@aglyn/plugins-crm 1.0.0-beta.164 → 1.0.0-beta.166

package/src/lib/server/record-facts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/record-facts.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  registerPluginRecordFactsReader,\n  type PluginRecordFactsRead,\n  type PluginRecordFactsReader,\n  type PluginRecordFactsRequest,\n} from '@aglyn/aglyn/plugin-manager/plugin-record-facts'\nimport {\n  CRM_COLLECTIONS,\n  contactPrimaryGroup,\n  crmReadTokens,\n  isOrgWideMember,\n  type ConsentGroup,\n  type ContactFieldDefinition,\n  type CrmActivity,\n  type CrmCompany,\n  type CrmDeal,\n  type CrmPipeline,\n  type CrmTask,\n} from '@aglyn/aglyn/server'\nimport {\n  consentGroupForSite,\n  firebaseAdmin,\n  getOrgDoc,\n  memberHasOrgPermission,\n  resolveOrgIdForHost,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin'\nimport { BUNDLE_ID } from '../constants/bundle-common'\nimport {\n  CRM_IMPORT_FACTS_RESOURCE,\n  CRM_RECORD_FACTS_RESOURCES,\n  companyFacts,\n  contactFacts,\n  dealFacts,\n  importFacts,\n  isCrmImportFactsCollection,\n  leadFacts,\n  type CrmRecordFactsKind,\n} from '../model/record-facts'\nimport { crmSuiteRefusal } from './suite-gate'\n\n/**\n * THE CRM'S READERS ON THE CORE'S RECORD-FACTS SEAM (AGL-2917).\n *\n * Another plugin asks for a contact, a company, a deal, a lead or an import's\n * field catalog by resource name, and gets the facts `model/record-facts.ts`\n * reports — read here with the rules every other CRM door applies, for the\n * member the caller names:\n *\n *  1. the site belongs to the organization;\n *  2. the member reaches it — an org-wide member at the organization level, a\n *     member of that site under it — and holds `data.manage`, the key the\n *     whole CRM is gated on. A verified staff caller passes, as at every CRM\n *     route;\n *  3. the organization's plan carries the CRM, asked after the caller is\n *     known, the order `suite-gate.ts` gives;\n *  4. the record exists and is visible where it is read: under a site, its\n *     `visibleTo` meets the site's read tokens, as the console's listeners\n *     filter; at the organization level every row is the member's;\n *  5. what hangs off it — its logged activity, its tasks, its deals — is held\n *     to the same visibility, row by row.\n *\n * A caller in the same process skips the plugin API dispatcher, and with it\n * the dispatcher's per-site enablement, release flag, lockdown and rate\n * limit; those are the caller's to establish before it asks (the AI plugin's\n * CRM admission does). Nothing here writes.\n */\n\ntype Firestore = FirebaseFirestore.Firestore\ntype Data = Record<string, unknown>\ntype Refusal = { ok: false; status: 400 | 403 | 404; error: string }\n\n/** The org collection a contact lives in, beside the CRM's own. */\nconst CONTACTS_COLLECTION = 'contacts'\n\n/** Logged activities read per record before visibility and the timeline cut. */\nexport const CRM_FACTS_ACTIVITIES_READ = 40\n/** Tasks read per record, the record page's own window. */\nexport const CRM_FACTS_TASKS_READ = 50\n/** Deals read per contact or company. */\nexport const CRM_FACTS_DEALS_READ = 20\n/** Custom field definitions an import catalog reads. */\nexport const CRM_FACTS_FIELD_DEFINITIONS_READ = 100\n\nexport const CRM_FACTS_UNKNOWN_SITE = 'Unknown site'\nexport const CRM_FACTS_NOT_A_MEMBER = 'You are not a member of that organization'\nexport const CRM_FACTS_SITE_REFUSAL = 'Reading CRM records requires the data.manage permission on this site'\nexport const CRM_FACTS_ORG_REFUSAL =\n  'Reading CRM records across the organization requires the data.manage permission for the whole organization'\nexport const CRM_FACTS_LEAD_NEEDS_SITE = 'A lead is read on the site that captured it'\n\nconst NOT_FOUND: Record<CrmRecordFactsKind | 'import', string> = {\n  contact: 'This contact could not be found. It may have been deleted.',\n  company: 'This company could not be found. It may have been deleted.',\n  deal: 'This deal could not be found. It may have been deleted.',\n  lead: 'This lead could not be found. It may have been removed.',\n  import: 'There is no such import.',\n}\n\n/** Where a read runs, once the caller has been admitted. */\ninterface CrmFactsScope {\n  orgId: string\n  hostId: string | null\n  org: Data\n  /** The site's consent group under a site; `null` at the organization level. */\n  group: ConsentGroup | null\n  /** Whether a row's `visibleTo` is readable here. */\n  visible: (visibleTo: unknown) => boolean\n}\n\nfunction firestore(): Firestore {\n  return firebaseAdmin.app().firestore()\n}\n\n/**\n * Rules 1 to 3: the site, the member and the plan. A refusal names what the\n * member lacks in the words the console's own CRM doors use.\n */\nexport async function crmFactsScope(request: PluginRecordFactsRequest): Promise<CrmFactsScope | Refusal> {\n  const orgId = String(request.orgId ?? '').trim()\n  const hostId = request.hostId ? String(request.hostId).trim() : null\n  if (!orgId) return { ok: false, status: 400, error: 'Open a workspace first' }\n  if (hostId && (await resolveOrgIdForHost(hostId)) !== orgId) {\n    return { ok: false, status: 404, error: CRM_FACTS_UNKNOWN_SITE }\n  }\n  if (!request.staff) {\n    const membership = await resolveOrgMembership(request.uid, orgId).catch(() => null)\n    const member = membership?.orgId === orgId ? membership.member : null\n    if (!member) return { ok: false, status: 403, error: CRM_FACTS_NOT_A_MEMBER }\n    const reaches = hostId\n      ? isOrgWideMember(member) || Boolean(member.hostAccess?.[hostId])\n      : isOrgWideMember(member)\n    const allowed = reaches && (await memberHasOrgPermission(orgId, member, 'data.manage'))\n    if (!allowed) {\n      return { ok: false, status: 403, error: hostId ? CRM_FACTS_SITE_REFUSAL : CRM_FACTS_ORG_REFUSAL }\n    }\n  }\n  const org = ((request.org as Data | null) ?? ((await getOrgDoc(orgId)) as Data | null)) || null\n  if (!org) return { ok: false, status: 404, error: 'Unknown organization' }\n  const suite = crmSuiteRefusal(org, 'Reading a CRM record')\n  if (suite) return { ok: false, status: 403, error: suite.body.error }\n  if (!hostId) return { orgId, hostId: null, org, group: null, visible: () => true }\n  const group = await consentGroupForSite(hostId, org)\n  const readable = new Set<string>(crmReadTokens(group))\n  return {\n    orgId,\n    hostId,\n    org,\n    group,\n    visible: (visibleTo) =>\n      Array.isArray(visibleTo) && visibleTo.some((token) => readable.has(String(token))),\n  }\n}\n\nconst orgCollection = (orgId: string, name: string) =>\n  firestore().collection('orgs').doc(orgId).collection(name)\n\n/** Rows of an org collection naming one record, held to the scope's visibility. */\nasync function rowsNaming<T>(\n  scope: CrmFactsScope,\n  input: { collection: string; field: string; id: string; orderBy: string; direction: 'asc' | 'desc'; limit: number },\n): Promise<T[]> {\n  const snapshot = await orgCollection(scope.orgId, input.collection)\n    .where(input.field, '==', input.id)\n    .orderBy(input.orderBy, input.direction)\n    .limit(input.limit)\n    .get()\n  return snapshot.docs\n    .map((doc) => (doc.data() ?? {}) as Data)\n    .filter((row) => scope.visible(row['visibleTo'])) as T[]\n}\n\n/** The pipelines some deals name, by id, read once each. */\nasync function pipelinesFor(scope: CrmFactsScope, deals: ReadonlyArray<Partial<CrmDeal>>): Promise<Map<string, CrmPipeline>> {\n  const ids = [...new Set(deals.map((deal) => String(deal.pipelineId ?? '')).filter(Boolean))]\n  const snapshots = await Promise.all(ids.map((id) => orgCollection(scope.orgId, CRM_COLLECTIONS.pipelines).doc(id).get()))\n  return new Map(\n    snapshots\n      .filter((snapshot) => snapshot.exists)\n      .map((snapshot) => [snapshot.id, (snapshot.data() ?? {}) as CrmPipeline]),\n  )\n}\n\n/** A record document the scope may read, or `null`. */\nasync function visibleDoc(scope: CrmFactsScope, collection: string, id: string): Promise<Data | null> {\n  if (!id) return null\n  const snapshot = await orgCollection(scope.orgId, collection).doc(id).get()\n  const data = snapshot.exists ? ((snapshot.data() ?? {}) as Data) : null\n  return data && scope.visible(data['visibleTo']) ? data : null\n}\n\nconst refused = (kind: CrmRecordFactsKind | 'import', status: 400 | 404 = 404): Refusal => ({\n  ok: false,\n  status,\n  error: NOT_FOUND[kind],\n})\n\n/** A reader that admits the caller, then reads the record. */\nfunction reader(read: (scope: CrmFactsScope, request: PluginRecordFactsRequest) => Promise<PluginRecordFactsRead>): PluginRecordFactsReader {\n  return {\n    read: async (request) => {\n      const scope = await crmFactsScope(request)\n      if ('ok' in scope) return scope\n      return read(scope, request)\n    },\n  }\n}\n\nexport const crmContactFactsReader = reader(async (scope, request) => {\n  const id = String(request.id ?? '').trim()\n  const row = await visibleDoc(scope, CONTACTS_COLLECTION, id)\n  if (!row) return refused('contact')\n  const group = scope.group ?? contactPrimaryGroup(row, scope.org)\n  const naming = { field: 'contactId', id }\n  const [activities, tasks, deals] = await Promise.all([\n    rowsNaming<CrmActivity>(scope, { ...naming, collection: CRM_COLLECTIONS.activities, orderBy: 'atMs', direction: 'desc', limit: CRM_FACTS_ACTIVITIES_READ }),\n    rowsNaming<CrmTask>(scope, { ...naming, collection: CRM_COLLECTIONS.tasks, orderBy: 'dueAtMs', direction: 'asc', limit: CRM_FACTS_TASKS_READ }),\n    rowsNaming<CrmDeal>(scope, { ...naming, collection: CRM_COLLECTIONS.deals, orderBy: 'updatedAt', direction: 'desc', limit: CRM_FACTS_DEALS_READ }),\n  ])\n  const pipelines = await pipelinesFor(scope, deals)\n  return {\n    ok: true,\n    facts: { ...contactFacts({ row, group, activities, tasks, deals, pipelines, nowMs: request.now.getTime() }) },\n  }\n})\n\nexport const crmCompanyFactsReader = reader(async (scope, request) => {\n  const id = String(request.id ?? '').trim()\n  const company = await visibleDoc(scope, CRM_COLLECTIONS.companies, id)\n  if (!company) return refused('company')\n  const naming = { field: 'companyId', id }\n  const [activities, tasks, deals] = await Promise.all([\n    rowsNaming<CrmActivity>(scope, { ...naming, collection: CRM_COLLECTIONS.activities, orderBy: 'atMs', direction: 'desc', limit: CRM_FACTS_ACTIVITIES_READ }),\n    rowsNaming<CrmTask>(scope, { ...naming, collection: CRM_COLLECTIONS.tasks, orderBy: 'dueAtMs', direction: 'asc', limit: CRM_FACTS_TASKS_READ }),\n    rowsNaming<CrmDeal>(scope, { ...naming, collection: CRM_COLLECTIONS.deals, orderBy: 'updatedAt', direction: 'desc', limit: CRM_FACTS_DEALS_READ }),\n  ])\n  const pipelines = await pipelinesFor(scope, deals)\n  return {\n    ok: true,\n    facts: {\n      ...companyFacts({ company: company as Partial<CrmCompany>, activities, tasks, deals, pipelines, nowMs: request.now.getTime() }),\n    },\n  }\n})\n\nexport const crmDealFactsReader = reader(async (scope, request) => {\n  const id = String(request.id ?? '').trim()\n  const deal = (await visibleDoc(scope, CRM_COLLECTIONS.deals, id)) as (Partial<CrmDeal> & Data) | null\n  if (!deal) return refused('deal')\n  const naming = { field: 'dealId', id }\n  const [activities, tasks, pipelines] = await Promise.all([\n    rowsNaming<CrmActivity>(scope, { ...naming, collection: CRM_COLLECTIONS.activities, orderBy: 'atMs', direction: 'desc', limit: CRM_FACTS_ACTIVITIES_READ }),\n    rowsNaming<CrmTask>(scope, { ...naming, collection: CRM_COLLECTIONS.tasks, orderBy: 'dueAtMs', direction: 'asc', limit: CRM_FACTS_TASKS_READ }),\n    pipelinesFor(scope, [deal]),\n  ])\n  return {\n    ok: true,\n    facts: {\n      ...dealFacts({\n        deal,\n        pipeline: pipelines.get(String(deal.pipelineId ?? '')) ?? null,\n        activities,\n        tasks,\n        nowMs: request.now.getTime(),\n      }),\n    },\n  }\n})\n\nexport const crmLeadFactsReader = reader(async (scope, request) => {\n  if (!scope.hostId) return { ok: false, status: 400, error: CRM_FACTS_LEAD_NEEDS_SITE }\n  const id = String(request.id ?? '').trim()\n  if (!id) return refused('lead')\n  const snapshot = await firestore().collection('hosts').doc(scope.hostId).collection('leads').doc(id).get()\n  if (!snapshot.exists) return refused('lead')\n  const activities = await rowsNaming<CrmActivity>(scope, {\n    field: 'leadId',\n    id,\n    collection: CRM_COLLECTIONS.activities,\n    orderBy: 'atMs',\n    direction: 'desc',\n    limit: CRM_FACTS_ACTIVITIES_READ,\n  })\n  return { ok: true, facts: { ...leadFacts({ lead: (snapshot.data() ?? {}) as Data, activities }) } }\n})\n\nexport const crmImportFactsReader = reader(async (scope, request) => {\n  const collection = String(request.id ?? '').trim()\n  if (!isCrmImportFactsCollection(collection)) return refused('import', 400)\n  const snapshot = await orgCollection(scope.orgId, CRM_COLLECTIONS.contactFields)\n    .limit(CRM_FACTS_FIELD_DEFINITIONS_READ)\n    .get()\n  const definitions = snapshot.docs\n    .map((doc) => (doc.data() ?? {}) as Partial<ContactFieldDefinition> & Data)\n    .filter((definition) => scope.visible(definition['visibleTo']))\n  return { ok: true, facts: { ...importFacts(collection, definitions) } }\n})\n\n/** Every reader this plugin registers, by resource name. */\nexport const CRM_FACTS_READERS: Readonly<Record<string, PluginRecordFactsReader>> = {\n  [CRM_RECORD_FACTS_RESOURCES.contact]: crmContactFactsReader,\n  [CRM_RECORD_FACTS_RESOURCES.company]: crmCompanyFactsReader,\n  [CRM_RECORD_FACTS_RESOURCES.deal]: crmDealFactsReader,\n  [CRM_RECORD_FACTS_RESOURCES.lead]: crmLeadFactsReader,\n  [CRM_IMPORT_FACTS_RESOURCE]: crmImportFactsReader,\n}\n\n/**\n * Registers the readers; the console surface calls it, the one process that\n * runs AI jobs (AGL-3026). Idempotent: a second call replaces the first.\n */\nexport function registerCrmRecordFactsReaders(): void {\n  for (const [resource, factsReader] of Object.entries(CRM_FACTS_READERS)) {\n    registerPluginRecordFactsReader(resource, factsReader, { pluginId: BUNDLE_ID })\n  }\n}\n"],"names":["registerPluginRecordFactsReader","CRM_COLLECTIONS","contactPrimaryGroup","crmReadTokens","isOrgWideMember","consentGroupForSite","firebaseAdmin","getOrgDoc","memberHasOrgPermission","resolveOrgIdForHost","resolveOrgMembership","BUNDLE_ID","CRM_IMPORT_FACTS_RESOURCE","CRM_RECORD_FACTS_RESOURCES","companyFacts","contactFacts","dealFacts","importFacts","isCrmImportFactsCollection","leadFacts","crmSuiteRefusal","CONTACTS_COLLECTION","CRM_FACTS_ACTIVITIES_READ","CRM_FACTS_TASKS_READ","CRM_FACTS_DEALS_READ","CRM_FACTS_FIELD_DEFINITIONS_READ","CRM_FACTS_UNKNOWN_SITE","CRM_FACTS_NOT_A_MEMBER","CRM_FACTS_SITE_REFUSAL","CRM_FACTS_ORG_REFUSAL","CRM_FACTS_LEAD_NEEDS_SITE","NOT_FOUND","contact","company","deal","lead","import","firestore","app","crmFactsScope","request","orgId","String","trim","hostId","ok","status","error","staff","member","membership","uid","catch","reaches","Boolean","hostAccess","allowed","org","suite","body","group","visible","readable","Set","visibleTo","Array","isArray","some","token","has","orgCollection","name","collection","doc","rowsNaming","scope","input","snapshot","where","field","id","orderBy","direction","limit","get","docs","map","data","filter","row","pipelinesFor","deals","ids","pipelineId","snapshots","Promise","all","pipelines","Map","exists","visibleDoc","refused","kind","reader","read","crmContactFactsReader","naming","activities","tasks","facts","nowMs","now","getTime","crmCompanyFactsReader","companies","crmDealFactsReader","pipeline","crmLeadFactsReader","crmImportFactsReader","contactFields","definitions","definition","CRM_FACTS_READERS","registerCrmRecordFactsReaders","resource","factsReader","Object","entries","pluginId"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,+BAA+B,QAI1B,kDAAiD;AACxD,SACEC,eAAe,EACfC,mBAAmB,EACnBC,aAAa,EACbC,eAAe,QAQV,sBAAqB;AAC5B,SACEC,mBAAmB,EACnBC,aAAa,EACbC,SAAS,EACTC,sBAAsB,EACtBC,mBAAmB,EACnBC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,SAAS,QAAQ,gCAA4B;AACtD,SACEC,yBAAyB,EACzBC,0BAA0B,EAC1BC,YAAY,EACZC,YAAY,EACZC,SAAS,EACTC,WAAW,EACXC,0BAA0B,EAC1BC,SAAS,QAEJ,2BAAuB;AAC9B,SAASC,eAAe,QAAQ,kBAAc;AAiC9C,iEAAiE,GACjE,MAAMC,sBAAsB;AAE5B,8EAA8E,GAC9E,OAAO,MAAMC,4BAA4B,GAAE;AAC3C,yDAAyD,GACzD,OAAO,MAAMC,uBAAuB,GAAE;AACtC,uCAAuC,GACvC,OAAO,MAAMC,uBAAuB,GAAE;AACtC,sDAAsD,GACtD,OAAO,MAAMC,mCAAmC,IAAG;AAEnD,OAAO,MAAMC,yBAAyB,eAAc;AACpD,OAAO,MAAMC,yBAAyB,4CAA2C;AACjF,OAAO,MAAMC,yBAAyB,uEAAsE;AAC5G,OAAO,MAAMC,wBACX,6GAA4G;AAC9G,OAAO,MAAMC,4BAA4B,8CAA6C;AAEtF,MAAMC,YAA2D;IAC/DC,SAAS;IACTC,SAAS;IACTC,MAAM;IACNC,MAAM;IACNC,QAAQ;AACV;AAaA,SAASC;IACP,OAAO/B,cAAcgC,GAAG,GAAGD,SAAS;AACtC;AAEA;;;CAGC,GACD,OAAO,eAAeE,cAAcC,OAAiC;QAC9CA,gBAkBPA;IAlBd,MAAMC,QAAQC,QAAOF,iBAAAA,QAAQC,KAAK,YAAbD,iBAAiB,IAAIG,IAAI;IAC9C,MAAMC,SAASJ,QAAQI,MAAM,GAAGF,OAAOF,QAAQI,MAAM,EAAED,IAAI,KAAK;IAChE,IAAI,CAACF,OAAO,OAAO;QAAEI,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAyB;IAC7E,IAAIH,UAAU,AAAC,MAAMnC,oBAAoBmC,YAAaH,OAAO;QAC3D,OAAO;YAAEI,IAAI;YAAOC,QAAQ;YAAKC,OAAOrB;QAAuB;IACjE;IACA,IAAI,CAACc,QAAQQ,KAAK,EAAE;YAKqBC;QAJvC,MAAMC,aAAa,MAAMxC,qBAAqB8B,QAAQW,GAAG,EAAEV,OAAOW,KAAK,CAAC,IAAM;QAC9E,MAAMH,SAASC,CAAAA,8BAAAA,WAAYT,KAAK,MAAKA,QAAQS,WAAWD,MAAM,GAAG;QACjE,IAAI,CAACA,QAAQ,OAAO;YAAEJ,IAAI;YAAOC,QAAQ;YAAKC,OAAOpB;QAAuB;QAC5E,MAAM0B,UAAUT,SACZxC,gBAAgB6C,WAAWK,SAAQL,qBAAAA,OAAOM,UAAU,qBAAjBN,kBAAmB,CAACL,OAAO,IAC9DxC,gBAAgB6C;QACpB,MAAMO,UAAUH,WAAY,MAAM7C,uBAAuBiC,OAAOQ,QAAQ;QACxE,IAAI,CAACO,SAAS;YACZ,OAAO;gBAAEX,IAAI;gBAAOC,QAAQ;gBAAKC,OAAOH,SAAShB,yBAAyBC;YAAsB;QAClG;IACF;IACA,MAAM4B,MAAM,EAAEjB,eAAAA,QAAQiB,GAAG,YAAXjB,eAAiC,MAAMjC,UAAUkC,WAA4B;IAC3F,IAAI,CAACgB,KAAK,OAAO;QAAEZ,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAuB;IACzE,MAAMW,QAAQtC,gBAAgBqC,KAAK;IACnC,IAAIC,OAAO,OAAO;QAAEb,IAAI;QAAOC,QAAQ;QAAKC,OAAOW,MAAMC,IAAI,CAACZ,KAAK;IAAC;IACpE,IAAI,CAACH,QAAQ,OAAO;QAAEH;QAAOG,QAAQ;QAAMa;QAAKG,OAAO;QAAMC,SAAS,IAAM;IAAK;IACjF,MAAMD,QAAQ,MAAMvD,oBAAoBuC,QAAQa;IAChD,MAAMK,WAAW,IAAIC,IAAY5D,cAAcyD;IAC/C,OAAO;QACLnB;QACAG;QACAa;QACAG;QACAC,SAAS,CAACG,YACRC,MAAMC,OAAO,CAACF,cAAcA,UAAUG,IAAI,CAAC,CAACC,QAAUN,SAASO,GAAG,CAAC3B,OAAO0B;IAC9E;AACF;AAEA,MAAME,gBAAgB,CAAC7B,OAAe8B,OACpClC,YAAYmC,UAAU,CAAC,QAAQC,GAAG,CAAChC,OAAO+B,UAAU,CAACD;AAEvD,iFAAiF,GACjF,eAAeG,WACbC,KAAoB,EACpBC,KAAmH;IAEnH,MAAMC,WAAW,MAAMP,cAAcK,MAAMlC,KAAK,EAAEmC,MAAMJ,UAAU,EAC/DM,KAAK,CAACF,MAAMG,KAAK,EAAE,MAAMH,MAAMI,EAAE,EACjCC,OAAO,CAACL,MAAMK,OAAO,EAAEL,MAAMM,SAAS,EACtCC,KAAK,CAACP,MAAMO,KAAK,EACjBC,GAAG;IACN,OAAOP,SAASQ,IAAI,CACjBC,GAAG,CAAC,CAACb;YAASA;gBAAAA,YAAAA,IAAIc,IAAI,cAARd,YAAc,CAAC;OAC7Be,MAAM,CAAC,CAACC,MAAQd,MAAMd,OAAO,CAAC4B,GAAG,CAAC,YAAY;AACnD;AAEA,0DAA0D,GAC1D,eAAeC,aAAaf,KAAoB,EAAEgB,KAAsC;IACtF,MAAMC,MAAM;WAAI,IAAI7B,IAAI4B,MAAML,GAAG,CAAC,CAACpD;gBAAgBA;mBAAPQ,QAAOR,mBAAAA,KAAK2D,UAAU,YAAf3D,mBAAmB;WAAKsD,MAAM,CAAClC;KAAU;IAC5F,MAAMwC,YAAY,MAAMC,QAAQC,GAAG,CAACJ,IAAIN,GAAG,CAAC,CAACN,KAAOV,cAAcK,MAAMlC,KAAK,EAAExC,gBAAgBgG,SAAS,EAAExB,GAAG,CAACO,IAAII,GAAG;IACrH,OAAO,IAAIc,IACTJ,UACGN,MAAM,CAAC,CAACX,WAAaA,SAASsB,MAAM,EACpCb,GAAG,CAAC,CAACT;YAA4BA;eAAf;YAACA,SAASG,EAAE;aAAGH,iBAAAA,SAASU,IAAI,cAAbV,iBAAmB,CAAC;SAAkB;;AAE9E;AAEA,qDAAqD,GACrD,eAAeuB,WAAWzB,KAAoB,EAAEH,UAAkB,EAAEQ,EAAU;QAG3CH;IAFjC,IAAI,CAACG,IAAI,OAAO;IAChB,MAAMH,WAAW,MAAMP,cAAcK,MAAMlC,KAAK,EAAE+B,YAAYC,GAAG,CAACO,IAAII,GAAG;IACzE,MAAMG,OAAOV,SAASsB,MAAM,IAAKtB,iBAAAA,SAASU,IAAI,cAAbV,iBAAmB,CAAC,IAAc;IACnE,OAAOU,QAAQZ,MAAMd,OAAO,CAAC0B,IAAI,CAAC,YAAY,IAAIA,OAAO;AAC3D;AAEA,MAAMc,UAAU,CAACC,MAAqCxD,SAAoB,GAAG,GAAe,CAAA;QAC1FD,IAAI;QACJC;QACAC,OAAOhB,SAAS,CAACuE,KAAK;IACxB,CAAA;AAEA,4DAA4D,GAC5D,SAASC,OAAOC,IAAiG;IAC/G,OAAO;QACLA,MAAM,OAAOhE;YACX,MAAMmC,QAAQ,MAAMpC,cAAcC;YAClC,IAAI,QAAQmC,OAAO,OAAOA;YAC1B,OAAO6B,KAAK7B,OAAOnC;QACrB;IACF;AACF;AAEA,OAAO,MAAMiE,wBAAwBF,OAAO,OAAO5B,OAAOnC;QACtCA,aAGJmC;IAHd,MAAMK,KAAKtC,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IACxC,MAAM8C,MAAM,MAAMW,WAAWzB,OAAOtD,qBAAqB2D;IACzD,IAAI,CAACS,KAAK,OAAOY,QAAQ;IACzB,MAAMzC,SAAQe,eAAAA,MAAMf,KAAK,YAAXe,eAAezE,oBAAoBuF,KAAKd,MAAMlB,GAAG;IAC/D,MAAMiD,SAAS;QAAE3B,OAAO;QAAaC;IAAG;IACxC,MAAM,CAAC2B,YAAYC,OAAOjB,MAAM,GAAG,MAAMI,QAAQC,GAAG,CAAC;QACnDtB,WAAwBC,OAAO,aAAK+B;YAAQlC,YAAYvE,gBAAgB0G,UAAU;YAAE1B,SAAS;YAAQC,WAAW;YAAQC,OAAO7D;;QAC/HoD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYvE,gBAAgB2G,KAAK;YAAE3B,SAAS;YAAWC,WAAW;YAAOC,OAAO5D;;QACxHmD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYvE,gBAAgB0F,KAAK;YAAEV,SAAS;YAAaC,WAAW;YAAQC,OAAO3D;;KAC5H;IACD,MAAMyE,YAAY,MAAMP,aAAaf,OAAOgB;IAC5C,OAAO;QACL9C,IAAI;QACJgE,OAAO,aAAK9F,aAAa;YAAE0E;YAAK7B;YAAO+C;YAAYC;YAAOjB;YAAOM;YAAWa,OAAOtE,QAAQuE,GAAG,CAACC,OAAO;QAAG;IAC3G;AACF,GAAE;AAEF,OAAO,MAAMC,wBAAwBV,OAAO,OAAO5B,OAAOnC;QACtCA;IAAlB,MAAMwC,KAAKtC,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IACxC,MAAMV,UAAU,MAAMmE,WAAWzB,OAAO1E,gBAAgBiH,SAAS,EAAElC;IACnE,IAAI,CAAC/C,SAAS,OAAOoE,QAAQ;IAC7B,MAAMK,SAAS;QAAE3B,OAAO;QAAaC;IAAG;IACxC,MAAM,CAAC2B,YAAYC,OAAOjB,MAAM,GAAG,MAAMI,QAAQC,GAAG,CAAC;QACnDtB,WAAwBC,OAAO,aAAK+B;YAAQlC,YAAYvE,gBAAgB0G,UAAU;YAAE1B,SAAS;YAAQC,WAAW;YAAQC,OAAO7D;;QAC/HoD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYvE,gBAAgB2G,KAAK;YAAE3B,SAAS;YAAWC,WAAW;YAAOC,OAAO5D;;QACxHmD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYvE,gBAAgB0F,KAAK;YAAEV,SAAS;YAAaC,WAAW;YAAQC,OAAO3D;;KAC5H;IACD,MAAMyE,YAAY,MAAMP,aAAaf,OAAOgB;IAC5C,OAAO;QACL9C,IAAI;QACJgE,OAAO,aACF/F,aAAa;YAAEmB,SAASA;YAAgC0E;YAAYC;YAAOjB;YAAOM;YAAWa,OAAOtE,QAAQuE,GAAG,CAACC,OAAO;QAAG;IAEjI;AACF,GAAE;AAEF,OAAO,MAAMG,qBAAqBZ,OAAO,OAAO5B,OAAOnC;QACnCA,aAcFyD,gBAAqB/D;IAdrC,MAAM8C,KAAKtC,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IACxC,MAAMT,OAAQ,MAAMkE,WAAWzB,OAAO1E,gBAAgB0F,KAAK,EAAEX;IAC7D,IAAI,CAAC9C,MAAM,OAAOmE,QAAQ;IAC1B,MAAMK,SAAS;QAAE3B,OAAO;QAAUC;IAAG;IACrC,MAAM,CAAC2B,YAAYC,OAAOX,UAAU,GAAG,MAAMF,QAAQC,GAAG,CAAC;QACvDtB,WAAwBC,OAAO,aAAK+B;YAAQlC,YAAYvE,gBAAgB0G,UAAU;YAAE1B,SAAS;YAAQC,WAAW;YAAQC,OAAO7D;;QAC/HoD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYvE,gBAAgB2G,KAAK;YAAE3B,SAAS;YAAWC,WAAW;YAAOC,OAAO5D;;QACxHmE,aAAaf,OAAO;YAACzC;SAAK;KAC3B;IACD,OAAO;QACLW,IAAI;QACJgE,OAAO,aACF7F,UAAU;YACXkB;YACAkF,QAAQ,GAAEnB,iBAAAA,UAAUb,GAAG,CAAC1C,QAAOR,mBAAAA,KAAK2D,UAAU,YAAf3D,mBAAmB,gBAAxC+D,iBAAgD;YAC1DU;YACAC;YACAE,OAAOtE,QAAQuE,GAAG,CAACC,OAAO;QAC5B;IAEJ;AACF,GAAE;AAEF,OAAO,MAAMK,qBAAqBd,OAAO,OAAO5B,OAAOnC;QAEnCA,aAYgCqC;IAblD,IAAI,CAACF,MAAM/B,MAAM,EAAE,OAAO;QAAEC,IAAI;QAAOC,QAAQ;QAAKC,OAAOjB;IAA0B;IACrF,MAAMkD,KAAKtC,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IACxC,IAAI,CAACqC,IAAI,OAAOqB,QAAQ;IACxB,MAAMxB,WAAW,MAAMxC,YAAYmC,UAAU,CAAC,SAASC,GAAG,CAACE,MAAM/B,MAAM,EAAE4B,UAAU,CAAC,SAASC,GAAG,CAACO,IAAII,GAAG;IACxG,IAAI,CAACP,SAASsB,MAAM,EAAE,OAAOE,QAAQ;IACrC,MAAMM,aAAa,MAAMjC,WAAwBC,OAAO;QACtDI,OAAO;QACPC;QACAR,YAAYvE,gBAAgB0G,UAAU;QACtC1B,SAAS;QACTC,WAAW;QACXC,OAAO7D;IACT;IACA,OAAO;QAAEuB,IAAI;QAAMgE,OAAO,aAAK1F,UAAU;YAAEgB,IAAI,GAAG0C,iBAAAA,SAASU,IAAI,cAAbV,iBAAmB,CAAC;YAAY8B;QAAW;IAAK;AACpG,GAAE;AAEF,OAAO,MAAMW,uBAAuBf,OAAO,OAAO5B,OAAOnC;QAC7BA;IAA1B,MAAMgC,aAAa9B,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IAChD,IAAI,CAACzB,2BAA2BsD,aAAa,OAAO6B,QAAQ,UAAU;IACtE,MAAMxB,WAAW,MAAMP,cAAcK,MAAMlC,KAAK,EAAExC,gBAAgBsH,aAAa,EAC5EpC,KAAK,CAAC1D,kCACN2D,GAAG;IACN,MAAMoC,cAAc3C,SAASQ,IAAI,CAC9BC,GAAG,CAAC,CAACb;YAASA;gBAAAA,YAAAA,IAAIc,IAAI,cAARd,YAAc,CAAC;OAC7Be,MAAM,CAAC,CAACiC,aAAe9C,MAAMd,OAAO,CAAC4D,UAAU,CAAC,YAAY;IAC/D,OAAO;QAAE5E,IAAI;QAAMgE,OAAO,aAAK5F,YAAYuD,YAAYgD;IAAe;AACxE,GAAE;AAEF,0DAA0D,GAC1D,OAAO,MAAME,oBAAuE;IAClF,CAAC7G,2BAA2BmB,OAAO,CAAC,EAAEyE;IACtC,CAAC5F,2BAA2BoB,OAAO,CAAC,EAAEgF;IACtC,CAACpG,2BAA2BqB,IAAI,CAAC,EAAEiF;IACnC,CAACtG,2BAA2BsB,IAAI,CAAC,EAAEkF;IACnC,CAACzG,0BAA0B,EAAE0G;AAC/B,EAAC;AAED;;;CAGC,GACD,OAAO,SAASK;IACd,KAAK,MAAM,CAACC,UAAUC,YAAY,IAAIC,OAAOC,OAAO,CAACL,mBAAoB;QACvE1H,gCAAgC4H,UAAUC,aAAa;YAAEG,UAAUrH;QAAU;IAC/E;AACF"}
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/record-facts.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  registerPluginRecordFactsReader,\n  type PluginRecordFactsRead,\n  type PluginRecordFactsReader,\n  type PluginRecordFactsRequest,\n} from '@aglyn/aglyn/plugin-manager/plugin-record-facts'\nimport {\n  CRM_COLLECTIONS,\n  contactPrimaryGroup,\n  crmReadTokens,\n  isOrgWideMember,\n  type ConsentGroup,\n  type ContactFieldDefinition,\n  type CrmActivity,\n  type CrmCompany,\n  type CrmDeal,\n  type CrmPipeline,\n  type CrmTask,\n} from '@aglyn/aglyn/server'\nimport {\n  consentGroupForSite,\n  firebaseAdmin,\n  getOrgDoc,\n  memberHasOrgPermission,\n  readLeadForHost,\n  resolveOrgIdForHost,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin'\nimport { BUNDLE_ID } from '../constants/bundle-common'\nimport {\n  CRM_IMPORT_FACTS_RESOURCE,\n  CRM_RECORD_FACTS_RESOURCES,\n  companyFacts,\n  contactFacts,\n  dealFacts,\n  importFacts,\n  isCrmImportFactsCollection,\n  leadFacts,\n  type CrmRecordFactsKind,\n} from '../model/record-facts'\nimport { crmSuiteRefusal } from './suite-gate'\n\n/**\n * THE CRM'S READERS ON THE CORE'S RECORD-FACTS SEAM (AGL-2917).\n *\n * Another plugin asks for a contact, a company, a deal, a lead or an import's\n * field catalog by resource name, and gets the facts `model/record-facts.ts`\n * reports — read here with the rules every other CRM door applies, for the\n * member the caller names:\n *\n *  1. the site belongs to the organization;\n *  2. the member reaches it — an org-wide member at the organization level, a\n *     member of that site under it — and holds `data.manage`, the key the\n *     whole CRM is gated on. A verified staff caller passes, as at every CRM\n *     route;\n *  3. the organization's plan carries the CRM, asked after the caller is\n *     known, the order `suite-gate.ts` gives;\n *  4. the record exists and is visible where it is read: under a site, its\n *     `visibleTo` meets the site's read tokens, as the console's listeners\n *     filter; at the organization level every row is the member's;\n *  5. what hangs off it — its logged activity, its tasks, its deals — is held\n *     to the same visibility, row by row.\n *\n * A caller in the same process skips the plugin API dispatcher, and with it\n * the dispatcher's per-site enablement, release flag, lockdown and rate\n * limit; those are the caller's to establish before it asks (the AI plugin's\n * CRM admission does). Nothing here writes.\n */\n\ntype Firestore = FirebaseFirestore.Firestore\ntype Data = Record<string, unknown>\ntype Refusal = { ok: false; status: 400 | 403 | 404; error: string }\n\n/** The org collection a contact lives in, beside the CRM's own. */\nconst CONTACTS_COLLECTION = 'contacts'\n\n/** Logged activities read per record before visibility and the timeline cut. */\nexport const CRM_FACTS_ACTIVITIES_READ = 40\n/** Tasks read per record, the record page's own window. */\nexport const CRM_FACTS_TASKS_READ = 50\n/** Deals read per contact or company. */\nexport const CRM_FACTS_DEALS_READ = 20\n/** Custom field definitions an import catalog reads. */\nexport const CRM_FACTS_FIELD_DEFINITIONS_READ = 100\n\nexport const CRM_FACTS_UNKNOWN_SITE = 'Unknown site'\nexport const CRM_FACTS_NOT_A_MEMBER = 'You are not a member of that organization'\nexport const CRM_FACTS_SITE_REFUSAL = 'Reading CRM records requires the data.manage permission on this site'\nexport const CRM_FACTS_ORG_REFUSAL =\n  'Reading CRM records across the organization requires the data.manage permission for the whole organization'\nexport const CRM_FACTS_LEAD_NEEDS_SITE = 'A lead is read on the site that captured it'\n\nconst NOT_FOUND: Record<CrmRecordFactsKind | 'import', string> = {\n  contact: 'This contact could not be found. It may have been deleted.',\n  company: 'This company could not be found. It may have been deleted.',\n  deal: 'This deal could not be found. It may have been deleted.',\n  lead: 'This lead could not be found. It may have been removed.',\n  import: 'There is no such import.',\n}\n\n/** Where a read runs, once the caller has been admitted. */\ninterface CrmFactsScope {\n  orgId: string\n  hostId: string | null\n  org: Data\n  /** The site's consent group under a site; `null` at the organization level. */\n  group: ConsentGroup | null\n  /** Whether a row's `visibleTo` is readable here. */\n  visible: (visibleTo: unknown) => boolean\n}\n\nfunction firestore(): Firestore {\n  return firebaseAdmin.app().firestore()\n}\n\n/**\n * Rules 1 to 3: the site, the member and the plan. A refusal names what the\n * member lacks in the words the console's own CRM doors use.\n */\nexport async function crmFactsScope(request: PluginRecordFactsRequest): Promise<CrmFactsScope | Refusal> {\n  const orgId = String(request.orgId ?? '').trim()\n  const hostId = request.hostId ? String(request.hostId).trim() : null\n  if (!orgId) return { ok: false, status: 400, error: 'Open a workspace first' }\n  if (hostId && (await resolveOrgIdForHost(hostId)) !== orgId) {\n    return { ok: false, status: 404, error: CRM_FACTS_UNKNOWN_SITE }\n  }\n  if (!request.staff) {\n    const membership = await resolveOrgMembership(request.uid, orgId).catch(() => null)\n    const member = membership?.orgId === orgId ? membership.member : null\n    if (!member) return { ok: false, status: 403, error: CRM_FACTS_NOT_A_MEMBER }\n    const reaches = hostId\n      ? isOrgWideMember(member) || Boolean(member.hostAccess?.[hostId])\n      : isOrgWideMember(member)\n    const allowed = reaches && (await memberHasOrgPermission(orgId, member, 'data.manage'))\n    if (!allowed) {\n      return { ok: false, status: 403, error: hostId ? CRM_FACTS_SITE_REFUSAL : CRM_FACTS_ORG_REFUSAL }\n    }\n  }\n  const org = ((request.org as Data | null) ?? ((await getOrgDoc(orgId)) as Data | null)) || null\n  if (!org) return { ok: false, status: 404, error: 'Unknown organization' }\n  const suite = crmSuiteRefusal(org, 'Reading a CRM record')\n  if (suite) return { ok: false, status: 403, error: suite.body.error }\n  if (!hostId) return { orgId, hostId: null, org, group: null, visible: () => true }\n  const group = await consentGroupForSite(hostId, org)\n  const readable = new Set<string>(crmReadTokens(group))\n  return {\n    orgId,\n    hostId,\n    org,\n    group,\n    visible: (visibleTo) =>\n      Array.isArray(visibleTo) && visibleTo.some((token) => readable.has(String(token))),\n  }\n}\n\nconst orgCollection = (orgId: string, name: string) =>\n  firestore().collection('orgs').doc(orgId).collection(name)\n\n/** Rows of an org collection naming one record, held to the scope's visibility. */\nasync function rowsNaming<T>(\n  scope: CrmFactsScope,\n  input: { collection: string; field: string; id: string; orderBy: string; direction: 'asc' | 'desc'; limit: number },\n): Promise<T[]> {\n  const snapshot = await orgCollection(scope.orgId, input.collection)\n    .where(input.field, '==', input.id)\n    .orderBy(input.orderBy, input.direction)\n    .limit(input.limit)\n    .get()\n  return snapshot.docs\n    .map((doc) => (doc.data() ?? {}) as Data)\n    .filter((row) => scope.visible(row['visibleTo'])) as T[]\n}\n\n/** The pipelines some deals name, by id, read once each. */\nasync function pipelinesFor(scope: CrmFactsScope, deals: ReadonlyArray<Partial<CrmDeal>>): Promise<Map<string, CrmPipeline>> {\n  const ids = [...new Set(deals.map((deal) => String(deal.pipelineId ?? '')).filter(Boolean))]\n  const snapshots = await Promise.all(ids.map((id) => orgCollection(scope.orgId, CRM_COLLECTIONS.pipelines).doc(id).get()))\n  return new Map(\n    snapshots\n      .filter((snapshot) => snapshot.exists)\n      .map((snapshot) => [snapshot.id, (snapshot.data() ?? {}) as CrmPipeline]),\n  )\n}\n\n/** A record document the scope may read, or `null`. */\nasync function visibleDoc(scope: CrmFactsScope, collection: string, id: string): Promise<Data | null> {\n  if (!id) return null\n  const snapshot = await orgCollection(scope.orgId, collection).doc(id).get()\n  const data = snapshot.exists ? ((snapshot.data() ?? {}) as Data) : null\n  return data && scope.visible(data['visibleTo']) ? data : null\n}\n\nconst refused = (kind: CrmRecordFactsKind | 'import', status: 400 | 404 = 404): Refusal => ({\n  ok: false,\n  status,\n  error: NOT_FOUND[kind],\n})\n\n/** A reader that admits the caller, then reads the record. */\nfunction reader(read: (scope: CrmFactsScope, request: PluginRecordFactsRequest) => Promise<PluginRecordFactsRead>): PluginRecordFactsReader {\n  return {\n    read: async (request) => {\n      const scope = await crmFactsScope(request)\n      if ('ok' in scope) return scope\n      return read(scope, request)\n    },\n  }\n}\n\nexport const crmContactFactsReader = reader(async (scope, request) => {\n  const id = String(request.id ?? '').trim()\n  const row = await visibleDoc(scope, CONTACTS_COLLECTION, id)\n  if (!row) return refused('contact')\n  const group = scope.group ?? contactPrimaryGroup(row, scope.org)\n  const naming = { field: 'contactId', id }\n  const [activities, tasks, deals] = await Promise.all([\n    rowsNaming<CrmActivity>(scope, { ...naming, collection: CRM_COLLECTIONS.activities, orderBy: 'atMs', direction: 'desc', limit: CRM_FACTS_ACTIVITIES_READ }),\n    rowsNaming<CrmTask>(scope, { ...naming, collection: CRM_COLLECTIONS.tasks, orderBy: 'dueAtMs', direction: 'asc', limit: CRM_FACTS_TASKS_READ }),\n    rowsNaming<CrmDeal>(scope, { ...naming, collection: CRM_COLLECTIONS.deals, orderBy: 'updatedAt', direction: 'desc', limit: CRM_FACTS_DEALS_READ }),\n  ])\n  const pipelines = await pipelinesFor(scope, deals)\n  return {\n    ok: true,\n    facts: { ...contactFacts({ row, group, activities, tasks, deals, pipelines, nowMs: request.now.getTime() }) },\n  }\n})\n\nexport const crmCompanyFactsReader = reader(async (scope, request) => {\n  const id = String(request.id ?? '').trim()\n  const company = await visibleDoc(scope, CRM_COLLECTIONS.companies, id)\n  if (!company) return refused('company')\n  const naming = { field: 'companyId', id }\n  const [activities, tasks, deals] = await Promise.all([\n    rowsNaming<CrmActivity>(scope, { ...naming, collection: CRM_COLLECTIONS.activities, orderBy: 'atMs', direction: 'desc', limit: CRM_FACTS_ACTIVITIES_READ }),\n    rowsNaming<CrmTask>(scope, { ...naming, collection: CRM_COLLECTIONS.tasks, orderBy: 'dueAtMs', direction: 'asc', limit: CRM_FACTS_TASKS_READ }),\n    rowsNaming<CrmDeal>(scope, { ...naming, collection: CRM_COLLECTIONS.deals, orderBy: 'updatedAt', direction: 'desc', limit: CRM_FACTS_DEALS_READ }),\n  ])\n  const pipelines = await pipelinesFor(scope, deals)\n  return {\n    ok: true,\n    facts: {\n      ...companyFacts({ company: company as Partial<CrmCompany>, activities, tasks, deals, pipelines, nowMs: request.now.getTime() }),\n    },\n  }\n})\n\nexport const crmDealFactsReader = reader(async (scope, request) => {\n  const id = String(request.id ?? '').trim()\n  const deal = (await visibleDoc(scope, CRM_COLLECTIONS.deals, id)) as (Partial<CrmDeal> & Data) | null\n  if (!deal) return refused('deal')\n  const naming = { field: 'dealId', id }\n  const [activities, tasks, pipelines] = await Promise.all([\n    rowsNaming<CrmActivity>(scope, { ...naming, collection: CRM_COLLECTIONS.activities, orderBy: 'atMs', direction: 'desc', limit: CRM_FACTS_ACTIVITIES_READ }),\n    rowsNaming<CrmTask>(scope, { ...naming, collection: CRM_COLLECTIONS.tasks, orderBy: 'dueAtMs', direction: 'asc', limit: CRM_FACTS_TASKS_READ }),\n    pipelinesFor(scope, [deal]),\n  ])\n  return {\n    ok: true,\n    facts: {\n      ...dealFacts({\n        deal,\n        pipeline: pipelines.get(String(deal.pipelineId ?? '')) ?? null,\n        activities,\n        tasks,\n        nowMs: request.now.getTime(),\n      }),\n    },\n  }\n})\n\nexport const crmLeadFactsReader = reader(async (scope, request) => {\n  if (!scope.hostId) return { ok: false, status: 400, error: CRM_FACTS_LEAD_NEEDS_SITE }\n  const id = String(request.id ?? '').trim()\n  if (!id) return refused('lead')\n  const snapshot = await readLeadForHost(scope.hostId, id)\n  if (!snapshot) return refused('lead')\n  const activities = await rowsNaming<CrmActivity>(scope, {\n    field: 'leadId',\n    id,\n    collection: CRM_COLLECTIONS.activities,\n    orderBy: 'atMs',\n    direction: 'desc',\n    limit: CRM_FACTS_ACTIVITIES_READ,\n  })\n  return { ok: true, facts: { ...leadFacts({ lead: (snapshot.data() ?? {}) as Data, activities }) } }\n})\n\nexport const crmImportFactsReader = reader(async (scope, request) => {\n  const collection = String(request.id ?? '').trim()\n  if (!isCrmImportFactsCollection(collection)) return refused('import', 400)\n  const snapshot = await orgCollection(scope.orgId, CRM_COLLECTIONS.contactFields)\n    .limit(CRM_FACTS_FIELD_DEFINITIONS_READ)\n    .get()\n  const definitions = snapshot.docs\n    .map((doc) => (doc.data() ?? {}) as Partial<ContactFieldDefinition> & Data)\n    .filter((definition) => scope.visible(definition['visibleTo']))\n  return { ok: true, facts: { ...importFacts(collection, definitions) } }\n})\n\n/** Every reader this plugin registers, by resource name. */\nexport const CRM_FACTS_READERS: Readonly<Record<string, PluginRecordFactsReader>> = {\n  [CRM_RECORD_FACTS_RESOURCES.contact]: crmContactFactsReader,\n  [CRM_RECORD_FACTS_RESOURCES.company]: crmCompanyFactsReader,\n  [CRM_RECORD_FACTS_RESOURCES.deal]: crmDealFactsReader,\n  [CRM_RECORD_FACTS_RESOURCES.lead]: crmLeadFactsReader,\n  [CRM_IMPORT_FACTS_RESOURCE]: crmImportFactsReader,\n}\n\n/**\n * Registers the readers; the console surface calls it, the one process that\n * runs AI jobs (AGL-3026). Idempotent: a second call replaces the first.\n */\nexport function registerCrmRecordFactsReaders(): void {\n  for (const [resource, factsReader] of Object.entries(CRM_FACTS_READERS)) {\n    registerPluginRecordFactsReader(resource, factsReader, { pluginId: BUNDLE_ID })\n  }\n}\n"],"names":["registerPluginRecordFactsReader","CRM_COLLECTIONS","contactPrimaryGroup","crmReadTokens","isOrgWideMember","consentGroupForSite","firebaseAdmin","getOrgDoc","memberHasOrgPermission","readLeadForHost","resolveOrgIdForHost","resolveOrgMembership","BUNDLE_ID","CRM_IMPORT_FACTS_RESOURCE","CRM_RECORD_FACTS_RESOURCES","companyFacts","contactFacts","dealFacts","importFacts","isCrmImportFactsCollection","leadFacts","crmSuiteRefusal","CONTACTS_COLLECTION","CRM_FACTS_ACTIVITIES_READ","CRM_FACTS_TASKS_READ","CRM_FACTS_DEALS_READ","CRM_FACTS_FIELD_DEFINITIONS_READ","CRM_FACTS_UNKNOWN_SITE","CRM_FACTS_NOT_A_MEMBER","CRM_FACTS_SITE_REFUSAL","CRM_FACTS_ORG_REFUSAL","CRM_FACTS_LEAD_NEEDS_SITE","NOT_FOUND","contact","company","deal","lead","import","firestore","app","crmFactsScope","request","orgId","String","trim","hostId","ok","status","error","staff","member","membership","uid","catch","reaches","Boolean","hostAccess","allowed","org","suite","body","group","visible","readable","Set","visibleTo","Array","isArray","some","token","has","orgCollection","name","collection","doc","rowsNaming","scope","input","snapshot","where","field","id","orderBy","direction","limit","get","docs","map","data","filter","row","pipelinesFor","deals","ids","pipelineId","snapshots","Promise","all","pipelines","Map","exists","visibleDoc","refused","kind","reader","read","crmContactFactsReader","naming","activities","tasks","facts","nowMs","now","getTime","crmCompanyFactsReader","companies","crmDealFactsReader","pipeline","crmLeadFactsReader","crmImportFactsReader","contactFields","definitions","definition","CRM_FACTS_READERS","registerCrmRecordFactsReaders","resource","factsReader","Object","entries","pluginId"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,+BAA+B,QAI1B,kDAAiD;AACxD,SACEC,eAAe,EACfC,mBAAmB,EACnBC,aAAa,EACbC,eAAe,QAQV,sBAAqB;AAC5B,SACEC,mBAAmB,EACnBC,aAAa,EACbC,SAAS,EACTC,sBAAsB,EACtBC,eAAe,EACfC,mBAAmB,EACnBC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,SAAS,QAAQ,gCAA4B;AACtD,SACEC,yBAAyB,EACzBC,0BAA0B,EAC1BC,YAAY,EACZC,YAAY,EACZC,SAAS,EACTC,WAAW,EACXC,0BAA0B,EAC1BC,SAAS,QAEJ,2BAAuB;AAC9B,SAASC,eAAe,QAAQ,kBAAc;AAiC9C,iEAAiE,GACjE,MAAMC,sBAAsB;AAE5B,8EAA8E,GAC9E,OAAO,MAAMC,4BAA4B,GAAE;AAC3C,yDAAyD,GACzD,OAAO,MAAMC,uBAAuB,GAAE;AACtC,uCAAuC,GACvC,OAAO,MAAMC,uBAAuB,GAAE;AACtC,sDAAsD,GACtD,OAAO,MAAMC,mCAAmC,IAAG;AAEnD,OAAO,MAAMC,yBAAyB,eAAc;AACpD,OAAO,MAAMC,yBAAyB,4CAA2C;AACjF,OAAO,MAAMC,yBAAyB,uEAAsE;AAC5G,OAAO,MAAMC,wBACX,6GAA4G;AAC9G,OAAO,MAAMC,4BAA4B,8CAA6C;AAEtF,MAAMC,YAA2D;IAC/DC,SAAS;IACTC,SAAS;IACTC,MAAM;IACNC,MAAM;IACNC,QAAQ;AACV;AAaA,SAASC;IACP,OAAOhC,cAAciC,GAAG,GAAGD,SAAS;AACtC;AAEA;;;CAGC,GACD,OAAO,eAAeE,cAAcC,OAAiC;QAC9CA,gBAkBPA;IAlBd,MAAMC,QAAQC,QAAOF,iBAAAA,QAAQC,KAAK,YAAbD,iBAAiB,IAAIG,IAAI;IAC9C,MAAMC,SAASJ,QAAQI,MAAM,GAAGF,OAAOF,QAAQI,MAAM,EAAED,IAAI,KAAK;IAChE,IAAI,CAACF,OAAO,OAAO;QAAEI,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAyB;IAC7E,IAAIH,UAAU,AAAC,MAAMnC,oBAAoBmC,YAAaH,OAAO;QAC3D,OAAO;YAAEI,IAAI;YAAOC,QAAQ;YAAKC,OAAOrB;QAAuB;IACjE;IACA,IAAI,CAACc,QAAQQ,KAAK,EAAE;YAKqBC;QAJvC,MAAMC,aAAa,MAAMxC,qBAAqB8B,QAAQW,GAAG,EAAEV,OAAOW,KAAK,CAAC,IAAM;QAC9E,MAAMH,SAASC,CAAAA,8BAAAA,WAAYT,KAAK,MAAKA,QAAQS,WAAWD,MAAM,GAAG;QACjE,IAAI,CAACA,QAAQ,OAAO;YAAEJ,IAAI;YAAOC,QAAQ;YAAKC,OAAOpB;QAAuB;QAC5E,MAAM0B,UAAUT,SACZzC,gBAAgB8C,WAAWK,SAAQL,qBAAAA,OAAOM,UAAU,qBAAjBN,kBAAmB,CAACL,OAAO,IAC9DzC,gBAAgB8C;QACpB,MAAMO,UAAUH,WAAY,MAAM9C,uBAAuBkC,OAAOQ,QAAQ;QACxE,IAAI,CAACO,SAAS;YACZ,OAAO;gBAAEX,IAAI;gBAAOC,QAAQ;gBAAKC,OAAOH,SAAShB,yBAAyBC;YAAsB;QAClG;IACF;IACA,MAAM4B,MAAM,EAAEjB,eAAAA,QAAQiB,GAAG,YAAXjB,eAAiC,MAAMlC,UAAUmC,WAA4B;IAC3F,IAAI,CAACgB,KAAK,OAAO;QAAEZ,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAuB;IACzE,MAAMW,QAAQtC,gBAAgBqC,KAAK;IACnC,IAAIC,OAAO,OAAO;QAAEb,IAAI;QAAOC,QAAQ;QAAKC,OAAOW,MAAMC,IAAI,CAACZ,KAAK;IAAC;IACpE,IAAI,CAACH,QAAQ,OAAO;QAAEH;QAAOG,QAAQ;QAAMa;QAAKG,OAAO;QAAMC,SAAS,IAAM;IAAK;IACjF,MAAMD,QAAQ,MAAMxD,oBAAoBwC,QAAQa;IAChD,MAAMK,WAAW,IAAIC,IAAY7D,cAAc0D;IAC/C,OAAO;QACLnB;QACAG;QACAa;QACAG;QACAC,SAAS,CAACG,YACRC,MAAMC,OAAO,CAACF,cAAcA,UAAUG,IAAI,CAAC,CAACC,QAAUN,SAASO,GAAG,CAAC3B,OAAO0B;IAC9E;AACF;AAEA,MAAME,gBAAgB,CAAC7B,OAAe8B,OACpClC,YAAYmC,UAAU,CAAC,QAAQC,GAAG,CAAChC,OAAO+B,UAAU,CAACD;AAEvD,iFAAiF,GACjF,eAAeG,WACbC,KAAoB,EACpBC,KAAmH;IAEnH,MAAMC,WAAW,MAAMP,cAAcK,MAAMlC,KAAK,EAAEmC,MAAMJ,UAAU,EAC/DM,KAAK,CAACF,MAAMG,KAAK,EAAE,MAAMH,MAAMI,EAAE,EACjCC,OAAO,CAACL,MAAMK,OAAO,EAAEL,MAAMM,SAAS,EACtCC,KAAK,CAACP,MAAMO,KAAK,EACjBC,GAAG;IACN,OAAOP,SAASQ,IAAI,CACjBC,GAAG,CAAC,CAACb;YAASA;gBAAAA,YAAAA,IAAIc,IAAI,cAARd,YAAc,CAAC;OAC7Be,MAAM,CAAC,CAACC,MAAQd,MAAMd,OAAO,CAAC4B,GAAG,CAAC,YAAY;AACnD;AAEA,0DAA0D,GAC1D,eAAeC,aAAaf,KAAoB,EAAEgB,KAAsC;IACtF,MAAMC,MAAM;WAAI,IAAI7B,IAAI4B,MAAML,GAAG,CAAC,CAACpD;gBAAgBA;mBAAPQ,QAAOR,mBAAAA,KAAK2D,UAAU,YAAf3D,mBAAmB;WAAKsD,MAAM,CAAClC;KAAU;IAC5F,MAAMwC,YAAY,MAAMC,QAAQC,GAAG,CAACJ,IAAIN,GAAG,CAAC,CAACN,KAAOV,cAAcK,MAAMlC,KAAK,EAAEzC,gBAAgBiG,SAAS,EAAExB,GAAG,CAACO,IAAII,GAAG;IACrH,OAAO,IAAIc,IACTJ,UACGN,MAAM,CAAC,CAACX,WAAaA,SAASsB,MAAM,EACpCb,GAAG,CAAC,CAACT;YAA4BA;eAAf;YAACA,SAASG,EAAE;aAAGH,iBAAAA,SAASU,IAAI,cAAbV,iBAAmB,CAAC;SAAkB;;AAE9E;AAEA,qDAAqD,GACrD,eAAeuB,WAAWzB,KAAoB,EAAEH,UAAkB,EAAEQ,EAAU;QAG3CH;IAFjC,IAAI,CAACG,IAAI,OAAO;IAChB,MAAMH,WAAW,MAAMP,cAAcK,MAAMlC,KAAK,EAAE+B,YAAYC,GAAG,CAACO,IAAII,GAAG;IACzE,MAAMG,OAAOV,SAASsB,MAAM,IAAKtB,iBAAAA,SAASU,IAAI,cAAbV,iBAAmB,CAAC,IAAc;IACnE,OAAOU,QAAQZ,MAAMd,OAAO,CAAC0B,IAAI,CAAC,YAAY,IAAIA,OAAO;AAC3D;AAEA,MAAMc,UAAU,CAACC,MAAqCxD,SAAoB,GAAG,GAAe,CAAA;QAC1FD,IAAI;QACJC;QACAC,OAAOhB,SAAS,CAACuE,KAAK;IACxB,CAAA;AAEA,4DAA4D,GAC5D,SAASC,OAAOC,IAAiG;IAC/G,OAAO;QACLA,MAAM,OAAOhE;YACX,MAAMmC,QAAQ,MAAMpC,cAAcC;YAClC,IAAI,QAAQmC,OAAO,OAAOA;YAC1B,OAAO6B,KAAK7B,OAAOnC;QACrB;IACF;AACF;AAEA,OAAO,MAAMiE,wBAAwBF,OAAO,OAAO5B,OAAOnC;QACtCA,aAGJmC;IAHd,MAAMK,KAAKtC,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IACxC,MAAM8C,MAAM,MAAMW,WAAWzB,OAAOtD,qBAAqB2D;IACzD,IAAI,CAACS,KAAK,OAAOY,QAAQ;IACzB,MAAMzC,SAAQe,eAAAA,MAAMf,KAAK,YAAXe,eAAe1E,oBAAoBwF,KAAKd,MAAMlB,GAAG;IAC/D,MAAMiD,SAAS;QAAE3B,OAAO;QAAaC;IAAG;IACxC,MAAM,CAAC2B,YAAYC,OAAOjB,MAAM,GAAG,MAAMI,QAAQC,GAAG,CAAC;QACnDtB,WAAwBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB2G,UAAU;YAAE1B,SAAS;YAAQC,WAAW;YAAQC,OAAO7D;;QAC/HoD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB4G,KAAK;YAAE3B,SAAS;YAAWC,WAAW;YAAOC,OAAO5D;;QACxHmD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB2F,KAAK;YAAEV,SAAS;YAAaC,WAAW;YAAQC,OAAO3D;;KAC5H;IACD,MAAMyE,YAAY,MAAMP,aAAaf,OAAOgB;IAC5C,OAAO;QACL9C,IAAI;QACJgE,OAAO,aAAK9F,aAAa;YAAE0E;YAAK7B;YAAO+C;YAAYC;YAAOjB;YAAOM;YAAWa,OAAOtE,QAAQuE,GAAG,CAACC,OAAO;QAAG;IAC3G;AACF,GAAE;AAEF,OAAO,MAAMC,wBAAwBV,OAAO,OAAO5B,OAAOnC;QACtCA;IAAlB,MAAMwC,KAAKtC,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IACxC,MAAMV,UAAU,MAAMmE,WAAWzB,OAAO3E,gBAAgBkH,SAAS,EAAElC;IACnE,IAAI,CAAC/C,SAAS,OAAOoE,QAAQ;IAC7B,MAAMK,SAAS;QAAE3B,OAAO;QAAaC;IAAG;IACxC,MAAM,CAAC2B,YAAYC,OAAOjB,MAAM,GAAG,MAAMI,QAAQC,GAAG,CAAC;QACnDtB,WAAwBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB2G,UAAU;YAAE1B,SAAS;YAAQC,WAAW;YAAQC,OAAO7D;;QAC/HoD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB4G,KAAK;YAAE3B,SAAS;YAAWC,WAAW;YAAOC,OAAO5D;;QACxHmD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB2F,KAAK;YAAEV,SAAS;YAAaC,WAAW;YAAQC,OAAO3D;;KAC5H;IACD,MAAMyE,YAAY,MAAMP,aAAaf,OAAOgB;IAC5C,OAAO;QACL9C,IAAI;QACJgE,OAAO,aACF/F,aAAa;YAAEmB,SAASA;YAAgC0E;YAAYC;YAAOjB;YAAOM;YAAWa,OAAOtE,QAAQuE,GAAG,CAACC,OAAO;QAAG;IAEjI;AACF,GAAE;AAEF,OAAO,MAAMG,qBAAqBZ,OAAO,OAAO5B,OAAOnC;QACnCA,aAcFyD,gBAAqB/D;IAdrC,MAAM8C,KAAKtC,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IACxC,MAAMT,OAAQ,MAAMkE,WAAWzB,OAAO3E,gBAAgB2F,KAAK,EAAEX;IAC7D,IAAI,CAAC9C,MAAM,OAAOmE,QAAQ;IAC1B,MAAMK,SAAS;QAAE3B,OAAO;QAAUC;IAAG;IACrC,MAAM,CAAC2B,YAAYC,OAAOX,UAAU,GAAG,MAAMF,QAAQC,GAAG,CAAC;QACvDtB,WAAwBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB2G,UAAU;YAAE1B,SAAS;YAAQC,WAAW;YAAQC,OAAO7D;;QAC/HoD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB4G,KAAK;YAAE3B,SAAS;YAAWC,WAAW;YAAOC,OAAO5D;;QACxHmE,aAAaf,OAAO;YAACzC;SAAK;KAC3B;IACD,OAAO;QACLW,IAAI;QACJgE,OAAO,aACF7F,UAAU;YACXkB;YACAkF,QAAQ,GAAEnB,iBAAAA,UAAUb,GAAG,CAAC1C,QAAOR,mBAAAA,KAAK2D,UAAU,YAAf3D,mBAAmB,gBAAxC+D,iBAAgD;YAC1DU;YACAC;YACAE,OAAOtE,QAAQuE,GAAG,CAACC,OAAO;QAC5B;IAEJ;AACF,GAAE;AAEF,OAAO,MAAMK,qBAAqBd,OAAO,OAAO5B,OAAOnC;QAEnCA,aAYgCqC;IAblD,IAAI,CAACF,MAAM/B,MAAM,EAAE,OAAO;QAAEC,IAAI;QAAOC,QAAQ;QAAKC,OAAOjB;IAA0B;IACrF,MAAMkD,KAAKtC,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IACxC,IAAI,CAACqC,IAAI,OAAOqB,QAAQ;IACxB,MAAMxB,WAAW,MAAMrE,gBAAgBmE,MAAM/B,MAAM,EAAEoC;IACrD,IAAI,CAACH,UAAU,OAAOwB,QAAQ;IAC9B,MAAMM,aAAa,MAAMjC,WAAwBC,OAAO;QACtDI,OAAO;QACPC;QACAR,YAAYxE,gBAAgB2G,UAAU;QACtC1B,SAAS;QACTC,WAAW;QACXC,OAAO7D;IACT;IACA,OAAO;QAAEuB,IAAI;QAAMgE,OAAO,aAAK1F,UAAU;YAAEgB,IAAI,GAAG0C,iBAAAA,SAASU,IAAI,cAAbV,iBAAmB,CAAC;YAAY8B;QAAW;IAAK;AACpG,GAAE;AAEF,OAAO,MAAMW,uBAAuBf,OAAO,OAAO5B,OAAOnC;QAC7BA;IAA1B,MAAMgC,aAAa9B,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IAChD,IAAI,CAACzB,2BAA2BsD,aAAa,OAAO6B,QAAQ,UAAU;IACtE,MAAMxB,WAAW,MAAMP,cAAcK,MAAMlC,KAAK,EAAEzC,gBAAgBuH,aAAa,EAC5EpC,KAAK,CAAC1D,kCACN2D,GAAG;IACN,MAAMoC,cAAc3C,SAASQ,IAAI,CAC9BC,GAAG,CAAC,CAACb;YAASA;gBAAAA,YAAAA,IAAIc,IAAI,cAARd,YAAc,CAAC;OAC7Be,MAAM,CAAC,CAACiC,aAAe9C,MAAMd,OAAO,CAAC4D,UAAU,CAAC,YAAY;IAC/D,OAAO;QAAE5E,IAAI;QAAMgE,OAAO,aAAK5F,YAAYuD,YAAYgD;IAAe;AACxE,GAAE;AAEF,0DAA0D,GAC1D,OAAO,MAAME,oBAAuE;IAClF,CAAC7G,2BAA2BmB,OAAO,CAAC,EAAEyE;IACtC,CAAC5F,2BAA2BoB,OAAO,CAAC,EAAEgF;IACtC,CAACpG,2BAA2BqB,IAAI,CAAC,EAAEiF;IACnC,CAACtG,2BAA2BsB,IAAI,CAAC,EAAEkF;IACnC,CAACzG,0BAA0B,EAAE0G;AAC/B,EAAC;AAED;;;CAGC,GACD,OAAO,SAASK;IACd,KAAK,MAAM,CAACC,UAAUC,YAAY,IAAIC,OAAOC,OAAO,CAACL,mBAAoB;QACvE3H,gCAAgC6H,UAAUC,aAAa;YAAEG,UAAUrH;QAAU;IAC/E;AACF"}