@aglyn/plugins-crm 1.0.0-beta.217 → 1.0.0-beta.219

package/src/lib/server/task-reminders-route.d.ts

@@ -0,0 +1,82 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * A task's reminder at its own time (AGL-2659): `POST /api/crm/task-reminders`.
+ *
+ * The digest beside this route says once a morning what is late and what
+ * is due today; nothing said "the 3:00 call is at 3:00". Every hour this
+ * reads, per org, the open tasks whose `remindAtMs` has come and tells
+ * each one's assignee ONCE — a console notification per task
+ * (`content.taskReminder`, opening the record the task is for) and one
+ * email per member per run listing everything of theirs that fell due.
+ * The words and the rule live in `crm-task-reminders.ts`; this file is the
+ * reads, the sends and the sweep, in the digest's shape wherever the two
+ * do the same thing.
+ *
+ * ## Who is told, and who is not
+ *
+ * The task's ASSIGNEE, and nobody else — an unassigned task is a deliberate
+ * choice in the drawer, as the digest reads it. Only a member who may open
+ * the CRM (`data.manage`, resolved through their custom role), only in an
+ * org whose plan carries the suite and whose `release_crm` flag is
+ * on: the plan gate is the digest's own (`crmDigestEntitled`), so a plan
+ * that gets no digest gets no reminders either. The recipient's
+ * operational-category mute (`notificationPrefs.content`) governs the WHOLE
+ * reminder, mail included — unlike the digest, which has a switch of its
+ * own for the schedule it keeps; a reminder is one message about one task.
+ *
+ * ## Once, and resumable
+ *
+ * `reminderSentAtMs` on the task is the idempotence: stamped in one batch
+ * with the member's sends, so a rerun over the same hour reads the mark and
+ * sends nothing, and stamped on every reminder the run HANDLED — sent, or
+ * found nobody to send it to — so a reminder nobody can be told about does
+ * not come back every hour. A reminder is left unstamped only when the run
+ * never reached a verdict: the send-rate governor refused, or the org
+ * threw. Orgs are swept in id order behind a cursor, as the digest sweeps
+ * them, so the workflow's `done:false` loop carries a platform of any
+ * size across invocations.
+ *
+ * The task query reads the NEWEST reminders that have come due, not the
+ * oldest — see `CRM_TASK_REMINDER_CEILING` for why that is what makes a
+ * bounded page safe against a window that only ever grows.
+ *
+ * The email is a `bulk` send under the platform send-rate governor
+ * (AGL-2409), metered as PLATFORM mail, for the digest's reasons: a cron
+ * fan-out on the shared sending domain, and the platform reminding a
+ * member is not the org's sending. A refusal STOPS the run and reports
+ * `done: true`; the refused member was never stamped, and the next hour's
+ * run finds their reminders at the top of the window again.
+ */
+/** The beat `/api/health/crons` reads — the `SCHEDULED_JOBS` row's id. */
+export declare const CRM_TASK_REMINDERS_JOB_ID = "crm-task-reminders";
+/**
+ * Orgs per invocation.
+ *
+ * More than the digest's twenty-five: an org here costs one task query and,
+ * only when something fell due, the roster and the sends. The common hour
+ * finds nothing due in most orgs, and a chunk that reads a hundred empty
+ * queries finishes well inside `maxDuration = 60`.
+ */
+export declare const CRM_TASK_REMINDERS_ORG_CHUNK = 100;
+/**
+ * The most members per org whose address is chased through the auth pools
+ * when their member document carries none — the digest's bound, for the
+ * digest's reason: work, not audience.
+ */
+export declare const CRM_TASK_REMINDERS_MAX_UID_LOOKUPS = 5;
+export declare function crmTaskRemindersRoute(request: Request): Promise<Response>;

package/src/lib/server/task-reminders-route.js

@@ -0,0 +1,497 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { buildRoute, composeCrmTaskReminderBody, composeCrmTaskReminderEmailText, composeCrmTaskReminderSubject, CRM_COLLECTIONS, CRM_TASK_REMINDER_CEILING, crmTaskReminderDue, crmTaskReminderLink, isReleaseFlagOnForOrg, notificationMuted, parseOrgReleaseFlagOverrides, pluginRequestFromWeb, resolveBrandingProfile, resolveEffectivePlan, resolveOrgEntitlements, Route } from "@aglyn/aglyn/server";
+import { crmDigestEntitled } from "../model/crm-digest.js";
+import { rateLimitedRetryAtMs, sendEmail } from "@aglyn/shared-util-email";
+import { withoutMailWithheldAccounts } from "@aglyn/tenant-data-admin/server/account-mail";
+import { findUserByUidAcrossPools, firebaseAdmin, getServerReleaseFlagValues, listOrgMembers, memberHasOrgPermission, meterPlatformEmail, notifyUsers } from "@aglyn/tenant-data-admin";
+// From the LEAF, not the barrel (AGL-2407): the cron specs mock
+// `@aglyn/tenant-data-admin` wholesale, and a suppression gate imported
+// through the barrel would be silently replaced by whatever the factory
+// lists. Same reasoning as the digest beside this route.
+import { filterSuppressedEmails } from "@aglyn/tenant-data-admin/server/email-suppression";
+import { loadSystemEmail, renderLoadedSystemEmail, systemEmailBrand, systemEmailContent } from "@aglyn/tenant-data-admin/server/render-system-email";
+import { isCronAuthorized, isCronDryRun } from "@aglyn/tenant-data-admin/server/cron-auth";
+import { writeCronBeat } from "@aglyn/aglyn/app-utils/health-report";
+import { brandSupportLine } from "@aglyn/aglyn/app-utils/brand-support-line";
+import { platformConsoleOrigin as consoleOrigin } from "@aglyn/aglyn/app-utils/platform-brand";
+import { digestTimeZone } from "./daily-digest-route.js";
+/**
+ * The mark a scheduled run leaves for `/api/health/crons` (AGL-1955), on the
+ * INVOCATION and before the work — the console's rule for every cron. Never
+ * throws: reaching the admin app is inside the try, because a monitor that
+ * can take down the job it describes is worse than the failure it watches.
+ */ async function recordCronBeat(jobId) {
+    try {
+        await writeCronBeat(firebaseAdmin.app().firestore(), jobId);
+    } catch (unused) {
+    // Deliberately swallowed: a job that stops stamping reds its own row.
+    }
+}
+// lockdown-423: exempt — server-internal cron (x-cron-secret), no user caller; it reads an org's CRM to remind its members and writes nothing a locked org could lose.
+/**
+ * A task's reminder at its own time (AGL-2659): `POST /api/crm/task-reminders`.
+ *
+ * The digest beside this route says once a morning what is late and what
+ * is due today; nothing said "the 3:00 call is at 3:00". Every hour this
+ * reads, per org, the open tasks whose `remindAtMs` has come and tells
+ * each one's assignee ONCE — a console notification per task
+ * (`content.taskReminder`, opening the record the task is for) and one
+ * email per member per run listing everything of theirs that fell due.
+ * The words and the rule live in `crm-task-reminders.ts`; this file is the
+ * reads, the sends and the sweep, in the digest's shape wherever the two
+ * do the same thing.
+ *
+ * ## Who is told, and who is not
+ *
+ * The task's ASSIGNEE, and nobody else — an unassigned task is a deliberate
+ * choice in the drawer, as the digest reads it. Only a member who may open
+ * the CRM (`data.manage`, resolved through their custom role), only in an
+ * org whose plan carries the suite and whose `release_crm` flag is
+ * on: the plan gate is the digest's own (`crmDigestEntitled`), so a plan
+ * that gets no digest gets no reminders either. The recipient's
+ * operational-category mute (`notificationPrefs.content`) governs the WHOLE
+ * reminder, mail included — unlike the digest, which has a switch of its
+ * own for the schedule it keeps; a reminder is one message about one task.
+ *
+ * ## Once, and resumable
+ *
+ * `reminderSentAtMs` on the task is the idempotence: stamped in one batch
+ * with the member's sends, so a rerun over the same hour reads the mark and
+ * sends nothing, and stamped on every reminder the run HANDLED — sent, or
+ * found nobody to send it to — so a reminder nobody can be told about does
+ * not come back every hour. A reminder is left unstamped only when the run
+ * never reached a verdict: the send-rate governor refused, or the org
+ * threw. Orgs are swept in id order behind a cursor, as the digest sweeps
+ * them, so the workflow's `done:false` loop carries a platform of any
+ * size across invocations.
+ *
+ * The task query reads the NEWEST reminders that have come due, not the
+ * oldest — see `CRM_TASK_REMINDER_CEILING` for why that is what makes a
+ * bounded page safe against a window that only ever grows.
+ *
+ * The email is a `bulk` send under the platform send-rate governor
+ * (AGL-2409), metered as PLATFORM mail, for the digest's reasons: a cron
+ * fan-out on the shared sending domain, and the platform reminding a
+ * member is not the org's sending. A refusal STOPS the run and reports
+ * `done: true`; the refused member was never stamped, and the next hour's
+ * run finds their reminders at the top of the window again.
+ */ /** The beat `/api/health/crons` reads — the `SCHEDULED_JOBS` row's id. */ export const CRM_TASK_REMINDERS_JOB_ID = 'crm-task-reminders';
+/**
+ * Orgs per invocation.
+ *
+ * More than the digest's twenty-five: an org here costs one task query and,
+ * only when something fell due, the roster and the sends. The common hour
+ * finds nothing due in most orgs, and a chunk that reads a hundred empty
+ * queries finishes well inside `maxDuration = 60`.
+ */ export const CRM_TASK_REMINDERS_ORG_CHUNK = 100;
+/**
+ * The most members per org whose address is chased through the auth pools
+ * when their member document carries none — the digest's bound, for the
+ * digest's reason: work, not audience.
+ */ export const CRM_TASK_REMINDERS_MAX_UID_LOOKUPS = 5;
+async function remindOrg(ctx, orgDoc) {
+    var _orgDoc_data, _org_slug;
+    const { firestore, nowMs, timeZone, dryRun } = ctx;
+    const orgId = orgDoc.id;
+    const org = (_orgDoc_data = orgDoc.data()) != null ? _orgDoc_data : {};
+    const quiet = {
+        due: 0,
+        handled: 0,
+        notified: 0,
+        emailed: 0
+    };
+    if (!crmDigestEntitled(resolveOrgEntitlements(org).features)) {
+        return _extends({}, quiet, {
+            skipped: 'not-entitled'
+        });
+    }
+    const flagOn = isReleaseFlagOnForOrg('release_crm', ctx.flagValues['release_crm'], orgId, parseOrgReleaseFlagOverrides(org['releaseFlags']), resolveEffectivePlan(org));
+    if (!flagOn) return _extends({}, quiet, {
+        skipped: 'release-flag'
+    });
+    /*
+   * Every open task whose reminder has come, newest first, on
+   * `(status, remindAtMs desc)`. The "not yet handled" half is a fact about
+   * a field's absence, which a query cannot select on, so it is asked of
+   * the page in memory — and the page being the NEWEST five hundred is what
+   * keeps the handled ones from crowding out the next one due.
+   */ const page = await orgDoc.ref.collection(CRM_COLLECTIONS.tasks).where('status', '==', 'open').where('remindAtMs', '<=', nowMs).orderBy('remindAtMs', 'desc').limit(CRM_TASK_REMINDER_CEILING).get();
+    const due = [];
+    for (const doc of page.docs){
+        var _data_title, _data_kind, _data_assigneeUid, _data_hostId;
+        const data = doc.data();
+        if (!crmTaskReminderDue(data, nowMs)) continue;
+        due.push({
+            ref: doc.ref,
+            id: doc.id,
+            title: String((_data_title = data['title']) != null ? _data_title : ''),
+            kind: (_data_kind = data['kind']) != null ? _data_kind : 'todo',
+            dueAtMs: typeof data['dueAtMs'] === 'number' ? data['dueAtMs'] : null,
+            remindAtMs: Number(data['remindAtMs']),
+            assigneeUid: String((_data_assigneeUid = data['assigneeUid']) != null ? _data_assigneeUid : ''),
+            hostId: String((_data_hostId = data['hostId']) != null ? _data_hostId : ''),
+            contactId: data['contactId'] || undefined,
+            companyId: data['companyId'] || undefined,
+            dealId: data['dealId'] || undefined
+        });
+    }
+    const tasksTruncated = page.docs.length >= CRM_TASK_REMINDER_CEILING;
+    if (!due.length) {
+        return _extends({}, quiet, {
+            skipped: 'nothing-due'
+        }, tasksTruncated ? {
+            tasksTruncated
+        } : {});
+    }
+    const report = {
+        due: due.length,
+        handled: 0,
+        notified: 0,
+        emailed: 0,
+        members: {}
+    };
+    if (tasksTruncated) report.tasksTruncated = true;
+    const rows = report.members;
+    /**
+   * Stamp a set of reminders as handled, in one batch, unless this is a
+   * plan. Everything a member's verdict covers lands together, which is
+   * what makes a rerun read the same answer for all of them.
+   */ const settle = async (tasks)=>{
+        report.handled += tasks.length;
+        if (dryRun) return;
+        const batch = firestore.batch();
+        for (const task of tasks)batch.update(task.ref, {
+            reminderSentAtMs: nowMs
+        });
+        await batch.commit();
+    };
+    const byAssignee = new Map();
+    const unassigned = [];
+    for (const task of due){
+        var _byAssignee_get;
+        if (!task.assigneeUid) {
+            unassigned.push(task);
+            continue;
+        }
+        const mine = (_byAssignee_get = byAssignee.get(task.assigneeUid)) != null ? _byAssignee_get : [];
+        mine.push(task);
+        byAssignee.set(task.assigneeUid, mine);
+    }
+    // A reminder for nobody is handled by saying so: it would otherwise sit
+    // at the top of the window every hour for as long as the task is open.
+    if (unassigned.length) {
+        rows[''] = {
+            tasks: unassigned.length,
+            skipped: 'unassigned'
+        };
+        await settle(unassigned);
+    }
+    if (!byAssignee.size) return report;
+    const listed = (await listOrgMembers(orgId)).filter((member)=>member.orgSuspended !== true);
+    // A locked or disabled account is not told (AGL-3418): it cannot sign in
+    // to act on it.
+    const reachable = new Set(await withoutMailWithheldAccounts(listed.map((member)=>member.$id)));
+    const members = listed.filter((member)=>reachable.has(member.$id));
+    const memberById = new Map(members.map((member)=>[
+            member.$id,
+            member
+        ]));
+    // Sorted so the order members are told in — and the member a refusal
+    // lands on — is the same on every run.
+    const uids = [
+        ...byAssignee.keys()
+    ].sort();
+    const userDocs = await firestore.getAll(...uids.map((uid)=>firestore.collection('users').doc(uid)));
+    const userById = new Map(userDocs.map((doc)=>[
+            doc.id,
+            doc
+        ]));
+    // The sites the due tasks name, for the absolute links the mail carries.
+    const hostIds = [
+        ...new Set(due.map((task)=>task.hostId).filter(Boolean))
+    ];
+    const hostDocs = hostIds.length ? await firestore.getAll(...hostIds.map((hostId)=>firestore.collection('hosts').doc(hostId))) : [];
+    const hostById = new Map(hostDocs.map((doc)=>[
+            doc.id,
+            doc
+        ]));
+    const branding = resolveBrandingProfile(org);
+    const orgSlug = String((_org_slug = org['slug']) != null ? _org_slug : '');
+    const orgHub = orgSlug ? `${ctx.origin}${buildRoute(Route.ORG_HOME, {
+        orgSlug
+    })}/crm` : null;
+    const hubUrl = (hostId)=>{
+        var _ref;
+        var _hostById_get;
+        if (!hostId) return orgHub;
+        const subdomain = String((_ref = (_hostById_get = hostById.get(hostId)) == null ? void 0 : _hostById_get.get('subdomain')) != null ? _ref : '');
+        if (!orgSlug || !subdomain) return null;
+        return `${ctx.origin}${buildRoute(Route.HOST_DASHBOARD, {
+            orgSlug,
+            host: subdomain
+        })}/crm`;
+    };
+    // The record the task is for, on its own hub — the notification's link
+    // past the `/{hostId}/crm` or `/org/crm` prefix the console rewrites.
+    const taskUrl = (task)=>{
+        const hub = hubUrl(task.hostId);
+        if (!hub) return ctx.origin;
+        const link = crmTaskReminderLink(task.hostId || null, task);
+        return `${hub}${link.slice(link.indexOf('/crm') + '/crm'.length)}`;
+    };
+    const settingsUrl = `${ctx.origin}${buildRoute(Route.MANAGE_NOTIFICATION_SETTINGS)}`;
+    const supportLine = brandSupportLine(branding);
+    const brand = systemEmailBrand(org);
+    let reminderEmail;
+    let poolLookups = 0;
+    for (const uid of uids){
+        var _member_email;
+        const tasks = byAssignee.get(uid);
+        const row = {
+            tasks: tasks.length
+        };
+        rows[uid] = row;
+        const member = memberById.get(uid);
+        if (!member) {
+            row.skipped = 'not-a-member';
+            await settle(tasks);
+            continue;
+        }
+        if (!await memberHasOrgPermission(orgId, member, 'data.manage')) {
+            row.skipped = 'no-data-manage';
+            await settle(tasks);
+            continue;
+        }
+        const userDoc = userById.get(uid);
+        if (notificationMuted(userDoc == null ? void 0 : userDoc.get('notificationPrefs'), 'content.taskReminder')) {
+            row.skipped = 'muted';
+            await settle(tasks);
+            continue;
+        }
+        if (dryRun) {
+            row.notified = tasks.length;
+            row.emailed = true;
+            await settle(tasks);
+            continue;
+        }
+        /*
+     * THE EMAIL FIRST, for the digest's reason: a refusal from the
+     * send-rate governor stops the run with nothing else done for this
+     * member — no notification to double next hour, no mark to skip them
+     * on — so the order here is the idempotence, not a preference.
+     */ let emailed = false;
+        let emailReason;
+        let address = String((_member_email = member.email) != null ? _member_email : '').trim().toLowerCase();
+        if (!address.includes('@') && poolLookups < CRM_TASK_REMINDERS_MAX_UID_LOOKUPS) {
+            var _ref;
+            var _pooled_record;
+            poolLookups += 1;
+            const pooled = await findUserByUidAcrossPools(uid).catch(()=>null);
+            address = String((_ref = pooled == null ? void 0 : (_pooled_record = pooled.record) == null ? void 0 : _pooled_record.email) != null ? _ref : '').trim().toLowerCase();
+        }
+        const recipients = address.includes('@') ? await filterSuppressedEmails([
+            address
+        ], firestore) : [];
+        if (!recipients.length) {
+            emailReason = address.includes('@') ? 'suppressed' : 'no-recipient';
+        } else {
+            const reminderInput = {
+                tasks,
+                timeZone,
+                productName: branding.productName,
+                taskUrl,
+                settingsUrl,
+                supportLine
+            };
+            const subject = composeCrmTaskReminderSubject(tasks);
+            // The `crm-task-reminder` system email (AGL-3367), in the org's brand,
+            // read once per org and rendered per member.
+            reminderEmail != null ? reminderEmail : reminderEmail = loadSystemEmail('crm-task-reminder').catch(()=>null);
+            const loaded = await reminderEmail;
+            const rendered = loaded ? renderLoadedSystemEmail(loaded, _extends({}, brand.merge, {
+                'reminder.subject': subject,
+                'reminder.body': composeCrmTaskReminderEmailText(_extends({}, reminderInput, {
+                    omitClosing: true
+                })),
+                settingsUrl
+            }), brand.options) : null;
+            const result = await sendEmail(_extends({
+                to: recipients
+            }, systemEmailContent(rendered, {
+                subject,
+                text: composeCrmTaskReminderEmailText(reminderInput)
+            }), {
+                fromName: branding.fromName,
+                context: 'crm-task-reminder',
+                priority: 'bulk'
+            }));
+            if (result.sent) {
+                emailed = true;
+                await meterPlatformEmail().catch(()=>undefined);
+            } else if (rateLimitedRetryAtMs(result) !== null) {
+                row.deferred = true;
+                report.deferred = true;
+                return report;
+            } else {
+                var _result_reason;
+                emailReason = (_result_reason = result.reason) != null ? _result_reason : 'failed';
+            }
+        }
+        // One notification per task: each opens the record it is for.
+        for (const task of tasks){
+            await notifyUsers([
+                uid
+            ], _extends({
+                type: 'content.taskReminder',
+                title: 'Task reminder',
+                body: composeCrmTaskReminderBody(task, timeZone),
+                link: crmTaskReminderLink(task.hostId || null, task),
+                orgId
+            }, task.hostId ? {
+                hostId: task.hostId
+            } : {}));
+        }
+        await settle(tasks);
+        row.notified = tasks.length;
+        row.emailed = emailed;
+        if (emailReason) row.emailReason = emailReason;
+        report.notified += tasks.length;
+        if (emailed) report.emailed += 1;
+    }
+    return report;
+}
+export async function crmTaskRemindersRoute(request) {
+    const { method, body, headers: rawHeaders, query } = await pluginRequestFromWeb(request);
+    const headers = rawHeaders;
+    if (method !== 'POST' && method !== 'GET') {
+        return Response.json({
+            error: 'Method not allowed'
+        }, {
+            status: 405
+        });
+    }
+    if (!process.env.CRON_SECRET) {
+        return Response.json({
+            error: 'Task reminders are not configured (CRON_SECRET).'
+        }, {
+            status: 501
+        });
+    }
+    if (!isCronAuthorized(headers)) {
+        return Response.json({
+            error: 'Unauthenticated'
+        }, {
+            status: 401
+        });
+    }
+    // A GET reports the plan and sends nothing; a bodyless POST — what the
+    // scheduled workflow sends — is a real run. `isCronDryRun` keys the
+    // default on the METHOD for exactly that reason.
+    const dryRun = isCronDryRun({
+        method,
+        body,
+        query
+    });
+    // Stamped on the invocation, not on the work (AGL-1955): an hour with
+    // nothing due still ran.
+    if (method === 'POST') await recordCronBeat(CRM_TASK_REMINDERS_JOB_ID);
+    try {
+        var _ref;
+        var _orgDocs_;
+        const firestore = firebaseAdmin.app().firestore();
+        const nowMs = Date.now();
+        const ctx = {
+            firestore,
+            nowMs,
+            timeZone: digestTimeZone(),
+            dryRun,
+            flagValues: await getServerReleaseFlagValues(),
+            origin: consoleOrigin()
+        };
+        // The resumable sweep, in the shape the digest reads orgs (AGL-2220):
+        // ordered by id, `limit + 1` to learn whether there is more, the cursor
+        // validated as an org id before it becomes a reference.
+        const requestedLimit = Number(body == null ? void 0 : body.limit);
+        const pageSize = Number.isFinite(requestedLimit) && requestedLimit > 0 ? Math.min(Math.floor(requestedLimit), CRM_TASK_REMINDERS_ORG_CHUNK) : CRM_TASK_REMINDERS_ORG_CHUNK;
+        const rawCursor = body == null ? void 0 : body.cursor;
+        const cursor = typeof rawCursor === 'string' && rawCursor.length > 0 && !rawCursor.includes('/') ? rawCursor : null;
+        let orgQuery = firestore.collection('orgs').orderBy(firebaseAdmin.firestore.FieldPath.documentId()).limit(pageSize + 1);
+        if (cursor) orgQuery = orgQuery.startAfter(firestore.collection('orgs').doc(cursor));
+        const page = await orgQuery.get();
+        const hasMore = page.docs.length > pageSize;
+        const orgDocs = hasMore ? page.docs.slice(0, pageSize) : page.docs;
+        const orgs = {};
+        const failures = {};
+        let due = 0;
+        let handled = 0;
+        let notified = 0;
+        let emailed = 0;
+        let deferred = false;
+        for (const orgDoc of orgDocs){
+            try {
+                const report = await remindOrg(ctx, orgDoc);
+                orgs[orgDoc.id] = report;
+                due += report.due;
+                handled += report.handled;
+                notified += report.notified;
+                emailed += report.emailed;
+                if (report.deferred) {
+                    deferred = true;
+                    break;
+                }
+            } catch (error) {
+                var _ref1;
+                console.error('[crm] task reminders failed for org', orgDoc.id, error);
+                failures[orgDoc.id] = (_ref1 = error == null ? void 0 : error.message) != null ? _ref1 : 'unknown';
+            }
+        }
+        const failed = Object.keys(failures);
+        return Response.json(_extends({
+            timeZone: ctx.timeZone,
+            dryRun,
+            swept: orgDocs.length,
+            due,
+            handled,
+            notified,
+            emailed,
+            orgs
+        }, deferred ? {
+            deferred: true
+        } : {}, failed.length ? {
+            failures
+        } : {}, {
+            // A deferred run reports `done: true` — see the module comment —
+            // so the workflow's loop does not re-POST into a full window.
+            nextCursor: deferred || !hasMore ? null : (_ref = (_orgDocs_ = orgDocs[orgDocs.length - 1]) == null ? void 0 : _orgDocs_.id) != null ? _ref : null,
+            done: deferred || !hasMore
+        }), // 207: this chunk finished and some org in it needs a person, which is
+        // what fails the workflow (its one alerting channel).
+        {
+            status: failed.length ? 207 : 200
+        });
+    } catch (error) {
+        console.error('[crm] task reminders run failed', error);
+        return Response.json({
+            error: 'Task reminders run failed'
+        }, {
+            status: 500
+        });
+    }
+}
+
+//# sourceMappingURL=task-reminders-route.js.map

package/src/lib/server/task-reminders-route.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/task-reminders-route.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  type AglynOrgBilling,\n  type AglynOrgMember,\n  buildRoute,\n  composeCrmTaskReminderBody,\n  composeCrmTaskReminderEmailText,\n  composeCrmTaskReminderSubject,\n  CRM_COLLECTIONS,\n  CRM_TASK_REMINDER_CEILING,\n  type CrmReminderTask,\n  crmTaskReminderDue,\n  crmTaskReminderLink,\n  isReleaseFlagOnForOrg,\n  notificationMuted,\n  parseOrgReleaseFlagOverrides,\n  pluginRequestFromWeb,\n  resolveBrandingProfile,\n  resolveEffectivePlan,\n  resolveOrgEntitlements,\n  Route,\n} from '@aglyn/aglyn/server'\nimport {\n  crmDigestEntitled,\n} from '../model/crm-digest'\nimport { rateLimitedRetryAtMs, sendEmail } from '@aglyn/shared-util-email'\nimport { withoutMailWithheldAccounts } from '@aglyn/tenant-data-admin/server/account-mail'\nimport {\n  findUserByUidAcrossPools,\n  firebaseAdmin,\n  getServerReleaseFlagValues,\n  listOrgMembers,\n  memberHasOrgPermission,\n  meterPlatformEmail,\n  notifyUsers,\n} from '@aglyn/tenant-data-admin'\n// From the LEAF, not the barrel (AGL-2407): the cron specs mock\n// `@aglyn/tenant-data-admin` wholesale, and a suppression gate imported\n// through the barrel would be silently replaced by whatever the factory\n// lists. Same reasoning as the digest beside this route.\nimport { filterSuppressedEmails } from '@aglyn/tenant-data-admin/server/email-suppression'\nimport {\n  loadSystemEmail,\n  renderLoadedSystemEmail,\n  systemEmailBrand,\n  systemEmailContent,\n  type LoadedSystemEmail,\n} from '@aglyn/tenant-data-admin/server/render-system-email'\nimport { isCronAuthorized, isCronDryRun } from '@aglyn/tenant-data-admin/server/cron-auth'\nimport { writeCronBeat } from '@aglyn/aglyn/app-utils/health-report'\nimport { brandSupportLine } from '@aglyn/aglyn/app-utils/brand-support-line'\nimport { platformConsoleOrigin as consoleOrigin } from '@aglyn/aglyn/app-utils/platform-brand'\nimport { digestTimeZone } from './daily-digest-route'\n\n/**\n * The mark a scheduled run leaves for `/api/health/crons` (AGL-1955), on the\n * INVOCATION and before the work — the console's rule for every cron. Never\n * throws: reaching the admin app is inside the try, because a monitor that\n * can take down the job it describes is worse than the failure it watches.\n */\nasync function recordCronBeat(jobId: string): Promise<void> {\n  try {\n    await writeCronBeat(firebaseAdmin.app().firestore(), jobId)\n  } catch {\n    // Deliberately swallowed: a job that stops stamping reds its own row.\n  }\n}\n\n// lockdown-423: exempt — server-internal cron (x-cron-secret), no user caller; it reads an org's CRM to remind its members and writes nothing a locked org could lose.\n\n/**\n * A task's reminder at its own time (AGL-2659): `POST /api/crm/task-reminders`.\n *\n * The digest beside this route says once a morning what is late and what\n * is due today; nothing said \"the 3:00 call is at 3:00\". Every hour this\n * reads, per org, the open tasks whose `remindAtMs` has come and tells\n * each one's assignee ONCE — a console notification per task\n * (`content.taskReminder`, opening the record the task is for) and one\n * email per member per run listing everything of theirs that fell due.\n * The words and the rule live in `crm-task-reminders.ts`; this file is the\n * reads, the sends and the sweep, in the digest's shape wherever the two\n * do the same thing.\n *\n * ## Who is told, and who is not\n *\n * The task's ASSIGNEE, and nobody else — an unassigned task is a deliberate\n * choice in the drawer, as the digest reads it. Only a member who may open\n * the CRM (`data.manage`, resolved through their custom role), only in an\n * org whose plan carries the suite and whose `release_crm` flag is\n * on: the plan gate is the digest's own (`crmDigestEntitled`), so a plan\n * that gets no digest gets no reminders either. The recipient's\n * operational-category mute (`notificationPrefs.content`) governs the WHOLE\n * reminder, mail included — unlike the digest, which has a switch of its\n * own for the schedule it keeps; a reminder is one message about one task.\n *\n * ## Once, and resumable\n *\n * `reminderSentAtMs` on the task is the idempotence: stamped in one batch\n * with the member's sends, so a rerun over the same hour reads the mark and\n * sends nothing, and stamped on every reminder the run HANDLED — sent, or\n * found nobody to send it to — so a reminder nobody can be told about does\n * not come back every hour. A reminder is left unstamped only when the run\n * never reached a verdict: the send-rate governor refused, or the org\n * threw. Orgs are swept in id order behind a cursor, as the digest sweeps\n * them, so the workflow's `done:false` loop carries a platform of any\n * size across invocations.\n *\n * The task query reads the NEWEST reminders that have come due, not the\n * oldest — see `CRM_TASK_REMINDER_CEILING` for why that is what makes a\n * bounded page safe against a window that only ever grows.\n *\n * The email is a `bulk` send under the platform send-rate governor\n * (AGL-2409), metered as PLATFORM mail, for the digest's reasons: a cron\n * fan-out on the shared sending domain, and the platform reminding a\n * member is not the org's sending. A refusal STOPS the run and reports\n * `done: true`; the refused member was never stamped, and the next hour's\n * run finds their reminders at the top of the window again.\n */\n\n/** The beat `/api/health/crons` reads — the `SCHEDULED_JOBS` row's id. */\nexport const CRM_TASK_REMINDERS_JOB_ID = 'crm-task-reminders'\n\n/**\n * Orgs per invocation.\n *\n * More than the digest's twenty-five: an org here costs one task query and,\n * only when something fell due, the roster and the sends. The common hour\n * finds nothing due in most orgs, and a chunk that reads a hundred empty\n * queries finishes well inside `maxDuration = 60`.\n */\nexport const CRM_TASK_REMINDERS_ORG_CHUNK = 100\n\n/**\n * The most members per org whose address is chased through the auth pools\n * when their member document carries none — the digest's bound, for the\n * digest's reason: work, not audience.\n */\nexport const CRM_TASK_REMINDERS_MAX_UID_LOOKUPS = 5\n\ntype Firestore = FirebaseFirestore.Firestore\ntype Snapshot = FirebaseFirestore.QueryDocumentSnapshot\n\n/** What one member's row in the response says. */\ninterface MemberReport {\n  tasks: number\n  skipped?: string\n  notified?: number\n  emailed?: boolean\n  emailReason?: string\n  deferred?: boolean\n}\n\ninterface OrgReport {\n  skipped?: string\n  /** Reminders that had come due and were not yet handled. */\n  due: number\n  /** Reminders this run stamped as handled. */\n  handled: number\n  /** Console notifications sent. */\n  notified: number\n  /** Emails sent — one per member per run. */\n  emailed: number\n  members?: Record<string, MemberReport>\n  tasksTruncated?: boolean\n  /** The send-rate governor refused; the sweep stops here. */\n  deferred?: boolean\n}\n\ninterface SweepContext {\n  firestore: Firestore\n  nowMs: number\n  timeZone: string\n  dryRun: boolean\n  flagValues: Awaited<ReturnType<typeof getServerReleaseFlagValues>>\n  origin: string\n}\n\n/** A due reminder with the document it came from, so the stamp has a target. */\ninterface DueTask extends CrmReminderTask {\n  ref: FirebaseFirestore.DocumentReference\n}\n\nasync function remindOrg(ctx: SweepContext, orgDoc: Snapshot): Promise<OrgReport> {\n  const { firestore, nowMs, timeZone, dryRun } = ctx\n  const orgId = orgDoc.id\n  const org = (orgDoc.data() ?? {}) as Partial<AglynOrgBilling> & Record<string, unknown>\n  const quiet: OrgReport = { due: 0, handled: 0, notified: 0, emailed: 0 }\n\n  if (!crmDigestEntitled(resolveOrgEntitlements(org).features)) {\n    return { ...quiet, skipped: 'not-entitled' }\n  }\n  const flagOn = isReleaseFlagOnForOrg(\n    'release_crm',\n    ctx.flagValues['release_crm'],\n    orgId,\n    parseOrgReleaseFlagOverrides(org['releaseFlags']),\n    resolveEffectivePlan(org),\n  )\n  if (!flagOn) return { ...quiet, skipped: 'release-flag' }\n\n  /*\n   * Every open task whose reminder has come, newest first, on\n   * `(status, remindAtMs desc)`. The \"not yet handled\" half is a fact about\n   * a field's absence, which a query cannot select on, so it is asked of\n   * the page in memory — and the page being the NEWEST five hundred is what\n   * keeps the handled ones from crowding out the next one due.\n   */\n  const page = await orgDoc.ref\n    .collection(CRM_COLLECTIONS.tasks)\n    .where('status', '==', 'open')\n    .where('remindAtMs', '<=', nowMs)\n    .orderBy('remindAtMs', 'desc')\n    .limit(CRM_TASK_REMINDER_CEILING)\n    .get()\n  const due: DueTask[] = []\n  for (const doc of page.docs) {\n    const data = doc.data() as Record<string, unknown>\n    if (!crmTaskReminderDue(data as Parameters<typeof crmTaskReminderDue>[0], nowMs)) continue\n    due.push({\n      ref: doc.ref,\n      id: doc.id,\n      title: String(data['title'] ?? ''),\n      kind: (data['kind'] as CrmReminderTask['kind']) ?? 'todo',\n      dueAtMs: typeof data['dueAtMs'] === 'number' ? (data['dueAtMs'] as number) : null,\n      remindAtMs: Number(data['remindAtMs']),\n      assigneeUid: String(data['assigneeUid'] ?? ''),\n      hostId: String(data['hostId'] ?? ''),\n      contactId: (data['contactId'] as string) || undefined,\n      companyId: (data['companyId'] as string) || undefined,\n      dealId: (data['dealId'] as string) || undefined,\n    })\n  }\n  const tasksTruncated = page.docs.length >= CRM_TASK_REMINDER_CEILING\n  if (!due.length) {\n    return { ...quiet, skipped: 'nothing-due', ...(tasksTruncated ? { tasksTruncated } : {}) }\n  }\n\n  const report: OrgReport = { due: due.length, handled: 0, notified: 0, emailed: 0, members: {} }\n  if (tasksTruncated) report.tasksTruncated = true\n  const rows = report.members as Record<string, MemberReport>\n\n  /**\n   * Stamp a set of reminders as handled, in one batch, unless this is a\n   * plan. Everything a member's verdict covers lands together, which is\n   * what makes a rerun read the same answer for all of them.\n   */\n  const settle = async (tasks: DueTask[]): Promise<void> => {\n    report.handled += tasks.length\n    if (dryRun) return\n    const batch = firestore.batch()\n    for (const task of tasks) batch.update(task.ref, { reminderSentAtMs: nowMs })\n    await batch.commit()\n  }\n\n  const byAssignee = new Map<string, DueTask[]>()\n  const unassigned: DueTask[] = []\n  for (const task of due) {\n    if (!task.assigneeUid) {\n      unassigned.push(task)\n      continue\n    }\n    const mine = byAssignee.get(task.assigneeUid) ?? []\n    mine.push(task)\n    byAssignee.set(task.assigneeUid, mine)\n  }\n  // A reminder for nobody is handled by saying so: it would otherwise sit\n  // at the top of the window every hour for as long as the task is open.\n  if (unassigned.length) {\n    rows[''] = { tasks: unassigned.length, skipped: 'unassigned' }\n    await settle(unassigned)\n  }\n  if (!byAssignee.size) return report\n\n  const listed = (await listOrgMembers(orgId)).filter(\n    (member) => member.orgSuspended !== true,\n  )\n  // A locked or disabled account is not told (AGL-3418): it cannot sign in\n  // to act on it.\n  const reachable = new Set(\n    await withoutMailWithheldAccounts(listed.map((member) => member.$id)),\n  )\n  const members = listed.filter((member) => reachable.has(member.$id))\n  const memberById = new Map(members.map((member) => [member.$id, member]))\n  // Sorted so the order members are told in — and the member a refusal\n  // lands on — is the same on every run.\n  const uids = [...byAssignee.keys()].sort()\n  const userDocs = await firestore.getAll(\n    ...uids.map((uid) => firestore.collection('users').doc(uid)),\n  )\n  const userById = new Map(userDocs.map((doc) => [doc.id, doc]))\n\n  // The sites the due tasks name, for the absolute links the mail carries.\n  const hostIds = [...new Set(due.map((task) => task.hostId).filter(Boolean))]\n  const hostDocs = hostIds.length\n    ? await firestore.getAll(...hostIds.map((hostId) => firestore.collection('hosts').doc(hostId)))\n    : []\n  const hostById = new Map(hostDocs.map((doc) => [doc.id, doc]))\n\n  const branding = resolveBrandingProfile(org)\n  const orgSlug = String(org['slug'] ?? '')\n  const orgHub = orgSlug ? `${ctx.origin}${buildRoute(Route.ORG_HOME, { orgSlug })}/crm` : null\n  const hubUrl = (hostId: string): string | null => {\n    if (!hostId) return orgHub\n    const subdomain = String(hostById.get(hostId)?.get('subdomain') ?? '')\n    if (!orgSlug || !subdomain) return null\n    return `${ctx.origin}${buildRoute(Route.HOST_DASHBOARD, { orgSlug, host: subdomain })}/crm`\n  }\n  // The record the task is for, on its own hub — the notification's link\n  // past the `/{hostId}/crm` or `/org/crm` prefix the console rewrites.\n  const taskUrl = (task: CrmReminderTask): string => {\n    const hub = hubUrl(task.hostId)\n    if (!hub) return ctx.origin\n    const link = crmTaskReminderLink(task.hostId || null, task)\n    return `${hub}${link.slice(link.indexOf('/crm') + '/crm'.length)}`\n  }\n  const settingsUrl = `${ctx.origin}${buildRoute(Route.MANAGE_NOTIFICATION_SETTINGS)}`\n  const supportLine = brandSupportLine(branding)\n  const brand = systemEmailBrand(org)\n  let reminderEmail: Promise<LoadedSystemEmail | null> | undefined\n  let poolLookups = 0\n\n  for (const uid of uids) {\n    const tasks = byAssignee.get(uid) as DueTask[]\n    const row: MemberReport = { tasks: tasks.length }\n    rows[uid] = row\n    const member = memberById.get(uid)\n    if (!member) {\n      row.skipped = 'not-a-member'\n      await settle(tasks)\n      continue\n    }\n    if (!(await memberHasOrgPermission(orgId, member as AglynOrgMember, 'data.manage'))) {\n      row.skipped = 'no-data-manage'\n      await settle(tasks)\n      continue\n    }\n    const userDoc = userById.get(uid)\n    if (notificationMuted(userDoc?.get('notificationPrefs'), 'content.taskReminder')) {\n      row.skipped = 'muted'\n      await settle(tasks)\n      continue\n    }\n    if (dryRun) {\n      row.notified = tasks.length\n      row.emailed = true\n      await settle(tasks)\n      continue\n    }\n\n    /*\n     * THE EMAIL FIRST, for the digest's reason: a refusal from the\n     * send-rate governor stops the run with nothing else done for this\n     * member — no notification to double next hour, no mark to skip them\n     * on — so the order here is the idempotence, not a preference.\n     */\n    let emailed = false\n    let emailReason: string | undefined\n    let address = String(member.email ?? '').trim().toLowerCase()\n    if (!address.includes('@') && poolLookups < CRM_TASK_REMINDERS_MAX_UID_LOOKUPS) {\n      poolLookups += 1\n      const pooled = await findUserByUidAcrossPools(uid).catch(() => null)\n      address = String(pooled?.record?.email ?? '').trim().toLowerCase()\n    }\n    const recipients = address.includes('@')\n      ? await filterSuppressedEmails([address], firestore)\n      : []\n    if (!recipients.length) {\n      emailReason = address.includes('@') ? 'suppressed' : 'no-recipient'\n    } else {\n      const reminderInput = {\n        tasks,\n        timeZone,\n        productName: branding.productName,\n        taskUrl,\n        settingsUrl,\n        supportLine,\n      }\n      const subject = composeCrmTaskReminderSubject(tasks)\n      // The `crm-task-reminder` system email (AGL-3367), in the org's brand,\n      // read once per org and rendered per member.\n      reminderEmail ??= loadSystemEmail('crm-task-reminder').catch(() => null)\n      const loaded = await reminderEmail\n      const rendered = loaded\n        ? renderLoadedSystemEmail(\n            loaded,\n            {\n              ...brand.merge,\n              'reminder.subject': subject,\n              'reminder.body': composeCrmTaskReminderEmailText({ ...reminderInput, omitClosing: true }),\n              settingsUrl,\n            },\n            brand.options,\n          )\n        : null\n      const result = await sendEmail({\n        to: recipients,\n        ...systemEmailContent(rendered, {\n          subject,\n          text: composeCrmTaskReminderEmailText(reminderInput),\n        }),\n        fromName: branding.fromName,\n        context: 'crm-task-reminder',\n        priority: 'bulk',\n      })\n      if (result.sent) {\n        emailed = true\n        await meterPlatformEmail().catch(() => undefined)\n      } else if (rateLimitedRetryAtMs(result) !== null) {\n        row.deferred = true\n        report.deferred = true\n        return report\n      } else {\n        emailReason = (result as { reason?: string }).reason ?? 'failed'\n      }\n    }\n\n    // One notification per task: each opens the record it is for.\n    for (const task of tasks) {\n      await notifyUsers([uid], {\n        type: 'content.taskReminder',\n        title: 'Task reminder',\n        body: composeCrmTaskReminderBody(task, timeZone),\n        link: crmTaskReminderLink(task.hostId || null, task),\n        orgId,\n        ...(task.hostId ? { hostId: task.hostId } : {}),\n      })\n    }\n    await settle(tasks)\n    row.notified = tasks.length\n    row.emailed = emailed\n    if (emailReason) row.emailReason = emailReason\n    report.notified += tasks.length\n    if (emailed) report.emailed += 1\n  }\n  return report\n}\n\nexport async function crmTaskRemindersRoute(request: Request): Promise<Response> {\n  const { method, body, headers: rawHeaders, query } = await pluginRequestFromWeb(request)\n  const headers = rawHeaders as Partial<Record<string, string>>\n  if (method !== 'POST' && method !== 'GET') {\n    return Response.json({ error: 'Method not allowed' }, { status: 405 })\n  }\n  if (!process.env.CRON_SECRET) {\n    return Response.json(\n      { error: 'Task reminders are not configured (CRON_SECRET).' },\n      { status: 501 },\n    )\n  }\n  if (!isCronAuthorized(headers)) {\n    return Response.json({ error: 'Unauthenticated' }, { status: 401 })\n  }\n  // A GET reports the plan and sends nothing; a bodyless POST — what the\n  // scheduled workflow sends — is a real run. `isCronDryRun` keys the\n  // default on the METHOD for exactly that reason.\n  const dryRun = isCronDryRun({ method, body, query })\n  // Stamped on the invocation, not on the work (AGL-1955): an hour with\n  // nothing due still ran.\n  if (method === 'POST') await recordCronBeat(CRM_TASK_REMINDERS_JOB_ID)\n\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const nowMs = Date.now()\n    const ctx: SweepContext = {\n      firestore,\n      nowMs,\n      timeZone: digestTimeZone(),\n      dryRun,\n      flagValues: await getServerReleaseFlagValues(),\n      origin: consoleOrigin(),\n    }\n\n    // The resumable sweep, in the shape the digest reads orgs (AGL-2220):\n    // ordered by id, `limit + 1` to learn whether there is more, the cursor\n    // validated as an org id before it becomes a reference.\n    const requestedLimit = Number((body as { limit?: unknown } | undefined)?.limit)\n    const pageSize =\n      Number.isFinite(requestedLimit) && requestedLimit > 0\n        ? Math.min(Math.floor(requestedLimit), CRM_TASK_REMINDERS_ORG_CHUNK)\n        : CRM_TASK_REMINDERS_ORG_CHUNK\n    const rawCursor = (body as { cursor?: unknown } | undefined)?.cursor\n    const cursor =\n      typeof rawCursor === 'string' && rawCursor.length > 0 && !rawCursor.includes('/')\n        ? rawCursor\n        : null\n    let orgQuery = firestore\n      .collection('orgs')\n      .orderBy(firebaseAdmin.firestore.FieldPath.documentId())\n      .limit(pageSize + 1)\n    if (cursor) orgQuery = orgQuery.startAfter(firestore.collection('orgs').doc(cursor))\n    const page = await orgQuery.get()\n    const hasMore = page.docs.length > pageSize\n    const orgDocs = hasMore ? page.docs.slice(0, pageSize) : page.docs\n\n    const orgs: Record<string, OrgReport> = {}\n    const failures: Record<string, string> = {}\n    let due = 0\n    let handled = 0\n    let notified = 0\n    let emailed = 0\n    let deferred = false\n    for (const orgDoc of orgDocs) {\n      try {\n        const report = await remindOrg(ctx, orgDoc)\n        orgs[orgDoc.id] = report\n        due += report.due\n        handled += report.handled\n        notified += report.notified\n        emailed += report.emailed\n        if (report.deferred) {\n          deferred = true\n          break\n        }\n      } catch (error) {\n        console.error('[crm] task reminders failed for org', orgDoc.id, error)\n        failures[orgDoc.id] = (error as Error)?.message ?? 'unknown'\n      }\n    }\n    const failed = Object.keys(failures)\n    return Response.json(\n      {\n        timeZone: ctx.timeZone,\n        dryRun,\n        swept: orgDocs.length,\n        due,\n        handled,\n        notified,\n        emailed,\n        orgs,\n        ...(deferred ? { deferred: true } : {}),\n        ...(failed.length ? { failures } : {}),\n        // A deferred run reports `done: true` — see the module comment —\n        // so the workflow's loop does not re-POST into a full window.\n        nextCursor: deferred || !hasMore ? null : (orgDocs[orgDocs.length - 1]?.id ?? null),\n        done: deferred || !hasMore,\n      },\n      // 207: this chunk finished and some org in it needs a person, which is\n      // what fails the workflow (its one alerting channel).\n      { status: failed.length ? 207 : 200 },\n    )\n  } catch (error) {\n    console.error('[crm] task reminders run failed', error)\n    return Response.json({ error: 'Task reminders run failed' }, { status: 500 })\n  }\n}\n"],"names":["buildRoute","composeCrmTaskReminderBody","composeCrmTaskReminderEmailText","composeCrmTaskReminderSubject","CRM_COLLECTIONS","CRM_TASK_REMINDER_CEILING","crmTaskReminderDue","crmTaskReminderLink","isReleaseFlagOnForOrg","notificationMuted","parseOrgReleaseFlagOverrides","pluginRequestFromWeb","resolveBrandingProfile","resolveEffectivePlan","resolveOrgEntitlements","Route","crmDigestEntitled","rateLimitedRetryAtMs","sendEmail","withoutMailWithheldAccounts","findUserByUidAcrossPools","firebaseAdmin","getServerReleaseFlagValues","listOrgMembers","memberHasOrgPermission","meterPlatformEmail","notifyUsers","filterSuppressedEmails","loadSystemEmail","renderLoadedSystemEmail","systemEmailBrand","systemEmailContent","isCronAuthorized","isCronDryRun","writeCronBeat","brandSupportLine","platformConsoleOrigin","consoleOrigin","digestTimeZone","recordCronBeat","jobId","app","firestore","CRM_TASK_REMINDERS_JOB_ID","CRM_TASK_REMINDERS_ORG_CHUNK","CRM_TASK_REMINDERS_MAX_UID_LOOKUPS","remindOrg","ctx","orgDoc","org","nowMs","timeZone","dryRun","orgId","id","data","quiet","due","handled","notified","emailed","features","skipped","flagOn","flagValues","page","ref","collection","tasks","where","orderBy","limit","get","doc","docs","push","title","String","kind","dueAtMs","remindAtMs","Number","assigneeUid","hostId","contactId","undefined","companyId","dealId","tasksTruncated","length","report","members","rows","settle","batch","task","update","reminderSentAtMs","commit","byAssignee","Map","unassigned","mine","set","size","listed","filter","member","orgSuspended","reachable","Set","map","$id","has","memberById","uids","keys","sort","userDocs","getAll","uid","userById","hostIds","Boolean","hostDocs","hostById","branding","orgSlug","orgHub","origin","ORG_HOME","hubUrl","subdomain","HOST_DASHBOARD","host","taskUrl","hub","link","slice","indexOf","settingsUrl","MANAGE_NOTIFICATION_SETTINGS","supportLine","brand","reminderEmail","poolLookups","row","userDoc","emailReason","address","email","trim","toLowerCase","includes","pooled","catch","record","recipients","reminderInput","productName","subject","loaded","rendered","merge","omitClosing","options","result","to","text","fromName","context","priority","sent","deferred","reason","type","body","crmTaskRemindersRoute","request","method","headers","rawHeaders","query","Response","json","error","status","process","env","CRON_SECRET","orgDocs","Date","now","requestedLimit","pageSize","isFinite","Math","min","floor","rawCursor","cursor","orgQuery","FieldPath","documentId","startAfter","hasMore","orgs","failures","console","message","failed","Object","swept","nextCursor","done"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAGEA,UAAU,EACVC,0BAA0B,EAC1BC,+BAA+B,EAC/BC,6BAA6B,EAC7BC,eAAe,EACfC,yBAAyB,EAEzBC,kBAAkB,EAClBC,mBAAmB,EACnBC,qBAAqB,EACrBC,iBAAiB,EACjBC,4BAA4B,EAC5BC,oBAAoB,EACpBC,sBAAsB,EACtBC,oBAAoB,EACpBC,sBAAsB,EACtBC,KAAK,QACA,sBAAqB;AAC5B,SACEC,iBAAiB,QACZ,yBAAqB;AAC5B,SAASC,oBAAoB,EAAEC,SAAS,QAAQ,2BAA0B;AAC1E,SAASC,2BAA2B,QAAQ,+CAA8C;AAC1F,SACEC,wBAAwB,EACxBC,aAAa,EACbC,0BAA0B,EAC1BC,cAAc,EACdC,sBAAsB,EACtBC,kBAAkB,EAClBC,WAAW,QACN,2BAA0B;AACjC,gEAAgE;AAChE,wEAAwE;AACxE,wEAAwE;AACxE,yDAAyD;AACzD,SAASC,sBAAsB,QAAQ,oDAAmD;AAC1F,SACEC,eAAe,EACfC,uBAAuB,EACvBC,gBAAgB,EAChBC,kBAAkB,QAEb,sDAAqD;AAC5D,SAASC,gBAAgB,EAAEC,YAAY,QAAQ,4CAA2C;AAC1F,SAASC,aAAa,QAAQ,uCAAsC;AACpE,SAASC,gBAAgB,QAAQ,4CAA2C;AAC5E,SAASC,yBAAyBC,aAAa,QAAQ,wCAAuC;AAC9F,SAASC,cAAc,QAAQ,0BAAsB;AAErD;;;;;CAKC,GACD,eAAeC,eAAeC,KAAa;IACzC,IAAI;QACF,MAAMN,cAAcb,cAAcoB,GAAG,GAAGC,SAAS,IAAIF;IACvD,EAAE,eAAM;IACN,sEAAsE;IACxE;AACF;AAEA,uKAAuK;AAEvK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CC,GAED,wEAAwE,GACxE,OAAO,MAAMG,4BAA4B,qBAAoB;AAE7D;;;;;;;CAOC,GACD,OAAO,MAAMC,+BAA+B,IAAG;AAE/C;;;;CAIC,GACD,OAAO,MAAMC,qCAAqC,EAAC;AA6CnD,eAAeC,UAAUC,GAAiB,EAAEC,MAAgB;QAG7CA,cAkHUC;IApHvB,MAAM,EAAEP,SAAS,EAAEQ,KAAK,EAAEC,QAAQ,EAAEC,MAAM,EAAE,GAAGL;IAC/C,MAAMM,QAAQL,OAAOM,EAAE;IACvB,MAAML,OAAOD,eAAAA,OAAOO,IAAI,cAAXP,eAAiB,CAAC;IAC/B,MAAMQ,QAAmB;QAAEC,KAAK;QAAGC,SAAS;QAAGC,UAAU;QAAGC,SAAS;IAAE;IAEvE,IAAI,CAAC5C,kBAAkBF,uBAAuBmC,KAAKY,QAAQ,GAAG;QAC5D,OAAO,aAAKL;YAAOM,SAAS;;IAC9B;IACA,MAAMC,SAASvD,sBACb,eACAuC,IAAIiB,UAAU,CAAC,cAAc,EAC7BX,OACA3C,6BAA6BuC,GAAG,CAAC,eAAe,GAChDpC,qBAAqBoC;IAEvB,IAAI,CAACc,QAAQ,OAAO,aAAKP;QAAOM,SAAS;;IAEzC;;;;;;GAMC,GACD,MAAMG,OAAO,MAAMjB,OAAOkB,GAAG,CAC1BC,UAAU,CAAC/D,gBAAgBgE,KAAK,EAChCC,KAAK,CAAC,UAAU,MAAM,QACtBA,KAAK,CAAC,cAAc,MAAMnB,OAC1BoB,OAAO,CAAC,cAAc,QACtBC,KAAK,CAAClE,2BACNmE,GAAG;IACN,MAAMf,MAAiB,EAAE;IACzB,KAAK,MAAMgB,OAAOR,KAAKS,IAAI,CAAE;YAMXnB,aACPA,YAGaA,mBACLA;QAVjB,MAAMA,OAAOkB,IAAIlB,IAAI;QACrB,IAAI,CAACjD,mBAAmBiD,MAAkDL,QAAQ;QAClFO,IAAIkB,IAAI,CAAC;YACPT,KAAKO,IAAIP,GAAG;YACZZ,IAAImB,IAAInB,EAAE;YACVsB,OAAOC,QAAOtB,cAAAA,IAAI,CAAC,QAAQ,YAAbA,cAAiB;YAC/BuB,IAAI,GAAGvB,aAAAA,IAAI,CAAC,OAAO,YAAZA,aAA4C;YACnDwB,SAAS,OAAOxB,IAAI,CAAC,UAAU,KAAK,WAAYA,IAAI,CAAC,UAAU,GAAc;YAC7EyB,YAAYC,OAAO1B,IAAI,CAAC,aAAa;YACrC2B,aAAaL,QAAOtB,oBAAAA,IAAI,CAAC,cAAc,YAAnBA,oBAAuB;YAC3C4B,QAAQN,QAAOtB,eAAAA,IAAI,CAAC,SAAS,YAAdA,eAAkB;YACjC6B,WAAW,AAAC7B,IAAI,CAAC,YAAY,IAAe8B;YAC5CC,WAAW,AAAC/B,IAAI,CAAC,YAAY,IAAe8B;YAC5CE,QAAQ,AAAChC,IAAI,CAAC,SAAS,IAAe8B;QACxC;IACF;IACA,MAAMG,iBAAiBvB,KAAKS,IAAI,CAACe,MAAM,IAAIpF;IAC3C,IAAI,CAACoD,IAAIgC,MAAM,EAAE;QACf,OAAO,aAAKjC;YAAOM,SAAS;WAAmB0B,iBAAiB;YAAEA;QAAe,IAAI,CAAC;IACxF;IAEA,MAAME,SAAoB;QAAEjC,KAAKA,IAAIgC,MAAM;QAAE/B,SAAS;QAAGC,UAAU;QAAGC,SAAS;QAAG+B,SAAS,CAAC;IAAE;IAC9F,IAAIH,gBAAgBE,OAAOF,cAAc,GAAG;IAC5C,MAAMI,OAAOF,OAAOC,OAAO;IAE3B;;;;GAIC,GACD,MAAME,SAAS,OAAOzB;QACpBsB,OAAOhC,OAAO,IAAIU,MAAMqB,MAAM;QAC9B,IAAIrC,QAAQ;QACZ,MAAM0C,QAAQpD,UAAUoD,KAAK;QAC7B,KAAK,MAAMC,QAAQ3B,MAAO0B,MAAME,MAAM,CAACD,KAAK7B,GAAG,EAAE;YAAE+B,kBAAkB/C;QAAM;QAC3E,MAAM4C,MAAMI,MAAM;IACpB;IAEA,MAAMC,aAAa,IAAIC;IACvB,MAAMC,aAAwB,EAAE;IAChC,KAAK,MAAMN,QAAQtC,IAAK;YAKT0C;QAJb,IAAI,CAACJ,KAAKb,WAAW,EAAE;YACrBmB,WAAW1B,IAAI,CAACoB;YAChB;QACF;QACA,MAAMO,QAAOH,kBAAAA,WAAW3B,GAAG,CAACuB,KAAKb,WAAW,aAA/BiB,kBAAoC,EAAE;QACnDG,KAAK3B,IAAI,CAACoB;QACVI,WAAWI,GAAG,CAACR,KAAKb,WAAW,EAAEoB;IACnC;IACA,wEAAwE;IACxE,uEAAuE;IACvE,IAAID,WAAWZ,MAAM,EAAE;QACrBG,IAAI,CAAC,GAAG,GAAG;YAAExB,OAAOiC,WAAWZ,MAAM;YAAE3B,SAAS;QAAa;QAC7D,MAAM+B,OAAOQ;IACf;IACA,IAAI,CAACF,WAAWK,IAAI,EAAE,OAAOd;IAE7B,MAAMe,SAAS,AAAC,CAAA,MAAMlF,eAAe8B,MAAK,EAAGqD,MAAM,CACjD,CAACC,SAAWA,OAAOC,YAAY,KAAK;IAEtC,yEAAyE;IACzE,gBAAgB;IAChB,MAAMC,YAAY,IAAIC,IACpB,MAAM3F,4BAA4BsF,OAAOM,GAAG,CAAC,CAACJ,SAAWA,OAAOK,GAAG;IAErE,MAAMrB,UAAUc,OAAOC,MAAM,CAAC,CAACC,SAAWE,UAAUI,GAAG,CAACN,OAAOK,GAAG;IAClE,MAAME,aAAa,IAAId,IAAIT,QAAQoB,GAAG,CAAC,CAACJ,SAAW;YAACA,OAAOK,GAAG;YAAEL;SAAO;IACvE,qEAAqE;IACrE,uCAAuC;IACvC,MAAMQ,OAAO;WAAIhB,WAAWiB,IAAI;KAAG,CAACC,IAAI;IACxC,MAAMC,WAAW,MAAM5E,UAAU6E,MAAM,IAClCJ,KAAKJ,GAAG,CAAC,CAACS,MAAQ9E,UAAUyB,UAAU,CAAC,SAASM,GAAG,CAAC+C;IAEzD,MAAMC,WAAW,IAAIrB,IAAIkB,SAASP,GAAG,CAAC,CAACtC,MAAQ;YAACA,IAAInB,EAAE;YAAEmB;SAAI;IAE5D,yEAAyE;IACzE,MAAMiD,UAAU;WAAI,IAAIZ,IAAIrD,IAAIsD,GAAG,CAAC,CAAChB,OAASA,KAAKZ,MAAM,EAAEuB,MAAM,CAACiB;KAAU;IAC5E,MAAMC,WAAWF,QAAQjC,MAAM,GAC3B,MAAM/C,UAAU6E,MAAM,IAAIG,QAAQX,GAAG,CAAC,CAAC5B,SAAWzC,UAAUyB,UAAU,CAAC,SAASM,GAAG,CAACU,YACpF,EAAE;IACN,MAAM0C,WAAW,IAAIzB,IAAIwB,SAASb,GAAG,CAAC,CAACtC,MAAQ;YAACA,IAAInB,EAAE;YAAEmB;SAAI;IAE5D,MAAMqD,WAAWlH,uBAAuBqC;IACxC,MAAM8E,UAAUlD,QAAO5B,YAAAA,GAAG,CAAC,OAAO,YAAXA,YAAe;IACtC,MAAM+E,SAASD,UAAU,GAAGhF,IAAIkF,MAAM,GAAGjI,WAAWe,MAAMmH,QAAQ,EAAE;QAAEH;IAAQ,GAAG,IAAI,CAAC,GAAG;IACzF,MAAMI,SAAS,CAAChD;;YAEW0C;QADzB,IAAI,CAAC1C,QAAQ,OAAO6C;QACpB,MAAMI,YAAYvD,gBAAOgD,gBAAAA,SAASrD,GAAG,CAACW,4BAAb0C,cAAsBrD,GAAG,CAAC,+BAAgB;QACnE,IAAI,CAACuD,WAAW,CAACK,WAAW,OAAO;QACnC,OAAO,GAAGrF,IAAIkF,MAAM,GAAGjI,WAAWe,MAAMsH,cAAc,EAAE;YAAEN;YAASO,MAAMF;QAAU,GAAG,IAAI,CAAC;IAC7F;IACA,uEAAuE;IACvE,sEAAsE;IACtE,MAAMG,UAAU,CAACxC;QACf,MAAMyC,MAAML,OAAOpC,KAAKZ,MAAM;QAC9B,IAAI,CAACqD,KAAK,OAAOzF,IAAIkF,MAAM;QAC3B,MAAMQ,OAAOlI,oBAAoBwF,KAAKZ,MAAM,IAAI,MAAMY;QACtD,OAAO,GAAGyC,MAAMC,KAAKC,KAAK,CAACD,KAAKE,OAAO,CAAC,UAAU,OAAOlD,MAAM,GAAG;IACpE;IACA,MAAMmD,cAAc,GAAG7F,IAAIkF,MAAM,GAAGjI,WAAWe,MAAM8H,4BAA4B,GAAG;IACpF,MAAMC,cAAc3G,iBAAiB2F;IACrC,MAAMiB,QAAQjH,iBAAiBmB;IAC/B,IAAI+F;IACJ,IAAIC,cAAc;IAElB,KAAK,MAAMzB,OAAOL,KAAM;YAoCDR;QAnCrB,MAAMvC,QAAQ+B,WAAW3B,GAAG,CAACgD;QAC7B,MAAM0B,MAAoB;YAAE9E,OAAOA,MAAMqB,MAAM;QAAC;QAChDG,IAAI,CAAC4B,IAAI,GAAG0B;QACZ,MAAMvC,SAASO,WAAW1C,GAAG,CAACgD;QAC9B,IAAI,CAACb,QAAQ;YACXuC,IAAIpF,OAAO,GAAG;YACd,MAAM+B,OAAOzB;YACb;QACF;QACA,IAAI,CAAE,MAAM5C,uBAAuB6B,OAAOsD,QAA0B,gBAAiB;YACnFuC,IAAIpF,OAAO,GAAG;YACd,MAAM+B,OAAOzB;YACb;QACF;QACA,MAAM+E,UAAU1B,SAASjD,GAAG,CAACgD;QAC7B,IAAI/G,kBAAkB0I,2BAAAA,QAAS3E,GAAG,CAAC,sBAAsB,yBAAyB;YAChF0E,IAAIpF,OAAO,GAAG;YACd,MAAM+B,OAAOzB;YACb;QACF;QACA,IAAIhB,QAAQ;YACV8F,IAAIvF,QAAQ,GAAGS,MAAMqB,MAAM;YAC3ByD,IAAItF,OAAO,GAAG;YACd,MAAMiC,OAAOzB;YACb;QACF;QAEA;;;;;KAKC,GACD,IAAIR,UAAU;QACd,IAAIwF;QACJ,IAAIC,UAAUxE,QAAO8B,gBAAAA,OAAO2C,KAAK,YAAZ3C,gBAAgB,IAAI4C,IAAI,GAAGC,WAAW;QAC3D,IAAI,CAACH,QAAQI,QAAQ,CAAC,QAAQR,cAAcpG,oCAAoC;;gBAG7D6G;YAFjBT,eAAe;YACf,MAAMS,SAAS,MAAMtI,yBAAyBoG,KAAKmC,KAAK,CAAC,IAAM;YAC/DN,UAAUxE,eAAO6E,2BAAAA,iBAAAA,OAAQE,MAAM,qBAAdF,eAAgBJ,KAAK,mBAAI,IAAIC,IAAI,GAAGC,WAAW;QAClE;QACA,MAAMK,aAAaR,QAAQI,QAAQ,CAAC,OAChC,MAAM9H,uBAAuB;YAAC0H;SAAQ,EAAE3G,aACxC,EAAE;QACN,IAAI,CAACmH,WAAWpE,MAAM,EAAE;YACtB2D,cAAcC,QAAQI,QAAQ,CAAC,OAAO,eAAe;QACvD,OAAO;YACL,MAAMK,gBAAgB;gBACpB1F;gBACAjB;gBACA4G,aAAajC,SAASiC,WAAW;gBACjCxB;gBACAK;gBACAE;YACF;YACA,MAAMkB,UAAU7J,8BAA8BiE;YAC9C,uEAAuE;YACvE,6CAA6C;YAC7C4E,wBAAAA,gBAAAA,gBAAkBpH,gBAAgB,qBAAqB+H,KAAK,CAAC,IAAM;YACnE,MAAMM,SAAS,MAAMjB;YACrB,MAAMkB,WAAWD,SACbpI,wBACEoI,QACA,aACKlB,MAAMoB,KAAK;gBACd,oBAAoBH;gBACpB,iBAAiB9J,gCAAgC,aAAK4J;oBAAeM,aAAa;;gBAClFxB;gBAEFG,MAAMsB,OAAO,IAEf;YACJ,MAAMC,SAAS,MAAMpJ,UAAU;gBAC7BqJ,IAAIV;eACD9H,mBAAmBmI,UAAU;gBAC9BF;gBACAQ,MAAMtK,gCAAgC4J;YACxC;gBACAW,UAAU3C,SAAS2C,QAAQ;gBAC3BC,SAAS;gBACTC,UAAU;;YAEZ,IAAIL,OAAOM,IAAI,EAAE;gBACfhH,UAAU;gBACV,MAAMnC,qBAAqBkI,KAAK,CAAC,IAAMtE;YACzC,OAAO,IAAIpE,qBAAqBqJ,YAAY,MAAM;gBAChDpB,IAAI2B,QAAQ,GAAG;gBACfnF,OAAOmF,QAAQ,GAAG;gBAClB,OAAOnF;YACT,OAAO;oBACS;gBAAd0D,eAAc,iBAAA,AAACkB,OAA+BQ,MAAM,YAAtC,iBAA0C;YAC1D;QACF;QAEA,8DAA8D;QAC9D,KAAK,MAAM/E,QAAQ3B,MAAO;YACxB,MAAM1C,YAAY;gBAAC8F;aAAI,EAAE;gBACvBuD,MAAM;gBACNnG,OAAO;gBACPoG,MAAM/K,2BAA2B8F,MAAM5C;gBACvCsF,MAAMlI,oBAAoBwF,KAAKZ,MAAM,IAAI,MAAMY;gBAC/C1C;eACI0C,KAAKZ,MAAM,GAAG;gBAAEA,QAAQY,KAAKZ,MAAM;YAAC,IAAI,CAAC;QAEjD;QACA,MAAMU,OAAOzB;QACb8E,IAAIvF,QAAQ,GAAGS,MAAMqB,MAAM;QAC3ByD,IAAItF,OAAO,GAAGA;QACd,IAAIwF,aAAaF,IAAIE,WAAW,GAAGA;QACnC1D,OAAO/B,QAAQ,IAAIS,MAAMqB,MAAM;QAC/B,IAAI7B,SAAS8B,OAAO9B,OAAO,IAAI;IACjC;IACA,OAAO8B;AACT;AAEA,OAAO,eAAeuF,sBAAsBC,OAAgB;IAC1D,MAAM,EAAEC,MAAM,EAAEH,IAAI,EAAEI,SAASC,UAAU,EAAEC,KAAK,EAAE,GAAG,MAAM3K,qBAAqBuK;IAChF,MAAME,UAAUC;IAChB,IAAIF,WAAW,UAAUA,WAAW,OAAO;QACzC,OAAOI,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAqB,GAAG;YAAEC,QAAQ;QAAI;IACtE;IACA,IAAI,CAACC,QAAQC,GAAG,CAACC,WAAW,EAAE;QAC5B,OAAON,SAASC,IAAI,CAClB;YAAEC,OAAO;QAAmD,GAC5D;YAAEC,QAAQ;QAAI;IAElB;IACA,IAAI,CAAC1J,iBAAiBoJ,UAAU;QAC9B,OAAOG,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAkB,GAAG;YAAEC,QAAQ;QAAI;IACnE;IACA,uEAAuE;IACvE,oEAAoE;IACpE,iDAAiD;IACjD,MAAMtI,SAASnB,aAAa;QAAEkJ;QAAQH;QAAMM;IAAM;IAClD,sEAAsE;IACtE,yBAAyB;IACzB,IAAIH,WAAW,QAAQ,MAAM5I,eAAeI;IAE5C,IAAI;;YAyE6CmJ;QAxE/C,MAAMpJ,YAAYrB,cAAcoB,GAAG,GAAGC,SAAS;QAC/C,MAAMQ,QAAQ6I,KAAKC,GAAG;QACtB,MAAMjJ,MAAoB;YACxBL;YACAQ;YACAC,UAAUb;YACVc;YACAY,YAAY,MAAM1C;YAClB2G,QAAQ5F;QACV;QAEA,sEAAsE;QACtE,wEAAwE;QACxE,wDAAwD;QACxD,MAAM4J,iBAAiBhH,OAAQ+F,wBAAD,AAACA,KAA0CzG,KAAK;QAC9E,MAAM2H,WACJjH,OAAOkH,QAAQ,CAACF,mBAAmBA,iBAAiB,IAChDG,KAAKC,GAAG,CAACD,KAAKE,KAAK,CAACL,iBAAiBrJ,gCACrCA;QACN,MAAM2J,YAAavB,wBAAD,AAACA,KAA2CwB,MAAM;QACpE,MAAMA,SACJ,OAAOD,cAAc,YAAYA,UAAU9G,MAAM,GAAG,KAAK,CAAC8G,UAAU9C,QAAQ,CAAC,OACzE8C,YACA;QACN,IAAIE,WAAW/J,UACZyB,UAAU,CAAC,QACXG,OAAO,CAACjD,cAAcqB,SAAS,CAACgK,SAAS,CAACC,UAAU,IACpDpI,KAAK,CAAC2H,WAAW;QACpB,IAAIM,QAAQC,WAAWA,SAASG,UAAU,CAAClK,UAAUyB,UAAU,CAAC,QAAQM,GAAG,CAAC+H;QAC5E,MAAMvI,OAAO,MAAMwI,SAASjI,GAAG;QAC/B,MAAMqI,UAAU5I,KAAKS,IAAI,CAACe,MAAM,GAAGyG;QACnC,MAAMJ,UAAUe,UAAU5I,KAAKS,IAAI,CAACgE,KAAK,CAAC,GAAGwD,YAAYjI,KAAKS,IAAI;QAElE,MAAMoI,OAAkC,CAAC;QACzC,MAAMC,WAAmC,CAAC;QAC1C,IAAItJ,MAAM;QACV,IAAIC,UAAU;QACd,IAAIC,WAAW;QACf,IAAIC,UAAU;QACd,IAAIiH,WAAW;QACf,KAAK,MAAM7H,UAAU8I,QAAS;YAC5B,IAAI;gBACF,MAAMpG,SAAS,MAAM5C,UAAUC,KAAKC;gBACpC8J,IAAI,CAAC9J,OAAOM,EAAE,CAAC,GAAGoC;gBAClBjC,OAAOiC,OAAOjC,GAAG;gBACjBC,WAAWgC,OAAOhC,OAAO;gBACzBC,YAAY+B,OAAO/B,QAAQ;gBAC3BC,WAAW8B,OAAO9B,OAAO;gBACzB,IAAI8B,OAAOmF,QAAQ,EAAE;oBACnBA,WAAW;oBACX;gBACF;YACF,EAAE,OAAOY,OAAO;;gBACduB,QAAQvB,KAAK,CAAC,uCAAuCzI,OAAOM,EAAE,EAAEmI;gBAChEsB,QAAQ,CAAC/J,OAAOM,EAAE,CAAC,YAAImI,yBAAD,AAACA,MAAiBwB,OAAO,oBAAI;YACrD;QACF;QACA,MAAMC,SAASC,OAAO/F,IAAI,CAAC2F;QAC3B,OAAOxB,SAASC,IAAI,CAClB;YACErI,UAAUJ,IAAII,QAAQ;YACtBC;YACAgK,OAAOtB,QAAQrG,MAAM;YACrBhC;YACAC;YACAC;YACAC;YACAkJ;WACIjC,WAAW;YAAEA,UAAU;QAAK,IAAI,CAAC,GACjCqC,OAAOzH,MAAM,GAAG;YAAEsH;QAAS,IAAI,CAAC;YACpC,iEAAiE;YACjE,8DAA8D;YAC9DM,YAAYxC,YAAY,CAACgC,UAAU,gBAAQf,YAAAA,OAAO,CAACA,QAAQrG,MAAM,GAAG,EAAE,qBAA3BqG,UAA6BxI,EAAE,mBAAI;YAC9EgK,MAAMzC,YAAY,CAACgC;YAErB,uEAAuE;QACvE,sDAAsD;QACtD;YAAEnB,QAAQwB,OAAOzH,MAAM,GAAG,MAAM;QAAI;IAExC,EAAE,OAAOgG,OAAO;QACduB,QAAQvB,KAAK,CAAC,mCAAmCA;QACjD,OAAOF,SAASC,IAAI,CAAC;YAAEC,OAAO;QAA4B,GAAG;YAAEC,QAAQ;QAAI;IAC7E;AACF"}