@aglyn/plugins-crm 1.0.0-beta.217 → 1.0.0-beta.219

package/src/lib/server/daily-digest-route.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/daily-digest-route.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  type AglynOrgBilling,\n  type AglynOrgMember,\n  buildRoute,\n  CRM_COLLECTIONS,\n  DIGEST_PREFS_FIELD,\n  digestEnabled,\n  hostRoleFor,\n  isReleaseFlagOnForOrg,\n  notificationMuted,\n  parseOrgReleaseFlagOverrides,\n  pluginRequestFromWeb,\n  resolveBrandingProfile,\n  resolveEffectivePlan,\n  resolveOrgEntitlements,\n  Route,\n} from '@aglyn/aglyn/server'\nimport {\n  buildMemberDigests,\n  composeCrmDigestEmailText,\n  composeCrmDigestSubject,\n  composeCrmDigestSummary,\n  CRM_DIGEST_DEFAULT_TIME_ZONE,\n  CRM_DIGEST_LEAD_AGE_MS,\n  CRM_DIGEST_LEAD_WINDOW,\n  CRM_DIGEST_TASK_CEILING,\n  crmDigestCounts,\n  crmDigestEntitled,\n  type CrmDigestLead,\n  type CrmDigestTask,\n  crmDigestWindow,\n  type CrmMemberDigest,\n  isUnworkedLead,\n  utcDayKey,\n} from '../model/crm-digest'\nimport { rateLimitedRetryAtMs, sendEmail } from '@aglyn/shared-util-email'\nimport { withoutMailWithheldAccounts } from '@aglyn/tenant-data-admin/server/account-mail'\nimport {\n  findUserByUidAcrossPools,\n  firebaseAdmin,\n  getServerReleaseFlagValues,\n  listOrgMembers,\n  memberHasOrgPermission,\n  meterPlatformEmail,\n  notifyUsers,\n} from '@aglyn/tenant-data-admin'\n// From the LEAF, not the barrel (AGL-2407): the cron specs mock\n// `@aglyn/tenant-data-admin` wholesale, and a suppression gate imported\n// through the barrel would be silently replaced by whatever the factory\n// lists. Same reasoning as `usage-alert-email.ts`.\nimport { filterSuppressedEmails } from '@aglyn/tenant-data-admin/server/email-suppression'\nimport {\n  loadSystemEmail,\n  renderLoadedSystemEmail,\n  systemEmailBrand,\n  systemEmailContent,\n  type LoadedSystemEmail,\n} from '@aglyn/tenant-data-admin/server/render-system-email'\nimport { isCronAuthorized, isCronDryRun } from '@aglyn/tenant-data-admin/server/cron-auth'\nimport { writeCronBeat } from '@aglyn/aglyn/app-utils/health-report'\nimport { brandSupportLine } from '@aglyn/aglyn/app-utils/brand-support-line'\nimport { platformConsoleOrigin as consoleOrigin } from '@aglyn/aglyn/app-utils/platform-brand'\nimport { scopeTokensForHost } from '@aglyn/aglyn/app-utils/scope-tokens'\n\n/**\n * The mark a scheduled run leaves for `/api/health/crons` (AGL-1955), on the\n * INVOCATION and before the work — the console's rule for every cron. Never\n * throws: reaching the admin app is inside the try, because a monitor that\n * can take down the job it describes is worse than the failure it watches.\n */\nasync function recordCronBeat(jobId: string): Promise<void> {\n  try {\n    await writeCronBeat(firebaseAdmin.app().firestore(), jobId)\n  } catch {\n    // Deliberately swallowed: a job that stops stamping reds its own row.\n  }\n}\n\n// lockdown-423: exempt — server-internal cron (x-cron-secret), no user caller; it reads an org's CRM to remind its members and writes nothing a locked org could lose.\n\n/**\n * The daily CRM digest (AGL-2619): `POST /api/crm/daily-digest`.\n *\n * Overdue and due-today are computed at read time by design (AGL-2599), so\n * until this route nothing ever told anybody a task was late — overdue work\n * was found by opening the Tasks section. Once a morning, per org and per\n * member with open work, this counts their overdue and due-today tasks and\n * the leads nobody has worked, and says so ONCE: a console notification\n * (`content.crmDailyDigest`) and an email through the platform's own\n * sending path. The words and the arithmetic live in `crm-digest.ts`; this\n * file is the reads, the sends and the sweep.\n *\n * ## Who is told, and who is not\n *\n * A task's assignee, a lead's owner, and — for a lead nobody owns — every\n * member who reaches the site it was captured on. Only members who may open\n * the CRM (`data.manage`, resolved through their custom role the way the task\n * routes resolve it), and only in an org whose plan carries the suite and\n * whose `release_crm` flag is on: a digest about a surface the reader\n * cannot open is a reminder to pay, not a reminder to call.\n *\n * Two switches on the recipient's own account are honored. The **Daily CRM\n * digest** preference (`users/{uid}.digestPrefs.crmDaily`, on until turned\n * off) governs the whole digest, mail included. The operational category\n * mute (`notificationPrefs.content`) governs the console notification alone,\n * as it does for every other `content.` type — the mute is a fact about the\n * console feed, and the digest switch is a fact about the digest.\n *\n * ## Once a day, and resumable\n *\n * `orgs/{orgId}/crmDigests/{YYYY-MM-DD}` records, per member, that today's\n * digest went out. It is stamped AFTER the sends, so a run that dies\n * mid-org re-sends only to the members it never reached, and a second run\n * on the same UTC day sends nothing. Orgs are swept in id order behind a\n * cursor the way `usage-alerts` sweeps them, so the workflow's `done:false`\n * loop carries a platform of any size across invocations.\n *\n * The email is a `bulk` send under the platform send-rate governor\n * (AGL-2409): a cron fan-out on the shared sending domain, answering nothing\n * anybody just did. A refusal STOPS the run and reports `done: true` — the\n * window is full, and re-POSTing into it would only red the workflow — and\n * because the refused member was never stamped, tomorrow's run digests them\n * afresh. Nothing about today's list is worth mailing tomorrow anyway.\n *\n * Metered as PLATFORM mail, not the org's: this is the platform reminding a\n * member, and a reminder that pushed an org toward its email overage would\n * be its own small absurdity. It is not a one-to-one CRM send and counts\n * against no per-member sending allowance.\n */\n\n/** The beat `/api/health/crons` would read, were this job in its inventory. */\nexport const CRM_DIGEST_JOB_ID = 'crm-daily-digest'\n\n/**\n * Orgs per invocation.\n *\n * Fewer than `usage-alerts`' hundred: an org costs a task query, a paged\n * host list, a leads query per site, the roster, and a send per member with\n * work, under `maxDuration = 60`. A chunk that times out never advances its\n * cursor, so the safe size is the one that finishes.\n */\nexport const CRM_DIGEST_ORG_CHUNK = 25\n\n/** Hosts read per page inside one org, ordered by id like the orgs sweep. */\nconst CRM_DIGEST_HOST_PAGE = 100\n\n/**\n * The most sites one org's digest reads leads from, after which the sweep\n * stops and SAYS SO in the response rather than reading without bound.\n */\nexport const CRM_DIGEST_HOST_CEILING = 200\n\n/**\n * The key a person's switch for this digest is stored under in\n * `users/{uid}.digestPrefs` — the one the CRM declares under\n * `notificationDigests` in `plugins.config.json`, which is the one the\n * settings page writes. `daily-digest-route.spec.ts` holds the two to one\n * spelling.\n */\nexport const CRM_DAILY_DIGEST_KEY = 'crmDaily'\n\n/** `orgs/{orgId}/crmDigests/{day}` — server-written, matched by no rule. */\nexport const CRM_DIGEST_MARKER_COLLECTION = 'crmDigests'\n\n/**\n * The most members per org whose address is chased through the auth pools\n * when their member document carries none. Bounds WORK, not audience — the\n * denormalized copy is normally present, and `orgAdminEmails` draws the same\n * line for the same reason.\n */\nexport const CRM_DIGEST_EMAIL_MAX_UID_LOOKUPS = 5\n\n/**\n * The zone the digest's \"today\" is drawn in.\n *\n * `CRM_DIGEST_TIME_ZONE` overrides the default for a self-hosted console\n * whose team wakes up elsewhere; a value `Intl` does not know falls back to\n * the default with a warning rather than throwing the whole run away.\n */\nexport function digestTimeZone(env: NodeJS.ProcessEnv = process.env): string {\n  const configured = String(env['CRM_DIGEST_TIME_ZONE'] ?? '').trim()\n  if (!configured) return CRM_DIGEST_DEFAULT_TIME_ZONE\n  try {\n    new Intl.DateTimeFormat('en-US', { timeZone: configured })\n    return configured\n  } catch {\n    console.warn(\n      `crm-daily-digest: CRM_DIGEST_TIME_ZONE \"${configured}\" is not a zone — ` +\n        `using ${CRM_DIGEST_DEFAULT_TIME_ZONE}`,\n    )\n    return CRM_DIGEST_DEFAULT_TIME_ZONE\n  }\n}\n\ntype Firestore = FirebaseFirestore.Firestore\ntype Snapshot = FirebaseFirestore.QueryDocumentSnapshot\n\n/**\n * Every host owned by an org, paged by document id — the shape\n * `usage-alerts` reads hosts with, at a lower ceiling because each host here\n * costs a leads query.\n */\nasync function hostsOfOrg(\n  firestore: Firestore,\n  orgId: string,\n): Promise<{ docs: Snapshot[]; truncated: boolean }> {\n  const docs: Snapshot[] = []\n  let cursor: string | null = null\n  for (;;) {\n    let query = firestore\n      .collection('hosts')\n      .where('orgId', '==', orgId)\n      .orderBy(firebaseAdmin.firestore.FieldPath.documentId())\n      .limit(CRM_DIGEST_HOST_PAGE)\n    if (cursor) query = query.startAfter(firestore.collection('hosts').doc(cursor))\n    const page = await query.get()\n    for (const doc of page.docs) docs.push(doc)\n    if (page.docs.length < CRM_DIGEST_HOST_PAGE) return { docs, truncated: false }\n    if (docs.length >= CRM_DIGEST_HOST_CEILING) {\n      console.warn(\n        `crm-daily-digest: org ${orgId} has more than ${CRM_DIGEST_HOST_CEILING} ` +\n          'hosts — leads on the rest are not digested',\n      )\n      return { docs, truncated: true }\n    }\n    cursor = page.docs[page.docs.length - 1].id\n  }\n}\n\n/** What one member's row in the response says. */\ninterface MemberReport {\n  skipped?: string\n  overdue?: number\n  today?: number\n  leads?: number\n  notified?: boolean\n  emailed?: boolean\n  emailReason?: string\n  deferred?: boolean\n}\n\ninterface OrgReport {\n  skipped?: string\n  digests: number\n  notified: number\n  emailed: number\n  members?: Record<string, MemberReport>\n  hostsTruncated?: boolean\n  tasksTruncated?: boolean\n  /** The send-rate governor refused; the sweep stops here. */\n  deferred?: boolean\n}\n\ninterface SweepContext {\n  firestore: Firestore\n  nowMs: number\n  day: string\n  timeZone: string\n  dryRun: boolean\n  flagValues: Awaited<ReturnType<typeof getServerReleaseFlagValues>>\n  origin: string\n}\n\n/**\n * The console path a notification opens — the legacy `/{hostDocId}/rest`\n * shape every host notification uses, or the `/org/rest` shape the console\n * rewrites onto the organization's own hub when nothing owed names a site:\n * an organization task (AGL-2637) has none.\n */\nfunction notificationLink(hostId: string, section: 'tasks' | 'leads'): string {\n  return hostId ? `/${hostId}/crm/${section}` : `/org/crm/${section}`\n}\n\nasync function digestOrg(ctx: SweepContext, orgDoc: Snapshot): Promise<OrgReport> {\n  const { firestore, nowMs, day, timeZone, dryRun } = ctx\n  const orgId = orgDoc.id\n  const org = (orgDoc.data() ?? {}) as Partial<AglynOrgBilling> & Record<string, unknown>\n  const quiet: OrgReport = { digests: 0, notified: 0, emailed: 0 }\n\n  if (!crmDigestEntitled(resolveOrgEntitlements(org).features)) {\n    return { ...quiet, skipped: 'not-entitled' }\n  }\n  const flagOn = isReleaseFlagOnForOrg(\n    'release_crm',\n    ctx.flagValues['release_crm'],\n    orgId,\n    parseOrgReleaseFlagOverrides(org['releaseFlags']),\n    resolveEffectivePlan(org),\n  )\n  if (!flagOn) return { ...quiet, skipped: 'release-flag' }\n\n  const window = crmDigestWindow(nowMs, timeZone)\n\n  /*\n   * Every open task due before tomorrow, soonest first — overdue and today\n   * in one query on `(status, dueAtMs)`, bucketed afterwards. Undated tasks\n   * carry `dueAtMs: null`, which a range excludes.\n   */\n  const taskPage = await orgDoc.ref\n    .collection(CRM_COLLECTIONS.tasks)\n    .where('status', '==', 'open')\n    .where('dueAtMs', '<', window.endMs)\n    .orderBy('dueAtMs', 'asc')\n    .limit(CRM_DIGEST_TASK_CEILING)\n    .get()\n  const tasks: CrmDigestTask[] = taskPage.docs.map((doc) => ({\n    id: doc.id,\n    title: String(doc.get('title') ?? ''),\n    kind: doc.get('kind') ?? 'todo',\n    dueAtMs: Number(doc.get('dueAtMs')),\n    assigneeUid: String(doc.get('assigneeUid') ?? ''),\n    hostId: String(doc.get('hostId') ?? ''),\n    contactId: doc.get('contactId') || undefined,\n    companyId: doc.get('companyId') || undefined,\n    dealId: doc.get('dealId') || undefined,\n  }))\n  const tasksTruncated = taskPage.docs.length >= CRM_DIGEST_TASK_CEILING\n\n  /*\n   * The leads nobody has worked, per site. A window of the newest old leads\n   * by first sighting, filtered in memory, for the reason the Leads section\n   * gives: the capture door stamps no `status`, and a query cannot select on\n   * a field's absence.\n   */\n  const hosts = await hostsOfOrg(firestore, orgId)\n  const hostById = new Map(hosts.docs.map((doc) => [doc.id, doc]))\n  const leadCutoff = nowMs - CRM_DIGEST_LEAD_AGE_MS\n  const leads: CrmDigestLead[] = []\n  for (const host of hosts.docs) {\n    /*\n     * Still per site, but over the ORG collection narrowed to what that site\n     * may see (AGL-3275). The digest is a per-site message, so the loop stays;\n     * what changed is that a site's leads are selected by `visibleTo` rather\n     * than by the collection's parent, and a lead two brands share is in both\n     * of their digests — which is the honest answer, since both hold it.\n     */\n    const page = await firestore\n      .collection('orgs')\n      .doc(orgId)\n      .collection('leads')\n      .where('visibleTo', 'array-contains-any', scopeTokensForHost(host.id))\n      .where('firstSeenAtMs', '<=', leadCutoff)\n      .orderBy('firstSeenAtMs', 'desc')\n      .limit(CRM_DIGEST_LEAD_WINDOW)\n      .get()\n    for (const doc of page.docs) {\n      const data = doc.data() as Record<string, unknown>\n      if (!isUnworkedLead(data as Parameters<typeof isUnworkedLead>[0], nowMs)) continue\n      leads.push({\n        id: doc.id,\n        hostId: host.id,\n        email: String(data['email'] ?? ''),\n        name: String(data['name'] ?? '') || undefined,\n        ownerUid: String(data['ownerUid'] ?? '') || undefined,\n        firstSeenAtMs: Number(data['firstSeenAtMs']),\n      })\n    }\n  }\n\n  if (!tasks.length && !leads.length) return { ...quiet, skipped: 'nothing-owed' }\n\n  const listed = (await listOrgMembers(orgId)).filter(\n    (member) => member.orgSuspended !== true,\n  )\n  // A locked or disabled account is not told (AGL-3418): it cannot sign in\n  // to act on it.\n  const reachable = new Set(\n    await withoutMailWithheldAccounts(listed.map((member) => member.$id)),\n  )\n  const members = listed.filter((member) => reachable.has(member.$id))\n  const memberById = new Map(members.map((member) => [member.$id, member]))\n  const digests = buildMemberDigests({\n    tasks,\n    leads,\n    window,\n    members: members.map((member) => ({\n      uid: member.$id,\n      reachesHost: (hostId: string) => hostRoleFor(member, hostId) !== null,\n    })),\n  })\n  if (!digests.size) return { ...quiet, skipped: 'nobody-to-tell' }\n\n  const markerRef = orgDoc.ref.collection(CRM_DIGEST_MARKER_COLLECTION).doc(day)\n  const marker = await markerRef.get()\n  const sentToday = (marker.get('members') ?? {}) as Record<string, unknown>\n\n  // Sorted so the order members are told in — and the member a refusal\n  // lands on — is the same on every run.\n  const uids = [...digests.keys()].sort()\n  const userDocs = await firestore.getAll(\n    ...uids.map((uid) => firestore.collection('users').doc(uid)),\n  )\n  const userById = new Map(userDocs.map((doc) => [doc.id, doc]))\n\n  const branding = resolveBrandingProfile(org)\n  const orgSlug = String(org['slug'] ?? '')\n  const hostName = (hostId: string): string => {\n    const host = hostById.get(hostId)\n    return String(host?.get('name') || host?.get('subdomain') || hostId)\n  }\n  const hubUrl = (hostId: string): string | null => {\n    const subdomain = String(hostById.get(hostId)?.get('subdomain') ?? '')\n    if (!orgSlug || !subdomain) return null\n    return `${ctx.origin}${buildRoute(Route.HOST_DASHBOARD, { orgSlug, host: subdomain })}/crm`\n  }\n  // The organization's own hub, for a member whose owed tasks name no site.\n  const orgHubUrl = orgSlug\n    ? `${ctx.origin}${buildRoute(Route.ORG_HOME, { orgSlug })}/crm`\n    : null\n  const settingsUrl = `${ctx.origin}${buildRoute(Route.MANAGE_NOTIFICATION_SETTINGS)}`\n  const supportLine = brandSupportLine(branding)\n  const brand = systemEmailBrand(org)\n  let digestEmail: Promise<LoadedSystemEmail | null> | undefined\n\n  const report: OrgReport = { digests: 0, notified: 0, emailed: 0, members: {} }\n  if (hosts.truncated) report.hostsTruncated = true\n  if (tasksTruncated) report.tasksTruncated = true\n  const rows = report.members as Record<string, MemberReport>\n  let poolLookups = 0\n\n  for (const uid of uids) {\n    const digest = digests.get(uid) as CrmMemberDigest\n    if (sentToday[uid]) {\n      rows[uid] = { skipped: 'already-sent' }\n      continue\n    }\n    const member = memberById.get(uid) as AglynOrgMember\n    if (!(await memberHasOrgPermission(orgId, member, 'data.manage'))) {\n      rows[uid] = { skipped: 'no-data-manage' }\n      continue\n    }\n    const userDoc = userById.get(uid)\n    if (!digestEnabled(userDoc?.get(DIGEST_PREFS_FIELD), CRM_DAILY_DIGEST_KEY)) {\n      rows[uid] = { skipped: 'digest-off' }\n      continue\n    }\n    const muted = notificationMuted(\n      userDoc?.get('notificationPrefs'),\n      'content.crmDailyDigest',\n    )\n    const counts = crmDigestCounts(digest)\n    const row: MemberReport = { ...counts }\n    rows[uid] = row\n    report.digests += 1\n    if (dryRun) {\n      row.notified = !muted\n      continue\n    }\n\n    // The site the links open on: where the first task THAT HAS A SITE\n    // lives, else where the first lead was captured. An organization task\n    // (AGL-2637) names no site, and a digest owed nothing but those opens\n    // on the organization's hub.\n    const anchorHostId =\n      [...digest.overdue, ...digest.today].find((task) => task.hostId)?.hostId ||\n      digest.leads[0]?.hostId ||\n      ''\n    const section = counts.overdue + counts.today > 0 ? 'tasks' : 'leads'\n    const hub = anchorHostId ? hubUrl(anchorHostId) : orgHubUrl\n\n    /*\n     * THE EMAIL FIRST. A refusal from the send-rate governor stops the run\n     * with nothing else done for this member — no notification to double\n     * tomorrow, no marker to skip them on — so the order here is the\n     * idempotence, not a preference.\n     */\n    let emailed = false\n    let emailReason: string | undefined\n    let address = String(member.email ?? '').trim().toLowerCase()\n    if (!address.includes('@') && poolLookups < CRM_DIGEST_EMAIL_MAX_UID_LOOKUPS) {\n      poolLookups += 1\n      const pooled = await findUserByUidAcrossPools(uid).catch(() => null)\n      address = String(pooled?.record?.email ?? '').trim().toLowerCase()\n    }\n    const recipients = address.includes('@')\n      ? await filterSuppressedEmails([address], firestore)\n      : []\n    if (!recipients.length) {\n      emailReason = address.includes('@') ? 'suppressed' : 'no-recipient'\n    } else {\n      const digestInput = {\n        digest,\n        nowMs,\n        timeZone,\n        productName: branding.productName,\n        tasksUrl: hub ? `${hub}/tasks` : ctx.origin,\n        leadsUrl: (hostId: string) => `${hubUrl(hostId) ?? ctx.origin}/leads`,\n        settingsUrl,\n        hostName,\n        supportLine,\n      }\n      const subject = composeCrmDigestSubject(counts)\n      // The `crm-daily-digest` system email (AGL-3367), in the org's brand,\n      // read once per org and rendered per member.\n      digestEmail ??= loadSystemEmail('crm-daily-digest').catch(() => null)\n      const loaded = await digestEmail\n      const rendered = loaded\n        ? renderLoadedSystemEmail(\n            loaded,\n            {\n              ...brand.merge,\n              'digest.subject': subject,\n              'digest.body': composeCrmDigestEmailText({ ...digestInput, omitClosing: true }),\n              settingsUrl,\n            },\n            brand.options,\n          )\n        : null\n      const result = await sendEmail({\n        to: recipients,\n        ...systemEmailContent(rendered, {\n          subject,\n          text: composeCrmDigestEmailText(digestInput),\n        }),\n        fromName: branding.fromName,\n        context: 'crm-daily-digest',\n        priority: 'bulk',\n      })\n      if (result.sent) {\n        emailed = true\n        await meterPlatformEmail().catch(() => undefined)\n      } else if (rateLimitedRetryAtMs(result) !== null) {\n        row.deferred = true\n        report.deferred = true\n        return report\n      } else {\n        emailReason = (result as { reason?: string }).reason ?? 'failed'\n      }\n    }\n\n    let notified = false\n    if (!muted) {\n      await notifyUsers([uid], {\n        type: 'content.crmDailyDigest',\n        title: 'Your CRM today',\n        body: composeCrmDigestSummary(counts),\n        link: notificationLink(anchorHostId, section),\n        orgId,\n        ...(anchorHostId ? { hostId: anchorHostId } : {}),\n      })\n      notified = true\n    }\n\n    await markerRef.set(\n      {\n        day,\n        members: {\n          [uid]: { atMs: nowMs, ...counts, notified, emailed },\n        },\n        updatedAt: firebaseAdmin.firestore.FieldValue.serverTimestamp(),\n      },\n      { merge: true },\n    )\n    row.notified = notified\n    row.emailed = emailed\n    if (emailReason) row.emailReason = emailReason\n    if (notified) report.notified += 1\n    if (emailed) report.emailed += 1\n  }\n  return report\n}\n\nexport async function crmDailyDigestRoute(request: Request): Promise<Response> {\n  const { method, body, headers: rawHeaders, query } = await pluginRequestFromWeb(request)\n  const headers = rawHeaders as Partial<Record<string, string>>\n  if (method !== 'POST' && method !== 'GET') {\n    return Response.json({ error: 'Method not allowed' }, { status: 405 })\n  }\n  if (!process.env.CRON_SECRET) {\n    return Response.json(\n      { error: 'The CRM digest is not configured (CRON_SECRET).' },\n      { status: 501 },\n    )\n  }\n  if (!isCronAuthorized(headers)) {\n    return Response.json({ error: 'Unauthenticated' }, { status: 401 })\n  }\n  // A GET reports the plan and sends nothing; a bodyless POST — what the\n  // scheduled workflow sends — is a real run. `isCronDryRun` keys the\n  // default on the METHOD for exactly that reason.\n  const dryRun = isCronDryRun({ method, body, query })\n  // Stamped on the invocation, not on the work (AGL-1955), so the beat is\n  // already there the day this job joins `SCHEDULED_JOBS`.\n  if (method === 'POST') await recordCronBeat(CRM_DIGEST_JOB_ID)\n\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const nowMs = Date.now()\n    const ctx: SweepContext = {\n      firestore,\n      nowMs,\n      day: utcDayKey(nowMs),\n      timeZone: digestTimeZone(),\n      dryRun,\n      flagValues: await getServerReleaseFlagValues(),\n      origin: consoleOrigin(),\n    }\n\n    // The resumable sweep, in the shape `usage-alerts` reads orgs (AGL-2220):\n    // ordered by id, `limit + 1` to learn whether there is more, the cursor\n    // validated as an org id before it becomes a reference.\n    const requestedLimit = Number((body as { limit?: unknown } | undefined)?.limit)\n    const pageSize =\n      Number.isFinite(requestedLimit) && requestedLimit > 0\n        ? Math.min(Math.floor(requestedLimit), CRM_DIGEST_ORG_CHUNK)\n        : CRM_DIGEST_ORG_CHUNK\n    const rawCursor = (body as { cursor?: unknown } | undefined)?.cursor\n    const cursor =\n      typeof rawCursor === 'string' && rawCursor.length > 0 && !rawCursor.includes('/')\n        ? rawCursor\n        : null\n    let orgQuery = firestore\n      .collection('orgs')\n      .orderBy(firebaseAdmin.firestore.FieldPath.documentId())\n      .limit(pageSize + 1)\n    if (cursor) orgQuery = orgQuery.startAfter(firestore.collection('orgs').doc(cursor))\n    const page = await orgQuery.get()\n    const hasMore = page.docs.length > pageSize\n    const orgDocs = hasMore ? page.docs.slice(0, pageSize) : page.docs\n\n    const orgs: Record<string, OrgReport> = {}\n    const failures: Record<string, string> = {}\n    let digests = 0\n    let notified = 0\n    let emailed = 0\n    let deferred = false\n    for (const orgDoc of orgDocs) {\n      try {\n        const report = await digestOrg(ctx, orgDoc)\n        orgs[orgDoc.id] = report\n        digests += report.digests\n        notified += report.notified\n        emailed += report.emailed\n        if (report.deferred) {\n          deferred = true\n          break\n        }\n      } catch (error) {\n        console.error('[crm] daily digest failed for org', orgDoc.id, error)\n        failures[orgDoc.id] = (error as Error)?.message ?? 'unknown'\n      }\n    }\n    const failed = Object.keys(failures)\n    return Response.json(\n      {\n        day: ctx.day,\n        timeZone: ctx.timeZone,\n        dryRun,\n        swept: orgDocs.length,\n        digests,\n        notified,\n        emailed,\n        orgs,\n        ...(deferred ? { deferred: true } : {}),\n        ...(failed.length ? { failures } : {}),\n        // A deferred run reports `done: true` — see the module comment —\n        // so the workflow's loop does not re-POST into a full window.\n        nextCursor: deferred || !hasMore ? null : (orgDocs[orgDocs.length - 1]?.id ?? null),\n        done: deferred || !hasMore,\n      },\n      // 207: this chunk finished and some org in it needs a person, which is\n      // what fails the workflow (its one alerting channel).\n      { status: failed.length ? 207 : 200 },\n    )\n  } catch (error) {\n    console.error('[crm] daily digest run failed', error)\n    return Response.json({ error: 'CRM digest run failed' }, { status: 500 })\n  }\n}\n"],"names":["buildRoute","CRM_COLLECTIONS","DIGEST_PREFS_FIELD","digestEnabled","hostRoleFor","isReleaseFlagOnForOrg","notificationMuted","parseOrgReleaseFlagOverrides","pluginRequestFromWeb","resolveBrandingProfile","resolveEffectivePlan","resolveOrgEntitlements","Route","buildMemberDigests","composeCrmDigestEmailText","composeCrmDigestSubject","composeCrmDigestSummary","CRM_DIGEST_DEFAULT_TIME_ZONE","CRM_DIGEST_LEAD_AGE_MS","CRM_DIGEST_LEAD_WINDOW","CRM_DIGEST_TASK_CEILING","crmDigestCounts","crmDigestEntitled","crmDigestWindow","isUnworkedLead","utcDayKey","rateLimitedRetryAtMs","sendEmail","withoutMailWithheldAccounts","findUserByUidAcrossPools","firebaseAdmin","getServerReleaseFlagValues","listOrgMembers","memberHasOrgPermission","meterPlatformEmail","notifyUsers","filterSuppressedEmails","loadSystemEmail","renderLoadedSystemEmail","systemEmailBrand","systemEmailContent","isCronAuthorized","isCronDryRun","writeCronBeat","brandSupportLine","platformConsoleOrigin","consoleOrigin","scopeTokensForHost","recordCronBeat","jobId","app","firestore","CRM_DIGEST_JOB_ID","CRM_DIGEST_ORG_CHUNK","CRM_DIGEST_HOST_PAGE","CRM_DIGEST_HOST_CEILING","CRM_DAILY_DIGEST_KEY","CRM_DIGEST_MARKER_COLLECTION","CRM_DIGEST_EMAIL_MAX_UID_LOOKUPS","digestTimeZone","env","process","configured","String","trim","Intl","DateTimeFormat","timeZone","console","warn","hostsOfOrg","orgId","docs","cursor","query","collection","where","orderBy","FieldPath","documentId","limit","startAfter","doc","page","get","push","length","truncated","id","notificationLink","hostId","section","digestOrg","ctx","orgDoc","marker","org","nowMs","day","dryRun","data","quiet","digests","notified","emailed","features","skipped","flagOn","flagValues","window","taskPage","ref","tasks","endMs","map","title","kind","dueAtMs","Number","assigneeUid","contactId","undefined","companyId","dealId","tasksTruncated","hosts","hostById","Map","leadCutoff","leads","host","email","name","ownerUid","firstSeenAtMs","listed","filter","member","orgSuspended","reachable","Set","$id","members","has","memberById","uid","reachesHost","size","markerRef","sentToday","uids","keys","sort","userDocs","getAll","userById","branding","orgSlug","hostName","hubUrl","subdomain","origin","HOST_DASHBOARD","orgHubUrl","ORG_HOME","settingsUrl","MANAGE_NOTIFICATION_SETTINGS","supportLine","brand","digestEmail","report","hostsTruncated","rows","poolLookups","digest","userDoc","muted","counts","row","anchorHostId","overdue","today","find","task","hub","emailReason","address","toLowerCase","includes","pooled","catch","record","recipients","digestInput","productName","tasksUrl","leadsUrl","subject","loaded","rendered","merge","omitClosing","options","result","to","text","fromName","context","priority","sent","deferred","reason","type","body","link","set","atMs","updatedAt","FieldValue","serverTimestamp","crmDailyDigestRoute","request","method","headers","rawHeaders","Response","json","error","status","CRON_SECRET","orgDocs","Date","now","requestedLimit","pageSize","isFinite","Math","min","floor","rawCursor","orgQuery","hasMore","slice","orgs","failures","message","failed","Object","swept","nextCursor","done"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAGEA,UAAU,EACVC,eAAe,EACfC,kBAAkB,EAClBC,aAAa,EACbC,WAAW,EACXC,qBAAqB,EACrBC,iBAAiB,EACjBC,4BAA4B,EAC5BC,oBAAoB,EACpBC,sBAAsB,EACtBC,oBAAoB,EACpBC,sBAAsB,EACtBC,KAAK,QACA,sBAAqB;AAC5B,SACEC,kBAAkB,EAClBC,yBAAyB,EACzBC,uBAAuB,EACvBC,uBAAuB,EACvBC,4BAA4B,EAC5BC,sBAAsB,EACtBC,sBAAsB,EACtBC,uBAAuB,EACvBC,eAAe,EACfC,iBAAiB,EAGjBC,eAAe,EAEfC,cAAc,EACdC,SAAS,QACJ,yBAAqB;AAC5B,SAASC,oBAAoB,EAAEC,SAAS,QAAQ,2BAA0B;AAC1E,SAASC,2BAA2B,QAAQ,+CAA8C;AAC1F,SACEC,wBAAwB,EACxBC,aAAa,EACbC,0BAA0B,EAC1BC,cAAc,EACdC,sBAAsB,EACtBC,kBAAkB,EAClBC,WAAW,QACN,2BAA0B;AACjC,gEAAgE;AAChE,wEAAwE;AACxE,wEAAwE;AACxE,mDAAmD;AACnD,SAASC,sBAAsB,QAAQ,oDAAmD;AAC1F,SACEC,eAAe,EACfC,uBAAuB,EACvBC,gBAAgB,EAChBC,kBAAkB,QAEb,sDAAqD;AAC5D,SAASC,gBAAgB,EAAEC,YAAY,QAAQ,4CAA2C;AAC1F,SAASC,aAAa,QAAQ,uCAAsC;AACpE,SAASC,gBAAgB,QAAQ,4CAA2C;AAC5E,SAASC,yBAAyBC,aAAa,QAAQ,wCAAuC;AAC9F,SAASC,kBAAkB,QAAQ,sCAAqC;AAExE;;;;;CAKC,GACD,eAAeC,eAAeC,KAAa;IACzC,IAAI;QACF,MAAMN,cAAcb,cAAcoB,GAAG,GAAGC,SAAS,IAAIF;IACvD,EAAE,eAAM;IACN,sEAAsE;IACxE;AACF;AAEA,uKAAuK;AAEvK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDC,GAED,6EAA6E,GAC7E,OAAO,MAAMG,oBAAoB,mBAAkB;AAEnD;;;;;;;CAOC,GACD,OAAO,MAAMC,uBAAuB,GAAE;AAEtC,2EAA2E,GAC3E,MAAMC,uBAAuB;AAE7B;;;CAGC,GACD,OAAO,MAAMC,0BAA0B,IAAG;AAE1C;;;;;;CAMC,GACD,OAAO,MAAMC,uBAAuB,WAAU;AAE9C,0EAA0E,GAC1E,OAAO,MAAMC,+BAA+B,aAAY;AAExD;;;;;CAKC,GACD,OAAO,MAAMC,mCAAmC,EAAC;AAEjD;;;;;;CAMC,GACD,OAAO,SAASC,eAAeC,MAAyBC,QAAQD,GAAG;QACvCA;IAA1B,MAAME,aAAaC,QAAOH,4BAAAA,GAAG,CAAC,uBAAuB,YAA3BA,4BAA+B,IAAII,IAAI;IACjE,IAAI,CAACF,YAAY,OAAO7C;IACxB,IAAI;QACF,IAAIgD,KAAKC,cAAc,CAAC,SAAS;YAAEC,UAAUL;QAAW;QACxD,OAAOA;IACT,EAAE,eAAM;QACNM,QAAQC,IAAI,CACV,CAAC,wCAAwC,EAAEP,WAAW,kBAAkB,CAAC,GACvE,CAAC,MAAM,EAAE7C,8BAA8B;QAE3C,OAAOA;IACT;AACF;AAKA;;;;CAIC,GACD,eAAeqD,WACbnB,SAAoB,EACpBoB,KAAa;IAEb,MAAMC,OAAmB,EAAE;IAC3B,IAAIC,SAAwB;IAC5B,OAAS;QACP,IAAIC,QAAQvB,UACTwB,UAAU,CAAC,SACXC,KAAK,CAAC,SAAS,MAAML,OACrBM,OAAO,CAAC/C,cAAcqB,SAAS,CAAC2B,SAAS,CAACC,UAAU,IACpDC,KAAK,CAAC1B;QACT,IAAImB,QAAQC,QAAQA,MAAMO,UAAU,CAAC9B,UAAUwB,UAAU,CAAC,SAASO,GAAG,CAACT;QACvE,MAAMU,OAAO,MAAMT,MAAMU,GAAG;QAC5B,KAAK,MAAMF,OAAOC,KAAKX,IAAI,CAAEA,KAAKa,IAAI,CAACH;QACvC,IAAIC,KAAKX,IAAI,CAACc,MAAM,GAAGhC,sBAAsB,OAAO;YAAEkB;YAAMe,WAAW;QAAM;QAC7E,IAAIf,KAAKc,MAAM,IAAI/B,yBAAyB;YAC1Ca,QAAQC,IAAI,CACV,CAAC,sBAAsB,EAAEE,MAAM,eAAe,EAAEhB,wBAAwB,CAAC,CAAC,GACxE;YAEJ,OAAO;gBAAEiB;gBAAMe,WAAW;YAAK;QACjC;QACAd,SAASU,KAAKX,IAAI,CAACW,KAAKX,IAAI,CAACc,MAAM,GAAG,EAAE,CAACE,EAAE;IAC7C;AACF;AAoCA;;;;;CAKC,GACD,SAASC,iBAAiBC,MAAc,EAAEC,OAA0B;IAClE,OAAOD,SAAS,CAAC,CAAC,EAAEA,OAAO,KAAK,EAAEC,SAAS,GAAG,CAAC,SAAS,EAAEA,SAAS;AACrE;AAEA,eAAeC,UAAUC,GAAiB,EAAEC,MAAgB;QAG7CA,cA4GMC,aAWIC;IAzHvB,MAAM,EAAE7C,SAAS,EAAE8C,KAAK,EAAEC,GAAG,EAAE/B,QAAQ,EAAEgC,MAAM,EAAE,GAAGN;IACpD,MAAMtB,QAAQuB,OAAON,EAAE;IACvB,MAAMQ,OAAOF,eAAAA,OAAOM,IAAI,cAAXN,eAAiB,CAAC;IAC/B,MAAMO,QAAmB;QAAEC,SAAS;QAAGC,UAAU;QAAGC,SAAS;IAAE;IAE/D,IAAI,CAAClF,kBAAkBX,uBAAuBqF,KAAKS,QAAQ,GAAG;QAC5D,OAAO,aAAKJ;YAAOK,SAAS;;IAC9B;IACA,MAAMC,SAAStG,sBACb,eACAwF,IAAIe,UAAU,CAAC,cAAc,EAC7BrC,OACAhE,6BAA6ByF,GAAG,CAAC,eAAe,GAChDtF,qBAAqBsF;IAEvB,IAAI,CAACW,QAAQ,OAAO,aAAKN;QAAOK,SAAS;;IAEzC,MAAMG,SAAStF,gBAAgB0E,OAAO9B;IAEtC;;;;GAIC,GACD,MAAM2C,WAAW,MAAMhB,OAAOiB,GAAG,CAC9BpC,UAAU,CAAC1E,gBAAgB+G,KAAK,EAChCpC,KAAK,CAAC,UAAU,MAAM,QACtBA,KAAK,CAAC,WAAW,KAAKiC,OAAOI,KAAK,EAClCpC,OAAO,CAAC,WAAW,OACnBG,KAAK,CAAC5D,yBACNgE,GAAG;IACN,MAAM4B,QAAyBF,SAAStC,IAAI,CAAC0C,GAAG,CAAC,CAAChC;YAElCA,UACRA,WAEcA,WACLA;eAN0C;YACzDM,IAAIN,IAAIM,EAAE;YACV2B,OAAOpD,QAAOmB,WAAAA,IAAIE,GAAG,CAAC,oBAARF,WAAoB;YAClCkC,IAAI,GAAElC,YAAAA,IAAIE,GAAG,CAAC,mBAARF,YAAmB;YACzBmC,SAASC,OAAOpC,IAAIE,GAAG,CAAC;YACxBmC,aAAaxD,QAAOmB,YAAAA,IAAIE,GAAG,CAAC,0BAARF,YAA0B;YAC9CQ,QAAQ3B,QAAOmB,YAAAA,IAAIE,GAAG,CAAC,qBAARF,YAAqB;YACpCsC,WAAWtC,IAAIE,GAAG,CAAC,gBAAgBqC;YACnCC,WAAWxC,IAAIE,GAAG,CAAC,gBAAgBqC;YACnCE,QAAQzC,IAAIE,GAAG,CAAC,aAAaqC;QAC/B;;IACA,MAAMG,iBAAiBd,SAAStC,IAAI,CAACc,MAAM,IAAIlE;IAE/C;;;;;GAKC,GACD,MAAMyG,QAAQ,MAAMvD,WAAWnB,WAAWoB;IAC1C,MAAMuD,WAAW,IAAIC,IAAIF,MAAMrD,IAAI,CAAC0C,GAAG,CAAC,CAAChC,MAAQ;YAACA,IAAIM,EAAE;YAAEN;SAAI;IAC9D,MAAM8C,aAAa/B,QAAQ/E;IAC3B,MAAM+G,QAAyB,EAAE;IACjC,KAAK,MAAMC,QAAQL,MAAMrD,IAAI,CAAE;QAC7B;;;;;;KAMC,GACD,MAAMW,OAAO,MAAMhC,UAChBwB,UAAU,CAAC,QACXO,GAAG,CAACX,OACJI,UAAU,CAAC,SACXC,KAAK,CAAC,aAAa,sBAAsB7B,mBAAmBmF,KAAK1C,EAAE,GACnEZ,KAAK,CAAC,iBAAiB,MAAMoD,YAC7BnD,OAAO,CAAC,iBAAiB,QACzBG,KAAK,CAAC7D,wBACNiE,GAAG;QACN,KAAK,MAAMF,OAAOC,KAAKX,IAAI,CAAE;gBAMX4B,aACDA,YACIA;YAPnB,MAAMA,OAAOlB,IAAIkB,IAAI;YACrB,IAAI,CAAC5E,eAAe4E,MAA8CH,QAAQ;YAC1EgC,MAAM5C,IAAI,CAAC;gBACTG,IAAIN,IAAIM,EAAE;gBACVE,QAAQwC,KAAK1C,EAAE;gBACf2C,OAAOpE,QAAOqC,cAAAA,IAAI,CAAC,QAAQ,YAAbA,cAAiB;gBAC/BgC,MAAMrE,QAAOqC,aAAAA,IAAI,CAAC,OAAO,YAAZA,aAAgB,OAAOqB;gBACpCY,UAAUtE,QAAOqC,iBAAAA,IAAI,CAAC,WAAW,YAAhBA,iBAAoB,OAAOqB;gBAC5Ca,eAAehB,OAAOlB,IAAI,CAAC,gBAAgB;YAC7C;QACF;IACF;IAEA,IAAI,CAACY,MAAM1B,MAAM,IAAI,CAAC2C,MAAM3C,MAAM,EAAE,OAAO,aAAKe;QAAOK,SAAS;;IAEhE,MAAM6B,SAAS,AAAC,CAAA,MAAMvG,eAAeuC,MAAK,EAAGiE,MAAM,CACjD,CAACC,SAAWA,OAAOC,YAAY,KAAK;IAEtC,yEAAyE;IACzE,gBAAgB;IAChB,MAAMC,YAAY,IAAIC,IACpB,MAAMhH,4BAA4B2G,OAAOrB,GAAG,CAAC,CAACuB,SAAWA,OAAOI,GAAG;IAErE,MAAMC,UAAUP,OAAOC,MAAM,CAAC,CAACC,SAAWE,UAAUI,GAAG,CAACN,OAAOI,GAAG;IAClE,MAAMG,aAAa,IAAIjB,IAAIe,QAAQ5B,GAAG,CAAC,CAACuB,SAAW;YAACA,OAAOI,GAAG;YAAEJ;SAAO;IACvE,MAAMnC,UAAUzF,mBAAmB;QACjCmG;QACAiB;QACApB;QACAiC,SAASA,QAAQ5B,GAAG,CAAC,CAACuB,SAAY,CAAA;gBAChCQ,KAAKR,OAAOI,GAAG;gBACfK,aAAa,CAACxD,SAAmBtF,YAAYqI,QAAQ/C,YAAY;YACnE,CAAA;IACF;IACA,IAAI,CAACY,QAAQ6C,IAAI,EAAE,OAAO,aAAK9C;QAAOK,SAAS;;IAE/C,MAAM0C,YAAYtD,OAAOiB,GAAG,CAACpC,UAAU,CAAClB,8BAA8ByB,GAAG,CAACgB;IAC1E,MAAMH,SAAS,MAAMqD,UAAUhE,GAAG;IAClC,MAAMiE,aAAatD,cAAAA,OAAOX,GAAG,CAAC,sBAAXW,cAAyB,CAAC;IAE7C,qEAAqE;IACrE,uCAAuC;IACvC,MAAMuD,OAAO;WAAIhD,QAAQiD,IAAI;KAAG,CAACC,IAAI;IACrC,MAAMC,WAAW,MAAMtG,UAAUuG,MAAM,IAClCJ,KAAKpC,GAAG,CAAC,CAAC+B,MAAQ9F,UAAUwB,UAAU,CAAC,SAASO,GAAG,CAAC+D;IAEzD,MAAMU,WAAW,IAAI5B,IAAI0B,SAASvC,GAAG,CAAC,CAAChC,MAAQ;YAACA,IAAIM,EAAE;YAAEN;SAAI;IAE5D,MAAM0E,WAAWnJ,uBAAuBuF;IACxC,MAAM6D,UAAU9F,QAAOiC,YAAAA,GAAG,CAAC,OAAO,YAAXA,YAAe;IACtC,MAAM8D,WAAW,CAACpE;QAChB,MAAMwC,OAAOJ,SAAS1C,GAAG,CAACM;QAC1B,OAAO3B,OAAOmE,CAAAA,wBAAAA,KAAM9C,GAAG,CAAC,aAAW8C,wBAAAA,KAAM9C,GAAG,CAAC,iBAAgBM;IAC/D;IACA,MAAMqE,SAAS,CAACrE;;YACWoC;QAAzB,MAAMkC,YAAYjG,gBAAO+D,gBAAAA,SAAS1C,GAAG,CAACM,4BAAboC,cAAsB1C,GAAG,CAAC,+BAAgB;QACnE,IAAI,CAACyE,WAAW,CAACG,WAAW,OAAO;QACnC,OAAO,GAAGnE,IAAIoE,MAAM,GAAGjK,WAAWY,MAAMsJ,cAAc,EAAE;YAAEL;YAAS3B,MAAM8B;QAAU,GAAG,IAAI,CAAC;IAC7F;IACA,0EAA0E;IAC1E,MAAMG,YAAYN,UACd,GAAGhE,IAAIoE,MAAM,GAAGjK,WAAWY,MAAMwJ,QAAQ,EAAE;QAAEP;IAAQ,GAAG,IAAI,CAAC,GAC7D;IACJ,MAAMQ,cAAc,GAAGxE,IAAIoE,MAAM,GAAGjK,WAAWY,MAAM0J,4BAA4B,GAAG;IACpF,MAAMC,cAAc3H,iBAAiBgH;IACrC,MAAMY,QAAQjI,iBAAiByD;IAC/B,IAAIyE;IAEJ,MAAMC,SAAoB;QAAEpE,SAAS;QAAGC,UAAU;QAAGC,SAAS;QAAGsC,SAAS,CAAC;IAAE;IAC7E,IAAIjB,MAAMtC,SAAS,EAAEmF,OAAOC,cAAc,GAAG;IAC7C,IAAI/C,gBAAgB8C,OAAO9C,cAAc,GAAG;IAC5C,MAAMgD,OAAOF,OAAO5B,OAAO;IAC3B,IAAI+B,cAAc;IAElB,KAAK,MAAM5B,OAAOK,KAAM;YAgDDb;YAdnB,OACAqC;QAlCF,MAAMA,SAASxE,QAAQlB,GAAG,CAAC6D;QAC3B,IAAII,SAAS,CAACJ,IAAI,EAAE;YAClB2B,IAAI,CAAC3B,IAAI,GAAG;gBAAEvC,SAAS;YAAe;YACtC;QACF;QACA,MAAM+B,SAASO,WAAW5D,GAAG,CAAC6D;QAC9B,IAAI,CAAE,MAAMhH,uBAAuBsC,OAAOkE,QAAQ,gBAAiB;YACjEmC,IAAI,CAAC3B,IAAI,GAAG;gBAAEvC,SAAS;YAAiB;YACxC;QACF;QACA,MAAMqE,UAAUpB,SAASvE,GAAG,CAAC6D;QAC7B,IAAI,CAAC9I,cAAc4K,2BAAAA,QAAS3F,GAAG,CAAClF,qBAAqBsD,uBAAuB;YAC1EoH,IAAI,CAAC3B,IAAI,GAAG;gBAAEvC,SAAS;YAAa;YACpC;QACF;QACA,MAAMsE,QAAQ1K,kBACZyK,2BAAAA,QAAS3F,GAAG,CAAC,sBACb;QAEF,MAAM6F,SAAS5J,gBAAgByJ;QAC/B,MAAMI,MAAoB,aAAKD;QAC/BL,IAAI,CAAC3B,IAAI,GAAGiC;QACZR,OAAOpE,OAAO,IAAI;QAClB,IAAIH,QAAQ;YACV+E,IAAI3E,QAAQ,GAAG,CAACyE;YAChB;QACF;QAEA,mEAAmE;QACnE,sEAAsE;QACtE,sEAAsE;QACtE,6BAA6B;QAC7B,MAAMG,eACJ,EAAA,QAAA;eAAIL,OAAOM,OAAO;eAAKN,OAAOO,KAAK;SAAC,CAACC,IAAI,CAAC,CAACC,OAASA,KAAK7F,MAAM,sBAA/D,MAAkEA,MAAM,OACxEoF,iBAAAA,OAAO7C,KAAK,CAAC,EAAE,qBAAf6C,eAAiBpF,MAAM,KACvB;QACF,MAAMC,UAAUsF,OAAOG,OAAO,GAAGH,OAAOI,KAAK,GAAG,IAAI,UAAU;QAC9D,MAAMG,MAAML,eAAepB,OAAOoB,gBAAgBhB;QAElD;;;;;KAKC,GACD,IAAI3D,UAAU;QACd,IAAIiF;QACJ,IAAIC,UAAU3H,QAAO0E,gBAAAA,OAAON,KAAK,YAAZM,gBAAgB,IAAIzE,IAAI,GAAG2H,WAAW;QAC3D,IAAI,CAACD,QAAQE,QAAQ,CAAC,QAAQf,cAAcnH,kCAAkC;;gBAG3DmI;YAFjBhB,eAAe;YACf,MAAMgB,SAAS,MAAMhK,yBAAyBoH,KAAK6C,KAAK,CAAC,IAAM;YAC/DJ,UAAU3H,eAAO8H,2BAAAA,iBAAAA,OAAQE,MAAM,qBAAdF,eAAgB1D,KAAK,mBAAI,IAAInE,IAAI,GAAG2H,WAAW;QAClE;QACA,MAAMK,aAAaN,QAAQE,QAAQ,CAAC,OAChC,MAAMxJ,uBAAuB;YAACsJ;SAAQ,EAAEvI,aACxC,EAAE;QACN,IAAI,CAAC6I,WAAW1G,MAAM,EAAE;YACtBmG,cAAcC,QAAQE,QAAQ,CAAC,OAAO,eAAe;QACvD,OAAO;YACL,MAAMK,cAAc;gBAClBnB;gBACA7E;gBACA9B;gBACA+H,aAAatC,SAASsC,WAAW;gBACjCC,UAAUX,MAAM,GAAGA,IAAI,MAAM,CAAC,GAAG3F,IAAIoE,MAAM;gBAC3CmC,UAAU,CAAC1G;wBAAsBqE;2BAAH,IAAGA,UAAAA,OAAOrE,mBAAPqE,UAAkBlE,IAAIoE,MAAM,CAAC,MAAM,CAAC;;gBACrEI;gBACAP;gBACAS;YACF;YACA,MAAM8B,UAAUtL,wBAAwBkK;YACxC,sEAAsE;YACtE,6CAA6C;YAC7CR,sBAAAA,cAAAA,cAAgBpI,gBAAgB,oBAAoByJ,KAAK,CAAC,IAAM;YAChE,MAAMQ,SAAS,MAAM7B;YACrB,MAAM8B,WAAWD,SACbhK,wBACEgK,QACA,aACK9B,MAAMgC,KAAK;gBACd,kBAAkBH;gBAClB,eAAevL,0BAA0B,aAAKmL;oBAAaQ,aAAa;;gBACxEpC;gBAEFG,MAAMkC,OAAO,IAEf;YACJ,MAAMC,SAAS,MAAMhL,UAAU;gBAC7BiL,IAAIZ;eACDxJ,mBAAmB+J,UAAU;gBAC9BF;gBACAQ,MAAM/L,0BAA0BmL;YAClC;gBACAa,UAAUlD,SAASkD,QAAQ;gBAC3BC,SAAS;gBACTC,UAAU;;YAEZ,IAAIL,OAAOM,IAAI,EAAE;gBACfzG,UAAU;gBACV,MAAMtE,qBAAqB4J,KAAK,CAAC,IAAMrE;YACzC,OAAO,IAAI/F,qBAAqBiL,YAAY,MAAM;gBAChDzB,IAAIgC,QAAQ,GAAG;gBACfxC,OAAOwC,QAAQ,GAAG;gBAClB,OAAOxC;YACT,OAAO;oBACS;gBAAde,eAAc,iBAAA,AAACkB,OAA+BQ,MAAM,YAAtC,iBAA0C;YAC1D;QACF;QAEA,IAAI5G,WAAW;QACf,IAAI,CAACyE,OAAO;YACV,MAAM7I,YAAY;gBAAC8G;aAAI,EAAE;gBACvBmE,MAAM;gBACNjG,OAAO;gBACPkG,MAAMrM,wBAAwBiK;gBAC9BqC,MAAM7H,iBAAiB0F,cAAcxF;gBACrCpB;eACI4G,eAAe;gBAAEzF,QAAQyF;YAAa,IAAI,CAAC;YAEjD5E,WAAW;QACb;QAEA,MAAM6C,UAAUmE,GAAG,CACjB;YACErH;YACA4C,SAAS;gBACP,CAACG,IAAI,EAAE;oBAAEuE,MAAMvH;mBAAUgF;oBAAQ1E;oBAAUC;;YAC7C;YACAiH,WAAW3L,cAAcqB,SAAS,CAACuK,UAAU,CAACC,eAAe;QAC/D,GACA;YAAEnB,OAAO;QAAK;QAEhBtB,IAAI3E,QAAQ,GAAGA;QACf2E,IAAI1E,OAAO,GAAGA;QACd,IAAIiF,aAAaP,IAAIO,WAAW,GAAGA;QACnC,IAAIlF,UAAUmE,OAAOnE,QAAQ,IAAI;QACjC,IAAIC,SAASkE,OAAOlE,OAAO,IAAI;IACjC;IACA,OAAOkE;AACT;AAEA,OAAO,eAAekD,oBAAoBC,OAAgB;IACxD,MAAM,EAAEC,MAAM,EAAET,IAAI,EAAEU,SAASC,UAAU,EAAEtJ,KAAK,EAAE,GAAG,MAAMlE,qBAAqBqN;IAChF,MAAME,UAAUC;IAChB,IAAIF,WAAW,UAAUA,WAAW,OAAO;QACzC,OAAOG,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAqB,GAAG;YAAEC,QAAQ;QAAI;IACtE;IACA,IAAI,CAACvK,QAAQD,GAAG,CAACyK,WAAW,EAAE;QAC5B,OAAOJ,SAASC,IAAI,CAClB;YAAEC,OAAO;QAAkD,GAC3D;YAAEC,QAAQ;QAAI;IAElB;IACA,IAAI,CAAC3L,iBAAiBsL,UAAU;QAC9B,OAAOE,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAkB,GAAG;YAAEC,QAAQ;QAAI;IACnE;IACA,uEAAuE;IACvE,oEAAoE;IACpE,iDAAiD;IACjD,MAAMjI,SAASzD,aAAa;QAAEoL;QAAQT;QAAM3I;IAAM;IAClD,wEAAwE;IACxE,yDAAyD;IACzD,IAAIoJ,WAAW,QAAQ,MAAM9K,eAAeI;IAE5C,IAAI;;YAwE6CkL;QAvE/C,MAAMnL,YAAYrB,cAAcoB,GAAG,GAAGC,SAAS;QAC/C,MAAM8C,QAAQsI,KAAKC,GAAG;QACtB,MAAM3I,MAAoB;YACxB1C;YACA8C;YACAC,KAAKzE,UAAUwE;YACf9B,UAAUR;YACVwC;YACAS,YAAY,MAAM7E;YAClBkI,QAAQnH;QACV;QAEA,0EAA0E;QAC1E,wEAAwE;QACxE,wDAAwD;QACxD,MAAM2L,iBAAiBnH,OAAQ+F,wBAAD,AAACA,KAA0CrI,KAAK;QAC9E,MAAM0J,WACJpH,OAAOqH,QAAQ,CAACF,mBAAmBA,iBAAiB,IAChDG,KAAKC,GAAG,CAACD,KAAKE,KAAK,CAACL,iBAAiBpL,wBACrCA;QACN,MAAM0L,YAAa1B,wBAAD,AAACA,KAA2C5I,MAAM;QACpE,MAAMA,SACJ,OAAOsK,cAAc,YAAYA,UAAUzJ,MAAM,GAAG,KAAK,CAACyJ,UAAUnD,QAAQ,CAAC,OACzEmD,YACA;QACN,IAAIC,WAAW7L,UACZwB,UAAU,CAAC,QACXE,OAAO,CAAC/C,cAAcqB,SAAS,CAAC2B,SAAS,CAACC,UAAU,IACpDC,KAAK,CAAC0J,WAAW;QACpB,IAAIjK,QAAQuK,WAAWA,SAAS/J,UAAU,CAAC9B,UAAUwB,UAAU,CAAC,QAAQO,GAAG,CAACT;QAC5E,MAAMU,OAAO,MAAM6J,SAAS5J,GAAG;QAC/B,MAAM6J,UAAU9J,KAAKX,IAAI,CAACc,MAAM,GAAGoJ;QACnC,MAAMJ,UAAUW,UAAU9J,KAAKX,IAAI,CAAC0K,KAAK,CAAC,GAAGR,YAAYvJ,KAAKX,IAAI;QAElE,MAAM2K,OAAkC,CAAC;QACzC,MAAMC,WAAmC,CAAC;QAC1C,IAAI9I,UAAU;QACd,IAAIC,WAAW;QACf,IAAIC,UAAU;QACd,IAAI0G,WAAW;QACf,KAAK,MAAMpH,UAAUwI,QAAS;YAC5B,IAAI;gBACF,MAAM5D,SAAS,MAAM9E,UAAUC,KAAKC;gBACpCqJ,IAAI,CAACrJ,OAAON,EAAE,CAAC,GAAGkF;gBAClBpE,WAAWoE,OAAOpE,OAAO;gBACzBC,YAAYmE,OAAOnE,QAAQ;gBAC3BC,WAAWkE,OAAOlE,OAAO;gBACzB,IAAIkE,OAAOwC,QAAQ,EAAE;oBACnBA,WAAW;oBACX;gBACF;YACF,EAAE,OAAOiB,OAAO;;gBACd/J,QAAQ+J,KAAK,CAAC,qCAAqCrI,OAAON,EAAE,EAAE2I;gBAC9DiB,QAAQ,CAACtJ,OAAON,EAAE,CAAC,YAAI2I,yBAAD,AAACA,MAAiBkB,OAAO,oBAAI;YACrD;QACF;QACA,MAAMC,SAASC,OAAOhG,IAAI,CAAC6F;QAC3B,OAAOnB,SAASC,IAAI,CAClB;YACEhI,KAAKL,IAAIK,GAAG;YACZ/B,UAAU0B,IAAI1B,QAAQ;YACtBgC;YACAqJ,OAAOlB,QAAQhJ,MAAM;YACrBgB;YACAC;YACAC;YACA2I;WACIjC,WAAW;YAAEA,UAAU;QAAK,IAAI,CAAC,GACjCoC,OAAOhK,MAAM,GAAG;YAAE8J;QAAS,IAAI,CAAC;YACpC,iEAAiE;YACjE,8DAA8D;YAC9DK,YAAYvC,YAAY,CAAC+B,UAAU,gBAAQX,YAAAA,OAAO,CAACA,QAAQhJ,MAAM,GAAG,EAAE,qBAA3BgJ,UAA6B9I,EAAE,mBAAI;YAC9EkK,MAAMxC,YAAY,CAAC+B;YAErB,uEAAuE;QACvE,sDAAsD;QACtD;YAAEb,QAAQkB,OAAOhK,MAAM,GAAG,MAAM;QAAI;IAExC,EAAE,OAAO6I,OAAO;QACd/J,QAAQ+J,KAAK,CAAC,iCAAiCA;QAC/C,OAAOF,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAwB,GAAG;YAAEC,QAAQ;QAAI;IACzE;AACF"}

package/src/lib/server/export-route.d.ts

@@ -0,0 +1,60 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** Header naming the row count the server undertook to send. */
+export declare const EXPORT_ROWS_HEADER = "X-Aglyn-Export-Rows";
+/**
+ * THE WHOLE COLLECTION, STREAMED (AGL-2662).
+ *
+ * ## What this fixes
+ *
+ * Every CRM export until now wrote the rows the LIST had loaded — a
+ * `limit(1000)` window for contacts, a `limit(200)` view for tasks — and
+ * called the file `contacts.csv`. A merchant with 40,000 contacts got 1,000
+ * of them and nothing on screen or in the file said so. `docs/bulk-actions.md`
+ * said it in prose, which is not where somebody opening a spreadsheet looks.
+ * This is the same file over every row there is, and it carries
+ * `X-Aglyn-Export-Rows` so the client can prove what it received is whole —
+ * a stream that dies halfway yields a perfectly well-formed shorter file, and
+ * nothing about the bytes says they are short.
+ *
+ * ## Why it is a route and not a bigger client read
+ *
+ * A browser cannot hold an unbounded collection, and the tier that most
+ * needs a complete export is the tier with the most rows. Cursor-paged and
+ * streamed, completeness costs neither a hang nor a buffer.
+ *
+ * ## The columns are the client's columns
+ *
+ * `crmExportHeader` and `crmExportCells` (`model/crm-csv.ts`) are the
+ * writers each section's Export button uses. One feature, one file format.
+ *
+ * ## The order is by document id, deliberately
+ *
+ * Firestore DROPS every document missing the ordered field, so ordering by
+ * `updatedAt` or `dueAtMs` would silently omit rows written before that
+ * field existed — the exact silent loss an export must not have. A document
+ * id is on every document and is a total order.
+ *
+ * ## Scope is enforced here, because nothing else can
+ *
+ * The Admin SDK bypasses the rules, so `memberScopeTokens` IS the
+ * enforcement: an org-wide member reads every row, and a scoped
+ * collaborator's query carries their own tokens as the `array-contains-any`
+ * the rules would have evaluated. Leads are host data by path, so the
+ * equivalent check is whether the caller reaches the site.
+ */
+export declare function crmExportRoute(request: Request): Promise<Response>;

package/src/lib/server/export-route.js

@@ -0,0 +1,447 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { checkEntitlement, consentGroupForHost, CRM_COLLECTIONS, csvCell, hostScopeToken, isOrgWideMember, MAX_SCOPE_HOSTS, memberCanSee, memberScopeTokens, scopeTokensForHost, planLabelGrantingFeature, pluginRequestFromWeb } from "@aglyn/aglyn/server";
+import { emailUnverifiedResponse, firebaseAdmin, isImpersonationSession, isServerReleaseFlagOnForOrg, lockdownRefusal, memberHasOrgPermission, resolveOrgMembership } from "@aglyn/tenant-data-admin";
+import { FieldPath, FieldValue } from "firebase-admin/firestore";
+import { addAdminAudit } from "@aglyn/tenant-data-admin/server/admin-audit-write";
+import { invalidIdTokenResponse } from "@aglyn/tenant-data-admin/server/id-token-refusal";
+import { contactCsvRowFromDoc, crmExportCells, crmExportHeader, isCrmExportResource } from "../model/crm-csv.js";
+import { contactPrimaryGroup } from "../model/contact-holder.js";
+/**
+ * Documents read per round trip. Not a cap — the stream keeps paging until
+ * the collection is exhausted. It bounds what is held at once, which is the
+ * only thing a page size should ever bound.
+ */ const PAGE_SIZE = 500;
+/** Sites read per page when the leads file spans an organization. */ const HOST_PAGE = 100;
+/**
+ * The most sites one organization-level leads file reads from.
+ *
+ * A ceiling rather than an unbounded sweep, and it is REPORTED: the file's
+ * row header counts only what was read, so a short file is provably short
+ * rather than quietly partial.
+ */ const HOST_CEILING = 200;
+/** The most linked records a tasks file resolves names for before writing ids. */ const NAME_CACHE_CEILING = 2000;
+/** Header naming the row count the server undertook to send. */ export const EXPORT_ROWS_HEADER = 'X-Aglyn-Export-Rows';
+const json = (body, status)=>Response.json(body, {
+        status
+    });
+/** Which collection under the org root each resource is, bar leads. */ const ORG_COLLECTION = {
+    contacts: 'contacts',
+    companies: CRM_COLLECTIONS.companies,
+    deals: CRM_COLLECTIONS.deals,
+    tasks: CRM_COLLECTIONS.tasks
+};
+/** The file's name, before the date stamp. */ const FILE_BASE = {
+    contacts: 'contacts',
+    companies: 'companies',
+    deals: 'deals',
+    tasks: 'tasks',
+    leads: 'leads'
+};
+/**
+ * THE WHOLE COLLECTION, STREAMED (AGL-2662).
+ *
+ * ## What this fixes
+ *
+ * Every CRM export until now wrote the rows the LIST had loaded — a
+ * `limit(1000)` window for contacts, a `limit(200)` view for tasks — and
+ * called the file `contacts.csv`. A merchant with 40,000 contacts got 1,000
+ * of them and nothing on screen or in the file said so. `docs/bulk-actions.md`
+ * said it in prose, which is not where somebody opening a spreadsheet looks.
+ * This is the same file over every row there is, and it carries
+ * `X-Aglyn-Export-Rows` so the client can prove what it received is whole —
+ * a stream that dies halfway yields a perfectly well-formed shorter file, and
+ * nothing about the bytes says they are short.
+ *
+ * ## Why it is a route and not a bigger client read
+ *
+ * A browser cannot hold an unbounded collection, and the tier that most
+ * needs a complete export is the tier with the most rows. Cursor-paged and
+ * streamed, completeness costs neither a hang nor a buffer.
+ *
+ * ## The columns are the client's columns
+ *
+ * `crmExportHeader` and `crmExportCells` (`model/crm-csv.ts`) are the
+ * writers each section's Export button uses. One feature, one file format.
+ *
+ * ## The order is by document id, deliberately
+ *
+ * Firestore DROPS every document missing the ordered field, so ordering by
+ * `updatedAt` or `dueAtMs` would silently omit rows written before that
+ * field existed — the exact silent loss an export must not have. A document
+ * id is on every document and is a total order.
+ *
+ * ## Scope is enforced here, because nothing else can
+ *
+ * The Admin SDK bypasses the rules, so `memberScopeTokens` IS the
+ * enforcement: an org-wide member reads every row, and a scoped
+ * collaborator's query carries their own tokens as the `array-contains-any`
+ * the rules would have evaluated. Leads are host data by path, so the
+ * equivalent check is whether the caller reaches the site.
+ */ export async function crmExportRoute(request) {
+    var _headers_authorization, _ref, _ref1, _ref2;
+    const { method, query, headers: rawHeaders } = await pluginRequestFromWeb(request);
+    const headers = rawHeaders;
+    if (method !== 'GET') return json({
+        error: 'Method not allowed'
+    }, 405);
+    const authorization = (_headers_authorization = headers.authorization) != null ? _headers_authorization : '';
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return json({
+        error: 'Unauthenticated'
+    }, 401);
+    const orgId = String((_ref = query == null ? void 0 : query['orgId']) != null ? _ref : '');
+    const resource = String((_ref1 = query == null ? void 0 : query['resource']) != null ? _ref1 : '');
+    const hostId = String((_ref2 = query == null ? void 0 : query['hostId']) != null ? _ref2 : '');
+    if (!orgId || !isCrmExportResource(resource)) {
+        return json({
+            error: 'Missing orgId or resource'
+        }, 400);
+    }
+    try {
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        if (!decoded.email_verified && !isImpersonationSession(decoded)) {
+            return emailUnverifiedResponse();
+        }
+        const staff = decoded['staff'] === true;
+        const membership = await resolveOrgMembership(decoded.uid, orgId);
+        const member = membership == null ? void 0 : membership.member;
+        if (!member && !staff) return json({
+            error: 'Not found'
+        }, 404);
+        /*
+     * THE PEOPLE FILES ARE EVERY WORKSPACE'S (AGL-2839, AGL-2851).
+     *
+     * Exporting the contacts and leads a workspace holds is an obligation,
+     * not a CRM feature — a Free workspace takes them from its Privacy
+     * settings — so neither the release flag nor the plan is asked of those
+     * two. The CRM's own records, companies, deals and tasks, are asked
+     * both: the flag here, and the plan once the org has been read.
+     */ const peopleFile = resource === 'contacts' || resource === 'leads';
+        if (!peopleFile && !staff && !await isServerReleaseFlagOnForOrg('release_crm', orgId)) {
+            return json({
+                error: 'Not available'
+            }, 404);
+        }
+        // The permission the CRM's own rules read for. Reading is not writing,
+        // but these records ARE the audience: `data.manage` is what admits a
+        // person to the list this file copies.
+        if (!staff && !await memberHasOrgPermission(orgId, member, 'data.manage')) {
+            return json({
+                error: 'Not found'
+            }, 404);
+        }
+        const firestore = firebaseAdmin.app().firestore();
+        const orgRef = firestore.collection('orgs').doc(orgId);
+        const orgSnapshot = await orgRef.get();
+        if (!orgSnapshot.exists) return json({
+            error: 'Unknown organization'
+        }, 404);
+        const org = orgSnapshot.data();
+        const locked = await lockdownRefusal({
+            request,
+            staff,
+            uid: decoded.uid,
+            org
+        });
+        if (locked) return locked;
+        // The CRM's own records on a plan without the CRM, staff included: the
+        // refusal every `crm/*` route gives, after the caller is known.
+        if (!peopleFile && !checkEntitlement(org, 'crm')) {
+            const plan = planLabelGrantingFeature('crm');
+            return json({
+                error: `Exporting ${resource} is part of the CRM, which is not included in ` + 'your current plan. Manage your plan and add-ons from Billing.' + (plan ? ` Included from ${plan}.` : ''),
+                reason: 'plan_required',
+                code: 'crm'
+            }, 403);
+        }
+        const orgWide = staff || isOrgWideMember(member);
+        // `array-contains-any` takes at most thirty values, which is also the
+        // widest a consent group can be — a reader past that is the org-wide
+        // case and never reaches here.
+        const tokens = memberScopeTokens(member).slice(0, MAX_SCOPE_HOSTS);
+        if (!orgWide && !tokens.length) return json({
+            error: 'Not found'
+        }, 404);
+        /* The roster, once, so every owner and assignee cell is an address. */ const ownerEmails = new Map();
+        for (const entry of (await orgRef.collection('members').get()).docs){
+            var _ref3;
+            var _entry_data;
+            const email = String((_ref3 = (_entry_data = entry.data()) == null ? void 0 : _entry_data['email']) != null ? _ref3 : '');
+            if (email) ownerEmails.set(entry.id, email);
+        }
+        const ownerEmail = (uid)=>{
+            var _ownerEmails_get;
+            return (_ownerEmails_get = ownerEmails.get(uid)) != null ? _ownerEmails_get : uid;
+        };
+        const options = {
+            ownerEmail,
+            assigneeEmail: ownerEmail
+        };
+        if (resource === 'contacts') {
+            /*
+       * A contact's fields live in one holder's FACET, so the file has to
+       * say which. Under a site that is the site's own group, for every
+       * row; at the organization level it is each row's PRIMARY holder —
+       * the same answer the org-level Contacts list flattens by, so the
+       * file and the table read one profile per person. What a file must
+       * never do is read the top of the document, which is where the
+       * pre-facet migration left one holder's fields.
+       */ if (!hostId && !orgWide) return json({
+                error: 'Missing hostId'
+            }, 400);
+            const fields = await orgRef.collection(CRM_COLLECTIONS.contactFields).get();
+            options.customFields = fields.docs.map((entry)=>{
+                var _ref, _ref1;
+                var _entry_data, _entry_data1, _entry_data2;
+                return {
+                    key: String((_ref = (_entry_data = entry.data()) == null ? void 0 : _entry_data['key']) != null ? _ref : entry.id),
+                    label: String((_ref1 = (_entry_data1 = entry.data()) == null ? void 0 : _entry_data1['label']) != null ? _ref1 : entry.id),
+                    archivedAt: (_entry_data2 = entry.data()) == null ? void 0 : _entry_data2['archivedAt']
+                };
+            }).filter((field)=>!field.archivedAt).map(({ key, label })=>({
+                    key,
+                    label
+                }));
+        }
+        if (resource === 'deals') {
+            const pipelines = await orgRef.collection(CRM_COLLECTIONS.pipelines).get();
+            const names = new Map();
+            const stages = new Map();
+            for (const entry of pipelines.docs){
+                var _entry_data1, _data_name, _data_stages;
+                const data = (_entry_data1 = entry.data()) != null ? _entry_data1 : {};
+                names.set(entry.id, String((_data_name = data['name']) != null ? _data_name : entry.id));
+                for (const stage of (_data_stages = data['stages']) != null ? _data_stages : []){
+                    var _ref4;
+                    const stageId = String((_ref4 = stage == null ? void 0 : stage['id']) != null ? _ref4 : '');
+                    if (stageId) {
+                        var _ref5;
+                        stages.set(`${entry.id}/${stageId}`, String((_ref5 = stage == null ? void 0 : stage['name']) != null ? _ref5 : stageId));
+                    }
+                }
+            }
+            options.pipelineName = (id)=>names.get(id);
+            options.stageName = (pipelineId, stageId)=>stages.get(`${pipelineId}/${stageId}`);
+        }
+        /*
+     * A task names its contact, company and deal by ID, and a spreadsheet
+     * cannot read one. The list resolves them from rows it already holds;
+     * the server looks them up as it meets them — batched per page,
+     * remembered, and capped, so a tasks file costs reads in proportion to
+     * the records it actually references rather than to the org. Past the
+     * cap the id is written, which is the documented degradation everywhere
+     * else in these files.
+     */ const recordNames = new Map();
+        const resolveNames = async (wanted)=>{
+            const missing = wanted.filter((entry)=>entry.id && !recordNames.has(`${entry.kind}:${entry.id}`) && recordNames.size < NAME_CACHE_CEILING);
+            if (!missing.length) return;
+            const refs = missing.map((entry)=>orgRef.collection(entry.kind === 'contact' ? 'contacts' : entry.kind === 'company' ? CRM_COLLECTIONS.companies : CRM_COLLECTIONS.deals).doc(entry.id));
+            const snapshots = await firestore.getAll(...refs);
+            snapshots.forEach((snapshot, index)=>{
+                var _snapshot_data, _data_title, _ref, _data_name;
+                const entry = missing[index];
+                const data = (_snapshot_data = snapshot.data()) != null ? _snapshot_data : {};
+                const name = entry.kind === 'deal' ? String((_data_title = data['title']) != null ? _data_title : '') : String((_ref = (_data_name = data['name']) != null ? _data_name : data['email']) != null ? _ref : '');
+                recordNames.set(`${entry.kind}:${entry.id}`, name || entry.id);
+            });
+        };
+        if (resource === 'tasks') {
+            options.recordName = (kind, id)=>recordNames.get(`${kind}:${id}`);
+        }
+        /*
+     * LEADS ARE HOST DATA BY PATH. Under one site the file is that site's;
+     * with no site named, an org-wide member takes every site's leads in one
+     * file with a `Site` column — the same file the organization-level Leads
+     * list writes. A scoped collaborator must name a site they reach.
+     */ const siteNames = new Map();
+        let leadHostIds = [];
+        if (resource === 'leads') {
+            if (hostId) {
+                if (!orgWide && !memberCanSee(member, [
+                    hostScopeToken(hostId)
+                ])) {
+                    return json({
+                        error: 'Not found'
+                    }, 404);
+                }
+                leadHostIds = [
+                    hostId
+                ];
+            } else {
+                if (!orgWide) return json({
+                    error: 'Missing hostId'
+                }, 400);
+                let cursor = null;
+                for(;;){
+                    let page = firestore.collection('hosts').where('orgId', '==', orgId).orderBy(FieldPath.documentId()).limit(HOST_PAGE);
+                    if (cursor) page = page.startAfter(firestore.collection('hosts').doc(cursor));
+                    const snapshot = await page.get();
+                    for (const entry of snapshot.docs){
+                        var _ref6, _ref7;
+                        var _entry_data2, _entry_data3;
+                        leadHostIds.push(entry.id);
+                        siteNames.set(entry.id, String((_ref6 = (_ref7 = (_entry_data2 = entry.data()) == null ? void 0 : _entry_data2['displayName']) != null ? _ref7 : (_entry_data3 = entry.data()) == null ? void 0 : _entry_data3['subdomain']) != null ? _ref6 : entry.id));
+                    }
+                    if (snapshot.docs.length < HOST_PAGE) break;
+                    if (leadHostIds.length >= HOST_CEILING) break;
+                    cursor = snapshot.docs[snapshot.docs.length - 1].id;
+                }
+                options.siteName = (id)=>siteNames.get(id);
+            }
+        }
+        /** One resource's rows, as a query per collection the file spans. */ const sources = resource === 'leads' ? leadHostIds.map((id)=>({
+                hostId: id,
+                /*
+             * The org collection, narrowed per SITE (AGL-3275).
+             *
+             * One source per site is still right — the file names the site a
+             * row came from — but a site's leads are selected by `visibleTo`
+             * now rather than by the collection's parent, so the narrowing
+             * moves onto the reference itself. It cannot use the `scoped`
+             * flag below: that applies the MEMBER's tokens, and here each
+             * source needs the tokens of its own site.
+             */ reference: orgRef.collection('leads').where('visibleTo', 'array-contains-any', scopeTokensForHost(id)),
+                scoped: false
+            })) : [
+            {
+                hostId: '',
+                reference: orgRef.collection(ORG_COLLECTION[resource]),
+                scoped: !orgWide
+            }
+        ];
+        // Taken BEFORE the first page, so it describes the collections the
+        // export started from. A `count()` aggregate bills one read per 1,000
+        // documents — cheap next to the export it is describing, and the only
+        // way the client can tell a complete file from a truncated one.
+        let total = 0;
+        for (const source of sources){
+            var _data_count;
+            const counted = source.scoped ? source.reference.where('visibleTo', 'array-contains-any', tokens) : source.reference;
+            total += Number((_data_count = (await counted.count().get()).data().count) != null ? _data_count : 0);
+        }
+        /** The holder one contact is written through, resolved per level. */ const holderFor = (document)=>{
+            const group = hostId ? consentGroupForHost(org, hostId) : contactPrimaryGroup(document, org);
+            return {
+                groupId: group.groupId,
+                hostIds: group.hostIds
+            };
+        };
+        const encoder = new TextEncoder();
+        const encode = (text)=>encoder.encode(text);
+        const line = (cells)=>cells.map(csvCell).join(',');
+        let sourceIndex = 0;
+        let cursor = null;
+        let phase = 'head';
+        const stream = new ReadableStream({
+            async pull (controller) {
+                try {
+                    if (phase === 'head') {
+                        phase = sources.length ? 'body' : 'tail';
+                        controller.enqueue(encode(line(crmExportHeader(resource, options))));
+                        return;
+                    }
+                    if (phase === 'body') {
+                        var _snapshot_docs_;
+                        const source = sources[sourceIndex];
+                        let page = source.reference;
+                        if (source.scoped) {
+                            page = page.where('visibleTo', 'array-contains-any', tokens);
+                        }
+                        page = page.orderBy(FieldPath.documentId()).limit(PAGE_SIZE);
+                        if (cursor) page = page.startAfter(cursor);
+                        const snapshot = await page.get();
+                        const exhausted = snapshot.docs.length < PAGE_SIZE;
+                        cursor = exhausted ? null : (_snapshot_docs_ = snapshot.docs[snapshot.docs.length - 1]) != null ? _snapshot_docs_ : null;
+                        if (exhausted) {
+                            sourceIndex += 1;
+                            if (sourceIndex >= sources.length) phase = 'tail';
+                        }
+                        if (!snapshot.empty) {
+                            const documents = snapshot.docs.map((entry)=>{
+                                var _entry_data;
+                                return _extends({}, (_entry_data = entry.data()) != null ? _entry_data : {}, {
+                                    $id: entry.id
+                                }, source.hostId ? {
+                                    hostId: source.hostId
+                                } : {});
+                            });
+                            if (resource === 'tasks') {
+                                await resolveNames(documents.flatMap((document)=>[
+                                        'contact',
+                                        'company',
+                                        'deal'
+                                    ].map((kind)=>{
+                                        var _document_;
+                                        return {
+                                            kind,
+                                            id: String((_document_ = document[kind === 'contact' ? 'contactId' : kind === 'company' ? 'companyId' : 'dealId']) != null ? _document_ : '')
+                                        };
+                                    })));
+                            }
+                            const lines = documents.map((document)=>line(crmExportCells(resource, resource === 'contacts' ? contactCsvRowFromDoc(document, holderFor(document)) : document, options)));
+                            controller.enqueue(encode(`\n${lines.join('\n')}`));
+                            return;
+                        }
+                        if (phase === 'body') return;
+                    }
+                    controller.enqueue(encode('\n'));
+                    controller.close();
+                } catch (error) {
+                    // Erroring the stream truncates the download rather than
+                    // completing it short — a half-written file the browser reports
+                    // as a failed transfer, not a quiet partial handover.
+                    controller.error(error);
+                }
+            }
+        });
+        // Ids and counts only, never content: a full copy of an audience
+        // leaving the platform is worth a row; who was in it is not ours to log.
+        void addAdminAudit(firestore, {
+            actorUid: decoded.uid,
+            action: 'crm.exported',
+            target: `orgs/${orgId}/${resource}`,
+            before: null,
+            after: {
+                resource,
+                rows: total,
+                hostId: hostId || null
+            },
+            at: FieldValue.serverTimestamp()
+        }).catch(()=>undefined);
+        const stamp = new Date().toISOString().slice(0, 10);
+        return new Response(stream, {
+            status: 200,
+            headers: {
+                'Content-Type': 'text/csv; charset=utf-8',
+                'Content-Disposition': `attachment; filename="${FILE_BASE[resource]}-${stamp}.csv"`,
+                [EXPORT_ROWS_HEADER]: String(total),
+                'Cache-Control': 'no-store, private'
+            }
+        });
+    } catch (error) {
+        // A refused credential is a 401, not a fault of ours (AGL-1993). Null
+        // for anything else, so a real failure keeps the answer below.
+        const unauthenticated = invalidIdTokenResponse(error);
+        if (unauthenticated) return unauthenticated;
+        return json({
+            error: 'Export failed'
+        }, 500);
+    }
+}
+
+//# sourceMappingURL=export-route.js.map