@aglyn/plugins-crm 1.0.0-beta.161 → 1.0.0-beta.163

package/src/lib/server/record-email-state.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/record-email-state.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  registerPluginRecordEmailStateWriter,\n  type PluginRecordEmailStateReport,\n  type PluginRecordEmailStateRequest,\n  type PluginRecordEmailStateWriter,\n} from '@aglyn/aglyn/plugin-manager/plugin-record-email-state'\nimport {\n  EMAIL_STATE_FIELD,\n  nextEmailState,\n  normalizeContactEmail,\n  personKey,\n  readEmailState,\n  type EmailState,\n} from '@aglyn/aglyn/server'\nimport { findContactByEmail, firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { BUNDLE_ID } from '../constants/bundle-common'\n\n/**\n * THE CRM'S WRITER ON THE CORE'S RECORD EMAIL-STATE SEAM (AGL-3245).\n *\n * A sender filed a verdict on an address — the outreach runtime's bounce,\n * the campaign webhook's complaint, a member's do-not-contact mark, the\n * unsubscribe link — and says so here; this writes it onto every record\n * the address is, as `emailState`, so the record a person reads and the\n * lists a send consults agree.\n *\n * One address can be several records: the contact the organization holds\n * (found through the address index, `findContactByEmail`), and a lead on\n * each site the organization owns — leads are keyed by `personKey`, so a\n * lead is addressed directly under every host. All of them are stamped;\n * the verdict is about the address, not about which record a rep opened.\n * A caller that knows only the site reads the organization off it.\n *\n * The write keeps the STRONGER verdict (`nextEmailState`): a member's\n * do-not-contact mark is not undone by a later bounce, and `ok` lands only\n * when a caller forces it. `updatedAt` is left alone — a verdict is\n * something that happened to the person, not an edit the team made, and a\n * list sorted on recency must not reshuffle on a bounce.\n *\n * Never throws: the list is the control, and a record that could not be\n * stamped is a chip a page goes without, logged.\n */\n\ntype Firestore = FirebaseFirestore.Firestore\n\nexport interface CrmRecordEmailStateDeps {\n  firestore(): Firestore\n}\n\nconst NONE: PluginRecordEmailStateReport = { records: 0 }\n\n/** The sites an organization owns, by id: `hosts` where `orgId` is the org's. */\nasync function orgHostIds(firestore: Firestore, orgId: string): Promise<string[]> {\n  const hosts = await firestore.collection('hosts').where('orgId', '==', orgId).select().get()\n  return hosts.docs.map((doc) => doc.id)\n}\n\n/**\n * Applies the verdict to one record; answers whether it moved. A read then\n * a merge rather than a transaction: two verdicts landing together each\n * compare against a state at least as old as their own, and the ranking\n * makes the order of two writes of the same rank immaterial.\n */\nasync function stampRecord(\n  ref: FirebaseFirestore.DocumentReference,\n  incoming: EmailState,\n  force: boolean,\n): Promise<boolean> {\n  const snapshot = await ref.get()\n  if (!snapshot.exists) return false\n  const current = readEmailState(snapshot.data() as Record<string, unknown>)\n  const next = nextEmailState(current, incoming, { force })\n  // The current verdict stood, or the same verdict arrived again — a second\n  // run of the caller — and there is nothing to write.\n  if (\n    next === current ||\n    (current &&\n      next.status === current.status &&\n      next.atMs === current.atMs &&\n      next.source === current.source &&\n      next.detail === current.detail)\n  ) {\n    return false\n  }\n  await ref.set({ [EMAIL_STATE_FIELD]: next }, { merge: true })\n  return true\n}\n\n/** The organization a request names, or the one its site belongs to. */\nasync function resolveOrgId(firestore: Firestore, request: PluginRecordEmailStateRequest): Promise<string> {\n  const named = String(request.orgId ?? '').trim()\n  if (named) return named\n  const hostId = String(request.hostId ?? '').trim()\n  if (!hostId) return ''\n  const host = await firestore.collection('hosts').doc(hostId).get()\n  return host.exists ? String(host.get('orgId') ?? '') : ''\n}\n\nexport function createCrmRecordEmailStateWriter(deps: CrmRecordEmailStateDeps): PluginRecordEmailStateWriter {\n  return {\n    async stamp(request) {\n      const email = normalizeContactEmail(request.email)\n      const key = email ? personKey(email) : null\n      if (!email || !key) return NONE\n      const firestore = deps.firestore()\n      let orgId: string\n      try {\n        orgId = await resolveOrgId(firestore, request)\n      } catch (error) {\n        console.error('[crm] the site’s organization could not be read for an email state', request.hostId, error)\n        return NONE\n      }\n      if (!orgId) return NONE\n      const state: EmailState = {\n        status: request.state.status,\n        atMs: Number.isFinite(request.state.atMs) && request.state.atMs > 0 ? request.state.atMs : Date.now(),\n        source: request.state.source,\n        detail: request.state.detail\n          ? String(request.state.detail).replace(/\\s+/g, ' ').trim().slice(0, 500)\n          : null,\n        ...(request.state.enrollmentId ? { enrollmentId: request.state.enrollmentId } : {}),\n      }\n      const force = request.force === true\n      let records = 0\n      try {\n        const contacts = firestore.collection('orgs').doc(orgId).collection('contacts')\n        const contact = await findContactByEmail(contacts, email)\n        if (contact && (await stampRecord(contact.ref, state, force))) records += 1\n      } catch (error) {\n        console.error('[crm] the contact could not be stamped with an email state', orgId, error)\n      }\n      try {\n        for (const hostId of await orgHostIds(firestore, orgId)) {\n          const lead = firestore.collection('hosts').doc(hostId).collection('leads').doc(key)\n          if (await stampRecord(lead, state, force)) records += 1\n        }\n      } catch (error) {\n        console.error('[crm] the leads could not be stamped with an email state', orgId, error)\n      }\n      return { records }\n    },\n  }\n}\n\n/** The platform's own dependencies. Specs build their own. */\nexport function defaultCrmRecordEmailStateDeps(): CrmRecordEmailStateDeps {\n  return { firestore: () => firebaseAdmin.app().firestore() }\n}\n\n/** Registers the CRM as the workspace's record system on the email-state seam. */\nexport function registerCrmRecordEmailStateWriter(\n  deps: CrmRecordEmailStateDeps = defaultCrmRecordEmailStateDeps(),\n): void {\n  registerPluginRecordEmailStateWriter(createCrmRecordEmailStateWriter(deps), { pluginId: BUNDLE_ID })\n}\n"],"names":["registerPluginRecordEmailStateWriter","EMAIL_STATE_FIELD","nextEmailState","normalizeContactEmail","personKey","readEmailState","findContactByEmail","firebaseAdmin","BUNDLE_ID","NONE","records","orgHostIds","firestore","orgId","hosts","collection","where","select","get","docs","map","doc","id","stampRecord","ref","incoming","force","snapshot","exists","current","data","next","status","atMs","source","detail","set","merge","resolveOrgId","request","host","named","String","trim","hostId","createCrmRecordEmailStateWriter","deps","stamp","email","key","error","console","state","Number","isFinite","Date","now","replace","slice","enrollmentId","contacts","contact","lead","defaultCrmRecordEmailStateDeps","app","registerCrmRecordEmailStateWriter","pluginId"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,oCAAoC,QAI/B,wDAAuD;AAC9D,SACEC,iBAAiB,EACjBC,cAAc,EACdC,qBAAqB,EACrBC,SAAS,EACTC,cAAc,QAET,sBAAqB;AAC5B,SAASC,kBAAkB,EAAEC,aAAa,QAAQ,2BAA0B;AAC5E,SAASC,SAAS,QAAQ,gCAA4B;AAkCtD,MAAMC,OAAqC;IAAEC,SAAS;AAAE;AAExD,+EAA+E,GAC/E,eAAeC,WAAWC,SAAoB,EAAEC,KAAa;IAC3D,MAAMC,QAAQ,MAAMF,UAAUG,UAAU,CAAC,SAASC,KAAK,CAAC,SAAS,MAAMH,OAAOI,MAAM,GAAGC,GAAG;IAC1F,OAAOJ,MAAMK,IAAI,CAACC,GAAG,CAAC,CAACC,MAAQA,IAAIC,EAAE;AACvC;AAEA;;;;;CAKC,GACD,eAAeC,YACbC,GAAwC,EACxCC,QAAoB,EACpBC,KAAc;IAEd,MAAMC,WAAW,MAAMH,IAAIN,GAAG;IAC9B,IAAI,CAACS,SAASC,MAAM,EAAE,OAAO;IAC7B,MAAMC,UAAUxB,eAAesB,SAASG,IAAI;IAC5C,MAAMC,OAAO7B,eAAe2B,SAASJ,UAAU;QAAEC;IAAM;IACvD,0EAA0E;IAC1E,qDAAqD;IACrD,IACEK,SAASF,WACRA,WACCE,KAAKC,MAAM,KAAKH,QAAQG,MAAM,IAC9BD,KAAKE,IAAI,KAAKJ,QAAQI,IAAI,IAC1BF,KAAKG,MAAM,KAAKL,QAAQK,MAAM,IAC9BH,KAAKI,MAAM,KAAKN,QAAQM,MAAM,EAChC;QACA,OAAO;IACT;IACA,MAAMX,IAAIY,GAAG,CAAC;QAAE,CAACnC,kBAAkB,EAAE8B;IAAK,GAAG;QAAEM,OAAO;IAAK;IAC3D,OAAO;AACT;AAEA,sEAAsE,GACtE,eAAeC,aAAa1B,SAAoB,EAAE2B,OAAsC;QACjEA,gBAECA,iBAGMC;IAL5B,MAAMC,QAAQC,QAAOH,iBAAAA,QAAQ1B,KAAK,YAAb0B,iBAAiB,IAAII,IAAI;IAC9C,IAAIF,OAAO,OAAOA;IAClB,MAAMG,SAASF,QAAOH,kBAAAA,QAAQK,MAAM,YAAdL,kBAAkB,IAAII,IAAI;IAChD,IAAI,CAACC,QAAQ,OAAO;IACpB,MAAMJ,OAAO,MAAM5B,UAAUG,UAAU,CAAC,SAASM,GAAG,CAACuB,QAAQ1B,GAAG;IAChE,OAAOsB,KAAKZ,MAAM,GAAGc,QAAOF,YAAAA,KAAKtB,GAAG,CAAC,oBAATsB,YAAqB,MAAM;AACzD;AAEA,OAAO,SAASK,gCAAgCC,IAA6B;IAC3E,OAAO;QACL,MAAMC,OAAMR,OAAO;YACjB,MAAMS,QAAQ7C,sBAAsBoC,QAAQS,KAAK;YACjD,MAAMC,MAAMD,QAAQ5C,UAAU4C,SAAS;YACvC,IAAI,CAACA,SAAS,CAACC,KAAK,OAAOxC;YAC3B,MAAMG,YAAYkC,KAAKlC,SAAS;YAChC,IAAIC;YACJ,IAAI;gBACFA,QAAQ,MAAMyB,aAAa1B,WAAW2B;YACxC,EAAE,OAAOW,OAAO;gBACdC,QAAQD,KAAK,CAAC,sEAAsEX,QAAQK,MAAM,EAAEM;gBACpG,OAAOzC;YACT;YACA,IAAI,CAACI,OAAO,OAAOJ;YACnB,MAAM2C,QAAoB;gBACxBpB,QAAQO,QAAQa,KAAK,CAACpB,MAAM;gBAC5BC,MAAMoB,OAAOC,QAAQ,CAACf,QAAQa,KAAK,CAACnB,IAAI,KAAKM,QAAQa,KAAK,CAACnB,IAAI,GAAG,IAAIM,QAAQa,KAAK,CAACnB,IAAI,GAAGsB,KAAKC,GAAG;gBACnGtB,QAAQK,QAAQa,KAAK,CAAClB,MAAM;gBAC5BC,QAAQI,QAAQa,KAAK,CAACjB,MAAM,GACxBO,OAAOH,QAAQa,KAAK,CAACjB,MAAM,EAAEsB,OAAO,CAAC,QAAQ,KAAKd,IAAI,GAAGe,KAAK,CAAC,GAAG,OAClE;eACAnB,QAAQa,KAAK,CAACO,YAAY,GAAG;gBAAEA,cAAcpB,QAAQa,KAAK,CAACO,YAAY;YAAC,IAAI,CAAC;YAEnF,MAAMjC,QAAQa,QAAQb,KAAK,KAAK;YAChC,IAAIhB,UAAU;YACd,IAAI;gBACF,MAAMkD,WAAWhD,UAAUG,UAAU,CAAC,QAAQM,GAAG,CAACR,OAAOE,UAAU,CAAC;gBACpE,MAAM8C,UAAU,MAAMvD,mBAAmBsD,UAAUZ;gBACnD,IAAIa,WAAY,MAAMtC,YAAYsC,QAAQrC,GAAG,EAAE4B,OAAO1B,QAAShB,WAAW;YAC5E,EAAE,OAAOwC,OAAO;gBACdC,QAAQD,KAAK,CAAC,8DAA8DrC,OAAOqC;YACrF;YACA,IAAI;gBACF,KAAK,MAAMN,UAAU,CAAA,MAAMjC,WAAWC,WAAWC,MAAK,EAAG;oBACvD,MAAMiD,OAAOlD,UAAUG,UAAU,CAAC,SAASM,GAAG,CAACuB,QAAQ7B,UAAU,CAAC,SAASM,GAAG,CAAC4B;oBAC/E,IAAI,MAAM1B,YAAYuC,MAAMV,OAAO1B,QAAQhB,WAAW;gBACxD;YACF,EAAE,OAAOwC,OAAO;gBACdC,QAAQD,KAAK,CAAC,4DAA4DrC,OAAOqC;YACnF;YACA,OAAO;gBAAExC;YAAQ;QACnB;IACF;AACF;AAEA,4DAA4D,GAC5D,OAAO,SAASqD;IACd,OAAO;QAAEnD,WAAW,IAAML,cAAcyD,GAAG,GAAGpD,SAAS;IAAG;AAC5D;AAEA,gFAAgF,GAChF,OAAO,SAASqD,kCACdnB,OAAgCiB,gCAAgC;IAEhE/D,qCAAqC6C,gCAAgCC,OAAO;QAAEoB,UAAU1D;IAAU;AACpG"}

package/src/lib/server/record-timeline.d.ts

@@ -33,7 +33,11 @@ import { type PluginRecordTimelineWriter } from '@aglyn/aglyn/plugin-manager/plu
  *  4. anything else — a note, a task — is filed under the caller's own key,
  *     hashed with the caller's plugin id, and written once the same way;
  *  5. a record at its activity ceiling is refused with the sentence every
- *     CRM writer answers with, before anything is written.
+ *     CRM writer answers with, before anything is written;
+ *  6. a bounce or a complaint on a filed email (AGL-3245) advances that
+ *     email's own delivery state — the row the send was filed under, found
+ *     by its `Message-ID` — exactly as the campaign webhook advances one,
+ *     so the timeline reads Sent, then Bounced, with what the server said.
  *
  * Each entry names the plugin that filed it (`sourcePluginId`), and a task's
  * `nextTaskAtMs` is recomputed on the records it names, as every server

package/src/lib/server/record-timeline.js

@@ -16,7 +16,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * limitations under the License.
  */ import { registerPluginRecordTimelineWriter } from "@aglyn/aglyn/plugin-manager/plugin-record-timeline";
 import { buildCrmCapturedEmailActivity, checkEntitlement, consentGroupForHost, CRM_ACTIVITY_LOG_FULL_MESSAGE, CRM_COLLECTIONS, crmActivityLogHasRoom, crmCapturedEmailKey, crmScopeTokens, crmTaskReminderAfterEdit, isCrmActivityKind, isCrmTaskKind } from "@aglyn/aglyn/server";
-import { countCrmActivitiesForRecord, createCrmEmailActivity, crmActivityRef, crmCapturedEmailActivityRef, firebaseAdmin, recomputeCrmNextTaskAt } from "@aglyn/tenant-data-admin";
+import { countCrmActivitiesForRecord, createCrmEmailActivity, crmActivityRef, crmCapturedEmailActivityRef, firebaseAdmin, recomputeCrmNextTaskAt, recordCrmEmailDelivery } from "@aglyn/tenant-data-admin";
 import { createHash } from "crypto";
 import { FieldValue } from "firebase-admin/firestore";
 import { BUNDLE_ID } from "../constants/bundle-common.js";
@@ -200,6 +200,31 @@ export function createCrmRecordTimelineWriter(deps) {
                 id: ref.id,
                 created
             };
+        },
+        async recordEmailDelivery (request) {
+            var _request_orgId, _request_detail;
+            const orgId = String((_request_orgId = request.orgId) != null ? _request_orgId : '').trim();
+            const key = crmCapturedEmailKey(request.messageId, null);
+            if (!orgId || !key) return refuse(400, 'A delivery names its organization and the email’s Message-ID.');
+            if (request.state !== 'bounced' && request.state !== 'complained') {
+                return refuse(400, `"${String(request.state)}" isn't a delivery failure.`);
+            }
+            const firestore = deps.firestore();
+            const ref = crmCapturedEmailActivityRef(firestore, orgId, key);
+            const outcome = await recordCrmEmailDelivery(firestore, {
+                orgId,
+                activityId: ref.id,
+                state: request.state,
+                atMs: request.atMs,
+                detail: (_request_detail = request.detail) != null ? _request_detail : null
+            });
+            if (outcome === 'missing') return refuse(404, 'No email by that Message-ID is filed here.');
+            if (outcome === 'failed') return refuse(409, 'The delivery state could not be written.');
+            return {
+                ok: true,
+                id: ref.id,
+                created: outcome === 'advanced'
+            };
         }
     };
 }

package/src/lib/server/record-timeline.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/record-timeline.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  registerPluginRecordTimelineWriter,\n  type PluginRecordActivityRequest,\n  type PluginRecordEntryContext,\n  type PluginRecordTaskRequest,\n  type PluginRecordTimelineWriter,\n  type PluginRecordWrite,\n} from '@aglyn/aglyn/plugin-manager/plugin-record-timeline'\nimport {\n  buildCrmCapturedEmailActivity,\n  checkEntitlement,\n  consentGroupForHost,\n  CRM_ACTIVITY_LOG_FULL_MESSAGE,\n  CRM_COLLECTIONS,\n  crmActivityLogHasRoom,\n  crmCapturedEmailKey,\n  crmScopeTokens,\n  crmTaskReminderAfterEdit,\n  isCrmActivityKind,\n  isCrmTaskKind,\n  type CrmActivity,\n  type CrmActivityLink,\n  type CrmTask,\n} from '@aglyn/aglyn/server'\nimport {\n  countCrmActivitiesForRecord,\n  createCrmEmailActivity,\n  crmActivityRef,\n  crmCapturedEmailActivityRef,\n  firebaseAdmin,\n  recomputeCrmNextTaskAt,\n} from '@aglyn/tenant-data-admin'\nimport { createHash } from 'crypto'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { BUNDLE_ID } from '../constants/bundle-common'\nimport { CRM_SUITE_FEATURE } from './suite-gate'\n\n/**\n * THE CRM'S WRITER ON THE CORE'S RECORD-TIMELINE SEAM (AGL-2981).\n *\n * Another plugin files an activity or a task on a contact, company or deal —\n * an email a sequence sent, the reply it read, the call it asks for — and\n * this writes it as the CRM writes its own:\n *\n *  1. the workspace's plan carries the CRM (`features.crm`), as at every\n *     CRM door; a Free workspace keeps no records to file on;\n *  2. the entry carries the scope a record made on that site carries\n *     (`crmScopeTokens`), so exactly the people who see the record see it;\n *  3. an EMAIL is filed under the id the capture address files a copy of the\n *     same message by (`cap_` + the digest of its `Message-ID`), and written\n *     with `create()`: the send, a copy the rep forwarded to the capture\n *     address, and a second run of the caller are one row;\n *  4. anything else — a note, a task — is filed under the caller's own key,\n *     hashed with the caller's plugin id, and written once the same way;\n *  5. a record at its activity ceiling is refused with the sentence every\n *     CRM writer answers with, before anything is written.\n *\n * Each entry names the plugin that filed it (`sourcePluginId`), and a task's\n * `nextTaskAtMs` is recomputed on the records it names, as every server\n * writer of a task does.\n */\n\ntype Firestore = FirebaseFirestore.Firestore\n\nexport interface CrmRecordTimelineDeps {\n  firestore(): Firestore\n}\n\n/** gRPC `ALREADY_EXISTS`, which `create()` rejects with when the document is there. */\nconst ALREADY_EXISTS = 6\n\n/** The longest task title the CRM keeps, as its own forms do. */\nconst TASK_TITLE_MAX = 200\n/** The longest note body or task note an entry filed here keeps. */\nconst NOTE_MAX = 2_000\n\nconst refuse = (status: 400 | 403 | 404 | 409, error: string): PluginRecordWrite => ({\n  ok: false,\n  status,\n  error,\n})\n\n/** The record fields of a link, only the ones it names. */\nfunction linkFields(link: PluginRecordEntryContext['link']): CrmActivityLink {\n  return {\n    ...(link?.contactId ? { contactId: String(link.contactId) } : {}),\n    ...(link?.companyId ? { companyId: String(link.companyId) } : {}),\n    ...(link?.dealId ? { dealId: String(link.dealId) } : {}),\n    // A lead (AGL-3234): host-scoped by path, so the entry carries the\n    // site's scope like any record created from that site.\n    ...(link?.leadId ? { leadId: String(link.leadId) } : {}),\n  }\n}\n\n/** The document id a caller's key files under: its own namespace, never a raw key. */\nfunction keyedId(sourcePluginId: string, key: string): string {\n  return `plg_${createHash('sha256').update(`${sourcePluginId}:${key}`).digest('hex').slice(0, 28)}`\n}\n\nexport function createCrmRecordTimelineWriter(deps: CrmRecordTimelineDeps): PluginRecordTimelineWriter {\n  /** The org, its plan, the link and the scope an entry is stamped with. */\n  async function admit(\n    context: PluginRecordEntryContext,\n  ): Promise<\n    | PluginRecordWrite\n    | { firestore: Firestore; orgRef: FirebaseFirestore.DocumentReference; link: CrmActivityLink; visibleTo: string[] }\n  > {\n    const orgId = String(context.orgId ?? '').trim()\n    const hostId = String(context.hostId ?? '').trim()\n    const link = linkFields(context.link)\n    if (!orgId || !hostId || !String(context.sourcePluginId ?? '').trim()) {\n      return refuse(400, 'An entry names its organization, its site and the plugin filing it.')\n    }\n    if (!link.contactId && !link.companyId && !link.dealId && !link.leadId) {\n      return refuse(400, 'An entry is filed on a contact, a company, a deal or a lead.')\n    }\n    const firestore = deps.firestore()\n    const orgRef = firestore.collection('orgs').doc(orgId)\n    const snapshot = await orgRef.get()\n    if (!snapshot.exists) return refuse(404, 'That organization no longer exists.')\n    const org = (snapshot.data() ?? {}) as Record<string, unknown>\n    if (!checkEntitlement(org, CRM_SUITE_FEATURE)) {\n      return refuse(403, \"This workspace's plan doesn't include the CRM.\")\n    }\n    return {\n      firestore,\n      orgRef,\n      link,\n      visibleTo: crmScopeTokens(org, consentGroupForHost(org, hostId)),\n    }\n  }\n\n  /** Creates a keyed entry once: `created: false` for one already filed. */\n  async function createOnce(\n    ref: FirebaseFirestore.DocumentReference,\n    data: Record<string, unknown>,\n  ): Promise<boolean> {\n    try {\n      await ref.create({\n        ...data,\n        createdAt: FieldValue.serverTimestamp(),\n        updatedAt: FieldValue.serverTimestamp(),\n      })\n      return true\n    } catch (error) {\n      if ((error as { code?: unknown })?.code === ALREADY_EXISTS) return false\n      throw error\n    }\n  }\n\n  return {\n    async logActivity(request: PluginRecordActivityRequest): Promise<PluginRecordWrite> {\n      if (!isCrmActivityKind(request.kind)) return refuse(400, `\"${String(request.kind)}\" isn't an activity.`)\n      const admitted = await admit(request)\n      if ('ok' in admitted) return admitted\n      const { firestore, orgRef, link, visibleTo } = admitted\n      const orgId = orgRef.id\n\n      let ref: FirebaseFirestore.DocumentReference\n      let activity: CrmActivity\n      if (request.kind === 'email') {\n        const email = request.email\n        const key = email ? crmCapturedEmailKey(email.messageId, null) : null\n        if (!email || !key) return refuse(400, 'An email is filed by its Message-ID.')\n        ref = crmCapturedEmailActivityRef(firestore, orgId, key)\n        activity = buildCrmCapturedEmailActivity({\n          direction: email.direction === 'inbound' ? 'inbound' : 'outbound',\n          subject: email.subject,\n          excerpt: request.body,\n          from: email.from,\n          to: email.to,\n          messageId: email.messageId,\n          inReplyTo: email.inReplyTo ?? null,\n          atMs: request.atMs,\n          byUid: String(request.byUid ?? ''),\n          byName: request.byName ?? null,\n          link,\n          hostId: request.hostId,\n          visibleTo,\n        })\n      } else {\n        const key = String(request.dedupeKey ?? '').trim()\n        if (!key) return refuse(400, 'An entry that is not an email names its own key.')\n        ref = crmActivityRef(firestore, orgId, keyedId(request.sourcePluginId, key))\n        const byName = String(request.byName ?? '').trim()\n        activity = {\n          kind: request.kind,\n          body: String(request.body ?? '').slice(0, NOTE_MAX),\n          atMs: request.atMs,\n          byUid: String(request.byUid ?? ''),\n          ...(byName ? { byName } : {}),\n          ...link,\n          hostId: request.hostId,\n          visibleTo,\n        }\n      }\n      // Filed before: answered off the one read, ahead of the ceiling's count.\n      if ((await ref.get()).exists) return { ok: true, id: ref.id, created: false }\n      if (!crmActivityLogHasRoom(await countCrmActivitiesForRecord(orgRef, link))) {\n        return refuse(409, CRM_ACTIVITY_LOG_FULL_MESSAGE)\n      }\n      const stamped = { ...activity, sourcePluginId: request.sourcePluginId }\n      const created =\n        request.kind === 'email'\n          ? (await createCrmEmailActivity(ref, stamped)) === 'created'\n          : await createOnce(ref, stamped as unknown as Record<string, unknown>)\n      return { ok: true, id: ref.id, created }\n    },\n\n    async createTask(request: PluginRecordTaskRequest): Promise<PluginRecordWrite> {\n      const title = String(request.title ?? '').replace(/\\s+/g, ' ').trim().slice(0, TASK_TITLE_MAX)\n      const key = String(request.dedupeKey ?? '').trim()\n      if (!title || !key) return refuse(400, 'A task has a title and the caller’s own key.')\n      if (!isCrmTaskKind(request.kind)) return refuse(400, `\"${String(request.kind)}\" isn't a task.`)\n      if (!Number.isFinite(request.dueAtMs)) return refuse(400, 'A task has a due time.')\n      const admitted = await admit(request)\n      if ('ok' in admitted) return admitted\n      const { firestore, orgRef, link, visibleTo } = admitted\n      const ref = orgRef.collection(CRM_COLLECTIONS.tasks).doc(keyedId(request.sourcePluginId, key))\n      const notes = String(request.notes ?? '').trim().slice(0, NOTE_MAX)\n      const assigneeUid = String(request.assigneeUid ?? '').trim()\n      const task: CrmTask = {\n        title,\n        ...(notes ? { notes } : {}),\n        kind: request.kind,\n        priority: 'normal',\n        status: 'open',\n        dueAtMs: request.dueAtMs,\n        // The reminder a person's task gets (AGL-2659): the due time.\n        remindAtMs: crmTaskReminderAfterEdit({ dueAtMs: request.dueAtMs, previous: null }),\n        ...(assigneeUid ? { assigneeUid } : {}),\n        createdByUid: String(request.createdByUid ?? ''),\n        sourcePluginId: request.sourcePluginId,\n        ...link,\n        hostId: request.hostId,\n        visibleTo,\n      }\n      const created = await createOnce(ref, task as unknown as Record<string, unknown>)\n      if (created) {\n        // The records the task names carry `nextTaskAtMs` (AGL-2661); a figure\n        // that could not move is the Fields section's recompute's.\n        await recomputeCrmNextTaskAt(firestore, orgRef.id, [link]).catch((error: unknown) => {\n          console.error('[crm] next activity could not be recomputed', orgRef.id, error)\n        })\n      }\n      return { ok: true, id: ref.id, created }\n    },\n  }\n}\n\n/** The platform's own dependencies. Specs build their own. */\nexport function defaultCrmRecordTimelineDeps(): CrmRecordTimelineDeps {\n  return { firestore: () => firebaseAdmin.app().firestore() }\n}\n\n/** Registers the CRM as the workspace's record system on the timeline seam. */\nexport function registerCrmRecordTimelineWriter(\n  deps: CrmRecordTimelineDeps = defaultCrmRecordTimelineDeps(),\n): void {\n  registerPluginRecordTimelineWriter(createCrmRecordTimelineWriter(deps), { pluginId: BUNDLE_ID })\n}\n"],"names":["registerPluginRecordTimelineWriter","buildCrmCapturedEmailActivity","checkEntitlement","consentGroupForHost","CRM_ACTIVITY_LOG_FULL_MESSAGE","CRM_COLLECTIONS","crmActivityLogHasRoom","crmCapturedEmailKey","crmScopeTokens","crmTaskReminderAfterEdit","isCrmActivityKind","isCrmTaskKind","countCrmActivitiesForRecord","createCrmEmailActivity","crmActivityRef","crmCapturedEmailActivityRef","firebaseAdmin","recomputeCrmNextTaskAt","createHash","FieldValue","BUNDLE_ID","CRM_SUITE_FEATURE","ALREADY_EXISTS","TASK_TITLE_MAX","NOTE_MAX","refuse","status","error","ok","linkFields","link","contactId","String","companyId","dealId","leadId","keyedId","sourcePluginId","key","update","digest","slice","createCrmRecordTimelineWriter","deps","admit","context","snapshot","orgId","trim","hostId","firestore","orgRef","collection","doc","get","exists","org","data","visibleTo","createOnce","ref","create","createdAt","serverTimestamp","updatedAt","code","logActivity","request","kind","admitted","id","activity","email","messageId","direction","subject","excerpt","body","from","to","inReplyTo","atMs","byUid","byName","dedupeKey","created","stamped","createTask","title","replace","Number","isFinite","dueAtMs","tasks","notes","assigneeUid","task","priority","remindAtMs","previous","createdByUid","catch","console","defaultCrmRecordTimelineDeps","app","registerCrmRecordTimelineWriter","pluginId"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,kCAAkC,QAM7B,qDAAoD;AAC3D,SACEC,6BAA6B,EAC7BC,gBAAgB,EAChBC,mBAAmB,EACnBC,6BAA6B,EAC7BC,eAAe,EACfC,qBAAqB,EACrBC,mBAAmB,EACnBC,cAAc,EACdC,wBAAwB,EACxBC,iBAAiB,EACjBC,aAAa,QAIR,sBAAqB;AAC5B,SACEC,2BAA2B,EAC3BC,sBAAsB,EACtBC,cAAc,EACdC,2BAA2B,EAC3BC,aAAa,EACbC,sBAAsB,QACjB,2BAA0B;AACjC,SAASC,UAAU,QAAQ,SAAQ;AACnC,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,SAAS,QAAQ,gCAA4B;AACtD,SAASC,iBAAiB,QAAQ,kBAAc;AAiChD,qFAAqF,GACrF,MAAMC,iBAAiB;AAEvB,+DAA+D,GAC/D,MAAMC,iBAAiB;AACvB,kEAAkE,GAClE,MAAMC,WAAW;AAEjB,MAAMC,SAAS,CAACC,QAA+BC,QAAsC,CAAA;QACnFC,IAAI;QACJF;QACAC;IACF,CAAA;AAEA,yDAAyD,GACzD,SAASE,WAAWC,IAAsC;IACxD,OAAO,aACDA,CAAAA,wBAAAA,KAAMC,SAAS,IAAG;QAAEA,WAAWC,OAAOF,KAAKC,SAAS;IAAE,IAAI,CAAC,GAC3DD,CAAAA,wBAAAA,KAAMG,SAAS,IAAG;QAAEA,WAAWD,OAAOF,KAAKG,SAAS;IAAE,IAAI,CAAC,GAC3DH,CAAAA,wBAAAA,KAAMI,MAAM,IAAG;QAAEA,QAAQF,OAAOF,KAAKI,MAAM;IAAE,IAAI,CAAC,GAGlDJ,CAAAA,wBAAAA,KAAMK,MAAM,IAAG;QAAEA,QAAQH,OAAOF,KAAKK,MAAM;IAAE,IAAI,CAAC;AAE1D;AAEA,oFAAoF,GACpF,SAASC,QAAQC,cAAsB,EAAEC,GAAW;IAClD,OAAO,CAAC,IAAI,EAAEpB,WAAW,UAAUqB,MAAM,CAAC,GAAGF,eAAe,CAAC,EAAEC,KAAK,EAAEE,MAAM,CAAC,OAAOC,KAAK,CAAC,GAAG,KAAK;AACpG;AAEA,OAAO,SAASC,8BAA8BC,IAA2B;IACvE,wEAAwE,GACxE,eAAeC,MACbC,OAAiC;YAKZA,gBACCA,iBAEWA,yBAUpBC;QAbb,MAAMC,QAAQf,QAAOa,iBAAAA,QAAQE,KAAK,YAAbF,iBAAiB,IAAIG,IAAI;QAC9C,MAAMC,SAASjB,QAAOa,kBAAAA,QAAQI,MAAM,YAAdJ,kBAAkB,IAAIG,IAAI;QAChD,MAAMlB,OAAOD,WAAWgB,QAAQf,IAAI;QACpC,IAAI,CAACiB,SAAS,CAACE,UAAU,CAACjB,QAAOa,0BAAAA,QAAQR,cAAc,YAAtBQ,0BAA0B,IAAIG,IAAI,IAAI;YACrE,OAAOvB,OAAO,KAAK;QACrB;QACA,IAAI,CAACK,KAAKC,SAAS,IAAI,CAACD,KAAKG,SAAS,IAAI,CAACH,KAAKI,MAAM,IAAI,CAACJ,KAAKK,MAAM,EAAE;YACtE,OAAOV,OAAO,KAAK;QACrB;QACA,MAAMyB,YAAYP,KAAKO,SAAS;QAChC,MAAMC,SAASD,UAAUE,UAAU,CAAC,QAAQC,GAAG,CAACN;QAChD,MAAMD,WAAW,MAAMK,OAAOG,GAAG;QACjC,IAAI,CAACR,SAASS,MAAM,EAAE,OAAO9B,OAAO,KAAK;QACzC,MAAM+B,OAAOV,iBAAAA,SAASW,IAAI,cAAbX,iBAAmB,CAAC;QACjC,IAAI,CAAC5C,iBAAiBsD,KAAKnC,oBAAoB;YAC7C,OAAOI,OAAO,KAAK;QACrB;QACA,OAAO;YACLyB;YACAC;YACArB;YACA4B,WAAWlD,eAAegD,KAAKrD,oBAAoBqD,KAAKP;QAC1D;IACF;IAEA,wEAAwE,GACxE,eAAeU,WACbC,GAAwC,EACxCH,IAA6B;QAE7B,IAAI;YACF,MAAMG,IAAIC,MAAM,CAAC,aACZJ;gBACHK,WAAW3C,WAAW4C,eAAe;gBACrCC,WAAW7C,WAAW4C,eAAe;;YAEvC,OAAO;QACT,EAAE,OAAOpC,OAAO;YACd,IAAI,CAACA,yBAAD,AAACA,MAA8BsC,IAAI,MAAK3C,gBAAgB,OAAO;YACnE,MAAMK;QACR;IACF;IAEA,OAAO;QACL,MAAMuC,aAAYC,OAAoC;YACpD,IAAI,CAACzD,kBAAkByD,QAAQC,IAAI,GAAG,OAAO3C,OAAO,KAAK,CAAC,CAAC,EAAEO,OAAOmC,QAAQC,IAAI,EAAE,oBAAoB,CAAC;YACvG,MAAMC,WAAW,MAAMzB,MAAMuB;YAC7B,IAAI,QAAQE,UAAU,OAAOA;YAC7B,MAAM,EAAEnB,SAAS,EAAEC,MAAM,EAAErB,IAAI,EAAE4B,SAAS,EAAE,GAAGW;YAC/C,MAAMtB,QAAQI,OAAOmB,EAAE;YAEvB,IAAIV;YACJ,IAAIW;YACJ,IAAIJ,QAAQC,IAAI,KAAK,SAAS;oBAYfI,kBAEGL,gBACNA;gBAdV,MAAMK,QAAQL,QAAQK,KAAK;gBAC3B,MAAMlC,MAAMkC,QAAQjE,oBAAoBiE,MAAMC,SAAS,EAAE,QAAQ;gBACjE,IAAI,CAACD,SAAS,CAAClC,KAAK,OAAOb,OAAO,KAAK;gBACvCmC,MAAM7C,4BAA4BmC,WAAWH,OAAOT;gBACpDiC,WAAWtE,8BAA8B;oBACvCyE,WAAWF,MAAME,SAAS,KAAK,YAAY,YAAY;oBACvDC,SAASH,MAAMG,OAAO;oBACtBC,SAAST,QAAQU,IAAI;oBACrBC,MAAMN,MAAMM,IAAI;oBAChBC,IAAIP,MAAMO,EAAE;oBACZN,WAAWD,MAAMC,SAAS;oBAC1BO,SAAS,GAAER,mBAAAA,MAAMQ,SAAS,YAAfR,mBAAmB;oBAC9BS,MAAMd,QAAQc,IAAI;oBAClBC,OAAOlD,QAAOmC,iBAAAA,QAAQe,KAAK,YAAbf,iBAAiB;oBAC/BgB,MAAM,GAAEhB,kBAAAA,QAAQgB,MAAM,YAAdhB,kBAAkB;oBAC1BrC;oBACAmB,QAAQkB,QAAQlB,MAAM;oBACtBS;gBACF;YACF,OAAO;oBACcS,oBAGGA,kBAGPA,eAECA;gBARhB,MAAM7B,MAAMN,QAAOmC,qBAAAA,QAAQiB,SAAS,YAAjBjB,qBAAqB,IAAInB,IAAI;gBAChD,IAAI,CAACV,KAAK,OAAOb,OAAO,KAAK;gBAC7BmC,MAAM9C,eAAeoC,WAAWH,OAAOX,QAAQ+B,QAAQ9B,cAAc,EAAEC;gBACvE,MAAM6C,SAASnD,QAAOmC,mBAAAA,QAAQgB,MAAM,YAAdhB,mBAAkB,IAAInB,IAAI;gBAChDuB,WAAW;oBACTH,MAAMD,QAAQC,IAAI;oBAClBS,MAAM7C,QAAOmC,gBAAAA,QAAQU,IAAI,YAAZV,gBAAgB,IAAI1B,KAAK,CAAC,GAAGjB;oBAC1CyD,MAAMd,QAAQc,IAAI;oBAClBC,OAAOlD,QAAOmC,kBAAAA,QAAQe,KAAK,YAAbf,kBAAiB;mBAC3BgB,SAAS;oBAAEA;gBAAO,IAAI,CAAC,GACxBrD;oBACHmB,QAAQkB,QAAQlB,MAAM;oBACtBS;;YAEJ;YACA,yEAAyE;YACzE,IAAI,AAAC,CAAA,MAAME,IAAIN,GAAG,EAAC,EAAGC,MAAM,EAAE,OAAO;gBAAE3B,IAAI;gBAAM0C,IAAIV,IAAIU,EAAE;gBAAEe,SAAS;YAAM;YAC5E,IAAI,CAAC/E,sBAAsB,MAAMM,4BAA4BuC,QAAQrB,QAAQ;gBAC3E,OAAOL,OAAO,KAAKrB;YACrB;YACA,MAAMkF,UAAU,aAAKf;gBAAUlC,gBAAgB8B,QAAQ9B,cAAc;;YACrE,MAAMgD,UACJlB,QAAQC,IAAI,KAAK,UACb,AAAC,MAAMvD,uBAAuB+C,KAAK0B,aAAc,YACjD,MAAM3B,WAAWC,KAAK0B;YAC5B,OAAO;gBAAE1D,IAAI;gBAAM0C,IAAIV,IAAIU,EAAE;gBAAEe;YAAQ;QACzC;QAEA,MAAME,YAAWpB,OAAgC;gBAC1BA,gBACFA,oBAQEA,gBACMA,sBAWJA;YArBvB,MAAMqB,QAAQxD,QAAOmC,iBAAAA,QAAQqB,KAAK,YAAbrB,iBAAiB,IAAIsB,OAAO,CAAC,QAAQ,KAAKzC,IAAI,GAAGP,KAAK,CAAC,GAAGlB;YAC/E,MAAMe,MAAMN,QAAOmC,qBAAAA,QAAQiB,SAAS,YAAjBjB,qBAAqB,IAAInB,IAAI;YAChD,IAAI,CAACwC,SAAS,CAAClD,KAAK,OAAOb,OAAO,KAAK;YACvC,IAAI,CAACd,cAAcwD,QAAQC,IAAI,GAAG,OAAO3C,OAAO,KAAK,CAAC,CAAC,EAAEO,OAAOmC,QAAQC,IAAI,EAAE,eAAe,CAAC;YAC9F,IAAI,CAACsB,OAAOC,QAAQ,CAACxB,QAAQyB,OAAO,GAAG,OAAOnE,OAAO,KAAK;YAC1D,MAAM4C,WAAW,MAAMzB,MAAMuB;YAC7B,IAAI,QAAQE,UAAU,OAAOA;YAC7B,MAAM,EAAEnB,SAAS,EAAEC,MAAM,EAAErB,IAAI,EAAE4B,SAAS,EAAE,GAAGW;YAC/C,MAAMT,MAAMT,OAAOC,UAAU,CAAC/C,gBAAgBwF,KAAK,EAAExC,GAAG,CAACjB,QAAQ+B,QAAQ9B,cAAc,EAAEC;YACzF,MAAMwD,QAAQ9D,QAAOmC,iBAAAA,QAAQ2B,KAAK,YAAb3B,iBAAiB,IAAInB,IAAI,GAAGP,KAAK,CAAC,GAAGjB;YAC1D,MAAMuE,cAAc/D,QAAOmC,uBAAAA,QAAQ4B,WAAW,YAAnB5B,uBAAuB,IAAInB,IAAI;YAC1D,MAAMgD,OAAgB;gBACpBR;eACIM,QAAQ;gBAAEA;YAAM,IAAI,CAAC;gBACzB1B,MAAMD,QAAQC,IAAI;gBAClB6B,UAAU;gBACVvE,QAAQ;gBACRkE,SAASzB,QAAQyB,OAAO;gBACxB,8DAA8D;gBAC9DM,YAAYzF,yBAAyB;oBAAEmF,SAASzB,QAAQyB,OAAO;oBAAEO,UAAU;gBAAK;eAC5EJ,cAAc;gBAAEA;YAAY,IAAI,CAAC;gBACrCK,cAAcpE,QAAOmC,wBAAAA,QAAQiC,YAAY,YAApBjC,wBAAwB;gBAC7C9B,gBAAgB8B,QAAQ9B,cAAc;eACnCP;gBACHmB,QAAQkB,QAAQlB,MAAM;gBACtBS;;YAEF,MAAM2B,UAAU,MAAM1B,WAAWC,KAAKoC;YACtC,IAAIX,SAAS;gBACX,uEAAuE;gBACvE,2DAA2D;gBAC3D,MAAMpE,uBAAuBiC,WAAWC,OAAOmB,EAAE,EAAE;oBAACxC;iBAAK,EAAEuE,KAAK,CAAC,CAAC1E;oBAChE2E,QAAQ3E,KAAK,CAAC,+CAA+CwB,OAAOmB,EAAE,EAAE3C;gBAC1E;YACF;YACA,OAAO;gBAAEC,IAAI;gBAAM0C,IAAIV,IAAIU,EAAE;gBAAEe;YAAQ;QACzC;IACF;AACF;AAEA,4DAA4D,GAC5D,OAAO,SAASkB;IACd,OAAO;QAAErD,WAAW,IAAMlC,cAAcwF,GAAG,GAAGtD,SAAS;IAAG;AAC5D;AAEA,6EAA6E,GAC7E,OAAO,SAASuD,gCACd9D,OAA8B4D,8BAA8B;IAE5DvG,mCAAmC0C,8BAA8BC,OAAO;QAAE+D,UAAUtF;IAAU;AAChG"}
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/record-timeline.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  registerPluginRecordTimelineWriter,\n  type PluginRecordActivityRequest,\n  type PluginRecordDeliveryRequest,\n  type PluginRecordEntryContext,\n  type PluginRecordTaskRequest,\n  type PluginRecordTimelineWriter,\n  type PluginRecordWrite,\n} from '@aglyn/aglyn/plugin-manager/plugin-record-timeline'\nimport {\n  buildCrmCapturedEmailActivity,\n  checkEntitlement,\n  consentGroupForHost,\n  CRM_ACTIVITY_LOG_FULL_MESSAGE,\n  CRM_COLLECTIONS,\n  crmActivityLogHasRoom,\n  crmCapturedEmailKey,\n  crmScopeTokens,\n  crmTaskReminderAfterEdit,\n  isCrmActivityKind,\n  isCrmTaskKind,\n  type CrmActivity,\n  type CrmActivityLink,\n  type CrmTask,\n} from '@aglyn/aglyn/server'\nimport {\n  countCrmActivitiesForRecord,\n  createCrmEmailActivity,\n  crmActivityRef,\n  crmCapturedEmailActivityRef,\n  firebaseAdmin,\n  recomputeCrmNextTaskAt,\n  recordCrmEmailDelivery,\n} from '@aglyn/tenant-data-admin'\nimport { createHash } from 'crypto'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { BUNDLE_ID } from '../constants/bundle-common'\nimport { CRM_SUITE_FEATURE } from './suite-gate'\n\n/**\n * THE CRM'S WRITER ON THE CORE'S RECORD-TIMELINE SEAM (AGL-2981).\n *\n * Another plugin files an activity or a task on a contact, company or deal —\n * an email a sequence sent, the reply it read, the call it asks for — and\n * this writes it as the CRM writes its own:\n *\n *  1. the workspace's plan carries the CRM (`features.crm`), as at every\n *     CRM door; a Free workspace keeps no records to file on;\n *  2. the entry carries the scope a record made on that site carries\n *     (`crmScopeTokens`), so exactly the people who see the record see it;\n *  3. an EMAIL is filed under the id the capture address files a copy of the\n *     same message by (`cap_` + the digest of its `Message-ID`), and written\n *     with `create()`: the send, a copy the rep forwarded to the capture\n *     address, and a second run of the caller are one row;\n *  4. anything else — a note, a task — is filed under the caller's own key,\n *     hashed with the caller's plugin id, and written once the same way;\n *  5. a record at its activity ceiling is refused with the sentence every\n *     CRM writer answers with, before anything is written;\n *  6. a bounce or a complaint on a filed email (AGL-3245) advances that\n *     email's own delivery state — the row the send was filed under, found\n *     by its `Message-ID` — exactly as the campaign webhook advances one,\n *     so the timeline reads Sent, then Bounced, with what the server said.\n *\n * Each entry names the plugin that filed it (`sourcePluginId`), and a task's\n * `nextTaskAtMs` is recomputed on the records it names, as every server\n * writer of a task does.\n */\n\ntype Firestore = FirebaseFirestore.Firestore\n\nexport interface CrmRecordTimelineDeps {\n  firestore(): Firestore\n}\n\n/** gRPC `ALREADY_EXISTS`, which `create()` rejects with when the document is there. */\nconst ALREADY_EXISTS = 6\n\n/** The longest task title the CRM keeps, as its own forms do. */\nconst TASK_TITLE_MAX = 200\n/** The longest note body or task note an entry filed here keeps. */\nconst NOTE_MAX = 2_000\n\nconst refuse = (status: 400 | 403 | 404 | 409, error: string): PluginRecordWrite => ({\n  ok: false,\n  status,\n  error,\n})\n\n/** The record fields of a link, only the ones it names. */\nfunction linkFields(link: PluginRecordEntryContext['link']): CrmActivityLink {\n  return {\n    ...(link?.contactId ? { contactId: String(link.contactId) } : {}),\n    ...(link?.companyId ? { companyId: String(link.companyId) } : {}),\n    ...(link?.dealId ? { dealId: String(link.dealId) } : {}),\n    // A lead (AGL-3234): host-scoped by path, so the entry carries the\n    // site's scope like any record created from that site.\n    ...(link?.leadId ? { leadId: String(link.leadId) } : {}),\n  }\n}\n\n/** The document id a caller's key files under: its own namespace, never a raw key. */\nfunction keyedId(sourcePluginId: string, key: string): string {\n  return `plg_${createHash('sha256').update(`${sourcePluginId}:${key}`).digest('hex').slice(0, 28)}`\n}\n\nexport function createCrmRecordTimelineWriter(deps: CrmRecordTimelineDeps): PluginRecordTimelineWriter {\n  /** The org, its plan, the link and the scope an entry is stamped with. */\n  async function admit(\n    context: PluginRecordEntryContext,\n  ): Promise<\n    | PluginRecordWrite\n    | { firestore: Firestore; orgRef: FirebaseFirestore.DocumentReference; link: CrmActivityLink; visibleTo: string[] }\n  > {\n    const orgId = String(context.orgId ?? '').trim()\n    const hostId = String(context.hostId ?? '').trim()\n    const link = linkFields(context.link)\n    if (!orgId || !hostId || !String(context.sourcePluginId ?? '').trim()) {\n      return refuse(400, 'An entry names its organization, its site and the plugin filing it.')\n    }\n    if (!link.contactId && !link.companyId && !link.dealId && !link.leadId) {\n      return refuse(400, 'An entry is filed on a contact, a company, a deal or a lead.')\n    }\n    const firestore = deps.firestore()\n    const orgRef = firestore.collection('orgs').doc(orgId)\n    const snapshot = await orgRef.get()\n    if (!snapshot.exists) return refuse(404, 'That organization no longer exists.')\n    const org = (snapshot.data() ?? {}) as Record<string, unknown>\n    if (!checkEntitlement(org, CRM_SUITE_FEATURE)) {\n      return refuse(403, \"This workspace's plan doesn't include the CRM.\")\n    }\n    return {\n      firestore,\n      orgRef,\n      link,\n      visibleTo: crmScopeTokens(org, consentGroupForHost(org, hostId)),\n    }\n  }\n\n  /** Creates a keyed entry once: `created: false` for one already filed. */\n  async function createOnce(\n    ref: FirebaseFirestore.DocumentReference,\n    data: Record<string, unknown>,\n  ): Promise<boolean> {\n    try {\n      await ref.create({\n        ...data,\n        createdAt: FieldValue.serverTimestamp(),\n        updatedAt: FieldValue.serverTimestamp(),\n      })\n      return true\n    } catch (error) {\n      if ((error as { code?: unknown })?.code === ALREADY_EXISTS) return false\n      throw error\n    }\n  }\n\n  return {\n    async logActivity(request: PluginRecordActivityRequest): Promise<PluginRecordWrite> {\n      if (!isCrmActivityKind(request.kind)) return refuse(400, `\"${String(request.kind)}\" isn't an activity.`)\n      const admitted = await admit(request)\n      if ('ok' in admitted) return admitted\n      const { firestore, orgRef, link, visibleTo } = admitted\n      const orgId = orgRef.id\n\n      let ref: FirebaseFirestore.DocumentReference\n      let activity: CrmActivity\n      if (request.kind === 'email') {\n        const email = request.email\n        const key = email ? crmCapturedEmailKey(email.messageId, null) : null\n        if (!email || !key) return refuse(400, 'An email is filed by its Message-ID.')\n        ref = crmCapturedEmailActivityRef(firestore, orgId, key)\n        activity = buildCrmCapturedEmailActivity({\n          direction: email.direction === 'inbound' ? 'inbound' : 'outbound',\n          subject: email.subject,\n          excerpt: request.body,\n          from: email.from,\n          to: email.to,\n          messageId: email.messageId,\n          inReplyTo: email.inReplyTo ?? null,\n          atMs: request.atMs,\n          byUid: String(request.byUid ?? ''),\n          byName: request.byName ?? null,\n          link,\n          hostId: request.hostId,\n          visibleTo,\n        })\n      } else {\n        const key = String(request.dedupeKey ?? '').trim()\n        if (!key) return refuse(400, 'An entry that is not an email names its own key.')\n        ref = crmActivityRef(firestore, orgId, keyedId(request.sourcePluginId, key))\n        const byName = String(request.byName ?? '').trim()\n        activity = {\n          kind: request.kind,\n          body: String(request.body ?? '').slice(0, NOTE_MAX),\n          atMs: request.atMs,\n          byUid: String(request.byUid ?? ''),\n          ...(byName ? { byName } : {}),\n          ...link,\n          hostId: request.hostId,\n          visibleTo,\n        }\n      }\n      // Filed before: answered off the one read, ahead of the ceiling's count.\n      if ((await ref.get()).exists) return { ok: true, id: ref.id, created: false }\n      if (!crmActivityLogHasRoom(await countCrmActivitiesForRecord(orgRef, link))) {\n        return refuse(409, CRM_ACTIVITY_LOG_FULL_MESSAGE)\n      }\n      const stamped = { ...activity, sourcePluginId: request.sourcePluginId }\n      const created =\n        request.kind === 'email'\n          ? (await createCrmEmailActivity(ref, stamped)) === 'created'\n          : await createOnce(ref, stamped as unknown as Record<string, unknown>)\n      return { ok: true, id: ref.id, created }\n    },\n\n    async createTask(request: PluginRecordTaskRequest): Promise<PluginRecordWrite> {\n      const title = String(request.title ?? '').replace(/\\s+/g, ' ').trim().slice(0, TASK_TITLE_MAX)\n      const key = String(request.dedupeKey ?? '').trim()\n      if (!title || !key) return refuse(400, 'A task has a title and the caller’s own key.')\n      if (!isCrmTaskKind(request.kind)) return refuse(400, `\"${String(request.kind)}\" isn't a task.`)\n      if (!Number.isFinite(request.dueAtMs)) return refuse(400, 'A task has a due time.')\n      const admitted = await admit(request)\n      if ('ok' in admitted) return admitted\n      const { firestore, orgRef, link, visibleTo } = admitted\n      const ref = orgRef.collection(CRM_COLLECTIONS.tasks).doc(keyedId(request.sourcePluginId, key))\n      const notes = String(request.notes ?? '').trim().slice(0, NOTE_MAX)\n      const assigneeUid = String(request.assigneeUid ?? '').trim()\n      const task: CrmTask = {\n        title,\n        ...(notes ? { notes } : {}),\n        kind: request.kind,\n        priority: 'normal',\n        status: 'open',\n        dueAtMs: request.dueAtMs,\n        // The reminder a person's task gets (AGL-2659): the due time.\n        remindAtMs: crmTaskReminderAfterEdit({ dueAtMs: request.dueAtMs, previous: null }),\n        ...(assigneeUid ? { assigneeUid } : {}),\n        createdByUid: String(request.createdByUid ?? ''),\n        sourcePluginId: request.sourcePluginId,\n        ...link,\n        hostId: request.hostId,\n        visibleTo,\n      }\n      const created = await createOnce(ref, task as unknown as Record<string, unknown>)\n      if (created) {\n        // The records the task names carry `nextTaskAtMs` (AGL-2661); a figure\n        // that could not move is the Fields section's recompute's.\n        await recomputeCrmNextTaskAt(firestore, orgRef.id, [link]).catch((error: unknown) => {\n          console.error('[crm] next activity could not be recomputed', orgRef.id, error)\n        })\n      }\n      return { ok: true, id: ref.id, created }\n    },\n\n    async recordEmailDelivery(request: PluginRecordDeliveryRequest): Promise<PluginRecordWrite> {\n      const orgId = String(request.orgId ?? '').trim()\n      const key = crmCapturedEmailKey(request.messageId, null)\n      if (!orgId || !key) return refuse(400, 'A delivery names its organization and the email’s Message-ID.')\n      if (request.state !== 'bounced' && request.state !== 'complained') {\n        return refuse(400, `\"${String(request.state)}\" isn't a delivery failure.`)\n      }\n      const firestore = deps.firestore()\n      const ref = crmCapturedEmailActivityRef(firestore, orgId, key)\n      const outcome = await recordCrmEmailDelivery(firestore, {\n        orgId,\n        activityId: ref.id,\n        state: request.state,\n        atMs: request.atMs,\n        detail: request.detail ?? null,\n      })\n      if (outcome === 'missing') return refuse(404, 'No email by that Message-ID is filed here.')\n      if (outcome === 'failed') return refuse(409, 'The delivery state could not be written.')\n      return { ok: true, id: ref.id, created: outcome === 'advanced' }\n    },\n  }\n}\n\n/** The platform's own dependencies. Specs build their own. */\nexport function defaultCrmRecordTimelineDeps(): CrmRecordTimelineDeps {\n  return { firestore: () => firebaseAdmin.app().firestore() }\n}\n\n/** Registers the CRM as the workspace's record system on the timeline seam. */\nexport function registerCrmRecordTimelineWriter(\n  deps: CrmRecordTimelineDeps = defaultCrmRecordTimelineDeps(),\n): void {\n  registerPluginRecordTimelineWriter(createCrmRecordTimelineWriter(deps), { pluginId: BUNDLE_ID })\n}\n"],"names":["registerPluginRecordTimelineWriter","buildCrmCapturedEmailActivity","checkEntitlement","consentGroupForHost","CRM_ACTIVITY_LOG_FULL_MESSAGE","CRM_COLLECTIONS","crmActivityLogHasRoom","crmCapturedEmailKey","crmScopeTokens","crmTaskReminderAfterEdit","isCrmActivityKind","isCrmTaskKind","countCrmActivitiesForRecord","createCrmEmailActivity","crmActivityRef","crmCapturedEmailActivityRef","firebaseAdmin","recomputeCrmNextTaskAt","recordCrmEmailDelivery","createHash","FieldValue","BUNDLE_ID","CRM_SUITE_FEATURE","ALREADY_EXISTS","TASK_TITLE_MAX","NOTE_MAX","refuse","status","error","ok","linkFields","link","contactId","String","companyId","dealId","leadId","keyedId","sourcePluginId","key","update","digest","slice","createCrmRecordTimelineWriter","deps","admit","context","snapshot","orgId","trim","hostId","firestore","orgRef","collection","doc","get","exists","org","data","visibleTo","createOnce","ref","create","createdAt","serverTimestamp","updatedAt","code","logActivity","request","kind","admitted","id","activity","email","messageId","direction","subject","excerpt","body","from","to","inReplyTo","atMs","byUid","byName","dedupeKey","created","stamped","createTask","title","replace","Number","isFinite","dueAtMs","tasks","notes","assigneeUid","task","priority","remindAtMs","previous","createdByUid","catch","console","recordEmailDelivery","state","outcome","activityId","detail","defaultCrmRecordTimelineDeps","app","registerCrmRecordTimelineWriter","pluginId"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,kCAAkC,QAO7B,qDAAoD;AAC3D,SACEC,6BAA6B,EAC7BC,gBAAgB,EAChBC,mBAAmB,EACnBC,6BAA6B,EAC7BC,eAAe,EACfC,qBAAqB,EACrBC,mBAAmB,EACnBC,cAAc,EACdC,wBAAwB,EACxBC,iBAAiB,EACjBC,aAAa,QAIR,sBAAqB;AAC5B,SACEC,2BAA2B,EAC3BC,sBAAsB,EACtBC,cAAc,EACdC,2BAA2B,EAC3BC,aAAa,EACbC,sBAAsB,EACtBC,sBAAsB,QACjB,2BAA0B;AACjC,SAASC,UAAU,QAAQ,SAAQ;AACnC,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,SAAS,QAAQ,gCAA4B;AACtD,SAASC,iBAAiB,QAAQ,kBAAc;AAqChD,qFAAqF,GACrF,MAAMC,iBAAiB;AAEvB,+DAA+D,GAC/D,MAAMC,iBAAiB;AACvB,kEAAkE,GAClE,MAAMC,WAAW;AAEjB,MAAMC,SAAS,CAACC,QAA+BC,QAAsC,CAAA;QACnFC,IAAI;QACJF;QACAC;IACF,CAAA;AAEA,yDAAyD,GACzD,SAASE,WAAWC,IAAsC;IACxD,OAAO,aACDA,CAAAA,wBAAAA,KAAMC,SAAS,IAAG;QAAEA,WAAWC,OAAOF,KAAKC,SAAS;IAAE,IAAI,CAAC,GAC3DD,CAAAA,wBAAAA,KAAMG,SAAS,IAAG;QAAEA,WAAWD,OAAOF,KAAKG,SAAS;IAAE,IAAI,CAAC,GAC3DH,CAAAA,wBAAAA,KAAMI,MAAM,IAAG;QAAEA,QAAQF,OAAOF,KAAKI,MAAM;IAAE,IAAI,CAAC,GAGlDJ,CAAAA,wBAAAA,KAAMK,MAAM,IAAG;QAAEA,QAAQH,OAAOF,KAAKK,MAAM;IAAE,IAAI,CAAC;AAE1D;AAEA,oFAAoF,GACpF,SAASC,QAAQC,cAAsB,EAAEC,GAAW;IAClD,OAAO,CAAC,IAAI,EAAEpB,WAAW,UAAUqB,MAAM,CAAC,GAAGF,eAAe,CAAC,EAAEC,KAAK,EAAEE,MAAM,CAAC,OAAOC,KAAK,CAAC,GAAG,KAAK;AACpG;AAEA,OAAO,SAASC,8BAA8BC,IAA2B;IACvE,wEAAwE,GACxE,eAAeC,MACbC,OAAiC;YAKZA,gBACCA,iBAEWA,yBAUpBC;QAbb,MAAMC,QAAQf,QAAOa,iBAAAA,QAAQE,KAAK,YAAbF,iBAAiB,IAAIG,IAAI;QAC9C,MAAMC,SAASjB,QAAOa,kBAAAA,QAAQI,MAAM,YAAdJ,kBAAkB,IAAIG,IAAI;QAChD,MAAMlB,OAAOD,WAAWgB,QAAQf,IAAI;QACpC,IAAI,CAACiB,SAAS,CAACE,UAAU,CAACjB,QAAOa,0BAAAA,QAAQR,cAAc,YAAtBQ,0BAA0B,IAAIG,IAAI,IAAI;YACrE,OAAOvB,OAAO,KAAK;QACrB;QACA,IAAI,CAACK,KAAKC,SAAS,IAAI,CAACD,KAAKG,SAAS,IAAI,CAACH,KAAKI,MAAM,IAAI,CAACJ,KAAKK,MAAM,EAAE;YACtE,OAAOV,OAAO,KAAK;QACrB;QACA,MAAMyB,YAAYP,KAAKO,SAAS;QAChC,MAAMC,SAASD,UAAUE,UAAU,CAAC,QAAQC,GAAG,CAACN;QAChD,MAAMD,WAAW,MAAMK,OAAOG,GAAG;QACjC,IAAI,CAACR,SAASS,MAAM,EAAE,OAAO9B,OAAO,KAAK;QACzC,MAAM+B,OAAOV,iBAAAA,SAASW,IAAI,cAAbX,iBAAmB,CAAC;QACjC,IAAI,CAAC7C,iBAAiBuD,KAAKnC,oBAAoB;YAC7C,OAAOI,OAAO,KAAK;QACrB;QACA,OAAO;YACLyB;YACAC;YACArB;YACA4B,WAAWnD,eAAeiD,KAAKtD,oBAAoBsD,KAAKP;QAC1D;IACF;IAEA,wEAAwE,GACxE,eAAeU,WACbC,GAAwC,EACxCH,IAA6B;QAE7B,IAAI;YACF,MAAMG,IAAIC,MAAM,CAAC,aACZJ;gBACHK,WAAW3C,WAAW4C,eAAe;gBACrCC,WAAW7C,WAAW4C,eAAe;;YAEvC,OAAO;QACT,EAAE,OAAOpC,OAAO;YACd,IAAI,CAACA,yBAAD,AAACA,MAA8BsC,IAAI,MAAK3C,gBAAgB,OAAO;YACnE,MAAMK;QACR;IACF;IAEA,OAAO;QACL,MAAMuC,aAAYC,OAAoC;YACpD,IAAI,CAAC1D,kBAAkB0D,QAAQC,IAAI,GAAG,OAAO3C,OAAO,KAAK,CAAC,CAAC,EAAEO,OAAOmC,QAAQC,IAAI,EAAE,oBAAoB,CAAC;YACvG,MAAMC,WAAW,MAAMzB,MAAMuB;YAC7B,IAAI,QAAQE,UAAU,OAAOA;YAC7B,MAAM,EAAEnB,SAAS,EAAEC,MAAM,EAAErB,IAAI,EAAE4B,SAAS,EAAE,GAAGW;YAC/C,MAAMtB,QAAQI,OAAOmB,EAAE;YAEvB,IAAIV;YACJ,IAAIW;YACJ,IAAIJ,QAAQC,IAAI,KAAK,SAAS;oBAYfI,kBAEGL,gBACNA;gBAdV,MAAMK,QAAQL,QAAQK,KAAK;gBAC3B,MAAMlC,MAAMkC,QAAQlE,oBAAoBkE,MAAMC,SAAS,EAAE,QAAQ;gBACjE,IAAI,CAACD,SAAS,CAAClC,KAAK,OAAOb,OAAO,KAAK;gBACvCmC,MAAM9C,4BAA4BoC,WAAWH,OAAOT;gBACpDiC,WAAWvE,8BAA8B;oBACvC0E,WAAWF,MAAME,SAAS,KAAK,YAAY,YAAY;oBACvDC,SAASH,MAAMG,OAAO;oBACtBC,SAAST,QAAQU,IAAI;oBACrBC,MAAMN,MAAMM,IAAI;oBAChBC,IAAIP,MAAMO,EAAE;oBACZN,WAAWD,MAAMC,SAAS;oBAC1BO,SAAS,GAAER,mBAAAA,MAAMQ,SAAS,YAAfR,mBAAmB;oBAC9BS,MAAMd,QAAQc,IAAI;oBAClBC,OAAOlD,QAAOmC,iBAAAA,QAAQe,KAAK,YAAbf,iBAAiB;oBAC/BgB,MAAM,GAAEhB,kBAAAA,QAAQgB,MAAM,YAAdhB,kBAAkB;oBAC1BrC;oBACAmB,QAAQkB,QAAQlB,MAAM;oBACtBS;gBACF;YACF,OAAO;oBACcS,oBAGGA,kBAGPA,eAECA;gBARhB,MAAM7B,MAAMN,QAAOmC,qBAAAA,QAAQiB,SAAS,YAAjBjB,qBAAqB,IAAInB,IAAI;gBAChD,IAAI,CAACV,KAAK,OAAOb,OAAO,KAAK;gBAC7BmC,MAAM/C,eAAeqC,WAAWH,OAAOX,QAAQ+B,QAAQ9B,cAAc,EAAEC;gBACvE,MAAM6C,SAASnD,QAAOmC,mBAAAA,QAAQgB,MAAM,YAAdhB,mBAAkB,IAAInB,IAAI;gBAChDuB,WAAW;oBACTH,MAAMD,QAAQC,IAAI;oBAClBS,MAAM7C,QAAOmC,gBAAAA,QAAQU,IAAI,YAAZV,gBAAgB,IAAI1B,KAAK,CAAC,GAAGjB;oBAC1CyD,MAAMd,QAAQc,IAAI;oBAClBC,OAAOlD,QAAOmC,kBAAAA,QAAQe,KAAK,YAAbf,kBAAiB;mBAC3BgB,SAAS;oBAAEA;gBAAO,IAAI,CAAC,GACxBrD;oBACHmB,QAAQkB,QAAQlB,MAAM;oBACtBS;;YAEJ;YACA,yEAAyE;YACzE,IAAI,AAAC,CAAA,MAAME,IAAIN,GAAG,EAAC,EAAGC,MAAM,EAAE,OAAO;gBAAE3B,IAAI;gBAAM0C,IAAIV,IAAIU,EAAE;gBAAEe,SAAS;YAAM;YAC5E,IAAI,CAAChF,sBAAsB,MAAMM,4BAA4BwC,QAAQrB,QAAQ;gBAC3E,OAAOL,OAAO,KAAKtB;YACrB;YACA,MAAMmF,UAAU,aAAKf;gBAAUlC,gBAAgB8B,QAAQ9B,cAAc;;YACrE,MAAMgD,UACJlB,QAAQC,IAAI,KAAK,UACb,AAAC,MAAMxD,uBAAuBgD,KAAK0B,aAAc,YACjD,MAAM3B,WAAWC,KAAK0B;YAC5B,OAAO;gBAAE1D,IAAI;gBAAM0C,IAAIV,IAAIU,EAAE;gBAAEe;YAAQ;QACzC;QAEA,MAAME,YAAWpB,OAAgC;gBAC1BA,gBACFA,oBAQEA,gBACMA,sBAWJA;YArBvB,MAAMqB,QAAQxD,QAAOmC,iBAAAA,QAAQqB,KAAK,YAAbrB,iBAAiB,IAAIsB,OAAO,CAAC,QAAQ,KAAKzC,IAAI,GAAGP,KAAK,CAAC,GAAGlB;YAC/E,MAAMe,MAAMN,QAAOmC,qBAAAA,QAAQiB,SAAS,YAAjBjB,qBAAqB,IAAInB,IAAI;YAChD,IAAI,CAACwC,SAAS,CAAClD,KAAK,OAAOb,OAAO,KAAK;YACvC,IAAI,CAACf,cAAcyD,QAAQC,IAAI,GAAG,OAAO3C,OAAO,KAAK,CAAC,CAAC,EAAEO,OAAOmC,QAAQC,IAAI,EAAE,eAAe,CAAC;YAC9F,IAAI,CAACsB,OAAOC,QAAQ,CAACxB,QAAQyB,OAAO,GAAG,OAAOnE,OAAO,KAAK;YAC1D,MAAM4C,WAAW,MAAMzB,MAAMuB;YAC7B,IAAI,QAAQE,UAAU,OAAOA;YAC7B,MAAM,EAAEnB,SAAS,EAAEC,MAAM,EAAErB,IAAI,EAAE4B,SAAS,EAAE,GAAGW;YAC/C,MAAMT,MAAMT,OAAOC,UAAU,CAAChD,gBAAgByF,KAAK,EAAExC,GAAG,CAACjB,QAAQ+B,QAAQ9B,cAAc,EAAEC;YACzF,MAAMwD,QAAQ9D,QAAOmC,iBAAAA,QAAQ2B,KAAK,YAAb3B,iBAAiB,IAAInB,IAAI,GAAGP,KAAK,CAAC,GAAGjB;YAC1D,MAAMuE,cAAc/D,QAAOmC,uBAAAA,QAAQ4B,WAAW,YAAnB5B,uBAAuB,IAAInB,IAAI;YAC1D,MAAMgD,OAAgB;gBACpBR;eACIM,QAAQ;gBAAEA;YAAM,IAAI,CAAC;gBACzB1B,MAAMD,QAAQC,IAAI;gBAClB6B,UAAU;gBACVvE,QAAQ;gBACRkE,SAASzB,QAAQyB,OAAO;gBACxB,8DAA8D;gBAC9DM,YAAY1F,yBAAyB;oBAAEoF,SAASzB,QAAQyB,OAAO;oBAAEO,UAAU;gBAAK;eAC5EJ,cAAc;gBAAEA;YAAY,IAAI,CAAC;gBACrCK,cAAcpE,QAAOmC,wBAAAA,QAAQiC,YAAY,YAApBjC,wBAAwB;gBAC7C9B,gBAAgB8B,QAAQ9B,cAAc;eACnCP;gBACHmB,QAAQkB,QAAQlB,MAAM;gBACtBS;;YAEF,MAAM2B,UAAU,MAAM1B,WAAWC,KAAKoC;YACtC,IAAIX,SAAS;gBACX,uEAAuE;gBACvE,2DAA2D;gBAC3D,MAAMrE,uBAAuBkC,WAAWC,OAAOmB,EAAE,EAAE;oBAACxC;iBAAK,EAAEuE,KAAK,CAAC,CAAC1E;oBAChE2E,QAAQ3E,KAAK,CAAC,+CAA+CwB,OAAOmB,EAAE,EAAE3C;gBAC1E;YACF;YACA,OAAO;gBAAEC,IAAI;gBAAM0C,IAAIV,IAAIU,EAAE;gBAAEe;YAAQ;QACzC;QAEA,MAAMkB,qBAAoBpC,OAAoC;gBACvCA,gBAaXA;YAbV,MAAMpB,QAAQf,QAAOmC,iBAAAA,QAAQpB,KAAK,YAAboB,iBAAiB,IAAInB,IAAI;YAC9C,MAAMV,MAAMhC,oBAAoB6D,QAAQM,SAAS,EAAE;YACnD,IAAI,CAAC1B,SAAS,CAACT,KAAK,OAAOb,OAAO,KAAK;YACvC,IAAI0C,QAAQqC,KAAK,KAAK,aAAarC,QAAQqC,KAAK,KAAK,cAAc;gBACjE,OAAO/E,OAAO,KAAK,CAAC,CAAC,EAAEO,OAAOmC,QAAQqC,KAAK,EAAE,2BAA2B,CAAC;YAC3E;YACA,MAAMtD,YAAYP,KAAKO,SAAS;YAChC,MAAMU,MAAM9C,4BAA4BoC,WAAWH,OAAOT;YAC1D,MAAMmE,UAAU,MAAMxF,uBAAuBiC,WAAW;gBACtDH;gBACA2D,YAAY9C,IAAIU,EAAE;gBAClBkC,OAAOrC,QAAQqC,KAAK;gBACpBvB,MAAMd,QAAQc,IAAI;gBAClB0B,MAAM,GAAExC,kBAAAA,QAAQwC,MAAM,YAAdxC,kBAAkB;YAC5B;YACA,IAAIsC,YAAY,WAAW,OAAOhF,OAAO,KAAK;YAC9C,IAAIgF,YAAY,UAAU,OAAOhF,OAAO,KAAK;YAC7C,OAAO;gBAAEG,IAAI;gBAAM0C,IAAIV,IAAIU,EAAE;gBAAEe,SAASoB,YAAY;YAAW;QACjE;IACF;AACF;AAEA,4DAA4D,GAC5D,OAAO,SAASG;IACd,OAAO;QAAE1D,WAAW,IAAMnC,cAAc8F,GAAG,GAAG3D,SAAS;IAAG;AAC5D;AAEA,6EAA6E,GAC7E,OAAO,SAAS4D,gCACdnE,OAA8BiE,8BAA8B;IAE5D7G,mCAAmC2C,8BAA8BC,OAAO;QAAEoE,UAAU3F;IAAU;AAChG"}

package/src/lib/server.js

@@ -59,6 +59,7 @@ import { BUNDLE_ID } from "./constants/bundle-common.js";
 import { CRM_NEXT_ACTIVITY_ROUTE } from "./model/next-activity.js";
 import { CRM_TASK_ROUTES } from "./model/task-routes.js";
 import { crmNextActivityHandler } from "./server/next-activity-routes.js";
+import { registerCrmRecordEmailStateWriter } from "./server/record-email-state.js";
 import { registerCrmRecordTimelineWriter } from "./server/record-timeline.js";
 import { crmTaskCompleteHandler, crmTaskSaveHandler } from "./server/task-routes.js";
 import { crmCompaniesImportHandler } from "./server/companies-import.js";
@@ -620,6 +621,10 @@ import { CRM_RECIPE_INSTALL_ROUTE, CRM_RECIPE_STATUS_ROUTE, crmRecipeInstallHand
     // seam (AGL-2981): another plugin files an email, a reply or a task on a
     // record through it, under the CRM's own scope, dedupe and ceiling.
     registerCrmRecordTimelineWriter();
+    // And on the record email-state seam (AGL-3245): a sender that filed a
+    // verdict on an address — a bounce, a complaint, an unsubscribe, a
+    // do-not-contact mark — stamps the lead and the contact through it.
+    registerCrmRecordEmailStateWriter();
 }
 
 //# sourceMappingURL=server.js.map

package/src/lib/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/plugins/crm/src/lib/server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The Contacts plugin's SERVER half (AGL-2595).\n *\n * Contacts CRM v1 had none: every console write was client-direct against\n * the Firestore rules, and the one server path that creates a contact —\n * `upsertHostContact` — belongs to the capture doors, not to this plugin.\n * v2 needs a server for the things a browser must not do alone: an import\n * that dedupes forty thousand rows, a bulk action over a selection, an\n * auto-association of contacts to companies by domain. Each of those lands\n * as a `crm/<route>` handler registered here.\n *\n * `crm/ping` exists so the wiring is PROVEN rather than assumed:\n * `plugins.config.json` names this module's register function and the\n * `crm` API prefix, the generated server manifest loads this file, and the\n * console's `/api/[...pluginApi]` dispatcher reaches the handler. A plugin\n * whose first real route also had to be its first wiring test would have\n * two things to debug at once.\n *\n * The real routes are the writes with a side effect outside the document:\n * `crm/contact-stage` (AGL-2605) exists for the EVENT — `contactStageChanged`\n * can only be emitted by a server path that performed the write, so a record\n * page that moved the stage client-direct would move the person and tell no\n * automation; the task routes (AGL-2599) carry an assignee's notification and\n * the `taskCompleted` event; `crm/contacts-import` (AGL-2602) pushes one chunk\n * of a file through the same capture door every other server door uses.\n * `crm/deal-stage` (AGL-2598) is the one writer of a deal's stage, won and lost,\n * because a stage change is what automations listen for (`server-deal-stage.ts`).\n * `crm/contacts-create` (AGL-2596) is a person typed into the console by a\n * member of the team — a server route because the dedupe against every\n * holder's rows and the audience band are judgments the browser cannot make.\n * `crm/contact-update` (AGL-2804) is every other write to a contact's facets:\n * the rules cannot tell one field of a holder's facet from another, so they\n * leave a client nothing there but letting a holder go, and the plan is\n * asked here about the fields a save carries.\n */\n\nimport {\n  CONTACT_ERASED_MESSAGE,\n  contactFacetPath,\n  CRM_COLLECTIONS,\n  crmReadTokens,\n  isContactLifecycleStage,\n  isOrgWideMember,\n  normalizeAddress,\n  normalizeContactEmail,\n  normalizePhone,\n  type AglynPostalAddress,\n  type PluginApiHandler,\n  type PluginApiRequest,\n  readContactFacet,\n  registerPluginApiRoute,\n  visibleToHost,\n} from '@aglyn/aglyn/server'\nimport {\n  consentGroupForSite,\n  firebaseAdmin,\n  getOrgForHost,\n  logHostActivity,\n  memberHasOrgPermission,\n  orgDataCollectionForHost,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport { captureHostContact, emitHostEvent } from '@aglyn/tenant-runtime'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { CRM_API_ROUTES } from './constants/api-routes'\nimport { registerCrmServerDeclarations } from './declarations.server'\nimport { BUNDLE_ID } from './constants/bundle-common'\nimport { CRM_NEXT_ACTIVITY_ROUTE } from './model/next-activity'\nimport { CRM_TASK_ROUTES } from './model/task-routes'\nimport { crmNextActivityHandler } from './server/next-activity-routes'\nimport { registerCrmRecordTimelineWriter } from './server/record-timeline'\nimport { crmTaskCompleteHandler, crmTaskSaveHandler } from './server/task-routes'\nimport { crmCompaniesImportHandler } from './server/companies-import'\nimport { crmContactsImportHandler } from './server/contacts-import'\nimport { crmDealsImportHandler } from './server/deals-import'\nimport { crmLeadsImportHandler } from './server/leads-import'\nimport { crmTasksImportHandler } from './server/tasks-import'\nimport { crmDealStageHandler } from './server-deal-stage'\nimport { crmEmailSendHandler } from './server/email-send'\nimport { leadConvertHandler } from './server/lead-convert'\nimport { leadCreateHandler } from './server/lead-create'\nimport {\n  CONTACT_EMAIL_HISTORY_ROUTE,\n  contactEmailHistoryHandler,\n} from './server/contact-email-history'\nimport { CONTACTS_MERGE_ROUTE, contactsMergeHandler } from './server/contacts-merge'\nimport { CRM_ERASE_PERSON_ROUTE, crmErasePersonHandler } from './server/erase-person'\nimport { CRM_ORG_ACTIVITY_ROUTE, crmOrgActivityHandler } from './server/org-activity'\nimport { CRM_INBOUND_ADDRESS_ROUTE, crmInboundAddressHandler } from './server/inbound-address'\nimport { crmCompanyDeleteHandler } from './server/company-delete'\nimport { CONTACT_PHONE_REFUSAL, normalizeTags, typed } from './server/contact-profile'\nimport { crmContactUpdateHandler } from './server/contact-update'\nimport {\n  CRM_EMAIL_TEMPLATE_DUPLICATE_ROUTE,\n  crmEmailTemplateDuplicateHandler,\n} from './server/email-template-duplicate'\nimport { registerCrmRecordFactsReaders } from './server/record-facts'\nimport { crmSuiteRefusal } from './server/suite-gate'\nimport {\n  CRM_RECIPE_INSTALL_ROUTE,\n  CRM_RECIPE_STATUS_ROUTE,\n  crmRecipeInstallHandler,\n  crmRecipeStatusHandler,\n} from './server/recipe-routes'\n\n/**\n * `GET /api/crm/ping` → `{ ok: true, plugin: 'crm' }`.\n *\n * No auth, no host, no data: it answers whether the plugin's server bundle\n * was loaded and its routes registered, which is a fact about the process\n * and not about any org. Anything that reads a document goes behind the\n * same session and role checks the other plugins' console routes use.\n */\nexport const crmPingHandler: PluginApiHandler = (req, res) => {\n  if (req.method !== 'GET') {\n    res.setHeader('Allow', 'GET')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  res.status(200).json({ ok: true, plugin: BUNDLE_ID })\n}\n\ntype Refusal = { ok: false; status: number; error: string }\n\n/**\n * Who is calling, and whether they may edit this site's CRM.\n *\n * The same check the inbox, bookings and email console routes make: a\n * bearer ID token, verified, and an `admin` or `editor` role on the host\n * document. A contact is a site's business record, so the site's own role\n * map is the right authority; org-wide reach is not required, because a\n * site editor who can open the record in the console can already write\n * every other field on it client-direct.\n */\nasync function authorizeSiteEditor(\n  req: PluginApiRequest,\n  hostId: string,\n): Promise<{ ok: true; uid: string } | Refusal> {\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return { ok: false, status: 401, error: 'Unauthenticated' }\n  let uid: string\n  try {\n    uid = (await firebaseAdmin.app().auth().verifyIdToken(idToken)).uid\n  } catch (error) {\n    // A refused credential is the caller's 401; a failure to check one is\n    // ours and keeps a 5xx (AGL-2852).\n    if (isRefusedIdToken(error)) return { ok: false, status: 401, error: 'Unauthenticated' }\n    console.error('[crm] the site editor could not be verified', error)\n    return { ok: false, status: 500, error: 'The sign-in could not be checked. Try again.' }\n  }\n  const hostSnapshot = await firebaseAdmin\n    .app()\n    .firestore()\n    .collection('hosts')\n    .doc(hostId)\n    .get()\n  if (!hostSnapshot.exists) {\n    return { ok: false, status: 404, error: 'Unknown site' }\n  }\n  const memberRole = (hostSnapshot.get('memberRoles') ?? {})[uid]\n  if (memberRole !== 'admin' && memberRole !== 'editor') {\n    return { ok: false, status: 403, error: 'Not a site admin or editor' }\n  }\n  return { ok: true, uid }\n}\n\n/**\n * `POST /api/crm/contact-stage` with `{ hostId, contactId, lifecycleStage }`.\n *\n * Writes the stage into THIS site's facet on the contact — a dotted\n * `update()`, never a top-level field, because the row is shared by every\n * site in the org and a stage is one holder's reading of the person — and\n * then announces `contactStageChanged` with the stage it replaced.\n *\n * A stage set to what it already is writes nothing and announces nothing:\n * the response says `changed: false`, and no automation listening for a\n * change hears one that did not happen.\n *\n * `lifecycleStage: null` CLEARS the stage (AGL-2804). A facet is the\n * server's to write, so \"not placed yet\" comes through the route that owns\n * the stage rather than as a client-direct delete, and it is refused to a\n * plan without the suite the way a move is. There is no event for \"no\n * stage\", so a clear announces nothing; an empty string names no stage and\n * is refused like any other the list does not have.\n *\n * The contact is looked up by id and then checked against `visibleTo`,\n * because the Admin SDK evaluates no rules: a caller who can edit site A\n * must not be able to restage a contact only site B holds by guessing its\n * id, and the scoped query the list uses is not available to a `doc()` read.\n */\nexport const contactStageHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  const hostId = String(req.body?.hostId ?? '').trim()\n  const contactId = String(req.body?.contactId ?? '').trim()\n  const requested: unknown = req.body?.lifecycleStage\n  if (!hostId || !contactId) {\n    res.status(400).json({ error: 'Missing hostId or contactId' })\n    return\n  }\n  // `null` clears the stage; anything else has to be one of the list's.\n  const clearing = requested === null\n  const lifecycleStage = clearing\n    ? ''\n    : isContactLifecycleStage(requested)\n      ? requested\n      : null\n  if (lifecycleStage === null) {\n    res.status(400).json({ error: 'Pick a lifecycle stage' })\n    return\n  }\n  const caller = await authorizeSiteEditor(req, hostId)\n  if (caller.ok === false) {\n    res.status(caller.status).json({ error: caller.error })\n    return\n  }\n  try {\n    // A lifecycle stage is the suite's (AGL-2787) — see `suite-gate.ts`.\n    const owner = await getOrgForHost(hostId)\n    if (!owner) {\n      res.status(404).json({ error: 'Unknown site' })\n      return\n    }\n    const suite = crmSuiteRefusal(owner.org, \"Moving a contact's lifecycle stage\")\n    if (suite) {\n      res.status(suite.status).json(suite.body)\n      return\n    }\n    const contactsRef = await orgDataCollectionForHost(hostId, 'contacts')\n    const snapshot = await contactsRef.doc(contactId).get()\n    if (!snapshot.exists || !visibleToHost(snapshot.get('visibleTo'), hostId)) {\n      res.status(404).json({ error: 'Unknown contact' })\n      return\n    }\n    const group = await consentGroupForSite(hostId)\n    const facet = readContactFacet(\n      snapshot.data() as Record<string, unknown>,\n      group.groupId,\n    )\n    const previousStage = facet.lifecycleStage ?? ''\n    if (previousStage === lifecycleStage) {\n      res\n        .status(200)\n        .json({ ok: true, changed: false, lifecycleStage, previousStage })\n      return\n    }\n    await snapshot.ref.update({\n      [contactFacetPath(group.groupId, 'lifecycleStage')]: clearing\n        ? FieldValue.delete()\n        : lifecycleStage,\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n    // Awaited, not floated: a serverless response ending cancels in-flight\n    // work, and the event is the reason this route exists. A clear has none.\n    if (!clearing) {\n      await emitHostEvent(hostId, 'contactStageChanged', {\n        contactId,\n        email: String(snapshot.get('email') ?? ''),\n        lifecycleStage,\n        previousStage,\n      })\n    }\n    res\n      .status(200)\n      .json({ ok: true, changed: true, lifecycleStage, previousStage })\n  } catch (error) {\n    console.error('[crm] contact-stage failed', hostId, contactId, error)\n    res.status(500).json({ error: 'The stage could not be changed' })\n  }\n}\n\n/**\n * What the create route says when the band refused (AGL-2596).\n *\n * The contacts list's own alert, in the past tense: the list says new\n * visitors are \"no longer captured\", and this says the one contact the\n * reader just tried to add was not. The remedy is the same sentence in both\n * places, so a reader who sees one and then the other is told one thing.\n */\nexport const CONTACT_BAND_FULL_MESSAGE =\n  'Contact limit reached — this contact was not added. Upgrade in Billing ' +\n  'to keep collecting.'\n\n/**\n * `POST /api/crm/contacts-create` — a person added by hand (AGL-2596).\n *\n * Body: `{ hostId, email, name?, phone?, jobTitle?, companyName?,\n * companyId?, address?, ownerUid?, lifecycleStage?, tags?,\n * marketingConsent? }`. Answers `{ contactId, created }`: `created` is\n * false when the address already belonged to somebody, in which case what\n * was typed MERGES into the existing row — the dedupe the shared address\n * book exists for, and the reason a second \"create\" of one person is not\n * an error.\n *\n * ## Who may call it\n *\n * The caller's ID token, then `data.manage` on the site's org — the same key\n * the console surface itself is gated on, resolved through the same\n * three-layer permission read the members route uses. A scoped member is\n * admitted only for a site they reach: the rules would refuse a browser\n * write outside their tokens, and a server route that admitted it would be\n * a way round the rules rather than a service in front of them.\n *\n * ## What it refuses, and how\n *\n * A malformed email or phone number is a 400 with a sentence the drawer can\n * show under the field. The band is a 409 carrying the list's own wording:\n * it is not a bad request and not a server fault, it is the plan saying no,\n * and the drawer relays the sentence rather than inventing one.\n *\n * ## The company (AGL-2613)\n *\n * `companyId` is the picker's choice, and it is checked before anything is\n * written: the company has to exist and be visible to the capturing site's\n * scope, or a caller could file a person under a record they cannot open —\n * the same refusal the lead conversion makes. It reaches the upsert as\n * `facet.companyId`, which is where the link is kept in step with its mirror\n * and the company's contacts count; a merge onto somebody already at another\n * company is a MOVE there, not a second link. The stored company's own name\n * is what is echoed, over whatever the client sent, because the name on the\n * record is the company's and not the form's.\n *\n * ## What it writes beyond the upsert\n *\n * `upsertHostContact` takes the profile — phone, title, address, owner,\n * stage, company — and writes it into the capturing group's facet. The two\n * things it does not take are written here by DOTTED path afterwards: the\n * tags, which union into whatever the person already carried, and the\n * company name — the picked company's, or free text for a person filed\n * under a name no company record carries yet. Dotted paths because this is\n * an `update()`, and only an update reads a dot as a path — a nested object\n * here would replace the facet map and take every other holder's records\n * with it.\n */\nexport const crmContactsCreateHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n\n  const body = (req.body ?? {}) as Record<string, unknown>\n  const hostId = typed(body['hostId'], 128)\n  if (!hostId) {\n    res.status(400).json({ error: 'Missing hostId' })\n    return\n  }\n  const email = normalizeContactEmail(body['email'])\n  if (!email) {\n    res.status(400).json({ error: 'Enter a valid email address.' })\n    return\n  }\n  const rawPhone = typed(body['phone'], 40)\n  const phone = rawPhone ? normalizePhone(rawPhone) : null\n  if (rawPhone && !phone) {\n    res.status(400).json({ error: CONTACT_PHONE_REFUSAL })\n    return\n  }\n  const rawStage = typed(body['lifecycleStage'], 40)\n  if (rawStage && !isContactLifecycleStage(rawStage)) {\n    res.status(400).json({ error: 'Unknown lifecycle stage.' })\n    return\n  }\n  const name = typed(body['name'], 120)\n  const jobTitle = typed(body['jobTitle'], 120)\n  let companyName = typed(body['companyName'], 120)\n  const companyId = typed(body['companyId'], 128)\n  const ownerUid = typed(body['ownerUid'], 128)\n  const address =\n    body['address'] && typeof body['address'] === 'object'\n      ? normalizeAddress(body['address'] as AglynPostalAddress)\n      : null\n  const tags = normalizeTags(body['tags'])\n  const marketingConsent = body['marketingConsent'] === true\n\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) {\n    res.status(401).json({ error: 'Unauthenticated' })\n    return\n  }\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const resolved = await getOrgForHost(hostId)\n    if (!resolved) {\n      res.status(404).json({ error: 'Unknown site' })\n      return\n    }\n    const isStaff = decoded['staff'] === true\n    if (!isStaff) {\n      const membership = await resolveOrgMembership(decoded.uid, resolved.orgId)\n      const member = membership?.member ?? null\n      const reaches =\n        isOrgWideMember(member) || Boolean(member?.hostAccess?.[hostId])\n      const allowed =\n        member &&\n        reaches &&\n        (await memberHasOrgPermission(resolved.orgId, member, 'data.manage'))\n      if (!allowed) {\n        res.status(403).json({\n          error: 'Adding contacts requires the data.manage permission on this site',\n        })\n        return\n      }\n    }\n\n    // A person typed in by the team is the suite's; the capture doors that\n    // fill a Free workspace's contacts do not come through here (AGL-2787).\n    const suite = crmSuiteRefusal(resolved.org, 'Adding a contact by hand')\n    if (suite) {\n      res.status(suite.status).json(suite.body)\n      return\n    }\n\n    if (companyId) {\n      const group = await consentGroupForSite(\n        hostId,\n        resolved.org as Record<string, unknown>,\n      )\n      const readable = new Set<string>(crmReadTokens(group))\n      const companySnapshot = await firebaseAdmin\n        .app()\n        .firestore()\n        .collection('orgs')\n        .doc(resolved.orgId)\n        .collection(CRM_COLLECTIONS.companies)\n        .doc(companyId)\n        .get()\n      const tokens: unknown = companySnapshot.exists\n        ? companySnapshot.get('visibleTo')\n        : undefined\n      const visible =\n        Array.isArray(tokens) && tokens.some((token) => readable.has(String(token)))\n      if (!visible) {\n        res.status(404).json({ error: 'Unknown company' })\n        return\n      }\n      companyName = typed(companySnapshot.get('name'), 120) || companyName\n    }\n\n    const result = await captureHostContact({\n      hostId,\n      email,\n      ...(name ? { name } : {}),\n      source: 'manual',\n      interaction: { summary: 'Added by hand' },\n      marketingConsent,\n      facet: {\n        ...(phone ? { phone } : {}),\n        ...(jobTitle ? { jobTitle } : {}),\n        ...(companyId ? { companyId } : {}),\n        ...(address ? { address } : {}),\n        ...(ownerUid ? { ownerUid } : {}),\n        ...(rawStage && isContactLifecycleStage(rawStage)\n          ? { lifecycleStage: rawStage }\n          : {}),\n      },\n    })\n\n    if ('refused' in result) {\n      if (result.refused === 'band') {\n        res.status(409).json({ error: CONTACT_BAND_FULL_MESSAGE, reason: 'band' })\n        return\n      }\n      if (result.refused === 'invalid-email') {\n        res.status(400).json({ error: 'Enter a valid email address.' })\n        return\n      }\n      // The person was erased from this workspace (AGL-2623). A conflict,\n      // like the band: the request was well-formed and the answer is a\n      // standing fact about the address, not a fault in the call.\n      if (result.refused === 'erased') {\n        res.status(409).json({ error: CONTACT_ERASED_MESSAGE, reason: 'erased' })\n        return\n      }\n      res.status(500).json({ error: 'The contact could not be saved.' })\n      return\n    }\n\n    if (tags.length || companyName) {\n      const group = await consentGroupForSite(\n        hostId,\n        resolved.org as Record<string, unknown>,\n      )\n      const contacts = await orgDataCollectionForHost(hostId, 'contacts')\n      await contacts.doc(result.contactId).update({\n        ...(tags.length\n          ? {\n              [contactFacetPath(group.groupId, 'tags')]: FieldValue.arrayUnion(\n                ...tags,\n              ),\n            }\n          : {}),\n        ...(companyName\n          ? {\n              [contactFacetPath(group.groupId, 'companyName')]: companyName,\n              // The search echo — see `HostContact.companyName`.\n              companyName,\n            }\n          : {}),\n        updatedAt: FieldValue.serverTimestamp(),\n      })\n    }\n\n    /*\n     * The audit line, written HERE rather than by the console (AGL-2622):\n     * a route that verified the caller and performed the write is the one\n     * writer that cannot record an act that did not happen, which is the\n     * reason `check-activity-coverage.mjs` counts this file. A merge into\n     * a person the org already held is said to be one — the row was\n     * updated, not added — so the feed cannot claim two people for one.\n     */\n    await logHostActivity(\n      hostId,\n      { uid: decoded.uid, email: decoded.email ?? null },\n      result.created ? 'Added contact' : 'Updated contact',\n      { type: 'contact', id: result.contactId, name: name || email },\n    )\n\n    res\n      .status(result.created ? 201 : 200)\n      .json({ contactId: result.contactId, created: result.created })\n  } catch (error) {\n    console.error('[crm] contact create failed', error)\n    res.status(500).json({ error: 'The contact could not be saved.' })\n  }\n}\n\n/** Console API registration, named in `plugins.config.json` as `consoleApi`. */\nexport function registerCrmConsoleApi(): void {\n  /*\n   * The contact-capture writer, again (AGL-3080). Both apps run it at boot\n   * from their generated server-declarations manifest, and this is the\n   * backstop for a process whose boot did not: the first CRM door to load\n   * registers it. Registering twice replaces in place.\n   */\n  registerCrmServerDeclarations()\n  registerPluginApiRoute(CRM_API_ROUTES.ping, crmPingHandler)\n  registerPluginApiRoute(CRM_API_ROUTES.contactStage, contactStageHandler)\n  // Every other console write to a contact's facets (AGL-2804): the rules\n  // cannot tell one facet field from another, so the plan is asked here.\n  registerPluginApiRoute(CRM_API_ROUTES.contactUpdate, crmContactUpdateHandler)\n  // A company's contacts unlinked, then the company (AGL-2804): the unlink\n  // clears a facet, which is the server's to write.\n  registerPluginApiRoute(CRM_API_ROUTES.companyDelete, crmCompanyDeleteHandler)\n  // Tasks (AGL-2599): the two writes with a side effect outside the document\n  // — an assignee's notification, and the `taskCompleted` host event.\n  registerPluginApiRoute(CRM_TASK_ROUTES.save, crmTaskSaveHandler)\n  registerPluginApiRoute(CRM_TASK_ROUTES.complete, crmTaskCompleteHandler)\n  // A client-direct task write's door to `nextTaskAtMs` (AGL-2661).\n  registerPluginApiRoute(CRM_NEXT_ACTIVITY_ROUTE, crmNextActivityHandler)\n  // One chunk of a contact file (AGL-2602), judged and written through the\n  // same door every capture uses.\n  registerPluginApiRoute('crm/contacts-import', crmContactsImportHandler)\n  // One chunk of a companies file (AGL-2621), matched by domain then name\n  // and written with the stamp every CRM creator writes.\n  registerPluginApiRoute('crm/companies-import', crmCompaniesImportHandler)\n  // One chunk of a deals file and one of a tasks file (AGL-2662): the\n  // pipeline, the stage and the assignee resolved by name, a row refused\n  // when the org has no such name.\n  registerPluginApiRoute('crm/deals-import', crmDealsImportHandler)\n  registerPluginApiRoute('crm/tasks-import', crmTasksImportHandler)\n  // One chunk of a leads file (AGL-2701), written through `addHostLead` —\n  // the same door a sign-up, a booking and a form submission file a lead\n  // through, so an imported row is keyed, bounded and unconsented exactly\n  // as a captured one is.\n  registerPluginApiRoute('crm/leads-import', crmLeadsImportHandler)\n  // The one writer of a deal's stage, won and lost (AGL-2598): the browser\n  // could write the field, but only a server can emit the event an\n  // automation listens for.\n  registerPluginApiRoute('crm/deal-stage', crmDealStageHandler)\n  // A person typed into the console (AGL-2596): the capture doors' own\n  // function behind a session check, so the dedupe and the band are judged\n  // where every other door judges them.\n  registerPluginApiRoute('crm/contacts-create', crmContactsCreateHandler)\n  // A lead becomes a contact, a company and a deal (AGL-2608) — the one CRM\n  // write a browser cannot make alone, because only the server may create a\n  // contact through the dedupe-and-meter door.\n  registerPluginApiRoute('crm/lead-convert', leadConvertHandler)\n  // A lead entered by hand (AGL-3231): the New lead drawer's route.\n  registerPluginApiRoute('crm/leads-create', leadCreateHandler)\n  // The one READ behind a route (AGL-2616): the per-recipient delivery log\n  // is closed to clients, so a contact's campaign mail is projected here.\n  registerPluginApiRoute(CONTACT_EMAIL_HISTORY_ROUTE, contactEmailHistoryHandler)\n  // One email to one person from their record (AGL-2615): the recipient is\n  // read off the record, the daily cap and both suppression lists are\n  // judged, and the message leaves on the site's sending identity.\n  registerPluginApiRoute(CRM_API_ROUTES.emailSend, crmEmailSendHandler)\n  // Two records for one person become one (AGL-2625): the repoint of every\n  // row naming the merged record and the transaction over both documents\n  // are the server's, and the address index it writes is closed to clients.\n  registerPluginApiRoute(CONTACTS_MERGE_ROUTE, contactsMergeHandler)\n  // Files a person's privacy erasure for the daily job (AGL-2623);\n  // workspace admins only.\n  registerPluginApiRoute(CRM_ERASE_PERSON_ROUTE, crmErasePersonHandler)\n  // One line in the organization's activity feed for an act the org-level\n  // hub performed client-direct (AGL-2634): the feed is closed to clients,\n  // so the bulk bars' lines come through here.\n  registerPluginApiRoute(CRM_ORG_ACTIVITY_ROUTE, crmOrgActivityHandler)\n  // A recipe's action written into one site's automations from the org\n  // hub (AGL-2639), stamped and deduplicated by the server, and the stamps\n  // read back per site so the hub can say which sites carry which recipe.\n  registerPluginApiRoute(CRM_RECIPE_INSTALL_ROUTE, crmRecipeInstallHandler)\n  registerPluginApiRoute(CRM_RECIPE_STATUS_ROUTE, crmRecipeStatusHandler)\n  // The workspace's email capture address (AGL-2657): the token is minted\n  // and rotated here, behind the CRM's own gate, and the org document that\n  // carries it is closed to every client.\n  registerPluginApiRoute(CRM_INBOUND_ADDRESS_ROUTE, crmInboundAddressHandler)\n  registerPluginApiRoute(\n    CRM_EMAIL_TEMPLATE_DUPLICATE_ROUTE,\n    crmEmailTemplateDuplicateHandler,\n  )\n  // The facts of a contact, company, deal or lead, and an import's field\n  // catalog, for another plugin in this process (AGL-2917): read on the core's\n  // record-facts seam under the rules every CRM door applies, and written\n  // nowhere.\n  registerCrmRecordFactsReaders()\n  // The CRM as the workspace's record system on the core's record-timeline\n  // seam (AGL-2981): another plugin files an email, a reply or a task on a\n  // record through it, under the CRM's own scope, dedupe and ceiling.\n  registerCrmRecordTimelineWriter()\n}\n"],"names":["CONTACT_ERASED_MESSAGE","contactFacetPath","CRM_COLLECTIONS","crmReadTokens","isContactLifecycleStage","isOrgWideMember","normalizeAddress","normalizeContactEmail","normalizePhone","readContactFacet","registerPluginApiRoute","visibleToHost","consentGroupForSite","firebaseAdmin","getOrgForHost","logHostActivity","memberHasOrgPermission","orgDataCollectionForHost","resolveOrgMembership","isRefusedIdToken","captureHostContact","emitHostEvent","FieldValue","CRM_API_ROUTES","registerCrmServerDeclarations","BUNDLE_ID","CRM_NEXT_ACTIVITY_ROUTE","CRM_TASK_ROUTES","crmNextActivityHandler","registerCrmRecordTimelineWriter","crmTaskCompleteHandler","crmTaskSaveHandler","crmCompaniesImportHandler","crmContactsImportHandler","crmDealsImportHandler","crmLeadsImportHandler","crmTasksImportHandler","crmDealStageHandler","crmEmailSendHandler","leadConvertHandler","leadCreateHandler","CONTACT_EMAIL_HISTORY_ROUTE","contactEmailHistoryHandler","CONTACTS_MERGE_ROUTE","contactsMergeHandler","CRM_ERASE_PERSON_ROUTE","crmErasePersonHandler","CRM_ORG_ACTIVITY_ROUTE","crmOrgActivityHandler","CRM_INBOUND_ADDRESS_ROUTE","crmInboundAddressHandler","crmCompanyDeleteHandler","CONTACT_PHONE_REFUSAL","normalizeTags","typed","crmContactUpdateHandler","CRM_EMAIL_TEMPLATE_DUPLICATE_ROUTE","crmEmailTemplateDuplicateHandler","registerCrmRecordFactsReaders","crmSuiteRefusal","CRM_RECIPE_INSTALL_ROUTE","CRM_RECIPE_STATUS_ROUTE","crmRecipeInstallHandler","crmRecipeStatusHandler","crmPingHandler","req","res","method","setHeader","status","json","error","ok","plugin","authorizeSiteEditor","hostId","hostSnapshot","authorization","String","headers","idToken","startsWith","slice","length","undefined","uid","app","auth","verifyIdToken","console","firestore","collection","doc","get","exists","memberRole","contactStageHandler","body","trim","contactId","requested","lifecycleStage","clearing","caller","facet","owner","suite","org","contactsRef","snapshot","group","data","groupId","previousStage","changed","ref","update","delete","updatedAt","serverTimestamp","email","CONTACT_BAND_FULL_MESSAGE","crmContactsCreateHandler","rawPhone","phone","rawStage","name","jobTitle","companyName","companyId","ownerUid","address","tags","marketingConsent","decoded","resolved","isStaff","member","membership","orgId","reaches","Boolean","hostAccess","allowed","readable","Set","companySnapshot","companies","tokens","visible","Array","isArray","some","token","has","result","source","interaction","summary","refused","reason","contacts","arrayUnion","created","type","id","registerCrmConsoleApi","ping","contactStage","contactUpdate","companyDelete","save","complete","emailSend"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCC,GAED,SACEA,sBAAsB,EACtBC,gBAAgB,EAChBC,eAAe,EACfC,aAAa,EACbC,uBAAuB,EACvBC,eAAe,EACfC,gBAAgB,EAChBC,qBAAqB,EACrBC,cAAc,EAIdC,gBAAgB,EAChBC,sBAAsB,EACtBC,aAAa,QACR,sBAAqB;AAC5B,SACEC,mBAAmB,EACnBC,aAAa,EACbC,aAAa,EACbC,eAAe,EACfC,sBAAsB,EACtBC,wBAAwB,EACxBC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,gBAAgB,QAAQ,mDAAkD;AACnF,SAASC,kBAAkB,EAAEC,aAAa,QAAQ,wBAAuB;AACzE,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,cAAc,QAAQ,4BAAwB;AACvD,SAASC,6BAA6B,QAAQ,2BAAuB;AACrE,SAASC,SAAS,QAAQ,+BAA2B;AACrD,SAASC,uBAAuB,QAAQ,2BAAuB;AAC/D,SAASC,eAAe,QAAQ,yBAAqB;AACrD,SAASC,sBAAsB,QAAQ,mCAA+B;AACtE,SAASC,+BAA+B,QAAQ,8BAA0B;AAC1E,SAASC,sBAAsB,EAAEC,kBAAkB,QAAQ,0BAAsB;AACjF,SAASC,yBAAyB,QAAQ,+BAA2B;AACrE,SAASC,wBAAwB,QAAQ,8BAA0B;AACnE,SAASC,qBAAqB,QAAQ,2BAAuB;AAC7D,SAASC,qBAAqB,QAAQ,2BAAuB;AAC7D,SAASC,qBAAqB,QAAQ,2BAAuB;AAC7D,SAASC,mBAAmB,QAAQ,yBAAqB;AACzD,SAASC,mBAAmB,QAAQ,yBAAqB;AACzD,SAASC,kBAAkB,QAAQ,2BAAuB;AAC1D,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SACEC,2BAA2B,EAC3BC,0BAA0B,QACrB,oCAAgC;AACvC,SAASC,oBAAoB,EAAEC,oBAAoB,QAAQ,6BAAyB;AACpF,SAASC,sBAAsB,EAAEC,qBAAqB,QAAQ,2BAAuB;AACrF,SAASC,sBAAsB,EAAEC,qBAAqB,QAAQ,2BAAuB;AACrF,SAASC,yBAAyB,EAAEC,wBAAwB,QAAQ,8BAA0B;AAC9F,SAASC,uBAAuB,QAAQ,6BAAyB;AACjE,SAASC,qBAAqB,EAAEC,aAAa,EAAEC,KAAK,QAAQ,8BAA0B;AACtF,SAASC,uBAAuB,QAAQ,6BAAyB;AACjE,SACEC,kCAAkC,EAClCC,gCAAgC,QAC3B,uCAAmC;AAC1C,SAASC,6BAA6B,QAAQ,2BAAuB;AACrE,SAASC,eAAe,QAAQ,yBAAqB;AACrD,SACEC,wBAAwB,EACxBC,uBAAuB,EACvBC,uBAAuB,EACvBC,sBAAsB,QACjB,4BAAwB;AAE/B;;;;;;;CAOC,GACD,OAAO,MAAMC,iBAAmC,CAACC,KAAKC;IACpD,IAAID,IAAIE,MAAM,KAAK,OAAO;QACxBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACnD;IACF;IACAL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEE,IAAI;QAAMC,QAAQhD;IAAU;AACrD,EAAC;AAID;;;;;;;;;CASC,GACD,eAAeiD,oBACbT,GAAqB,EACrBU,MAAc;QAEeV,4BAwBTW;IAxBpB,MAAMC,gBAAgBC,QAAOb,6BAAAA,IAAIc,OAAO,CAACF,aAAa,YAAzBZ,6BAA6B;IAC1D,MAAMe,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAO;QAAER,IAAI;QAAOH,QAAQ;QAAKE,OAAO;IAAkB;IACxE,IAAIc;IACJ,IAAI;QACFA,MAAM,AAAC,CAAA,MAAMxE,cAAcyE,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACR,QAAO,EAAGK,GAAG;IACrE,EAAE,OAAOd,OAAO;QACd,sEAAsE;QACtE,mCAAmC;QACnC,IAAIpD,iBAAiBoD,QAAQ,OAAO;YAAEC,IAAI;YAAOH,QAAQ;YAAKE,OAAO;QAAkB;QACvFkB,QAAQlB,KAAK,CAAC,+CAA+CA;QAC7D,OAAO;YAAEC,IAAI;YAAOH,QAAQ;YAAKE,OAAO;QAA+C;IACzF;IACA,MAAMK,eAAe,MAAM/D,cACxByE,GAAG,GACHI,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAACjB,QACJkB,GAAG;IACN,IAAI,CAACjB,aAAakB,MAAM,EAAE;QACxB,OAAO;YAAEtB,IAAI;YAAOH,QAAQ;YAAKE,OAAO;QAAe;IACzD;IACA,MAAMwB,aAAa,EAACnB,oBAAAA,aAAaiB,GAAG,CAAC,0BAAjBjB,oBAAmC,CAAC,EAAE,CAACS,IAAI;IAC/D,IAAIU,eAAe,WAAWA,eAAe,UAAU;QACrD,OAAO;YAAEvB,IAAI;YAAOH,QAAQ;YAAKE,OAAO;QAA6B;IACvE;IACA,OAAO;QAAEC,IAAI;QAAMa;IAAI;AACzB;AAEA;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,OAAO,MAAMW,sBAAwC,OAAO/B,KAAKC;;QAMzCD,WACGA,YACEA;IAP3B,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACnD;IACF;IACA,MAAMI,SAASG,gBAAOb,YAAAA,IAAIgC,IAAI,qBAARhC,UAAUU,MAAM,mBAAI,IAAIuB,IAAI;IAClD,MAAMC,YAAYrB,iBAAOb,aAAAA,IAAIgC,IAAI,qBAARhC,WAAUkC,SAAS,oBAAI,IAAID,IAAI;IACxD,MAAME,aAAqBnC,aAAAA,IAAIgC,IAAI,qBAARhC,WAAUoC,cAAc;IACnD,IAAI,CAAC1B,UAAU,CAACwB,WAAW;QACzBjC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA8B;QAC5D;IACF;IACA,sEAAsE;IACtE,MAAM+B,WAAWF,cAAc;IAC/B,MAAMC,iBAAiBC,WACnB,KACAlG,wBAAwBgG,aACtBA,YACA;IACN,IAAIC,mBAAmB,MAAM;QAC3BnC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAyB;QACvD;IACF;IACA,MAAMgC,SAAS,MAAM7B,oBAAoBT,KAAKU;IAC9C,IAAI4B,OAAO/B,EAAE,KAAK,OAAO;QACvBN,IAAIG,MAAM,CAACkC,OAAOlC,MAAM,EAAEC,IAAI,CAAC;YAAEC,OAAOgC,OAAOhC,KAAK;QAAC;QACrD;IACF;IACA,IAAI;YAuBoBiC;QAtBtB,qEAAqE;QACrE,MAAMC,QAAQ,MAAM3F,cAAc6D;QAClC,IAAI,CAAC8B,OAAO;YACVvC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;YAC7C;QACF;QACA,MAAMmC,QAAQ/C,gBAAgB8C,MAAME,GAAG,EAAE;QACzC,IAAID,OAAO;YACTxC,IAAIG,MAAM,CAACqC,MAAMrC,MAAM,EAAEC,IAAI,CAACoC,MAAMT,IAAI;YACxC;QACF;QACA,MAAMW,cAAc,MAAM3F,yBAAyB0D,QAAQ;QAC3D,MAAMkC,WAAW,MAAMD,YAAYhB,GAAG,CAACO,WAAWN,GAAG;QACrD,IAAI,CAACgB,SAASf,MAAM,IAAI,CAACnF,cAAckG,SAAShB,GAAG,CAAC,cAAclB,SAAS;YACzET,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkB;YAChD;QACF;QACA,MAAMuC,QAAQ,MAAMlG,oBAAoB+D;QACxC,MAAM6B,QAAQ/F,iBACZoG,SAASE,IAAI,IACbD,MAAME,OAAO;QAEf,MAAMC,iBAAgBT,wBAAAA,MAAMH,cAAc,YAApBG,wBAAwB;QAC9C,IAAIS,kBAAkBZ,gBAAgB;YACpCnC,IACGG,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAEE,IAAI;gBAAM0C,SAAS;gBAAOb;gBAAgBY;YAAc;YAClE;QACF;QACA,MAAMJ,SAASM,GAAG,CAACC,MAAM,CAAC;YACxB,CAACnH,iBAAiB6G,MAAME,OAAO,EAAE,kBAAkB,EAAEV,WACjDhF,WAAW+F,MAAM,KACjBhB;YACJiB,WAAWhG,WAAWiG,eAAe;QACvC;QACA,uEAAuE;QACvE,yEAAyE;QACzE,IAAI,CAACjB,UAAU;gBAGGO;YAFhB,MAAMxF,cAAcsD,QAAQ,uBAAuB;gBACjDwB;gBACAqB,OAAO1C,QAAO+B,gBAAAA,SAAShB,GAAG,CAAC,oBAAbgB,gBAAyB;gBACvCR;gBACAY;YACF;QACF;QACA/C,IACGG,MAAM,CAAC,KACPC,IAAI,CAAC;YAAEE,IAAI;YAAM0C,SAAS;YAAMb;YAAgBY;QAAc;IACnE,EAAE,OAAO1C,OAAO;QACdkB,QAAQlB,KAAK,CAAC,8BAA8BI,QAAQwB,WAAW5B;QAC/DL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiC;IACjE;AACF,EAAC;AAED;;;;;;;CAOC,GACD,OAAO,MAAMkD,4BACX,4EACA,sBAAqB;AAEvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkDC,GACD,OAAO,MAAMC,2BAA6C,OAAOzD,KAAKC;QAOtDD,WAkCeA;IAxC7B,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACnD;IACF;IAEA,MAAM0B,QAAQhC,YAAAA,IAAIgC,IAAI,YAARhC,YAAY,CAAC;IAC3B,MAAMU,SAASrB,MAAM2C,IAAI,CAAC,SAAS,EAAE;IACrC,IAAI,CAACtB,QAAQ;QACXT,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;QAC/C;IACF;IACA,MAAMiD,QAAQjH,sBAAsB0F,IAAI,CAAC,QAAQ;IACjD,IAAI,CAACuB,OAAO;QACVtD,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA+B;QAC7D;IACF;IACA,MAAMoD,WAAWrE,MAAM2C,IAAI,CAAC,QAAQ,EAAE;IACtC,MAAM2B,QAAQD,WAAWnH,eAAemH,YAAY;IACpD,IAAIA,YAAY,CAACC,OAAO;QACtB1D,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOnB;QAAsB;QACpD;IACF;IACA,MAAMyE,WAAWvE,MAAM2C,IAAI,CAAC,iBAAiB,EAAE;IAC/C,IAAI4B,YAAY,CAACzH,wBAAwByH,WAAW;QAClD3D,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA2B;QACzD;IACF;IACA,MAAMuD,OAAOxE,MAAM2C,IAAI,CAAC,OAAO,EAAE;IACjC,MAAM8B,WAAWzE,MAAM2C,IAAI,CAAC,WAAW,EAAE;IACzC,IAAI+B,cAAc1E,MAAM2C,IAAI,CAAC,cAAc,EAAE;IAC7C,MAAMgC,YAAY3E,MAAM2C,IAAI,CAAC,YAAY,EAAE;IAC3C,MAAMiC,WAAW5E,MAAM2C,IAAI,CAAC,WAAW,EAAE;IACzC,MAAMkC,UACJlC,IAAI,CAAC,UAAU,IAAI,OAAOA,IAAI,CAAC,UAAU,KAAK,WAC1C3F,iBAAiB2F,IAAI,CAAC,UAAU,IAChC;IACN,MAAMmC,OAAO/E,cAAc4C,IAAI,CAAC,OAAO;IACvC,MAAMoC,mBAAmBpC,IAAI,CAAC,mBAAmB,KAAK;IAEtD,MAAMpB,gBAAgBC,QAAOb,6BAAAA,IAAIc,OAAO,CAACF,aAAa,YAAzBZ,6BAA6B;IAC1D,MAAMe,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS;QACZd,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkB;QAChD;IACF;IAEA,IAAI;YAqI2B+D;QApI7B,MAAMA,UAAU,MAAMzH,cAAcyE,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACR;QAC/D,MAAMuD,WAAW,MAAMzH,cAAc6D;QACrC,IAAI,CAAC4D,UAAU;YACbrE,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;YAC7C;QACF;QACA,MAAMiE,UAAUF,OAAO,CAAC,QAAQ,KAAK;QACrC,IAAI,CAACE,SAAS;;gBAIyBC;YAHrC,MAAMC,aAAa,MAAMxH,qBAAqBoH,QAAQjD,GAAG,EAAEkD,SAASI,KAAK;YACzE,MAAMF,iBAASC,8BAAAA,WAAYD,MAAM,mBAAI;YACrC,MAAMG,UACJvI,gBAAgBoI,WAAWI,QAAQJ,2BAAAA,qBAAAA,OAAQK,UAAU,qBAAlBL,kBAAoB,CAAC9D,OAAO;YACjE,MAAMoE,UACJN,UACAG,WACC,MAAM5H,uBAAuBuH,SAASI,KAAK,EAAEF,QAAQ;YACxD,IAAI,CAACM,SAAS;gBACZ7E,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBACnBC,OAAO;gBACT;gBACA;YACF;QACF;QAEA,uEAAuE;QACvE,wEAAwE;QACxE,MAAMmC,QAAQ/C,gBAAgB4E,SAAS5B,GAAG,EAAE;QAC5C,IAAID,OAAO;YACTxC,IAAIG,MAAM,CAACqC,MAAMrC,MAAM,EAAEC,IAAI,CAACoC,MAAMT,IAAI;YACxC;QACF;QAEA,IAAIgC,WAAW;YACb,MAAMnB,QAAQ,MAAMlG,oBAClB+D,QACA4D,SAAS5B,GAAG;YAEd,MAAMqC,WAAW,IAAIC,IAAY9I,cAAc2G;YAC/C,MAAMoC,kBAAkB,MAAMrI,cAC3ByE,GAAG,GACHI,SAAS,GACTC,UAAU,CAAC,QACXC,GAAG,CAAC2C,SAASI,KAAK,EAClBhD,UAAU,CAACzF,gBAAgBiJ,SAAS,EACpCvD,GAAG,CAACqC,WACJpC,GAAG;YACN,MAAMuD,SAAkBF,gBAAgBpD,MAAM,GAC1CoD,gBAAgBrD,GAAG,CAAC,eACpBT;YACJ,MAAMiE,UACJC,MAAMC,OAAO,CAACH,WAAWA,OAAOI,IAAI,CAAC,CAACC,QAAUT,SAASU,GAAG,CAAC5E,OAAO2E;YACtE,IAAI,CAACJ,SAAS;gBACZnF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAO;gBAAkB;gBAChD;YACF;YACAyD,cAAc1E,MAAM4F,gBAAgBrD,GAAG,CAAC,SAAS,QAAQmC;QAC3D;QAEA,MAAM2B,SAAS,MAAMvI,mBAAmB;YACtCuD;YACA6C;WACIM,OAAO;YAAEA;QAAK,IAAI,CAAC;YACvB8B,QAAQ;YACRC,aAAa;gBAAEC,SAAS;YAAgB;YACxCzB;YACA7B,OAAO,aACDoB,QAAQ;gBAAEA;YAAM,IAAI,CAAC,GACrBG,WAAW;gBAAEA;YAAS,IAAI,CAAC,GAC3BE,YAAY;gBAAEA;YAAU,IAAI,CAAC,GAC7BE,UAAU;gBAAEA;YAAQ,IAAI,CAAC,GACzBD,WAAW;gBAAEA;YAAS,IAAI,CAAC,GAC3BL,YAAYzH,wBAAwByH,YACpC;gBAAExB,gBAAgBwB;YAAS,IAC3B,CAAC;;QAIT,IAAI,aAAa8B,QAAQ;YACvB,IAAIA,OAAOI,OAAO,KAAK,QAAQ;gBAC7B7F,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAOkD;oBAA2BuC,QAAQ;gBAAO;gBACxE;YACF;YACA,IAAIL,OAAOI,OAAO,KAAK,iBAAiB;gBACtC7F,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAO;gBAA+B;gBAC7D;YACF;YACA,oEAAoE;YACpE,iEAAiE;YACjE,4DAA4D;YAC5D,IAAIoF,OAAOI,OAAO,KAAK,UAAU;gBAC/B7F,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAOvE;oBAAwBgK,QAAQ;gBAAS;gBACvE;YACF;YACA9F,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkC;YAChE;QACF;QAEA,IAAI6D,KAAKjD,MAAM,IAAI6C,aAAa;YAC9B,MAAMlB,QAAQ,MAAMlG,oBAClB+D,QACA4D,SAAS5B,GAAG;YAEd,MAAMsD,WAAW,MAAMhJ,yBAAyB0D,QAAQ;YACxD,MAAMsF,SAASrE,GAAG,CAAC+D,OAAOxD,SAAS,EAAEiB,MAAM,CAAC,aACtCgB,KAAKjD,MAAM,GACX;gBACE,CAAClF,iBAAiB6G,MAAME,OAAO,EAAE,QAAQ,EAAE1F,WAAW4I,UAAU,IAC3D9B;YAEP,IACA,CAAC,GACDJ,cACA;gBACE,CAAC/H,iBAAiB6G,MAAME,OAAO,EAAE,eAAe,EAAEgB;gBAClD,mDAAmD;gBACnDA;YACF,IACA,CAAC;gBACLV,WAAWhG,WAAWiG,eAAe;;QAEzC;QAEA;;;;;;;KAOC,GACD,MAAMxG,gBACJ4D,QACA;YAAEU,KAAKiD,QAAQjD,GAAG;YAAEmC,KAAK,GAAEc,iBAAAA,QAAQd,KAAK,YAAbc,iBAAiB;QAAK,GACjDqB,OAAOQ,OAAO,GAAG,kBAAkB,mBACnC;YAAEC,MAAM;YAAWC,IAAIV,OAAOxD,SAAS;YAAE2B,MAAMA,QAAQN;QAAM;QAG/DtD,IACGG,MAAM,CAACsF,OAAOQ,OAAO,GAAG,MAAM,KAC9B7F,IAAI,CAAC;YAAE6B,WAAWwD,OAAOxD,SAAS;YAAEgE,SAASR,OAAOQ,OAAO;QAAC;IACjE,EAAE,OAAO5F,OAAO;QACdkB,QAAQlB,KAAK,CAAC,+BAA+BA;QAC7CL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkC;IAClE;AACF,EAAC;AAED,8EAA8E,GAC9E,OAAO,SAAS+F;IACd;;;;;GAKC,GACD9I;IACAd,uBAAuBa,eAAegJ,IAAI,EAAEvG;IAC5CtD,uBAAuBa,eAAeiJ,YAAY,EAAExE;IACpD,wEAAwE;IACxE,uEAAuE;IACvEtF,uBAAuBa,eAAekJ,aAAa,EAAElH;IACrD,yEAAyE;IACzE,kDAAkD;IAClD7C,uBAAuBa,eAAemJ,aAAa,EAAEvH;IACrD,2EAA2E;IAC3E,oEAAoE;IACpEzC,uBAAuBiB,gBAAgBgJ,IAAI,EAAE5I;IAC7CrB,uBAAuBiB,gBAAgBiJ,QAAQ,EAAE9I;IACjD,kEAAkE;IAClEpB,uBAAuBgB,yBAAyBE;IAChD,yEAAyE;IACzE,gCAAgC;IAChClB,uBAAuB,uBAAuBuB;IAC9C,wEAAwE;IACxE,uDAAuD;IACvDvB,uBAAuB,wBAAwBsB;IAC/C,oEAAoE;IACpE,uEAAuE;IACvE,iCAAiC;IACjCtB,uBAAuB,oBAAoBwB;IAC3CxB,uBAAuB,oBAAoB0B;IAC3C,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,wBAAwB;IACxB1B,uBAAuB,oBAAoByB;IAC3C,yEAAyE;IACzE,iEAAiE;IACjE,0BAA0B;IAC1BzB,uBAAuB,kBAAkB2B;IACzC,qEAAqE;IACrE,yEAAyE;IACzE,sCAAsC;IACtC3B,uBAAuB,uBAAuBgH;IAC9C,0EAA0E;IAC1E,0EAA0E;IAC1E,6CAA6C;IAC7ChH,uBAAuB,oBAAoB6B;IAC3C,kEAAkE;IAClE7B,uBAAuB,oBAAoB8B;IAC3C,yEAAyE;IACzE,wEAAwE;IACxE9B,uBAAuB+B,6BAA6BC;IACpD,yEAAyE;IACzE,oEAAoE;IACpE,iEAAiE;IACjEhC,uBAAuBa,eAAesJ,SAAS,EAAEvI;IACjD,yEAAyE;IACzE,uEAAuE;IACvE,0EAA0E;IAC1E5B,uBAAuBiC,sBAAsBC;IAC7C,iEAAiE;IACjE,yBAAyB;IACzBlC,uBAAuBmC,wBAAwBC;IAC/C,wEAAwE;IACxE,yEAAyE;IACzE,6CAA6C;IAC7CpC,uBAAuBqC,wBAAwBC;IAC/C,qEAAqE;IACrE,yEAAyE;IACzE,wEAAwE;IACxEtC,uBAAuBkD,0BAA0BE;IACjDpD,uBAAuBmD,yBAAyBE;IAChD,wEAAwE;IACxE,yEAAyE;IACzE,wCAAwC;IACxCrD,uBAAuBuC,2BAA2BC;IAClDxC,uBACE8C,oCACAC;IAEF,uEAAuE;IACvE,6EAA6E;IAC7E,wEAAwE;IACxE,WAAW;IACXC;IACA,yEAAyE;IACzE,yEAAyE;IACzE,oEAAoE;IACpE7B;AACF"}
+{"version":3,"sources":["../../../../../../libs/plugins/crm/src/lib/server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The Contacts plugin's SERVER half (AGL-2595).\n *\n * Contacts CRM v1 had none: every console write was client-direct against\n * the Firestore rules, and the one server path that creates a contact —\n * `upsertHostContact` — belongs to the capture doors, not to this plugin.\n * v2 needs a server for the things a browser must not do alone: an import\n * that dedupes forty thousand rows, a bulk action over a selection, an\n * auto-association of contacts to companies by domain. Each of those lands\n * as a `crm/<route>` handler registered here.\n *\n * `crm/ping` exists so the wiring is PROVEN rather than assumed:\n * `plugins.config.json` names this module's register function and the\n * `crm` API prefix, the generated server manifest loads this file, and the\n * console's `/api/[...pluginApi]` dispatcher reaches the handler. A plugin\n * whose first real route also had to be its first wiring test would have\n * two things to debug at once.\n *\n * The real routes are the writes with a side effect outside the document:\n * `crm/contact-stage` (AGL-2605) exists for the EVENT — `contactStageChanged`\n * can only be emitted by a server path that performed the write, so a record\n * page that moved the stage client-direct would move the person and tell no\n * automation; the task routes (AGL-2599) carry an assignee's notification and\n * the `taskCompleted` event; `crm/contacts-import` (AGL-2602) pushes one chunk\n * of a file through the same capture door every other server door uses.\n * `crm/deal-stage` (AGL-2598) is the one writer of a deal's stage, won and lost,\n * because a stage change is what automations listen for (`server-deal-stage.ts`).\n * `crm/contacts-create` (AGL-2596) is a person typed into the console by a\n * member of the team — a server route because the dedupe against every\n * holder's rows and the audience band are judgments the browser cannot make.\n * `crm/contact-update` (AGL-2804) is every other write to a contact's facets:\n * the rules cannot tell one field of a holder's facet from another, so they\n * leave a client nothing there but letting a holder go, and the plan is\n * asked here about the fields a save carries.\n */\n\nimport {\n  CONTACT_ERASED_MESSAGE,\n  contactFacetPath,\n  CRM_COLLECTIONS,\n  crmReadTokens,\n  isContactLifecycleStage,\n  isOrgWideMember,\n  normalizeAddress,\n  normalizeContactEmail,\n  normalizePhone,\n  type AglynPostalAddress,\n  type PluginApiHandler,\n  type PluginApiRequest,\n  readContactFacet,\n  registerPluginApiRoute,\n  visibleToHost,\n} from '@aglyn/aglyn/server'\nimport {\n  consentGroupForSite,\n  firebaseAdmin,\n  getOrgForHost,\n  logHostActivity,\n  memberHasOrgPermission,\n  orgDataCollectionForHost,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport { captureHostContact, emitHostEvent } from '@aglyn/tenant-runtime'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { CRM_API_ROUTES } from './constants/api-routes'\nimport { registerCrmServerDeclarations } from './declarations.server'\nimport { BUNDLE_ID } from './constants/bundle-common'\nimport { CRM_NEXT_ACTIVITY_ROUTE } from './model/next-activity'\nimport { CRM_TASK_ROUTES } from './model/task-routes'\nimport { crmNextActivityHandler } from './server/next-activity-routes'\nimport { registerCrmRecordEmailStateWriter } from './server/record-email-state'\nimport { registerCrmRecordTimelineWriter } from './server/record-timeline'\nimport { crmTaskCompleteHandler, crmTaskSaveHandler } from './server/task-routes'\nimport { crmCompaniesImportHandler } from './server/companies-import'\nimport { crmContactsImportHandler } from './server/contacts-import'\nimport { crmDealsImportHandler } from './server/deals-import'\nimport { crmLeadsImportHandler } from './server/leads-import'\nimport { crmTasksImportHandler } from './server/tasks-import'\nimport { crmDealStageHandler } from './server-deal-stage'\nimport { crmEmailSendHandler } from './server/email-send'\nimport { leadConvertHandler } from './server/lead-convert'\nimport { leadCreateHandler } from './server/lead-create'\nimport {\n  CONTACT_EMAIL_HISTORY_ROUTE,\n  contactEmailHistoryHandler,\n} from './server/contact-email-history'\nimport { CONTACTS_MERGE_ROUTE, contactsMergeHandler } from './server/contacts-merge'\nimport { CRM_ERASE_PERSON_ROUTE, crmErasePersonHandler } from './server/erase-person'\nimport { CRM_ORG_ACTIVITY_ROUTE, crmOrgActivityHandler } from './server/org-activity'\nimport { CRM_INBOUND_ADDRESS_ROUTE, crmInboundAddressHandler } from './server/inbound-address'\nimport { crmCompanyDeleteHandler } from './server/company-delete'\nimport { CONTACT_PHONE_REFUSAL, normalizeTags, typed } from './server/contact-profile'\nimport { crmContactUpdateHandler } from './server/contact-update'\nimport {\n  CRM_EMAIL_TEMPLATE_DUPLICATE_ROUTE,\n  crmEmailTemplateDuplicateHandler,\n} from './server/email-template-duplicate'\nimport { registerCrmRecordFactsReaders } from './server/record-facts'\nimport { crmSuiteRefusal } from './server/suite-gate'\nimport {\n  CRM_RECIPE_INSTALL_ROUTE,\n  CRM_RECIPE_STATUS_ROUTE,\n  crmRecipeInstallHandler,\n  crmRecipeStatusHandler,\n} from './server/recipe-routes'\n\n/**\n * `GET /api/crm/ping` → `{ ok: true, plugin: 'crm' }`.\n *\n * No auth, no host, no data: it answers whether the plugin's server bundle\n * was loaded and its routes registered, which is a fact about the process\n * and not about any org. Anything that reads a document goes behind the\n * same session and role checks the other plugins' console routes use.\n */\nexport const crmPingHandler: PluginApiHandler = (req, res) => {\n  if (req.method !== 'GET') {\n    res.setHeader('Allow', 'GET')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  res.status(200).json({ ok: true, plugin: BUNDLE_ID })\n}\n\ntype Refusal = { ok: false; status: number; error: string }\n\n/**\n * Who is calling, and whether they may edit this site's CRM.\n *\n * The same check the inbox, bookings and email console routes make: a\n * bearer ID token, verified, and an `admin` or `editor` role on the host\n * document. A contact is a site's business record, so the site's own role\n * map is the right authority; org-wide reach is not required, because a\n * site editor who can open the record in the console can already write\n * every other field on it client-direct.\n */\nasync function authorizeSiteEditor(\n  req: PluginApiRequest,\n  hostId: string,\n): Promise<{ ok: true; uid: string } | Refusal> {\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return { ok: false, status: 401, error: 'Unauthenticated' }\n  let uid: string\n  try {\n    uid = (await firebaseAdmin.app().auth().verifyIdToken(idToken)).uid\n  } catch (error) {\n    // A refused credential is the caller's 401; a failure to check one is\n    // ours and keeps a 5xx (AGL-2852).\n    if (isRefusedIdToken(error)) return { ok: false, status: 401, error: 'Unauthenticated' }\n    console.error('[crm] the site editor could not be verified', error)\n    return { ok: false, status: 500, error: 'The sign-in could not be checked. Try again.' }\n  }\n  const hostSnapshot = await firebaseAdmin\n    .app()\n    .firestore()\n    .collection('hosts')\n    .doc(hostId)\n    .get()\n  if (!hostSnapshot.exists) {\n    return { ok: false, status: 404, error: 'Unknown site' }\n  }\n  const memberRole = (hostSnapshot.get('memberRoles') ?? {})[uid]\n  if (memberRole !== 'admin' && memberRole !== 'editor') {\n    return { ok: false, status: 403, error: 'Not a site admin or editor' }\n  }\n  return { ok: true, uid }\n}\n\n/**\n * `POST /api/crm/contact-stage` with `{ hostId, contactId, lifecycleStage }`.\n *\n * Writes the stage into THIS site's facet on the contact — a dotted\n * `update()`, never a top-level field, because the row is shared by every\n * site in the org and a stage is one holder's reading of the person — and\n * then announces `contactStageChanged` with the stage it replaced.\n *\n * A stage set to what it already is writes nothing and announces nothing:\n * the response says `changed: false`, and no automation listening for a\n * change hears one that did not happen.\n *\n * `lifecycleStage: null` CLEARS the stage (AGL-2804). A facet is the\n * server's to write, so \"not placed yet\" comes through the route that owns\n * the stage rather than as a client-direct delete, and it is refused to a\n * plan without the suite the way a move is. There is no event for \"no\n * stage\", so a clear announces nothing; an empty string names no stage and\n * is refused like any other the list does not have.\n *\n * The contact is looked up by id and then checked against `visibleTo`,\n * because the Admin SDK evaluates no rules: a caller who can edit site A\n * must not be able to restage a contact only site B holds by guessing its\n * id, and the scoped query the list uses is not available to a `doc()` read.\n */\nexport const contactStageHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  const hostId = String(req.body?.hostId ?? '').trim()\n  const contactId = String(req.body?.contactId ?? '').trim()\n  const requested: unknown = req.body?.lifecycleStage\n  if (!hostId || !contactId) {\n    res.status(400).json({ error: 'Missing hostId or contactId' })\n    return\n  }\n  // `null` clears the stage; anything else has to be one of the list's.\n  const clearing = requested === null\n  const lifecycleStage = clearing\n    ? ''\n    : isContactLifecycleStage(requested)\n      ? requested\n      : null\n  if (lifecycleStage === null) {\n    res.status(400).json({ error: 'Pick a lifecycle stage' })\n    return\n  }\n  const caller = await authorizeSiteEditor(req, hostId)\n  if (caller.ok === false) {\n    res.status(caller.status).json({ error: caller.error })\n    return\n  }\n  try {\n    // A lifecycle stage is the suite's (AGL-2787) — see `suite-gate.ts`.\n    const owner = await getOrgForHost(hostId)\n    if (!owner) {\n      res.status(404).json({ error: 'Unknown site' })\n      return\n    }\n    const suite = crmSuiteRefusal(owner.org, \"Moving a contact's lifecycle stage\")\n    if (suite) {\n      res.status(suite.status).json(suite.body)\n      return\n    }\n    const contactsRef = await orgDataCollectionForHost(hostId, 'contacts')\n    const snapshot = await contactsRef.doc(contactId).get()\n    if (!snapshot.exists || !visibleToHost(snapshot.get('visibleTo'), hostId)) {\n      res.status(404).json({ error: 'Unknown contact' })\n      return\n    }\n    const group = await consentGroupForSite(hostId)\n    const facet = readContactFacet(\n      snapshot.data() as Record<string, unknown>,\n      group.groupId,\n    )\n    const previousStage = facet.lifecycleStage ?? ''\n    if (previousStage === lifecycleStage) {\n      res\n        .status(200)\n        .json({ ok: true, changed: false, lifecycleStage, previousStage })\n      return\n    }\n    await snapshot.ref.update({\n      [contactFacetPath(group.groupId, 'lifecycleStage')]: clearing\n        ? FieldValue.delete()\n        : lifecycleStage,\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n    // Awaited, not floated: a serverless response ending cancels in-flight\n    // work, and the event is the reason this route exists. A clear has none.\n    if (!clearing) {\n      await emitHostEvent(hostId, 'contactStageChanged', {\n        contactId,\n        email: String(snapshot.get('email') ?? ''),\n        lifecycleStage,\n        previousStage,\n      })\n    }\n    res\n      .status(200)\n      .json({ ok: true, changed: true, lifecycleStage, previousStage })\n  } catch (error) {\n    console.error('[crm] contact-stage failed', hostId, contactId, error)\n    res.status(500).json({ error: 'The stage could not be changed' })\n  }\n}\n\n/**\n * What the create route says when the band refused (AGL-2596).\n *\n * The contacts list's own alert, in the past tense: the list says new\n * visitors are \"no longer captured\", and this says the one contact the\n * reader just tried to add was not. The remedy is the same sentence in both\n * places, so a reader who sees one and then the other is told one thing.\n */\nexport const CONTACT_BAND_FULL_MESSAGE =\n  'Contact limit reached — this contact was not added. Upgrade in Billing ' +\n  'to keep collecting.'\n\n/**\n * `POST /api/crm/contacts-create` — a person added by hand (AGL-2596).\n *\n * Body: `{ hostId, email, name?, phone?, jobTitle?, companyName?,\n * companyId?, address?, ownerUid?, lifecycleStage?, tags?,\n * marketingConsent? }`. Answers `{ contactId, created }`: `created` is\n * false when the address already belonged to somebody, in which case what\n * was typed MERGES into the existing row — the dedupe the shared address\n * book exists for, and the reason a second \"create\" of one person is not\n * an error.\n *\n * ## Who may call it\n *\n * The caller's ID token, then `data.manage` on the site's org — the same key\n * the console surface itself is gated on, resolved through the same\n * three-layer permission read the members route uses. A scoped member is\n * admitted only for a site they reach: the rules would refuse a browser\n * write outside their tokens, and a server route that admitted it would be\n * a way round the rules rather than a service in front of them.\n *\n * ## What it refuses, and how\n *\n * A malformed email or phone number is a 400 with a sentence the drawer can\n * show under the field. The band is a 409 carrying the list's own wording:\n * it is not a bad request and not a server fault, it is the plan saying no,\n * and the drawer relays the sentence rather than inventing one.\n *\n * ## The company (AGL-2613)\n *\n * `companyId` is the picker's choice, and it is checked before anything is\n * written: the company has to exist and be visible to the capturing site's\n * scope, or a caller could file a person under a record they cannot open —\n * the same refusal the lead conversion makes. It reaches the upsert as\n * `facet.companyId`, which is where the link is kept in step with its mirror\n * and the company's contacts count; a merge onto somebody already at another\n * company is a MOVE there, not a second link. The stored company's own name\n * is what is echoed, over whatever the client sent, because the name on the\n * record is the company's and not the form's.\n *\n * ## What it writes beyond the upsert\n *\n * `upsertHostContact` takes the profile — phone, title, address, owner,\n * stage, company — and writes it into the capturing group's facet. The two\n * things it does not take are written here by DOTTED path afterwards: the\n * tags, which union into whatever the person already carried, and the\n * company name — the picked company's, or free text for a person filed\n * under a name no company record carries yet. Dotted paths because this is\n * an `update()`, and only an update reads a dot as a path — a nested object\n * here would replace the facet map and take every other holder's records\n * with it.\n */\nexport const crmContactsCreateHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n\n  const body = (req.body ?? {}) as Record<string, unknown>\n  const hostId = typed(body['hostId'], 128)\n  if (!hostId) {\n    res.status(400).json({ error: 'Missing hostId' })\n    return\n  }\n  const email = normalizeContactEmail(body['email'])\n  if (!email) {\n    res.status(400).json({ error: 'Enter a valid email address.' })\n    return\n  }\n  const rawPhone = typed(body['phone'], 40)\n  const phone = rawPhone ? normalizePhone(rawPhone) : null\n  if (rawPhone && !phone) {\n    res.status(400).json({ error: CONTACT_PHONE_REFUSAL })\n    return\n  }\n  const rawStage = typed(body['lifecycleStage'], 40)\n  if (rawStage && !isContactLifecycleStage(rawStage)) {\n    res.status(400).json({ error: 'Unknown lifecycle stage.' })\n    return\n  }\n  const name = typed(body['name'], 120)\n  const jobTitle = typed(body['jobTitle'], 120)\n  let companyName = typed(body['companyName'], 120)\n  const companyId = typed(body['companyId'], 128)\n  const ownerUid = typed(body['ownerUid'], 128)\n  const address =\n    body['address'] && typeof body['address'] === 'object'\n      ? normalizeAddress(body['address'] as AglynPostalAddress)\n      : null\n  const tags = normalizeTags(body['tags'])\n  const marketingConsent = body['marketingConsent'] === true\n\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) {\n    res.status(401).json({ error: 'Unauthenticated' })\n    return\n  }\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const resolved = await getOrgForHost(hostId)\n    if (!resolved) {\n      res.status(404).json({ error: 'Unknown site' })\n      return\n    }\n    const isStaff = decoded['staff'] === true\n    if (!isStaff) {\n      const membership = await resolveOrgMembership(decoded.uid, resolved.orgId)\n      const member = membership?.member ?? null\n      const reaches =\n        isOrgWideMember(member) || Boolean(member?.hostAccess?.[hostId])\n      const allowed =\n        member &&\n        reaches &&\n        (await memberHasOrgPermission(resolved.orgId, member, 'data.manage'))\n      if (!allowed) {\n        res.status(403).json({\n          error: 'Adding contacts requires the data.manage permission on this site',\n        })\n        return\n      }\n    }\n\n    // A person typed in by the team is the suite's; the capture doors that\n    // fill a Free workspace's contacts do not come through here (AGL-2787).\n    const suite = crmSuiteRefusal(resolved.org, 'Adding a contact by hand')\n    if (suite) {\n      res.status(suite.status).json(suite.body)\n      return\n    }\n\n    if (companyId) {\n      const group = await consentGroupForSite(\n        hostId,\n        resolved.org as Record<string, unknown>,\n      )\n      const readable = new Set<string>(crmReadTokens(group))\n      const companySnapshot = await firebaseAdmin\n        .app()\n        .firestore()\n        .collection('orgs')\n        .doc(resolved.orgId)\n        .collection(CRM_COLLECTIONS.companies)\n        .doc(companyId)\n        .get()\n      const tokens: unknown = companySnapshot.exists\n        ? companySnapshot.get('visibleTo')\n        : undefined\n      const visible =\n        Array.isArray(tokens) && tokens.some((token) => readable.has(String(token)))\n      if (!visible) {\n        res.status(404).json({ error: 'Unknown company' })\n        return\n      }\n      companyName = typed(companySnapshot.get('name'), 120) || companyName\n    }\n\n    const result = await captureHostContact({\n      hostId,\n      email,\n      ...(name ? { name } : {}),\n      source: 'manual',\n      interaction: { summary: 'Added by hand' },\n      marketingConsent,\n      facet: {\n        ...(phone ? { phone } : {}),\n        ...(jobTitle ? { jobTitle } : {}),\n        ...(companyId ? { companyId } : {}),\n        ...(address ? { address } : {}),\n        ...(ownerUid ? { ownerUid } : {}),\n        ...(rawStage && isContactLifecycleStage(rawStage)\n          ? { lifecycleStage: rawStage }\n          : {}),\n      },\n    })\n\n    if ('refused' in result) {\n      if (result.refused === 'band') {\n        res.status(409).json({ error: CONTACT_BAND_FULL_MESSAGE, reason: 'band' })\n        return\n      }\n      if (result.refused === 'invalid-email') {\n        res.status(400).json({ error: 'Enter a valid email address.' })\n        return\n      }\n      // The person was erased from this workspace (AGL-2623). A conflict,\n      // like the band: the request was well-formed and the answer is a\n      // standing fact about the address, not a fault in the call.\n      if (result.refused === 'erased') {\n        res.status(409).json({ error: CONTACT_ERASED_MESSAGE, reason: 'erased' })\n        return\n      }\n      res.status(500).json({ error: 'The contact could not be saved.' })\n      return\n    }\n\n    if (tags.length || companyName) {\n      const group = await consentGroupForSite(\n        hostId,\n        resolved.org as Record<string, unknown>,\n      )\n      const contacts = await orgDataCollectionForHost(hostId, 'contacts')\n      await contacts.doc(result.contactId).update({\n        ...(tags.length\n          ? {\n              [contactFacetPath(group.groupId, 'tags')]: FieldValue.arrayUnion(\n                ...tags,\n              ),\n            }\n          : {}),\n        ...(companyName\n          ? {\n              [contactFacetPath(group.groupId, 'companyName')]: companyName,\n              // The search echo — see `HostContact.companyName`.\n              companyName,\n            }\n          : {}),\n        updatedAt: FieldValue.serverTimestamp(),\n      })\n    }\n\n    /*\n     * The audit line, written HERE rather than by the console (AGL-2622):\n     * a route that verified the caller and performed the write is the one\n     * writer that cannot record an act that did not happen, which is the\n     * reason `check-activity-coverage.mjs` counts this file. A merge into\n     * a person the org already held is said to be one — the row was\n     * updated, not added — so the feed cannot claim two people for one.\n     */\n    await logHostActivity(\n      hostId,\n      { uid: decoded.uid, email: decoded.email ?? null },\n      result.created ? 'Added contact' : 'Updated contact',\n      { type: 'contact', id: result.contactId, name: name || email },\n    )\n\n    res\n      .status(result.created ? 201 : 200)\n      .json({ contactId: result.contactId, created: result.created })\n  } catch (error) {\n    console.error('[crm] contact create failed', error)\n    res.status(500).json({ error: 'The contact could not be saved.' })\n  }\n}\n\n/** Console API registration, named in `plugins.config.json` as `consoleApi`. */\nexport function registerCrmConsoleApi(): void {\n  /*\n   * The contact-capture writer, again (AGL-3080). Both apps run it at boot\n   * from their generated server-declarations manifest, and this is the\n   * backstop for a process whose boot did not: the first CRM door to load\n   * registers it. Registering twice replaces in place.\n   */\n  registerCrmServerDeclarations()\n  registerPluginApiRoute(CRM_API_ROUTES.ping, crmPingHandler)\n  registerPluginApiRoute(CRM_API_ROUTES.contactStage, contactStageHandler)\n  // Every other console write to a contact's facets (AGL-2804): the rules\n  // cannot tell one facet field from another, so the plan is asked here.\n  registerPluginApiRoute(CRM_API_ROUTES.contactUpdate, crmContactUpdateHandler)\n  // A company's contacts unlinked, then the company (AGL-2804): the unlink\n  // clears a facet, which is the server's to write.\n  registerPluginApiRoute(CRM_API_ROUTES.companyDelete, crmCompanyDeleteHandler)\n  // Tasks (AGL-2599): the two writes with a side effect outside the document\n  // — an assignee's notification, and the `taskCompleted` host event.\n  registerPluginApiRoute(CRM_TASK_ROUTES.save, crmTaskSaveHandler)\n  registerPluginApiRoute(CRM_TASK_ROUTES.complete, crmTaskCompleteHandler)\n  // A client-direct task write's door to `nextTaskAtMs` (AGL-2661).\n  registerPluginApiRoute(CRM_NEXT_ACTIVITY_ROUTE, crmNextActivityHandler)\n  // One chunk of a contact file (AGL-2602), judged and written through the\n  // same door every capture uses.\n  registerPluginApiRoute('crm/contacts-import', crmContactsImportHandler)\n  // One chunk of a companies file (AGL-2621), matched by domain then name\n  // and written with the stamp every CRM creator writes.\n  registerPluginApiRoute('crm/companies-import', crmCompaniesImportHandler)\n  // One chunk of a deals file and one of a tasks file (AGL-2662): the\n  // pipeline, the stage and the assignee resolved by name, a row refused\n  // when the org has no such name.\n  registerPluginApiRoute('crm/deals-import', crmDealsImportHandler)\n  registerPluginApiRoute('crm/tasks-import', crmTasksImportHandler)\n  // One chunk of a leads file (AGL-2701), written through `addHostLead` —\n  // the same door a sign-up, a booking and a form submission file a lead\n  // through, so an imported row is keyed, bounded and unconsented exactly\n  // as a captured one is.\n  registerPluginApiRoute('crm/leads-import', crmLeadsImportHandler)\n  // The one writer of a deal's stage, won and lost (AGL-2598): the browser\n  // could write the field, but only a server can emit the event an\n  // automation listens for.\n  registerPluginApiRoute('crm/deal-stage', crmDealStageHandler)\n  // A person typed into the console (AGL-2596): the capture doors' own\n  // function behind a session check, so the dedupe and the band are judged\n  // where every other door judges them.\n  registerPluginApiRoute('crm/contacts-create', crmContactsCreateHandler)\n  // A lead becomes a contact, a company and a deal (AGL-2608) — the one CRM\n  // write a browser cannot make alone, because only the server may create a\n  // contact through the dedupe-and-meter door.\n  registerPluginApiRoute('crm/lead-convert', leadConvertHandler)\n  // A lead entered by hand (AGL-3231): the New lead drawer's route.\n  registerPluginApiRoute('crm/leads-create', leadCreateHandler)\n  // The one READ behind a route (AGL-2616): the per-recipient delivery log\n  // is closed to clients, so a contact's campaign mail is projected here.\n  registerPluginApiRoute(CONTACT_EMAIL_HISTORY_ROUTE, contactEmailHistoryHandler)\n  // One email to one person from their record (AGL-2615): the recipient is\n  // read off the record, the daily cap and both suppression lists are\n  // judged, and the message leaves on the site's sending identity.\n  registerPluginApiRoute(CRM_API_ROUTES.emailSend, crmEmailSendHandler)\n  // Two records for one person become one (AGL-2625): the repoint of every\n  // row naming the merged record and the transaction over both documents\n  // are the server's, and the address index it writes is closed to clients.\n  registerPluginApiRoute(CONTACTS_MERGE_ROUTE, contactsMergeHandler)\n  // Files a person's privacy erasure for the daily job (AGL-2623);\n  // workspace admins only.\n  registerPluginApiRoute(CRM_ERASE_PERSON_ROUTE, crmErasePersonHandler)\n  // One line in the organization's activity feed for an act the org-level\n  // hub performed client-direct (AGL-2634): the feed is closed to clients,\n  // so the bulk bars' lines come through here.\n  registerPluginApiRoute(CRM_ORG_ACTIVITY_ROUTE, crmOrgActivityHandler)\n  // A recipe's action written into one site's automations from the org\n  // hub (AGL-2639), stamped and deduplicated by the server, and the stamps\n  // read back per site so the hub can say which sites carry which recipe.\n  registerPluginApiRoute(CRM_RECIPE_INSTALL_ROUTE, crmRecipeInstallHandler)\n  registerPluginApiRoute(CRM_RECIPE_STATUS_ROUTE, crmRecipeStatusHandler)\n  // The workspace's email capture address (AGL-2657): the token is minted\n  // and rotated here, behind the CRM's own gate, and the org document that\n  // carries it is closed to every client.\n  registerPluginApiRoute(CRM_INBOUND_ADDRESS_ROUTE, crmInboundAddressHandler)\n  registerPluginApiRoute(\n    CRM_EMAIL_TEMPLATE_DUPLICATE_ROUTE,\n    crmEmailTemplateDuplicateHandler,\n  )\n  // The facts of a contact, company, deal or lead, and an import's field\n  // catalog, for another plugin in this process (AGL-2917): read on the core's\n  // record-facts seam under the rules every CRM door applies, and written\n  // nowhere.\n  registerCrmRecordFactsReaders()\n  // The CRM as the workspace's record system on the core's record-timeline\n  // seam (AGL-2981): another plugin files an email, a reply or a task on a\n  // record through it, under the CRM's own scope, dedupe and ceiling.\n  registerCrmRecordTimelineWriter()\n  // And on the record email-state seam (AGL-3245): a sender that filed a\n  // verdict on an address — a bounce, a complaint, an unsubscribe, a\n  // do-not-contact mark — stamps the lead and the contact through it.\n  registerCrmRecordEmailStateWriter()\n}\n"],"names":["CONTACT_ERASED_MESSAGE","contactFacetPath","CRM_COLLECTIONS","crmReadTokens","isContactLifecycleStage","isOrgWideMember","normalizeAddress","normalizeContactEmail","normalizePhone","readContactFacet","registerPluginApiRoute","visibleToHost","consentGroupForSite","firebaseAdmin","getOrgForHost","logHostActivity","memberHasOrgPermission","orgDataCollectionForHost","resolveOrgMembership","isRefusedIdToken","captureHostContact","emitHostEvent","FieldValue","CRM_API_ROUTES","registerCrmServerDeclarations","BUNDLE_ID","CRM_NEXT_ACTIVITY_ROUTE","CRM_TASK_ROUTES","crmNextActivityHandler","registerCrmRecordEmailStateWriter","registerCrmRecordTimelineWriter","crmTaskCompleteHandler","crmTaskSaveHandler","crmCompaniesImportHandler","crmContactsImportHandler","crmDealsImportHandler","crmLeadsImportHandler","crmTasksImportHandler","crmDealStageHandler","crmEmailSendHandler","leadConvertHandler","leadCreateHandler","CONTACT_EMAIL_HISTORY_ROUTE","contactEmailHistoryHandler","CONTACTS_MERGE_ROUTE","contactsMergeHandler","CRM_ERASE_PERSON_ROUTE","crmErasePersonHandler","CRM_ORG_ACTIVITY_ROUTE","crmOrgActivityHandler","CRM_INBOUND_ADDRESS_ROUTE","crmInboundAddressHandler","crmCompanyDeleteHandler","CONTACT_PHONE_REFUSAL","normalizeTags","typed","crmContactUpdateHandler","CRM_EMAIL_TEMPLATE_DUPLICATE_ROUTE","crmEmailTemplateDuplicateHandler","registerCrmRecordFactsReaders","crmSuiteRefusal","CRM_RECIPE_INSTALL_ROUTE","CRM_RECIPE_STATUS_ROUTE","crmRecipeInstallHandler","crmRecipeStatusHandler","crmPingHandler","req","res","method","setHeader","status","json","error","ok","plugin","authorizeSiteEditor","hostId","hostSnapshot","authorization","String","headers","idToken","startsWith","slice","length","undefined","uid","app","auth","verifyIdToken","console","firestore","collection","doc","get","exists","memberRole","contactStageHandler","body","trim","contactId","requested","lifecycleStage","clearing","caller","facet","owner","suite","org","contactsRef","snapshot","group","data","groupId","previousStage","changed","ref","update","delete","updatedAt","serverTimestamp","email","CONTACT_BAND_FULL_MESSAGE","crmContactsCreateHandler","rawPhone","phone","rawStage","name","jobTitle","companyName","companyId","ownerUid","address","tags","marketingConsent","decoded","resolved","isStaff","member","membership","orgId","reaches","Boolean","hostAccess","allowed","readable","Set","companySnapshot","companies","tokens","visible","Array","isArray","some","token","has","result","source","interaction","summary","refused","reason","contacts","arrayUnion","created","type","id","registerCrmConsoleApi","ping","contactStage","contactUpdate","companyDelete","save","complete","emailSend"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCC,GAED,SACEA,sBAAsB,EACtBC,gBAAgB,EAChBC,eAAe,EACfC,aAAa,EACbC,uBAAuB,EACvBC,eAAe,EACfC,gBAAgB,EAChBC,qBAAqB,EACrBC,cAAc,EAIdC,gBAAgB,EAChBC,sBAAsB,EACtBC,aAAa,QACR,sBAAqB;AAC5B,SACEC,mBAAmB,EACnBC,aAAa,EACbC,aAAa,EACbC,eAAe,EACfC,sBAAsB,EACtBC,wBAAwB,EACxBC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,gBAAgB,QAAQ,mDAAkD;AACnF,SAASC,kBAAkB,EAAEC,aAAa,QAAQ,wBAAuB;AACzE,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,cAAc,QAAQ,4BAAwB;AACvD,SAASC,6BAA6B,QAAQ,2BAAuB;AACrE,SAASC,SAAS,QAAQ,+BAA2B;AACrD,SAASC,uBAAuB,QAAQ,2BAAuB;AAC/D,SAASC,eAAe,QAAQ,yBAAqB;AACrD,SAASC,sBAAsB,QAAQ,mCAA+B;AACtE,SAASC,iCAAiC,QAAQ,iCAA6B;AAC/E,SAASC,+BAA+B,QAAQ,8BAA0B;AAC1E,SAASC,sBAAsB,EAAEC,kBAAkB,QAAQ,0BAAsB;AACjF,SAASC,yBAAyB,QAAQ,+BAA2B;AACrE,SAASC,wBAAwB,QAAQ,8BAA0B;AACnE,SAASC,qBAAqB,QAAQ,2BAAuB;AAC7D,SAASC,qBAAqB,QAAQ,2BAAuB;AAC7D,SAASC,qBAAqB,QAAQ,2BAAuB;AAC7D,SAASC,mBAAmB,QAAQ,yBAAqB;AACzD,SAASC,mBAAmB,QAAQ,yBAAqB;AACzD,SAASC,kBAAkB,QAAQ,2BAAuB;AAC1D,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SACEC,2BAA2B,EAC3BC,0BAA0B,QACrB,oCAAgC;AACvC,SAASC,oBAAoB,EAAEC,oBAAoB,QAAQ,6BAAyB;AACpF,SAASC,sBAAsB,EAAEC,qBAAqB,QAAQ,2BAAuB;AACrF,SAASC,sBAAsB,EAAEC,qBAAqB,QAAQ,2BAAuB;AACrF,SAASC,yBAAyB,EAAEC,wBAAwB,QAAQ,8BAA0B;AAC9F,SAASC,uBAAuB,QAAQ,6BAAyB;AACjE,SAASC,qBAAqB,EAAEC,aAAa,EAAEC,KAAK,QAAQ,8BAA0B;AACtF,SAASC,uBAAuB,QAAQ,6BAAyB;AACjE,SACEC,kCAAkC,EAClCC,gCAAgC,QAC3B,uCAAmC;AAC1C,SAASC,6BAA6B,QAAQ,2BAAuB;AACrE,SAASC,eAAe,QAAQ,yBAAqB;AACrD,SACEC,wBAAwB,EACxBC,uBAAuB,EACvBC,uBAAuB,EACvBC,sBAAsB,QACjB,4BAAwB;AAE/B;;;;;;;CAOC,GACD,OAAO,MAAMC,iBAAmC,CAACC,KAAKC;IACpD,IAAID,IAAIE,MAAM,KAAK,OAAO;QACxBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACnD;IACF;IACAL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEE,IAAI;QAAMC,QAAQjD;IAAU;AACrD,EAAC;AAID;;;;;;;;;CASC,GACD,eAAekD,oBACbT,GAAqB,EACrBU,MAAc;QAEeV,4BAwBTW;IAxBpB,MAAMC,gBAAgBC,QAAOb,6BAAAA,IAAIc,OAAO,CAACF,aAAa,YAAzBZ,6BAA6B;IAC1D,MAAMe,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAO;QAAER,IAAI;QAAOH,QAAQ;QAAKE,OAAO;IAAkB;IACxE,IAAIc;IACJ,IAAI;QACFA,MAAM,AAAC,CAAA,MAAMzE,cAAc0E,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACR,QAAO,EAAGK,GAAG;IACrE,EAAE,OAAOd,OAAO;QACd,sEAAsE;QACtE,mCAAmC;QACnC,IAAIrD,iBAAiBqD,QAAQ,OAAO;YAAEC,IAAI;YAAOH,QAAQ;YAAKE,OAAO;QAAkB;QACvFkB,QAAQlB,KAAK,CAAC,+CAA+CA;QAC7D,OAAO;YAAEC,IAAI;YAAOH,QAAQ;YAAKE,OAAO;QAA+C;IACzF;IACA,MAAMK,eAAe,MAAMhE,cACxB0E,GAAG,GACHI,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAACjB,QACJkB,GAAG;IACN,IAAI,CAACjB,aAAakB,MAAM,EAAE;QACxB,OAAO;YAAEtB,IAAI;YAAOH,QAAQ;YAAKE,OAAO;QAAe;IACzD;IACA,MAAMwB,aAAa,EAACnB,oBAAAA,aAAaiB,GAAG,CAAC,0BAAjBjB,oBAAmC,CAAC,EAAE,CAACS,IAAI;IAC/D,IAAIU,eAAe,WAAWA,eAAe,UAAU;QACrD,OAAO;YAAEvB,IAAI;YAAOH,QAAQ;YAAKE,OAAO;QAA6B;IACvE;IACA,OAAO;QAAEC,IAAI;QAAMa;IAAI;AACzB;AAEA;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,OAAO,MAAMW,sBAAwC,OAAO/B,KAAKC;;QAMzCD,WACGA,YACEA;IAP3B,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACnD;IACF;IACA,MAAMI,SAASG,gBAAOb,YAAAA,IAAIgC,IAAI,qBAARhC,UAAUU,MAAM,mBAAI,IAAIuB,IAAI;IAClD,MAAMC,YAAYrB,iBAAOb,aAAAA,IAAIgC,IAAI,qBAARhC,WAAUkC,SAAS,oBAAI,IAAID,IAAI;IACxD,MAAME,aAAqBnC,aAAAA,IAAIgC,IAAI,qBAARhC,WAAUoC,cAAc;IACnD,IAAI,CAAC1B,UAAU,CAACwB,WAAW;QACzBjC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA8B;QAC5D;IACF;IACA,sEAAsE;IACtE,MAAM+B,WAAWF,cAAc;IAC/B,MAAMC,iBAAiBC,WACnB,KACAnG,wBAAwBiG,aACtBA,YACA;IACN,IAAIC,mBAAmB,MAAM;QAC3BnC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAyB;QACvD;IACF;IACA,MAAMgC,SAAS,MAAM7B,oBAAoBT,KAAKU;IAC9C,IAAI4B,OAAO/B,EAAE,KAAK,OAAO;QACvBN,IAAIG,MAAM,CAACkC,OAAOlC,MAAM,EAAEC,IAAI,CAAC;YAAEC,OAAOgC,OAAOhC,KAAK;QAAC;QACrD;IACF;IACA,IAAI;YAuBoBiC;QAtBtB,qEAAqE;QACrE,MAAMC,QAAQ,MAAM5F,cAAc8D;QAClC,IAAI,CAAC8B,OAAO;YACVvC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;YAC7C;QACF;QACA,MAAMmC,QAAQ/C,gBAAgB8C,MAAME,GAAG,EAAE;QACzC,IAAID,OAAO;YACTxC,IAAIG,MAAM,CAACqC,MAAMrC,MAAM,EAAEC,IAAI,CAACoC,MAAMT,IAAI;YACxC;QACF;QACA,MAAMW,cAAc,MAAM5F,yBAAyB2D,QAAQ;QAC3D,MAAMkC,WAAW,MAAMD,YAAYhB,GAAG,CAACO,WAAWN,GAAG;QACrD,IAAI,CAACgB,SAASf,MAAM,IAAI,CAACpF,cAAcmG,SAAShB,GAAG,CAAC,cAAclB,SAAS;YACzET,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkB;YAChD;QACF;QACA,MAAMuC,QAAQ,MAAMnG,oBAAoBgE;QACxC,MAAM6B,QAAQhG,iBACZqG,SAASE,IAAI,IACbD,MAAME,OAAO;QAEf,MAAMC,iBAAgBT,wBAAAA,MAAMH,cAAc,YAApBG,wBAAwB;QAC9C,IAAIS,kBAAkBZ,gBAAgB;YACpCnC,IACGG,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAEE,IAAI;gBAAM0C,SAAS;gBAAOb;gBAAgBY;YAAc;YAClE;QACF;QACA,MAAMJ,SAASM,GAAG,CAACC,MAAM,CAAC;YACxB,CAACpH,iBAAiB8G,MAAME,OAAO,EAAE,kBAAkB,EAAEV,WACjDjF,WAAWgG,MAAM,KACjBhB;YACJiB,WAAWjG,WAAWkG,eAAe;QACvC;QACA,uEAAuE;QACvE,yEAAyE;QACzE,IAAI,CAACjB,UAAU;gBAGGO;YAFhB,MAAMzF,cAAcuD,QAAQ,uBAAuB;gBACjDwB;gBACAqB,OAAO1C,QAAO+B,gBAAAA,SAAShB,GAAG,CAAC,oBAAbgB,gBAAyB;gBACvCR;gBACAY;YACF;QACF;QACA/C,IACGG,MAAM,CAAC,KACPC,IAAI,CAAC;YAAEE,IAAI;YAAM0C,SAAS;YAAMb;YAAgBY;QAAc;IACnE,EAAE,OAAO1C,OAAO;QACdkB,QAAQlB,KAAK,CAAC,8BAA8BI,QAAQwB,WAAW5B;QAC/DL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiC;IACjE;AACF,EAAC;AAED;;;;;;;CAOC,GACD,OAAO,MAAMkD,4BACX,4EACA,sBAAqB;AAEvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkDC,GACD,OAAO,MAAMC,2BAA6C,OAAOzD,KAAKC;QAOtDD,WAkCeA;IAxC7B,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACnD;IACF;IAEA,MAAM0B,QAAQhC,YAAAA,IAAIgC,IAAI,YAARhC,YAAY,CAAC;IAC3B,MAAMU,SAASrB,MAAM2C,IAAI,CAAC,SAAS,EAAE;IACrC,IAAI,CAACtB,QAAQ;QACXT,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;QAC/C;IACF;IACA,MAAMiD,QAAQlH,sBAAsB2F,IAAI,CAAC,QAAQ;IACjD,IAAI,CAACuB,OAAO;QACVtD,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA+B;QAC7D;IACF;IACA,MAAMoD,WAAWrE,MAAM2C,IAAI,CAAC,QAAQ,EAAE;IACtC,MAAM2B,QAAQD,WAAWpH,eAAeoH,YAAY;IACpD,IAAIA,YAAY,CAACC,OAAO;QACtB1D,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOnB;QAAsB;QACpD;IACF;IACA,MAAMyE,WAAWvE,MAAM2C,IAAI,CAAC,iBAAiB,EAAE;IAC/C,IAAI4B,YAAY,CAAC1H,wBAAwB0H,WAAW;QAClD3D,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA2B;QACzD;IACF;IACA,MAAMuD,OAAOxE,MAAM2C,IAAI,CAAC,OAAO,EAAE;IACjC,MAAM8B,WAAWzE,MAAM2C,IAAI,CAAC,WAAW,EAAE;IACzC,IAAI+B,cAAc1E,MAAM2C,IAAI,CAAC,cAAc,EAAE;IAC7C,MAAMgC,YAAY3E,MAAM2C,IAAI,CAAC,YAAY,EAAE;IAC3C,MAAMiC,WAAW5E,MAAM2C,IAAI,CAAC,WAAW,EAAE;IACzC,MAAMkC,UACJlC,IAAI,CAAC,UAAU,IAAI,OAAOA,IAAI,CAAC,UAAU,KAAK,WAC1C5F,iBAAiB4F,IAAI,CAAC,UAAU,IAChC;IACN,MAAMmC,OAAO/E,cAAc4C,IAAI,CAAC,OAAO;IACvC,MAAMoC,mBAAmBpC,IAAI,CAAC,mBAAmB,KAAK;IAEtD,MAAMpB,gBAAgBC,QAAOb,6BAAAA,IAAIc,OAAO,CAACF,aAAa,YAAzBZ,6BAA6B;IAC1D,MAAMe,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS;QACZd,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkB;QAChD;IACF;IAEA,IAAI;YAqI2B+D;QApI7B,MAAMA,UAAU,MAAM1H,cAAc0E,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACR;QAC/D,MAAMuD,WAAW,MAAM1H,cAAc8D;QACrC,IAAI,CAAC4D,UAAU;YACbrE,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;YAC7C;QACF;QACA,MAAMiE,UAAUF,OAAO,CAAC,QAAQ,KAAK;QACrC,IAAI,CAACE,SAAS;;gBAIyBC;YAHrC,MAAMC,aAAa,MAAMzH,qBAAqBqH,QAAQjD,GAAG,EAAEkD,SAASI,KAAK;YACzE,MAAMF,iBAASC,8BAAAA,WAAYD,MAAM,mBAAI;YACrC,MAAMG,UACJxI,gBAAgBqI,WAAWI,QAAQJ,2BAAAA,qBAAAA,OAAQK,UAAU,qBAAlBL,kBAAoB,CAAC9D,OAAO;YACjE,MAAMoE,UACJN,UACAG,WACC,MAAM7H,uBAAuBwH,SAASI,KAAK,EAAEF,QAAQ;YACxD,IAAI,CAACM,SAAS;gBACZ7E,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBACnBC,OAAO;gBACT;gBACA;YACF;QACF;QAEA,uEAAuE;QACvE,wEAAwE;QACxE,MAAMmC,QAAQ/C,gBAAgB4E,SAAS5B,GAAG,EAAE;QAC5C,IAAID,OAAO;YACTxC,IAAIG,MAAM,CAACqC,MAAMrC,MAAM,EAAEC,IAAI,CAACoC,MAAMT,IAAI;YACxC;QACF;QAEA,IAAIgC,WAAW;YACb,MAAMnB,QAAQ,MAAMnG,oBAClBgE,QACA4D,SAAS5B,GAAG;YAEd,MAAMqC,WAAW,IAAIC,IAAY/I,cAAc4G;YAC/C,MAAMoC,kBAAkB,MAAMtI,cAC3B0E,GAAG,GACHI,SAAS,GACTC,UAAU,CAAC,QACXC,GAAG,CAAC2C,SAASI,KAAK,EAClBhD,UAAU,CAAC1F,gBAAgBkJ,SAAS,EACpCvD,GAAG,CAACqC,WACJpC,GAAG;YACN,MAAMuD,SAAkBF,gBAAgBpD,MAAM,GAC1CoD,gBAAgBrD,GAAG,CAAC,eACpBT;YACJ,MAAMiE,UACJC,MAAMC,OAAO,CAACH,WAAWA,OAAOI,IAAI,CAAC,CAACC,QAAUT,SAASU,GAAG,CAAC5E,OAAO2E;YACtE,IAAI,CAACJ,SAAS;gBACZnF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAO;gBAAkB;gBAChD;YACF;YACAyD,cAAc1E,MAAM4F,gBAAgBrD,GAAG,CAAC,SAAS,QAAQmC;QAC3D;QAEA,MAAM2B,SAAS,MAAMxI,mBAAmB;YACtCwD;YACA6C;WACIM,OAAO;YAAEA;QAAK,IAAI,CAAC;YACvB8B,QAAQ;YACRC,aAAa;gBAAEC,SAAS;YAAgB;YACxCzB;YACA7B,OAAO,aACDoB,QAAQ;gBAAEA;YAAM,IAAI,CAAC,GACrBG,WAAW;gBAAEA;YAAS,IAAI,CAAC,GAC3BE,YAAY;gBAAEA;YAAU,IAAI,CAAC,GAC7BE,UAAU;gBAAEA;YAAQ,IAAI,CAAC,GACzBD,WAAW;gBAAEA;YAAS,IAAI,CAAC,GAC3BL,YAAY1H,wBAAwB0H,YACpC;gBAAExB,gBAAgBwB;YAAS,IAC3B,CAAC;;QAIT,IAAI,aAAa8B,QAAQ;YACvB,IAAIA,OAAOI,OAAO,KAAK,QAAQ;gBAC7B7F,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAOkD;oBAA2BuC,QAAQ;gBAAO;gBACxE;YACF;YACA,IAAIL,OAAOI,OAAO,KAAK,iBAAiB;gBACtC7F,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAO;gBAA+B;gBAC7D;YACF;YACA,oEAAoE;YACpE,iEAAiE;YACjE,4DAA4D;YAC5D,IAAIoF,OAAOI,OAAO,KAAK,UAAU;gBAC/B7F,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAOxE;oBAAwBiK,QAAQ;gBAAS;gBACvE;YACF;YACA9F,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkC;YAChE;QACF;QAEA,IAAI6D,KAAKjD,MAAM,IAAI6C,aAAa;YAC9B,MAAMlB,QAAQ,MAAMnG,oBAClBgE,QACA4D,SAAS5B,GAAG;YAEd,MAAMsD,WAAW,MAAMjJ,yBAAyB2D,QAAQ;YACxD,MAAMsF,SAASrE,GAAG,CAAC+D,OAAOxD,SAAS,EAAEiB,MAAM,CAAC,aACtCgB,KAAKjD,MAAM,GACX;gBACE,CAACnF,iBAAiB8G,MAAME,OAAO,EAAE,QAAQ,EAAE3F,WAAW6I,UAAU,IAC3D9B;YAEP,IACA,CAAC,GACDJ,cACA;gBACE,CAAChI,iBAAiB8G,MAAME,OAAO,EAAE,eAAe,EAAEgB;gBAClD,mDAAmD;gBACnDA;YACF,IACA,CAAC;gBACLV,WAAWjG,WAAWkG,eAAe;;QAEzC;QAEA;;;;;;;KAOC,GACD,MAAMzG,gBACJ6D,QACA;YAAEU,KAAKiD,QAAQjD,GAAG;YAAEmC,KAAK,GAAEc,iBAAAA,QAAQd,KAAK,YAAbc,iBAAiB;QAAK,GACjDqB,OAAOQ,OAAO,GAAG,kBAAkB,mBACnC;YAAEC,MAAM;YAAWC,IAAIV,OAAOxD,SAAS;YAAE2B,MAAMA,QAAQN;QAAM;QAG/DtD,IACGG,MAAM,CAACsF,OAAOQ,OAAO,GAAG,MAAM,KAC9B7F,IAAI,CAAC;YAAE6B,WAAWwD,OAAOxD,SAAS;YAAEgE,SAASR,OAAOQ,OAAO;QAAC;IACjE,EAAE,OAAO5F,OAAO;QACdkB,QAAQlB,KAAK,CAAC,+BAA+BA;QAC7CL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkC;IAClE;AACF,EAAC;AAED,8EAA8E,GAC9E,OAAO,SAAS+F;IACd;;;;;GAKC,GACD/I;IACAd,uBAAuBa,eAAeiJ,IAAI,EAAEvG;IAC5CvD,uBAAuBa,eAAekJ,YAAY,EAAExE;IACpD,wEAAwE;IACxE,uEAAuE;IACvEvF,uBAAuBa,eAAemJ,aAAa,EAAElH;IACrD,yEAAyE;IACzE,kDAAkD;IAClD9C,uBAAuBa,eAAeoJ,aAAa,EAAEvH;IACrD,2EAA2E;IAC3E,oEAAoE;IACpE1C,uBAAuBiB,gBAAgBiJ,IAAI,EAAE5I;IAC7CtB,uBAAuBiB,gBAAgBkJ,QAAQ,EAAE9I;IACjD,kEAAkE;IAClErB,uBAAuBgB,yBAAyBE;IAChD,yEAAyE;IACzE,gCAAgC;IAChClB,uBAAuB,uBAAuBwB;IAC9C,wEAAwE;IACxE,uDAAuD;IACvDxB,uBAAuB,wBAAwBuB;IAC/C,oEAAoE;IACpE,uEAAuE;IACvE,iCAAiC;IACjCvB,uBAAuB,oBAAoByB;IAC3CzB,uBAAuB,oBAAoB2B;IAC3C,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,wBAAwB;IACxB3B,uBAAuB,oBAAoB0B;IAC3C,yEAAyE;IACzE,iEAAiE;IACjE,0BAA0B;IAC1B1B,uBAAuB,kBAAkB4B;IACzC,qEAAqE;IACrE,yEAAyE;IACzE,sCAAsC;IACtC5B,uBAAuB,uBAAuBiH;IAC9C,0EAA0E;IAC1E,0EAA0E;IAC1E,6CAA6C;IAC7CjH,uBAAuB,oBAAoB8B;IAC3C,kEAAkE;IAClE9B,uBAAuB,oBAAoB+B;IAC3C,yEAAyE;IACzE,wEAAwE;IACxE/B,uBAAuBgC,6BAA6BC;IACpD,yEAAyE;IACzE,oEAAoE;IACpE,iEAAiE;IACjEjC,uBAAuBa,eAAeuJ,SAAS,EAAEvI;IACjD,yEAAyE;IACzE,uEAAuE;IACvE,0EAA0E;IAC1E7B,uBAAuBkC,sBAAsBC;IAC7C,iEAAiE;IACjE,yBAAyB;IACzBnC,uBAAuBoC,wBAAwBC;IAC/C,wEAAwE;IACxE,yEAAyE;IACzE,6CAA6C;IAC7CrC,uBAAuBsC,wBAAwBC;IAC/C,qEAAqE;IACrE,yEAAyE;IACzE,wEAAwE;IACxEvC,uBAAuBmD,0BAA0BE;IACjDrD,uBAAuBoD,yBAAyBE;IAChD,wEAAwE;IACxE,yEAAyE;IACzE,wCAAwC;IACxCtD,uBAAuBwC,2BAA2BC;IAClDzC,uBACE+C,oCACAC;IAEF,uEAAuE;IACvE,6EAA6E;IAC7E,wEAAwE;IACxE,WAAW;IACXC;IACA,yEAAyE;IACzE,yEAAyE;IACzE,oEAAoE;IACpE7B;IACA,uEAAuE;IACvE,mEAAmE;IACnE,oEAAoE;IACpED;AACF"}