {
+      brand: { id: 'acme', url: 'https://acme.example', images: {}, ...brand },
+      // The account's unsubscribe group ids (#649) — every send resolves one from config
+      marketing: { campaigns: { providers: { sendgrid: { groups: { orders: 900001, hello: 900002, account: 900003, marketing: 900004, security: 900005, newsletter: 900006, internal: 900007 } } } } },
+    },
+    project: { websiteUrl: 'https://acme.example' },
+    libraries: { admin: {} },
+    User: () => ({ properties: {} }),
+  };
+  const ctx = { Manager, log: () => {}, error: () => {} };
+
+  return new Transactional(ctx).build({
+    to: 'user@acme.example',
+    subject: 'Hi',
+    template: 'card',
+    copy: true,
+    ...settings,
+  });
+}
+
+let configuredBuild;
+const buildConfigured = () => (configuredBuild = configuredBuild || buildWith({
+  ...brandWithPerson,
+  contact: {
+    ...brandWithPerson.contact,
+    carbonCopy: [
+      { email: 'audit@acme.example', name: 'Acme Audit' },
+      { email: 'archive@acme.example' },
+    ],
+  },
+}));
+
+let unconfiguredBuild;
+const buildUnconfigured = () => (unconfiguredBuild = unconfiguredBuild || buildWith(brandWithPerson));
+
+let malformedBuild;
+const buildMalformed = () => (malformedBuild = malformedBuild || buildWith({
+  ...brandWithPerson,
+  contact: { ...brandWithPerson.contact, carbonCopy: [{ name: 'No Address' }] },
+}).catch((error) => error));
+
+module.exports = defineCases({
+  description: 'Email identity (person, company, audit BCCs come from config)',
+  type: 'group',
+  tests: [
+    // ---------- Personal signoff: config-driven ----------
+
+    {
+      name: 'personal signoff is filled from brand.contact.person',
+
+      run() {
+        const out = resolveSignoff({ type: 'personal' }, brandWithPerson);
+
+        assert.equal(out.name, 'Jane Doe, CEO');
+        assert.equal(out.image, 'https://acme.example/jane.jpg');
+        assert.equal(out.url, 'https://jane.example');
+        assert.equal(out.urlText, '@janedoe');
+      },
+    },
+
+    {
+      name: 'an explicit caller signoff still wins over config',
+
+      run() {
+        const out = resolveSignoff({ type: 'personal', name: 'Sam Smith, CTO' }, brandWithPerson);
+
+        assert.equal(out.name, 'Sam Smith, CTO');
+        // Unspecified fields still come from config.
+        assert.equal(out.url, 'https://jane.example');
+      },
+    },
+
+    {
+      name: 'firstName is derived from the brand OWN configured name',
+
+      run() {
+        assert.equal(resolvePerson(brandWithPerson).firstName, 'Jane');
+      },
+    },
+
+    {
+      name: 'an explicit firstName wins over the derivation',
+
+      run() {
+        const brand = { contact: { person: { name: 'Jonathan Doe, CEO', firstName: 'Jon' } } };
+
+        assert.equal(resolvePerson(brand).firstName, 'Jon');
+      },
+    },
+
+    {
+      name: 'optional person fields are omitted, not substituted',
+
+      run() {
+        const brand = { contact: { person: { name: 'Jane Doe' } } };
+        const out = resolveSignoff({ type: 'personal' }, brand);
+
+        assert.equal(out.image, null, 'a missing headshot must be null, not a stand-in face');
+        assert.equal(out.url, null);
+        assert.equal(out.urlText, null);
+      },
+    },
+
+    // ---------- Personal signoff: loud failure ----------
+
+    {
+      name: 'personal signoff with NO configured person throws',
+
+      run() {
+        assert.throws(
+          () => resolveSignoff({ type: 'personal' }, brandWithoutPerson),
+          (error) => error.code === 400 && /brand\.contact\.person\.name/.test(error.message),
+          'a missing person must fail loudly',
+        );
+      },
+    },
+
+    {
+      name: 'personal signoff with no brand at all throws',
+
+      run() {
+        assert.throws(() => resolveSignoff({ type: 'personal' }, undefined), (error) => error.code === 400);
+      },
+    },
+
+    {
+      name: 'the loud failure never leaks the framework identity',
+
+      run() {
+        // The whole point: refuse, rather than sign the mail as someone else.
+        let thrown;
+        try {
+          resolveSignoff({ type: 'personal' }, brandWithoutPerson);
+        } catch (error) {
+          thrown = error;
+        }
+
+        assert.ok(thrown, 'expected a throw');
+        assert.ok(!FRAMEWORK_IDENTITY.test(thrown.message), `error message leaked an identity: ${thrown.message}`);
+      },
+    },
+
+    {
+      name: 'a team signoff needs no person config (unchanged default path)',
+
+      run() {
+        const out = resolveSignoff({}, brandWithoutPerson);
+
+        assert.equal(out.type, 'team');
+        assert.equal(out.name, undefined);
+      },
+    },
+
+    // ---------- Footer: company identity ----------
+
+    {
+      name: 'footer renders the configured company name + wordmark',
+
+      run() {
+        const out = footer(brandWithPerson, {});
+
+        assert.ok(out.includes('Acme Holdings Inc'), `company name missing: ${out}`);
+        assert.ok(out.includes('https://acme.example/holdings-wordmark.png'), 'company wordmark missing');
+        assert.ok(!FRAMEWORK_IDENTITY.test(out), 'footer leaked the framework identity');
+      },
+    },
+
+    {
+      name: 'footer falls back to brand.name for the company name (documented schema chain)',
+
+      run() {
+        const out = footer({ name: 'Acme', url: 'https://acme.example' }, {});
+
+        assert.ok(out.includes('©') && out.includes('Acme'), `copyright name missing: ${out}`);
+        assert.ok(!FRAMEWORK_IDENTITY.test(out), 'footer leaked the framework identity');
+      },
+    },
+
+    {
+      name: 'footer omits the wordmark entirely when unconfigured',
+
+      run() {
+        const out = footer({ name: 'Acme', url: 'https://acme.example' }, {});
+
+        assert.ok(!out.includes('<mj-image'), `rendered a wordmark with nothing configured: ${out}`);
+      },
+    },
+
+    // ---------- Feedback template: no third-party asset host ----------
+
+    {
+      name: 'feedback template fetches no image from the framework CDN',
+
+      run() {
+        const out = feedbackTemplate.build({
+          data: { brand: brandWithPerson, email: { subject: 'Hi' } },
+          theme: {},
+        });
+
+        assert.ok(!FRAMEWORK_IDENTITY.test(out), 'feedback template leaked the framework identity');
+        assert.ok(!/<img/.test(out), `feedback template still loads a hosted image: ${out}`);
+      },
+    },
+
+    {
+      name: 'feedback template still renders all four rating faces',
+
+      run() {
+        const out = feedbackTemplate.build({
+          data: { brand: brandWithPerson, email: { subject: 'Hi' } },
+          theme: {},
+        });
+
+        // The glyphs that replaced the hosted PNGs — dislike/neutral/like/love.
+        for (const face of ['&#128542;', '&#128528;', '&#128578;', '&#128525;']) {
+          assert.ok(out.includes(face), `missing rating face ${face}`);
+        }
+
+        for (const rating of ['dislike', 'neutral', 'like', 'love']) {
+          assert.ok(out.includes(`rating=${rating}`), `missing rating link for ${rating}`);
+        }
+      },
+    },
+
+    // ---------- Integration: audit BCCs come from config, through the real build ----------
+
+    {
+      name: 'built email: audit BCCs come from brand.contact.carbonCopy',
+
+      async run() {
+        const configured = await buildConfigured();
+        const emails = configured.bcc.map((entry) => entry.email);
+
+        assert.deepEqual(emails, ['audit@acme.example', 'archive@acme.example']);
+        assert.equal(configured.bcc[0].name, 'Acme Audit');
+        // A nameless entry falls back to the company name, not a framework one.
+        assert.equal(configured.bcc[1].name, 'Acme Holdings Inc');
+      },
+    },
+
+    {
+      name: 'built email: no carbonCopy config means NO bcc — never the framework addresses',
+
+      async run() {
+        const unconfigured = await buildUnconfigured();
+
+        assert.deepEqual(unconfigured.bcc, [], `unexpected bcc: ${JSON.stringify(unconfigured.bcc)}`);
+        assert.ok(!FRAMEWORK_IDENTITY.test(JSON.stringify(unconfigured)), 'built email leaked the framework identity');
+      },
+    },
+
+    {
+      name: 'built email: copy: true still carbon-copies the brand itself (unchanged)',
+
+      async run() {
+        const unconfigured = await buildUnconfigured();
+
+        assert.equal(unconfigured.cc[0].email, 'support@acme.example');
+      },
+    },
+
+    {
+      name: 'built email: a carbonCopy entry with no email fails loudly',
+
+      async run() {
+        const malformed = await buildMalformed();
+
+        assert.ok(malformed instanceof Error, 'expected a throw');
+        assert.equal(malformed.code, 400);
+        assert.ok(/carbonCopy/.test(malformed.message), `unhelpful message: ${malformed.message}`);
+      },
+    },
+  ],
+});

package/test/email/marketing/consent-gate.test.js

@@ -0,0 +1,265 @@
+/**
+ * Consent gate test — verifies Marketing.add()/sync() skip users whose
+ * consent.marketing.status is the literal string 'revoked' (and ONLY then).
+ *
+ * Plain-node control-flow test (no emulator, no providers, no network):
+ * - isMarketingRevoked() — the pure gate semantic (revoked-only skip).
+ * - sync() — gate fires after doc resolution, BEFORE validation/providers, so a
+ *   revoked doc returns { blocked: 'consent', email } with zero I/O. Proceed cases
+ *   stop at the testing-mode provider guard (ctx.isTesting() → true here).
+ * - add() — by-email lookup runs through a minimal in-memory firestore stand-in to
+ *   exercise add()'s wiring (block on revoked, proceed on no-user, fail open on
+ *   lookup error). The emulator suites (test/routes/marketing/*) remain the
+ *   integration surface for the real Firestore paths.
+ */
+const assert = require('node:assert');
+const Marketing = require('../../../dist/manager/libraries/email/marketing/index.js');
+const defineCases = require('../../../dist/vendor/devkit/test/define-cases.js');
+
+const { isMarketingRevoked } = Marketing;
+
+// Proceed cases must stop at the testing-mode provider guard — never let an ambient
+// TEST_EXTENDED_MODE (or provider API keys) in the shell turn this into a live call.
+delete process.env.TEST_EXTENDED_MODE;
+
+// ─── isMarketingRevoked(): ONLY the literal 'revoked' blocks ───
+const GATE_CASES = [
+  { name: 'status revoked', doc: { consent: { marketing: { status: 'revoked' } } }, expect: true },
+  { name: 'status granted', doc: { consent: { marketing: { status: 'granted' } } }, expect: false },
+  { name: 'status null', doc: { consent: { marketing: { status: null } } }, expect: false },
+  { name: 'status missing', doc: { consent: { marketing: {} } }, expect: false },
+  { name: 'marketing missing', doc: { consent: {} }, expect: false },
+  { name: 'consent missing (legacy user)', doc: { auth: { email: 'legacy@gmail.com' } }, expect: false },
+  { name: 'empty doc', doc: {}, expect: false },
+  { name: 'null doc (no user)', doc: null, expect: false },
+  { name: 'undefined doc', doc: undefined, expect: false },
+  { name: 'status REVOKED (case-sensitive literal)', doc: { consent: { marketing: { status: 'REVOKED' } } }, expect: false },
+  { name: 'status pending (future enum value)', doc: { consent: { marketing: { status: 'pending' } } }, expect: false },
+  { name: 'status true (non-string)', doc: { consent: { marketing: { status: true } } }, expect: false },
+];
+
+/**
+ * Minimal ctx — just what the Marketing constructor + gate paths read.
+ * isTesting() → true so proceed cases stop at the provider guard (no network).
+ */
+function buildAssistant(admin) {
+  const calls = { logs: [], warns: [], errors: [] };
+
+  const ctx = {
+    Manager: {
+      libraries: { admin },
+      config: {},
+    },
+    isTesting: () => true,
+    log: (...args) => calls.logs.push(args),
+    warn: (...args) => calls.warns.push(args),
+    error: (...args) => calls.errors.push(args),
+  };
+
+  return { ctx, calls };
+}
+
+/**
+ * Minimal in-memory firestore stand-in for add()'s by-email lookup and sync()'s
+ * by-uid fetch. `userDoc: null` → empty query result / nonexistent doc.
+ * `failLookup: true` → the query get() rejects (exercises the fail-open path).
+ */
+function buildAdmin({ userDoc = null, failLookup = false } = {}) {
+  const captured = { queries: [], docPaths: [] };
+
+  const admin = {
+    firestore: () => ({
+      collection: (name) => ({
+        where: (field, op, value) => {
+          captured.queries.push({ collection: name, field, op, value });
+          return {
+            limit: () => ({
+              get: async () => {
+                if (failLookup) {
+                  throw new Error('firestore unavailable');
+                }
+                return userDoc
+                  ? { empty: false, docs: [{ id: 'test-uid', data: () => userDoc }] }
+                  : { empty: true, docs: [] };
+              },
+            }),
+          };
+        },
+      }),
+      doc: (path) => {
+        captured.docPaths.push(path);
+        return {
+          get: async () => ({
+            exists: !!userDoc,
+            data: () => userDoc,
+          }),
+        };
+      },
+    }),
+  };
+
+  return { admin, captured };
+}
+
+const REVOKED_DOC = {
+  auth: { email: 'revoked.user@gmail.com' },
+  consent: { marketing: { status: 'revoked' } },
+};
+
+const GRANTED_DOC = {
+  auth: { email: 'granted.user@gmail.com' },
+  consent: { marketing: { status: 'granted' } },
+};
+
+const LEGACY_DOC = {
+  auth: { email: 'legacy.user@gmail.com' },
+  // No consent field at all — pre-consent-system user, must keep syncing
+};
+
+module.exports = defineCases({
+  description: 'Marketing consent gate (revoked-only skip on add/sync)',
+  type: 'group',
+  tests: [
+    // ─── 1. isMarketingRevoked() semantics ───
+    ...GATE_CASES.map(({ name, doc, expect }) => ({
+      name: `isMarketingRevoked: ${name}`,
+
+      run() {
+        const actual = isMarketingRevoked(doc);
+
+        assert.strictEqual(actual, expect, `Expected ${expect}, got ${actual}`);
+      },
+    })),
+
+    // ─── 2. sync() blocks a revoked doc (gate fires before validation/providers) ───
+    {
+      name: 'sync(): blocks revoked doc',
+
+      async run() {
+        const { ctx, calls } = buildAssistant(null);
+        const result = await new Marketing(ctx).sync(REVOKED_DOC);
+
+        assert.strictEqual(result.blocked, 'consent', `Expected blocked='consent', got ${JSON.stringify(result)}`);
+        assert.strictEqual(result.email, 'revoked.user@gmail.com', `blocked result must include the email, got ${JSON.stringify(result)}`);
+        assert.strictEqual(calls.warns.length, 1, `revoked skip must log a warn, got ${calls.warns.length}`);
+      },
+    },
+
+    // ─── 3. sync() proceeds on missing consent (legacy user) ───
+    {
+      name: 'sync(): proceeds on missing consent',
+
+      async run() {
+        const { ctx } = buildAssistant(null);
+        const result = await new Marketing(ctx).sync(LEGACY_DOC);
+
+        assert.strictEqual(result.blocked, undefined, `Expected no block, got ${JSON.stringify(result)}`);
+      },
+    },
+
+    // ─── 4. sync() proceeds on granted consent ───
+    {
+      name: 'sync(): proceeds on granted consent',
+
+      async run() {
+        const { ctx } = buildAssistant(null);
+        const result = await new Marketing(ctx).sync(GRANTED_DOC);
+
+        assert.strictEqual(result.blocked, undefined, `Expected no block, got ${JSON.stringify(result)}`);
+      },
+    },
+
+    // ─── 5. sync() by uid blocks when the fetched doc is revoked ───
+    {
+      name: 'sync(uid): blocks revoked fetched doc',
+
+      async run() {
+        const { admin, captured } = buildAdmin({ userDoc: REVOKED_DOC });
+        const { ctx } = buildAssistant(admin);
+        const result = await new Marketing(ctx).sync('revoked-uid');
+
+        assert.strictEqual(result.blocked, 'consent', `Expected blocked='consent', got ${JSON.stringify(result)}`);
+        assert.strictEqual(captured.docPaths[0], 'users/revoked-uid', `Expected a users/{uid} fetch, got ${JSON.stringify(captured.docPaths)}`);
+      },
+    },
+
+    // ─── 6. add() blocks when the email maps to a revoked user ───
+    {
+      name: 'add(): blocks revoked user by email',
+
+      async run() {
+        const { admin, captured } = buildAdmin({ userDoc: REVOKED_DOC });
+        const { ctx, calls } = buildAssistant(admin);
+        const result = await new Marketing(ctx).add({ email: 'revoked.user@gmail.com' });
+
+        assert.strictEqual(result.blocked, 'consent', `Expected blocked='consent', got ${JSON.stringify(result)}`);
+        assert.strictEqual(result.email, 'revoked.user@gmail.com', `blocked result must include the email, got ${JSON.stringify(result)}`);
+        assert.strictEqual(calls.warns.length, 1, `revoked skip must log a warn, got ${calls.warns.length}`);
+
+        const query = captured.queries[0];
+
+        assert.ok(
+          query
+            && query.collection === 'users'
+            && query.field === 'auth.email'
+            && query.op === '=='
+            && query.value === 'revoked.user@gmail.com',
+          `add() must look up users by auth.email (the webhook-provider query), got ${JSON.stringify(query)}`,
+        );
+      },
+    },
+
+    // ─── 7. add() normalizes the email for the lookup ───
+    {
+      name: 'add(): lookup trims + lowercases the email',
+
+      async run() {
+        const { admin, captured } = buildAdmin({ userDoc: null });
+        const { ctx } = buildAssistant(admin);
+        await new Marketing(ctx).add({ email: '  Revoked.User@GMAIL.com  ' });
+
+        assert.strictEqual(captured.queries[0]?.value, 'revoked.user@gmail.com', `Got ${JSON.stringify(captured.queries[0])}`);
+      },
+    },
+
+    // ─── 8. add() proceeds when no user doc exists (pure newsletter contact) ───
+    {
+      name: 'add(): proceeds when no user doc exists',
+
+      async run() {
+        const { admin } = buildAdmin({ userDoc: null });
+        const { ctx } = buildAssistant(admin);
+        const result = await new Marketing(ctx).add({ email: 'newsletter.reader@gmail.com' });
+
+        assert.strictEqual(result.blocked, undefined, `Expected no block, got ${JSON.stringify(result)}`);
+      },
+    },
+
+    // ─── 9. add() proceeds when the matched user has no consent field (legacy) ───
+    {
+      name: 'add(): proceeds on legacy user (no consent field)',
+
+      async run() {
+        const { admin } = buildAdmin({ userDoc: LEGACY_DOC });
+        const { ctx } = buildAssistant(admin);
+        const result = await new Marketing(ctx).add({ email: 'legacy.user@gmail.com' });
+
+        assert.strictEqual(result.blocked, undefined, `Expected no block, got ${JSON.stringify(result)}`);
+      },
+    },
+
+    // ─── 10. add() fails open when the lookup errors ───
+    {
+      name: 'add(): fails open on lookup error',
+
+      async run() {
+        const { admin } = buildAdmin({ failLookup: true });
+        const { ctx, calls } = buildAssistant(admin);
+        const result = await new Marketing(ctx).add({ email: 'someone@gmail.com' });
+
+        assert.strictEqual(result.blocked, undefined, `Expected no block, got ${JSON.stringify(result)}`);
+        assert.strictEqual(calls.errors.length, 1, `lookup error must be logged, got ${calls.errors.length}`);
+      },
+    },
+  ],
+});