@aglyn/plugins-crm 1.0.0-beta.217 → 1.0.0-beta.219

package/src/lib/server/merge-contacts.js

@@ -0,0 +1,274 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * MERGING TWO CONTACTS — the write (AGL-2625).
+ *
+ * `planContactMerge` says what the survivor becomes; this performs it, and
+ * moves everything that pointed at the merged record. One function behind
+ * two doors — the console's `crm/contacts-merge` route and
+ * `POST /v1/contacts/{id}/merge` — so the REST caller and the record page
+ * cannot merge two different ways.
+ *
+ * ## The order is the crash-safety argument
+ *
+ *  1. Every deal, task and activity naming the merged contact is repointed
+ *     at the survivor, and every lead converted into it. Batched, bounded,
+ *     idempotent: a re-run finds nothing left to move.
+ *  2. Then, in ONE transaction: the survivor takes the plan, every address
+ *     it now answers to is indexed at it, and the merged document is
+ *     deleted — with both records re-read inside the transaction, so two
+ *     merges racing on one pair cannot both succeed and a plan is never
+ *     computed on a document that changed under it.
+ *
+ * Children first because a process that dies between the two steps leaves
+ * children pointing at a record that EXISTS — the survivor — while the merged
+ * document is still there for a retry to fold in. The other order would
+ * leave deals pointing at a deleted contact, which is a record nobody can
+ * open from anywhere.
+ *
+ * ## What it does not move
+ *
+ * List memberships, suppression entries and the delivery log are keyed by
+ * ADDRESS, not by contact id, and stay under the merged address; a capture
+ * on that address resolves to the survivor through the index, which is the
+ * fact those keys need. A company's contacts count drops only for a company
+ * both records named — the survivor still names the rest.
+ */ import { CONTACT_EMAIL_INDEX_COLLECTION, contactEmails } from "@aglyn/aglyn/app-utils/contacts";
+import { planContactMerge } from "../model/contact-merge.js";
+import { CRM_COLLECTIONS } from "@aglyn/aglyn/app-utils/crm";
+import { personKey } from "@aglyn/aglyn/app-utils/person-key";
+import { FieldValue } from "firebase-admin/firestore";
+import { settleCompanyContactsCounts } from "@aglyn/tenant-data-admin/server/contact-company-link";
+import { recomputeCrmNextTaskAt } from "@aglyn/tenant-data-admin/server/crm-next-activity";
+import { restampCrmListFieldsAt } from "@aglyn/tenant-data-admin/server/crm-records";
+import { logHostActivity } from "@aglyn/tenant-data-admin/server/organizations";
+/** How many pointing rows one repoint pass reads — and one batch writes. */ const REPOINT_PAGE = 400;
+/** A ceiling on passes, so a query that keeps answering cannot loop forever. */ const REPOINT_PASSES = 25;
+/**
+ * Point every row of `collection` whose `contactId` is `from` at `to`.
+ *
+ * Page, batch, repeat: each pass reads the rows still pointing at the
+ * merged record — the ones a previous pass moved no longer match — so the
+ * loop ends when a pass finds nothing. `updatedAt` moves with the pointer
+ * because an integration syncing by `updatedAfter` has to see the change.
+ */ async function repointContactId(firestore, collection, from, to) {
+    let moved = 0;
+    for(let pass = 0; pass < REPOINT_PASSES; pass += 1){
+        const page = await collection.where('contactId', '==', from).limit(REPOINT_PAGE).get();
+        if (page.empty) break;
+        const batch = firestore.batch();
+        for (const row of page.docs){
+            batch.update(row.ref, {
+                contactId: to,
+                updatedAt: FieldValue.serverTimestamp()
+            });
+        }
+        await batch.commit();
+        moved += page.size;
+        if (page.size < REPOINT_PAGE) break;
+    }
+    return moved;
+}
+/**
+ * The leads converted into the merged contact, restamped at the survivor.
+ *
+ * A lead lives at `orgs/{orgId}/leads/{personKey(email)}` (AGL-3275), so there
+ * is still no query — one document per address, asked for directly. This used
+ * to be bounded by sites TIMES addresses because a lead lived under each site;
+ * it is bounded by addresses now, and the sites drop out of the signature
+ * because the collection no longer has one per site to walk.
+ */ async function repointLeads(orgRef, emails, from, to) {
+    let moved = 0;
+    /*
+   * ONE ROW PER ADDRESS, on the org (AGL-3275). This walked the sites because
+   * there was a lead under each of them; re-pointing the same document once
+   * per site would now be the same write repeated, and the second would find
+   * `convertedContactId` already moved and skip — a silent undercount rather
+   * than a wrong answer, but an undercount the caller reports to the operator.
+   */ for (const email of emails){
+        const key = personKey(email);
+        if (!key) continue;
+        const leadRef = orgRef.collection('leads').doc(key);
+        const lead = await leadRef.get();
+        if (!lead.exists || lead.get('convertedContactId') !== from) continue;
+        await leadRef.update({
+            convertedContactId: to,
+            updatedAt: FieldValue.serverTimestamp()
+        });
+        moved += 1;
+    }
+    return moved;
+}
+export async function mergeContacts(options) {
+    var _mergedBefore_data, _survivorBefore_data, _contactEmails_, _plan_emails_;
+    const { firestore, orgRef, survivorId, mergedId, actor, hostId } = options;
+    if (!survivorId || !mergedId || survivorId === mergedId) {
+        return {
+            ok: false,
+            reason: 'same-record'
+        };
+    }
+    const contactsRef = orgRef.collection('contacts');
+    const survivorRef = contactsRef.doc(survivorId);
+    const mergedRef = contactsRef.doc(mergedId);
+    const [survivorBefore, mergedBefore] = await Promise.all([
+        survivorRef.get(),
+        mergedRef.get()
+    ]);
+    if (!survivorBefore.exists) return {
+        ok: false,
+        reason: 'survivor-missing'
+    };
+    if (!mergedBefore.exists) return {
+        ok: false,
+        reason: 'merged-missing'
+    };
+    const mergedData = (_mergedBefore_data = mergedBefore.data()) != null ? _mergedBefore_data : {};
+    const survivorData = (_survivorBefore_data = survivorBefore.data()) != null ? _survivorBefore_data : {};
+    /*==========================================
+   * 1. THE CHILDREN — before the parent, for the reason the header gives.
+   *=========================================*/ const [deals, tasks, activities] = await Promise.all([
+        repointContactId(firestore, orgRef.collection(CRM_COLLECTIONS.deals), mergedId, survivorId),
+        repointContactId(firestore, orgRef.collection(CRM_COLLECTIONS.tasks), mergedId, survivorId),
+        repointContactId(firestore, orgRef.collection(CRM_COLLECTIONS.activities), mergedId, survivorId)
+    ]);
+    const leads = await repointLeads(orgRef, contactEmails(mergedData), mergedId, survivorId);
+    /*==========================================
+   * 2. THE SWAP — one transaction over both documents and the index.
+   *=========================================*/ const index = orgRef.collection(CONTACT_EMAIL_INDEX_COLLECTION);
+    const swapped = await firestore.runTransaction(async (transaction)=>{
+        var _survivor_data, _merged_data, _survivor_data1;
+        const [survivor, merged] = await Promise.all([
+            transaction.get(survivorRef),
+            transaction.get(mergedRef)
+        ]);
+        if (!survivor.exists) return {
+            reason: 'survivor-missing'
+        };
+        if (!merged.exists) return {
+            reason: 'merged-missing'
+        };
+        const plan = planContactMerge((_survivor_data = survivor.data()) != null ? _survivor_data : {}, (_merged_data = merged.data()) != null ? _merged_data : {});
+        transaction.set(survivorRef, _extends({}, plan.survivor, {
+            updatedAt: FieldValue.serverTimestamp()
+        }), {
+            merge: true
+        });
+        for (const email of plan.emails){
+            const key = personKey(email);
+            if (!key) continue;
+            transaction.set(index.doc(key), {
+                email,
+                contactId: survivorId,
+                updatedAt: FieldValue.serverTimestamp()
+            }, {
+                merge: true
+            });
+        }
+        transaction.delete(mergedRef);
+        return {
+            plan,
+            survivor: (_survivor_data1 = survivor.data()) != null ? _survivor_data1 : {}
+        };
+    });
+    if ('reason' in swapped) return {
+        ok: false,
+        reason: swapped.reason
+    };
+    const { plan } = swapped;
+    // The survivor now carries both records' addresses, holders and facets —
+    // what the Contacts list searches and filters by (AGL-3321).
+    await restampCrmListFieldsAt(survivorRef, 'contacts');
+    /*
+   * The companies both records named counted two people and now count one
+   * (AGL-2613). Settled after the swap the way the capture settles its
+   * counts: a figure that could not move is logged, and the company page's
+   * live aggregate corrects it.
+   */ await settleCompanyContactsCounts(orgRef.collection(CRM_COLLECTIONS.companies), {
+        companyId: null,
+        mirror: null,
+        counts: plan.companyCounts
+    });
+    /*
+   * The survivor now owns the merged record's open tasks too, so its next
+   * activity is the earliest of both (AGL-2661). Settled the same way: a
+   * figure that could not move is logged, and the Fields section's
+   * recompute corrects it.
+   */ await recomputeCrmNextTaskAt(firestore, orgRef.id, [
+        {
+            contactId: survivorId
+        }
+    ]).catch((error)=>{
+        console.error('contact merge next activity could not be recomputed', survivorId, error);
+    });
+    const mergedEmail = (_contactEmails_ = contactEmails(mergedData)[0]) != null ? _contactEmails_ : '';
+    const survivorEmail = (_plan_emails_ = plan.emails[0]) != null ? _plan_emails_ : '';
+    // The canonical name — the one identity every holder shares — for the
+    // feed; the address stands in for a person nobody has named.
+    const survivorName = typeof swapped.survivor['name'] === 'string' ? swapped.survivor['name'] : '';
+    /*
+   * THE TIMELINE NOTE, on the survivor: the merge is an event in this
+   * person's history, and the record page is where a reader looks for one.
+   * Filed under the calling site, or the survivor's first site for a door
+   * with none; its own catch, because a note that could not be written must
+   * not read as a merge that did not happen.
+   */ try {
+        var _survivorData_hostId;
+        await orgRef.collection(CRM_COLLECTIONS.activities).add(_extends({
+            kind: 'note',
+            body: `Merged with ${mergedEmail}`,
+            atMs: Date.now(),
+            byUid: actor.uid
+        }, options.actorName || actor.email ? {
+            byName: options.actorName || actor.email
+        } : {}, {
+            contactId: survivorId,
+            visibleTo: plan.visibleTo,
+            hostId: hostId != null ? hostId : String((_survivorData_hostId = survivorData['hostId']) != null ? _survivorData_hostId : ''),
+            createdByUid: actor.uid,
+            createdAt: FieldValue.serverTimestamp(),
+            updatedAt: FieldValue.serverTimestamp()
+        }));
+    } catch (error) {
+        console.error('[contact-merge] timeline note failed', survivorId, error);
+    }
+    // The audit line (AGL-2622), in the feed of the site whose console did
+    // the work. A door with no site — the API — has no host feed to write.
+    if (hostId) {
+        await logHostActivity(hostId, actor, `Merged with ${mergedEmail}`, {
+            type: 'contact',
+            id: survivorId,
+            name: survivorName || survivorEmail
+        });
+    }
+    return {
+        ok: true,
+        survivorId,
+        survivorEmail,
+        mergedId,
+        mergedEmail,
+        emails: plan.emails,
+        repointed: {
+            deals,
+            tasks,
+            activities,
+            leads
+        }
+    };
+}
+
+//# sourceMappingURL=merge-contacts.js.map

package/src/lib/server/merge-contacts.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/merge-contacts.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * MERGING TWO CONTACTS — the write (AGL-2625).\n *\n * `planContactMerge` says what the survivor becomes; this performs it, and\n * moves everything that pointed at the merged record. One function behind\n * two doors — the console's `crm/contacts-merge` route and\n * `POST /v1/contacts/{id}/merge` — so the REST caller and the record page\n * cannot merge two different ways.\n *\n * ## The order is the crash-safety argument\n *\n *  1. Every deal, task and activity naming the merged contact is repointed\n *     at the survivor, and every lead converted into it. Batched, bounded,\n *     idempotent: a re-run finds nothing left to move.\n *  2. Then, in ONE transaction: the survivor takes the plan, every address\n *     it now answers to is indexed at it, and the merged document is\n *     deleted — with both records re-read inside the transaction, so two\n *     merges racing on one pair cannot both succeed and a plan is never\n *     computed on a document that changed under it.\n *\n * Children first because a process that dies between the two steps leaves\n * children pointing at a record that EXISTS — the survivor — while the merged\n * document is still there for a retry to fold in. The other order would\n * leave deals pointing at a deleted contact, which is a record nobody can\n * open from anywhere.\n *\n * ## What it does not move\n *\n * List memberships, suppression entries and the delivery log are keyed by\n * ADDRESS, not by contact id, and stay under the merged address; a capture\n * on that address resolves to the survivor through the index, which is the\n * fact those keys need. A company's contacts count drops only for a company\n * both records named — the survivor still names the rest.\n */\n\nimport {\n  CONTACT_EMAIL_INDEX_COLLECTION,\n  contactEmails,\n} from '@aglyn/aglyn/app-utils/contacts'\nimport type { HostActivityActor } from '@aglyn/aglyn/app-utils/activity-presenter'\nimport { planContactMerge } from '../model/contact-merge'\nimport { CRM_COLLECTIONS } from '@aglyn/aglyn/app-utils/crm'\nimport { personKey } from '@aglyn/aglyn/app-utils/person-key'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { settleCompanyContactsCounts } from '@aglyn/tenant-data-admin/server/contact-company-link'\nimport { recomputeCrmNextTaskAt } from '@aglyn/tenant-data-admin/server/crm-next-activity'\nimport { restampCrmListFieldsAt } from '@aglyn/tenant-data-admin/server/crm-records'\nimport { logHostActivity } from '@aglyn/tenant-data-admin/server/organizations'\n\n/** How many pointing rows one repoint pass reads — and one batch writes. */\nconst REPOINT_PAGE = 400\n/** A ceiling on passes, so a query that keeps answering cannot loop forever. */\nconst REPOINT_PASSES = 25\n\nexport interface MergeContactsOptions {\n  firestore: FirebaseFirestore.Firestore\n  /** `orgs/{orgId}` — the org whose contacts both records are. */\n  orgRef: FirebaseFirestore.DocumentReference\n  /** The record that stays, and keeps its address as the identity. */\n  survivorId: string\n  /** The record folded in and deleted. */\n  mergedId: string\n  actor: HostActivityActor\n  /**\n   * The site whose console did the work: where the activity feed entry\n   * lands, and the site a timeline note is filed under. `null` for a door\n   * with no site — the REST API — which logs no host entry.\n   */\n  hostId: string | null\n  /** The actor's display name for the timeline note, when the door knows it. */\n  actorName?: string | null\n}\n\nexport interface MergeContactsRepointed {\n  deals: number\n  tasks: number\n  activities: number\n  leads: number\n}\n\nexport type MergeContactsResult =\n  | {\n      ok: true\n      survivorId: string\n      survivorEmail: string\n      mergedId: string\n      mergedEmail: string\n      /** Every address the survivor answers to now, primary first. */\n      emails: string[]\n      repointed: MergeContactsRepointed\n    }\n  | { ok: false; reason: 'same-record' | 'survivor-missing' | 'merged-missing' }\n\n/**\n * Point every row of `collection` whose `contactId` is `from` at `to`.\n *\n * Page, batch, repeat: each pass reads the rows still pointing at the\n * merged record — the ones a previous pass moved no longer match — so the\n * loop ends when a pass finds nothing. `updatedAt` moves with the pointer\n * because an integration syncing by `updatedAfter` has to see the change.\n */\nasync function repointContactId(\n  firestore: FirebaseFirestore.Firestore,\n  collection: FirebaseFirestore.CollectionReference,\n  from: string,\n  to: string,\n): Promise<number> {\n  let moved = 0\n  for (let pass = 0; pass < REPOINT_PASSES; pass += 1) {\n    const page = await collection\n      .where('contactId', '==', from)\n      .limit(REPOINT_PAGE)\n      .get()\n    if (page.empty) break\n    const batch = firestore.batch()\n    for (const row of page.docs) {\n      batch.update(row.ref, {\n        contactId: to,\n        updatedAt: FieldValue.serverTimestamp(),\n      })\n    }\n    await batch.commit()\n    moved += page.size\n    if (page.size < REPOINT_PAGE) break\n  }\n  return moved\n}\n\n/**\n * The leads converted into the merged contact, restamped at the survivor.\n *\n * A lead lives at `orgs/{orgId}/leads/{personKey(email)}` (AGL-3275), so there\n * is still no query — one document per address, asked for directly. This used\n * to be bounded by sites TIMES addresses because a lead lived under each site;\n * it is bounded by addresses now, and the sites drop out of the signature\n * because the collection no longer has one per site to walk.\n */\nasync function repointLeads(\n  orgRef: FirebaseFirestore.DocumentReference,\n  emails: readonly string[],\n  from: string,\n  to: string,\n): Promise<number> {\n  let moved = 0\n  /*\n   * ONE ROW PER ADDRESS, on the org (AGL-3275). This walked the sites because\n   * there was a lead under each of them; re-pointing the same document once\n   * per site would now be the same write repeated, and the second would find\n   * `convertedContactId` already moved and skip — a silent undercount rather\n   * than a wrong answer, but an undercount the caller reports to the operator.\n   */\n  for (const email of emails) {\n    const key = personKey(email)\n    if (!key) continue\n    const leadRef = orgRef.collection('leads').doc(key)\n    const lead = await leadRef.get()\n    if (!lead.exists || lead.get('convertedContactId') !== from) continue\n    await leadRef.update({\n      convertedContactId: to,\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n    moved += 1\n  }\n  return moved\n}\n\nexport async function mergeContacts(\n  options: MergeContactsOptions,\n): Promise<MergeContactsResult> {\n  const { firestore, orgRef, survivorId, mergedId, actor, hostId } = options\n  if (!survivorId || !mergedId || survivorId === mergedId) {\n    return { ok: false, reason: 'same-record' }\n  }\n  const contactsRef = orgRef.collection('contacts')\n  const survivorRef = contactsRef.doc(survivorId)\n  const mergedRef = contactsRef.doc(mergedId)\n  const [survivorBefore, mergedBefore] = await Promise.all([\n    survivorRef.get(),\n    mergedRef.get(),\n  ])\n  if (!survivorBefore.exists) return { ok: false, reason: 'survivor-missing' }\n  if (!mergedBefore.exists) return { ok: false, reason: 'merged-missing' }\n  const mergedData = (mergedBefore.data() ?? {}) as Record<string, unknown>\n  const survivorData = (survivorBefore.data() ?? {}) as Record<string, unknown>\n\n  /*==========================================\n   * 1. THE CHILDREN — before the parent, for the reason the header gives.\n   *=========================================*/\n  const [deals, tasks, activities] = await Promise.all([\n    repointContactId(firestore, orgRef.collection(CRM_COLLECTIONS.deals), mergedId, survivorId),\n    repointContactId(firestore, orgRef.collection(CRM_COLLECTIONS.tasks), mergedId, survivorId),\n    repointContactId(\n      firestore,\n      orgRef.collection(CRM_COLLECTIONS.activities),\n      mergedId,\n      survivorId,\n    ),\n  ])\n  const leads = await repointLeads(\n    orgRef,\n    contactEmails(mergedData),\n    mergedId,\n    survivorId,\n  )\n\n  /*==========================================\n   * 2. THE SWAP — one transaction over both documents and the index.\n   *=========================================*/\n  const index = orgRef.collection(CONTACT_EMAIL_INDEX_COLLECTION)\n  const swapped = await firestore.runTransaction(async (transaction) => {\n    const [survivor, merged] = await Promise.all([\n      transaction.get(survivorRef),\n      transaction.get(mergedRef),\n    ])\n    if (!survivor.exists) return { reason: 'survivor-missing' as const }\n    if (!merged.exists) return { reason: 'merged-missing' as const }\n    const plan = planContactMerge(\n      (survivor.data() ?? {}) as Record<string, unknown>,\n      (merged.data() ?? {}) as Record<string, unknown>,\n    )\n    transaction.set(\n      survivorRef,\n      { ...plan.survivor, updatedAt: FieldValue.serverTimestamp() },\n      { merge: true },\n    )\n    for (const email of plan.emails) {\n      const key = personKey(email)\n      if (!key) continue\n      transaction.set(\n        index.doc(key),\n        { email, contactId: survivorId, updatedAt: FieldValue.serverTimestamp() },\n        { merge: true },\n      )\n    }\n    transaction.delete(mergedRef)\n    return { plan, survivor: (survivor.data() ?? {}) as Record<string, unknown> }\n  })\n  if ('reason' in swapped) return { ok: false, reason: swapped.reason }\n  const { plan } = swapped\n  // The survivor now carries both records' addresses, holders and facets —\n  // what the Contacts list searches and filters by (AGL-3321).\n  await restampCrmListFieldsAt(survivorRef, 'contacts')\n\n  /*\n   * The companies both records named counted two people and now count one\n   * (AGL-2613). Settled after the swap the way the capture settles its\n   * counts: a figure that could not move is logged, and the company page's\n   * live aggregate corrects it.\n   */\n  await settleCompanyContactsCounts(orgRef.collection(CRM_COLLECTIONS.companies), {\n    companyId: null,\n    mirror: null,\n    counts: plan.companyCounts,\n  })\n  /*\n   * The survivor now owns the merged record's open tasks too, so its next\n   * activity is the earliest of both (AGL-2661). Settled the same way: a\n   * figure that could not move is logged, and the Fields section's\n   * recompute corrects it.\n   */\n  await recomputeCrmNextTaskAt(firestore, orgRef.id, [{ contactId: survivorId }]).catch(\n    (error: unknown) => {\n      console.error('contact merge next activity could not be recomputed', survivorId, error)\n    },\n  )\n\n  const mergedEmail = contactEmails(mergedData)[0] ?? ''\n  const survivorEmail = plan.emails[0] ?? ''\n  // The canonical name — the one identity every holder shares — for the\n  // feed; the address stands in for a person nobody has named.\n  const survivorName =\n    typeof swapped.survivor['name'] === 'string' ? swapped.survivor['name'] : ''\n\n  /*\n   * THE TIMELINE NOTE, on the survivor: the merge is an event in this\n   * person's history, and the record page is where a reader looks for one.\n   * Filed under the calling site, or the survivor's first site for a door\n   * with none; its own catch, because a note that could not be written must\n   * not read as a merge that did not happen.\n   */\n  try {\n    await orgRef.collection(CRM_COLLECTIONS.activities).add({\n      kind: 'note',\n      body: `Merged with ${mergedEmail}`,\n      atMs: Date.now(),\n      byUid: actor.uid,\n      ...(options.actorName || actor.email\n        ? { byName: options.actorName || actor.email }\n        : {}),\n      contactId: survivorId,\n      visibleTo: plan.visibleTo,\n      hostId: hostId ?? String(survivorData['hostId'] ?? ''),\n      createdByUid: actor.uid,\n      createdAt: FieldValue.serverTimestamp(),\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n  } catch (error) {\n    console.error('[contact-merge] timeline note failed', survivorId, error)\n  }\n\n  // The audit line (AGL-2622), in the feed of the site whose console did\n  // the work. A door with no site — the API — has no host feed to write.\n  if (hostId) {\n    await logHostActivity(hostId, actor, `Merged with ${mergedEmail}`, {\n      type: 'contact',\n      id: survivorId,\n      name: survivorName || survivorEmail,\n    })\n  }\n\n  return {\n    ok: true,\n    survivorId,\n    survivorEmail,\n    mergedId,\n    mergedEmail,\n    emails: plan.emails,\n    repointed: { deals, tasks, activities, leads },\n  }\n}\n"],"names":["CONTACT_EMAIL_INDEX_COLLECTION","contactEmails","planContactMerge","CRM_COLLECTIONS","personKey","FieldValue","settleCompanyContactsCounts","recomputeCrmNextTaskAt","restampCrmListFieldsAt","logHostActivity","REPOINT_PAGE","REPOINT_PASSES","repointContactId","firestore","collection","from","to","moved","pass","page","where","limit","get","empty","batch","row","docs","update","ref","contactId","updatedAt","serverTimestamp","commit","size","repointLeads","orgRef","emails","email","key","leadRef","doc","lead","exists","convertedContactId","mergeContacts","options","mergedBefore","survivorBefore","plan","survivorId","mergedId","actor","hostId","ok","reason","contactsRef","survivorRef","mergedRef","Promise","all","mergedData","data","survivorData","deals","tasks","activities","leads","index","swapped","runTransaction","transaction","survivor","merged","set","merge","delete","companies","companyId","mirror","counts","companyCounts","id","catch","error","console","mergedEmail","survivorEmail","survivorName","add","kind","body","atMs","Date","now","byUid","uid","actorName","byName","visibleTo","String","createdByUid","createdAt","type","name","repointed"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCC,GAED,SACEA,8BAA8B,EAC9BC,aAAa,QACR,kCAAiC;AAExC,SAASC,gBAAgB,QAAQ,4BAAwB;AACzD,SAASC,eAAe,QAAQ,6BAA4B;AAC5D,SAASC,SAAS,QAAQ,oCAAmC;AAC7D,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,2BAA2B,QAAQ,uDAAsD;AAClG,SAASC,sBAAsB,QAAQ,oDAAmD;AAC1F,SAASC,sBAAsB,QAAQ,8CAA6C;AACpF,SAASC,eAAe,QAAQ,gDAA+C;AAE/E,0EAA0E,GAC1E,MAAMC,eAAe;AACrB,8EAA8E,GAC9E,MAAMC,iBAAiB;AAyCvB;;;;;;;CAOC,GACD,eAAeC,iBACbC,SAAsC,EACtCC,UAAiD,EACjDC,IAAY,EACZC,EAAU;IAEV,IAAIC,QAAQ;IACZ,IAAK,IAAIC,OAAO,GAAGA,OAAOP,gBAAgBO,QAAQ,EAAG;QACnD,MAAMC,OAAO,MAAML,WAChBM,KAAK,CAAC,aAAa,MAAML,MACzBM,KAAK,CAACX,cACNY,GAAG;QACN,IAAIH,KAAKI,KAAK,EAAE;QAChB,MAAMC,QAAQX,UAAUW,KAAK;QAC7B,KAAK,MAAMC,OAAON,KAAKO,IAAI,CAAE;YAC3BF,MAAMG,MAAM,CAACF,IAAIG,GAAG,EAAE;gBACpBC,WAAWb;gBACXc,WAAWzB,WAAW0B,eAAe;YACvC;QACF;QACA,MAAMP,MAAMQ,MAAM;QAClBf,SAASE,KAAKc,IAAI;QAClB,IAAId,KAAKc,IAAI,GAAGvB,cAAc;IAChC;IACA,OAAOO;AACT;AAEA;;;;;;;;CAQC,GACD,eAAeiB,aACbC,MAA2C,EAC3CC,MAAyB,EACzBrB,IAAY,EACZC,EAAU;IAEV,IAAIC,QAAQ;IACZ;;;;;;GAMC,GACD,KAAK,MAAMoB,SAASD,OAAQ;QAC1B,MAAME,MAAMlC,UAAUiC;QACtB,IAAI,CAACC,KAAK;QACV,MAAMC,UAAUJ,OAAOrB,UAAU,CAAC,SAAS0B,GAAG,CAACF;QAC/C,MAAMG,OAAO,MAAMF,QAAQjB,GAAG;QAC9B,IAAI,CAACmB,KAAKC,MAAM,IAAID,KAAKnB,GAAG,CAAC,0BAA0BP,MAAM;QAC7D,MAAMwB,QAAQZ,MAAM,CAAC;YACnBgB,oBAAoB3B;YACpBc,WAAWzB,WAAW0B,eAAe;QACvC;QACAd,SAAS;IACX;IACA,OAAOA;AACT;AAEA,OAAO,eAAe2B,cACpBC,OAA6B;QAeTC,oBACEC,sBAmFF9C,iBACE+C;IAlGtB,MAAM,EAAEnC,SAAS,EAAEsB,MAAM,EAAEc,UAAU,EAAEC,QAAQ,EAAEC,KAAK,EAAEC,MAAM,EAAE,GAAGP;IACnE,IAAI,CAACI,cAAc,CAACC,YAAYD,eAAeC,UAAU;QACvD,OAAO;YAAEG,IAAI;YAAOC,QAAQ;QAAc;IAC5C;IACA,MAAMC,cAAcpB,OAAOrB,UAAU,CAAC;IACtC,MAAM0C,cAAcD,YAAYf,GAAG,CAACS;IACpC,MAAMQ,YAAYF,YAAYf,GAAG,CAACU;IAClC,MAAM,CAACH,gBAAgBD,aAAa,GAAG,MAAMY,QAAQC,GAAG,CAAC;QACvDH,YAAYlC,GAAG;QACfmC,UAAUnC,GAAG;KACd;IACD,IAAI,CAACyB,eAAeL,MAAM,EAAE,OAAO;QAAEW,IAAI;QAAOC,QAAQ;IAAmB;IAC3E,IAAI,CAACR,aAAaJ,MAAM,EAAE,OAAO;QAAEW,IAAI;QAAOC,QAAQ;IAAiB;IACvE,MAAMM,cAAcd,qBAAAA,aAAae,IAAI,cAAjBf,qBAAuB,CAAC;IAC5C,MAAMgB,gBAAgBf,uBAAAA,eAAec,IAAI,cAAnBd,uBAAyB,CAAC;IAEhD;;6CAE2C,GAC3C,MAAM,CAACgB,OAAOC,OAAOC,WAAW,GAAG,MAAMP,QAAQC,GAAG,CAAC;QACnD/C,iBAAiBC,WAAWsB,OAAOrB,UAAU,CAACX,gBAAgB4D,KAAK,GAAGb,UAAUD;QAChFrC,iBAAiBC,WAAWsB,OAAOrB,UAAU,CAACX,gBAAgB6D,KAAK,GAAGd,UAAUD;QAChFrC,iBACEC,WACAsB,OAAOrB,UAAU,CAACX,gBAAgB8D,UAAU,GAC5Cf,UACAD;KAEH;IACD,MAAMiB,QAAQ,MAAMhC,aAClBC,QACAlC,cAAc2D,aACdV,UACAD;IAGF;;6CAE2C,GAC3C,MAAMkB,QAAQhC,OAAOrB,UAAU,CAACd;IAChC,MAAMoE,UAAU,MAAMvD,UAAUwD,cAAc,CAAC,OAAOC;YAQjDC,gBACAC,cAiBuBD;QAzB1B,MAAM,CAACA,UAAUC,OAAO,GAAG,MAAMd,QAAQC,GAAG,CAAC;YAC3CW,YAAYhD,GAAG,CAACkC;YAChBc,YAAYhD,GAAG,CAACmC;SACjB;QACD,IAAI,CAACc,SAAS7B,MAAM,EAAE,OAAO;YAAEY,QAAQ;QAA4B;QACnE,IAAI,CAACkB,OAAO9B,MAAM,EAAE,OAAO;YAAEY,QAAQ;QAA0B;QAC/D,MAAMN,OAAO9C,kBACVqE,iBAAAA,SAASV,IAAI,cAAbU,iBAAmB,CAAC,IACpBC,eAAAA,OAAOX,IAAI,cAAXW,eAAiB,CAAC;QAErBF,YAAYG,GAAG,CACbjB,aACA,aAAKR,KAAKuB,QAAQ;YAAEzC,WAAWzB,WAAW0B,eAAe;YACzD;YAAE2C,OAAO;QAAK;QAEhB,KAAK,MAAMrC,SAASW,KAAKZ,MAAM,CAAE;YAC/B,MAAME,MAAMlC,UAAUiC;YACtB,IAAI,CAACC,KAAK;YACVgC,YAAYG,GAAG,CACbN,MAAM3B,GAAG,CAACF,MACV;gBAAED;gBAAOR,WAAWoB;gBAAYnB,WAAWzB,WAAW0B,eAAe;YAAG,GACxE;gBAAE2C,OAAO;YAAK;QAElB;QACAJ,YAAYK,MAAM,CAAClB;QACnB,OAAO;YAAET;YAAMuB,QAAQ,GAAGA,kBAAAA,SAASV,IAAI,cAAbU,kBAAmB,CAAC;QAA8B;IAC9E;IACA,IAAI,YAAYH,SAAS,OAAO;QAAEf,IAAI;QAAOC,QAAQc,QAAQd,MAAM;IAAC;IACpE,MAAM,EAAEN,IAAI,EAAE,GAAGoB;IACjB,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM5D,uBAAuBgD,aAAa;IAE1C;;;;;GAKC,GACD,MAAMlD,4BAA4B6B,OAAOrB,UAAU,CAACX,gBAAgByE,SAAS,GAAG;QAC9EC,WAAW;QACXC,QAAQ;QACRC,QAAQ/B,KAAKgC,aAAa;IAC5B;IACA;;;;;GAKC,GACD,MAAMzE,uBAAuBM,WAAWsB,OAAO8C,EAAE,EAAE;QAAC;YAAEpD,WAAWoB;QAAW;KAAE,EAAEiC,KAAK,CACnF,CAACC;QACCC,QAAQD,KAAK,CAAC,uDAAuDlC,YAAYkC;IACnF;IAGF,MAAME,eAAcpF,kBAAAA,cAAc2D,WAAW,CAAC,EAAE,YAA5B3D,kBAAgC;IACpD,MAAMqF,iBAAgBtC,gBAAAA,KAAKZ,MAAM,CAAC,EAAE,YAAdY,gBAAkB;IACxC,sEAAsE;IACtE,6DAA6D;IAC7D,MAAMuC,eACJ,OAAOnB,QAAQG,QAAQ,CAAC,OAAO,KAAK,WAAWH,QAAQG,QAAQ,CAAC,OAAO,GAAG;IAE5E;;;;;;GAMC,GACD,IAAI;YAWyBT;QAV3B,MAAM3B,OAAOrB,UAAU,CAACX,gBAAgB8D,UAAU,EAAEuB,GAAG,CAAC;YACtDC,MAAM;YACNC,MAAM,CAAC,YAAY,EAAEL,aAAa;YAClCM,MAAMC,KAAKC,GAAG;YACdC,OAAO3C,MAAM4C,GAAG;WACZlD,QAAQmD,SAAS,IAAI7C,MAAMd,KAAK,GAChC;YAAE4D,QAAQpD,QAAQmD,SAAS,IAAI7C,MAAMd,KAAK;QAAC,IAC3C,CAAC;YACLR,WAAWoB;YACXiD,WAAWlD,KAAKkD,SAAS;YACzB9C,MAAM,EAAEA,iBAAAA,SAAU+C,QAAOrC,uBAAAA,YAAY,CAAC,SAAS,YAAtBA,uBAA0B;YACnDsC,cAAcjD,MAAM4C,GAAG;YACvBM,WAAWhG,WAAW0B,eAAe;YACrCD,WAAWzB,WAAW0B,eAAe;;IAEzC,EAAE,OAAOoD,OAAO;QACdC,QAAQD,KAAK,CAAC,wCAAwClC,YAAYkC;IACpE;IAEA,uEAAuE;IACvE,uEAAuE;IACvE,IAAI/B,QAAQ;QACV,MAAM3C,gBAAgB2C,QAAQD,OAAO,CAAC,YAAY,EAAEkC,aAAa,EAAE;YACjEiB,MAAM;YACNrB,IAAIhC;YACJsD,MAAMhB,gBAAgBD;QACxB;IACF;IAEA,OAAO;QACLjC,IAAI;QACJJ;QACAqC;QACApC;QACAmC;QACAjD,QAAQY,KAAKZ,MAAM;QACnBoE,WAAW;YAAEzC;YAAOC;YAAOC;YAAYC;QAAM;IAC/C;AACF"}

package/src/lib/server/pipeline-record-index.d.ts

@@ -0,0 +1,36 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginRecordIndex } from '@aglyn/aglyn/plugin-manager/plugin-record-index';
+/**
+ * The CRM's `pipeline` index (AGL-3080): the organization's deal pipelines
+ * and their stages, as another plugin reads them — an automation drafted by
+ * the AI names a stage a deal moves to — without knowing where pipelines are
+ * stored or what an archived one looks like.
+ *
+ * Org-scoped (`orgId` required; a site-only scope answers nothing). With a
+ * `hostId`, only the pipelines that site can see — the ones shared with it
+ * or with every site — which is the set that site's CRM offers. An archived
+ * pipeline is left out of every answer.
+ *
+ * `name` is the pipeline's, or `Untitled pipeline` for one saved without,
+ * which is what the CRM itself calls it. A pipeline's `facts`:
+ *   `stages: Array<{ id: string, name: string }>`, in the pipeline's order,
+ *   each stage that has an id (a stage saved without a name has `name: ''`).
+ */
+/** What the CRM calls a pipeline saved without a name. */
+export declare const UNTITLED_PIPELINE = "Untitled pipeline";
+export declare const pipelineRecordIndex: PluginRecordIndex;

package/src/lib/server/pipeline-record-index.js

@@ -0,0 +1,87 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { visibleToHost } from "@aglyn/aglyn/app-utils/scope-tokens";
+import { firebaseAdmin } from "@aglyn/tenant-data-admin/server/firebase-admin";
+import { scopedToHost } from "@aglyn/tenant-data-admin/server/organizations";
+/**
+ * The CRM's `pipeline` index (AGL-3080): the organization's deal pipelines
+ * and their stages, as another plugin reads them — an automation drafted by
+ * the AI names a stage a deal moves to — without knowing where pipelines are
+ * stored or what an archived one looks like.
+ *
+ * Org-scoped (`orgId` required; a site-only scope answers nothing). With a
+ * `hostId`, only the pipelines that site can see — the ones shared with it
+ * or with every site — which is the set that site's CRM offers. An archived
+ * pipeline is left out of every answer.
+ *
+ * `name` is the pipeline's, or `Untitled pipeline` for one saved without,
+ * which is what the CRM itself calls it. A pipeline's `facts`:
+ *   `stages: Array<{ id: string, name: string }>`, in the pipeline's order,
+ *   each stage that has an id (a stage saved without a name has `name: ''`).
+ */ /** What the CRM calls a pipeline saved without a name. */ export const UNTITLED_PIPELINE = 'Untitled pipeline';
+const PIPELINE_FIELDS = [
+    'name',
+    'stages',
+    'archivedAt'
+];
+const str = (value)=>typeof value === 'string' ? value.trim() : '';
+function pipelineRecord(id, data) {
+    if (!data || Number(data['archivedAt']) > 0) return null;
+    const stages = (Array.isArray(data['stages']) ? data['stages'] : []).map((stage)=>{
+        const entry = stage != null ? stage : {};
+        return {
+            id: str(entry['id']),
+            name: str(entry['name'])
+        };
+    }).filter((stage)=>stage.id);
+    return {
+        id,
+        name: str(data['name']) || UNTITLED_PIPELINE,
+        facts: {
+            stages
+        }
+    };
+}
+function pipelineCollection(orgId) {
+    return firebaseAdmin.app().firestore().collection('orgs').doc(orgId).collection('pipelines');
+}
+export const pipelineRecordIndex = {
+    async list ({ orgId, hostId, limit }) {
+        if (!orgId || limit <= 0) return {
+            records: [],
+            truncated: false
+        };
+        const collection = pipelineCollection(orgId);
+        // One more than asked, so `truncated` is a fact rather than a guess; the
+        // archived rows are filtered after the read.
+        const snapshot = await (hostId ? scopedToHost(collection, hostId) : collection).select(...PIPELINE_FIELDS).limit(limit + 1).get();
+        const records = snapshot.docs.slice(0, limit).map((doc)=>pipelineRecord(doc.id, doc.data())).filter((record)=>record !== null);
+        return {
+            records,
+            truncated: snapshot.docs.length > limit
+        };
+    },
+    async get ({ orgId, hostId, id }) {
+        if (!orgId || !id) return null;
+        const snapshot = await pipelineCollection(orgId).doc(id).get();
+        const data = snapshot.exists ? snapshot.data() : undefined;
+        // A site asks about the pipelines it can see, and no other.
+        if (hostId && !visibleToHost(data == null ? void 0 : data['visibleTo'], hostId)) return null;
+        return pipelineRecord(snapshot.id, data);
+    }
+};
+
+//# sourceMappingURL=pipeline-record-index.js.map

package/src/lib/server/pipeline-record-index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/pipeline-record-index.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type {\n  PluginIndexedRecord,\n  PluginRecordIndex,\n} from '@aglyn/aglyn/plugin-manager/plugin-record-index'\nimport { visibleToHost } from '@aglyn/aglyn/app-utils/scope-tokens'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin/server/firebase-admin'\nimport { scopedToHost } from '@aglyn/tenant-data-admin/server/organizations'\n\n/**\n * The CRM's `pipeline` index (AGL-3080): the organization's deal pipelines\n * and their stages, as another plugin reads them — an automation drafted by\n * the AI names a stage a deal moves to — without knowing where pipelines are\n * stored or what an archived one looks like.\n *\n * Org-scoped (`orgId` required; a site-only scope answers nothing). With a\n * `hostId`, only the pipelines that site can see — the ones shared with it\n * or with every site — which is the set that site's CRM offers. An archived\n * pipeline is left out of every answer.\n *\n * `name` is the pipeline's, or `Untitled pipeline` for one saved without,\n * which is what the CRM itself calls it. A pipeline's `facts`:\n *   `stages: Array<{ id: string, name: string }>`, in the pipeline's order,\n *   each stage that has an id (a stage saved without a name has `name: ''`).\n */\n\n/** What the CRM calls a pipeline saved without a name. */\nexport const UNTITLED_PIPELINE = 'Untitled pipeline'\n\nconst PIPELINE_FIELDS = ['name', 'stages', 'archivedAt'] as const\n\nconst str = (value: unknown): string => (typeof value === 'string' ? value.trim() : '')\n\nfunction pipelineRecord(\n  id: string,\n  data: Record<string, unknown> | undefined,\n): PluginIndexedRecord | null {\n  if (!data || Number(data['archivedAt']) > 0) return null\n  const stages = (Array.isArray(data['stages']) ? data['stages'] : [])\n    .map((stage) => {\n      const entry = (stage ?? {}) as Record<string, unknown>\n      return { id: str(entry['id']), name: str(entry['name']) }\n    })\n    .filter((stage) => stage.id)\n  return { id, name: str(data['name']) || UNTITLED_PIPELINE, facts: { stages } }\n}\n\nfunction pipelineCollection(orgId: string): FirebaseFirestore.CollectionReference {\n  return firebaseAdmin.app().firestore().collection('orgs').doc(orgId).collection('pipelines')\n}\n\nexport const pipelineRecordIndex: PluginRecordIndex = {\n  async list({ orgId, hostId, limit }) {\n    if (!orgId || limit <= 0) return { records: [], truncated: false }\n    const collection = pipelineCollection(orgId)\n    // One more than asked, so `truncated` is a fact rather than a guess; the\n    // archived rows are filtered after the read.\n    const snapshot = await (hostId ? scopedToHost(collection, hostId) : collection)\n      .select(...PIPELINE_FIELDS)\n      .limit(limit + 1)\n      .get()\n    const records = snapshot.docs\n      .slice(0, limit)\n      .map((doc) => pipelineRecord(doc.id, doc.data()))\n      .filter((record): record is PluginIndexedRecord => record !== null)\n    return { records, truncated: snapshot.docs.length > limit }\n  },\n  async get({ orgId, hostId, id }) {\n    if (!orgId || !id) return null\n    const snapshot = await pipelineCollection(orgId).doc(id).get()\n    const data = snapshot.exists ? snapshot.data() : undefined\n    // A site asks about the pipelines it can see, and no other.\n    if (hostId && !visibleToHost(data?.['visibleTo'] as string[] | undefined, hostId)) return null\n    return pipelineRecord(snapshot.id, data)\n  },\n}\n"],"names":["visibleToHost","firebaseAdmin","scopedToHost","UNTITLED_PIPELINE","PIPELINE_FIELDS","str","value","trim","pipelineRecord","id","data","Number","stages","Array","isArray","map","stage","entry","name","filter","facts","pipelineCollection","orgId","app","firestore","collection","doc","pipelineRecordIndex","list","hostId","limit","records","truncated","snapshot","select","get","docs","slice","record","length","exists","undefined"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAMD,SAASA,aAAa,QAAQ,sCAAqC;AACnE,SAASC,aAAa,QAAQ,iDAAgD;AAC9E,SAASC,YAAY,QAAQ,gDAA+C;AAE5E;;;;;;;;;;;;;;;CAeC,GAED,wDAAwD,GACxD,OAAO,MAAMC,oBAAoB,oBAAmB;AAEpD,MAAMC,kBAAkB;IAAC;IAAQ;IAAU;CAAa;AAExD,MAAMC,MAAM,CAACC,QAA4B,OAAOA,UAAU,WAAWA,MAAMC,IAAI,KAAK;AAEpF,SAASC,eACPC,EAAU,EACVC,IAAyC;IAEzC,IAAI,CAACA,QAAQC,OAAOD,IAAI,CAAC,aAAa,IAAI,GAAG,OAAO;IACpD,MAAME,SAAS,AAACC,CAAAA,MAAMC,OAAO,CAACJ,IAAI,CAAC,SAAS,IAAIA,IAAI,CAAC,SAAS,GAAG,EAAE,AAAD,EAC/DK,GAAG,CAAC,CAACC;QACJ,MAAMC,QAASD,gBAAAA,QAAS,CAAC;QACzB,OAAO;YAAEP,IAAIJ,IAAIY,KAAK,CAAC,KAAK;YAAGC,MAAMb,IAAIY,KAAK,CAAC,OAAO;QAAE;IAC1D,GACCE,MAAM,CAAC,CAACH,QAAUA,MAAMP,EAAE;IAC7B,OAAO;QAAEA;QAAIS,MAAMb,IAAIK,IAAI,CAAC,OAAO,KAAKP;QAAmBiB,OAAO;YAAER;QAAO;IAAE;AAC/E;AAEA,SAASS,mBAAmBC,KAAa;IACvC,OAAOrB,cAAcsB,GAAG,GAAGC,SAAS,GAAGC,UAAU,CAAC,QAAQC,GAAG,CAACJ,OAAOG,UAAU,CAAC;AAClF;AAEA,OAAO,MAAME,sBAAyC;IACpD,MAAMC,MAAK,EAAEN,KAAK,EAAEO,MAAM,EAAEC,KAAK,EAAE;QACjC,IAAI,CAACR,SAASQ,SAAS,GAAG,OAAO;YAAEC,SAAS,EAAE;YAAEC,WAAW;QAAM;QACjE,MAAMP,aAAaJ,mBAAmBC;QACtC,yEAAyE;QACzE,6CAA6C;QAC7C,MAAMW,WAAW,MAAM,AAACJ,CAAAA,SAAS3B,aAAauB,YAAYI,UAAUJ,UAAS,EAC1ES,MAAM,IAAI9B,iBACV0B,KAAK,CAACA,QAAQ,GACdK,GAAG;QACN,MAAMJ,UAAUE,SAASG,IAAI,CAC1BC,KAAK,CAAC,GAAGP,OACTf,GAAG,CAAC,CAACW,MAAQlB,eAAekB,IAAIjB,EAAE,EAAEiB,IAAIhB,IAAI,KAC5CS,MAAM,CAAC,CAACmB,SAA0CA,WAAW;QAChE,OAAO;YAAEP;YAASC,WAAWC,SAASG,IAAI,CAACG,MAAM,GAAGT;QAAM;IAC5D;IACA,MAAMK,KAAI,EAAEb,KAAK,EAAEO,MAAM,EAAEpB,EAAE,EAAE;QAC7B,IAAI,CAACa,SAAS,CAACb,IAAI,OAAO;QAC1B,MAAMwB,WAAW,MAAMZ,mBAAmBC,OAAOI,GAAG,CAACjB,IAAI0B,GAAG;QAC5D,MAAMzB,OAAOuB,SAASO,MAAM,GAAGP,SAASvB,IAAI,KAAK+B;QACjD,4DAA4D;QAC5D,IAAIZ,UAAU,CAAC7B,cAAcU,wBAAAA,IAAM,CAAC,YAAY,EAA0BmB,SAAS,OAAO;QAC1F,OAAOrB,eAAeyB,SAASxB,EAAE,EAAEC;IACrC;AACF,EAAC"}

package/src/lib/server/record-facts.js

@@ -15,11 +15,12 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */ import { registerPluginRecordFactsReader } from "@aglyn/aglyn/plugin-manager/plugin-record-facts";
-import { CRM_COLLECTIONS, contactPrimaryGroup, crmReadTokens, isOrgWideMember } from "@aglyn/aglyn/server";
+import { CRM_COLLECTIONS, crmReadTokens, isOrgWideMember } from "@aglyn/aglyn/server";
 import { consentGroupForSite, firebaseAdmin, getOrgDoc, memberHasOrgPermission, readLeadForHost, resolveOrgIdForHost, resolveOrgMembership } from "@aglyn/tenant-data-admin";
 import { BUNDLE_ID } from "../constants/bundle-common.js";
 import { CRM_IMPORT_FACTS_RESOURCE, CRM_RECORD_FACTS_RESOURCES, companyFacts, contactFacts, dealFacts, importFacts, isCrmImportFactsCollection, leadFacts } from "../model/record-facts.js";
 import { crmSuiteRefusal } from "./suite-gate.js";
+import { contactPrimaryGroup } from "../model/contact-holder.js";
 /** The org collection a contact lives in, beside the CRM's own. */ const CONTACTS_COLLECTION = 'contacts';
 /** Logged activities read per record before visibility and the timeline cut. */ export const CRM_FACTS_ACTIVITIES_READ = 40;
 /** Tasks read per record, the record page's own window. */ export const CRM_FACTS_TASKS_READ = 50;

package/src/lib/server/record-facts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/record-facts.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  registerPluginRecordFactsReader,\n  type PluginRecordFactsRead,\n  type PluginRecordFactsReader,\n  type PluginRecordFactsRequest,\n} from '@aglyn/aglyn/plugin-manager/plugin-record-facts'\nimport {\n  CRM_COLLECTIONS,\n  contactPrimaryGroup,\n  crmReadTokens,\n  isOrgWideMember,\n  type ConsentGroup,\n  type ContactFieldDefinition,\n  type CrmActivity,\n  type CrmCompany,\n  type CrmDeal,\n  type CrmPipeline,\n  type CrmTask,\n} from '@aglyn/aglyn/server'\nimport {\n  consentGroupForSite,\n  firebaseAdmin,\n  getOrgDoc,\n  memberHasOrgPermission,\n  readLeadForHost,\n  resolveOrgIdForHost,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin'\nimport { BUNDLE_ID } from '../constants/bundle-common'\nimport {\n  CRM_IMPORT_FACTS_RESOURCE,\n  CRM_RECORD_FACTS_RESOURCES,\n  companyFacts,\n  contactFacts,\n  dealFacts,\n  importFacts,\n  isCrmImportFactsCollection,\n  leadFacts,\n  type CrmRecordFactsKind,\n} from '../model/record-facts'\nimport { crmSuiteRefusal } from './suite-gate'\n\n/**\n * THE CRM'S READERS ON THE CORE'S RECORD-FACTS SEAM (AGL-2917).\n *\n * Another plugin asks for a contact, a company, a deal, a lead or an import's\n * field catalog by resource name, and gets the facts `model/record-facts.ts`\n * reports — read here with the rules every other CRM door applies, for the\n * member the caller names:\n *\n *  1. the site belongs to the organization;\n *  2. the member reaches it — an org-wide member at the organization level, a\n *     member of that site under it — and holds `data.manage`, the key the\n *     whole CRM is gated on. A verified staff caller passes, as at every CRM\n *     route;\n *  3. the organization's plan carries the CRM, asked after the caller is\n *     known, the order `suite-gate.ts` gives;\n *  4. the record exists and is visible where it is read: under a site, its\n *     `visibleTo` meets the site's read tokens, as the console's listeners\n *     filter; at the organization level every row is the member's;\n *  5. what hangs off it — its logged activity, its tasks, its deals — is held\n *     to the same visibility, row by row.\n *\n * A caller in the same process skips the plugin API dispatcher, and with it\n * the dispatcher's per-site enablement, release flag, lockdown and rate\n * limit; those are the caller's to establish before it asks (the AI plugin's\n * CRM admission does). Nothing here writes.\n */\n\ntype Firestore = FirebaseFirestore.Firestore\ntype Data = Record<string, unknown>\ntype Refusal = { ok: false; status: 400 | 403 | 404; error: string }\n\n/** The org collection a contact lives in, beside the CRM's own. */\nconst CONTACTS_COLLECTION = 'contacts'\n\n/** Logged activities read per record before visibility and the timeline cut. */\nexport const CRM_FACTS_ACTIVITIES_READ = 40\n/** Tasks read per record, the record page's own window. */\nexport const CRM_FACTS_TASKS_READ = 50\n/** Deals read per contact or company. */\nexport const CRM_FACTS_DEALS_READ = 20\n/** Custom field definitions an import catalog reads. */\nexport const CRM_FACTS_FIELD_DEFINITIONS_READ = 100\n\nexport const CRM_FACTS_UNKNOWN_SITE = 'Unknown site'\nexport const CRM_FACTS_NOT_A_MEMBER = 'You are not a member of that organization'\nexport const CRM_FACTS_SITE_REFUSAL = 'Reading CRM records requires the data.manage permission on this site'\nexport const CRM_FACTS_ORG_REFUSAL =\n  'Reading CRM records across the organization requires the data.manage permission for the whole organization'\nexport const CRM_FACTS_LEAD_NEEDS_SITE = 'A lead is read on the site that captured it'\n\nconst NOT_FOUND: Record<CrmRecordFactsKind | 'import', string> = {\n  contact: 'This contact could not be found. It may have been deleted.',\n  company: 'This company could not be found. It may have been deleted.',\n  deal: 'This deal could not be found. It may have been deleted.',\n  lead: 'This lead could not be found. It may have been removed.',\n  import: 'There is no such import.',\n}\n\n/** Where a read runs, once the caller has been admitted. */\ninterface CrmFactsScope {\n  orgId: string\n  hostId: string | null\n  org: Data\n  /** The site's consent group under a site; `null` at the organization level. */\n  group: ConsentGroup | null\n  /** Whether a row's `visibleTo` is readable here. */\n  visible: (visibleTo: unknown) => boolean\n}\n\nfunction firestore(): Firestore {\n  return firebaseAdmin.app().firestore()\n}\n\n/**\n * Rules 1 to 3: the site, the member and the plan. A refusal names what the\n * member lacks in the words the console's own CRM doors use.\n */\nexport async function crmFactsScope(request: PluginRecordFactsRequest): Promise<CrmFactsScope | Refusal> {\n  const orgId = String(request.orgId ?? '').trim()\n  const hostId = request.hostId ? String(request.hostId).trim() : null\n  if (!orgId) return { ok: false, status: 400, error: 'Open a workspace first' }\n  if (hostId && (await resolveOrgIdForHost(hostId)) !== orgId) {\n    return { ok: false, status: 404, error: CRM_FACTS_UNKNOWN_SITE }\n  }\n  if (!request.staff) {\n    const membership = await resolveOrgMembership(request.uid, orgId).catch(() => null)\n    const member = membership?.orgId === orgId ? membership.member : null\n    if (!member) return { ok: false, status: 403, error: CRM_FACTS_NOT_A_MEMBER }\n    const reaches = hostId\n      ? isOrgWideMember(member) || Boolean(member.hostAccess?.[hostId])\n      : isOrgWideMember(member)\n    const allowed = reaches && (await memberHasOrgPermission(orgId, member, 'data.manage'))\n    if (!allowed) {\n      return { ok: false, status: 403, error: hostId ? CRM_FACTS_SITE_REFUSAL : CRM_FACTS_ORG_REFUSAL }\n    }\n  }\n  const org = ((request.org as Data | null) ?? ((await getOrgDoc(orgId)) as Data | null)) || null\n  if (!org) return { ok: false, status: 404, error: 'Unknown organization' }\n  const suite = crmSuiteRefusal(org, 'Reading a CRM record')\n  if (suite) return { ok: false, status: 403, error: suite.body.error }\n  if (!hostId) return { orgId, hostId: null, org, group: null, visible: () => true }\n  const group = await consentGroupForSite(hostId, org)\n  const readable = new Set<string>(crmReadTokens(group))\n  return {\n    orgId,\n    hostId,\n    org,\n    group,\n    visible: (visibleTo) =>\n      Array.isArray(visibleTo) && visibleTo.some((token) => readable.has(String(token))),\n  }\n}\n\nconst orgCollection = (orgId: string, name: string) =>\n  firestore().collection('orgs').doc(orgId).collection(name)\n\n/** Rows of an org collection naming one record, held to the scope's visibility. */\nasync function rowsNaming<T>(\n  scope: CrmFactsScope,\n  input: { collection: string; field: string; id: string; orderBy: string; direction: 'asc' | 'desc'; limit: number },\n): Promise<T[]> {\n  const snapshot = await orgCollection(scope.orgId, input.collection)\n    .where(input.field, '==', input.id)\n    .orderBy(input.orderBy, input.direction)\n    .limit(input.limit)\n    .get()\n  return snapshot.docs\n    .map((doc) => (doc.data() ?? {}) as Data)\n    .filter((row) => scope.visible(row['visibleTo'])) as T[]\n}\n\n/** The pipelines some deals name, by id, read once each. */\nasync function pipelinesFor(scope: CrmFactsScope, deals: ReadonlyArray<Partial<CrmDeal>>): Promise<Map<string, CrmPipeline>> {\n  const ids = [...new Set(deals.map((deal) => String(deal.pipelineId ?? '')).filter(Boolean))]\n  const snapshots = await Promise.all(ids.map((id) => orgCollection(scope.orgId, CRM_COLLECTIONS.pipelines).doc(id).get()))\n  return new Map(\n    snapshots\n      .filter((snapshot) => snapshot.exists)\n      .map((snapshot) => [snapshot.id, (snapshot.data() ?? {}) as CrmPipeline]),\n  )\n}\n\n/** A record document the scope may read, or `null`. */\nasync function visibleDoc(scope: CrmFactsScope, collection: string, id: string): Promise<Data | null> {\n  if (!id) return null\n  const snapshot = await orgCollection(scope.orgId, collection).doc(id).get()\n  const data = snapshot.exists ? ((snapshot.data() ?? {}) as Data) : null\n  return data && scope.visible(data['visibleTo']) ? data : null\n}\n\nconst refused = (kind: CrmRecordFactsKind | 'import', status: 400 | 404 = 404): Refusal => ({\n  ok: false,\n  status,\n  error: NOT_FOUND[kind],\n})\n\n/** A reader that admits the caller, then reads the record. */\nfunction reader(read: (scope: CrmFactsScope, request: PluginRecordFactsRequest) => Promise<PluginRecordFactsRead>): PluginRecordFactsReader {\n  return {\n    read: async (request) => {\n      const scope = await crmFactsScope(request)\n      if ('ok' in scope) return scope\n      return read(scope, request)\n    },\n  }\n}\n\nexport const crmContactFactsReader = reader(async (scope, request) => {\n  const id = String(request.id ?? '').trim()\n  const row = await visibleDoc(scope, CONTACTS_COLLECTION, id)\n  if (!row) return refused('contact')\n  const group = scope.group ?? contactPrimaryGroup(row, scope.org)\n  const naming = { field: 'contactId', id }\n  const [activities, tasks, deals] = await Promise.all([\n    rowsNaming<CrmActivity>(scope, { ...naming, collection: CRM_COLLECTIONS.activities, orderBy: 'atMs', direction: 'desc', limit: CRM_FACTS_ACTIVITIES_READ }),\n    rowsNaming<CrmTask>(scope, { ...naming, collection: CRM_COLLECTIONS.tasks, orderBy: 'dueAtMs', direction: 'asc', limit: CRM_FACTS_TASKS_READ }),\n    rowsNaming<CrmDeal>(scope, { ...naming, collection: CRM_COLLECTIONS.deals, orderBy: 'updatedAt', direction: 'desc', limit: CRM_FACTS_DEALS_READ }),\n  ])\n  const pipelines = await pipelinesFor(scope, deals)\n  return {\n    ok: true,\n    facts: { ...contactFacts({ row, group, activities, tasks, deals, pipelines, nowMs: request.now.getTime() }) },\n  }\n})\n\nexport const crmCompanyFactsReader = reader(async (scope, request) => {\n  const id = String(request.id ?? '').trim()\n  const company = await visibleDoc(scope, CRM_COLLECTIONS.companies, id)\n  if (!company) return refused('company')\n  const naming = { field: 'companyId', id }\n  const [activities, tasks, deals] = await Promise.all([\n    rowsNaming<CrmActivity>(scope, { ...naming, collection: CRM_COLLECTIONS.activities, orderBy: 'atMs', direction: 'desc', limit: CRM_FACTS_ACTIVITIES_READ }),\n    rowsNaming<CrmTask>(scope, { ...naming, collection: CRM_COLLECTIONS.tasks, orderBy: 'dueAtMs', direction: 'asc', limit: CRM_FACTS_TASKS_READ }),\n    rowsNaming<CrmDeal>(scope, { ...naming, collection: CRM_COLLECTIONS.deals, orderBy: 'updatedAt', direction: 'desc', limit: CRM_FACTS_DEALS_READ }),\n  ])\n  const pipelines = await pipelinesFor(scope, deals)\n  return {\n    ok: true,\n    facts: {\n      ...companyFacts({ company: company as Partial<CrmCompany>, activities, tasks, deals, pipelines, nowMs: request.now.getTime() }),\n    },\n  }\n})\n\nexport const crmDealFactsReader = reader(async (scope, request) => {\n  const id = String(request.id ?? '').trim()\n  const deal = (await visibleDoc(scope, CRM_COLLECTIONS.deals, id)) as (Partial<CrmDeal> & Data) | null\n  if (!deal) return refused('deal')\n  const naming = { field: 'dealId', id }\n  const [activities, tasks, pipelines] = await Promise.all([\n    rowsNaming<CrmActivity>(scope, { ...naming, collection: CRM_COLLECTIONS.activities, orderBy: 'atMs', direction: 'desc', limit: CRM_FACTS_ACTIVITIES_READ }),\n    rowsNaming<CrmTask>(scope, { ...naming, collection: CRM_COLLECTIONS.tasks, orderBy: 'dueAtMs', direction: 'asc', limit: CRM_FACTS_TASKS_READ }),\n    pipelinesFor(scope, [deal]),\n  ])\n  return {\n    ok: true,\n    facts: {\n      ...dealFacts({\n        deal,\n        pipeline: pipelines.get(String(deal.pipelineId ?? '')) ?? null,\n        activities,\n        tasks,\n        nowMs: request.now.getTime(),\n      }),\n    },\n  }\n})\n\nexport const crmLeadFactsReader = reader(async (scope, request) => {\n  if (!scope.hostId) return { ok: false, status: 400, error: CRM_FACTS_LEAD_NEEDS_SITE }\n  const id = String(request.id ?? '').trim()\n  if (!id) return refused('lead')\n  const snapshot = await readLeadForHost(scope.hostId, id)\n  if (!snapshot) return refused('lead')\n  const activities = await rowsNaming<CrmActivity>(scope, {\n    field: 'leadId',\n    id,\n    collection: CRM_COLLECTIONS.activities,\n    orderBy: 'atMs',\n    direction: 'desc',\n    limit: CRM_FACTS_ACTIVITIES_READ,\n  })\n  return { ok: true, facts: { ...leadFacts({ lead: (snapshot.data() ?? {}) as Data, activities }) } }\n})\n\nexport const crmImportFactsReader = reader(async (scope, request) => {\n  const collection = String(request.id ?? '').trim()\n  if (!isCrmImportFactsCollection(collection)) return refused('import', 400)\n  const snapshot = await orgCollection(scope.orgId, CRM_COLLECTIONS.contactFields)\n    .limit(CRM_FACTS_FIELD_DEFINITIONS_READ)\n    .get()\n  const definitions = snapshot.docs\n    .map((doc) => (doc.data() ?? {}) as Partial<ContactFieldDefinition> & Data)\n    .filter((definition) => scope.visible(definition['visibleTo']))\n  return { ok: true, facts: { ...importFacts(collection, definitions) } }\n})\n\n/** Every reader this plugin registers, by resource name. */\nexport const CRM_FACTS_READERS: Readonly<Record<string, PluginRecordFactsReader>> = {\n  [CRM_RECORD_FACTS_RESOURCES.contact]: crmContactFactsReader,\n  [CRM_RECORD_FACTS_RESOURCES.company]: crmCompanyFactsReader,\n  [CRM_RECORD_FACTS_RESOURCES.deal]: crmDealFactsReader,\n  [CRM_RECORD_FACTS_RESOURCES.lead]: crmLeadFactsReader,\n  [CRM_IMPORT_FACTS_RESOURCE]: crmImportFactsReader,\n}\n\n/**\n * Registers the readers; the console surface calls it, the one process that\n * runs AI jobs (AGL-3026). Idempotent: a second call replaces the first.\n */\nexport function registerCrmRecordFactsReaders(): void {\n  for (const [resource, factsReader] of Object.entries(CRM_FACTS_READERS)) {\n    registerPluginRecordFactsReader(resource, factsReader, { pluginId: BUNDLE_ID })\n  }\n}\n"],"names":["registerPluginRecordFactsReader","CRM_COLLECTIONS","contactPrimaryGroup","crmReadTokens","isOrgWideMember","consentGroupForSite","firebaseAdmin","getOrgDoc","memberHasOrgPermission","readLeadForHost","resolveOrgIdForHost","resolveOrgMembership","BUNDLE_ID","CRM_IMPORT_FACTS_RESOURCE","CRM_RECORD_FACTS_RESOURCES","companyFacts","contactFacts","dealFacts","importFacts","isCrmImportFactsCollection","leadFacts","crmSuiteRefusal","CONTACTS_COLLECTION","CRM_FACTS_ACTIVITIES_READ","CRM_FACTS_TASKS_READ","CRM_FACTS_DEALS_READ","CRM_FACTS_FIELD_DEFINITIONS_READ","CRM_FACTS_UNKNOWN_SITE","CRM_FACTS_NOT_A_MEMBER","CRM_FACTS_SITE_REFUSAL","CRM_FACTS_ORG_REFUSAL","CRM_FACTS_LEAD_NEEDS_SITE","NOT_FOUND","contact","company","deal","lead","import","firestore","app","crmFactsScope","request","orgId","String","trim","hostId","ok","status","error","staff","member","membership","uid","catch","reaches","Boolean","hostAccess","allowed","org","suite","body","group","visible","readable","Set","visibleTo","Array","isArray","some","token","has","orgCollection","name","collection","doc","rowsNaming","scope","input","snapshot","where","field","id","orderBy","direction","limit","get","docs","map","data","filter","row","pipelinesFor","deals","ids","pipelineId","snapshots","Promise","all","pipelines","Map","exists","visibleDoc","refused","kind","reader","read","crmContactFactsReader","naming","activities","tasks","facts","nowMs","now","getTime","crmCompanyFactsReader","companies","crmDealFactsReader","pipeline","crmLeadFactsReader","crmImportFactsReader","contactFields","definitions","definition","CRM_FACTS_READERS","registerCrmRecordFactsReaders","resource","factsReader","Object","entries","pluginId"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,+BAA+B,QAI1B,kDAAiD;AACxD,SACEC,eAAe,EACfC,mBAAmB,EACnBC,aAAa,EACbC,eAAe,QAQV,sBAAqB;AAC5B,SACEC,mBAAmB,EACnBC,aAAa,EACbC,SAAS,EACTC,sBAAsB,EACtBC,eAAe,EACfC,mBAAmB,EACnBC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,SAAS,QAAQ,gCAA4B;AACtD,SACEC,yBAAyB,EACzBC,0BAA0B,EAC1BC,YAAY,EACZC,YAAY,EACZC,SAAS,EACTC,WAAW,EACXC,0BAA0B,EAC1BC,SAAS,QAEJ,2BAAuB;AAC9B,SAASC,eAAe,QAAQ,kBAAc;AAiC9C,iEAAiE,GACjE,MAAMC,sBAAsB;AAE5B,8EAA8E,GAC9E,OAAO,MAAMC,4BAA4B,GAAE;AAC3C,yDAAyD,GACzD,OAAO,MAAMC,uBAAuB,GAAE;AACtC,uCAAuC,GACvC,OAAO,MAAMC,uBAAuB,GAAE;AACtC,sDAAsD,GACtD,OAAO,MAAMC,mCAAmC,IAAG;AAEnD,OAAO,MAAMC,yBAAyB,eAAc;AACpD,OAAO,MAAMC,yBAAyB,4CAA2C;AACjF,OAAO,MAAMC,yBAAyB,uEAAsE;AAC5G,OAAO,MAAMC,wBACX,6GAA4G;AAC9G,OAAO,MAAMC,4BAA4B,8CAA6C;AAEtF,MAAMC,YAA2D;IAC/DC,SAAS;IACTC,SAAS;IACTC,MAAM;IACNC,MAAM;IACNC,QAAQ;AACV;AAaA,SAASC;IACP,OAAOhC,cAAciC,GAAG,GAAGD,SAAS;AACtC;AAEA;;;CAGC,GACD,OAAO,eAAeE,cAAcC,OAAiC;QAC9CA,gBAkBPA;IAlBd,MAAMC,QAAQC,QAAOF,iBAAAA,QAAQC,KAAK,YAAbD,iBAAiB,IAAIG,IAAI;IAC9C,MAAMC,SAASJ,QAAQI,MAAM,GAAGF,OAAOF,QAAQI,MAAM,EAAED,IAAI,KAAK;IAChE,IAAI,CAACF,OAAO,OAAO;QAAEI,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAyB;IAC7E,IAAIH,UAAU,AAAC,MAAMnC,oBAAoBmC,YAAaH,OAAO;QAC3D,OAAO;YAAEI,IAAI;YAAOC,QAAQ;YAAKC,OAAOrB;QAAuB;IACjE;IACA,IAAI,CAACc,QAAQQ,KAAK,EAAE;YAKqBC;QAJvC,MAAMC,aAAa,MAAMxC,qBAAqB8B,QAAQW,GAAG,EAAEV,OAAOW,KAAK,CAAC,IAAM;QAC9E,MAAMH,SAASC,CAAAA,8BAAAA,WAAYT,KAAK,MAAKA,QAAQS,WAAWD,MAAM,GAAG;QACjE,IAAI,CAACA,QAAQ,OAAO;YAAEJ,IAAI;YAAOC,QAAQ;YAAKC,OAAOpB;QAAuB;QAC5E,MAAM0B,UAAUT,SACZzC,gBAAgB8C,WAAWK,SAAQL,qBAAAA,OAAOM,UAAU,qBAAjBN,kBAAmB,CAACL,OAAO,IAC9DzC,gBAAgB8C;QACpB,MAAMO,UAAUH,WAAY,MAAM9C,uBAAuBkC,OAAOQ,QAAQ;QACxE,IAAI,CAACO,SAAS;YACZ,OAAO;gBAAEX,IAAI;gBAAOC,QAAQ;gBAAKC,OAAOH,SAAShB,yBAAyBC;YAAsB;QAClG;IACF;IACA,MAAM4B,MAAM,EAAEjB,eAAAA,QAAQiB,GAAG,YAAXjB,eAAiC,MAAMlC,UAAUmC,WAA4B;IAC3F,IAAI,CAACgB,KAAK,OAAO;QAAEZ,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAuB;IACzE,MAAMW,QAAQtC,gBAAgBqC,KAAK;IACnC,IAAIC,OAAO,OAAO;QAAEb,IAAI;QAAOC,QAAQ;QAAKC,OAAOW,MAAMC,IAAI,CAACZ,KAAK;IAAC;IACpE,IAAI,CAACH,QAAQ,OAAO;QAAEH;QAAOG,QAAQ;QAAMa;QAAKG,OAAO;QAAMC,SAAS,IAAM;IAAK;IACjF,MAAMD,QAAQ,MAAMxD,oBAAoBwC,QAAQa;IAChD,MAAMK,WAAW,IAAIC,IAAY7D,cAAc0D;IAC/C,OAAO;QACLnB;QACAG;QACAa;QACAG;QACAC,SAAS,CAACG,YACRC,MAAMC,OAAO,CAACF,cAAcA,UAAUG,IAAI,CAAC,CAACC,QAAUN,SAASO,GAAG,CAAC3B,OAAO0B;IAC9E;AACF;AAEA,MAAME,gBAAgB,CAAC7B,OAAe8B,OACpClC,YAAYmC,UAAU,CAAC,QAAQC,GAAG,CAAChC,OAAO+B,UAAU,CAACD;AAEvD,iFAAiF,GACjF,eAAeG,WACbC,KAAoB,EACpBC,KAAmH;IAEnH,MAAMC,WAAW,MAAMP,cAAcK,MAAMlC,KAAK,EAAEmC,MAAMJ,UAAU,EAC/DM,KAAK,CAACF,MAAMG,KAAK,EAAE,MAAMH,MAAMI,EAAE,EACjCC,OAAO,CAACL,MAAMK,OAAO,EAAEL,MAAMM,SAAS,EACtCC,KAAK,CAACP,MAAMO,KAAK,EACjBC,GAAG;IACN,OAAOP,SAASQ,IAAI,CACjBC,GAAG,CAAC,CAACb;YAASA;gBAAAA,YAAAA,IAAIc,IAAI,cAARd,YAAc,CAAC;OAC7Be,MAAM,CAAC,CAACC,MAAQd,MAAMd,OAAO,CAAC4B,GAAG,CAAC,YAAY;AACnD;AAEA,0DAA0D,GAC1D,eAAeC,aAAaf,KAAoB,EAAEgB,KAAsC;IACtF,MAAMC,MAAM;WAAI,IAAI7B,IAAI4B,MAAML,GAAG,CAAC,CAACpD;gBAAgBA;mBAAPQ,QAAOR,mBAAAA,KAAK2D,UAAU,YAAf3D,mBAAmB;WAAKsD,MAAM,CAAClC;KAAU;IAC5F,MAAMwC,YAAY,MAAMC,QAAQC,GAAG,CAACJ,IAAIN,GAAG,CAAC,CAACN,KAAOV,cAAcK,MAAMlC,KAAK,EAAEzC,gBAAgBiG,SAAS,EAAExB,GAAG,CAACO,IAAII,GAAG;IACrH,OAAO,IAAIc,IACTJ,UACGN,MAAM,CAAC,CAACX,WAAaA,SAASsB,MAAM,EACpCb,GAAG,CAAC,CAACT;YAA4BA;eAAf;YAACA,SAASG,EAAE;aAAGH,iBAAAA,SAASU,IAAI,cAAbV,iBAAmB,CAAC;SAAkB;;AAE9E;AAEA,qDAAqD,GACrD,eAAeuB,WAAWzB,KAAoB,EAAEH,UAAkB,EAAEQ,EAAU;QAG3CH;IAFjC,IAAI,CAACG,IAAI,OAAO;IAChB,MAAMH,WAAW,MAAMP,cAAcK,MAAMlC,KAAK,EAAE+B,YAAYC,GAAG,CAACO,IAAII,GAAG;IACzE,MAAMG,OAAOV,SAASsB,MAAM,IAAKtB,iBAAAA,SAASU,IAAI,cAAbV,iBAAmB,CAAC,IAAc;IACnE,OAAOU,QAAQZ,MAAMd,OAAO,CAAC0B,IAAI,CAAC,YAAY,IAAIA,OAAO;AAC3D;AAEA,MAAMc,UAAU,CAACC,MAAqCxD,SAAoB,GAAG,GAAe,CAAA;QAC1FD,IAAI;QACJC;QACAC,OAAOhB,SAAS,CAACuE,KAAK;IACxB,CAAA;AAEA,4DAA4D,GAC5D,SAASC,OAAOC,IAAiG;IAC/G,OAAO;QACLA,MAAM,OAAOhE;YACX,MAAMmC,QAAQ,MAAMpC,cAAcC;YAClC,IAAI,QAAQmC,OAAO,OAAOA;YAC1B,OAAO6B,KAAK7B,OAAOnC;QACrB;IACF;AACF;AAEA,OAAO,MAAMiE,wBAAwBF,OAAO,OAAO5B,OAAOnC;QACtCA,aAGJmC;IAHd,MAAMK,KAAKtC,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IACxC,MAAM8C,MAAM,MAAMW,WAAWzB,OAAOtD,qBAAqB2D;IACzD,IAAI,CAACS,KAAK,OAAOY,QAAQ;IACzB,MAAMzC,SAAQe,eAAAA,MAAMf,KAAK,YAAXe,eAAe1E,oBAAoBwF,KAAKd,MAAMlB,GAAG;IAC/D,MAAMiD,SAAS;QAAE3B,OAAO;QAAaC;IAAG;IACxC,MAAM,CAAC2B,YAAYC,OAAOjB,MAAM,GAAG,MAAMI,QAAQC,GAAG,CAAC;QACnDtB,WAAwBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB2G,UAAU;YAAE1B,SAAS;YAAQC,WAAW;YAAQC,OAAO7D;;QAC/HoD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB4G,KAAK;YAAE3B,SAAS;YAAWC,WAAW;YAAOC,OAAO5D;;QACxHmD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB2F,KAAK;YAAEV,SAAS;YAAaC,WAAW;YAAQC,OAAO3D;;KAC5H;IACD,MAAMyE,YAAY,MAAMP,aAAaf,OAAOgB;IAC5C,OAAO;QACL9C,IAAI;QACJgE,OAAO,aAAK9F,aAAa;YAAE0E;YAAK7B;YAAO+C;YAAYC;YAAOjB;YAAOM;YAAWa,OAAOtE,QAAQuE,GAAG,CAACC,OAAO;QAAG;IAC3G;AACF,GAAE;AAEF,OAAO,MAAMC,wBAAwBV,OAAO,OAAO5B,OAAOnC;QACtCA;IAAlB,MAAMwC,KAAKtC,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IACxC,MAAMV,UAAU,MAAMmE,WAAWzB,OAAO3E,gBAAgBkH,SAAS,EAAElC;IACnE,IAAI,CAAC/C,SAAS,OAAOoE,QAAQ;IAC7B,MAAMK,SAAS;QAAE3B,OAAO;QAAaC;IAAG;IACxC,MAAM,CAAC2B,YAAYC,OAAOjB,MAAM,GAAG,MAAMI,QAAQC,GAAG,CAAC;QACnDtB,WAAwBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB2G,UAAU;YAAE1B,SAAS;YAAQC,WAAW;YAAQC,OAAO7D;;QAC/HoD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB4G,KAAK;YAAE3B,SAAS;YAAWC,WAAW;YAAOC,OAAO5D;;QACxHmD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB2F,KAAK;YAAEV,SAAS;YAAaC,WAAW;YAAQC,OAAO3D;;KAC5H;IACD,MAAMyE,YAAY,MAAMP,aAAaf,OAAOgB;IAC5C,OAAO;QACL9C,IAAI;QACJgE,OAAO,aACF/F,aAAa;YAAEmB,SAASA;YAAgC0E;YAAYC;YAAOjB;YAAOM;YAAWa,OAAOtE,QAAQuE,GAAG,CAACC,OAAO;QAAG;IAEjI;AACF,GAAE;AAEF,OAAO,MAAMG,qBAAqBZ,OAAO,OAAO5B,OAAOnC;QACnCA,aAcFyD,gBAAqB/D;IAdrC,MAAM8C,KAAKtC,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IACxC,MAAMT,OAAQ,MAAMkE,WAAWzB,OAAO3E,gBAAgB2F,KAAK,EAAEX;IAC7D,IAAI,CAAC9C,MAAM,OAAOmE,QAAQ;IAC1B,MAAMK,SAAS;QAAE3B,OAAO;QAAUC;IAAG;IACrC,MAAM,CAAC2B,YAAYC,OAAOX,UAAU,GAAG,MAAMF,QAAQC,GAAG,CAAC;QACvDtB,WAAwBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB2G,UAAU;YAAE1B,SAAS;YAAQC,WAAW;YAAQC,OAAO7D;;QAC/HoD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB4G,KAAK;YAAE3B,SAAS;YAAWC,WAAW;YAAOC,OAAO5D;;QACxHmE,aAAaf,OAAO;YAACzC;SAAK;KAC3B;IACD,OAAO;QACLW,IAAI;QACJgE,OAAO,aACF7F,UAAU;YACXkB;YACAkF,QAAQ,GAAEnB,iBAAAA,UAAUb,GAAG,CAAC1C,QAAOR,mBAAAA,KAAK2D,UAAU,YAAf3D,mBAAmB,gBAAxC+D,iBAAgD;YAC1DU;YACAC;YACAE,OAAOtE,QAAQuE,GAAG,CAACC,OAAO;QAC5B;IAEJ;AACF,GAAE;AAEF,OAAO,MAAMK,qBAAqBd,OAAO,OAAO5B,OAAOnC;QAEnCA,aAYgCqC;IAblD,IAAI,CAACF,MAAM/B,MAAM,EAAE,OAAO;QAAEC,IAAI;QAAOC,QAAQ;QAAKC,OAAOjB;IAA0B;IACrF,MAAMkD,KAAKtC,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IACxC,IAAI,CAACqC,IAAI,OAAOqB,QAAQ;IACxB,MAAMxB,WAAW,MAAMrE,gBAAgBmE,MAAM/B,MAAM,EAAEoC;IACrD,IAAI,CAACH,UAAU,OAAOwB,QAAQ;IAC9B,MAAMM,aAAa,MAAMjC,WAAwBC,OAAO;QACtDI,OAAO;QACPC;QACAR,YAAYxE,gBAAgB2G,UAAU;QACtC1B,SAAS;QACTC,WAAW;QACXC,OAAO7D;IACT;IACA,OAAO;QAAEuB,IAAI;QAAMgE,OAAO,aAAK1F,UAAU;YAAEgB,IAAI,GAAG0C,iBAAAA,SAASU,IAAI,cAAbV,iBAAmB,CAAC;YAAY8B;QAAW;IAAK;AACpG,GAAE;AAEF,OAAO,MAAMW,uBAAuBf,OAAO,OAAO5B,OAAOnC;QAC7BA;IAA1B,MAAMgC,aAAa9B,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IAChD,IAAI,CAACzB,2BAA2BsD,aAAa,OAAO6B,QAAQ,UAAU;IACtE,MAAMxB,WAAW,MAAMP,cAAcK,MAAMlC,KAAK,EAAEzC,gBAAgBuH,aAAa,EAC5EpC,KAAK,CAAC1D,kCACN2D,GAAG;IACN,MAAMoC,cAAc3C,SAASQ,IAAI,CAC9BC,GAAG,CAAC,CAACb;YAASA;gBAAAA,YAAAA,IAAIc,IAAI,cAARd,YAAc,CAAC;OAC7Be,MAAM,CAAC,CAACiC,aAAe9C,MAAMd,OAAO,CAAC4D,UAAU,CAAC,YAAY;IAC/D,OAAO;QAAE5E,IAAI;QAAMgE,OAAO,aAAK5F,YAAYuD,YAAYgD;IAAe;AACxE,GAAE;AAEF,0DAA0D,GAC1D,OAAO,MAAME,oBAAuE;IAClF,CAAC7G,2BAA2BmB,OAAO,CAAC,EAAEyE;IACtC,CAAC5F,2BAA2BoB,OAAO,CAAC,EAAEgF;IACtC,CAACpG,2BAA2BqB,IAAI,CAAC,EAAEiF;IACnC,CAACtG,2BAA2BsB,IAAI,CAAC,EAAEkF;IACnC,CAACzG,0BAA0B,EAAE0G;AAC/B,EAAC;AAED;;;CAGC,GACD,OAAO,SAASK;IACd,KAAK,MAAM,CAACC,UAAUC,YAAY,IAAIC,OAAOC,OAAO,CAACL,mBAAoB;QACvE3H,gCAAgC6H,UAAUC,aAAa;YAAEG,UAAUrH;QAAU;IAC/E;AACF"}
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/record-facts.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  registerPluginRecordFactsReader,\n  type PluginRecordFactsRead,\n  type PluginRecordFactsReader,\n  type PluginRecordFactsRequest,\n} from '@aglyn/aglyn/plugin-manager/plugin-record-facts'\nimport {\n  CRM_COLLECTIONS,\n  crmReadTokens,\n  isOrgWideMember,\n  type ConsentGroup,\n  type ContactFieldDefinition,\n  type CrmActivity,\n  type CrmCompany,\n  type CrmDeal,\n  type CrmPipeline,\n  type CrmTask,\n} from '@aglyn/aglyn/server'\nimport {\n  consentGroupForSite,\n  firebaseAdmin,\n  getOrgDoc,\n  memberHasOrgPermission,\n  readLeadForHost,\n  resolveOrgIdForHost,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin'\nimport { BUNDLE_ID } from '../constants/bundle-common'\nimport {\n  CRM_IMPORT_FACTS_RESOURCE,\n  CRM_RECORD_FACTS_RESOURCES,\n  companyFacts,\n  contactFacts,\n  dealFacts,\n  importFacts,\n  isCrmImportFactsCollection,\n  leadFacts,\n  type CrmRecordFactsKind,\n} from '../model/record-facts'\nimport { crmSuiteRefusal } from './suite-gate'\nimport { contactPrimaryGroup } from '../model/contact-holder'\n\n/**\n * THE CRM'S READERS ON THE CORE'S RECORD-FACTS SEAM (AGL-2917).\n *\n * Another plugin asks for a contact, a company, a deal, a lead or an import's\n * field catalog by resource name, and gets the facts `model/record-facts.ts`\n * reports — read here with the rules every other CRM door applies, for the\n * member the caller names:\n *\n *  1. the site belongs to the organization;\n *  2. the member reaches it — an org-wide member at the organization level, a\n *     member of that site under it — and holds `data.manage`, the key the\n *     whole CRM is gated on. A verified staff caller passes, as at every CRM\n *     route;\n *  3. the organization's plan carries the CRM, asked after the caller is\n *     known, the order `suite-gate.ts` gives;\n *  4. the record exists and is visible where it is read: under a site, its\n *     `visibleTo` meets the site's read tokens, as the console's listeners\n *     filter; at the organization level every row is the member's;\n *  5. what hangs off it — its logged activity, its tasks, its deals — is held\n *     to the same visibility, row by row.\n *\n * A caller in the same process skips the plugin API dispatcher, and with it\n * the dispatcher's per-site enablement, release flag, lockdown and rate\n * limit; those are the caller's to establish before it asks (the AI plugin's\n * CRM admission does). Nothing here writes.\n */\n\ntype Firestore = FirebaseFirestore.Firestore\ntype Data = Record<string, unknown>\ntype Refusal = { ok: false; status: 400 | 403 | 404; error: string }\n\n/** The org collection a contact lives in, beside the CRM's own. */\nconst CONTACTS_COLLECTION = 'contacts'\n\n/** Logged activities read per record before visibility and the timeline cut. */\nexport const CRM_FACTS_ACTIVITIES_READ = 40\n/** Tasks read per record, the record page's own window. */\nexport const CRM_FACTS_TASKS_READ = 50\n/** Deals read per contact or company. */\nexport const CRM_FACTS_DEALS_READ = 20\n/** Custom field definitions an import catalog reads. */\nexport const CRM_FACTS_FIELD_DEFINITIONS_READ = 100\n\nexport const CRM_FACTS_UNKNOWN_SITE = 'Unknown site'\nexport const CRM_FACTS_NOT_A_MEMBER = 'You are not a member of that organization'\nexport const CRM_FACTS_SITE_REFUSAL = 'Reading CRM records requires the data.manage permission on this site'\nexport const CRM_FACTS_ORG_REFUSAL =\n  'Reading CRM records across the organization requires the data.manage permission for the whole organization'\nexport const CRM_FACTS_LEAD_NEEDS_SITE = 'A lead is read on the site that captured it'\n\nconst NOT_FOUND: Record<CrmRecordFactsKind | 'import', string> = {\n  contact: 'This contact could not be found. It may have been deleted.',\n  company: 'This company could not be found. It may have been deleted.',\n  deal: 'This deal could not be found. It may have been deleted.',\n  lead: 'This lead could not be found. It may have been removed.',\n  import: 'There is no such import.',\n}\n\n/** Where a read runs, once the caller has been admitted. */\ninterface CrmFactsScope {\n  orgId: string\n  hostId: string | null\n  org: Data\n  /** The site's consent group under a site; `null` at the organization level. */\n  group: ConsentGroup | null\n  /** Whether a row's `visibleTo` is readable here. */\n  visible: (visibleTo: unknown) => boolean\n}\n\nfunction firestore(): Firestore {\n  return firebaseAdmin.app().firestore()\n}\n\n/**\n * Rules 1 to 3: the site, the member and the plan. A refusal names what the\n * member lacks in the words the console's own CRM doors use.\n */\nexport async function crmFactsScope(request: PluginRecordFactsRequest): Promise<CrmFactsScope | Refusal> {\n  const orgId = String(request.orgId ?? '').trim()\n  const hostId = request.hostId ? String(request.hostId).trim() : null\n  if (!orgId) return { ok: false, status: 400, error: 'Open a workspace first' }\n  if (hostId && (await resolveOrgIdForHost(hostId)) !== orgId) {\n    return { ok: false, status: 404, error: CRM_FACTS_UNKNOWN_SITE }\n  }\n  if (!request.staff) {\n    const membership = await resolveOrgMembership(request.uid, orgId).catch(() => null)\n    const member = membership?.orgId === orgId ? membership.member : null\n    if (!member) return { ok: false, status: 403, error: CRM_FACTS_NOT_A_MEMBER }\n    const reaches = hostId\n      ? isOrgWideMember(member) || Boolean(member.hostAccess?.[hostId])\n      : isOrgWideMember(member)\n    const allowed = reaches && (await memberHasOrgPermission(orgId, member, 'data.manage'))\n    if (!allowed) {\n      return { ok: false, status: 403, error: hostId ? CRM_FACTS_SITE_REFUSAL : CRM_FACTS_ORG_REFUSAL }\n    }\n  }\n  const org = ((request.org as Data | null) ?? ((await getOrgDoc(orgId)) as Data | null)) || null\n  if (!org) return { ok: false, status: 404, error: 'Unknown organization' }\n  const suite = crmSuiteRefusal(org, 'Reading a CRM record')\n  if (suite) return { ok: false, status: 403, error: suite.body.error }\n  if (!hostId) return { orgId, hostId: null, org, group: null, visible: () => true }\n  const group = await consentGroupForSite(hostId, org)\n  const readable = new Set<string>(crmReadTokens(group))\n  return {\n    orgId,\n    hostId,\n    org,\n    group,\n    visible: (visibleTo) =>\n      Array.isArray(visibleTo) && visibleTo.some((token) => readable.has(String(token))),\n  }\n}\n\nconst orgCollection = (orgId: string, name: string) =>\n  firestore().collection('orgs').doc(orgId).collection(name)\n\n/** Rows of an org collection naming one record, held to the scope's visibility. */\nasync function rowsNaming<T>(\n  scope: CrmFactsScope,\n  input: { collection: string; field: string; id: string; orderBy: string; direction: 'asc' | 'desc'; limit: number },\n): Promise<T[]> {\n  const snapshot = await orgCollection(scope.orgId, input.collection)\n    .where(input.field, '==', input.id)\n    .orderBy(input.orderBy, input.direction)\n    .limit(input.limit)\n    .get()\n  return snapshot.docs\n    .map((doc) => (doc.data() ?? {}) as Data)\n    .filter((row) => scope.visible(row['visibleTo'])) as T[]\n}\n\n/** The pipelines some deals name, by id, read once each. */\nasync function pipelinesFor(scope: CrmFactsScope, deals: ReadonlyArray<Partial<CrmDeal>>): Promise<Map<string, CrmPipeline>> {\n  const ids = [...new Set(deals.map((deal) => String(deal.pipelineId ?? '')).filter(Boolean))]\n  const snapshots = await Promise.all(ids.map((id) => orgCollection(scope.orgId, CRM_COLLECTIONS.pipelines).doc(id).get()))\n  return new Map(\n    snapshots\n      .filter((snapshot) => snapshot.exists)\n      .map((snapshot) => [snapshot.id, (snapshot.data() ?? {}) as CrmPipeline]),\n  )\n}\n\n/** A record document the scope may read, or `null`. */\nasync function visibleDoc(scope: CrmFactsScope, collection: string, id: string): Promise<Data | null> {\n  if (!id) return null\n  const snapshot = await orgCollection(scope.orgId, collection).doc(id).get()\n  const data = snapshot.exists ? ((snapshot.data() ?? {}) as Data) : null\n  return data && scope.visible(data['visibleTo']) ? data : null\n}\n\nconst refused = (kind: CrmRecordFactsKind | 'import', status: 400 | 404 = 404): Refusal => ({\n  ok: false,\n  status,\n  error: NOT_FOUND[kind],\n})\n\n/** A reader that admits the caller, then reads the record. */\nfunction reader(read: (scope: CrmFactsScope, request: PluginRecordFactsRequest) => Promise<PluginRecordFactsRead>): PluginRecordFactsReader {\n  return {\n    read: async (request) => {\n      const scope = await crmFactsScope(request)\n      if ('ok' in scope) return scope\n      return read(scope, request)\n    },\n  }\n}\n\nexport const crmContactFactsReader = reader(async (scope, request) => {\n  const id = String(request.id ?? '').trim()\n  const row = await visibleDoc(scope, CONTACTS_COLLECTION, id)\n  if (!row) return refused('contact')\n  const group = scope.group ?? contactPrimaryGroup(row, scope.org)\n  const naming = { field: 'contactId', id }\n  const [activities, tasks, deals] = await Promise.all([\n    rowsNaming<CrmActivity>(scope, { ...naming, collection: CRM_COLLECTIONS.activities, orderBy: 'atMs', direction: 'desc', limit: CRM_FACTS_ACTIVITIES_READ }),\n    rowsNaming<CrmTask>(scope, { ...naming, collection: CRM_COLLECTIONS.tasks, orderBy: 'dueAtMs', direction: 'asc', limit: CRM_FACTS_TASKS_READ }),\n    rowsNaming<CrmDeal>(scope, { ...naming, collection: CRM_COLLECTIONS.deals, orderBy: 'updatedAt', direction: 'desc', limit: CRM_FACTS_DEALS_READ }),\n  ])\n  const pipelines = await pipelinesFor(scope, deals)\n  return {\n    ok: true,\n    facts: { ...contactFacts({ row, group, activities, tasks, deals, pipelines, nowMs: request.now.getTime() }) },\n  }\n})\n\nexport const crmCompanyFactsReader = reader(async (scope, request) => {\n  const id = String(request.id ?? '').trim()\n  const company = await visibleDoc(scope, CRM_COLLECTIONS.companies, id)\n  if (!company) return refused('company')\n  const naming = { field: 'companyId', id }\n  const [activities, tasks, deals] = await Promise.all([\n    rowsNaming<CrmActivity>(scope, { ...naming, collection: CRM_COLLECTIONS.activities, orderBy: 'atMs', direction: 'desc', limit: CRM_FACTS_ACTIVITIES_READ }),\n    rowsNaming<CrmTask>(scope, { ...naming, collection: CRM_COLLECTIONS.tasks, orderBy: 'dueAtMs', direction: 'asc', limit: CRM_FACTS_TASKS_READ }),\n    rowsNaming<CrmDeal>(scope, { ...naming, collection: CRM_COLLECTIONS.deals, orderBy: 'updatedAt', direction: 'desc', limit: CRM_FACTS_DEALS_READ }),\n  ])\n  const pipelines = await pipelinesFor(scope, deals)\n  return {\n    ok: true,\n    facts: {\n      ...companyFacts({ company: company as Partial<CrmCompany>, activities, tasks, deals, pipelines, nowMs: request.now.getTime() }),\n    },\n  }\n})\n\nexport const crmDealFactsReader = reader(async (scope, request) => {\n  const id = String(request.id ?? '').trim()\n  const deal = (await visibleDoc(scope, CRM_COLLECTIONS.deals, id)) as (Partial<CrmDeal> & Data) | null\n  if (!deal) return refused('deal')\n  const naming = { field: 'dealId', id }\n  const [activities, tasks, pipelines] = await Promise.all([\n    rowsNaming<CrmActivity>(scope, { ...naming, collection: CRM_COLLECTIONS.activities, orderBy: 'atMs', direction: 'desc', limit: CRM_FACTS_ACTIVITIES_READ }),\n    rowsNaming<CrmTask>(scope, { ...naming, collection: CRM_COLLECTIONS.tasks, orderBy: 'dueAtMs', direction: 'asc', limit: CRM_FACTS_TASKS_READ }),\n    pipelinesFor(scope, [deal]),\n  ])\n  return {\n    ok: true,\n    facts: {\n      ...dealFacts({\n        deal,\n        pipeline: pipelines.get(String(deal.pipelineId ?? '')) ?? null,\n        activities,\n        tasks,\n        nowMs: request.now.getTime(),\n      }),\n    },\n  }\n})\n\nexport const crmLeadFactsReader = reader(async (scope, request) => {\n  if (!scope.hostId) return { ok: false, status: 400, error: CRM_FACTS_LEAD_NEEDS_SITE }\n  const id = String(request.id ?? '').trim()\n  if (!id) return refused('lead')\n  const snapshot = await readLeadForHost(scope.hostId, id)\n  if (!snapshot) return refused('lead')\n  const activities = await rowsNaming<CrmActivity>(scope, {\n    field: 'leadId',\n    id,\n    collection: CRM_COLLECTIONS.activities,\n    orderBy: 'atMs',\n    direction: 'desc',\n    limit: CRM_FACTS_ACTIVITIES_READ,\n  })\n  return { ok: true, facts: { ...leadFacts({ lead: (snapshot.data() ?? {}) as Data, activities }) } }\n})\n\nexport const crmImportFactsReader = reader(async (scope, request) => {\n  const collection = String(request.id ?? '').trim()\n  if (!isCrmImportFactsCollection(collection)) return refused('import', 400)\n  const snapshot = await orgCollection(scope.orgId, CRM_COLLECTIONS.contactFields)\n    .limit(CRM_FACTS_FIELD_DEFINITIONS_READ)\n    .get()\n  const definitions = snapshot.docs\n    .map((doc) => (doc.data() ?? {}) as Partial<ContactFieldDefinition> & Data)\n    .filter((definition) => scope.visible(definition['visibleTo']))\n  return { ok: true, facts: { ...importFacts(collection, definitions) } }\n})\n\n/** Every reader this plugin registers, by resource name. */\nexport const CRM_FACTS_READERS: Readonly<Record<string, PluginRecordFactsReader>> = {\n  [CRM_RECORD_FACTS_RESOURCES.contact]: crmContactFactsReader,\n  [CRM_RECORD_FACTS_RESOURCES.company]: crmCompanyFactsReader,\n  [CRM_RECORD_FACTS_RESOURCES.deal]: crmDealFactsReader,\n  [CRM_RECORD_FACTS_RESOURCES.lead]: crmLeadFactsReader,\n  [CRM_IMPORT_FACTS_RESOURCE]: crmImportFactsReader,\n}\n\n/**\n * Registers the readers; the console surface calls it, the one process that\n * runs AI jobs (AGL-3026). Idempotent: a second call replaces the first.\n */\nexport function registerCrmRecordFactsReaders(): void {\n  for (const [resource, factsReader] of Object.entries(CRM_FACTS_READERS)) {\n    registerPluginRecordFactsReader(resource, factsReader, { pluginId: BUNDLE_ID })\n  }\n}\n"],"names":["registerPluginRecordFactsReader","CRM_COLLECTIONS","crmReadTokens","isOrgWideMember","consentGroupForSite","firebaseAdmin","getOrgDoc","memberHasOrgPermission","readLeadForHost","resolveOrgIdForHost","resolveOrgMembership","BUNDLE_ID","CRM_IMPORT_FACTS_RESOURCE","CRM_RECORD_FACTS_RESOURCES","companyFacts","contactFacts","dealFacts","importFacts","isCrmImportFactsCollection","leadFacts","crmSuiteRefusal","contactPrimaryGroup","CONTACTS_COLLECTION","CRM_FACTS_ACTIVITIES_READ","CRM_FACTS_TASKS_READ","CRM_FACTS_DEALS_READ","CRM_FACTS_FIELD_DEFINITIONS_READ","CRM_FACTS_UNKNOWN_SITE","CRM_FACTS_NOT_A_MEMBER","CRM_FACTS_SITE_REFUSAL","CRM_FACTS_ORG_REFUSAL","CRM_FACTS_LEAD_NEEDS_SITE","NOT_FOUND","contact","company","deal","lead","import","firestore","app","crmFactsScope","request","orgId","String","trim","hostId","ok","status","error","staff","member","membership","uid","catch","reaches","Boolean","hostAccess","allowed","org","suite","body","group","visible","readable","Set","visibleTo","Array","isArray","some","token","has","orgCollection","name","collection","doc","rowsNaming","scope","input","snapshot","where","field","id","orderBy","direction","limit","get","docs","map","data","filter","row","pipelinesFor","deals","ids","pipelineId","snapshots","Promise","all","pipelines","Map","exists","visibleDoc","refused","kind","reader","read","crmContactFactsReader","naming","activities","tasks","facts","nowMs","now","getTime","crmCompanyFactsReader","companies","crmDealFactsReader","pipeline","crmLeadFactsReader","crmImportFactsReader","contactFields","definitions","definition","CRM_FACTS_READERS","registerCrmRecordFactsReaders","resource","factsReader","Object","entries","pluginId"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,+BAA+B,QAI1B,kDAAiD;AACxD,SACEC,eAAe,EACfC,aAAa,EACbC,eAAe,QAQV,sBAAqB;AAC5B,SACEC,mBAAmB,EACnBC,aAAa,EACbC,SAAS,EACTC,sBAAsB,EACtBC,eAAe,EACfC,mBAAmB,EACnBC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,SAAS,QAAQ,gCAA4B;AACtD,SACEC,yBAAyB,EACzBC,0BAA0B,EAC1BC,YAAY,EACZC,YAAY,EACZC,SAAS,EACTC,WAAW,EACXC,0BAA0B,EAC1BC,SAAS,QAEJ,2BAAuB;AAC9B,SAASC,eAAe,QAAQ,kBAAc;AAC9C,SAASC,mBAAmB,QAAQ,6BAAyB;AAiC7D,iEAAiE,GACjE,MAAMC,sBAAsB;AAE5B,8EAA8E,GAC9E,OAAO,MAAMC,4BAA4B,GAAE;AAC3C,yDAAyD,GACzD,OAAO,MAAMC,uBAAuB,GAAE;AACtC,uCAAuC,GACvC,OAAO,MAAMC,uBAAuB,GAAE;AACtC,sDAAsD,GACtD,OAAO,MAAMC,mCAAmC,IAAG;AAEnD,OAAO,MAAMC,yBAAyB,eAAc;AACpD,OAAO,MAAMC,yBAAyB,4CAA2C;AACjF,OAAO,MAAMC,yBAAyB,uEAAsE;AAC5G,OAAO,MAAMC,wBACX,6GAA4G;AAC9G,OAAO,MAAMC,4BAA4B,8CAA6C;AAEtF,MAAMC,YAA2D;IAC/DC,SAAS;IACTC,SAAS;IACTC,MAAM;IACNC,MAAM;IACNC,QAAQ;AACV;AAaA,SAASC;IACP,OAAOjC,cAAckC,GAAG,GAAGD,SAAS;AACtC;AAEA;;;CAGC,GACD,OAAO,eAAeE,cAAcC,OAAiC;QAC9CA,gBAkBPA;IAlBd,MAAMC,QAAQC,QAAOF,iBAAAA,QAAQC,KAAK,YAAbD,iBAAiB,IAAIG,IAAI;IAC9C,MAAMC,SAASJ,QAAQI,MAAM,GAAGF,OAAOF,QAAQI,MAAM,EAAED,IAAI,KAAK;IAChE,IAAI,CAACF,OAAO,OAAO;QAAEI,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAyB;IAC7E,IAAIH,UAAU,AAAC,MAAMpC,oBAAoBoC,YAAaH,OAAO;QAC3D,OAAO;YAAEI,IAAI;YAAOC,QAAQ;YAAKC,OAAOrB;QAAuB;IACjE;IACA,IAAI,CAACc,QAAQQ,KAAK,EAAE;YAKqBC;QAJvC,MAAMC,aAAa,MAAMzC,qBAAqB+B,QAAQW,GAAG,EAAEV,OAAOW,KAAK,CAAC,IAAM;QAC9E,MAAMH,SAASC,CAAAA,8BAAAA,WAAYT,KAAK,MAAKA,QAAQS,WAAWD,MAAM,GAAG;QACjE,IAAI,CAACA,QAAQ,OAAO;YAAEJ,IAAI;YAAOC,QAAQ;YAAKC,OAAOpB;QAAuB;QAC5E,MAAM0B,UAAUT,SACZ1C,gBAAgB+C,WAAWK,SAAQL,qBAAAA,OAAOM,UAAU,qBAAjBN,kBAAmB,CAACL,OAAO,IAC9D1C,gBAAgB+C;QACpB,MAAMO,UAAUH,WAAY,MAAM/C,uBAAuBmC,OAAOQ,QAAQ;QACxE,IAAI,CAACO,SAAS;YACZ,OAAO;gBAAEX,IAAI;gBAAOC,QAAQ;gBAAKC,OAAOH,SAAShB,yBAAyBC;YAAsB;QAClG;IACF;IACA,MAAM4B,MAAM,EAAEjB,eAAAA,QAAQiB,GAAG,YAAXjB,eAAiC,MAAMnC,UAAUoC,WAA4B;IAC3F,IAAI,CAACgB,KAAK,OAAO;QAAEZ,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAuB;IACzE,MAAMW,QAAQvC,gBAAgBsC,KAAK;IACnC,IAAIC,OAAO,OAAO;QAAEb,IAAI;QAAOC,QAAQ;QAAKC,OAAOW,MAAMC,IAAI,CAACZ,KAAK;IAAC;IACpE,IAAI,CAACH,QAAQ,OAAO;QAAEH;QAAOG,QAAQ;QAAMa;QAAKG,OAAO;QAAMC,SAAS,IAAM;IAAK;IACjF,MAAMD,QAAQ,MAAMzD,oBAAoByC,QAAQa;IAChD,MAAMK,WAAW,IAAIC,IAAY9D,cAAc2D;IAC/C,OAAO;QACLnB;QACAG;QACAa;QACAG;QACAC,SAAS,CAACG,YACRC,MAAMC,OAAO,CAACF,cAAcA,UAAUG,IAAI,CAAC,CAACC,QAAUN,SAASO,GAAG,CAAC3B,OAAO0B;IAC9E;AACF;AAEA,MAAME,gBAAgB,CAAC7B,OAAe8B,OACpClC,YAAYmC,UAAU,CAAC,QAAQC,GAAG,CAAChC,OAAO+B,UAAU,CAACD;AAEvD,iFAAiF,GACjF,eAAeG,WACbC,KAAoB,EACpBC,KAAmH;IAEnH,MAAMC,WAAW,MAAMP,cAAcK,MAAMlC,KAAK,EAAEmC,MAAMJ,UAAU,EAC/DM,KAAK,CAACF,MAAMG,KAAK,EAAE,MAAMH,MAAMI,EAAE,EACjCC,OAAO,CAACL,MAAMK,OAAO,EAAEL,MAAMM,SAAS,EACtCC,KAAK,CAACP,MAAMO,KAAK,EACjBC,GAAG;IACN,OAAOP,SAASQ,IAAI,CACjBC,GAAG,CAAC,CAACb;YAASA;gBAAAA,YAAAA,IAAIc,IAAI,cAARd,YAAc,CAAC;OAC7Be,MAAM,CAAC,CAACC,MAAQd,MAAMd,OAAO,CAAC4B,GAAG,CAAC,YAAY;AACnD;AAEA,0DAA0D,GAC1D,eAAeC,aAAaf,KAAoB,EAAEgB,KAAsC;IACtF,MAAMC,MAAM;WAAI,IAAI7B,IAAI4B,MAAML,GAAG,CAAC,CAACpD;gBAAgBA;mBAAPQ,QAAOR,mBAAAA,KAAK2D,UAAU,YAAf3D,mBAAmB;WAAKsD,MAAM,CAAClC;KAAU;IAC5F,MAAMwC,YAAY,MAAMC,QAAQC,GAAG,CAACJ,IAAIN,GAAG,CAAC,CAACN,KAAOV,cAAcK,MAAMlC,KAAK,EAAEzC,gBAAgBiG,SAAS,EAAExB,GAAG,CAACO,IAAII,GAAG;IACrH,OAAO,IAAIc,IACTJ,UACGN,MAAM,CAAC,CAACX,WAAaA,SAASsB,MAAM,EACpCb,GAAG,CAAC,CAACT;YAA4BA;eAAf;YAACA,SAASG,EAAE;aAAGH,iBAAAA,SAASU,IAAI,cAAbV,iBAAmB,CAAC;SAAkB;;AAE9E;AAEA,qDAAqD,GACrD,eAAeuB,WAAWzB,KAAoB,EAAEH,UAAkB,EAAEQ,EAAU;QAG3CH;IAFjC,IAAI,CAACG,IAAI,OAAO;IAChB,MAAMH,WAAW,MAAMP,cAAcK,MAAMlC,KAAK,EAAE+B,YAAYC,GAAG,CAACO,IAAII,GAAG;IACzE,MAAMG,OAAOV,SAASsB,MAAM,IAAKtB,iBAAAA,SAASU,IAAI,cAAbV,iBAAmB,CAAC,IAAc;IACnE,OAAOU,QAAQZ,MAAMd,OAAO,CAAC0B,IAAI,CAAC,YAAY,IAAIA,OAAO;AAC3D;AAEA,MAAMc,UAAU,CAACC,MAAqCxD,SAAoB,GAAG,GAAe,CAAA;QAC1FD,IAAI;QACJC;QACAC,OAAOhB,SAAS,CAACuE,KAAK;IACxB,CAAA;AAEA,4DAA4D,GAC5D,SAASC,OAAOC,IAAiG;IAC/G,OAAO;QACLA,MAAM,OAAOhE;YACX,MAAMmC,QAAQ,MAAMpC,cAAcC;YAClC,IAAI,QAAQmC,OAAO,OAAOA;YAC1B,OAAO6B,KAAK7B,OAAOnC;QACrB;IACF;AACF;AAEA,OAAO,MAAMiE,wBAAwBF,OAAO,OAAO5B,OAAOnC;QACtCA,aAGJmC;IAHd,MAAMK,KAAKtC,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IACxC,MAAM8C,MAAM,MAAMW,WAAWzB,OAAOtD,qBAAqB2D;IACzD,IAAI,CAACS,KAAK,OAAOY,QAAQ;IACzB,MAAMzC,SAAQe,eAAAA,MAAMf,KAAK,YAAXe,eAAevD,oBAAoBqE,KAAKd,MAAMlB,GAAG;IAC/D,MAAMiD,SAAS;QAAE3B,OAAO;QAAaC;IAAG;IACxC,MAAM,CAAC2B,YAAYC,OAAOjB,MAAM,GAAG,MAAMI,QAAQC,GAAG,CAAC;QACnDtB,WAAwBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB2G,UAAU;YAAE1B,SAAS;YAAQC,WAAW;YAAQC,OAAO7D;;QAC/HoD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB4G,KAAK;YAAE3B,SAAS;YAAWC,WAAW;YAAOC,OAAO5D;;QACxHmD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB2F,KAAK;YAAEV,SAAS;YAAaC,WAAW;YAAQC,OAAO3D;;KAC5H;IACD,MAAMyE,YAAY,MAAMP,aAAaf,OAAOgB;IAC5C,OAAO;QACL9C,IAAI;QACJgE,OAAO,aAAK/F,aAAa;YAAE2E;YAAK7B;YAAO+C;YAAYC;YAAOjB;YAAOM;YAAWa,OAAOtE,QAAQuE,GAAG,CAACC,OAAO;QAAG;IAC3G;AACF,GAAE;AAEF,OAAO,MAAMC,wBAAwBV,OAAO,OAAO5B,OAAOnC;QACtCA;IAAlB,MAAMwC,KAAKtC,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IACxC,MAAMV,UAAU,MAAMmE,WAAWzB,OAAO3E,gBAAgBkH,SAAS,EAAElC;IACnE,IAAI,CAAC/C,SAAS,OAAOoE,QAAQ;IAC7B,MAAMK,SAAS;QAAE3B,OAAO;QAAaC;IAAG;IACxC,MAAM,CAAC2B,YAAYC,OAAOjB,MAAM,GAAG,MAAMI,QAAQC,GAAG,CAAC;QACnDtB,WAAwBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB2G,UAAU;YAAE1B,SAAS;YAAQC,WAAW;YAAQC,OAAO7D;;QAC/HoD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB4G,KAAK;YAAE3B,SAAS;YAAWC,WAAW;YAAOC,OAAO5D;;QACxHmD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB2F,KAAK;YAAEV,SAAS;YAAaC,WAAW;YAAQC,OAAO3D;;KAC5H;IACD,MAAMyE,YAAY,MAAMP,aAAaf,OAAOgB;IAC5C,OAAO;QACL9C,IAAI;QACJgE,OAAO,aACFhG,aAAa;YAAEoB,SAASA;YAAgC0E;YAAYC;YAAOjB;YAAOM;YAAWa,OAAOtE,QAAQuE,GAAG,CAACC,OAAO;QAAG;IAEjI;AACF,GAAE;AAEF,OAAO,MAAMG,qBAAqBZ,OAAO,OAAO5B,OAAOnC;QACnCA,aAcFyD,gBAAqB/D;IAdrC,MAAM8C,KAAKtC,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IACxC,MAAMT,OAAQ,MAAMkE,WAAWzB,OAAO3E,gBAAgB2F,KAAK,EAAEX;IAC7D,IAAI,CAAC9C,MAAM,OAAOmE,QAAQ;IAC1B,MAAMK,SAAS;QAAE3B,OAAO;QAAUC;IAAG;IACrC,MAAM,CAAC2B,YAAYC,OAAOX,UAAU,GAAG,MAAMF,QAAQC,GAAG,CAAC;QACvDtB,WAAwBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB2G,UAAU;YAAE1B,SAAS;YAAQC,WAAW;YAAQC,OAAO7D;;QAC/HoD,WAAoBC,OAAO,aAAK+B;YAAQlC,YAAYxE,gBAAgB4G,KAAK;YAAE3B,SAAS;YAAWC,WAAW;YAAOC,OAAO5D;;QACxHmE,aAAaf,OAAO;YAACzC;SAAK;KAC3B;IACD,OAAO;QACLW,IAAI;QACJgE,OAAO,aACF9F,UAAU;YACXmB;YACAkF,QAAQ,GAAEnB,iBAAAA,UAAUb,GAAG,CAAC1C,QAAOR,mBAAAA,KAAK2D,UAAU,YAAf3D,mBAAmB,gBAAxC+D,iBAAgD;YAC1DU;YACAC;YACAE,OAAOtE,QAAQuE,GAAG,CAACC,OAAO;QAC5B;IAEJ;AACF,GAAE;AAEF,OAAO,MAAMK,qBAAqBd,OAAO,OAAO5B,OAAOnC;QAEnCA,aAYgCqC;IAblD,IAAI,CAACF,MAAM/B,MAAM,EAAE,OAAO;QAAEC,IAAI;QAAOC,QAAQ;QAAKC,OAAOjB;IAA0B;IACrF,MAAMkD,KAAKtC,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IACxC,IAAI,CAACqC,IAAI,OAAOqB,QAAQ;IACxB,MAAMxB,WAAW,MAAMtE,gBAAgBoE,MAAM/B,MAAM,EAAEoC;IACrD,IAAI,CAACH,UAAU,OAAOwB,QAAQ;IAC9B,MAAMM,aAAa,MAAMjC,WAAwBC,OAAO;QACtDI,OAAO;QACPC;QACAR,YAAYxE,gBAAgB2G,UAAU;QACtC1B,SAAS;QACTC,WAAW;QACXC,OAAO7D;IACT;IACA,OAAO;QAAEuB,IAAI;QAAMgE,OAAO,aAAK3F,UAAU;YAAEiB,IAAI,GAAG0C,iBAAAA,SAASU,IAAI,cAAbV,iBAAmB,CAAC;YAAY8B;QAAW;IAAK;AACpG,GAAE;AAEF,OAAO,MAAMW,uBAAuBf,OAAO,OAAO5B,OAAOnC;QAC7BA;IAA1B,MAAMgC,aAAa9B,QAAOF,cAAAA,QAAQwC,EAAE,YAAVxC,cAAc,IAAIG,IAAI;IAChD,IAAI,CAAC1B,2BAA2BuD,aAAa,OAAO6B,QAAQ,UAAU;IACtE,MAAMxB,WAAW,MAAMP,cAAcK,MAAMlC,KAAK,EAAEzC,gBAAgBuH,aAAa,EAC5EpC,KAAK,CAAC1D,kCACN2D,GAAG;IACN,MAAMoC,cAAc3C,SAASQ,IAAI,CAC9BC,GAAG,CAAC,CAACb;YAASA;gBAAAA,YAAAA,IAAIc,IAAI,cAARd,YAAc,CAAC;OAC7Be,MAAM,CAAC,CAACiC,aAAe9C,MAAMd,OAAO,CAAC4D,UAAU,CAAC,YAAY;IAC/D,OAAO;QAAE5E,IAAI;QAAMgE,OAAO,aAAK7F,YAAYwD,YAAYgD;IAAe;AACxE,GAAE;AAEF,0DAA0D,GAC1D,OAAO,MAAME,oBAAuE;IAClF,CAAC9G,2BAA2BoB,OAAO,CAAC,EAAEyE;IACtC,CAAC7F,2BAA2BqB,OAAO,CAAC,EAAEgF;IACtC,CAACrG,2BAA2BsB,IAAI,CAAC,EAAEiF;IACnC,CAACvG,2BAA2BuB,IAAI,CAAC,EAAEkF;IACnC,CAAC1G,0BAA0B,EAAE2G;AAC/B,EAAC;AAED;;;CAGC,GACD,OAAO,SAASK;IACd,KAAK,MAAM,CAACC,UAAUC,YAAY,IAAIC,OAAOC,OAAO,CAACL,mBAAoB;QACvE3H,gCAAgC6H,UAAUC,aAAa;YAAEG,UAAUtH;QAAU;IAC/E;AACF"}