@aglyn/plugins-crm 1.0.0-beta.217 → 1.0.0-beta.219

package/src/lib/server/contact-lifecycle-floor.js

@@ -0,0 +1,91 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * A person's lifecycle stage, FLOORED at what just happened to them
+ * (AGL-2641).
+ *
+ * The capture doors floor a stage inside `upsertHostContact`: an order
+ * names `customer` as its `initialLifecycleStage`, and the door fills an
+ * empty stage or advances an earlier one and never moves anybody back. A
+ * won deal is the same fact as a purchase — the business has decided this
+ * person bought — but it arrives at a record that already exists, through a
+ * writer that is not a capture door: the deal-stage route and the REST
+ * deals resource. This is the door's rule for them, over a contact document
+ * they already hold a reference to.
+ *
+ * The write goes into ONE holder's facet, because a stage is one business's
+ * reading of a person and the row is shared by every site in the org. The
+ * holder is the site the deal was made on, resolved to its consent group
+ * the way every other facet writer resolves it; a deal that names no site
+ * falls back to the site that captured the person, which is the one
+ * holder a contact always has. A contact that names none either is left
+ * alone and the caller told, rather than written into a facet nobody reads.
+ *
+ * The write is skipped when it would change nothing — a customer stays a
+ * customer, an evangelist stays an evangelist, `other` is never overwritten
+ * — so a caller can announce `contactStageChanged` exactly when `advanced`
+ * says the stage moved, and an automation listening for the change never
+ * hears one that did not happen.
+ */ import { consentGroupForHost, advanceContactLifecycleStage, contactFacetPath, isContactLifecycleStage, readContactFacet } from "@aglyn/aglyn/server";
+import { FieldValue } from "firebase-admin/firestore";
+import { restampCrmListFieldsAt } from "@aglyn/tenant-data-admin/server/crm-records";
+export async function floorContactLifecycleStage(options) {
+    var _snapshot_data, _options_hostId, _data_hostId, _advanceContactLifecycleStage, _data_email;
+    const { contactRef, org, floor } = options;
+    const snapshot = await contactRef.get();
+    if (!snapshot.exists) return {
+        outcome: 'missing',
+        contactId: contactRef.id
+    };
+    const data = (_snapshot_data = snapshot.data()) != null ? _snapshot_data : {};
+    const hostId = String((_options_hostId = options.hostId) != null ? _options_hostId : '').trim() || String((_data_hostId = data['hostId']) != null ? _data_hostId : '').trim();
+    if (!hostId) return {
+        outcome: 'unheld',
+        contactId: snapshot.id
+    };
+    const { groupId } = consentGroupForHost(org != null ? org : null, hostId);
+    const facet = readContactFacet(data, groupId);
+    const held = isContactLifecycleStage(facet.lifecycleStage) ? facet.lifecycleStage : undefined;
+    const lifecycleStage = (_advanceContactLifecycleStage = advanceContactLifecycleStage(held, floor)) != null ? _advanceContactLifecycleStage : floor;
+    const email = String((_data_email = data['email']) != null ? _data_email : '');
+    if (lifecycleStage === held) {
+        return {
+            outcome: 'held',
+            contactId: snapshot.id,
+            email,
+            hostId,
+            groupId,
+            lifecycleStage
+        };
+    }
+    await snapshot.ref.update({
+        [contactFacetPath(groupId, 'lifecycleStage')]: lifecycleStage,
+        updatedAt: FieldValue.serverTimestamp()
+    });
+    // The stage is what the Contacts list filters by (AGL-3321).
+    await restampCrmListFieldsAt(snapshot.ref, 'contacts');
+    return {
+        outcome: 'advanced',
+        contactId: snapshot.id,
+        email,
+        hostId,
+        groupId,
+        previousStage: held != null ? held : '',
+        lifecycleStage
+    };
+}
+
+//# sourceMappingURL=contact-lifecycle-floor.js.map

package/src/lib/server/contact-lifecycle-floor.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/contact-lifecycle-floor.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * A person's lifecycle stage, FLOORED at what just happened to them\n * (AGL-2641).\n *\n * The capture doors floor a stage inside `upsertHostContact`: an order\n * names `customer` as its `initialLifecycleStage`, and the door fills an\n * empty stage or advances an earlier one and never moves anybody back. A\n * won deal is the same fact as a purchase — the business has decided this\n * person bought — but it arrives at a record that already exists, through a\n * writer that is not a capture door: the deal-stage route and the REST\n * deals resource. This is the door's rule for them, over a contact document\n * they already hold a reference to.\n *\n * The write goes into ONE holder's facet, because a stage is one business's\n * reading of a person and the row is shared by every site in the org. The\n * holder is the site the deal was made on, resolved to its consent group\n * the way every other facet writer resolves it; a deal that names no site\n * falls back to the site that captured the person, which is the one\n * holder a contact always has. A contact that names none either is left\n * alone and the caller told, rather than written into a facet nobody reads.\n *\n * The write is skipped when it would change nothing — a customer stays a\n * customer, an evangelist stays an evangelist, `other` is never overwritten\n * — so a caller can announce `contactStageChanged` exactly when `advanced`\n * says the stage moved, and an automation listening for the change never\n * hears one that did not happen.\n */\n\nimport {\n  consentGroupForHost,\n  advanceContactLifecycleStage,\n  contactFacetPath,\n  type ContactLifecycleStage,\n  isContactLifecycleStage,\n  readContactFacet,\n} from '@aglyn/aglyn/server'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { restampCrmListFieldsAt } from '@aglyn/tenant-data-admin/server/crm-records'\n\nexport type ContactLifecycleFloor =\n  | {\n      /** The stage was raised to the floor. */\n      outcome: 'advanced'\n      contactId: string\n      /** The address on the row, for the event a caller announces. */\n      email: string\n      /** The site whose facet was written. */\n      hostId: string\n      groupId: string\n      /** The stage before the write, or `''` for a person who had none. */\n      previousStage: ContactLifecycleStage | ''\n      lifecycleStage: ContactLifecycleStage\n    }\n  | {\n      /** The person already held the floor or a later stage; nothing was written. */\n      outcome: 'held'\n      contactId: string\n      email: string\n      hostId: string\n      groupId: string\n      lifecycleStage: ContactLifecycleStage\n    }\n  | {\n      /** No such contact. */\n      outcome: 'missing'\n      contactId: string\n    }\n  | {\n      /** Neither the caller nor the contact names a site, so there is no facet to write. */\n      outcome: 'unheld'\n      contactId: string\n    }\n\nexport interface ContactLifecycleFloorOptions {\n  contactRef: FirebaseFirestore.DocumentReference\n  /**\n   * The org the contact belongs to, for the consent groups — the same\n   * document every facet writer resolves the holder through.\n   */\n  org: Record<string, unknown> | null | undefined\n  /**\n   * The site the act happened on, whose facet takes the stage. `null` for a\n   * record no site captured; the contact's own capturing site is used then.\n   */\n  hostId: string | null | undefined\n  /** The EARLIEST stage that describes what happened — see `advanceContactLifecycleStage`. */\n  floor: ContactLifecycleStage\n}\n\nexport async function floorContactLifecycleStage(\n  options: ContactLifecycleFloorOptions,\n): Promise<ContactLifecycleFloor> {\n  const { contactRef, org, floor } = options\n  const snapshot = await contactRef.get()\n  if (!snapshot.exists) return { outcome: 'missing', contactId: contactRef.id }\n  const data = (snapshot.data() ?? {}) as Record<string, unknown>\n  const hostId = String(options.hostId ?? '').trim() || String(data['hostId'] ?? '').trim()\n  if (!hostId) return { outcome: 'unheld', contactId: snapshot.id }\n\n  const { groupId } = consentGroupForHost(org ?? null, hostId)\n  const facet = readContactFacet(data, groupId)\n  const held = isContactLifecycleStage(facet.lifecycleStage)\n    ? facet.lifecycleStage\n    : undefined\n  const lifecycleStage = advanceContactLifecycleStage(held, floor) ?? floor\n  const email = String(data['email'] ?? '')\n  if (lifecycleStage === held) {\n    return { outcome: 'held', contactId: snapshot.id, email, hostId, groupId, lifecycleStage }\n  }\n  await snapshot.ref.update({\n    [contactFacetPath(groupId, 'lifecycleStage')]: lifecycleStage,\n    updatedAt: FieldValue.serverTimestamp(),\n  })\n  // The stage is what the Contacts list filters by (AGL-3321).\n  await restampCrmListFieldsAt(snapshot.ref, 'contacts')\n  return {\n    outcome: 'advanced',\n    contactId: snapshot.id,\n    email,\n    hostId,\n    groupId,\n    previousStage: held ?? '',\n    lifecycleStage,\n  }\n}\n"],"names":["consentGroupForHost","advanceContactLifecycleStage","contactFacetPath","isContactLifecycleStage","readContactFacet","FieldValue","restampCrmListFieldsAt","floorContactLifecycleStage","options","snapshot","data","contactRef","org","floor","get","exists","outcome","contactId","id","hostId","String","trim","groupId","facet","held","lifecycleStage","undefined","email","ref","update","updatedAt","serverTimestamp","previousStage"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GAED,SACEA,mBAAmB,EACnBC,4BAA4B,EAC5BC,gBAAgB,EAEhBC,uBAAuB,EACvBC,gBAAgB,QACX,sBAAqB;AAC5B,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,sBAAsB,QAAQ,8CAA6C;AAoDpF,OAAO,eAAeC,2BACpBC,OAAqC;QAKvBC,gBACQD,iBAAuCE,cAQtCT,+BACFS;IAbrB,MAAM,EAAEC,UAAU,EAAEC,GAAG,EAAEC,KAAK,EAAE,GAAGL;IACnC,MAAMC,WAAW,MAAME,WAAWG,GAAG;IACrC,IAAI,CAACL,SAASM,MAAM,EAAE,OAAO;QAAEC,SAAS;QAAWC,WAAWN,WAAWO,EAAE;IAAC;IAC5E,MAAMR,QAAQD,iBAAAA,SAASC,IAAI,cAAbD,iBAAmB,CAAC;IAClC,MAAMU,SAASC,QAAOZ,kBAAAA,QAAQW,MAAM,YAAdX,kBAAkB,IAAIa,IAAI,MAAMD,QAAOV,eAAAA,IAAI,CAAC,SAAS,YAAdA,eAAkB,IAAIW,IAAI;IACvF,IAAI,CAACF,QAAQ,OAAO;QAAEH,SAAS;QAAUC,WAAWR,SAASS,EAAE;IAAC;IAEhE,MAAM,EAAEI,OAAO,EAAE,GAAGtB,oBAAoBY,cAAAA,MAAO,MAAMO;IACrD,MAAMI,QAAQnB,iBAAiBM,MAAMY;IACrC,MAAME,OAAOrB,wBAAwBoB,MAAME,cAAc,IACrDF,MAAME,cAAc,GACpBC;IACJ,MAAMD,kBAAiBxB,gCAAAA,6BAA6BuB,MAAMX,kBAAnCZ,gCAA6CY;IACpE,MAAMc,QAAQP,QAAOV,cAAAA,IAAI,CAAC,QAAQ,YAAbA,cAAiB;IACtC,IAAIe,mBAAmBD,MAAM;QAC3B,OAAO;YAAER,SAAS;YAAQC,WAAWR,SAASS,EAAE;YAAES;YAAOR;YAAQG;YAASG;QAAe;IAC3F;IACA,MAAMhB,SAASmB,GAAG,CAACC,MAAM,CAAC;QACxB,CAAC3B,iBAAiBoB,SAAS,kBAAkB,EAAEG;QAC/CK,WAAWzB,WAAW0B,eAAe;IACvC;IACA,6DAA6D;IAC7D,MAAMzB,uBAAuBG,SAASmB,GAAG,EAAE;IAC3C,OAAO;QACLZ,SAAS;QACTC,WAAWR,SAASS,EAAE;QACtBS;QACAR;QACAG;QACAU,aAAa,EAAER,eAAAA,OAAQ;QACvBC;IACF;AACF"}

package/src/lib/server/contact-remove.d.ts

@@ -0,0 +1,75 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * `POST /api/crm/contact-remove` — a holder lets contacts go, and a person's
+ * "no" to marketing stays (AGL-3338).
+ *
+ * Body: `{ hostId, contactIds }` under a site, or `{ orgId, hostId?,
+ * contactIds }` at the organization level. Answers `ContactRemoveResponse`:
+ * one outcome per contact, in the order the ids were sent.
+ *
+ * ## Delete is a detach, and a refusal is not let go
+ *
+ * A contact is shared by every site that captured the person. Removing it
+ * from one drops that holder's facet, consent grants, capture attribution
+ * and scope tokens, and the document is deleted only when nobody else holds
+ * it (`planContactDetach`). A refusal of marketing email is kept either way:
+ * a detach leaves it on the document for the holders that remain, and the
+ * last holder's delete copies every refusal into the organization's retained
+ * store in the same transaction (`removeContactKeepingRefusals`). The list
+ * gate reads both, so deleting a person is not a way to put somebody who
+ * said no on a list.
+ *
+ * ## Why a route
+ *
+ * The decision has to be made against the document's consent map, which a
+ * table row does not project, and it has to land in one commit with the
+ * retained store, which no client may write. So the rules close a client's
+ * update and delete of a contact, and the console's removals arrive here.
+ *
+ * ## Who may call it
+ *
+ * The CRM writer the other contact routes admit (`authorizeCrmWriter`),
+ * whose access reaches the site under a site. Each contact must be one the
+ * caller may read and, under a site, one the site's hub lists. Then, as the
+ * rules asked before the route existed:
+ *
+ *  - a DELETE needs the caller's reach to cover every holder of the row, so
+ *    a site collaborator cannot delete a person another site also holds;
+ *  - a DETACH changes who a record is shared with, which only an org-wide
+ *    member may do (`scopeUnchanged()` in the rules).
+ *
+ * ## The plan
+ *
+ * Letting a holder go is the CRM's "Remove from this site", included from
+ * Starter (AGL-2851), so a detach is refused on a plan without the CRM. A
+ * delete is not: removing a workspace's own record stays open on every plan.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/** What the suite gate names for a detach on a plan without the CRM. */
+export declare const CONTACT_DETACH_SUITE_ACT = "Removing a contact from one site";
+/**
+ * What a site is told for a contact it sees only because it was SHARED with
+ * it (AGL-3336): it holds nothing there to let go of, and taking the share
+ * away is a manager's unshare, not a removal.
+ */
+export declare const CONTACT_REMOVE_SHARED_REFUSAL: string;
+/** A contact read at the organization level that no site has captured. */
+export declare const CONTACT_REMOVE_NO_HOLDER = "No site holds this contact yet, so there is no site to remove it from.";
+/** What a site collaborator is told for a person another site also holds. */
+export declare const CONTACT_REMOVE_SCOPED_REFUSAL: string;
+export declare const crmContactRemoveHandler: PluginApiHandler;

package/src/lib/server/contact-remove.js

@@ -0,0 +1,244 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * `POST /api/crm/contact-remove` — a holder lets contacts go, and a person's
+ * "no" to marketing stays (AGL-3338).
+ *
+ * Body: `{ hostId, contactIds }` under a site, or `{ orgId, hostId?,
+ * contactIds }` at the organization level. Answers `ContactRemoveResponse`:
+ * one outcome per contact, in the order the ids were sent.
+ *
+ * ## Delete is a detach, and a refusal is not let go
+ *
+ * A contact is shared by every site that captured the person. Removing it
+ * from one drops that holder's facet, consent grants, capture attribution
+ * and scope tokens, and the document is deleted only when nobody else holds
+ * it (`planContactDetach`). A refusal of marketing email is kept either way:
+ * a detach leaves it on the document for the holders that remain, and the
+ * last holder's delete copies every refusal into the organization's retained
+ * store in the same transaction (`removeContactKeepingRefusals`). The list
+ * gate reads both, so deleting a person is not a way to put somebody who
+ * said no on a list.
+ *
+ * ## Why a route
+ *
+ * The decision has to be made against the document's consent map, which a
+ * table row does not project, and it has to land in one commit with the
+ * retained store, which no client may write. So the rules close a client's
+ * update and delete of a contact, and the console's removals arrive here.
+ *
+ * ## Who may call it
+ *
+ * The CRM writer the other contact routes admit (`authorizeCrmWriter`),
+ * whose access reaches the site under a site. Each contact must be one the
+ * caller may read and, under a site, one the site's hub lists. Then, as the
+ * rules asked before the route existed:
+ *
+ *  - a DELETE needs the caller's reach to cover every holder of the row, so
+ *    a site collaborator cannot delete a person another site also holds;
+ *  - a DETACH changes who a record is shared with, which only an org-wide
+ *    member may do (`scopeUnchanged()` in the rules).
+ *
+ * ## The plan
+ *
+ * Letting a holder go is the CRM's "Remove from this site", included from
+ * Starter (AGL-2851), so a detach is refused on a plan without the CRM. A
+ * delete is not: removing a workspace's own record stays open on every plan.
+ */ import { consentGroupForHost, crmReadTokens, heldScopeTokens, isOrgWideMember, memberScopeTokens, planContactDetach, seenOnlyThroughGrant, visibleToTokens } from "@aglyn/aglyn/server";
+import { firebaseAdmin, removeContactKeepingRefusals, restampCrmListFieldsOf } from "@aglyn/tenant-data-admin";
+import { CRM_CONTACT_REMOVE_MAX } from "../model/contact-remove.js";
+import { typed } from "./contact-profile.js";
+import { readCrmRouteScope } from "./org-caller.js";
+import { crmSuiteRefusal } from "./suite-gate.js";
+import { authorizeCrmWriter, canReach } from "./task-routes.js";
+import { contactPrimaryGroup } from "../model/contact-holder.js";
+/** What the suite gate names for a detach on a plan without the CRM. */ export const CONTACT_DETACH_SUITE_ACT = 'Removing a contact from one site';
+/**
+ * What a site is told for a contact it sees only because it was SHARED with
+ * it (AGL-3336): it holds nothing there to let go of, and taking the share
+ * away is a manager's unshare, not a removal.
+ */ export const CONTACT_REMOVE_SHARED_REFUSAL = 'This contact was shared with this site by another site. An owner or ' + 'admin can stop sharing it from its Sharing card.';
+/** A contact read at the organization level that no site has captured. */ export const CONTACT_REMOVE_NO_HOLDER = 'No site holds this contact yet, so there is no site to remove it from.';
+/** What a site collaborator is told for a person another site also holds. */ export const CONTACT_REMOVE_SCOPED_REFUSAL = 'Other sites hold this contact too, and your access is limited to ' + 'specific sites. Ask an organization administrator to remove it.';
+/** How many contacts are removed at once — each in its own transaction. */ const CONCURRENCY = 20;
+const refused = (contactId, error)=>({
+        contactId,
+        ok: false,
+        error
+    });
+/** The ids a body names, deduplicated — or `null` when any is unreadable or there are too many. */ function readContactIds(value) {
+    if (!Array.isArray(value) || !value.length || value.length > CRM_CONTACT_REMOVE_MAX) {
+        return null;
+    }
+    const ids = value.map((id)=>typed(id, 200));
+    if (ids.some((id)=>!id || id.includes('/'))) return null;
+    return [
+        ...new Set(ids)
+    ];
+}
+/** Under a site, whether the caller's access reaches it. */ function reachesSite(writer, hostId) {
+    var _writer_member_hostAccess, _writer_member;
+    return writer.staff || isOrgWideMember(writer.member) || Boolean((_writer_member = writer.member) == null ? void 0 : (_writer_member_hostAccess = _writer_member.hostAccess) == null ? void 0 : _writer_member_hostAccess[hostId]);
+}
+/** Whether the caller's reach is the whole organization. */ const orgWide = (writer)=>writer.staff || writer.level === 'org' || isOrgWideMember(writer.member);
+export const crmContactRemoveHandler = async (req, res)=>{
+    var _req_body;
+    if (req.method !== 'POST') {
+        res.setHeader('Allow', 'POST');
+        res.status(405).json({
+            error: 'Method not allowed'
+        });
+        return;
+    }
+    const body = (_req_body = req.body) != null ? _req_body : {};
+    const scope = readCrmRouteScope(body);
+    if (!scope) {
+        res.status(400).json({
+            error: 'Missing hostId'
+        });
+        return;
+    }
+    const contactIds = readContactIds(body['contactIds']);
+    if (!contactIds) {
+        res.status(400).json({
+            error: `Name between 1 and ${CRM_CONTACT_REMOVE_MAX} contacts.`
+        });
+        return;
+    }
+    try {
+        const writer = await authorizeCrmWriter(req, scope, {
+            suiteAct: null
+        });
+        if (writer.ok === false) {
+            res.status(writer.status).json(writer.body);
+            return;
+        }
+        if (scope.level === 'site' && !reachesSite(writer, scope.hostId)) {
+            res.status(403).json({
+                error: 'Your access to this organization does not reach this site.'
+            });
+            return;
+        }
+        const firestore = firebaseAdmin.app().firestore();
+        const contacts = firestore.collection('orgs').doc(writer.orgId).collection('contacts');
+        const siteGroup = scope.level === 'site' ? consentGroupForHost(writer.org, scope.hostId) : null;
+        const siteTokens = siteGroup ? crmReadTokens(siteGroup) : null;
+        const suite = crmSuiteRefusal(writer.org, CONTACT_DETACH_SUITE_ACT);
+        const callerTokens = new Set(memberScopeTokens(writer.member));
+        const nowMs = Date.now();
+        /*
+     * Decided inside each contact's transaction, against the document as it
+     * was read there: the reach, the holder letting go, and what that means.
+     */ const decide = (contact)=>{
+            const visibleTo = contact['visibleTo'];
+            if (!canReach(writer, visibleTo)) return {
+                refused: 'That contact is not visible to you.'
+            };
+            if (siteTokens && !visibleToTokens(visibleTo, siteTokens)) {
+                return {
+                    refused: 'That contact is not visible to this site.'
+                };
+            }
+            if (siteGroup && siteGroup.hostIds.every((hostId)=>seenOnlyThroughGrant(contact, hostId))) {
+                return {
+                    refused: CONTACT_REMOVE_SHARED_REFUSAL
+                };
+            }
+            const group = siteGroup != null ? siteGroup : contactPrimaryGroup(contact, writer.org);
+            if (!group.groupId || !group.hostIds.length) return {
+                refused: CONTACT_REMOVE_NO_HOLDER
+            };
+            const plan = planContactDetach(contact, group);
+            if (plan.action === 'delete') {
+                // The HOLDERS: a site the contact was only shared with holds
+                // nothing, so it never stands between a holder and its delete.
+                const holders = heldScopeTokens(contact);
+                if (!orgWide(writer) && !holders.every((token)=>callerTokens.has(token))) {
+                    return {
+                        refused: CONTACT_REMOVE_SCOPED_REFUSAL
+                    };
+                }
+                return plan;
+            }
+            if (!orgWide(writer)) return {
+                refused: CONTACT_REMOVE_SCOPED_REFUSAL
+            };
+            if (suite) return {
+                refused: suite.body.error
+            };
+            return plan;
+        };
+        const outcomes = new Map();
+        const detached = [];
+        for(let at = 0; at < contactIds.length; at += CONCURRENCY){
+            await Promise.all(contactIds.slice(at, at + CONCURRENCY).map(async (contactId)=>{
+                const contactRef = contacts.doc(contactId);
+                try {
+                    const removal = await removeContactKeepingRefusals({
+                        contactRef,
+                        decide,
+                        nowMs
+                    });
+                    if (removal.outcome === 'missing') {
+                        outcomes.set(contactId, refused(contactId, 'That contact no longer exists.'));
+                    } else if (removal.outcome === 'refused') {
+                        outcomes.set(contactId, refused(contactId, removal.error));
+                    } else if (removal.outcome === 'detached') {
+                        detached.push(contactRef);
+                        outcomes.set(contactId, {
+                            contactId,
+                            ok: true,
+                            removed: 'detached'
+                        });
+                    } else {
+                        outcomes.set(contactId, {
+                            contactId,
+                            ok: true,
+                            removed: 'deleted'
+                        });
+                    }
+                } catch (error) {
+                    console.error('[crm] contact-remove could not remove a contact', contactId, error);
+                    outcomes.set(contactId, refused(contactId, 'The contact could not be removed.'));
+                }
+            }));
+        }
+        // A detached row still carries the facet keys and scoped search tokens of
+        // the holder that let it go, which the Contacts list filters by (AGL-3321).
+        // Its own catch: the contacts are removed by now, and a list stamp that
+        // could not move is not a removal that failed.
+        if (detached.length) {
+            await restampCrmListFieldsOf(detached, 'contacts').catch((error)=>{
+                console.error('[crm] contact-remove could not restamp list fields', error);
+            });
+        }
+        const answer = {
+            ok: true,
+            results: contactIds.map((contactId)=>{
+                var _outcomes_get;
+                return (_outcomes_get = outcomes.get(contactId)) != null ? _outcomes_get : refused(contactId, 'The contact could not be removed.');
+            })
+        };
+        res.status(200).json(answer);
+    } catch (error) {
+        console.error('[crm] contact-remove failed', error);
+        res.status(500).json({
+            error: 'The contacts could not be removed.'
+        });
+    }
+};
+
+//# sourceMappingURL=contact-remove.js.map

package/src/lib/server/contact-remove.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/contact-remove.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * `POST /api/crm/contact-remove` — a holder lets contacts go, and a person's\n * \"no\" to marketing stays (AGL-3338).\n *\n * Body: `{ hostId, contactIds }` under a site, or `{ orgId, hostId?,\n * contactIds }` at the organization level. Answers `ContactRemoveResponse`:\n * one outcome per contact, in the order the ids were sent.\n *\n * ## Delete is a detach, and a refusal is not let go\n *\n * A contact is shared by every site that captured the person. Removing it\n * from one drops that holder's facet, consent grants, capture attribution\n * and scope tokens, and the document is deleted only when nobody else holds\n * it (`planContactDetach`). A refusal of marketing email is kept either way:\n * a detach leaves it on the document for the holders that remain, and the\n * last holder's delete copies every refusal into the organization's retained\n * store in the same transaction (`removeContactKeepingRefusals`). The list\n * gate reads both, so deleting a person is not a way to put somebody who\n * said no on a list.\n *\n * ## Why a route\n *\n * The decision has to be made against the document's consent map, which a\n * table row does not project, and it has to land in one commit with the\n * retained store, which no client may write. So the rules close a client's\n * update and delete of a contact, and the console's removals arrive here.\n *\n * ## Who may call it\n *\n * The CRM writer the other contact routes admit (`authorizeCrmWriter`),\n * whose access reaches the site under a site. Each contact must be one the\n * caller may read and, under a site, one the site's hub lists. Then, as the\n * rules asked before the route existed:\n *\n *  - a DELETE needs the caller's reach to cover every holder of the row, so\n *    a site collaborator cannot delete a person another site also holds;\n *  - a DETACH changes who a record is shared with, which only an org-wide\n *    member may do (`scopeUnchanged()` in the rules).\n *\n * ## The plan\n *\n * Letting a holder go is the CRM's \"Remove from this site\", included from\n * Starter (AGL-2851), so a detach is refused on a plan without the CRM. A\n * delete is not: removing a workspace's own record stays open on every plan.\n */\n\nimport {\n  consentGroupForHost,\n  crmReadTokens,\n  heldScopeTokens,\n  isOrgWideMember,\n  memberScopeTokens,\n  planContactDetach,\n  type PluginApiHandler,\n  seenOnlyThroughGrant,\n  visibleToTokens,\n} from '@aglyn/aglyn/server'\nimport {\n  firebaseAdmin,\n  removeContactKeepingRefusals,\n  restampCrmListFieldsOf,\n} from '@aglyn/tenant-data-admin'\nimport {\n  type ContactRemoveOutcome,\n  type ContactRemoveResponse,\n  CRM_CONTACT_REMOVE_MAX,\n} from '../model/contact-remove'\nimport { typed } from './contact-profile'\nimport { readCrmRouteScope } from './org-caller'\nimport { crmSuiteRefusal } from './suite-gate'\nimport { authorizeCrmWriter, canReach, type Writer } from './task-routes'\nimport { contactPrimaryGroup } from '../model/contact-holder'\n\n/** What the suite gate names for a detach on a plan without the CRM. */\nexport const CONTACT_DETACH_SUITE_ACT = 'Removing a contact from one site'\n\n/**\n * What a site is told for a contact it sees only because it was SHARED with\n * it (AGL-3336): it holds nothing there to let go of, and taking the share\n * away is a manager's unshare, not a removal.\n */\nexport const CONTACT_REMOVE_SHARED_REFUSAL =\n  'This contact was shared with this site by another site. An owner or ' +\n  'admin can stop sharing it from its Sharing card.'\n\n/** A contact read at the organization level that no site has captured. */\nexport const CONTACT_REMOVE_NO_HOLDER =\n  'No site holds this contact yet, so there is no site to remove it from.'\n\n/** What a site collaborator is told for a person another site also holds. */\nexport const CONTACT_REMOVE_SCOPED_REFUSAL =\n  'Other sites hold this contact too, and your access is limited to ' +\n  'specific sites. Ask an organization administrator to remove it.'\n\n/** How many contacts are removed at once — each in its own transaction. */\nconst CONCURRENCY = 20\n\nconst refused = (contactId: string, error: string): ContactRemoveOutcome => ({\n  contactId,\n  ok: false,\n  error,\n})\n\n/** The ids a body names, deduplicated — or `null` when any is unreadable or there are too many. */\nfunction readContactIds(value: unknown): string[] | null {\n  if (!Array.isArray(value) || !value.length || value.length > CRM_CONTACT_REMOVE_MAX) {\n    return null\n  }\n  const ids = value.map((id) => typed(id, 200))\n  if (ids.some((id) => !id || id.includes('/'))) return null\n  return [...new Set(ids)]\n}\n\n/** Under a site, whether the caller's access reaches it. */\nfunction reachesSite(writer: Writer, hostId: string): boolean {\n  return (\n    writer.staff ||\n    isOrgWideMember(writer.member) ||\n    Boolean((writer.member?.hostAccess as Record<string, unknown> | undefined)?.[hostId])\n  )\n}\n\n/** Whether the caller's reach is the whole organization. */\nconst orgWide = (writer: Writer): boolean =>\n  writer.staff || writer.level === 'org' || isOrgWideMember(writer.member)\n\nexport const crmContactRemoveHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  const body = (req.body ?? {}) as Record<string, unknown>\n  const scope = readCrmRouteScope(body)\n  if (!scope) {\n    res.status(400).json({ error: 'Missing hostId' })\n    return\n  }\n  const contactIds = readContactIds(body['contactIds'])\n  if (!contactIds) {\n    res.status(400).json({ error: `Name between 1 and ${CRM_CONTACT_REMOVE_MAX} contacts.` })\n    return\n  }\n\n  try {\n    const writer = await authorizeCrmWriter(req, scope, { suiteAct: null })\n    if (writer.ok === false) {\n      res.status(writer.status).json(writer.body)\n      return\n    }\n    if (scope.level === 'site' && !reachesSite(writer, scope.hostId)) {\n      res.status(403).json({ error: 'Your access to this organization does not reach this site.' })\n      return\n    }\n\n    const firestore = firebaseAdmin.app().firestore()\n    const contacts = firestore.collection('orgs').doc(writer.orgId).collection('contacts')\n    const siteGroup =\n      scope.level === 'site' ? consentGroupForHost(writer.org, scope.hostId) : null\n    const siteTokens = siteGroup ? crmReadTokens(siteGroup) : null\n    const suite = crmSuiteRefusal(writer.org, CONTACT_DETACH_SUITE_ACT)\n    const callerTokens = new Set<string>(memberScopeTokens(writer.member))\n    const nowMs = Date.now()\n\n    /*\n     * Decided inside each contact's transaction, against the document as it\n     * was read there: the reach, the holder letting go, and what that means.\n     */\n    const decide = (contact: Record<string, unknown>) => {\n      const visibleTo = contact['visibleTo'] as string[] | undefined\n      if (!canReach(writer, visibleTo)) return { refused: 'That contact is not visible to you.' }\n      if (siteTokens && !visibleToTokens(visibleTo, siteTokens)) {\n        return { refused: 'That contact is not visible to this site.' }\n      }\n      if (siteGroup && siteGroup.hostIds.every((hostId) => seenOnlyThroughGrant(contact, hostId))) {\n        return { refused: CONTACT_REMOVE_SHARED_REFUSAL }\n      }\n      const group = siteGroup ?? contactPrimaryGroup(contact, writer.org)\n      if (!group.groupId || !group.hostIds.length) return { refused: CONTACT_REMOVE_NO_HOLDER }\n      const plan = planContactDetach(contact, group)\n      if (plan.action === 'delete') {\n        // The HOLDERS: a site the contact was only shared with holds\n        // nothing, so it never stands between a holder and its delete.\n        const holders = heldScopeTokens(contact)\n        if (!orgWide(writer) && !holders.every((token) => callerTokens.has(token))) {\n          return { refused: CONTACT_REMOVE_SCOPED_REFUSAL }\n        }\n        return plan\n      }\n      if (!orgWide(writer)) return { refused: CONTACT_REMOVE_SCOPED_REFUSAL }\n      if (suite) return { refused: suite.body.error }\n      return plan\n    }\n\n    const outcomes = new Map<string, ContactRemoveOutcome>()\n    const detached: FirebaseFirestore.DocumentReference[] = []\n    for (let at = 0; at < contactIds.length; at += CONCURRENCY) {\n      await Promise.all(\n        contactIds.slice(at, at + CONCURRENCY).map(async (contactId) => {\n          const contactRef = contacts.doc(contactId)\n          try {\n            const removal = await removeContactKeepingRefusals({ contactRef, decide, nowMs })\n            if (removal.outcome === 'missing') {\n              outcomes.set(contactId, refused(contactId, 'That contact no longer exists.'))\n            } else if (removal.outcome === 'refused') {\n              outcomes.set(contactId, refused(contactId, removal.error))\n            } else if (removal.outcome === 'detached') {\n              detached.push(contactRef)\n              outcomes.set(contactId, { contactId, ok: true, removed: 'detached' })\n            } else {\n              outcomes.set(contactId, { contactId, ok: true, removed: 'deleted' })\n            }\n          } catch (error) {\n            console.error('[crm] contact-remove could not remove a contact', contactId, error)\n            outcomes.set(contactId, refused(contactId, 'The contact could not be removed.'))\n          }\n        }),\n      )\n    }\n    // A detached row still carries the facet keys and scoped search tokens of\n    // the holder that let it go, which the Contacts list filters by (AGL-3321).\n    // Its own catch: the contacts are removed by now, and a list stamp that\n    // could not move is not a removal that failed.\n    if (detached.length) {\n      await restampCrmListFieldsOf(detached, 'contacts').catch((error: unknown) => {\n        console.error('[crm] contact-remove could not restamp list fields', error)\n      })\n    }\n\n    const answer: ContactRemoveResponse = {\n      ok: true,\n      results: contactIds.map(\n        (contactId) =>\n          outcomes.get(contactId) ?? refused(contactId, 'The contact could not be removed.'),\n      ),\n    }\n    res.status(200).json(answer)\n  } catch (error) {\n    console.error('[crm] contact-remove failed', error)\n    res.status(500).json({ error: 'The contacts could not be removed.' })\n  }\n}\n"],"names":["consentGroupForHost","crmReadTokens","heldScopeTokens","isOrgWideMember","memberScopeTokens","planContactDetach","seenOnlyThroughGrant","visibleToTokens","firebaseAdmin","removeContactKeepingRefusals","restampCrmListFieldsOf","CRM_CONTACT_REMOVE_MAX","typed","readCrmRouteScope","crmSuiteRefusal","authorizeCrmWriter","canReach","contactPrimaryGroup","CONTACT_DETACH_SUITE_ACT","CONTACT_REMOVE_SHARED_REFUSAL","CONTACT_REMOVE_NO_HOLDER","CONTACT_REMOVE_SCOPED_REFUSAL","CONCURRENCY","refused","contactId","error","ok","readContactIds","value","Array","isArray","length","ids","map","id","some","includes","Set","reachesSite","writer","hostId","staff","member","Boolean","hostAccess","orgWide","level","crmContactRemoveHandler","req","res","method","setHeader","status","json","body","scope","contactIds","suiteAct","firestore","app","contacts","collection","doc","orgId","siteGroup","org","siteTokens","suite","callerTokens","nowMs","Date","now","decide","contact","visibleTo","hostIds","every","group","groupId","plan","action","holders","token","has","outcomes","Map","detached","at","Promise","all","slice","contactRef","removal","outcome","set","push","removed","console","catch","answer","results","get"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CC,GAED,SACEA,mBAAmB,EACnBC,aAAa,EACbC,eAAe,EACfC,eAAe,EACfC,iBAAiB,EACjBC,iBAAiB,EAEjBC,oBAAoB,EACpBC,eAAe,QACV,sBAAqB;AAC5B,SACEC,aAAa,EACbC,4BAA4B,EAC5BC,sBAAsB,QACjB,2BAA0B;AACjC,SAGEC,sBAAsB,QACjB,6BAAyB;AAChC,SAASC,KAAK,QAAQ,uBAAmB;AACzC,SAASC,iBAAiB,QAAQ,kBAAc;AAChD,SAASC,eAAe,QAAQ,kBAAc;AAC9C,SAASC,kBAAkB,EAAEC,QAAQ,QAAqB,mBAAe;AACzE,SAASC,mBAAmB,QAAQ,6BAAyB;AAE7D,sEAAsE,GACtE,OAAO,MAAMC,2BAA2B,mCAAkC;AAE1E;;;;CAIC,GACD,OAAO,MAAMC,gCACX,yEACA,mDAAkD;AAEpD,wEAAwE,GACxE,OAAO,MAAMC,2BACX,yEAAwE;AAE1E,2EAA2E,GAC3E,OAAO,MAAMC,gCACX,sEACA,kEAAiE;AAEnE,yEAAyE,GACzE,MAAMC,cAAc;AAEpB,MAAMC,UAAU,CAACC,WAAmBC,QAAyC,CAAA;QAC3ED;QACAE,IAAI;QACJD;IACF,CAAA;AAEA,iGAAiG,GACjG,SAASE,eAAeC,KAAc;IACpC,IAAI,CAACC,MAAMC,OAAO,CAACF,UAAU,CAACA,MAAMG,MAAM,IAAIH,MAAMG,MAAM,GAAGpB,wBAAwB;QACnF,OAAO;IACT;IACA,MAAMqB,MAAMJ,MAAMK,GAAG,CAAC,CAACC,KAAOtB,MAAMsB,IAAI;IACxC,IAAIF,IAAIG,IAAI,CAAC,CAACD,KAAO,CAACA,MAAMA,GAAGE,QAAQ,CAAC,OAAO,OAAO;IACtD,OAAO;WAAI,IAAIC,IAAIL;KAAK;AAC1B;AAEA,0DAA0D,GAC1D,SAASM,YAAYC,MAAc,EAAEC,MAAc;QAItCD,2BAAAA;IAHX,OACEA,OAAOE,KAAK,IACZtC,gBAAgBoC,OAAOG,MAAM,KAC7BC,SAASJ,iBAAAA,OAAOG,MAAM,sBAAbH,4BAAAA,eAAeK,UAAU,qBAA1B,AAACL,yBAAmE,CAACC,OAAO;AAExF;AAEA,0DAA0D,GAC1D,MAAMK,UAAU,CAACN,SACfA,OAAOE,KAAK,IAAIF,OAAOO,KAAK,KAAK,SAAS3C,gBAAgBoC,OAAOG,MAAM;AAEzE,OAAO,MAAMK,0BAA4C,OAAOC,KAAKC;QAMrDD;IALd,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE5B,OAAO;QAAqB;QACnD;IACF;IACA,MAAM6B,QAAQN,YAAAA,IAAIM,IAAI,YAARN,YAAY,CAAC;IAC3B,MAAMO,QAAQ1C,kBAAkByC;IAChC,IAAI,CAACC,OAAO;QACVN,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE5B,OAAO;QAAiB;QAC/C;IACF;IACA,MAAM+B,aAAa7B,eAAe2B,IAAI,CAAC,aAAa;IACpD,IAAI,CAACE,YAAY;QACfP,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE5B,OAAO,CAAC,mBAAmB,EAAEd,uBAAuB,UAAU,CAAC;QAAC;QACvF;IACF;IAEA,IAAI;QACF,MAAM4B,SAAS,MAAMxB,mBAAmBiC,KAAKO,OAAO;YAAEE,UAAU;QAAK;QACrE,IAAIlB,OAAOb,EAAE,KAAK,OAAO;YACvBuB,IAAIG,MAAM,CAACb,OAAOa,MAAM,EAAEC,IAAI,CAACd,OAAOe,IAAI;YAC1C;QACF;QACA,IAAIC,MAAMT,KAAK,KAAK,UAAU,CAACR,YAAYC,QAAQgB,MAAMf,MAAM,GAAG;YAChES,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAE5B,OAAO;YAA6D;YAC3F;QACF;QAEA,MAAMiC,YAAYlD,cAAcmD,GAAG,GAAGD,SAAS;QAC/C,MAAME,WAAWF,UAAUG,UAAU,CAAC,QAAQC,GAAG,CAACvB,OAAOwB,KAAK,EAAEF,UAAU,CAAC;QAC3E,MAAMG,YACJT,MAAMT,KAAK,KAAK,SAAS9C,oBAAoBuC,OAAO0B,GAAG,EAAEV,MAAMf,MAAM,IAAI;QAC3E,MAAM0B,aAAaF,YAAY/D,cAAc+D,aAAa;QAC1D,MAAMG,QAAQrD,gBAAgByB,OAAO0B,GAAG,EAAE/C;QAC1C,MAAMkD,eAAe,IAAI/B,IAAYjC,kBAAkBmC,OAAOG,MAAM;QACpE,MAAM2B,QAAQC,KAAKC,GAAG;QAEtB;;;KAGC,GACD,MAAMC,SAAS,CAACC;YACd,MAAMC,YAAYD,OAAO,CAAC,YAAY;YACtC,IAAI,CAACzD,SAASuB,QAAQmC,YAAY,OAAO;gBAAEnD,SAAS;YAAsC;YAC1F,IAAI2C,cAAc,CAAC3D,gBAAgBmE,WAAWR,aAAa;gBACzD,OAAO;oBAAE3C,SAAS;gBAA4C;YAChE;YACA,IAAIyC,aAAaA,UAAUW,OAAO,CAACC,KAAK,CAAC,CAACpC,SAAWlC,qBAAqBmE,SAASjC,UAAU;gBAC3F,OAAO;oBAAEjB,SAASJ;gBAA8B;YAClD;YACA,MAAM0D,QAAQb,oBAAAA,YAAa/C,oBAAoBwD,SAASlC,OAAO0B,GAAG;YAClE,IAAI,CAACY,MAAMC,OAAO,IAAI,CAACD,MAAMF,OAAO,CAAC5C,MAAM,EAAE,OAAO;gBAAER,SAASH;YAAyB;YACxF,MAAM2D,OAAO1E,kBAAkBoE,SAASI;YACxC,IAAIE,KAAKC,MAAM,KAAK,UAAU;gBAC5B,6DAA6D;gBAC7D,+DAA+D;gBAC/D,MAAMC,UAAU/E,gBAAgBuE;gBAChC,IAAI,CAAC5B,QAAQN,WAAW,CAAC0C,QAAQL,KAAK,CAAC,CAACM,QAAUd,aAAae,GAAG,CAACD,SAAS;oBAC1E,OAAO;wBAAE3D,SAASF;oBAA8B;gBAClD;gBACA,OAAO0D;YACT;YACA,IAAI,CAAClC,QAAQN,SAAS,OAAO;gBAAEhB,SAASF;YAA8B;YACtE,IAAI8C,OAAO,OAAO;gBAAE5C,SAAS4C,MAAMb,IAAI,CAAC7B,KAAK;YAAC;YAC9C,OAAOsD;QACT;QAEA,MAAMK,WAAW,IAAIC;QACrB,MAAMC,WAAkD,EAAE;QAC1D,IAAK,IAAIC,KAAK,GAAGA,KAAK/B,WAAWzB,MAAM,EAAEwD,MAAMjE,YAAa;YAC1D,MAAMkE,QAAQC,GAAG,CACfjC,WAAWkC,KAAK,CAACH,IAAIA,KAAKjE,aAAaW,GAAG,CAAC,OAAOT;gBAChD,MAAMmE,aAAa/B,SAASE,GAAG,CAACtC;gBAChC,IAAI;oBACF,MAAMoE,UAAU,MAAMnF,6BAA6B;wBAAEkF;wBAAYnB;wBAAQH;oBAAM;oBAC/E,IAAIuB,QAAQC,OAAO,KAAK,WAAW;wBACjCT,SAASU,GAAG,CAACtE,WAAWD,QAAQC,WAAW;oBAC7C,OAAO,IAAIoE,QAAQC,OAAO,KAAK,WAAW;wBACxCT,SAASU,GAAG,CAACtE,WAAWD,QAAQC,WAAWoE,QAAQnE,KAAK;oBAC1D,OAAO,IAAImE,QAAQC,OAAO,KAAK,YAAY;wBACzCP,SAASS,IAAI,CAACJ;wBACdP,SAASU,GAAG,CAACtE,WAAW;4BAAEA;4BAAWE,IAAI;4BAAMsE,SAAS;wBAAW;oBACrE,OAAO;wBACLZ,SAASU,GAAG,CAACtE,WAAW;4BAAEA;4BAAWE,IAAI;4BAAMsE,SAAS;wBAAU;oBACpE;gBACF,EAAE,OAAOvE,OAAO;oBACdwE,QAAQxE,KAAK,CAAC,mDAAmDD,WAAWC;oBAC5E2D,SAASU,GAAG,CAACtE,WAAWD,QAAQC,WAAW;gBAC7C;YACF;QAEJ;QACA,0EAA0E;QAC1E,4EAA4E;QAC5E,wEAAwE;QACxE,+CAA+C;QAC/C,IAAI8D,SAASvD,MAAM,EAAE;YACnB,MAAMrB,uBAAuB4E,UAAU,YAAYY,KAAK,CAAC,CAACzE;gBACxDwE,QAAQxE,KAAK,CAAC,sDAAsDA;YACtE;QACF;QAEA,MAAM0E,SAAgC;YACpCzE,IAAI;YACJ0E,SAAS5C,WAAWvB,GAAG,CACrB,CAACT;oBACC4D;wBAAAA,gBAAAA,SAASiB,GAAG,CAAC7E,sBAAb4D,gBAA2B7D,QAAQC,WAAW;;QAEpD;QACAyB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC8C;IACvB,EAAE,OAAO1E,OAAO;QACdwE,QAAQxE,KAAK,CAAC,+BAA+BA;QAC7CwB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE5B,OAAO;QAAqC;IACrE;AACF,EAAC"}

package/src/lib/server/contact-update.js

@@ -68,7 +68,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * link: summed per company and settled once the contacts are written, so a
  * company deleted in between cannot fail the save of the people at it — the
  * company page's live aggregate is what corrects a count that did not move.
- */ import { consentGroupForHost, CONTACT_FIELDS_MAX_PER_ORG, campaignMembershipValue, contactCampaignFieldPath, contactFacetPath, contactPrimaryGroup, CRM_COLLECTIONS, CRM_LEAD_SOURCE_PICKLIST, CRM_MEDIA_IDS_FIELD, crmReadTokens, effectiveCrmLeadSourcePicklist, isOrgWideMember, judgeCrmLeadSource, normalizeAddress, normalizeCrmMediaIds, normalizeCrmPicklistLabel, normalizePhone, planContactCompanyLink, readContactCompanyLink, readContactFacet, readCrmCustomInput, visibleToTokens } from "@aglyn/aglyn/server";
+ */ import { consentGroupForHost, CONTACT_FIELDS_MAX_PER_ORG, campaignMembershipValue, contactCampaignFieldPath, contactFacetPath, CRM_COLLECTIONS, CRM_LEAD_SOURCE_PICKLIST, CRM_MEDIA_IDS_FIELD, crmReadTokens, effectiveCrmLeadSourcePicklist, isOrgWideMember, judgeCrmLeadSource, normalizeAddress, normalizeCrmMediaIds, normalizeCrmPicklistLabel, normalizePhone, planContactCompanyLink, readContactCompanyLink, readContactFacet, readCrmCustomInput, visibleToTokens } from "@aglyn/aglyn/server";
 import { companyContactsCountFields, contactCompanyLinkFields, firebaseAdmin, resolveOrgMembership, restampCrmListFieldsOf } from "@aglyn/tenant-data-admin";
 import { FieldValue } from "firebase-admin/firestore";
 import { CONTACT_UPDATE_FIELDS, CRM_CONTACT_UPDATE_MAX } from "../model/contact-update.js";
@@ -76,6 +76,7 @@ import { CONTACT_NOTES_MAX, CONTACT_PHONE_REFUSAL, CONTACT_TAGS_MAX, normalizeTa
 import { readCrmRouteScope } from "./org-caller.js";
 import { crmSuiteRefusal } from "./suite-gate.js";
 import { authorizeCrmWriter, canReach } from "./task-routes.js";
+import { contactPrimaryGroup } from "../model/contact-holder.js";
 /** What the suite gate names for each field a request can carry. */ const SUITE_ACTS = {
     name: "Editing a contact's profile",
     phone: "Editing a contact's profile",