@aglyn/plugins-crm 1.0.0-beta.217 → 1.0.0-beta.219

package/src/lib/server/crm-sharing.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/crm-sharing.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The server half of CRM sharing (AGL-3336) — see `model/crm-sharing.ts`\n * for the model.\n *\n * Three writers, one transaction shape. A record's sharing is RECOMPUTED,\n * never patched: the transaction reads the record, keeps its hand shares\n * (changed by the caller when the act is a share or an unshare), matches\n * every active rule against it as it stands, and writes `visibleTo`,\n * `writeTo`, `sharing` and the list fields derived from `visibleTo` only\n * when any of them moves. So the same function serves\n *\n * - a manager's share or unshare (`crm/sharing`, `share`/`unshare`);\n * - a write to the record anywhere on the server, through the core's\n *   record-written seam (`crmSharingRecordWritten`), and a client-direct\n *   write's follow-up (`evaluate`);\n * - a rule's recompute over existing records (`rule-save`, `rule-continue`),\n *   and its removal (`rule-delete`), in budgeted passes with the progress on\n *   the rule.\n */\n\nimport {\n  CRM_COLLECTIONS,\n  crmActivityLogHasRoom,\n  type CrmActivityLink,\n  crmListFieldsPatch,\n} from '@aglyn/aglyn/app-utils/crm'\nimport { createResourceUid } from '@aglyn/aglyn/app-utils/create-resource-uid'\nimport { hostIdsFromScope } from '@aglyn/aglyn/app-utils/scope-tokens'\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { firebaseAdmin, getOrgForHost, logOrgActivity } from '@aglyn/tenant-data-admin'\nimport { countCrmActivitiesForRecord } from '@aglyn/tenant-data-admin/server/crm-records'\nimport { FieldPath, FieldValue } from 'firebase-admin/firestore'\nimport { BUNDLE_ID } from '../constants/bundle-common'\nimport {\n  activeSharingRules,\n  CRM_SHARING_CRITERIA_FOR,\n  CRM_SHARING_CRITERIA_KEYS,\n  CRM_SHARING_FIELD,\n  CRM_SHARING_IDS_MAX,\n  CRM_SHARING_OBJECT_LABELS,\n  CRM_SHARING_RULE_IDS_PATH,\n  CRM_SHARING_RULES_MAX,\n  CRM_WRITE_SCOPE_FIELD,\n  type CrmShareAccess,\n  type CrmShareGrant,\n  type CrmSharingCriteria,\n  type CrmSharingObject,\n  type CrmSharingResponse,\n  type CrmSharingRule,\n  type CrmSharingRuleRun,\n  type CrmSharingSite,\n  describeShareTargets,\n  evaluateRecordGrants,\n  isCrmShareAccess,\n  isCrmSharingObject,\n  planRecordSharing,\n  readCrmSharingRule,\n  readCrmSharingRules,\n  recordHeldScope,\n  sharingPlanChanges,\n  shareTargetsFrom,\n  withManualShares,\n  withoutManualShares,\n} from '../model/crm-sharing'\nimport { authorizeOrgCaller, orgHostIds, readCrmRouteScope } from './org-caller'\nimport { crmSuiteRefusal } from './suite-gate'\nimport { authorizeCrmWriter } from './task-routes'\n\ntype Firestore = FirebaseFirestore.Firestore\n\n/*==========================================\n * THE RULES, READ OFF THE ORG DOCUMENT.\n *=========================================*/\n\n/**\n * A few seconds of memory per process: every CRM write asks, and an org\n * with no rules should cost it nothing past the first read. A cached list\n * is never the reason a grant is TAKEN away — see `recomputeRecordSharing`.\n */\nconst RULES_TTL_MS = 10_000\nconst rulesCache = new Map<string, { atMs: number; rules: CrmSharingRule[] }>()\n\n/** Test seam, and what a rule write calls so its own process reads it fresh. */\nexport function forgetCrmSharingRules(orgId?: string): void {\n  if (orgId) rulesCache.delete(orgId)\n  else rulesCache.clear()\n}\n\nexport async function crmSharingRulesOf(\n  firestore: Firestore,\n  orgId: string,\n  options: { fresh?: boolean; nowMs?: number } = {},\n): Promise<{ rules: CrmSharingRule[]; fresh: boolean }> {\n  const nowMs = options.nowMs ?? Date.now()\n  const cached = rulesCache.get(orgId)\n  if (!options.fresh && cached && nowMs - cached.atMs < RULES_TTL_MS) {\n    return { rules: cached.rules, fresh: false }\n  }\n  const snapshot = await firestore.collection('orgs').doc(orgId).get()\n  const rules = readCrmSharingRules(snapshot.data() ?? null)\n  rulesCache.set(orgId, { atMs: nowMs, rules })\n  return { rules, fresh: true }\n}\n\n/*==========================================\n * ONE RECORD, RECOMPUTED.\n *=========================================*/\n\nexport interface RecomputeRecordSharingInput {\n  firestore: Firestore\n  orgId: string\n  object: CrmSharingObject\n  id: string\n  /** Every rule the org has, in any state. */\n  rules: readonly CrmSharingRule[]\n  /** Whether `rules` was read just now; a stale list is re-read before it takes a grant away. */\n  fresh: boolean\n  /** The hand shares' change, for a share or an unshare. */\n  manual?: (grants: Record<string, CrmShareGrant>) => Record<string, CrmShareGrant>\n  atMs: number\n}\n\nexport type RecomputeOutcome = 'changed' | 'unchanged' | 'missing'\n\nexport async function recomputeRecordSharing(\n  input: RecomputeRecordSharingInput,\n): Promise<RecomputeOutcome> {\n  const { firestore, orgId, object, id, atMs } = input\n  const ref = firestore.collection('orgs').doc(orgId).collection(object).doc(id)\n  return await firestore.runTransaction(async (tx) => {\n    const snapshot = await tx.get(ref)\n    if (!snapshot.exists) return 'missing' as const\n    const record = (snapshot.data() ?? {}) as Record<string, unknown>\n    let rules = input.rules\n    /*\n     * A GRANT IS NEVER TAKEN AWAY ON A STALE ANSWER. A rule grant whose rule\n     * the cached list does not name is dropped only once a fresh read of the\n     * org agrees: another process may have saved that rule seconds ago and\n     * applied it to this very record.\n     */\n    if (!input.fresh) {\n      const known = new Set(rules.map((rule) => rule.id))\n      const stored = record[CRM_SHARING_FIELD] as { ruleIds?: unknown } | undefined\n      const ruleIds = Array.isArray(stored?.ruleIds) ? (stored.ruleIds as unknown[]) : []\n      if (ruleIds.some((ruleId) => !known.has(String(ruleId)))) {\n        const org = await tx.get(firestore.collection('orgs').doc(orgId))\n        rules = readCrmSharingRules(org.data() ?? null)\n      }\n    }\n    let grants = evaluateRecordGrants(object, record, rules, atMs)\n    if (input.manual) grants = input.manual(grants)\n    const plan = planRecordSharing(record, grants)\n    if (!sharingPlanChanges(record, plan)) return 'unchanged' as const\n    const next = {\n      ...record,\n      visibleTo: plan.visibleTo,\n      [CRM_WRITE_SCOPE_FIELD]: plan.writeTo ?? undefined,\n      [CRM_SHARING_FIELD]: plan.sharing ?? undefined,\n    }\n    tx.update(ref, {\n      visibleTo: plan.visibleTo,\n      [CRM_WRITE_SCOPE_FIELD]: plan.writeTo ?? FieldValue.delete(),\n      [CRM_SHARING_FIELD]: plan.sharing ?? FieldValue.delete(),\n      // The scoped list fields are derived from `visibleTo` (AGL-3321), so a\n      // target site's folded search finds the record the moment it can see it.\n      ...crmListFieldsPatch(object, next),\n    })\n    return 'changed' as const\n  })\n}\n\n/** Several records at once, a few in flight. */\nasync function recomputeMany(\n  input: Omit<RecomputeRecordSharingInput, 'id'>,\n  ids: readonly string[],\n): Promise<{ changed: string[]; missing: number }> {\n  const queue = [...new Set(ids)]\n  const changed: string[] = []\n  let missing = 0\n  const worker = async () => {\n    for (let id = queue.shift(); id !== undefined; id = queue.shift()) {\n      const outcome = await recomputeRecordSharing({ ...input, id })\n      if (outcome === 'changed') changed.push(id)\n      if (outcome === 'missing') missing += 1\n    }\n  }\n  await Promise.all(Array.from({ length: Math.min(8, queue.length) }, worker))\n  return { changed, missing }\n}\n\n/**\n * Re-evaluates the org's rules for these records — the one thing a write\n * anywhere owes the sharing. An org with no active rule for the object\n * costs one cached read and nothing else; grants of a rule switched off\n * are taken away by that rule's own removal pass, not here.\n */\nexport async function evaluateCrmSharing(\n  firestore: Firestore,\n  orgId: string,\n  object: CrmSharingObject,\n  ids: readonly string[],\n): Promise<{ changed: number; missing: number }> {\n  const { rules, fresh } = await crmSharingRulesOf(firestore, orgId)\n  if (!activeSharingRules(rules, object).length) return { changed: 0, missing: 0 }\n  const outcome = await recomputeMany(\n    { firestore, orgId, object, rules, fresh, atMs: Date.now() },\n    ids,\n  )\n  return { changed: outcome.changed.length, missing: outcome.missing }\n}\n\n/**\n * The core's record-written seam (AGL-3336): every server writer of a lead,\n * a contact, a company or a deal restamps it, and the restamp tells this.\n * Never throws — the write it is told about already landed.\n */\nexport async function crmSharingRecordWritten(event: {\n  path: string\n  collection: string\n}): Promise<void> {\n  if (!isCrmSharingObject(event.collection)) return\n  const segments = event.path.split('/')\n  if (segments.length !== 4 || segments[0] !== 'orgs' || segments[2] !== event.collection) return\n  try {\n    await evaluateCrmSharing(\n      firebaseAdmin.app().firestore(),\n      segments[1],\n      event.collection,\n      [segments[3]],\n    )\n  } catch (error) {\n    console.error(`[crm] sharing rules could not be evaluated for ${event.path}`, error)\n  }\n}\n\n/*==========================================\n * THE AUDIT: a line on the record, a line in the org's feed.\n *=========================================*/\n\nconst LINK_FIELD: Readonly<Record<CrmSharingObject, keyof CrmActivityLink>> = {\n  leads: 'leadId',\n  contacts: 'contactId',\n  companies: 'companyId',\n  deals: 'dealId',\n}\n\nconst ORG_TARGET: Readonly<Record<CrmSharingObject, 'lead' | 'contact' | 'company' | 'deal'>> = {\n  leads: 'lead',\n  contacts: 'contact',\n  companies: 'company',\n  deals: 'deal',\n}\n\n/**\n * The entry on the record's Activity: who shared it with which sites, or\n * took a share away. Visible to the sites that hold the record and to the\n * sites it names, so both sides of a share read how it came about.\n */\nasync function fileSharingActivity(\n  firestore: Firestore,\n  input: {\n    orgId: string\n    object: CrmSharingObject\n    id: string\n    body: string\n    targets: readonly string[]\n    by: { uid: string; name: string }\n    atMs: number\n  },\n): Promise<void> {\n  try {\n    const orgRef = firestore.collection('orgs').doc(input.orgId)\n    const record = (await orgRef.collection(input.object).doc(input.id).get()).data() ?? {}\n    const held = recordHeldScope(record)\n    const visibleTo = [...new Set([...held, ...input.targets])]\n    if (!visibleTo.length) return\n    const link: CrmActivityLink = { [LINK_FIELD[input.object]]: input.id }\n    if (!crmActivityLogHasRoom(await countCrmActivitiesForRecord(orgRef, link))) return\n    const hostId =\n      typeof record['hostId'] === 'string' && record['hostId']\n        ? record['hostId']\n        : (hostIdsFromScope(held)[0] ?? '')\n    await orgRef\n      .collection(CRM_COLLECTIONS.activities)\n      .doc(createResourceUid())\n      .create({\n        kind: 'note',\n        body: input.body,\n        atMs: input.atMs,\n        byUid: input.by.uid,\n        ...(input.by.name ? { byName: input.by.name } : {}),\n        ...link,\n        hostId,\n        visibleTo,\n        sourcePluginId: BUNDLE_ID,\n        createdAt: FieldValue.serverTimestamp(),\n        updatedAt: FieldValue.serverTimestamp(),\n      })\n  } catch (error) {\n    console.error('[crm] the sharing entry could not be written on the record', input.id, error)\n  }\n}\n\n/*==========================================\n * THE ORG'S SITES.\n *=========================================*/\n\nexport async function crmSharingSites(firestore: Firestore, orgId: string): Promise<CrmSharingSite[]> {\n  const hosts = await firestore.collection('hosts').where('orgId', '==', orgId).get()\n  return hosts.docs\n    .map((doc) => {\n      const displayName = String(doc.get('displayName') ?? '').trim()\n      const subdomain = String(doc.get('subdomain') ?? '').trim()\n      return { id: String(doc.id), name: displayName || subdomain || String(doc.id) }\n    })\n    .sort((a, b) => a.name.localeCompare(b.name))\n}\n\n/*==========================================\n * A RULE, SAVED FROM A REQUEST.\n *=========================================*/\n\nfunction listFrom(raw: unknown, max: number): string[] {\n  if (!Array.isArray(raw)) return []\n  return [\n    ...new Set(\n      raw.map((entry) => String(entry ?? '').trim().slice(0, 200)).filter(Boolean),\n    ),\n  ].slice(0, max)\n}\n\n/**\n * The rule a request describes, judged: an object, a name, sites that are\n * the org's own, targets that are the org's own or all sites. `null` with\n * the reason when it cannot be saved.\n */\nexport function ruleFromRequest(\n  raw: unknown,\n  context: { hostIds: readonly string[]; existing: CrmSharingRule | null; uid: string; nowMs: number },\n): { rule: CrmSharingRule; error: null } | { rule: null; error: string } {\n  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {\n    return { rule: null, error: 'Describe the rule.' }\n  }\n  const value = raw as Record<string, unknown>\n  const object = value['object']\n  if (!isCrmSharingObject(object)) {\n    return { rule: null, error: 'Choose which records the rule shares.' }\n  }\n  const name = String(value['name'] ?? '').trim().slice(0, 120)\n  if (!name) return { rule: null, error: 'Name the rule.' }\n  const own = new Set(context.hostIds)\n  const sourceHostIds = listFrom(value['sourceHostIds'], 30)\n  if (sourceHostIds.some((id) => !own.has(id))) {\n    return { rule: null, error: 'A site the rule names is not one of this organization’s.' }\n  }\n  const targets = shareTargetsFrom(value['targets'])\n  if (!targets) return { rule: null, error: 'Choose the sites to share with, or All sites.' }\n  if (hostIdsFromScope(targets).some((id) => !own.has(id))) {\n    return { rule: null, error: 'A site the rule shares with is not one of this organization’s.' }\n  }\n  const access = value['access']\n  if (access !== undefined && !isCrmShareAccess(access)) {\n    return { rule: null, error: 'Access is read-only, or read and edit.' }\n  }\n  const rawCriteria = (value['criteria'] ?? {}) as Record<string, unknown>\n  const criteria: CrmSharingCriteria = {}\n  for (const key of CRM_SHARING_CRITERIA_KEYS) {\n    if (!CRM_SHARING_CRITERIA_FOR[object].includes(key)) continue\n    const list = listFrom(rawCriteria[key], 20)\n    if (list.length) criteria[key] = list\n  }\n  const existing = context.existing\n  const rule = readCrmSharingRule({\n    id: existing?.id ?? createResourceUid(),\n    name,\n    object,\n    enabled: value['enabled'] !== false,\n    sourceHostIds,\n    criteria,\n    targets,\n    access: (access as CrmShareAccess | undefined) ?? 'read',\n    createdByUid: existing?.createdByUid ?? context.uid,\n    createdAtMs: existing?.createdAtMs ?? context.nowMs,\n    updatedAtMs: context.nowMs,\n  })\n  if (!rule) return { rule: null, error: 'The rule could not be read.' }\n  return { rule, error: null }\n}\n\n/** A rule as the org document stores it — no `undefined` anywhere. */\nfunction storedRule(rule: CrmSharingRule): Record<string, unknown> {\n  return JSON.parse(JSON.stringify(rule)) as Record<string, unknown>\n}\n\n/**\n * Writes the org's rule list through `change`, in a transaction over the org\n * document, and answers the list as written.\n */\nasync function writeRules(\n  firestore: Firestore,\n  orgId: string,\n  change: (rules: CrmSharingRule[]) => CrmSharingRule[] | { error: string },\n): Promise<{ rules: CrmSharingRule[]; error: null } | { rules: null; error: string }> {\n  const orgRef = firestore.collection('orgs').doc(orgId)\n  const result = await firestore.runTransaction(async (tx) => {\n    const snapshot = await tx.get(orgRef)\n    const next = change(readCrmSharingRules(snapshot.data() ?? null))\n    if ('error' in next) return { rules: null, error: next.error }\n    tx.update(orgRef, new FieldPath('crm', 'sharingRules'), next.map(storedRule))\n    return { rules: next, error: null }\n  })\n  forgetCrmSharingRules(orgId)\n  return result as { rules: CrmSharingRule[]; error: null } | { rules: null; error: string }\n}\n\n/** Replaces one rule's run, leaving every other rule as it is. */\nasync function writeRun(\n  firestore: Firestore,\n  orgId: string,\n  ruleId: string,\n  run: CrmSharingRuleRun,\n  options: { dropRule?: boolean } = {},\n): Promise<CrmSharingRule | null> {\n  const written = await writeRules(firestore, orgId, (rules) =>\n    options.dropRule\n      ? rules.filter((rule) => rule.id !== ruleId)\n      : rules.map((rule) => (rule.id === ruleId ? { ...rule, run } : rule)),\n  )\n  return written.rules?.find((rule) => rule.id === ruleId) ?? null\n}\n\n/*==========================================\n * A RULE'S RUN: apply it everywhere, or take it away.\n *=========================================*/\n\nconst RUN_PAGE = 200\n\n/**\n * One budgeted pass of a rule's run, with the progress written on the rule\n * after every page so a reopened settings page shows where it stands and\n * `rule-continue` picks up from the cursor.\n *\n * `apply` walks the object's whole collection by document id — a rule\n * matches on fields no index narrows to (a facet's tags, a site that\n * captured the person) — and writes only the records whose sharing moves.\n * `remove` asks for exactly the records the rule holds a grant on\n * (`sharing.ruleIds`), each of which the recompute then takes it off; a\n * page that makes no progress fails the run rather than looping.\n */\nexport async function advanceSharingRuleRun(\n  firestore: Firestore,\n  orgId: string,\n  ruleId: string,\n  deadlineMs: number,\n): Promise<{ rule: CrmSharingRule | null; more: boolean }> {\n  const read = await crmSharingRulesOf(firestore, orgId, { fresh: true })\n  let rule = read.rules.find((entry) => entry.id === ruleId) ?? null\n  if (!rule?.run || rule.run.status !== 'running') return { rule, more: false }\n  const records = firestore.collection('orgs').doc(orgId).collection(rule.object)\n  let run: CrmSharingRuleRun = { ...rule.run }\n  const seen = new Set<string>()\n  try {\n    while (Date.now() < deadlineMs) {\n      const { rules } = await crmSharingRulesOf(firestore, orgId, { fresh: true })\n      let page: FirebaseFirestore.QuerySnapshot\n      if (run.mode === 'apply') {\n        let query = records.orderBy(FieldPath.documentId()).limit(RUN_PAGE)\n        if (run.cursor) query = query.startAfter(run.cursor)\n        page = await query.get()\n      } else {\n        page = await records.where(CRM_SHARING_RULE_IDS_PATH, 'array-contains', ruleId).limit(RUN_PAGE).get()\n      }\n      const atMs = Date.now()\n      // Only the records whose sharing would move are written.\n      const moving = page.docs\n        .filter((doc) => {\n          const record = (doc.data() ?? {}) as Record<string, unknown>\n          const plan = planRecordSharing(record, evaluateRecordGrants(rule!.object, record, rules, atMs))\n          return sharingPlanChanges(record, plan)\n        })\n        .map((doc) => doc.id)\n      if (run.mode === 'remove' && page.docs.length && page.docs.every((doc) => seen.has(doc.id))) {\n        throw new Error('the rule’s grants did not come off these records')\n      }\n      for (const doc of page.docs) seen.add(doc.id)\n      const outcome = await recomputeMany(\n        { firestore, orgId, object: rule.object, rules, fresh: true, atMs },\n        moving,\n      )\n      const done = run.mode === 'apply' ? page.size < RUN_PAGE : page.empty\n      run = {\n        ...run,\n        processed: run.processed + page.size,\n        changed: run.changed + outcome.changed.length,\n        cursor: run.mode === 'apply' ? (page.docs[page.docs.length - 1]?.id ?? run.cursor ?? null) : null,\n        ...(done ? { status: 'done' as const, finishedAtMs: Date.now() } : {}),\n      }\n      rule = await writeRun(firestore, orgId, ruleId, run, {\n        dropRule: done && rule.deleting === true,\n      })\n      if (done || !rule) return { rule, more: false }\n    }\n    return { rule, more: true }\n  } catch (error) {\n    console.error('[crm] a sharing rule run failed', orgId, ruleId, error)\n    rule = await writeRun(firestore, orgId, ruleId, {\n      ...run,\n      status: 'failed',\n      finishedAtMs: Date.now(),\n      error: 'The recompute stopped. Resume it to carry on from where it stopped.',\n    })\n    return { rule, more: false }\n  }\n}\n\n/*==========================================\n * THE ROUTE.\n *=========================================*/\n\n/** How long one request works on a rule before it answers and the page asks again. */\nconst RUN_BUDGET_MS = 20_000\n\nconst MANAGERS_ONLY =\n  'Sharing records across sites is for the workspace’s owners and admins.'\n\nfunction readIds(raw: unknown): string[] | null {\n  if (!Array.isArray(raw)) return null\n  const ids = [\n    ...new Set(\n      raw.map((entry) => String(entry ?? '').trim().slice(0, 256)).filter((id) => id && !id.includes('/')),\n    ),\n  ].slice(0, CRM_SHARING_IDS_MAX)\n  return ids.length ? ids : null\n}\n\n/**\n * `POST /api/crm/sharing` — `{ action, hostId | orgId, … }`.\n *\n * Every action but `evaluate` is an org manager's: an OWNER or ADMIN of the\n * whole workspace (`authorizeOrgCaller(…, 'manage-org')`), under a site's\n * hub or the org's. `evaluate` is what a client-direct write owes the rules\n * and is open to whoever may write the CRM. The plan gate is the CRM's own\n * (`crmSuiteRefusal`): sharing is only meaningful across several sites, and\n * the number of sites a workspace may have is already the plan's.\n */\nexport const crmSharingHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  const body = (req.body ?? {}) as Record<string, unknown>\n  const scope = readCrmRouteScope(body)\n  if (!scope) {\n    res.status(400).json({ error: 'Missing hostId' })\n    return\n  }\n  const action = String(body['action'] ?? '')\n  const firestore = firebaseAdmin.app().firestore()\n  try {\n    if (action === 'evaluate') {\n      const object = body['object']\n      const ids = readIds(body['ids'])\n      if (!isCrmSharingObject(object) || !ids) {\n        res.status(400).json({ error: 'Name the records.' })\n        return\n      }\n      const writer = await authorizeCrmWriter(req, scope, { suiteAct: null })\n      if (writer.ok === false) {\n        res.status(writer.status).json(writer.body)\n        return\n      }\n      const outcome = await evaluateCrmSharing(firestore, writer.orgId, object, ids)\n      const answer: CrmSharingResponse = { ok: true, ...outcome }\n      res.status(200).json(answer)\n      return\n    }\n\n    const orgId =\n      scope.level === 'org'\n        ? scope.orgId\n        : ((await getOrgForHost(scope.hostId).catch(() => null))?.orgId ?? '')\n    if (!orgId) {\n      res.status(404).json({ error: 'This site has no organization, so it has no CRM.' })\n      return\n    }\n    const caller = await authorizeOrgCaller(req, orgId, {\n      needs: 'manage-org',\n      refusal: MANAGERS_ONLY,\n    })\n    if (caller.ok === false) {\n      res.status(caller.status).json({ error: caller.error })\n      return\n    }\n    const suite = crmSuiteRefusal(caller.org, 'Sharing records across sites')\n    if (suite) {\n      res.status(suite.status).json(suite.body)\n      return\n    }\n    const actor = { uid: caller.uid, email: caller.email }\n    const byName = caller.name || caller.email || ''\n    const nowMs = Date.now()\n\n    if (action === 'sites') {\n      const answer: CrmSharingResponse = { ok: true, sites: await crmSharingSites(firestore, orgId) }\n      res.status(200).json(answer)\n      return\n    }\n\n    if (action === 'share' || action === 'unshare') {\n      const object = body['object']\n      const ids = readIds(body['ids'])\n      if (!isCrmSharingObject(object) || !ids) {\n        res.status(400).json({ error: 'Name the records to share.' })\n        return\n      }\n      const targets = shareTargetsFrom(body['targets'])\n      if (!targets) {\n        res.status(400).json({ error: 'Choose the sites, or All sites.' })\n        return\n      }\n      const sites = await crmSharingSites(firestore, orgId)\n      const own = new Set(sites.map((site) => site.id))\n      if (hostIdsFromScope(targets).some((id) => !own.has(id))) {\n        res.status(400).json({ error: 'A site named is not one of this organization’s.' })\n        return\n      }\n      const access: CrmShareAccess = body['access'] === 'edit' ? 'edit' : 'read'\n      const { rules, fresh } = await crmSharingRulesOf(firestore, orgId)\n      const outcome = await recomputeMany(\n        {\n          firestore,\n          orgId,\n          object,\n          rules,\n          fresh,\n          atMs: nowMs,\n          manual: (grants) =>\n            action === 'share'\n              ? withManualShares(grants, targets, access, { uid: caller.uid, name: byName }, nowMs)\n              : withoutManualShares(grants, targets),\n        },\n        ids,\n      )\n      const siteName = (id: string) => sites.find((site) => site.id === id)?.name ?? 'a site'\n      const named = describeShareTargets(targets, siteName)\n      const sentence =\n        action === 'share'\n          ? `Shared with ${named}${access === 'edit' ? ' (read and edit)' : ' (read-only)'}`\n          : `Stopped sharing with ${named}`\n      await Promise.all(\n        outcome.changed.map((id) =>\n          fileSharingActivity(firestore, {\n            orgId,\n            object,\n            id,\n            body: sentence,\n            targets,\n            by: { uid: caller.uid, name: byName },\n            atMs: nowMs,\n          }),\n        ),\n      )\n      if (outcome.changed.length) {\n        const label = CRM_SHARING_OBJECT_LABELS[object]\n        await logOrgActivity(\n          orgId,\n          actor,\n          outcome.changed.length === 1\n            ? `${sentence}: one ${label.one}`\n            : `${sentence}: ${outcome.changed.length} ${label.many.toLowerCase()}`,\n          {\n            type: ORG_TARGET[object],\n            ...(outcome.changed.length === 1 ? { id: outcome.changed[0] } : {}),\n          },\n        ).catch(() => undefined)\n      }\n      const answer: CrmSharingResponse = {\n        ok: true,\n        changed: outcome.changed.length,\n        missing: outcome.missing,\n      }\n      res.status(200).json(answer)\n      return\n    }\n\n    if (action === 'rule-save') {\n      const hostIds = await orgHostIds(firestore, orgId)\n      const raw = body['rule']\n      const ruleId = raw && typeof raw === 'object' ? String((raw as Record<string, unknown>)['id'] ?? '') : ''\n      let saved: CrmSharingRule | null = null\n      let error: string | null = null\n      const written = await writeRules(firestore, orgId, (rules) => {\n        const existing = ruleId ? (rules.find((rule) => rule.id === ruleId) ?? null) : null\n        if (ruleId && !existing) return { error: 'That rule no longer exists.' }\n        if (existing?.deleting) return { error: 'That rule is being deleted.' }\n        if (!existing && rules.length >= CRM_SHARING_RULES_MAX) {\n          return { error: `A workspace keeps at most ${CRM_SHARING_RULES_MAX} sharing rules.` }\n        }\n        const judged = ruleFromRequest(raw, { hostIds, existing, uid: caller.uid, nowMs })\n        if (!judged.rule) {\n          error = judged.error\n          return { error: judged.error }\n        }\n        /*\n         * An enabled rule walks every record — it may now match some and not\n         * others. A disabled one only has grants to take away, and asks for\n         * exactly the records holding them.\n         */\n        saved = {\n          ...judged.rule,\n          run: {\n            status: 'running',\n            mode: judged.rule.enabled ? 'apply' : 'remove',\n            processed: 0,\n            changed: 0,\n            cursor: null,\n            startedAtMs: nowMs,\n          },\n        }\n        return existing\n          ? rules.map((rule) => (rule.id === existing.id ? saved! : rule))\n          : [...rules, saved]\n      })\n      if (!written.rules || !saved) {\n        res.status(400).json({ error: error ?? written.error ?? 'The rule could not be saved.' })\n        return\n      }\n      const rule = saved as CrmSharingRule\n      await logOrgActivity(\n        orgId,\n        actor,\n        `${ruleId ? 'Changed' : 'Added'} the sharing rule “${rule.name}”`,\n        { type: `${BUNDLE_ID}:sharingRule`, id: rule.id, name: rule.name },\n      ).catch(() => undefined)\n      const advanced = await advanceSharingRuleRun(firestore, orgId, rule.id, Date.now() + RUN_BUDGET_MS)\n      const answer: CrmSharingResponse = { ok: true, rule: advanced.rule, more: advanced.more }\n      res.status(200).json(answer)\n      return\n    }\n\n    if (action === 'rule-delete' || action === 'rule-continue') {\n      const ruleId = String(body['ruleId'] ?? '').trim()\n      if (!ruleId) {\n        res.status(400).json({ error: 'Name the rule.' })\n        return\n      }\n      if (action === 'rule-delete') {\n        let name = ''\n        const written = await writeRules(firestore, orgId, (rules) => {\n          const existing = rules.find((rule) => rule.id === ruleId)\n          if (!existing) return { error: 'That rule no longer exists.' }\n          name = existing.name\n          return rules.map((rule) =>\n            rule.id === ruleId\n              ? {\n                  ...rule,\n                  enabled: false,\n                  deleting: true,\n                  updatedAtMs: nowMs,\n                  run: {\n                    status: 'running' as const,\n                    mode: 'remove' as const,\n                    processed: 0,\n                    changed: 0,\n                    cursor: null,\n                    startedAtMs: nowMs,\n                  },\n                }\n              : rule,\n          )\n        })\n        if (!written.rules) {\n          res.status(404).json({ error: written.error })\n          return\n        }\n        await logOrgActivity(orgId, actor, `Deleted the sharing rule “${name}”`, {\n          type: `${BUNDLE_ID}:sharingRule`,\n          id: ruleId,\n          name,\n        }).catch(() => undefined)\n      } else {\n        // A failed run resumes from its cursor.\n        await writeRules(firestore, orgId, (rules) =>\n          rules.map((rule) =>\n            rule.id === ruleId && rule.run?.status === 'failed'\n              ? { ...rule, run: { ...rule.run, status: 'running' as const } }\n              : rule,\n          ),\n        )\n      }\n      const advanced = await advanceSharingRuleRun(firestore, orgId, ruleId, Date.now() + RUN_BUDGET_MS)\n      const answer: CrmSharingResponse = { ok: true, rule: advanced.rule, more: advanced.more }\n      res.status(200).json(answer)\n      return\n    }\n\n    res.status(400).json({ error: 'Unknown sharing action.' })\n  } catch (error) {\n    console.error('[crm] sharing failed', action, error)\n    res.status(500).json({ error: 'The sharing could not be saved. Try again.' })\n  }\n}\n\n"],"names":["CRM_COLLECTIONS","crmActivityLogHasRoom","crmListFieldsPatch","createResourceUid","hostIdsFromScope","firebaseAdmin","getOrgForHost","logOrgActivity","countCrmActivitiesForRecord","FieldPath","FieldValue","BUNDLE_ID","activeSharingRules","CRM_SHARING_CRITERIA_FOR","CRM_SHARING_CRITERIA_KEYS","CRM_SHARING_FIELD","CRM_SHARING_IDS_MAX","CRM_SHARING_OBJECT_LABELS","CRM_SHARING_RULE_IDS_PATH","CRM_SHARING_RULES_MAX","CRM_WRITE_SCOPE_FIELD","describeShareTargets","evaluateRecordGrants","isCrmShareAccess","isCrmSharingObject","planRecordSharing","readCrmSharingRule","readCrmSharingRules","recordHeldScope","sharingPlanChanges","shareTargetsFrom","withManualShares","withoutManualShares","authorizeOrgCaller","orgHostIds","readCrmRouteScope","crmSuiteRefusal","authorizeCrmWriter","RULES_TTL_MS","rulesCache","Map","forgetCrmSharingRules","orgId","delete","clear","crmSharingRulesOf","firestore","options","snapshot","nowMs","Date","now","cached","get","fresh","atMs","rules","collection","doc","data","set","recomputeRecordSharing","input","object","id","ref","runTransaction","tx","plan","exists","record","known","Set","map","rule","stored","ruleIds","Array","isArray","some","ruleId","has","String","org","grants","manual","next","visibleTo","writeTo","undefined","sharing","update","recomputeMany","ids","queue","changed","missing","worker","shift","outcome","push","Promise","all","from","length","Math","min","evaluateCrmSharing","crmSharingRecordWritten","event","segments","path","split","app","error","console","LINK_FIELD","leads","contacts","companies","deals","ORG_TARGET","fileSharingActivity","orgRef","held","targets","link","hostId","activities","create","kind","body","byUid","by","uid","name","byName","sourcePluginId","createdAt","serverTimestamp","updatedAt","crmSharingSites","hosts","where","docs","displayName","trim","subdomain","sort","a","b","localeCompare","listFrom","raw","max","entry","slice","filter","Boolean","ruleFromRequest","context","value","own","hostIds","sourceHostIds","access","rawCriteria","criteria","key","includes","list","existing","enabled","createdByUid","createdAtMs","updatedAtMs","storedRule","JSON","parse","stringify","writeRules","change","result","writeRun","run","written","dropRule","find","RUN_PAGE","advanceSharingRuleRun","deadlineMs","read","status","more","records","seen","page","mode","query","orderBy","documentId","limit","cursor","startAfter","moving","every","Error","add","done","size","empty","processed","finishedAtMs","deleting","RUN_BUDGET_MS","MANAGERS_ONLY","readIds","crmSharingHandler","req","res","method","setHeader","json","scope","action","writer","suiteAct","ok","answer","level","catch","caller","needs","refusal","suite","actor","email","sites","site","siteName","named","sentence","label","one","many","toLowerCase","type","saved","judged","startedAtMs","advanced"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;CAkBC,GAED,SACEA,eAAe,EACfC,qBAAqB,EAErBC,kBAAkB,QACb,6BAA4B;AACnC,SAASC,iBAAiB,QAAQ,6CAA4C;AAC9E,SAASC,gBAAgB,QAAQ,sCAAqC;AAEtE,SAASC,aAAa,EAAEC,aAAa,EAAEC,cAAc,QAAQ,2BAA0B;AACvF,SAASC,2BAA2B,QAAQ,8CAA6C;AACzF,SAASC,SAAS,EAAEC,UAAU,QAAQ,2BAA0B;AAChE,SAASC,SAAS,QAAQ,gCAA4B;AACtD,SACEC,kBAAkB,EAClBC,wBAAwB,EACxBC,yBAAyB,EACzBC,iBAAiB,EACjBC,mBAAmB,EACnBC,yBAAyB,EACzBC,yBAAyB,EACzBC,qBAAqB,EACrBC,qBAAqB,EASrBC,oBAAoB,EACpBC,oBAAoB,EACpBC,gBAAgB,EAChBC,kBAAkB,EAClBC,iBAAiB,EACjBC,kBAAkB,EAClBC,mBAAmB,EACnBC,eAAe,EACfC,kBAAkB,EAClBC,gBAAgB,EAChBC,gBAAgB,EAChBC,mBAAmB,QACd,0BAAsB;AAC7B,SAASC,kBAAkB,EAAEC,UAAU,EAAEC,iBAAiB,QAAQ,kBAAc;AAChF,SAASC,eAAe,QAAQ,kBAAc;AAC9C,SAASC,kBAAkB,QAAQ,mBAAe;AAIlD;;2CAE2C,GAE3C;;;;CAIC,GACD,MAAMC,eAAe;AACrB,MAAMC,aAAa,IAAIC;AAEvB,8EAA8E,GAC9E,OAAO,SAASC,sBAAsBC,KAAc;IAClD,IAAIA,OAAOH,WAAWI,MAAM,CAACD;SACxBH,WAAWK,KAAK;AACvB;AAEA,OAAO,eAAeC,kBACpBC,SAAoB,EACpBJ,KAAa,EACbK,UAA+C,CAAC,CAAC;QAEnCA,gBAMoBC;IANlC,MAAMC,SAAQF,iBAAAA,QAAQE,KAAK,YAAbF,iBAAiBG,KAAKC,GAAG;IACvC,MAAMC,SAASb,WAAWc,GAAG,CAACX;IAC9B,IAAI,CAACK,QAAQO,KAAK,IAAIF,UAAUH,QAAQG,OAAOG,IAAI,GAAGjB,cAAc;QAClE,OAAO;YAAEkB,OAAOJ,OAAOI,KAAK;YAAEF,OAAO;QAAM;IAC7C;IACA,MAAMN,WAAW,MAAMF,UAAUW,UAAU,CAAC,QAAQC,GAAG,CAAChB,OAAOW,GAAG;IAClE,MAAMG,QAAQ7B,qBAAoBqB,iBAAAA,SAASW,IAAI,cAAbX,iBAAmB;IACrDT,WAAWqB,GAAG,CAAClB,OAAO;QAAEa,MAAMN;QAAOO;IAAM;IAC3C,OAAO;QAAEA;QAAOF,OAAO;IAAK;AAC9B;AAsBA,OAAO,eAAeO,uBACpBC,KAAkC;IAElC,MAAM,EAAEhB,SAAS,EAAEJ,KAAK,EAAEqB,MAAM,EAAEC,EAAE,EAAET,IAAI,EAAE,GAAGO;IAC/C,MAAMG,MAAMnB,UAAUW,UAAU,CAAC,QAAQC,GAAG,CAAChB,OAAOe,UAAU,CAACM,QAAQL,GAAG,CAACM;IAC3E,OAAO,MAAMlB,UAAUoB,cAAc,CAAC,OAAOC;YAG3BnB,gBAwBWoB,eACJA,eAIIA,gBACJA;QAhCvB,MAAMpB,WAAW,MAAMmB,GAAGd,GAAG,CAACY;QAC9B,IAAI,CAACjB,SAASqB,MAAM,EAAE,OAAO;QAC7B,MAAMC,UAAUtB,iBAAAA,SAASW,IAAI,cAAbX,iBAAmB,CAAC;QACpC,IAAIQ,QAAQM,MAAMN,KAAK;QACvB;;;;;KAKC,GACD,IAAI,CAACM,MAAMR,KAAK,EAAE;YAChB,MAAMiB,QAAQ,IAAIC,IAAIhB,MAAMiB,GAAG,CAAC,CAACC,OAASA,KAAKV,EAAE;YACjD,MAAMW,SAASL,MAAM,CAACvD,kBAAkB;YACxC,MAAM6D,UAAUC,MAAMC,OAAO,CAACH,0BAAAA,OAAQC,OAAO,IAAKD,OAAOC,OAAO,GAAiB,EAAE;YACnF,IAAIA,QAAQG,IAAI,CAAC,CAACC,SAAW,CAACT,MAAMU,GAAG,CAACC,OAAOF,WAAW;oBAE5BG;gBAD5B,MAAMA,MAAM,MAAMhB,GAAGd,GAAG,CAACP,UAAUW,UAAU,CAAC,QAAQC,GAAG,CAAChB;gBAC1Dc,QAAQ7B,qBAAoBwD,YAAAA,IAAIxB,IAAI,cAARwB,YAAc;YAC5C;QACF;QACA,IAAIC,SAAS9D,qBAAqByC,QAAQO,QAAQd,OAAOD;QACzD,IAAIO,MAAMuB,MAAM,EAAED,SAAStB,MAAMuB,MAAM,CAACD;QACxC,MAAMhB,OAAO3C,kBAAkB6C,QAAQc;QACvC,IAAI,CAACvD,mBAAmByC,QAAQF,OAAO,OAAO;QAC9C,MAAMkB,OAAO,aACRhB;YACHiB,WAAWnB,KAAKmB,SAAS;YACzB,CAACnE,sBAAsB,GAAEgD,gBAAAA,KAAKoB,OAAO,YAAZpB,gBAAgBqB;YACzC,CAAC1E,kBAAkB,GAAEqD,gBAAAA,KAAKsB,OAAO,YAAZtB,gBAAgBqB;;QAEvCtB,GAAGwB,MAAM,CAAC1B,KAAK;YACbsB,WAAWnB,KAAKmB,SAAS;YACzB,CAACnE,sBAAsB,GAAEgD,iBAAAA,KAAKoB,OAAO,YAAZpB,iBAAgB1D,WAAWiC,MAAM;YAC1D,CAAC5B,kBAAkB,GAAEqD,iBAAAA,KAAKsB,OAAO,YAAZtB,iBAAgB1D,WAAWiC,MAAM;WAGnDzC,mBAAmB6D,QAAQuB;QAEhC,OAAO;IACT;AACF;AAEA,8CAA8C,GAC9C,eAAeM,cACb9B,KAA8C,EAC9C+B,GAAsB;IAEtB,MAAMC,QAAQ;WAAI,IAAItB,IAAIqB;KAAK;IAC/B,MAAME,UAAoB,EAAE;IAC5B,IAAIC,UAAU;IACd,MAAMC,SAAS;QACb,IAAK,IAAIjC,KAAK8B,MAAMI,KAAK,IAAIlC,OAAOyB,WAAWzB,KAAK8B,MAAMI,KAAK,GAAI;YACjE,MAAMC,UAAU,MAAMtC,uBAAuB,aAAKC;gBAAOE;;YACzD,IAAImC,YAAY,WAAWJ,QAAQK,IAAI,CAACpC;YACxC,IAAImC,YAAY,WAAWH,WAAW;QACxC;IACF;IACA,MAAMK,QAAQC,GAAG,CAACzB,MAAM0B,IAAI,CAAC;QAAEC,QAAQC,KAAKC,GAAG,CAAC,GAAGZ,MAAMU,MAAM;IAAE,GAAGP;IACpE,OAAO;QAAEF;QAASC;IAAQ;AAC5B;AAEA;;;;;CAKC,GACD,OAAO,eAAeW,mBACpB7D,SAAoB,EACpBJ,KAAa,EACbqB,MAAwB,EACxB8B,GAAsB;IAEtB,MAAM,EAAErC,KAAK,EAAEF,KAAK,EAAE,GAAG,MAAMT,kBAAkBC,WAAWJ;IAC5D,IAAI,CAAC9B,mBAAmB4C,OAAOO,QAAQyC,MAAM,EAAE,OAAO;QAAET,SAAS;QAAGC,SAAS;IAAE;IAC/E,MAAMG,UAAU,MAAMP,cACpB;QAAE9C;QAAWJ;QAAOqB;QAAQP;QAAOF;QAAOC,MAAML,KAAKC,GAAG;IAAG,GAC3D0C;IAEF,OAAO;QAAEE,SAASI,QAAQJ,OAAO,CAACS,MAAM;QAAER,SAASG,QAAQH,OAAO;IAAC;AACrE;AAEA;;;;CAIC,GACD,OAAO,eAAeY,wBAAwBC,KAG7C;IACC,IAAI,CAACrF,mBAAmBqF,MAAMpD,UAAU,GAAG;IAC3C,MAAMqD,WAAWD,MAAME,IAAI,CAACC,KAAK,CAAC;IAClC,IAAIF,SAASN,MAAM,KAAK,KAAKM,QAAQ,CAAC,EAAE,KAAK,UAAUA,QAAQ,CAAC,EAAE,KAAKD,MAAMpD,UAAU,EAAE;IACzF,IAAI;QACF,MAAMkD,mBACJtG,cAAc4G,GAAG,GAAGnE,SAAS,IAC7BgE,QAAQ,CAAC,EAAE,EACXD,MAAMpD,UAAU,EAChB;YAACqD,QAAQ,CAAC,EAAE;SAAC;IAEjB,EAAE,OAAOI,OAAO;QACdC,QAAQD,KAAK,CAAC,CAAC,+CAA+C,EAAEL,MAAME,IAAI,EAAE,EAAEG;IAChF;AACF;AAEA;;2CAE2C,GAE3C,MAAME,aAAwE;IAC5EC,OAAO;IACPC,UAAU;IACVC,WAAW;IACXC,OAAO;AACT;AAEA,MAAMC,aAA0F;IAC9FJ,OAAO;IACPC,UAAU;IACVC,WAAW;IACXC,OAAO;AACT;AAEA;;;;CAIC,GACD,eAAeE,oBACb5E,SAAoB,EACpBgB,KAQC;IAED,IAAI;YAEa,OASR1D;QAVP,MAAMuH,SAAS7E,UAAUW,UAAU,CAAC,QAAQC,GAAG,CAACI,MAAMpB,KAAK;QAC3D,MAAM4B,UAAS,QAAA,AAAC,CAAA,MAAMqD,OAAOlE,UAAU,CAACK,MAAMC,MAAM,EAAEL,GAAG,CAACI,MAAME,EAAE,EAAEX,GAAG,EAAC,EAAGM,IAAI,cAAhE,QAAsE,CAAC;QACtF,MAAMiE,OAAOhG,gBAAgB0C;QAC7B,MAAMiB,YAAY;eAAI,IAAIf,IAAI;mBAAIoD;mBAAS9D,MAAM+D,OAAO;aAAC;SAAE;QAC3D,IAAI,CAACtC,UAAUiB,MAAM,EAAE;QACvB,MAAMsB,OAAwB;YAAE,CAACV,UAAU,CAACtD,MAAMC,MAAM,CAAC,CAAC,EAAED,MAAME,EAAE;QAAC;QACrE,IAAI,CAAC/D,sBAAsB,MAAMO,4BAA4BmH,QAAQG,QAAQ;QAC7E,MAAMC,SACJ,OAAOzD,MAAM,CAAC,SAAS,KAAK,YAAYA,MAAM,CAAC,SAAS,GACpDA,MAAM,CAAC,SAAS,IACflE,qBAAAA,iBAAiBwH,KAAK,CAAC,EAAE,YAAzBxH,qBAA6B;QACpC,MAAMuH,OACHlE,UAAU,CAACzD,gBAAgBgI,UAAU,EACrCtE,GAAG,CAACvD,qBACJ8H,MAAM,CAAC;YACNC,MAAM;YACNC,MAAMrE,MAAMqE,IAAI;YAChB5E,MAAMO,MAAMP,IAAI;YAChB6E,OAAOtE,MAAMuE,EAAE,CAACC,GAAG;WACfxE,MAAMuE,EAAE,CAACE,IAAI,GAAG;YAAEC,QAAQ1E,MAAMuE,EAAE,CAACE,IAAI;QAAC,IAAI,CAAC,GAC9CT;YACHC;YACAxC;YACAkD,gBAAgB9H;YAChB+H,WAAWhI,WAAWiI,eAAe;YACrCC,WAAWlI,WAAWiI,eAAe;;IAE3C,EAAE,OAAOzB,OAAO;QACdC,QAAQD,KAAK,CAAC,8DAA8DpD,MAAME,EAAE,EAAEkD;IACxF;AACF;AAEA;;2CAE2C,GAE3C,OAAO,eAAe2B,gBAAgB/F,SAAoB,EAAEJ,KAAa;IACvE,MAAMoG,QAAQ,MAAMhG,UAAUW,UAAU,CAAC,SAASsF,KAAK,CAAC,SAAS,MAAMrG,OAAOW,GAAG;IACjF,OAAOyF,MAAME,IAAI,CACdvE,GAAG,CAAC,CAACf;YACuBA,UACFA;QADzB,MAAMuF,cAAc/D,QAAOxB,WAAAA,IAAIL,GAAG,CAAC,0BAARK,WAA0B,IAAIwF,IAAI;QAC7D,MAAMC,YAAYjE,QAAOxB,YAAAA,IAAIL,GAAG,CAAC,wBAARK,YAAwB,IAAIwF,IAAI;QACzD,OAAO;YAAElF,IAAIkB,OAAOxB,IAAIM,EAAE;YAAGuE,MAAMU,eAAeE,aAAajE,OAAOxB,IAAIM,EAAE;QAAE;IAChF,GACCoF,IAAI,CAAC,CAACC,GAAGC,IAAMD,EAAEd,IAAI,CAACgB,aAAa,CAACD,EAAEf,IAAI;AAC/C;AAEA;;2CAE2C,GAE3C,SAASiB,SAASC,GAAY,EAAEC,GAAW;IACzC,IAAI,CAAC7E,MAAMC,OAAO,CAAC2E,MAAM,OAAO,EAAE;IAClC,OAAO;WACF,IAAIjF,IACLiF,IAAIhF,GAAG,CAAC,CAACkF,QAAUzE,OAAOyE,gBAAAA,QAAS,IAAIT,IAAI,GAAGU,KAAK,CAAC,GAAG,MAAMC,MAAM,CAACC;KAEvE,CAACF,KAAK,CAAC,GAAGF;AACb;AAEA;;;;CAIC,GACD,OAAO,SAASK,gBACdN,GAAY,EACZO,OAAoG;QAUhFC,aAgBCA;IAxBrB,IAAI,CAACR,OAAO,OAAOA,QAAQ,YAAY5E,MAAMC,OAAO,CAAC2E,MAAM;QACzD,OAAO;YAAE/E,MAAM;YAAMwC,OAAO;QAAqB;IACnD;IACA,MAAM+C,QAAQR;IACd,MAAM1F,SAASkG,KAAK,CAAC,SAAS;IAC9B,IAAI,CAACzI,mBAAmBuC,SAAS;QAC/B,OAAO;YAAEW,MAAM;YAAMwC,OAAO;QAAwC;IACtE;IACA,MAAMqB,OAAOrD,QAAO+E,cAAAA,KAAK,CAAC,OAAO,YAAbA,cAAiB,IAAIf,IAAI,GAAGU,KAAK,CAAC,GAAG;IACzD,IAAI,CAACrB,MAAM,OAAO;QAAE7D,MAAM;QAAMwC,OAAO;IAAiB;IACxD,MAAMgD,MAAM,IAAI1F,IAAIwF,QAAQG,OAAO;IACnC,MAAMC,gBAAgBZ,SAASS,KAAK,CAAC,gBAAgB,EAAE;IACvD,IAAIG,cAAcrF,IAAI,CAAC,CAACf,KAAO,CAACkG,IAAIjF,GAAG,CAACjB,MAAM;QAC5C,OAAO;YAAEU,MAAM;YAAMwC,OAAO;QAA2D;IACzF;IACA,MAAMW,UAAU/F,iBAAiBmI,KAAK,CAAC,UAAU;IACjD,IAAI,CAACpC,SAAS,OAAO;QAAEnD,MAAM;QAAMwC,OAAO;IAAgD;IAC1F,IAAI9G,iBAAiByH,SAAS9C,IAAI,CAAC,CAACf,KAAO,CAACkG,IAAIjF,GAAG,CAACjB,MAAM;QACxD,OAAO;YAAEU,MAAM;YAAMwC,OAAO;QAAiE;IAC/F;IACA,MAAMmD,SAASJ,KAAK,CAAC,SAAS;IAC9B,IAAII,WAAW5E,aAAa,CAAClE,iBAAiB8I,SAAS;QACrD,OAAO;YAAE3F,MAAM;YAAMwC,OAAO;QAAyC;IACvE;IACA,MAAMoD,eAAeL,kBAAAA,KAAK,CAAC,WAAW,YAAjBA,kBAAqB,CAAC;IAC3C,MAAMM,WAA+B,CAAC;IACtC,KAAK,MAAMC,OAAO1J,0BAA2B;QAC3C,IAAI,CAACD,wBAAwB,CAACkD,OAAO,CAAC0G,QAAQ,CAACD,MAAM;QACrD,MAAME,OAAOlB,SAASc,WAAW,CAACE,IAAI,EAAE;QACxC,IAAIE,KAAKlE,MAAM,EAAE+D,QAAQ,CAACC,IAAI,GAAGE;IACnC;IACA,MAAMC,WAAWX,QAAQW,QAAQ;IACjC,MAAMjG,OAAOhD,mBAAmB;QAC9BsC,EAAE,UAAE2G,4BAAAA,SAAU3G,EAAE,mBAAI7D;QACpBoI;QACAxE;QACA6G,SAASX,KAAK,CAAC,UAAU,KAAK;QAC9BG;QACAG;QACA1C;QACAwC,MAAM,EAAGA,iBAAAA,SAAyC;QAClDQ,YAAY,WAAEF,4BAAAA,SAAUE,YAAY,oBAAIb,QAAQ1B,GAAG;QACnDwC,WAAW,WAAEH,4BAAAA,SAAUG,WAAW,oBAAId,QAAQ/G,KAAK;QACnD8H,aAAaf,QAAQ/G,KAAK;IAC5B;IACA,IAAI,CAACyB,MAAM,OAAO;QAAEA,MAAM;QAAMwC,OAAO;IAA8B;IACrE,OAAO;QAAExC;QAAMwC,OAAO;IAAK;AAC7B;AAEA,oEAAoE,GACpE,SAAS8D,WAAWtG,IAAoB;IACtC,OAAOuG,KAAKC,KAAK,CAACD,KAAKE,SAAS,CAACzG;AACnC;AAEA;;;CAGC,GACD,eAAe0G,WACbtI,SAAoB,EACpBJ,KAAa,EACb2I,MAAyE;IAEzE,MAAM1D,SAAS7E,UAAUW,UAAU,CAAC,QAAQC,GAAG,CAAChB;IAChD,MAAM4I,SAAS,MAAMxI,UAAUoB,cAAc,CAAC,OAAOC;YAEXnB;QADxC,MAAMA,WAAW,MAAMmB,GAAGd,GAAG,CAACsE;QAC9B,MAAMrC,OAAO+F,OAAO1J,qBAAoBqB,iBAAAA,SAASW,IAAI,cAAbX,iBAAmB;QAC3D,IAAI,WAAWsC,MAAM,OAAO;YAAE9B,OAAO;YAAM0D,OAAO5B,KAAK4B,KAAK;QAAC;QAC7D/C,GAAGwB,MAAM,CAACgC,QAAQ,IAAIlH,UAAU,OAAO,iBAAiB6E,KAAKb,GAAG,CAACuG;QACjE,OAAO;YAAExH,OAAO8B;YAAM4B,OAAO;QAAK;IACpC;IACAzE,sBAAsBC;IACtB,OAAO4I;AACT;AAEA,gEAAgE,GAChE,eAAeC,SACbzI,SAAoB,EACpBJ,KAAa,EACbsC,MAAc,EACdwG,GAAsB,EACtBzI,UAAkC,CAAC,CAAC;;QAO7B0I;IALP,MAAMA,UAAU,MAAML,WAAWtI,WAAWJ,OAAO,CAACc,QAClDT,QAAQ2I,QAAQ,GACZlI,MAAMqG,MAAM,CAAC,CAACnF,OAASA,KAAKV,EAAE,KAAKgB,UACnCxB,MAAMiB,GAAG,CAAC,CAACC,OAAUA,KAAKV,EAAE,KAAKgB,SAAS,aAAKN;gBAAM8G;iBAAQ9G;IAEnE,gBAAO+G,iBAAAA,QAAQjI,KAAK,qBAAbiI,eAAeE,IAAI,CAAC,CAACjH,OAASA,KAAKV,EAAE,KAAKgB,0BAAW;AAC9D;AAEA;;2CAE2C,GAE3C,MAAM4G,WAAW;AAEjB;;;;;;;;;;;CAWC,GACD,OAAO,eAAeC,sBACpB/I,SAAoB,EACpBJ,KAAa,EACbsC,MAAc,EACd8G,UAAkB;QAGPC;IADX,MAAMA,OAAO,MAAMlJ,kBAAkBC,WAAWJ,OAAO;QAAEY,OAAO;IAAK;IACrE,IAAIoB,QAAOqH,mBAAAA,KAAKvI,KAAK,CAACmI,IAAI,CAAC,CAAChC,QAAUA,MAAM3F,EAAE,KAAKgB,mBAAxC+G,mBAAmD;IAC9D,IAAI,EAACrH,wBAAAA,KAAM8G,GAAG,KAAI9G,KAAK8G,GAAG,CAACQ,MAAM,KAAK,WAAW,OAAO;QAAEtH;QAAMuH,MAAM;IAAM;IAC5E,MAAMC,UAAUpJ,UAAUW,UAAU,CAAC,QAAQC,GAAG,CAAChB,OAAOe,UAAU,CAACiB,KAAKX,MAAM;IAC9E,IAAIyH,MAAyB,aAAK9G,KAAK8G,GAAG;IAC1C,MAAMW,OAAO,IAAI3H;IACjB,IAAI;QACF,MAAOtB,KAAKC,GAAG,KAAK2I,WAAY;gBAgCIM;gBAAAA;YA/BlC,MAAM,EAAE5I,KAAK,EAAE,GAAG,MAAMX,kBAAkBC,WAAWJ,OAAO;gBAAEY,OAAO;YAAK;YAC1E,IAAI8I;YACJ,IAAIZ,IAAIa,IAAI,KAAK,SAAS;gBACxB,IAAIC,QAAQJ,QAAQK,OAAO,CAAC9L,UAAU+L,UAAU,IAAIC,KAAK,CAACb;gBAC1D,IAAIJ,IAAIkB,MAAM,EAAEJ,QAAQA,MAAMK,UAAU,CAACnB,IAAIkB,MAAM;gBACnDN,OAAO,MAAME,MAAMjJ,GAAG;YACxB,OAAO;gBACL+I,OAAO,MAAMF,QAAQnD,KAAK,CAAC7H,2BAA2B,kBAAkB8D,QAAQyH,KAAK,CAACb,UAAUvI,GAAG;YACrG;YACA,MAAME,OAAOL,KAAKC,GAAG;YACrB,yDAAyD;YACzD,MAAMyJ,SAASR,KAAKpD,IAAI,CACrBa,MAAM,CAAC,CAACnG;oBACSA;gBAAhB,MAAMY,UAAUZ,YAAAA,IAAIC,IAAI,cAARD,YAAc,CAAC;gBAC/B,MAAMU,OAAO3C,kBAAkB6C,QAAQhD,qBAAqBoD,KAAMX,MAAM,EAAEO,QAAQd,OAAOD;gBACzF,OAAO1B,mBAAmByC,QAAQF;YACpC,GACCK,GAAG,CAAC,CAACf,MAAQA,IAAIM,EAAE;YACtB,IAAIwH,IAAIa,IAAI,KAAK,YAAYD,KAAKpD,IAAI,CAACxC,MAAM,IAAI4F,KAAKpD,IAAI,CAAC6D,KAAK,CAAC,CAACnJ,MAAQyI,KAAKlH,GAAG,CAACvB,IAAIM,EAAE,IAAI;gBAC3F,MAAM,IAAI8I,MAAM;YAClB;YACA,KAAK,MAAMpJ,OAAO0I,KAAKpD,IAAI,CAAEmD,KAAKY,GAAG,CAACrJ,IAAIM,EAAE;YAC5C,MAAMmC,UAAU,MAAMP,cACpB;gBAAE9C;gBAAWJ;gBAAOqB,QAAQW,KAAKX,MAAM;gBAAEP;gBAAOF,OAAO;gBAAMC;YAAK,GAClEqJ;YAEF,MAAMI,OAAOxB,IAAIa,IAAI,KAAK,UAAUD,KAAKa,IAAI,GAAGrB,WAAWQ,KAAKc,KAAK;YACrE1B,MAAM,aACDA;gBACH2B,WAAW3B,IAAI2B,SAAS,GAAGf,KAAKa,IAAI;gBACpClH,SAASyF,IAAIzF,OAAO,GAAGI,QAAQJ,OAAO,CAACS,MAAM;gBAC7CkG,QAAQlB,IAAIa,IAAI,KAAK,WAAWD,iBAAAA,cAAAA,KAAKpD,IAAI,CAACoD,KAAKpD,IAAI,CAACxC,MAAM,GAAG,EAAE,qBAA/B4F,YAAiCpI,EAAE,oBAAIwH,IAAIkB,MAAM,YAAjDN,OAAqD,OAAQ;eACzFY,OAAO;gBAAEhB,QAAQ;gBAAiBoB,cAAclK,KAAKC,GAAG;YAAG,IAAI,CAAC;YAEtEuB,OAAO,MAAM6G,SAASzI,WAAWJ,OAAOsC,QAAQwG,KAAK;gBACnDE,UAAUsB,QAAQtI,KAAK2I,QAAQ,KAAK;YACtC;YACA,IAAIL,QAAQ,CAACtI,MAAM,OAAO;gBAAEA;gBAAMuH,MAAM;YAAM;QAChD;QACA,OAAO;YAAEvH;YAAMuH,MAAM;QAAK;IAC5B,EAAE,OAAO/E,OAAO;QACdC,QAAQD,KAAK,CAAC,mCAAmCxE,OAAOsC,QAAQkC;QAChExC,OAAO,MAAM6G,SAASzI,WAAWJ,OAAOsC,QAAQ,aAC3CwG;YACHQ,QAAQ;YACRoB,cAAclK,KAAKC,GAAG;YACtB+D,OAAO;;QAET,OAAO;YAAExC;YAAMuH,MAAM;QAAM;IAC7B;AACF;AAEA;;2CAE2C,GAE3C,oFAAoF,GACpF,MAAMqB,gBAAgB;AAEtB,MAAMC,gBACJ;AAEF,SAASC,QAAQ/D,GAAY;IAC3B,IAAI,CAAC5E,MAAMC,OAAO,CAAC2E,MAAM,OAAO;IAChC,MAAM5D,MAAM;WACP,IAAIrB,IACLiF,IAAIhF,GAAG,CAAC,CAACkF,QAAUzE,OAAOyE,gBAAAA,QAAS,IAAIT,IAAI,GAAGU,KAAK,CAAC,GAAG,MAAMC,MAAM,CAAC,CAAC7F,KAAOA,MAAM,CAACA,GAAGyG,QAAQ,CAAC;KAElG,CAACb,KAAK,CAAC,GAAG5I;IACX,OAAO6E,IAAIW,MAAM,GAAGX,MAAM;AAC5B;AAEA;;;;;;;;;CASC,GACD,OAAO,MAAM4H,oBAAsC,OAAOC,KAAKC;QAM/CD,WAMQvF;IAXtB,IAAIuF,IAAIE,MAAM,KAAK,QAAQ;QACzBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAI3B,MAAM,CAAC,KAAK8B,IAAI,CAAC;YAAE5G,OAAO;QAAqB;QACnD;IACF;IACA,MAAMiB,QAAQuF,YAAAA,IAAIvF,IAAI,YAARuF,YAAY,CAAC;IAC3B,MAAMK,QAAQ5L,kBAAkBgG;IAChC,IAAI,CAAC4F,OAAO;QACVJ,IAAI3B,MAAM,CAAC,KAAK8B,IAAI,CAAC;YAAE5G,OAAO;QAAiB;QAC/C;IACF;IACA,MAAM8G,SAAS9I,QAAOiD,eAAAA,IAAI,CAAC,SAAS,YAAdA,eAAkB;IACxC,MAAMrF,YAAYzC,cAAc4G,GAAG,GAAGnE,SAAS;IAC/C,IAAI;;YAsBM;QArBR,IAAIkL,WAAW,YAAY;YACzB,MAAMjK,SAASoE,IAAI,CAAC,SAAS;YAC7B,MAAMtC,MAAM2H,QAAQrF,IAAI,CAAC,MAAM;YAC/B,IAAI,CAAC3G,mBAAmBuC,WAAW,CAAC8B,KAAK;gBACvC8H,IAAI3B,MAAM,CAAC,KAAK8B,IAAI,CAAC;oBAAE5G,OAAO;gBAAoB;gBAClD;YACF;YACA,MAAM+G,SAAS,MAAM5L,mBAAmBqL,KAAKK,OAAO;gBAAEG,UAAU;YAAK;YACrE,IAAID,OAAOE,EAAE,KAAK,OAAO;gBACvBR,IAAI3B,MAAM,CAACiC,OAAOjC,MAAM,EAAE8B,IAAI,CAACG,OAAO9F,IAAI;gBAC1C;YACF;YACA,MAAMhC,UAAU,MAAMQ,mBAAmB7D,WAAWmL,OAAOvL,KAAK,EAAEqB,QAAQ8B;YAC1E,MAAMuI,SAA6B;gBAAED,IAAI;eAAShI;YAClDwH,IAAI3B,MAAM,CAAC,KAAK8B,IAAI,CAACM;YACrB;QACF;QAEA,MAAM1L,QACJqL,MAAMM,KAAK,KAAK,QACZN,MAAMrL,KAAK,YACT,QAAA,MAAMpC,cAAcyN,MAAMhG,MAAM,EAAEuG,KAAK,CAAC,IAAM,0BAA/C,AAAC,MAAsD5L,KAAK,mBAAI;QACvE,IAAI,CAACA,OAAO;YACViL,IAAI3B,MAAM,CAAC,KAAK8B,IAAI,CAAC;gBAAE5G,OAAO;YAAmD;YACjF;QACF;QACA,MAAMqH,SAAS,MAAMtM,mBAAmByL,KAAKhL,OAAO;YAClD8L,OAAO;YACPC,SAASlB;QACX;QACA,IAAIgB,OAAOJ,EAAE,KAAK,OAAO;YACvBR,IAAI3B,MAAM,CAACuC,OAAOvC,MAAM,EAAE8B,IAAI,CAAC;gBAAE5G,OAAOqH,OAAOrH,KAAK;YAAC;YACrD;QACF;QACA,MAAMwH,QAAQtM,gBAAgBmM,OAAOpJ,GAAG,EAAE;QAC1C,IAAIuJ,OAAO;YACTf,IAAI3B,MAAM,CAAC0C,MAAM1C,MAAM,EAAE8B,IAAI,CAACY,MAAMvG,IAAI;YACxC;QACF;QACA,MAAMwG,QAAQ;YAAErG,KAAKiG,OAAOjG,GAAG;YAAEsG,OAAOL,OAAOK,KAAK;QAAC;QACrD,MAAMpG,SAAS+F,OAAOhG,IAAI,IAAIgG,OAAOK,KAAK,IAAI;QAC9C,MAAM3L,QAAQC,KAAKC,GAAG;QAEtB,IAAI6K,WAAW,SAAS;YACtB,MAAMI,SAA6B;gBAAED,IAAI;gBAAMU,OAAO,MAAMhG,gBAAgB/F,WAAWJ;YAAO;YAC9FiL,IAAI3B,MAAM,CAAC,KAAK8B,IAAI,CAACM;YACrB;QACF;QAEA,IAAIJ,WAAW,WAAWA,WAAW,WAAW;YAC9C,MAAMjK,SAASoE,IAAI,CAAC,SAAS;YAC7B,MAAMtC,MAAM2H,QAAQrF,IAAI,CAAC,MAAM;YAC/B,IAAI,CAAC3G,mBAAmBuC,WAAW,CAAC8B,KAAK;gBACvC8H,IAAI3B,MAAM,CAAC,KAAK8B,IAAI,CAAC;oBAAE5G,OAAO;gBAA6B;gBAC3D;YACF;YACA,MAAMW,UAAU/F,iBAAiBqG,IAAI,CAAC,UAAU;YAChD,IAAI,CAACN,SAAS;gBACZ8F,IAAI3B,MAAM,CAAC,KAAK8B,IAAI,CAAC;oBAAE5G,OAAO;gBAAkC;gBAChE;YACF;YACA,MAAM2H,QAAQ,MAAMhG,gBAAgB/F,WAAWJ;YAC/C,MAAMwH,MAAM,IAAI1F,IAAIqK,MAAMpK,GAAG,CAAC,CAACqK,OAASA,KAAK9K,EAAE;YAC/C,IAAI5D,iBAAiByH,SAAS9C,IAAI,CAAC,CAACf,KAAO,CAACkG,IAAIjF,GAAG,CAACjB,MAAM;gBACxD2J,IAAI3B,MAAM,CAAC,KAAK8B,IAAI,CAAC;oBAAE5G,OAAO;gBAAkD;gBAChF;YACF;YACA,MAAMmD,SAAyBlC,IAAI,CAAC,SAAS,KAAK,SAAS,SAAS;YACpE,MAAM,EAAE3E,KAAK,EAAEF,KAAK,EAAE,GAAG,MAAMT,kBAAkBC,WAAWJ;YAC5D,MAAMyD,UAAU,MAAMP,cACpB;gBACE9C;gBACAJ;gBACAqB;gBACAP;gBACAF;gBACAC,MAAMN;gBACNoC,QAAQ,CAACD,SACP4I,WAAW,UACPjM,iBAAiBqD,QAAQyC,SAASwC,QAAQ;wBAAE/B,KAAKiG,OAAOjG,GAAG;wBAAEC,MAAMC;oBAAO,GAAGvF,SAC7EjB,oBAAoBoD,QAAQyC;YACpC,GACAhC;YAEF,MAAMkJ,WAAW,CAAC/K;;oBAAe6K;gCAAAA,cAAAA,MAAMlD,IAAI,CAAC,CAACmD,OAASA,KAAK9K,EAAE,KAAKA,wBAAjC6K,YAAsCtG,IAAI,mBAAI;;YAC/E,MAAMyG,QAAQ3N,qBAAqBwG,SAASkH;YAC5C,MAAME,WACJjB,WAAW,UACP,CAAC,YAAY,EAAEgB,QAAQ3E,WAAW,SAAS,qBAAqB,gBAAgB,GAChF,CAAC,qBAAqB,EAAE2E,OAAO;YACrC,MAAM3I,QAAQC,GAAG,CACfH,QAAQJ,OAAO,CAACtB,GAAG,CAAC,CAACT,KACnB0D,oBAAoB5E,WAAW;oBAC7BJ;oBACAqB;oBACAC;oBACAmE,MAAM8G;oBACNpH;oBACAQ,IAAI;wBAAEC,KAAKiG,OAAOjG,GAAG;wBAAEC,MAAMC;oBAAO;oBACpCjF,MAAMN;gBACR;YAGJ,IAAIkD,QAAQJ,OAAO,CAACS,MAAM,EAAE;gBAC1B,MAAM0I,QAAQjO,yBAAyB,CAAC8C,OAAO;gBAC/C,MAAMxD,eACJmC,OACAiM,OACAxI,QAAQJ,OAAO,CAACS,MAAM,KAAK,IACvB,GAAGyI,SAAS,MAAM,EAAEC,MAAMC,GAAG,EAAE,GAC/B,GAAGF,SAAS,EAAE,EAAE9I,QAAQJ,OAAO,CAACS,MAAM,CAAC,CAAC,EAAE0I,MAAME,IAAI,CAACC,WAAW,IAAI,EACxE;oBACEC,MAAM7H,UAAU,CAAC1D,OAAO;mBACpBoC,QAAQJ,OAAO,CAACS,MAAM,KAAK,IAAI;oBAAExC,IAAImC,QAAQJ,OAAO,CAAC,EAAE;gBAAC,IAAI,CAAC,IAEnEuI,KAAK,CAAC,IAAM7I;YAChB;YACA,MAAM2I,SAA6B;gBACjCD,IAAI;gBACJpI,SAASI,QAAQJ,OAAO,CAACS,MAAM;gBAC/BR,SAASG,QAAQH,OAAO;YAC1B;YACA2H,IAAI3B,MAAM,CAAC,KAAK8B,IAAI,CAACM;YACrB;QACF;QAEA,IAAIJ,WAAW,aAAa;gBAG6B;YAFvD,MAAM7D,UAAU,MAAMjI,WAAWY,WAAWJ;YAC5C,MAAM+G,MAAMtB,IAAI,CAAC,OAAO;YACxB,MAAMnD,SAASyE,OAAO,OAAOA,QAAQ,WAAWvE,QAAO,UAAA,AAACuE,GAA+B,CAAC,KAAK,YAAtC,UAA0C,MAAM;YACvG,IAAI8F,QAA+B;YACnC,IAAIrI,QAAuB;YAC3B,MAAMuE,UAAU,MAAML,WAAWtI,WAAWJ,OAAO,CAACc;oBACvBA;gBAA3B,MAAMmH,WAAW3F,UAAUxB,cAAAA,MAAMmI,IAAI,CAAC,CAACjH,OAASA,KAAKV,EAAE,KAAKgB,mBAAjCxB,cAA4C,OAAQ;gBAC/E,IAAIwB,UAAU,CAAC2F,UAAU,OAAO;oBAAEzD,OAAO;gBAA8B;gBACvE,IAAIyD,4BAAAA,SAAU0C,QAAQ,EAAE,OAAO;oBAAEnG,OAAO;gBAA8B;gBACtE,IAAI,CAACyD,YAAYnH,MAAMgD,MAAM,IAAIrF,uBAAuB;oBACtD,OAAO;wBAAE+F,OAAO,CAAC,0BAA0B,EAAE/F,sBAAsB,eAAe,CAAC;oBAAC;gBACtF;gBACA,MAAMqO,SAASzF,gBAAgBN,KAAK;oBAAEU;oBAASQ;oBAAUrC,KAAKiG,OAAOjG,GAAG;oBAAErF;gBAAM;gBAChF,IAAI,CAACuM,OAAO9K,IAAI,EAAE;oBAChBwC,QAAQsI,OAAOtI,KAAK;oBACpB,OAAO;wBAAEA,OAAOsI,OAAOtI,KAAK;oBAAC;gBAC/B;gBACA;;;;SAIC,GACDqI,QAAQ,aACHC,OAAO9K,IAAI;oBACd8G,KAAK;wBACHQ,QAAQ;wBACRK,MAAMmD,OAAO9K,IAAI,CAACkG,OAAO,GAAG,UAAU;wBACtCuC,WAAW;wBACXpH,SAAS;wBACT2G,QAAQ;wBACR+C,aAAaxM;oBACf;;gBAEF,OAAO0H,WACHnH,MAAMiB,GAAG,CAAC,CAACC,OAAUA,KAAKV,EAAE,KAAK2G,SAAS3G,EAAE,GAAGuL,QAAS7K,QACxD;uBAAIlB;oBAAO+L;iBAAM;YACvB;YACA,IAAI,CAAC9D,QAAQjI,KAAK,IAAI,CAAC+L,OAAO;oBACErI;gBAA9ByG,IAAI3B,MAAM,CAAC,KAAK8B,IAAI,CAAC;oBAAE5G,KAAK,GAAEA,QAAAA,gBAAAA,QAASuE,QAAQvE,KAAK,YAAtBA,QAA0B;gBAA+B;gBACvF;YACF;YACA,MAAMxC,OAAO6K;YACb,MAAMhP,eACJmC,OACAiM,OACA,GAAG3J,SAAS,YAAY,QAAQ,mBAAmB,EAAEN,KAAK6D,IAAI,CAAC,CAAC,CAAC,EACjE;gBAAE+G,MAAM,GAAG3O,UAAU,YAAY,CAAC;gBAAEqD,IAAIU,KAAKV,EAAE;gBAAEuE,MAAM7D,KAAK6D,IAAI;YAAC,GACjE+F,KAAK,CAAC,IAAM7I;YACd,MAAMiK,WAAW,MAAM7D,sBAAsB/I,WAAWJ,OAAOgC,KAAKV,EAAE,EAAEd,KAAKC,GAAG,KAAKmK;YACrF,MAAMc,SAA6B;gBAAED,IAAI;gBAAMzJ,MAAMgL,SAAShL,IAAI;gBAAEuH,MAAMyD,SAASzD,IAAI;YAAC;YACxF0B,IAAI3B,MAAM,CAAC,KAAK8B,IAAI,CAACM;YACrB;QACF;QAEA,IAAIJ,WAAW,iBAAiBA,WAAW,iBAAiB;gBACpC7F;YAAtB,MAAMnD,SAASE,QAAOiD,eAAAA,IAAI,CAAC,SAAS,YAAdA,eAAkB,IAAIe,IAAI;YAChD,IAAI,CAAClE,QAAQ;gBACX2I,IAAI3B,MAAM,CAAC,KAAK8B,IAAI,CAAC;oBAAE5G,OAAO;gBAAiB;gBAC/C;YACF;YACA,IAAI8G,WAAW,eAAe;gBAC5B,IAAIzF,OAAO;gBACX,MAAMkD,UAAU,MAAML,WAAWtI,WAAWJ,OAAO,CAACc;oBAClD,MAAMmH,WAAWnH,MAAMmI,IAAI,CAAC,CAACjH,OAASA,KAAKV,EAAE,KAAKgB;oBAClD,IAAI,CAAC2F,UAAU,OAAO;wBAAEzD,OAAO;oBAA8B;oBAC7DqB,OAAOoC,SAASpC,IAAI;oBACpB,OAAO/E,MAAMiB,GAAG,CAAC,CAACC,OAChBA,KAAKV,EAAE,KAAKgB,SACR,aACKN;4BACHkG,SAAS;4BACTyC,UAAU;4BACVtC,aAAa9H;4BACbuI,KAAK;gCACHQ,QAAQ;gCACRK,MAAM;gCACNc,WAAW;gCACXpH,SAAS;gCACT2G,QAAQ;gCACR+C,aAAaxM;4BACf;6BAEFyB;gBAER;gBACA,IAAI,CAAC+G,QAAQjI,KAAK,EAAE;oBAClBmK,IAAI3B,MAAM,CAAC,KAAK8B,IAAI,CAAC;wBAAE5G,OAAOuE,QAAQvE,KAAK;oBAAC;oBAC5C;gBACF;gBACA,MAAM3G,eAAemC,OAAOiM,OAAO,CAAC,0BAA0B,EAAEpG,KAAK,CAAC,CAAC,EAAE;oBACvE+G,MAAM,GAAG3O,UAAU,YAAY,CAAC;oBAChCqD,IAAIgB;oBACJuD;gBACF,GAAG+F,KAAK,CAAC,IAAM7I;YACjB,OAAO;gBACL,wCAAwC;gBACxC,MAAM2F,WAAWtI,WAAWJ,OAAO,CAACc,QAClCA,MAAMiB,GAAG,CAAC,CAACC;4BACaA;+BAAtBA,KAAKV,EAAE,KAAKgB,UAAUN,EAAAA,YAAAA,KAAK8G,GAAG,qBAAR9G,UAAUsH,MAAM,MAAK,WACvC,aAAKtH;4BAAM8G,KAAK,aAAK9G,KAAK8G,GAAG;gCAAEQ,QAAQ;;6BACvCtH;;YAGV;YACA,MAAMgL,WAAW,MAAM7D,sBAAsB/I,WAAWJ,OAAOsC,QAAQ9B,KAAKC,GAAG,KAAKmK;YACpF,MAAMc,SAA6B;gBAAED,IAAI;gBAAMzJ,MAAMgL,SAAShL,IAAI;gBAAEuH,MAAMyD,SAASzD,IAAI;YAAC;YACxF0B,IAAI3B,MAAM,CAAC,KAAK8B,IAAI,CAACM;YACrB;QACF;QAEAT,IAAI3B,MAAM,CAAC,KAAK8B,IAAI,CAAC;YAAE5G,OAAO;QAA0B;IAC1D,EAAE,OAAOA,OAAO;QACdC,QAAQD,KAAK,CAAC,wBAAwB8G,QAAQ9G;QAC9CyG,IAAI3B,MAAM,CAAC,KAAK8B,IAAI,CAAC;YAAE5G,OAAO;QAA6C;IAC7E;AACF,EAAC"}

package/src/lib/server/daily-digest-route.d.ts

@@ -0,0 +1,107 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The daily CRM digest (AGL-2619): `POST /api/crm/daily-digest`.
+ *
+ * Overdue and due-today are computed at read time by design (AGL-2599), so
+ * until this route nothing ever told anybody a task was late — overdue work
+ * was found by opening the Tasks section. Once a morning, per org and per
+ * member with open work, this counts their overdue and due-today tasks and
+ * the leads nobody has worked, and says so ONCE: a console notification
+ * (`content.crmDailyDigest`) and an email through the platform's own
+ * sending path. The words and the arithmetic live in `crm-digest.ts`; this
+ * file is the reads, the sends and the sweep.
+ *
+ * ## Who is told, and who is not
+ *
+ * A task's assignee, a lead's owner, and — for a lead nobody owns — every
+ * member who reaches the site it was captured on. Only members who may open
+ * the CRM (`data.manage`, resolved through their custom role the way the task
+ * routes resolve it), and only in an org whose plan carries the suite and
+ * whose `release_crm` flag is on: a digest about a surface the reader
+ * cannot open is a reminder to pay, not a reminder to call.
+ *
+ * Two switches on the recipient's own account are honored. The **Daily CRM
+ * digest** preference (`users/{uid}.digestPrefs.crmDaily`, on until turned
+ * off) governs the whole digest, mail included. The operational category
+ * mute (`notificationPrefs.content`) governs the console notification alone,
+ * as it does for every other `content.` type — the mute is a fact about the
+ * console feed, and the digest switch is a fact about the digest.
+ *
+ * ## Once a day, and resumable
+ *
+ * `orgs/{orgId}/crmDigests/{YYYY-MM-DD}` records, per member, that today's
+ * digest went out. It is stamped AFTER the sends, so a run that dies
+ * mid-org re-sends only to the members it never reached, and a second run
+ * on the same UTC day sends nothing. Orgs are swept in id order behind a
+ * cursor the way `usage-alerts` sweeps them, so the workflow's `done:false`
+ * loop carries a platform of any size across invocations.
+ *
+ * The email is a `bulk` send under the platform send-rate governor
+ * (AGL-2409): a cron fan-out on the shared sending domain, answering nothing
+ * anybody just did. A refusal STOPS the run and reports `done: true` — the
+ * window is full, and re-POSTing into it would only red the workflow — and
+ * because the refused member was never stamped, tomorrow's run digests them
+ * afresh. Nothing about today's list is worth mailing tomorrow anyway.
+ *
+ * Metered as PLATFORM mail, not the org's: this is the platform reminding a
+ * member, and a reminder that pushed an org toward its email overage would
+ * be its own small absurdity. It is not a one-to-one CRM send and counts
+ * against no per-member sending allowance.
+ */
+/** The beat `/api/health/crons` would read, were this job in its inventory. */
+export declare const CRM_DIGEST_JOB_ID = "crm-daily-digest";
+/**
+ * Orgs per invocation.
+ *
+ * Fewer than `usage-alerts`' hundred: an org costs a task query, a paged
+ * host list, a leads query per site, the roster, and a send per member with
+ * work, under `maxDuration = 60`. A chunk that times out never advances its
+ * cursor, so the safe size is the one that finishes.
+ */
+export declare const CRM_DIGEST_ORG_CHUNK = 25;
+/**
+ * The most sites one org's digest reads leads from, after which the sweep
+ * stops and SAYS SO in the response rather than reading without bound.
+ */
+export declare const CRM_DIGEST_HOST_CEILING = 200;
+/**
+ * The key a person's switch for this digest is stored under in
+ * `users/{uid}.digestPrefs` — the one the CRM declares under
+ * `notificationDigests` in `plugins.config.json`, which is the one the
+ * settings page writes. `daily-digest-route.spec.ts` holds the two to one
+ * spelling.
+ */
+export declare const CRM_DAILY_DIGEST_KEY = "crmDaily";
+/** `orgs/{orgId}/crmDigests/{day}` — server-written, matched by no rule. */
+export declare const CRM_DIGEST_MARKER_COLLECTION = "crmDigests";
+/**
+ * The most members per org whose address is chased through the auth pools
+ * when their member document carries none. Bounds WORK, not audience — the
+ * denormalized copy is normally present, and `orgAdminEmails` draws the same
+ * line for the same reason.
+ */
+export declare const CRM_DIGEST_EMAIL_MAX_UID_LOOKUPS = 5;
+/**
+ * The zone the digest's "today" is drawn in.
+ *
+ * `CRM_DIGEST_TIME_ZONE` overrides the default for a self-hosted console
+ * whose team wakes up elsewhere; a value `Intl` does not know falls back to
+ * the default with a warning rather than throwing the whole run away.
+ */
+export declare function digestTimeZone(env?: NodeJS.ProcessEnv): string;
+export declare function crmDailyDigestRoute(request: Request): Promise<Response>;