@aglyn/plugins-crm 1.0.0-beta.143

package/src/lib/server/recipe-routes.js

@@ -0,0 +1,442 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * THE RECIPES, INSTALLED FROM THE ORGANIZATION (AGL-2639).
+ *
+ * On a site, a recipe opens the Actions editor prefilled and writes nothing
+ * until the person saves — the editor is the writer, and the site's own
+ * role is the authority. The organization-level CRM hub has no editor: it
+ * mounts over every site with no site of its own, and an org running five
+ * sites installed "Welcome a new lead" five times by hand. These two routes
+ * are the org hub's door to a site's automations.
+ *
+ * `crm/recipe-install` writes the action a recipe builds into ONE site's
+ * `hosts/{hostId}/actions`, as the site editor would have saved it — the
+ * same builder, the same validator, the same stored shape — and refuses a
+ * second install of the same recipe on the same site by the stamp the
+ * builder puts on it. A server route rather than a client write for three
+ * reasons the browser cannot supply: the document is created by a server
+ * on every plan (the rules close `actions` to client creates, and the
+ * per-site cap is counted here); the stamp is the server's word, not the
+ * caller's; and the site is checked to be one the caller may manage —
+ * at the org level, a site OF THE ORG the caller holds org-wide reach in,
+ * so a host id typed into the body cannot reach a site under another
+ * workspace.
+ *
+ * `crm/recipe-status` reads the stamps back for every site of the org, so
+ * the card can say which sites carry which recipe. An action with no stamp
+ * at all — saved before the stamp existed — is counted, not ignored: it
+ * may well be a recipe, and the reader is told the site "may already have
+ * it" rather than shown a clean slate.
+ *
+ * Both routes serve the site variant too (`hostId` alone, authorized by the
+ * host role that creates actions today), so a site-level caller gets the
+ * same answers; the org variant (`orgId` in the body) is the one the org
+ * hub uses.
+ */ import { ACTIONS_MAX_PER_HOST, checkEntitlement, createResourceUid, crmActionRecipe, hostActionDocument, hostActionRecipeId, hostRoleCanWrite, planLabelGrantingFeature, validateHostAction } from "@aglyn/aglyn/server";
+import { firebaseAdmin, getOrgForHost, logHostActivity, logOrgActivity } from "@aglyn/tenant-data-admin";
+import { isRefusedIdToken } from "@aglyn/tenant-data-admin/server/id-token-refusal";
+import { FieldValue } from "firebase-admin/firestore";
+import { CRM_API_ROUTES } from "../constants/api-routes.js";
+import { authorizeOrgCaller, orgHostIds, readCrmRouteScope } from "./org-caller.js";
+import { crmSuiteRefusal } from "./suite-gate.js";
+export const CRM_RECIPE_INSTALL_ROUTE = CRM_API_ROUTES.recipeInstall;
+export const CRM_RECIPE_STATUS_ROUTE = CRM_API_ROUTES.recipeStatus;
+const INSTALL_REFUSAL = 'Installing a recipe requires the data permission across the whole workspace';
+const STATUS_REFUSAL = 'Reading which sites carry a recipe requires the data permission across the whole workspace';
+function typed(value, max) {
+    return String(value != null ? value : '').trim().slice(0, max);
+}
+/**
+ * The site variant's authority: the role on the host document that creates
+ * an action through `/api/hosts/resources` today. Staff pass, as they pass
+ * that route. Answers the host snapshot it read, so the caller reads it
+ * once.
+ */ async function authorizeSiteWriter(req, hostId) {
+    var _req_headers_authorization, _host_get, _decoded_email;
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return {
+        ok: false,
+        status: 401,
+        error: 'Unauthenticated'
+    };
+    let decoded;
+    try {
+        decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+    } catch (error) {
+        // A refused credential is the caller's 401; a failure to check one is
+        // ours and keeps a 5xx (AGL-2852).
+        if (isRefusedIdToken(error)) return {
+            ok: false,
+            status: 401,
+            error: 'Unauthenticated'
+        };
+        console.error('[crm] the recipe site writer could not be verified', error);
+        return {
+            ok: false,
+            status: 500,
+            error: 'The sign-in could not be checked. Try again.'
+        };
+    }
+    const staff = decoded.staff === true;
+    const host = await firebaseAdmin.app().firestore().collection('hosts').doc(hostId).get();
+    if (!host.exists) return {
+        ok: false,
+        status: 404,
+        error: 'Unknown site'
+    };
+    const role = ((_host_get = host.get('memberRoles')) != null ? _host_get : {})[decoded.uid];
+    if (!staff && !hostRoleCanWrite(role)) {
+        return {
+            ok: false,
+            status: 403,
+            error: 'Editing requires the editor role'
+        };
+    }
+    const resolved = await getOrgForHost(hostId);
+    if (!resolved) return {
+        ok: false,
+        status: 404,
+        error: 'Unknown site'
+    };
+    return {
+        ok: true,
+        uid: decoded.uid,
+        email: (_decoded_email = decoded.email) != null ? _decoded_email : null,
+        staff,
+        orgId: resolved.orgId,
+        org: resolved.org,
+        host
+    };
+}
+/**
+ * The org variant's site check: the host document, when it belongs to the
+ * organization the caller was admitted to. A site under another workspace
+ * — or none — reads as unknown, so a probe learns nothing from the answer.
+ */ async function siteOfOrg(firestore, hostId, orgId) {
+    const host = await firestore.collection('hosts').doc(hostId).get();
+    return host.exists && host.get('orgId') === orgId ? host : null;
+}
+/** How a site reads in a feed line: its display name, its subdomain, its id. */ function siteLabel(host) {
+    var _host_get, _host_get1;
+    return String((_host_get = host.get('displayName')) != null ? _host_get : '').trim() || String((_host_get1 = host.get('subdomain')) != null ? _host_get1 : '').trim() || host.id;
+}
+/**
+ * The stamps a site's LIVE actions carry, read with a field mask: the
+ * install's duplicate check and the status sweep ask the same question,
+ * and neither needs a trigger or a step list to answer it. A soft-deleted
+ * action (`deletedAt`) is a freed slot and counts for nothing.
+ */ function readSiteStamps(rows) {
+    const installed = new Map();
+    let unstamped = 0;
+    let live = 0;
+    for (const row of rows.docs){
+        if (row.get('deletedAt') != null) continue;
+        live += 1;
+        const stamp = hostActionRecipeId(row.data());
+        if (stamp === undefined) unstamped += 1;
+        else if (stamp && !installed.has(stamp)) installed.set(stamp, row.id);
+    }
+    return {
+        installed,
+        unstamped,
+        live
+    };
+}
+const stampsQuery = (host)=>host.collection('actions').select('recipe', 'deletedAt');
+/**
+ * `POST /api/crm/recipe-install`
+ *
+ * The body is a CrmRecipeInstallRequest: the site, the recipe, the form a
+ * recipe that needs one is keyed on, and the org at the organization level.
+ * Answers 201 with a CrmRecipeInstallResult once the action is written, and
+ * 409 when a live action on the site already carries the stamp — naming it,
+ * so the caller can say "already installed" rather than install it twice.
+ *
+ * The write is one transaction: the stamps are read, the duplicate and the
+ * per-site cap are judged, and the document is created — all inside it, so
+ * two installs racing for the same site cannot both land.
+ */ export const crmRecipeInstallHandler = async (req, res)=>{
+    var _req_body, _ref;
+    if (req.method !== 'POST') {
+        res.setHeader('Allow', 'POST');
+        res.status(405).json({
+            error: 'Method not allowed'
+        });
+        return;
+    }
+    const body = typeof req.body === 'string' ? JSON.parse(req.body) : (_req_body = req.body) != null ? _req_body : {};
+    const scope = readCrmRouteScope(body);
+    const hostId = (_ref = scope == null ? void 0 : scope.hostId) != null ? _ref : '';
+    if (!scope || !hostId) {
+        res.status(400).json({
+            error: 'Missing hostId'
+        });
+        return;
+    }
+    const recipe = crmActionRecipe(typed(body.recipeId, 64));
+    if (!recipe) {
+        res.status(400).json({
+            error: 'Pick a recipe'
+        });
+        return;
+    }
+    const formId = typed(body.formId, 200);
+    try {
+        const firestore = firebaseAdmin.app().firestore();
+        let writer;
+        if (scope.level === 'org') {
+            const caller = await authorizeOrgCaller(req, scope.orgId, {
+                needs: 'data.manage',
+                refusal: INSTALL_REFUSAL
+            });
+            if (caller.ok === false) {
+                res.status(caller.status).json({
+                    error: caller.error
+                });
+                return;
+            }
+            const host = await siteOfOrg(firestore, hostId, caller.orgId);
+            if (!host) {
+                res.status(404).json({
+                    error: 'Unknown site'
+                });
+                return;
+            }
+            writer = {
+                ok: true,
+                uid: caller.uid,
+                email: caller.email,
+                staff: caller.staff,
+                orgId: caller.orgId,
+                org: caller.org,
+                host
+            };
+        } else {
+            const caller = await authorizeSiteWriter(req, hostId);
+            if (caller.ok === false) {
+                res.status(caller.status).json({
+                    error: caller.error
+                });
+                return;
+            }
+            writer = caller;
+        }
+        // A recipe is a CRM automation first (AGL-2787): the suite is asked
+        // before the actions builder, so a plan without either is told about
+        // the one the recipe belongs to.
+        const suite = crmSuiteRefusal(writer.org, 'A CRM recipe');
+        if (suite) {
+            res.status(suite.status).json(suite.body);
+            return;
+        }
+        // The gate the site's own Recipes menu applies, judged here from the
+        // org document rather than trusted from the console: a recipe is an
+        // action, and the plan that carries one carries the other.
+        if (!checkEntitlement(writer.org, 'actions')) {
+            var _planLabelGrantingFeature;
+            res.status(403).json({
+                error: `The actions builder requires the ${(_planLabelGrantingFeature = planLabelGrantingFeature('actions')) != null ? _planLabelGrantingFeature : 'Pro'} ` + 'plan — see Billing to upgrade'
+            });
+            return;
+        }
+        const hostRef = writer.host.ref;
+        let form;
+        if (recipe.needs === 'form') {
+            var _snapshot_get;
+            if (!formId) {
+                res.status(400).json({
+                    error: 'Pick one of the site’s forms'
+                });
+                return;
+            }
+            const snapshot = await hostRef.collection('forms').doc(formId).get();
+            if (!snapshot.exists) {
+                res.status(404).json({
+                    error: 'Unknown form'
+                });
+                return;
+            }
+            // An archived form collects nothing, so a recipe keyed on it would
+            // never fire; the name falls back to the id the way every form list's does.
+            if (snapshot.get('archivedAt') != null) {
+                res.status(400).json({
+                    error: 'That form is archived and collects nothing'
+                });
+                return;
+            }
+            form = {
+                id: snapshot.id,
+                name: String((_snapshot_get = snapshot.get('displayName')) != null ? _snapshot_get : '').trim() || snapshot.id
+            };
+        }
+        const action = recipe.build(form ? {
+            form
+        } : undefined);
+        const problem = validateHostAction(action);
+        if (problem) {
+            res.status(400).json({
+                error: problem
+            });
+            return;
+        }
+        const actionId = createResourceUid();
+        const outcome = await firestore.runTransaction(async (tx)=>{
+            const stamps = readSiteStamps(await tx.get(stampsQuery(hostRef)));
+            const existing = stamps.installed.get(recipe.id);
+            if (existing) {
+                return {
+                    status: 409,
+                    error: 'Already installed on this site',
+                    actionId: existing
+                };
+            }
+            if (stamps.live >= ACTIONS_MAX_PER_HOST) {
+                return {
+                    status: 403,
+                    error: `interactions and actions are capped at ${ACTIONS_MAX_PER_HOST} per site`
+                };
+            }
+            tx.create(hostRef.collection('actions').doc(actionId), _extends({}, hostActionDocument(action), {
+                createdAt: FieldValue.serverTimestamp(),
+                updatedAt: FieldValue.serverTimestamp(),
+                createdBy: writer.uid
+            }));
+            return null;
+        });
+        if (outcome) {
+            res.status(outcome.status).json(_extends({
+                error: outcome.error
+            }, outcome.actionId ? {
+                actionId: outcome.actionId
+            } : {}));
+            return;
+        }
+        const actor = {
+            uid: writer.uid,
+            email: writer.email
+        };
+        await logHostActivity(hostId, actor, 'Installed recipe', {
+            type: 'content',
+            id: actionId,
+            name: action.name
+        });
+        // The org hub's own feed line, for the act it performed (AGL-2634).
+        if (scope.level === 'org') {
+            await logOrgActivity(writer.orgId, actor, `Installed the “${recipe.title}” recipe on ${siteLabel(writer.host)}`, {
+                type: 'host',
+                id: hostId,
+                name: siteLabel(writer.host)
+            });
+        }
+        const answer = {
+            ok: true,
+            actionId,
+            name: action.name,
+            recipeId: recipe.id
+        };
+        res.status(201).json(answer);
+    } catch (error) {
+        console.error('[crm] recipe install failed', hostId, error);
+        res.status(500).json({
+            error: 'The recipe could not be installed'
+        });
+    }
+};
+/**
+ * `POST /api/crm/recipe-status`
+ *
+ * The body names the organization (`orgId`) for every one of its sites, or
+ * one site (`hostId`) for that site alone. Answers `ok: true` and `sites`,
+ * one CrmRecipeSiteStatus per site swept.
+ */ export const crmRecipeStatusHandler = async (req, res)=>{
+    var _req_body;
+    if (req.method !== 'POST') {
+        res.setHeader('Allow', 'POST');
+        res.status(405).json({
+            error: 'Method not allowed'
+        });
+        return;
+    }
+    const body = typeof req.body === 'string' ? JSON.parse(req.body) : (_req_body = req.body) != null ? _req_body : {};
+    const scope = readCrmRouteScope(body);
+    if (!scope) {
+        res.status(400).json({
+            error: 'Missing orgId or hostId'
+        });
+        return;
+    }
+    try {
+        const firestore = firebaseAdmin.app().firestore();
+        let orgId = null;
+        let org;
+        if (scope.level === 'org') {
+            const caller = await authorizeOrgCaller(req, scope.orgId, {
+                needs: 'data.manage',
+                refusal: STATUS_REFUSAL
+            });
+            if (caller.ok === false) {
+                res.status(caller.status).json({
+                    error: caller.error
+                });
+                return;
+            }
+            orgId = caller.orgId;
+            org = caller.org;
+        } else {
+            const caller = await authorizeSiteWriter(req, scope.hostId);
+            if (caller.ok === false) {
+                res.status(caller.status).json({
+                    error: caller.error
+                });
+                return;
+            }
+            org = caller.org;
+        }
+        // The plan after the caller, before any site is read (AGL-2851).
+        const suite = crmSuiteRefusal(org, 'Reading which sites carry a CRM recipe');
+        if (suite) {
+            res.status(suite.status).json(suite.body);
+            return;
+        }
+        const hostIds = orgId ? await orgHostIds(firestore, orgId) : [
+            scope.hostId
+        ];
+        const sites = await Promise.all(hostIds.map(async (hostId)=>{
+            const stamps = readSiteStamps(await stampsQuery(firestore.collection('hosts').doc(hostId)).get());
+            return {
+                hostId,
+                installed: [
+                    ...stamps.installed.keys()
+                ],
+                unstamped: stamps.unstamped
+            };
+        }));
+        res.status(200).json({
+            ok: true,
+            sites
+        });
+    } catch (error) {
+        console.error('[crm] recipe status failed', error);
+        res.status(500).json({
+            error: 'The recipe status could not be read'
+        });
+    }
+};
+
+//# sourceMappingURL=recipe-routes.js.map

package/src/lib/server/recipe-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/recipe-routes.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * THE RECIPES, INSTALLED FROM THE ORGANIZATION (AGL-2639).\n *\n * On a site, a recipe opens the Actions editor prefilled and writes nothing\n * until the person saves — the editor is the writer, and the site's own\n * role is the authority. The organization-level CRM hub has no editor: it\n * mounts over every site with no site of its own, and an org running five\n * sites installed \"Welcome a new lead\" five times by hand. These two routes\n * are the org hub's door to a site's automations.\n *\n * `crm/recipe-install` writes the action a recipe builds into ONE site's\n * `hosts/{hostId}/actions`, as the site editor would have saved it — the\n * same builder, the same validator, the same stored shape — and refuses a\n * second install of the same recipe on the same site by the stamp the\n * builder puts on it. A server route rather than a client write for three\n * reasons the browser cannot supply: the document is created by a server\n * on every plan (the rules close `actions` to client creates, and the\n * per-site cap is counted here); the stamp is the server's word, not the\n * caller's; and the site is checked to be one the caller may manage —\n * at the org level, a site OF THE ORG the caller holds org-wide reach in,\n * so a host id typed into the body cannot reach a site under another\n * workspace.\n *\n * `crm/recipe-status` reads the stamps back for every site of the org, so\n * the card can say which sites carry which recipe. An action with no stamp\n * at all — saved before the stamp existed — is counted, not ignored: it\n * may well be a recipe, and the reader is told the site \"may already have\n * it\" rather than shown a clean slate.\n *\n * Both routes serve the site variant too (`hostId` alone, authorized by the\n * host role that creates actions today), so a site-level caller gets the\n * same answers; the org variant (`orgId` in the body) is the one the org\n * hub uses.\n */\n\nimport {\n  ACTIONS_MAX_PER_HOST,\n  type AglynOrganization,\n  checkEntitlement,\n  createResourceUid,\n  crmActionRecipe,\n  type CrmActionRecipeId,\n  hostActionDocument,\n  hostActionRecipeId,\n  hostRoleCanWrite,\n  planLabelGrantingFeature,\n  type PluginApiHandler,\n  type PluginApiRequest,\n  validateHostAction,\n} from '@aglyn/aglyn/server'\nimport {\n  firebaseAdmin,\n  getOrgForHost,\n  logHostActivity,\n  logOrgActivity,\n} from '@aglyn/tenant-data-admin'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport {\n  CRM_API_ROUTES,\n  type CrmRecipeInstallRequest,\n  type CrmRecipeInstallResult,\n  type CrmRecipeSiteStatus,\n} from '../constants/api-routes'\nimport { authorizeOrgCaller, orgHostIds, readCrmRouteScope } from './org-caller'\nimport { crmSuiteRefusal } from './suite-gate'\n\nexport const CRM_RECIPE_INSTALL_ROUTE = CRM_API_ROUTES.recipeInstall\nexport const CRM_RECIPE_STATUS_ROUTE = CRM_API_ROUTES.recipeStatus\n\ntype Refusal = { ok: false; status: number; error: string }\n\n/** A verified caller who may write a site's actions, and the site's org. */\ninterface SiteWriter {\n  ok: true\n  uid: string\n  email: string | null\n  staff: boolean\n  orgId: string\n  org: Partial<AglynOrganization>\n  host: FirebaseFirestore.DocumentSnapshot\n}\n\nconst INSTALL_REFUSAL =\n  'Installing a recipe requires the data permission across the whole workspace'\nconst STATUS_REFUSAL =\n  'Reading which sites carry a recipe requires the data permission across the whole workspace'\n\nfunction typed(value: unknown, max: number): string {\n  return String(value ?? '')\n    .trim()\n    .slice(0, max)\n}\n\n/**\n * The site variant's authority: the role on the host document that creates\n * an action through `/api/hosts/resources` today. Staff pass, as they pass\n * that route. Answers the host snapshot it read, so the caller reads it\n * once.\n */\nasync function authorizeSiteWriter(\n  req: PluginApiRequest,\n  hostId: string,\n): Promise<SiteWriter | Refusal> {\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return { ok: false, status: 401, error: 'Unauthenticated' }\n  let decoded: { uid: string; email?: string; staff?: unknown }\n  try {\n    decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n  } catch (error) {\n    // A refused credential is the caller's 401; a failure to check one is\n    // ours and keeps a 5xx (AGL-2852).\n    if (isRefusedIdToken(error)) return { ok: false, status: 401, error: 'Unauthenticated' }\n    console.error('[crm] the recipe site writer could not be verified', error)\n    return { ok: false, status: 500, error: 'The sign-in could not be checked. Try again.' }\n  }\n  const staff = decoded.staff === true\n  const host = await firebaseAdmin\n    .app()\n    .firestore()\n    .collection('hosts')\n    .doc(hostId)\n    .get()\n  if (!host.exists) return { ok: false, status: 404, error: 'Unknown site' }\n  const role = (host.get('memberRoles') ?? {})[decoded.uid]\n  if (!staff && !hostRoleCanWrite(role)) {\n    return { ok: false, status: 403, error: 'Editing requires the editor role' }\n  }\n  const resolved = await getOrgForHost(hostId)\n  if (!resolved) return { ok: false, status: 404, error: 'Unknown site' }\n  return {\n    ok: true,\n    uid: decoded.uid,\n    email: decoded.email ?? null,\n    staff,\n    orgId: resolved.orgId,\n    org: resolved.org,\n    host,\n  }\n}\n\n/**\n * The org variant's site check: the host document, when it belongs to the\n * organization the caller was admitted to. A site under another workspace\n * — or none — reads as unknown, so a probe learns nothing from the answer.\n */\nasync function siteOfOrg(\n  firestore: FirebaseFirestore.Firestore,\n  hostId: string,\n  orgId: string,\n): Promise<FirebaseFirestore.DocumentSnapshot | null> {\n  const host = await firestore.collection('hosts').doc(hostId).get()\n  return host.exists && host.get('orgId') === orgId ? host : null\n}\n\n/** How a site reads in a feed line: its display name, its subdomain, its id. */\nfunction siteLabel(host: FirebaseFirestore.DocumentSnapshot): string {\n  return (\n    String(host.get('displayName') ?? '').trim() ||\n    String(host.get('subdomain') ?? '').trim() ||\n    host.id\n  )\n}\n\n/**\n * The stamps a site's LIVE actions carry, read with a field mask: the\n * install's duplicate check and the status sweep ask the same question,\n * and neither needs a trigger or a step list to answer it. A soft-deleted\n * action (`deletedAt`) is a freed slot and counts for nothing.\n */\nfunction readSiteStamps(rows: FirebaseFirestore.QuerySnapshot): {\n  installed: Map<CrmActionRecipeId, string>\n  unstamped: number\n  live: number\n} {\n  const installed = new Map<CrmActionRecipeId, string>()\n  let unstamped = 0\n  let live = 0\n  for (const row of rows.docs) {\n    if (row.get('deletedAt') != null) continue\n    live += 1\n    const stamp = hostActionRecipeId(row.data())\n    if (stamp === undefined) unstamped += 1\n    else if (stamp && !installed.has(stamp)) installed.set(stamp, row.id)\n  }\n  return { installed, unstamped, live }\n}\n\nconst stampsQuery = (host: FirebaseFirestore.DocumentReference) =>\n  host.collection('actions').select('recipe', 'deletedAt')\n\n/**\n * `POST /api/crm/recipe-install`\n *\n * The body is a CrmRecipeInstallRequest: the site, the recipe, the form a\n * recipe that needs one is keyed on, and the org at the organization level.\n * Answers 201 with a CrmRecipeInstallResult once the action is written, and\n * 409 when a live action on the site already carries the stamp — naming it,\n * so the caller can say \"already installed\" rather than install it twice.\n *\n * The write is one transaction: the stamps are read, the duplicate and the\n * per-site cap are judged, and the document is created — all inside it, so\n * two installs racing for the same site cannot both land.\n */\nexport const crmRecipeInstallHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  const body: Partial<CrmRecipeInstallRequest> =\n    typeof req.body === 'string' ? JSON.parse(req.body) : (req.body ?? {})\n  const scope = readCrmRouteScope(body as Record<string, unknown>)\n  const hostId = scope?.hostId ?? ''\n  if (!scope || !hostId) {\n    res.status(400).json({ error: 'Missing hostId' })\n    return\n  }\n  const recipe = crmActionRecipe(typed(body.recipeId, 64))\n  if (!recipe) {\n    res.status(400).json({ error: 'Pick a recipe' })\n    return\n  }\n  const formId = typed(body.formId, 200)\n\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    let writer: SiteWriter\n    if (scope.level === 'org') {\n      const caller = await authorizeOrgCaller(req, scope.orgId, {\n        needs: 'data.manage',\n        refusal: INSTALL_REFUSAL,\n      })\n      if (caller.ok === false) {\n        res.status(caller.status).json({ error: caller.error })\n        return\n      }\n      const host = await siteOfOrg(firestore, hostId, caller.orgId)\n      if (!host) {\n        res.status(404).json({ error: 'Unknown site' })\n        return\n      }\n      writer = {\n        ok: true,\n        uid: caller.uid,\n        email: caller.email,\n        staff: caller.staff,\n        orgId: caller.orgId,\n        org: caller.org,\n        host,\n      }\n    } else {\n      const caller = await authorizeSiteWriter(req, hostId)\n      if (caller.ok === false) {\n        res.status(caller.status).json({ error: caller.error })\n        return\n      }\n      writer = caller\n    }\n\n    // A recipe is a CRM automation first (AGL-2787): the suite is asked\n    // before the actions builder, so a plan without either is told about\n    // the one the recipe belongs to.\n    const suite = crmSuiteRefusal(writer.org, 'A CRM recipe')\n    if (suite) {\n      res.status(suite.status).json(suite.body)\n      return\n    }\n\n    // The gate the site's own Recipes menu applies, judged here from the\n    // org document rather than trusted from the console: a recipe is an\n    // action, and the plan that carries one carries the other.\n    if (!checkEntitlement(writer.org, 'actions')) {\n      res.status(403).json({\n        error:\n          `The actions builder requires the ${planLabelGrantingFeature('actions') ?? 'Pro'} ` +\n          'plan — see Billing to upgrade',\n      })\n      return\n    }\n\n    const hostRef = writer.host.ref\n    let form: { id: string; name: string } | undefined\n    if (recipe.needs === 'form') {\n      if (!formId) {\n        res.status(400).json({ error: 'Pick one of the site’s forms' })\n        return\n      }\n      const snapshot = await hostRef.collection('forms').doc(formId).get()\n      if (!snapshot.exists) {\n        res.status(404).json({ error: 'Unknown form' })\n        return\n      }\n      // An archived form collects nothing, so a recipe keyed on it would\n      // never fire; the name falls back to the id the way every form list's does.\n      if (snapshot.get('archivedAt') != null) {\n        res.status(400).json({ error: 'That form is archived and collects nothing' })\n        return\n      }\n      form = {\n        id: snapshot.id,\n        name: String(snapshot.get('displayName') ?? '').trim() || snapshot.id,\n      }\n    }\n\n    const action = recipe.build(form ? { form } : undefined)\n    const problem = validateHostAction(action)\n    if (problem) {\n      res.status(400).json({ error: problem })\n      return\n    }\n\n    const actionId = createResourceUid()\n    const outcome = await firestore.runTransaction(async (tx) => {\n      const stamps = readSiteStamps(await tx.get(stampsQuery(hostRef)))\n      const existing = stamps.installed.get(recipe.id)\n      if (existing) {\n        return {\n          status: 409,\n          error: 'Already installed on this site',\n          actionId: existing,\n        }\n      }\n      if (stamps.live >= ACTIONS_MAX_PER_HOST) {\n        return {\n          status: 403,\n          error: `interactions and actions are capped at ${ACTIONS_MAX_PER_HOST} per site`,\n        }\n      }\n      tx.create(hostRef.collection('actions').doc(actionId), {\n        ...hostActionDocument(action),\n        createdAt: FieldValue.serverTimestamp(),\n        updatedAt: FieldValue.serverTimestamp(),\n        createdBy: writer.uid,\n      })\n      return null\n    })\n    if (outcome) {\n      res.status(outcome.status).json({\n        error: outcome.error,\n        ...(outcome.actionId ? { actionId: outcome.actionId } : {}),\n      })\n      return\n    }\n\n    const actor = { uid: writer.uid, email: writer.email }\n    await logHostActivity(hostId, actor, 'Installed recipe', {\n      type: 'content',\n      id: actionId,\n      name: action.name,\n    })\n    // The org hub's own feed line, for the act it performed (AGL-2634).\n    if (scope.level === 'org') {\n      await logOrgActivity(\n        writer.orgId,\n        actor,\n        `Installed the “${recipe.title}” recipe on ${siteLabel(writer.host)}`,\n        { type: 'host', id: hostId, name: siteLabel(writer.host) },\n      )\n    }\n    const answer: CrmRecipeInstallResult = {\n      ok: true,\n      actionId,\n      name: action.name,\n      recipeId: recipe.id,\n    }\n    res.status(201).json(answer)\n  } catch (error) {\n    console.error('[crm] recipe install failed', hostId, error)\n    res.status(500).json({ error: 'The recipe could not be installed' })\n  }\n}\n\n/**\n * `POST /api/crm/recipe-status`\n *\n * The body names the organization (`orgId`) for every one of its sites, or\n * one site (`hostId`) for that site alone. Answers `ok: true` and `sites`,\n * one CrmRecipeSiteStatus per site swept.\n */\nexport const crmRecipeStatusHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  const body: Record<string, unknown> =\n    typeof req.body === 'string' ? JSON.parse(req.body) : (req.body ?? {})\n  const scope = readCrmRouteScope(body)\n  if (!scope) {\n    res.status(400).json({ error: 'Missing orgId or hostId' })\n    return\n  }\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    let orgId: string | null = null\n    let org: unknown\n    if (scope.level === 'org') {\n      const caller = await authorizeOrgCaller(req, scope.orgId, {\n        needs: 'data.manage',\n        refusal: STATUS_REFUSAL,\n      })\n      if (caller.ok === false) {\n        res.status(caller.status).json({ error: caller.error })\n        return\n      }\n      orgId = caller.orgId\n      org = caller.org\n    } else {\n      const caller = await authorizeSiteWriter(req, scope.hostId)\n      if (caller.ok === false) {\n        res.status(caller.status).json({ error: caller.error })\n        return\n      }\n      org = caller.org\n    }\n    // The plan after the caller, before any site is read (AGL-2851).\n    const suite = crmSuiteRefusal(org, 'Reading which sites carry a CRM recipe')\n    if (suite) {\n      res.status(suite.status).json(suite.body)\n      return\n    }\n    const hostIds = orgId ? await orgHostIds(firestore, orgId) : [scope.hostId]\n    const sites = await Promise.all(\n      hostIds.map(async (hostId): Promise<CrmRecipeSiteStatus> => {\n        const stamps = readSiteStamps(\n          await stampsQuery(firestore.collection('hosts').doc(hostId)).get(),\n        )\n        return {\n          hostId,\n          installed: [...stamps.installed.keys()],\n          unstamped: stamps.unstamped,\n        }\n      }),\n    )\n    res.status(200).json({ ok: true, sites })\n  } catch (error) {\n    console.error('[crm] recipe status failed', error)\n    res.status(500).json({ error: 'The recipe status could not be read' })\n  }\n}\n"],"names":["ACTIONS_MAX_PER_HOST","checkEntitlement","createResourceUid","crmActionRecipe","hostActionDocument","hostActionRecipeId","hostRoleCanWrite","planLabelGrantingFeature","validateHostAction","firebaseAdmin","getOrgForHost","logHostActivity","logOrgActivity","isRefusedIdToken","FieldValue","CRM_API_ROUTES","authorizeOrgCaller","orgHostIds","readCrmRouteScope","crmSuiteRefusal","CRM_RECIPE_INSTALL_ROUTE","recipeInstall","CRM_RECIPE_STATUS_ROUTE","recipeStatus","INSTALL_REFUSAL","STATUS_REFUSAL","typed","value","max","String","trim","slice","authorizeSiteWriter","req","hostId","host","decoded","authorization","headers","idToken","startsWith","length","undefined","ok","status","error","app","auth","verifyIdToken","console","staff","firestore","collection","doc","get","exists","role","uid","resolved","email","orgId","org","siteOfOrg","siteLabel","id","readSiteStamps","rows","installed","Map","unstamped","live","row","docs","stamp","data","has","set","stampsQuery","select","crmRecipeInstallHandler","res","method","setHeader","json","body","JSON","parse","scope","recipe","recipeId","formId","writer","level","caller","needs","refusal","suite","hostRef","ref","form","snapshot","name","action","build","problem","actionId","outcome","runTransaction","tx","stamps","existing","create","createdAt","serverTimestamp","updatedAt","createdBy","actor","type","title","answer","crmRecipeStatusHandler","hostIds","sites","Promise","all","map","keys"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCC,GAED,SACEA,oBAAoB,EAEpBC,gBAAgB,EAChBC,iBAAiB,EACjBC,eAAe,EAEfC,kBAAkB,EAClBC,kBAAkB,EAClBC,gBAAgB,EAChBC,wBAAwB,EAGxBC,kBAAkB,QACb,sBAAqB;AAC5B,SACEC,aAAa,EACbC,aAAa,EACbC,eAAe,EACfC,cAAc,QACT,2BAA0B;AACjC,SAASC,gBAAgB,QAAQ,mDAAkD;AACnF,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SACEC,cAAc,QAIT,6BAAyB;AAChC,SAASC,kBAAkB,EAAEC,UAAU,EAAEC,iBAAiB,QAAQ,kBAAc;AAChF,SAASC,eAAe,QAAQ,kBAAc;AAE9C,OAAO,MAAMC,2BAA2BL,eAAeM,aAAa,CAAA;AACpE,OAAO,MAAMC,0BAA0BP,eAAeQ,YAAY,CAAA;AAelE,MAAMC,kBACJ;AACF,MAAMC,iBACJ;AAEF,SAASC,MAAMC,KAAc,EAAEC,GAAW;IACxC,OAAOC,OAAOF,gBAAAA,QAAS,IACpBG,IAAI,GACJC,KAAK,CAAC,GAAGH;AACd;AAEA;;;;;CAKC,GACD,eAAeI,oBACbC,GAAqB,EACrBC,MAAc;QAEeD,4BAuBfE,WASLC;IAhCT,MAAMC,gBAAgBR,QAAOI,6BAAAA,IAAIK,OAAO,CAACD,aAAa,YAAzBJ,6BAA6B;IAC1D,MAAMM,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcN,KAAK,CAAC,UAAUU,MAAM,IACpCC;IACJ,IAAI,CAACH,SAAS,OAAO;QAAEI,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAkB;IACxE,IAAIT;IACJ,IAAI;QACFA,UAAU,MAAM3B,cAAcqC,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACT;IAC3D,EAAE,OAAOM,OAAO;QACd,sEAAsE;QACtE,mCAAmC;QACnC,IAAIhC,iBAAiBgC,QAAQ,OAAO;YAAEF,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAkB;QACvFI,QAAQJ,KAAK,CAAC,sDAAsDA;QACpE,OAAO;YAAEF,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAA+C;IACzF;IACA,MAAMK,QAAQd,QAAQc,KAAK,KAAK;IAChC,MAAMf,OAAO,MAAM1B,cAChBqC,GAAG,GACHK,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAACnB,QACJoB,GAAG;IACN,IAAI,CAACnB,KAAKoB,MAAM,EAAE,OAAO;QAAEZ,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAe;IACzE,MAAMW,OAAO,EAACrB,YAAAA,KAAKmB,GAAG,CAAC,0BAATnB,YAA2B,CAAC,EAAE,CAACC,QAAQqB,GAAG,CAAC;IACzD,IAAI,CAACP,SAAS,CAAC5C,iBAAiBkD,OAAO;QACrC,OAAO;YAAEb,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAmC;IAC7E;IACA,MAAMa,WAAW,MAAMhD,cAAcwB;IACrC,IAAI,CAACwB,UAAU,OAAO;QAAEf,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAe;IACtE,OAAO;QACLF,IAAI;QACJc,KAAKrB,QAAQqB,GAAG;QAChBE,KAAK,GAAEvB,iBAAAA,QAAQuB,KAAK,YAAbvB,iBAAiB;QACxBc;QACAU,OAAOF,SAASE,KAAK;QACrBC,KAAKH,SAASG,GAAG;QACjB1B;IACF;AACF;AAEA;;;;CAIC,GACD,eAAe2B,UACbX,SAAsC,EACtCjB,MAAc,EACd0B,KAAa;IAEb,MAAMzB,OAAO,MAAMgB,UAAUC,UAAU,CAAC,SAASC,GAAG,CAACnB,QAAQoB,GAAG;IAChE,OAAOnB,KAAKoB,MAAM,IAAIpB,KAAKmB,GAAG,CAAC,aAAaM,QAAQzB,OAAO;AAC7D;AAEA,8EAA8E,GAC9E,SAAS4B,UAAU5B,IAAwC;QAEhDA,WACAA;IAFT,OACEN,QAAOM,YAAAA,KAAKmB,GAAG,CAAC,0BAATnB,YAA2B,IAAIL,IAAI,MAC1CD,QAAOM,aAAAA,KAAKmB,GAAG,CAAC,wBAATnB,aAAyB,IAAIL,IAAI,MACxCK,KAAK6B,EAAE;AAEX;AAEA;;;;;CAKC,GACD,SAASC,eAAeC,IAAqC;IAK3D,MAAMC,YAAY,IAAIC;IACtB,IAAIC,YAAY;IAChB,IAAIC,OAAO;IACX,KAAK,MAAMC,OAAOL,KAAKM,IAAI,CAAE;QAC3B,IAAID,IAAIjB,GAAG,CAAC,gBAAgB,MAAM;QAClCgB,QAAQ;QACR,MAAMG,QAAQpE,mBAAmBkE,IAAIG,IAAI;QACzC,IAAID,UAAU/B,WAAW2B,aAAa;aACjC,IAAII,SAAS,CAACN,UAAUQ,GAAG,CAACF,QAAQN,UAAUS,GAAG,CAACH,OAAOF,IAAIP,EAAE;IACtE;IACA,OAAO;QAAEG;QAAWE;QAAWC;IAAK;AACtC;AAEA,MAAMO,cAAc,CAAC1C,OACnBA,KAAKiB,UAAU,CAAC,WAAW0B,MAAM,CAAC,UAAU;AAE9C;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMC,0BAA4C,OAAO9C,KAAK+C;QAOV/C;IANzD,IAAIA,IAAIgD,MAAM,KAAK,QAAQ;QACzBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIpC,MAAM,CAAC,KAAKuC,IAAI,CAAC;YAAEtC,OAAO;QAAqB;QACnD;IACF;IACA,MAAMuC,OACJ,OAAOnD,IAAImD,IAAI,KAAK,WAAWC,KAAKC,KAAK,CAACrD,IAAImD,IAAI,KAAKnD,YAAAA,IAAImD,IAAI,YAARnD,YAAY,CAAC;IACtE,MAAMsD,QAAQrE,kBAAkBkE;IAChC,MAAMlD,iBAASqD,yBAAAA,MAAOrD,MAAM,mBAAI;IAChC,IAAI,CAACqD,SAAS,CAACrD,QAAQ;QACrB8C,IAAIpC,MAAM,CAAC,KAAKuC,IAAI,CAAC;YAAEtC,OAAO;QAAiB;QAC/C;IACF;IACA,MAAM2C,SAASrF,gBAAgBuB,MAAM0D,KAAKK,QAAQ,EAAE;IACpD,IAAI,CAACD,QAAQ;QACXR,IAAIpC,MAAM,CAAC,KAAKuC,IAAI,CAAC;YAAEtC,OAAO;QAAgB;QAC9C;IACF;IACA,MAAM6C,SAAShE,MAAM0D,KAAKM,MAAM,EAAE;IAElC,IAAI;QACF,MAAMvC,YAAY1C,cAAcqC,GAAG,GAAGK,SAAS;QAC/C,IAAIwC;QACJ,IAAIJ,MAAMK,KAAK,KAAK,OAAO;YACzB,MAAMC,SAAS,MAAM7E,mBAAmBiB,KAAKsD,MAAM3B,KAAK,EAAE;gBACxDkC,OAAO;gBACPC,SAASvE;YACX;YACA,IAAIqE,OAAOlD,EAAE,KAAK,OAAO;gBACvBqC,IAAIpC,MAAM,CAACiD,OAAOjD,MAAM,EAAEuC,IAAI,CAAC;oBAAEtC,OAAOgD,OAAOhD,KAAK;gBAAC;gBACrD;YACF;YACA,MAAMV,OAAO,MAAM2B,UAAUX,WAAWjB,QAAQ2D,OAAOjC,KAAK;YAC5D,IAAI,CAACzB,MAAM;gBACT6C,IAAIpC,MAAM,CAAC,KAAKuC,IAAI,CAAC;oBAAEtC,OAAO;gBAAe;gBAC7C;YACF;YACA8C,SAAS;gBACPhD,IAAI;gBACJc,KAAKoC,OAAOpC,GAAG;gBACfE,OAAOkC,OAAOlC,KAAK;gBACnBT,OAAO2C,OAAO3C,KAAK;gBACnBU,OAAOiC,OAAOjC,KAAK;gBACnBC,KAAKgC,OAAOhC,GAAG;gBACf1B;YACF;QACF,OAAO;YACL,MAAM0D,SAAS,MAAM7D,oBAAoBC,KAAKC;YAC9C,IAAI2D,OAAOlD,EAAE,KAAK,OAAO;gBACvBqC,IAAIpC,MAAM,CAACiD,OAAOjD,MAAM,EAAEuC,IAAI,CAAC;oBAAEtC,OAAOgD,OAAOhD,KAAK;gBAAC;gBACrD;YACF;YACA8C,SAASE;QACX;QAEA,oEAAoE;QACpE,qEAAqE;QACrE,iCAAiC;QACjC,MAAMG,QAAQ7E,gBAAgBwE,OAAO9B,GAAG,EAAE;QAC1C,IAAImC,OAAO;YACThB,IAAIpC,MAAM,CAACoD,MAAMpD,MAAM,EAAEuC,IAAI,CAACa,MAAMZ,IAAI;YACxC;QACF;QAEA,qEAAqE;QACrE,oEAAoE;QACpE,2DAA2D;QAC3D,IAAI,CAACnF,iBAAiB0F,OAAO9B,GAAG,EAAE,YAAY;gBAGJtD;YAFxCyE,IAAIpC,MAAM,CAAC,KAAKuC,IAAI,CAAC;gBACnBtC,OACE,CAAC,iCAAiC,GAAEtC,4BAAAA,yBAAyB,sBAAzBA,4BAAuC,MAAM,CAAC,CAAC,GACnF;YACJ;YACA;QACF;QAEA,MAAM0F,UAAUN,OAAOxD,IAAI,CAAC+D,GAAG;QAC/B,IAAIC;QACJ,IAAIX,OAAOM,KAAK,KAAK,QAAQ;gBAkBZM;YAjBf,IAAI,CAACV,QAAQ;gBACXV,IAAIpC,MAAM,CAAC,KAAKuC,IAAI,CAAC;oBAAEtC,OAAO;gBAA+B;gBAC7D;YACF;YACA,MAAMuD,WAAW,MAAMH,QAAQ7C,UAAU,CAAC,SAASC,GAAG,CAACqC,QAAQpC,GAAG;YAClE,IAAI,CAAC8C,SAAS7C,MAAM,EAAE;gBACpByB,IAAIpC,MAAM,CAAC,KAAKuC,IAAI,CAAC;oBAAEtC,OAAO;gBAAe;gBAC7C;YACF;YACA,mEAAmE;YACnE,4EAA4E;YAC5E,IAAIuD,SAAS9C,GAAG,CAAC,iBAAiB,MAAM;gBACtC0B,IAAIpC,MAAM,CAAC,KAAKuC,IAAI,CAAC;oBAAEtC,OAAO;gBAA6C;gBAC3E;YACF;YACAsD,OAAO;gBACLnC,IAAIoC,SAASpC,EAAE;gBACfqC,MAAMxE,QAAOuE,gBAAAA,SAAS9C,GAAG,CAAC,0BAAb8C,gBAA+B,IAAItE,IAAI,MAAMsE,SAASpC,EAAE;YACvE;QACF;QAEA,MAAMsC,SAASd,OAAOe,KAAK,CAACJ,OAAO;YAAEA;QAAK,IAAIzD;QAC9C,MAAM8D,UAAUhG,mBAAmB8F;QACnC,IAAIE,SAAS;YACXxB,IAAIpC,MAAM,CAAC,KAAKuC,IAAI,CAAC;gBAAEtC,OAAO2D;YAAQ;YACtC;QACF;QAEA,MAAMC,WAAWvG;QACjB,MAAMwG,UAAU,MAAMvD,UAAUwD,cAAc,CAAC,OAAOC;YACpD,MAAMC,SAAS5C,eAAe,MAAM2C,GAAGtD,GAAG,CAACuB,YAAYoB;YACvD,MAAMa,WAAWD,OAAO1C,SAAS,CAACb,GAAG,CAACkC,OAAOxB,EAAE;YAC/C,IAAI8C,UAAU;gBACZ,OAAO;oBACLlE,QAAQ;oBACRC,OAAO;oBACP4D,UAAUK;gBACZ;YACF;YACA,IAAID,OAAOvC,IAAI,IAAItE,sBAAsB;gBACvC,OAAO;oBACL4C,QAAQ;oBACRC,OAAO,CAAC,uCAAuC,EAAE7C,qBAAqB,SAAS,CAAC;gBAClF;YACF;YACA4G,GAAGG,MAAM,CAACd,QAAQ7C,UAAU,CAAC,WAAWC,GAAG,CAACoD,WAAW,aAClDrG,mBAAmBkG;gBACtBU,WAAWlG,WAAWmG,eAAe;gBACrCC,WAAWpG,WAAWmG,eAAe;gBACrCE,WAAWxB,OAAOlC,GAAG;;YAEvB,OAAO;QACT;QACA,IAAIiD,SAAS;YACX1B,IAAIpC,MAAM,CAAC8D,QAAQ9D,MAAM,EAAEuC,IAAI,CAAC;gBAC9BtC,OAAO6D,QAAQ7D,KAAK;eAChB6D,QAAQD,QAAQ,GAAG;gBAAEA,UAAUC,QAAQD,QAAQ;YAAC,IAAI,CAAC;YAE3D;QACF;QAEA,MAAMW,QAAQ;YAAE3D,KAAKkC,OAAOlC,GAAG;YAAEE,OAAOgC,OAAOhC,KAAK;QAAC;QACrD,MAAMhD,gBAAgBuB,QAAQkF,OAAO,oBAAoB;YACvDC,MAAM;YACNrD,IAAIyC;YACJJ,MAAMC,OAAOD,IAAI;QACnB;QACA,oEAAoE;QACpE,IAAId,MAAMK,KAAK,KAAK,OAAO;YACzB,MAAMhF,eACJ+E,OAAO/B,KAAK,EACZwD,OACA,CAAC,eAAe,EAAE5B,OAAO8B,KAAK,CAAC,YAAY,EAAEvD,UAAU4B,OAAOxD,IAAI,GAAG,EACrE;gBAAEkF,MAAM;gBAAQrD,IAAI9B;gBAAQmE,MAAMtC,UAAU4B,OAAOxD,IAAI;YAAE;QAE7D;QACA,MAAMoF,SAAiC;YACrC5E,IAAI;YACJ8D;YACAJ,MAAMC,OAAOD,IAAI;YACjBZ,UAAUD,OAAOxB,EAAE;QACrB;QACAgB,IAAIpC,MAAM,CAAC,KAAKuC,IAAI,CAACoC;IACvB,EAAE,OAAO1E,OAAO;QACdI,QAAQJ,KAAK,CAAC,+BAA+BX,QAAQW;QACrDmC,IAAIpC,MAAM,CAAC,KAAKuC,IAAI,CAAC;YAAEtC,OAAO;QAAoC;IACpE;AACF,EAAC;AAED;;;;;;CAMC,GACD,OAAO,MAAM2E,yBAA2C,OAAOvF,KAAK+C;QAOT/C;IANzD,IAAIA,IAAIgD,MAAM,KAAK,QAAQ;QACzBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIpC,MAAM,CAAC,KAAKuC,IAAI,CAAC;YAAEtC,OAAO;QAAqB;QACnD;IACF;IACA,MAAMuC,OACJ,OAAOnD,IAAImD,IAAI,KAAK,WAAWC,KAAKC,KAAK,CAACrD,IAAImD,IAAI,KAAKnD,YAAAA,IAAImD,IAAI,YAARnD,YAAY,CAAC;IACtE,MAAMsD,QAAQrE,kBAAkBkE;IAChC,IAAI,CAACG,OAAO;QACVP,IAAIpC,MAAM,CAAC,KAAKuC,IAAI,CAAC;YAAEtC,OAAO;QAA0B;QACxD;IACF;IACA,IAAI;QACF,MAAMM,YAAY1C,cAAcqC,GAAG,GAAGK,SAAS;QAC/C,IAAIS,QAAuB;QAC3B,IAAIC;QACJ,IAAI0B,MAAMK,KAAK,KAAK,OAAO;YACzB,MAAMC,SAAS,MAAM7E,mBAAmBiB,KAAKsD,MAAM3B,KAAK,EAAE;gBACxDkC,OAAO;gBACPC,SAAStE;YACX;YACA,IAAIoE,OAAOlD,EAAE,KAAK,OAAO;gBACvBqC,IAAIpC,MAAM,CAACiD,OAAOjD,MAAM,EAAEuC,IAAI,CAAC;oBAAEtC,OAAOgD,OAAOhD,KAAK;gBAAC;gBACrD;YACF;YACAe,QAAQiC,OAAOjC,KAAK;YACpBC,MAAMgC,OAAOhC,GAAG;QAClB,OAAO;YACL,MAAMgC,SAAS,MAAM7D,oBAAoBC,KAAKsD,MAAMrD,MAAM;YAC1D,IAAI2D,OAAOlD,EAAE,KAAK,OAAO;gBACvBqC,IAAIpC,MAAM,CAACiD,OAAOjD,MAAM,EAAEuC,IAAI,CAAC;oBAAEtC,OAAOgD,OAAOhD,KAAK;gBAAC;gBACrD;YACF;YACAgB,MAAMgC,OAAOhC,GAAG;QAClB;QACA,iEAAiE;QACjE,MAAMmC,QAAQ7E,gBAAgB0C,KAAK;QACnC,IAAImC,OAAO;YACThB,IAAIpC,MAAM,CAACoD,MAAMpD,MAAM,EAAEuC,IAAI,CAACa,MAAMZ,IAAI;YACxC;QACF;QACA,MAAMqC,UAAU7D,QAAQ,MAAM3C,WAAWkC,WAAWS,SAAS;YAAC2B,MAAMrD,MAAM;SAAC;QAC3E,MAAMwF,QAAQ,MAAMC,QAAQC,GAAG,CAC7BH,QAAQI,GAAG,CAAC,OAAO3F;YACjB,MAAM2E,SAAS5C,eACb,MAAMY,YAAY1B,UAAUC,UAAU,CAAC,SAASC,GAAG,CAACnB,SAASoB,GAAG;YAElE,OAAO;gBACLpB;gBACAiC,WAAW;uBAAI0C,OAAO1C,SAAS,CAAC2D,IAAI;iBAAG;gBACvCzD,WAAWwC,OAAOxC,SAAS;YAC7B;QACF;QAEFW,IAAIpC,MAAM,CAAC,KAAKuC,IAAI,CAAC;YAAExC,IAAI;YAAM+E;QAAM;IACzC,EAAE,OAAO7E,OAAO;QACdI,QAAQJ,KAAK,CAAC,8BAA8BA;QAC5CmC,IAAIpC,MAAM,CAAC,KAAKuC,IAAI,CAAC;YAAEtC,OAAO;QAAsC;IACtE;AACF,EAAC"}

package/src/lib/server/record-facts.d.ts

@@ -0,0 +1,65 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginRecordFactsReader, type PluginRecordFactsRequest } from '@aglyn/aglyn/plugin-manager/plugin-record-facts';
+import { type ConsentGroup } from '@aglyn/aglyn/server';
+type Data = Record<string, unknown>;
+type Refusal = {
+    ok: false;
+    status: 400 | 403 | 404;
+    error: string;
+};
+/** Logged activities read per record before visibility and the timeline cut. */
+export declare const CRM_FACTS_ACTIVITIES_READ = 40;
+/** Tasks read per record, the record page's own window. */
+export declare const CRM_FACTS_TASKS_READ = 50;
+/** Deals read per contact or company. */
+export declare const CRM_FACTS_DEALS_READ = 20;
+/** Custom field definitions an import catalog reads. */
+export declare const CRM_FACTS_FIELD_DEFINITIONS_READ = 100;
+export declare const CRM_FACTS_UNKNOWN_SITE = "Unknown site";
+export declare const CRM_FACTS_NOT_A_MEMBER = "You are not a member of that organization";
+export declare const CRM_FACTS_SITE_REFUSAL = "Reading CRM records requires the data.manage permission on this site";
+export declare const CRM_FACTS_ORG_REFUSAL = "Reading CRM records across the organization requires the data.manage permission for the whole organization";
+export declare const CRM_FACTS_LEAD_NEEDS_SITE = "A lead is read on the site that captured it";
+/** Where a read runs, once the caller has been admitted. */
+interface CrmFactsScope {
+    orgId: string;
+    hostId: string | null;
+    org: Data;
+    /** The site's consent group under a site; `null` at the organization level. */
+    group: ConsentGroup | null;
+    /** Whether a row's `visibleTo` is readable here. */
+    visible: (visibleTo: unknown) => boolean;
+}
+/**
+ * Rules 1 to 3: the site, the member and the plan. A refusal names what the
+ * member lacks in the words the console's own CRM doors use.
+ */
+export declare function crmFactsScope(request: PluginRecordFactsRequest): Promise<CrmFactsScope | Refusal>;
+export declare const crmContactFactsReader: PluginRecordFactsReader;
+export declare const crmCompanyFactsReader: PluginRecordFactsReader;
+export declare const crmDealFactsReader: PluginRecordFactsReader;
+export declare const crmLeadFactsReader: PluginRecordFactsReader;
+export declare const crmImportFactsReader: PluginRecordFactsReader;
+/** Every reader this plugin registers, by resource name. */
+export declare const CRM_FACTS_READERS: Readonly<Record<string, PluginRecordFactsReader>>;
+/**
+ * Registers the readers; the console surface calls it, the one process that
+ * runs AI jobs (AGL-3026). Idempotent: a second call replaces the first.
+ */
+export declare function registerCrmRecordFactsReaders(): void;
+export {};