@aglyn/plugins-crm 1.0.0-beta.143

package/src/lib/server/record-facts.js

@@ -0,0 +1,337 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { registerPluginRecordFactsReader } from "@aglyn/aglyn/plugin-manager/plugin-record-facts";
+import { CRM_COLLECTIONS, contactPrimaryGroup, crmReadTokens, isOrgWideMember } from "@aglyn/aglyn/server";
+import { consentGroupForSite, firebaseAdmin, getOrgDoc, memberHasOrgPermission, resolveOrgIdForHost, resolveOrgMembership } from "@aglyn/tenant-data-admin";
+import { BUNDLE_ID } from "../constants/bundle-common.js";
+import { CRM_IMPORT_FACTS_RESOURCE, CRM_RECORD_FACTS_RESOURCES, companyFacts, contactFacts, dealFacts, importFacts, isCrmImportFactsCollection, leadFacts } from "../model/record-facts.js";
+import { crmSuiteRefusal } from "./suite-gate.js";
+/** The org collection a contact lives in, beside the CRM's own. */ const CONTACTS_COLLECTION = 'contacts';
+/** Logged activities read per record before visibility and the timeline cut. */ export const CRM_FACTS_ACTIVITIES_READ = 40;
+/** Tasks read per record, the record page's own window. */ export const CRM_FACTS_TASKS_READ = 50;
+/** Deals read per contact or company. */ export const CRM_FACTS_DEALS_READ = 20;
+/** Custom field definitions an import catalog reads. */ export const CRM_FACTS_FIELD_DEFINITIONS_READ = 100;
+export const CRM_FACTS_UNKNOWN_SITE = 'Unknown site';
+export const CRM_FACTS_NOT_A_MEMBER = 'You are not a member of that organization';
+export const CRM_FACTS_SITE_REFUSAL = 'Reading CRM records requires the data.manage permission on this site';
+export const CRM_FACTS_ORG_REFUSAL = 'Reading CRM records across the organization requires the data.manage permission for the whole organization';
+export const CRM_FACTS_LEAD_NEEDS_SITE = 'A lead is read on the site that captured it';
+const NOT_FOUND = {
+    contact: 'This contact could not be found. It may have been deleted.',
+    company: 'This company could not be found. It may have been deleted.',
+    deal: 'This deal could not be found. It may have been deleted.',
+    lead: 'This lead could not be found. It may have been removed.',
+    import: 'There is no such import.'
+};
+function firestore() {
+    return firebaseAdmin.app().firestore();
+}
+/**
+ * Rules 1 to 3: the site, the member and the plan. A refusal names what the
+ * member lacks in the words the console's own CRM doors use.
+ */ export async function crmFactsScope(request) {
+    var _request_orgId, _request_org;
+    const orgId = String((_request_orgId = request.orgId) != null ? _request_orgId : '').trim();
+    const hostId = request.hostId ? String(request.hostId).trim() : null;
+    if (!orgId) return {
+        ok: false,
+        status: 400,
+        error: 'Open a workspace first'
+    };
+    if (hostId && await resolveOrgIdForHost(hostId) !== orgId) {
+        return {
+            ok: false,
+            status: 404,
+            error: CRM_FACTS_UNKNOWN_SITE
+        };
+    }
+    if (!request.staff) {
+        var _member_hostAccess;
+        const membership = await resolveOrgMembership(request.uid, orgId).catch(()=>null);
+        const member = (membership == null ? void 0 : membership.orgId) === orgId ? membership.member : null;
+        if (!member) return {
+            ok: false,
+            status: 403,
+            error: CRM_FACTS_NOT_A_MEMBER
+        };
+        const reaches = hostId ? isOrgWideMember(member) || Boolean((_member_hostAccess = member.hostAccess) == null ? void 0 : _member_hostAccess[hostId]) : isOrgWideMember(member);
+        const allowed = reaches && await memberHasOrgPermission(orgId, member, 'data.manage');
+        if (!allowed) {
+            return {
+                ok: false,
+                status: 403,
+                error: hostId ? CRM_FACTS_SITE_REFUSAL : CRM_FACTS_ORG_REFUSAL
+            };
+        }
+    }
+    const org = ((_request_org = request.org) != null ? _request_org : await getOrgDoc(orgId)) || null;
+    if (!org) return {
+        ok: false,
+        status: 404,
+        error: 'Unknown organization'
+    };
+    const suite = crmSuiteRefusal(org, 'Reading a CRM record');
+    if (suite) return {
+        ok: false,
+        status: 403,
+        error: suite.body.error
+    };
+    if (!hostId) return {
+        orgId,
+        hostId: null,
+        org,
+        group: null,
+        visible: ()=>true
+    };
+    const group = await consentGroupForSite(hostId, org);
+    const readable = new Set(crmReadTokens(group));
+    return {
+        orgId,
+        hostId,
+        org,
+        group,
+        visible: (visibleTo)=>Array.isArray(visibleTo) && visibleTo.some((token)=>readable.has(String(token)))
+    };
+}
+const orgCollection = (orgId, name)=>firestore().collection('orgs').doc(orgId).collection(name);
+/** Rows of an org collection naming one record, held to the scope's visibility. */ async function rowsNaming(scope, input) {
+    const snapshot = await orgCollection(scope.orgId, input.collection).where(input.field, '==', input.id).orderBy(input.orderBy, input.direction).limit(input.limit).get();
+    return snapshot.docs.map((doc)=>{
+        var _doc_data;
+        return (_doc_data = doc.data()) != null ? _doc_data : {};
+    }).filter((row)=>scope.visible(row['visibleTo']));
+}
+/** The pipelines some deals name, by id, read once each. */ async function pipelinesFor(scope, deals) {
+    const ids = [
+        ...new Set(deals.map((deal)=>{
+            var _deal_pipelineId;
+            return String((_deal_pipelineId = deal.pipelineId) != null ? _deal_pipelineId : '');
+        }).filter(Boolean))
+    ];
+    const snapshots = await Promise.all(ids.map((id)=>orgCollection(scope.orgId, CRM_COLLECTIONS.pipelines).doc(id).get()));
+    return new Map(snapshots.filter((snapshot)=>snapshot.exists).map((snapshot)=>{
+        var _snapshot_data;
+        return [
+            snapshot.id,
+            (_snapshot_data = snapshot.data()) != null ? _snapshot_data : {}
+        ];
+    }));
+}
+/** A record document the scope may read, or `null`. */ async function visibleDoc(scope, collection, id) {
+    var _snapshot_data;
+    if (!id) return null;
+    const snapshot = await orgCollection(scope.orgId, collection).doc(id).get();
+    const data = snapshot.exists ? (_snapshot_data = snapshot.data()) != null ? _snapshot_data : {} : null;
+    return data && scope.visible(data['visibleTo']) ? data : null;
+}
+const refused = (kind, status = 404)=>({
+        ok: false,
+        status,
+        error: NOT_FOUND[kind]
+    });
+/** A reader that admits the caller, then reads the record. */ function reader(read) {
+    return {
+        read: async (request)=>{
+            const scope = await crmFactsScope(request);
+            if ('ok' in scope) return scope;
+            return read(scope, request);
+        }
+    };
+}
+export const crmContactFactsReader = reader(async (scope, request)=>{
+    var _request_id, _scope_group;
+    const id = String((_request_id = request.id) != null ? _request_id : '').trim();
+    const row = await visibleDoc(scope, CONTACTS_COLLECTION, id);
+    if (!row) return refused('contact');
+    const group = (_scope_group = scope.group) != null ? _scope_group : contactPrimaryGroup(row, scope.org);
+    const naming = {
+        field: 'contactId',
+        id
+    };
+    const [activities, tasks, deals] = await Promise.all([
+        rowsNaming(scope, _extends({}, naming, {
+            collection: CRM_COLLECTIONS.activities,
+            orderBy: 'atMs',
+            direction: 'desc',
+            limit: CRM_FACTS_ACTIVITIES_READ
+        })),
+        rowsNaming(scope, _extends({}, naming, {
+            collection: CRM_COLLECTIONS.tasks,
+            orderBy: 'dueAtMs',
+            direction: 'asc',
+            limit: CRM_FACTS_TASKS_READ
+        })),
+        rowsNaming(scope, _extends({}, naming, {
+            collection: CRM_COLLECTIONS.deals,
+            orderBy: 'updatedAt',
+            direction: 'desc',
+            limit: CRM_FACTS_DEALS_READ
+        }))
+    ]);
+    const pipelines = await pipelinesFor(scope, deals);
+    return {
+        ok: true,
+        facts: _extends({}, contactFacts({
+            row,
+            group,
+            activities,
+            tasks,
+            deals,
+            pipelines,
+            nowMs: request.now.getTime()
+        }))
+    };
+});
+export const crmCompanyFactsReader = reader(async (scope, request)=>{
+    var _request_id;
+    const id = String((_request_id = request.id) != null ? _request_id : '').trim();
+    const company = await visibleDoc(scope, CRM_COLLECTIONS.companies, id);
+    if (!company) return refused('company');
+    const naming = {
+        field: 'companyId',
+        id
+    };
+    const [activities, tasks, deals] = await Promise.all([
+        rowsNaming(scope, _extends({}, naming, {
+            collection: CRM_COLLECTIONS.activities,
+            orderBy: 'atMs',
+            direction: 'desc',
+            limit: CRM_FACTS_ACTIVITIES_READ
+        })),
+        rowsNaming(scope, _extends({}, naming, {
+            collection: CRM_COLLECTIONS.tasks,
+            orderBy: 'dueAtMs',
+            direction: 'asc',
+            limit: CRM_FACTS_TASKS_READ
+        })),
+        rowsNaming(scope, _extends({}, naming, {
+            collection: CRM_COLLECTIONS.deals,
+            orderBy: 'updatedAt',
+            direction: 'desc',
+            limit: CRM_FACTS_DEALS_READ
+        }))
+    ]);
+    const pipelines = await pipelinesFor(scope, deals);
+    return {
+        ok: true,
+        facts: _extends({}, companyFacts({
+            company: company,
+            activities,
+            tasks,
+            deals,
+            pipelines,
+            nowMs: request.now.getTime()
+        }))
+    };
+});
+export const crmDealFactsReader = reader(async (scope, request)=>{
+    var _request_id, _pipelines_get, _deal_pipelineId;
+    const id = String((_request_id = request.id) != null ? _request_id : '').trim();
+    const deal = await visibleDoc(scope, CRM_COLLECTIONS.deals, id);
+    if (!deal) return refused('deal');
+    const naming = {
+        field: 'dealId',
+        id
+    };
+    const [activities, tasks, pipelines] = await Promise.all([
+        rowsNaming(scope, _extends({}, naming, {
+            collection: CRM_COLLECTIONS.activities,
+            orderBy: 'atMs',
+            direction: 'desc',
+            limit: CRM_FACTS_ACTIVITIES_READ
+        })),
+        rowsNaming(scope, _extends({}, naming, {
+            collection: CRM_COLLECTIONS.tasks,
+            orderBy: 'dueAtMs',
+            direction: 'asc',
+            limit: CRM_FACTS_TASKS_READ
+        })),
+        pipelinesFor(scope, [
+            deal
+        ])
+    ]);
+    return {
+        ok: true,
+        facts: _extends({}, dealFacts({
+            deal,
+            pipeline: (_pipelines_get = pipelines.get(String((_deal_pipelineId = deal.pipelineId) != null ? _deal_pipelineId : ''))) != null ? _pipelines_get : null,
+            activities,
+            tasks,
+            nowMs: request.now.getTime()
+        }))
+    };
+});
+export const crmLeadFactsReader = reader(async (scope, request)=>{
+    var _request_id, _snapshot_data;
+    if (!scope.hostId) return {
+        ok: false,
+        status: 400,
+        error: CRM_FACTS_LEAD_NEEDS_SITE
+    };
+    const id = String((_request_id = request.id) != null ? _request_id : '').trim();
+    if (!id) return refused('lead');
+    const snapshot = await firestore().collection('hosts').doc(scope.hostId).collection('leads').doc(id).get();
+    if (!snapshot.exists) return refused('lead');
+    const activities = await rowsNaming(scope, {
+        field: 'leadId',
+        id,
+        collection: CRM_COLLECTIONS.activities,
+        orderBy: 'atMs',
+        direction: 'desc',
+        limit: CRM_FACTS_ACTIVITIES_READ
+    });
+    return {
+        ok: true,
+        facts: _extends({}, leadFacts({
+            lead: (_snapshot_data = snapshot.data()) != null ? _snapshot_data : {},
+            activities
+        }))
+    };
+});
+export const crmImportFactsReader = reader(async (scope, request)=>{
+    var _request_id;
+    const collection = String((_request_id = request.id) != null ? _request_id : '').trim();
+    if (!isCrmImportFactsCollection(collection)) return refused('import', 400);
+    const snapshot = await orgCollection(scope.orgId, CRM_COLLECTIONS.contactFields).limit(CRM_FACTS_FIELD_DEFINITIONS_READ).get();
+    const definitions = snapshot.docs.map((doc)=>{
+        var _doc_data;
+        return (_doc_data = doc.data()) != null ? _doc_data : {};
+    }).filter((definition)=>scope.visible(definition['visibleTo']));
+    return {
+        ok: true,
+        facts: _extends({}, importFacts(collection, definitions))
+    };
+});
+/** Every reader this plugin registers, by resource name. */ export const CRM_FACTS_READERS = {
+    [CRM_RECORD_FACTS_RESOURCES.contact]: crmContactFactsReader,
+    [CRM_RECORD_FACTS_RESOURCES.company]: crmCompanyFactsReader,
+    [CRM_RECORD_FACTS_RESOURCES.deal]: crmDealFactsReader,
+    [CRM_RECORD_FACTS_RESOURCES.lead]: crmLeadFactsReader,
+    [CRM_IMPORT_FACTS_RESOURCE]: crmImportFactsReader
+};
+/**
+ * Registers the readers; the console surface calls it, the one process that
+ * runs AI jobs (AGL-3026). Idempotent: a second call replaces the first.
+ */ export function registerCrmRecordFactsReaders() {
+    for (const [resource, factsReader] of Object.entries(CRM_FACTS_READERS)){
+        registerPluginRecordFactsReader(resource, factsReader, {
+            pluginId: BUNDLE_ID
+        });
+    }
+}
+
+//# sourceMappingURL=record-facts.js.map

package/src/lib/server/record-facts.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/record-facts.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  registerPluginRecordFactsReader,\n  type PluginRecordFactsRead,\n  type PluginRecordFactsReader,\n  type PluginRecordFactsRequest,\n} from '@aglyn/aglyn/plugin-manager/plugin-record-facts'\nimport {\n  CRM_COLLECTIONS,\n  contactPrimaryGroup,\n  crmReadTokens,\n  isOrgWideMember,\n  type ConsentGroup,\n  type ContactFieldDefinition,\n  type CrmActivity,\n  type CrmCompany,\n  type CrmDeal,\n  type CrmPipeline,\n  type CrmTask,\n} from '@aglyn/aglyn/server'\nimport {\n  consentGroupForSite,\n  firebaseAdmin,\n  getOrgDoc,\n  memberHasOrgPermission,\n  resolveOrgIdForHost,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin'\nimport { BUNDLE_ID } from '../constants/bundle-common'\nimport {\n  CRM_IMPORT_FACTS_RESOURCE,\n  CRM_RECORD_FACTS_RESOURCES,\n  companyFacts,\n  contactFacts,\n  dealFacts,\n  importFacts,\n  isCrmImportFactsCollection,\n  leadFacts,\n  type CrmRecordFactsKind,\n} from '../model/record-facts'\nimport { crmSuiteRefusal } from './suite-gate'\n\n/**\n * THE CRM'S READERS ON THE CORE'S RECORD-FACTS SEAM (AGL-2917).\n *\n * Another plugin asks for a contact, a company, a deal, a lead or an import's\n * field catalog by resource name, and gets the facts `model/record-facts.ts`\n * reports — read here with the rules every other CRM door applies, for the\n * member the caller names:\n *\n *  1. the site belongs to the organization;\n *  2. the member reaches it — an org-wide member at the organization level, a\n *     member of that site under it — and holds `data.manage`, the key the\n *     whole CRM is gated on. A verified staff caller passes, as at every CRM\n *     route;\n *  3. the organization's plan carries the CRM, asked after the caller is\n *     known, the order `suite-gate.ts` gives;\n *  4. the record exists and is visible where it is read: under a site, its\n *     `visibleTo` meets the site's read tokens, as the console's listeners\n *     filter; at the organization level every row is the member's;\n *  5. what hangs off it — its logged activity, its tasks, its deals — is held\n *     to the same visibility, row by row.\n *\n * A caller in the same process skips the plugin API dispatcher, and with it\n * the dispatcher's per-site enablement, release flag, lockdown and rate\n * limit; those are the caller's to establish before it asks (the AI plugin's\n * CRM admission does). Nothing here writes.\n */\n\ntype Firestore = FirebaseFirestore.Firestore\ntype Data = Record<string, unknown>\ntype Refusal = { ok: false; status: 400 | 403 | 404; error: string }\n\n/** The org collection a contact lives in, beside the CRM's own. */\nconst CONTACTS_COLLECTION = 'contacts'\n\n/** Logged activities read per record before visibility and the timeline cut. */\nexport const CRM_FACTS_ACTIVITIES_READ = 40\n/** Tasks read per record, the record page's own window. */\nexport const CRM_FACTS_TASKS_READ = 50\n/** Deals read per contact or company. */\nexport const CRM_FACTS_DEALS_READ = 20\n/** Custom field definitions an import catalog reads. */\nexport const CRM_FACTS_FIELD_DEFINITIONS_READ = 100\n\nexport const CRM_FACTS_UNKNOWN_SITE = 'Unknown site'\nexport const CRM_FACTS_NOT_A_MEMBER = 'You are not a member of that organization'\nexport const CRM_FACTS_SITE_REFUSAL = 'Reading CRM records requires the data.manage permission on this site'\nexport const CRM_FACTS_ORG_REFUSAL =\n  'Reading CRM records across the organization requires the data.manage permission for the whole organization'\nexport const CRM_FACTS_LEAD_NEEDS_SITE = 'A lead is read on the site that captured it'\n\nconst NOT_FOUND: Record<CrmRecordFactsKind | 'import', string> = {\n  contact: 'This contact could not be found. It may have been deleted.',\n  company: 'This company could not be found. It may have been deleted.',\n  deal: 'This deal could not be found. It may have been deleted.',\n  lead: 'This lead could not be found. It may have been removed.',\n  import: 'There is no such import.',\n}\n\n/** Where a read runs, once the caller has been admitted. */\ninterface CrmFactsScope {\n  orgId: string\n  hostId: string | null\n  org: Data\n  /** The site's consent group under a site; `null` at the organization level. */\n  group: ConsentGroup | null\n  /** Whether a row's `visibleTo` is readable here. */\n  visible: (visibleTo: unknown) => boolean\n}\n\nfunction firestore(): Firestore {\n  return firebaseAdmin.app().firestore()\n}\n\n/**\n * Rules 1 to 3: the site, the member and the plan. A refusal names what the\n * member lacks in the words the console's own CRM doors use.\n */\nexport async function crmFactsScope(request: PluginRecordFactsRequest): Promise<CrmFactsScope | Refusal> {\n  const orgId = String(request.orgId ?? '').trim()\n  const hostId = request.hostId ? String(request.hostId).trim() : null\n  if (!orgId) return { ok: false, status: 400, error: 'Open a workspace first' }\n  if (hostId && (await resolveOrgIdForHost(hostId)) !== orgId) {\n    return { ok: false, status: 404, error: CRM_FACTS_UNKNOWN_SITE }\n  }\n  if (!request.staff) {\n    const membership = await resolveOrgMembership(request.uid, orgId).catch(() => null)\n    const member = membership?.orgId === orgId ? membership.member : null\n    if (!member) return { ok: false, status: 403, error: CRM_FACTS_NOT_A_MEMBER }\n    const reaches = hostId\n      ? isOrgWideMember(member) || Boolean(member.hostAccess?.[hostId])\n      : isOrgWideMember(member)\n    const allowed = reaches && (await memberHasOrgPermission(orgId, member, 'data.manage'))\n    if (!allowed) {\n      return { ok: false, status: 403, error: hostId ? CRM_FACTS_SITE_REFUSAL : CRM_FACTS_ORG_REFUSAL }\n    }\n  }\n  const org = ((request.org as Data | null) ?? ((await getOrgDoc(orgId)) as Data | null)) || null\n  if (!org) return { ok: false, status: 404, error: 'Unknown organization' }\n  const suite = crmSuiteRefusal(org, 'Reading a CRM record')\n  if (suite) return { ok: false, status: 403, error: suite.body.error }\n  if (!hostId) return { orgId, hostId: null, org, group: null, visible: () => true }\n  const group = await consentGroupForSite(hostId, org)\n  const readable = new Set<string>(crmReadTokens(group))\n  return {\n    orgId,\n    hostId,\n    org,\n    group,\n    visible: (visibleTo) =>\n      Array.isArray(visibleTo) && visibleTo.some((token) => readable.has(String(token))),\n  }\n}\n\nconst orgCollection = (orgId: string, name: string) =>\n  firestore().collection('orgs').doc(orgId).collection(name)\n\n/** Rows of an org collection naming one record, held to the scope's visibility. */\nasync function rowsNaming<T>(\n  scope: CrmFactsScope,\n  input: { collection: string; field: string; id: string; orderBy: string; direction: 'asc' | 'desc'; limit: number },\n): Promise<T[]> {\n  const snapshot = await orgCollection(scope.orgId, input.collection)\n    .where(input.field, '==', input.id)\n    .orderBy(input.orderBy, input.direction)\n    .limit(input.limit)\n    .get()\n  return snapshot.docs\n    .map((doc) => (doc.data() ?? {}) as Data)\n    .filter((row) => scope.visible(row['visibleTo'])) as T[]\n}\n\n/** The pipelines some deals name, by id, read once each. */\nasync function pipelinesFor(scope: CrmFactsScope, deals: ReadonlyArray<Partial<CrmDeal>>): Promise<Map<string, CrmPipeline>> {\n  const ids = [...new Set(deals.map((deal) => String(deal.pipelineId ?? '')).filter(Boolean))]\n  const snapshots = await Promise.all(ids.map((id) => orgCollection(scope.orgId, CRM_COLLECTIONS.pipelines).doc(id).get()))\n  return new Map(\n    snapshots\n      .filter((snapshot) => snapshot.exists)\n      .map((snapshot) => [snapshot.id, (snapshot.data() ?? {}) as CrmPipeline]),\n  )\n}\n\n/** A record document the scope may read, or `null`. */\nasync function visibleDoc(scope: CrmFactsScope, collection: string, id: string): Promise<Data | null> {\n  if (!id) return null\n  const snapshot = await orgCollection(scope.orgId, collection).doc(id).get()\n  const data = snapshot.exists ? ((snapshot.data() ?? {}) as Data) : null\n  return data && scope.visible(data['visibleTo']) ? data : null\n}\n\nconst refused = (kind: CrmRecordFactsKind | 'import', status: 400 | 404 = 404): Refusal => ({\n  ok: false,\n  status,\n  error: NOT_FOUND[kind],\n})\n\n/** A reader that admits the caller, then reads the record. */\nfunction reader(read: (scope: CrmFactsScope, request: PluginRecordFactsRequest) => Promise<PluginRecordFactsRead>): PluginRecordFactsReader {\n  return {\n    read: async (request) => {\n      const scope = await crmFactsScope(request)\n      if ('ok' in scope) return scope\n      return read(scope, request)\n    },\n  }\n}\n\nexport const crmContactFactsReader = reader(async (scope, request) => {\n  const id = String(request.id ?? '').trim()\n  const row = await visibleDoc(scope, CONTACTS_COLLECTION, id)\n  if (!row) return refused('contact')\n  const group = scope.group ?? contactPrimaryGroup(row, scope.org)\n  const naming = { field: 'contactId', id }\n  const [activities, tasks, deals] = await Promise.all([\n    rowsNaming<CrmActivity>(scope, { ...naming, collection: CRM_COLLECTIONS.activities, orderBy: 'atMs', direction: 'desc', limit: CRM_FACTS_ACTIVITIES_READ }),\n    rowsNaming<CrmTask>(scope, { ...naming, collection: CRM_COLLECTIONS.tasks, orderBy: 'dueAtMs', direction: 'asc', limit: CRM_FACTS_TASKS_READ }),\n    rowsNaming<CrmDeal>(scope, { ...naming, collection: CRM_COLLECTIONS.deals, orderBy: 'updatedAt', direction: 'desc', limit: CRM_FACTS_DEALS_READ }),\n  ])\n  const pipelines = await pipelinesFor(scope, deals)\n  return {\n    ok: true,\n    facts: { ...contactFacts({ row, group, activities, tasks, deals, pipelines, nowMs: request.now.getTime() }) },\n  }\n})\n\nexport const crmCompanyFactsReader = reader(async (scope, request) => {\n  const id = String(request.id ?? '').trim()\n  const company = await visibleDoc(scope, CRM_COLLECTIONS.companies, id)\n  if (!company) return refused('company')\n  const naming = { field: 'companyId', id }\n  const [activities, tasks, deals] = await Promise.all([\n    rowsNaming<CrmActivity>(scope, { ...naming, collection: CRM_COLLECTIONS.activities, orderBy: 'atMs', direction: 'desc', limit: CRM_FACTS_ACTIVITIES_READ }),\n    rowsNaming<CrmTask>(scope, { ...naming, collection: CRM_COLLECTIONS.tasks, orderBy: 'dueAtMs', direction: 'asc', limit: CRM_FACTS_TASKS_READ }),\n    rowsNaming<CrmDeal>(scope, { ...naming, collection: CRM_COLLECTIONS.deals, orderBy: 'updatedAt', direction: 'desc', limit: CRM_FACTS_DEALS_READ }),\n  ])\n  const pipelines = await pipelinesFor(scope, deals)\n  return {\n    ok: true,\n    facts: {\n      ...companyFacts({ company: company as Partial<CrmCompany>, activities, tasks, deals, pipelines, nowMs: request.now.getTime() }),\n    },\n  }\n})\n\nexport const crmDealFactsReader = reader(async (scope, request) => {\n  const id = String(request.id ?? '').trim()\n  const deal = (await visibleDoc(scope, CRM_COLLECTIONS.deals, id)) as (Partial<CrmDeal> & Data) | null\n  if (!deal) return refused('deal')\n  const naming = { field: 'dealId', id }\n  const [activities, tasks, pipelines] = await Promise.all([\n    rowsNaming<CrmActivity>(scope, { ...naming, collection: CRM_COLLECTIONS.activities, orderBy: 'atMs', direction: 'desc', limit: CRM_FACTS_ACTIVITIES_READ }),\n    rowsNaming<CrmTask>(scope, { ...naming, collection: CRM_COLLECTIONS.tasks, orderBy: 'dueAtMs', direction: 'asc', limit: CRM_FACTS_TASKS_READ }),\n    pipelinesFor(scope, [deal]),\n  ])\n  return {\n    ok: true,\n    facts: {\n      ...dealFacts({\n        deal,\n        pipeline: pipelines.get(String(deal.pipelineId ?? '')) ?? null,\n        activities,\n        tasks,\n        nowMs: request.now.getTime(),\n      }),\n    },\n  }\n})\n\nexport const crmLeadFactsReader = reader(async (scope, request) => {\n  if (!scope.hostId) return { ok: false, status: 400, error: CRM_FACTS_LEAD_NEEDS_SITE }\n  const id = String(request.id ?? '').trim()\n  if (!id) return refused('lead')\n  const snapshot = await firestore().collection('hosts').doc(scope.hostId).collection('leads').doc(id).get()\n  if (!snapshot.exists) return refused('lead')\n  const activities = await rowsNaming<CrmActivity>(scope, {\n    field: 'leadId',\n    id,\n    collection: CRM_COLLECTIONS.activities,\n    orderBy: 'atMs',\n    direction: 'desc',\n    limit: CRM_FACTS_ACTIVITIES_READ,\n  })\n  return { ok: true, facts: { ...leadFacts({ lead: (snapshot.data() ?? {}) as Data, activities }) } }\n})\n\nexport const crmImportFactsReader = reader(async (scope, request) => {\n  const collection = String(request.id ?? '').trim()\n  if (!isCrmImportFactsCollection(collection)) return refused('import', 400)\n  const snapshot = await orgCollection(scope.orgId, CRM_COLLECTIONS.contactFields)\n    .limit(CRM_FACTS_FIELD_DEFINITIONS_READ)\n    .get()\n  const definitions = snapshot.docs\n    .map((doc) => (doc.data() ?? {}) as Partial<ContactFieldDefinition> & Data)\n    .filter((definition) => scope.visible(definition['visibleTo']))\n  return { ok: true, facts: { ...importFacts(collection, definitions) } }\n})\n\n/** Every reader this plugin registers, by resource name. */\nexport const CRM_FACTS_READERS: Readonly<Record<string, PluginRecordFactsReader>> = {\n  [CRM_RECORD_FACTS_RESOURCES.contact]: crmContactFactsReader,\n  [CRM_RECORD_FACTS_RESOURCES.company]: crmCompanyFactsReader,\n  [CRM_RECORD_FACTS_RESOURCES.deal]: crmDealFactsReader,\n  [CRM_RECORD_FACTS_RESOURCES.lead]: crmLeadFactsReader,\n  [CRM_IMPORT_FACTS_RESOURCE]: crmImportFactsReader,\n}\n\n/**\n * Registers the readers; the console surface calls it, the one process that\n * runs AI jobs (AGL-3026). Idempotent: a second call replaces the first.\n */\nexport function registerCrmRecordFactsReaders(): void {\n  for (const [resource, factsReader] of Object.entries(CRM_FACTS_READERS)) {\n    registerPluginRecordFactsReader(resource, factsReader, { pluginId: BUNDLE_ID })\n  }\n}\n"],"names":["registerPluginRecordFactsReader","CRM_COLLECTIONS","contactPrimaryGroup","crmReadTokens","isOrgWideMember","consentGroupForSite","firebaseAdmin","getOrgDoc","memberHasOrgPermission","resolveOrgIdForHost","resolveOrgMembership","BUNDLE_ID","CRM_IMPORT_FACTS_RESOURCE","CRM_RECORD_FACTS_RESOURCES","companyFacts","contactFacts","dealFacts","importFacts","isCrmImportFactsCollection","leadFacts","crmSuiteRefusal","CONTACTS_COLLECTION","CRM_FACTS_ACTIVITIES_READ","CRM_FACTS_TASKS_READ","CRM_FACTS_DEALS_READ","CRM_FACTS_FIELD_DEFINITIONS_READ","CRM_FACTS_UNKNOWN_SITE","CRM_FACTS_NOT_A_MEMBER","CRM_FACTS_SITE_REFUSAL","CRM_FACTS_ORG_REFUSAL","CRM_FACTS_LEAD_NEEDS_SITE","NOT_FOUND","contact","company","deal","lead","import","firestore","app","crmFactsScope","request","orgId","String","trim","hostId","ok","status","error","staff","member","membership","uid","catch","reaches","Boolean","hostAccess","allowed","org","suite","body","group","visible","readable","Set","visibleTo","Array","isArray","some","token","has","orgCollection","name","collection","doc","rowsNaming","scope","input","snapshot","where","field","id","orderBy","direction","limit","get","docs","map","data","filter","row","pipelinesFor","deals","ids","pipelineId","snapshots","Promise","all","pipelines","Map","exists","visibleDoc","refused","kind","reader","read","crmContactFactsReader","naming","activities","tasks","facts","nowMs","now","getTime","crmCompanyFactsReader","companies","crmDealFactsReader","pipeline","crmLeadFactsReader","crmImportFactsReader","contactFields","definitions","definition","CRM_FACTS_READERS","registerCrmRecordFactsReaders","resource","factsReader","Object","entries","pluginId"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,+BAA+B,QAI1B,kDAAiD;AACxD,SACEC,eAAe,EACfC,mBAAmB,EACnBC,aAAa,EACbC,eAAe,QAQV,sBAAqB;AAC5B,SACEC,mBAAmB,EACnBC,aAAa,EACbC,SAAS,EACTC,sBAAsB,EACtBC,mBAAmB,EACnBC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,SAAS,QAAQ,gCAA4B;AACtD,SACEC,yBAAyB,EACzBC,0BAA0B,EAC1BC,YAAY,EACZC,YAAY,EACZC,SAAS,EACTC,WAAW,EACXC,0BAA0B,EAC1BC,SAAS,QAEJ,2BAAuB;AAC9B,SAASC,eAAe,QAAQ,kBAAc;AAiC9C,iEAAiE,GACjE,MAAMC,sBAAsB;AAE5B,8EAA8E,GAC9E,OAAO,MAAMC,4BAA4B,GAAE;AAC3C,yDAAyD,GACzD,OAAO,MAAMC,uBAAuB,GAAE;AACtC,uCAAuC,GACvC,OAAO,MAAMC,uBAAuB,GAAE;AACtC,sDAAsD,GACtD,OAAO,MAAMC,mCAAmC,IAAG;AAEnD,OAAO,MAAMC,yBAAyB,eAAc;AACpD,OAAO,MAAMC,yBAAyB,4CAA2C;AACjF,OAAO,MAAMC,yBAAyB,uEAAsE;AAC5G,OAAO,MAAMC,wBACX,6GAA4G;AAC9G,OAAO,MAAMC,4BAA4B,8CAA6C;AAEtF,MAAMC,YAA2D;IAC/DC,SAAS;IACTC,SAAS;IACTC,MAAM;IACNC,MAAM;IACNC,QAAQ;AACV;AAaA,SAASC;IACP,OAAO/B,cAAcgC,GAAG,GAAGD,SAAS;AACtC;AAEA;;;CAGC,GACD,OAAO,eAAeE,cAAcC,OAAiC;QAC9CA,gBAkBPA;IAlBd,MAAMC,QAAQC,QAAOF,iBAAAA,QAAQC,KAAK,YAAbD,iBAAiB,IAAIG,IAAI;IAC9C,MAAMC,SAASJ,QAAQI,MAAM,GAAGF,OAAOF,QAAQI,MAAM,EAAED,IAAI,KAAK;IAChE,IAAI,CAACF,OAAO,OAAO;QAAEI,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAyB;IAC7E,IAAIH,UAAU,AAAC,MAAMnC,oBAAoBmC,YAAaH,OAAO;QAC3D,OAAO;YAAEI,IAAI;YAAOC,QAAQ;YAAKC,OAAOrB;QAAuB;IACjE;IACA,IAAI,CAACc,QAAQQ,KAAK,EAAE;YAKqBC;QAJvC,MAAMC,aAAa,MAAMxC,qBAAqB8B,QAAQW,GAAG,EAAEV,OAAOW,KAAK,CAAC,IAAM;QAC9E,MAAMH,SAASC,CAAAA,8BAAAA,WAAYT,KAAK,MAAKA,QAAQS,WAAWD,MAAM,GAAG;QACjE,IAAI,CAACA,QAAQ,OAAO;YAAEJ,IAAI;YAAOC,QAAQ;YAAKC,OAAOpB;QAAuB;QAC5E,MAAM0B,UAAUT,SACZxC,gBAAgB6C,WAAWK,SAAQL,qBAAAA,OAAOM,UAAU,qBAAjBN,kBAAmB,CAACL,OAAO,IAC9DxC,gBAAgB6C;QACpB,MAAMO,UAAUH,WAAY,MAAM7C,uBAAuBiC,OAAOQ,QAAQ;QACxE,IAAI,CAACO,SAAS;YACZ,OAAO;gBAAEX,IAAI;gBAAOC,QAAQ;gBAAKC,OAAOH,SAAShB,yBAAyBC;YAAsB;QAClG;IACF;IACA,MAAM4B,MAAM,EAAEjB,eAAAA,QAAQiB,GAAG,YAAXjB,eAAiC,MAAMjC,UAAUkC,WAA4B;IAC3F,IAAI,CAACgB,KAAK,OAAO;QAAEZ,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAuB;IACzE,MAAMW,QAAQtC,gBAAgBqC,KAAK;IACnC,IAAIC,OAAO,OAAO;QAAEb,IAAI;QAAOC,QAAQ;QAAKC,OAAOW,MAAMC,IAAI,CAACZ,KAAK;IAAC;IACpE,IAAI,CAACH,QAAQ,OAAO;QAAEH;QAAOG,QAAQ;QAAMa;QAAKG,OAAO;QAAMC,SAAS,IAAM;IAAK;IACjF,MAAMD,QAAQ,MAAMvD,oBAAoBuC,QAAQa;IAChD,MAAMK,WAAW,IAAIC,IAAY5D,cAAcyD;IAC/C,OAAO;QACLnB;QACAG;QACAa;QACAG;QACAC,SAAS,CAACG,YACRC,MAAMC,OAAO,CAACF,cAAcA,UAAUG,IAAI,CAAC,CAACC,QAAUN,SAASO,GAAG,CAAC3B,OAAO0B;IAC9E;AACF;AAEA,MAAME,gBAAgB,CAAC7B,OAAe8B,OACpClC,YAAYmC,UAAU,CAAC,QAAQC,GAAG,CAAChC,OAAO+B,UAAU,CAACD;AAEvD,iFAAiF,GACjF,eAAeG,WACbC,KAAoB,EACpBC,KAAmH;IAEnH,MAAMC,WAAW,MAAMP,cAAcK,MAAMlC,KAAK,EAAEmC,MAAMJ,UAAU,EAC/DM,KAAK,CAACF,MAAMG,KAAK,EAAE,MAAMH,MAAMI,EAAE,EACjCC,OAAO,CAACL,MAAMK,OAAO,EAAEL,MAAMM,SAAS,EACtCC,KAAK,CAACP,MAAMO,KAAK,EACjBC,GAAG;IACN,OAAOP,SAASQ,IAAI,CACjBC,GAAG,CAAC,CAACb;YAASA;gBAAAA,YAAAA,IAAIc,IAAI,cAARd,YAAc,CAAC;OAC7Be,MAAM,CAAC,CAACC,MAAQd,MAAMd,OAAO,CAAC4B,GAAG,CAAC,YAAY;AACnD;AAEA,0DAA0D,GAC1D,eAAeC,aAAaf,KAAoB,EAAEgB,KAAsC;IACtF,MAAMC,MAAM;WAAI,IAAI7B,IAAI4B,MAAML,GAAG,CAAC,CAACpD;gBAAgBA;mBAAPQ,QAAOR,mBAAAA,KAAK2D,UAAU,YAAf3D,mBAAmB;WAAKsD,MAAM,CAAClC;KAAU;IAC5F,MAAMwC,YAAY,MAAMC,QAAQC,GAAG,CAACJ,IAAIN,GAAG,CAAC,CAACN,KAAOV,cAAcK,MAAMlC,KAAK,EAAExC,gBAAgBgG,SAAS,EAAExB,GAAG,CAACO,IAAII,GAAG;IACrH,OAAO,IAAIc,IACTJ,UACGN,MAAM,CAAC,CAACX,WAAaA,SAASsB,MAAM,EACpCb,GAAG,CAAC,CAACT;YAA4BA;eAAf;YAACA,SAASG,EAAE;aAAGH,iBAAAA,SAASU,IAAI,cAAbV,iBAAmB,CAAC;SAAkB;;AAE9E;AAEA,qDAAqD,GACrD,eAAeuB,WAAWzB,KAAoB,EAAEH,UAAkB,EAAEQ,EAAU;QAG3CH;IAFjC,IAAI,CAACG,IAAI,OAAO;IAChB,MAAMH,WAAW,MAAMP,cAAcK,MAAMlC,KAAK,EAAE+B,YAAYC,GAAG,CAACO,IAAII,GAAG;IACzE,MAAMG,OAAOV,SAASsB,MAAM,IAAKtB,iBAAAA,SAASU,IAAI,cAAbV,iBAAmB,CAAC,IAAc;IACnE,OAAOU,QAAQZ,MAAMd,OAAO,CAAC0B,IAAI,CAAC,YAAY,IAAIA,OAAO;AAC3D;AAEA,MAAMc,UAAU,CAACC,MAAqCxD,SAAoB,GAAG,GAAe,CAAA;QAC1FD,IAAI;QACJC;QACAC,OAAOhB,SAAS,CAACuE,KAAK;IACxB,CAAA;AAEA,4DAA4D,GAC5D,SAASC,OAAOC,IAAiG;IAC/G,OAAO;QACLA,MAAM,OAAOhE;YACX,MAAMmC,QAAQ,MAAMpC,cAAcC;YAClC,IAAI,QAAQmC,OAAO,OAAOA;YAC1B,OAAO6B,KAAK7B,OAAOnC;QACrB;IACF;AACF;AAEA,OAAO,MAAMiE,wBAAwBF,OAAO,OAAO5B,OAAOnC;QACtCA,aAGJmC;IAHd,MAAMK,KAAKtC,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IACxC,MAAM8C,MAAM,MAAMW,WAAWzB,OAAOtD,qBAAqB2D;IACzD,IAAI,CAACS,KAAK,OAAOY,QAAQ;IACzB,MAAMzC,SAAQe,eAAAA,MAAMf,KAAK,YAAXe,eAAezE,oBAAoBuF,KAAKd,MAAMlB,GAAG;IAC/D,MAAMiD,SAAS;QAAE3B,OAAO;QAAaC;IAAG;IACxC,MAAM,CAAC2B,YAAYC,OAAOjB,MAAM,GAAG,MAAMI,QAAQC,GAAG,CAAC;QACnDtB,WAAwBC,OAAO,aAAK+B;YAAQlC,YAAYvE,gBAAgB0G,UAAU;YAAE1B,SAAS;YAAQC,WAAW;YAAQC,OAAO7D;;QAC/HoD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYvE,gBAAgB2G,KAAK;YAAE3B,SAAS;YAAWC,WAAW;YAAOC,OAAO5D;;QACxHmD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYvE,gBAAgB0F,KAAK;YAAEV,SAAS;YAAaC,WAAW;YAAQC,OAAO3D;;KAC5H;IACD,MAAMyE,YAAY,MAAMP,aAAaf,OAAOgB;IAC5C,OAAO;QACL9C,IAAI;QACJgE,OAAO,aAAK9F,aAAa;YAAE0E;YAAK7B;YAAO+C;YAAYC;YAAOjB;YAAOM;YAAWa,OAAOtE,QAAQuE,GAAG,CAACC,OAAO;QAAG;IAC3G;AACF,GAAE;AAEF,OAAO,MAAMC,wBAAwBV,OAAO,OAAO5B,OAAOnC;QACtCA;IAAlB,MAAMwC,KAAKtC,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IACxC,MAAMV,UAAU,MAAMmE,WAAWzB,OAAO1E,gBAAgBiH,SAAS,EAAElC;IACnE,IAAI,CAAC/C,SAAS,OAAOoE,QAAQ;IAC7B,MAAMK,SAAS;QAAE3B,OAAO;QAAaC;IAAG;IACxC,MAAM,CAAC2B,YAAYC,OAAOjB,MAAM,GAAG,MAAMI,QAAQC,GAAG,CAAC;QACnDtB,WAAwBC,OAAO,aAAK+B;YAAQlC,YAAYvE,gBAAgB0G,UAAU;YAAE1B,SAAS;YAAQC,WAAW;YAAQC,OAAO7D;;QAC/HoD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYvE,gBAAgB2G,KAAK;YAAE3B,SAAS;YAAWC,WAAW;YAAOC,OAAO5D;;QACxHmD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYvE,gBAAgB0F,KAAK;YAAEV,SAAS;YAAaC,WAAW;YAAQC,OAAO3D;;KAC5H;IACD,MAAMyE,YAAY,MAAMP,aAAaf,OAAOgB;IAC5C,OAAO;QACL9C,IAAI;QACJgE,OAAO,aACF/F,aAAa;YAAEmB,SAASA;YAAgC0E;YAAYC;YAAOjB;YAAOM;YAAWa,OAAOtE,QAAQuE,GAAG,CAACC,OAAO;QAAG;IAEjI;AACF,GAAE;AAEF,OAAO,MAAMG,qBAAqBZ,OAAO,OAAO5B,OAAOnC;QACnCA,aAcFyD,gBAAqB/D;IAdrC,MAAM8C,KAAKtC,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IACxC,MAAMT,OAAQ,MAAMkE,WAAWzB,OAAO1E,gBAAgB0F,KAAK,EAAEX;IAC7D,IAAI,CAAC9C,MAAM,OAAOmE,QAAQ;IAC1B,MAAMK,SAAS;QAAE3B,OAAO;QAAUC;IAAG;IACrC,MAAM,CAAC2B,YAAYC,OAAOX,UAAU,GAAG,MAAMF,QAAQC,GAAG,CAAC;QACvDtB,WAAwBC,OAAO,aAAK+B;YAAQlC,YAAYvE,gBAAgB0G,UAAU;YAAE1B,SAAS;YAAQC,WAAW;YAAQC,OAAO7D;;QAC/HoD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYvE,gBAAgB2G,KAAK;YAAE3B,SAAS;YAAWC,WAAW;YAAOC,OAAO5D;;QACxHmE,aAAaf,OAAO;YAACzC;SAAK;KAC3B;IACD,OAAO;QACLW,IAAI;QACJgE,OAAO,aACF7F,UAAU;YACXkB;YACAkF,QAAQ,GAAEnB,iBAAAA,UAAUb,GAAG,CAAC1C,QAAOR,mBAAAA,KAAK2D,UAAU,YAAf3D,mBAAmB,gBAAxC+D,iBAAgD;YAC1DU;YACAC;YACAE,OAAOtE,QAAQuE,GAAG,CAACC,OAAO;QAC5B;IAEJ;AACF,GAAE;AAEF,OAAO,MAAMK,qBAAqBd,OAAO,OAAO5B,OAAOnC;QAEnCA,aAYgCqC;IAblD,IAAI,CAACF,MAAM/B,MAAM,EAAE,OAAO;QAAEC,IAAI;QAAOC,QAAQ;QAAKC,OAAOjB;IAA0B;IACrF,MAAMkD,KAAKtC,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IACxC,IAAI,CAACqC,IAAI,OAAOqB,QAAQ;IACxB,MAAMxB,WAAW,MAAMxC,YAAYmC,UAAU,CAAC,SAASC,GAAG,CAACE,MAAM/B,MAAM,EAAE4B,UAAU,CAAC,SAASC,GAAG,CAACO,IAAII,GAAG;IACxG,IAAI,CAACP,SAASsB,MAAM,EAAE,OAAOE,QAAQ;IACrC,MAAMM,aAAa,MAAMjC,WAAwBC,OAAO;QACtDI,OAAO;QACPC;QACAR,YAAYvE,gBAAgB0G,UAAU;QACtC1B,SAAS;QACTC,WAAW;QACXC,OAAO7D;IACT;IACA,OAAO;QAAEuB,IAAI;QAAMgE,OAAO,aAAK1F,UAAU;YAAEgB,IAAI,GAAG0C,iBAAAA,SAASU,IAAI,cAAbV,iBAAmB,CAAC;YAAY8B;QAAW;IAAK;AACpG,GAAE;AAEF,OAAO,MAAMW,uBAAuBf,OAAO,OAAO5B,OAAOnC;QAC7BA;IAA1B,MAAMgC,aAAa9B,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IAChD,IAAI,CAACzB,2BAA2BsD,aAAa,OAAO6B,QAAQ,UAAU;IACtE,MAAMxB,WAAW,MAAMP,cAAcK,MAAMlC,KAAK,EAAExC,gBAAgBsH,aAAa,EAC5EpC,KAAK,CAAC1D,kCACN2D,GAAG;IACN,MAAMoC,cAAc3C,SAASQ,IAAI,CAC9BC,GAAG,CAAC,CAACb;YAASA;gBAAAA,YAAAA,IAAIc,IAAI,cAARd,YAAc,CAAC;OAC7Be,MAAM,CAAC,CAACiC,aAAe9C,MAAMd,OAAO,CAAC4D,UAAU,CAAC,YAAY;IAC/D,OAAO;QAAE5E,IAAI;QAAMgE,OAAO,aAAK5F,YAAYuD,YAAYgD;IAAe;AACxE,GAAE;AAEF,0DAA0D,GAC1D,OAAO,MAAME,oBAAuE;IAClF,CAAC7G,2BAA2BmB,OAAO,CAAC,EAAEyE;IACtC,CAAC5F,2BAA2BoB,OAAO,CAAC,EAAEgF;IACtC,CAACpG,2BAA2BqB,IAAI,CAAC,EAAEiF;IACnC,CAACtG,2BAA2BsB,IAAI,CAAC,EAAEkF;IACnC,CAACzG,0BAA0B,EAAE0G;AAC/B,EAAC;AAED;;;CAGC,GACD,OAAO,SAASK;IACd,KAAK,MAAM,CAACC,UAAUC,YAAY,IAAIC,OAAOC,OAAO,CAACL,mBAAoB;QACvE1H,gCAAgC4H,UAAUC,aAAa;YAAEG,UAAUrH;QAAU;IAC/E;AACF"}

package/src/lib/server/record-timeline.d.ts

@@ -0,0 +1,51 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginRecordTimelineWriter } from '@aglyn/aglyn/plugin-manager/plugin-record-timeline';
+/**
+ * THE CRM'S WRITER ON THE CORE'S RECORD-TIMELINE SEAM (AGL-2981).
+ *
+ * Another plugin files an activity or a task on a contact, company or deal —
+ * an email a sequence sent, the reply it read, the call it asks for — and
+ * this writes it as the CRM writes its own:
+ *
+ *  1. the workspace's plan carries the CRM (`features.crm`), as at every
+ *     CRM door; a Free workspace keeps no records to file on;
+ *  2. the entry carries the scope a record made on that site carries
+ *     (`crmScopeTokens`), so exactly the people who see the record see it;
+ *  3. an EMAIL is filed under the id the capture address files a copy of the
+ *     same message by (`cap_` + the digest of its `Message-ID`), and written
+ *     with `create()`: the send, a copy the rep forwarded to the capture
+ *     address, and a second run of the caller are one row;
+ *  4. anything else — a note, a task — is filed under the caller's own key,
+ *     hashed with the caller's plugin id, and written once the same way;
+ *  5. a record at its activity ceiling is refused with the sentence every
+ *     CRM writer answers with, before anything is written.
+ *
+ * Each entry names the plugin that filed it (`sourcePluginId`), and a task's
+ * `nextTaskAtMs` is recomputed on the records it names, as every server
+ * writer of a task does.
+ */
+type Firestore = FirebaseFirestore.Firestore;
+export interface CrmRecordTimelineDeps {
+    firestore(): Firestore;
+}
+export declare function createCrmRecordTimelineWriter(deps: CrmRecordTimelineDeps): PluginRecordTimelineWriter;
+/** The platform's own dependencies. Specs build their own. */
+export declare function defaultCrmRecordTimelineDeps(): CrmRecordTimelineDeps;
+/** Registers the CRM as the workspace's record system on the timeline seam. */
+export declare function registerCrmRecordTimelineWriter(deps?: CrmRecordTimelineDeps): void;
+export {};

package/src/lib/server/record-timeline.js

@@ -0,0 +1,215 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { registerPluginRecordTimelineWriter } from "@aglyn/aglyn/plugin-manager/plugin-record-timeline";
+import { buildCrmCapturedEmailActivity, checkEntitlement, consentGroupForHost, CRM_ACTIVITY_LOG_FULL_MESSAGE, CRM_COLLECTIONS, crmActivityLogHasRoom, crmCapturedEmailKey, crmScopeTokens, crmTaskReminderAfterEdit, isCrmActivityKind, isCrmTaskKind } from "@aglyn/aglyn/server";
+import { countCrmActivitiesForRecord, createCrmEmailActivity, crmActivityRef, crmCapturedEmailActivityRef, firebaseAdmin, recomputeCrmNextTaskAt } from "@aglyn/tenant-data-admin";
+import { createHash } from "crypto";
+import { FieldValue } from "firebase-admin/firestore";
+import { BUNDLE_ID } from "../constants/bundle-common.js";
+import { CRM_SUITE_FEATURE } from "./suite-gate.js";
+/** gRPC `ALREADY_EXISTS`, which `create()` rejects with when the document is there. */ const ALREADY_EXISTS = 6;
+/** The longest task title the CRM keeps, as its own forms do. */ const TASK_TITLE_MAX = 200;
+/** The longest note body or task note an entry filed here keeps. */ const NOTE_MAX = 2000;
+const refuse = (status, error)=>({
+        ok: false,
+        status,
+        error
+    });
+/** The record fields of a link, only the ones it names. */ function linkFields(link) {
+    return _extends({}, (link == null ? void 0 : link.contactId) ? {
+        contactId: String(link.contactId)
+    } : {}, (link == null ? void 0 : link.companyId) ? {
+        companyId: String(link.companyId)
+    } : {}, (link == null ? void 0 : link.dealId) ? {
+        dealId: String(link.dealId)
+    } : {});
+}
+/** The document id a caller's key files under: its own namespace, never a raw key. */ function keyedId(sourcePluginId, key) {
+    return `plg_${createHash('sha256').update(`${sourcePluginId}:${key}`).digest('hex').slice(0, 28)}`;
+}
+export function createCrmRecordTimelineWriter(deps) {
+    /** The org, its plan, the link and the scope an entry is stamped with. */ async function admit(context) {
+        var _context_orgId, _context_hostId, _context_sourcePluginId, _snapshot_data;
+        const orgId = String((_context_orgId = context.orgId) != null ? _context_orgId : '').trim();
+        const hostId = String((_context_hostId = context.hostId) != null ? _context_hostId : '').trim();
+        const link = linkFields(context.link);
+        if (!orgId || !hostId || !String((_context_sourcePluginId = context.sourcePluginId) != null ? _context_sourcePluginId : '').trim()) {
+            return refuse(400, 'An entry names its organization, its site and the plugin filing it.');
+        }
+        if (!link.contactId && !link.companyId && !link.dealId) {
+            return refuse(400, 'An entry is filed on a contact, a company or a deal.');
+        }
+        const firestore = deps.firestore();
+        const orgRef = firestore.collection('orgs').doc(orgId);
+        const snapshot = await orgRef.get();
+        if (!snapshot.exists) return refuse(404, 'That organization no longer exists.');
+        const org = (_snapshot_data = snapshot.data()) != null ? _snapshot_data : {};
+        if (!checkEntitlement(org, CRM_SUITE_FEATURE)) {
+            return refuse(403, "This workspace's plan doesn't include the CRM.");
+        }
+        return {
+            firestore,
+            orgRef,
+            link,
+            visibleTo: crmScopeTokens(org, consentGroupForHost(org, hostId))
+        };
+    }
+    /** Creates a keyed entry once: `created: false` for one already filed. */ async function createOnce(ref, data) {
+        try {
+            await ref.create(_extends({}, data, {
+                createdAt: FieldValue.serverTimestamp(),
+                updatedAt: FieldValue.serverTimestamp()
+            }));
+            return true;
+        } catch (error) {
+            if ((error == null ? void 0 : error.code) === ALREADY_EXISTS) return false;
+            throw error;
+        }
+    }
+    return {
+        async logActivity (request) {
+            if (!isCrmActivityKind(request.kind)) return refuse(400, `"${String(request.kind)}" isn't an activity.`);
+            const admitted = await admit(request);
+            if ('ok' in admitted) return admitted;
+            const { firestore, orgRef, link, visibleTo } = admitted;
+            const orgId = orgRef.id;
+            let ref;
+            let activity;
+            if (request.kind === 'email') {
+                var _email_inReplyTo, _request_byUid, _request_byName;
+                const email = request.email;
+                const key = email ? crmCapturedEmailKey(email.messageId, null) : null;
+                if (!email || !key) return refuse(400, 'An email is filed by its Message-ID.');
+                ref = crmCapturedEmailActivityRef(firestore, orgId, key);
+                activity = buildCrmCapturedEmailActivity({
+                    direction: email.direction === 'inbound' ? 'inbound' : 'outbound',
+                    subject: email.subject,
+                    excerpt: request.body,
+                    from: email.from,
+                    to: email.to,
+                    messageId: email.messageId,
+                    inReplyTo: (_email_inReplyTo = email.inReplyTo) != null ? _email_inReplyTo : null,
+                    atMs: request.atMs,
+                    byUid: String((_request_byUid = request.byUid) != null ? _request_byUid : ''),
+                    byName: (_request_byName = request.byName) != null ? _request_byName : null,
+                    link,
+                    hostId: request.hostId,
+                    visibleTo
+                });
+            } else {
+                var _request_dedupeKey, _request_byName1, _request_body, _request_byUid1;
+                const key = String((_request_dedupeKey = request.dedupeKey) != null ? _request_dedupeKey : '').trim();
+                if (!key) return refuse(400, 'An entry that is not an email names its own key.');
+                ref = crmActivityRef(firestore, orgId, keyedId(request.sourcePluginId, key));
+                const byName = String((_request_byName1 = request.byName) != null ? _request_byName1 : '').trim();
+                activity = _extends({
+                    kind: request.kind,
+                    body: String((_request_body = request.body) != null ? _request_body : '').slice(0, NOTE_MAX),
+                    atMs: request.atMs,
+                    byUid: String((_request_byUid1 = request.byUid) != null ? _request_byUid1 : '')
+                }, byName ? {
+                    byName
+                } : {}, link, {
+                    hostId: request.hostId,
+                    visibleTo
+                });
+            }
+            // Filed before: answered off the one read, ahead of the ceiling's count.
+            if ((await ref.get()).exists) return {
+                ok: true,
+                id: ref.id,
+                created: false
+            };
+            if (!crmActivityLogHasRoom(await countCrmActivitiesForRecord(orgRef, link))) {
+                return refuse(409, CRM_ACTIVITY_LOG_FULL_MESSAGE);
+            }
+            const stamped = _extends({}, activity, {
+                sourcePluginId: request.sourcePluginId
+            });
+            const created = request.kind === 'email' ? await createCrmEmailActivity(ref, stamped) === 'created' : await createOnce(ref, stamped);
+            return {
+                ok: true,
+                id: ref.id,
+                created
+            };
+        },
+        async createTask (request) {
+            var _request_title, _request_dedupeKey, _request_notes, _request_assigneeUid, _request_createdByUid;
+            const title = String((_request_title = request.title) != null ? _request_title : '').replace(/\s+/g, ' ').trim().slice(0, TASK_TITLE_MAX);
+            const key = String((_request_dedupeKey = request.dedupeKey) != null ? _request_dedupeKey : '').trim();
+            if (!title || !key) return refuse(400, 'A task has a title and the caller’s own key.');
+            if (!isCrmTaskKind(request.kind)) return refuse(400, `"${String(request.kind)}" isn't a task.`);
+            if (!Number.isFinite(request.dueAtMs)) return refuse(400, 'A task has a due time.');
+            const admitted = await admit(request);
+            if ('ok' in admitted) return admitted;
+            const { firestore, orgRef, link, visibleTo } = admitted;
+            const ref = orgRef.collection(CRM_COLLECTIONS.tasks).doc(keyedId(request.sourcePluginId, key));
+            const notes = String((_request_notes = request.notes) != null ? _request_notes : '').trim().slice(0, NOTE_MAX);
+            const assigneeUid = String((_request_assigneeUid = request.assigneeUid) != null ? _request_assigneeUid : '').trim();
+            const task = _extends({
+                title
+            }, notes ? {
+                notes
+            } : {}, {
+                kind: request.kind,
+                priority: 'normal',
+                status: 'open',
+                dueAtMs: request.dueAtMs,
+                // The reminder a person's task gets (AGL-2659): the due time.
+                remindAtMs: crmTaskReminderAfterEdit({
+                    dueAtMs: request.dueAtMs,
+                    previous: null
+                })
+            }, assigneeUid ? {
+                assigneeUid
+            } : {}, {
+                createdByUid: String((_request_createdByUid = request.createdByUid) != null ? _request_createdByUid : ''),
+                sourcePluginId: request.sourcePluginId
+            }, link, {
+                hostId: request.hostId,
+                visibleTo
+            });
+            const created = await createOnce(ref, task);
+            if (created) {
+                // The records the task names carry `nextTaskAtMs` (AGL-2661); a figure
+                // that could not move is the Fields section's recompute's.
+                await recomputeCrmNextTaskAt(firestore, orgRef.id, [
+                    link
+                ]).catch((error)=>{
+                    console.error('[crm] next activity could not be recomputed', orgRef.id, error);
+                });
+            }
+            return {
+                ok: true,
+                id: ref.id,
+                created
+            };
+        }
+    };
+}
+/** The platform's own dependencies. Specs build their own. */ export function defaultCrmRecordTimelineDeps() {
+    return {
+        firestore: ()=>firebaseAdmin.app().firestore()
+    };
+}
+/** Registers the CRM as the workspace's record system on the timeline seam. */ export function registerCrmRecordTimelineWriter(deps = defaultCrmRecordTimelineDeps()) {
+    registerPluginRecordTimelineWriter(createCrmRecordTimelineWriter(deps), {
+        pluginId: BUNDLE_ID
+    });
+}
+
+//# sourceMappingURL=record-timeline.js.map