@aglyn/plugins-crm 1.0.0-beta.218 → 1.0.0-beta.220

package/src/lib/plugin.js

@@ -21,6 +21,7 @@ import { CrmGlanceCard } from "./components/crm-glance-card.js";
 import { BUNDLE_ID } from "./constants/bundle-common.js";
 import { withCrmOrgMount } from "./hooks/use-crm-org-mount.js";
 import { registerCrmRecordRoutes } from "./model/crm-record-routes.js";
+import { CRM_SEARCH_SOURCES } from "./model/crm-search-sources.js";
 import { registerPluginZone } from "@aglyn/aglyn/plugin-manager/plugin-zones";
 import { CRM_RECORD_ATTRIBUTION_ZONE } from "./components/crm-attribution-zone.js";
 import { CRM_RECORD_BOOKING_ZONE } from "./components/crm-booking-zone.js";
@@ -109,6 +110,8 @@ const CrmTasksDueCard = lazy(()=>import("./components/crm-tasks-due-card.js"));
      * and the Firestore rules ask the same question where the data is
      * (`server/suite-gate.ts`).
      */ featureFlag: 'crm',
+        // What the console's search finds here, under the two gates above.
+        searchSources: CRM_SEARCH_SOURCES,
         /*
      * Dashboard cards (AGL-2599, AGL-2604): the site dashboard's `hostDashboard`
      * slot composes this extension's permission over each, so a card appears
@@ -201,6 +204,42 @@ const CrmTasksDueCard = lazy(()=>import("./components/crm-tasks-due-card.js"));
                 },
                 Component: CrmConsolePage
             }
+        ],
+        /*
+     * The ORGANIZATION's CRM hub (AGL-2630), at `/[orgSlug]/crm`: the same
+     * sections over every site at once, mounted with no site and the org's
+     * sites as `orgMount`. Its listeners carry no scope clause, so the
+     * shell's org route refuses a site collaborator on REACH before it asks
+     * the `data.manage` declared above; a permission alone, which a
+     * collaborator's role can carry, never opens it.
+     *
+     * It carries the SITE tab's id on purpose: `release_contacts` names
+     * `nav-tab-contacts`, so one flag holds both halves of the CRM, and the
+     * org half cannot ship while the site half is switched off. First among
+     * the organization's plugin tabs, beside Data, the org's other shared
+     * collection of records. The help opens the docs heading about this
+     * mount. Its old address, `/[orgSlug]/contacts`, is a console redirect
+     * (`consoleRedirects`), so it needs no `legacyHrefs` here.
+     */ orgNavItems: [
+            {
+                label: 'CRM',
+                href: '/crm',
+                sections: CRM_CONSOLE_SECTIONS,
+                navTabId: 'nav-tab-contacts',
+                tabOrder: -100,
+                icon: {
+                    path: mdiCardAccountDetailsOutline.path
+                },
+                header: {
+                    title: 'CRM',
+                    icon: {
+                        path: mdiCardAccountDetailsOutline.path
+                    },
+                    docsTopic: 'crm',
+                    docsAnchor: '#at-the-organization-level'
+                },
+                Component: CrmConsolePage
+            }
         ]
     });
 }

package/src/lib/plugin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/plugins/crm/src/lib/plugin.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn'\nimport { mdiCardAccountDetailsOutline } from '@aglyn/shared-data-mdi'\nimport { lazy } from 'react'\nimport { CRM_CONSOLE_SECTIONS } from './components/crm-console-sections'\nimport { CrmGlanceCard } from './components/crm-glance-card'\nimport { BUNDLE_ID } from './constants/bundle-common'\nimport { withCrmOrgMount } from './hooks/use-crm-org-mount'\nimport { registerCrmRecordRoutes } from './model/crm-record-routes'\nimport { registerPluginZone } from '@aglyn/aglyn/plugin-manager/plugin-zones'\nimport { CRM_RECORD_ATTRIBUTION_ZONE } from './components/crm-attribution-zone'\nimport { CRM_RECORD_BOOKING_ZONE } from './components/crm-booking-zone'\n\n/** Code-split: the CRM hub only loads when opened. */\nconst CrmConsolePage = lazy(\n  () => import('./components/crm-console-page'),\n)\n/** The dashboard glance, split the same way: it loads where the slot mounts it. */\n/** Where a form's fields save on a contact, drawn on the form's own page. */\nconst FormContactFieldsCard = lazy(\n  () => import('./components/form-contact-fields-card'),\n)\n\nconst CrmTasksDueCard = lazy(\n  () => import('./components/crm-tasks-due-card'),\n)\n\n/**\n * CRM feature plugin (AGL-395, the hub since AGL-2595). Console-only — its\n * records live in Firestore and have no canvas element, so there is no UI\n * bundle. The console half declares the CRM nav + hub through the\n * ConsoleExtension registry (release_crm gate via the nav tab); the\n * contacts section reads the `contactsPerHost` quota off the shell-passed\n * `org`.\n *\n * The plugin id is `crm` (AGL-2595). It was `contacts` while the surface was\n * one list; the id is persisted in every org's `enabledPlugins` and every\n * host's `disabledPlugins`, so the runtime read the old value as this one\n * until the stored documents had been rewritten, and the alias was retired\n * once that backfill reported nothing left (AGL-2614). The `/contacts`\n * address is a URL, not a stored id, and the nav item keeps redirecting it.\n */\nexport function registerCrmConsole(): void {\n  registerCrmRecordRoutes()\n  registerPluginZone(\n    {\n      zone: CRM_RECORD_BOOKING_ZONE,\n      label: 'Book a meeting from a CRM record',\n      surface: 'console',\n      // One control in a record header's row of actions, and one beside the\n      // composer's fields: the page lays them out, so the zone adds nothing.\n      layout: 'bare',\n      description:\n        'In a record’s header and beside the one-to-one composer. A widget here offers the site’s bookable services and the link a visitor books one at; it is handed the site, the record and, from the composer, a way to insert the chosen link. It writes nothing.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  registerPluginZone(\n    {\n      zone: CRM_RECORD_ATTRIBUTION_ZONE,\n      label: 'Where a CRM record came from',\n      surface: 'console',\n      description:\n        'On a contact’s page and in a lead’s history. A widget here says which campaign or link brought the person; it is handed the site, what the record is and its id, and it writes nothing.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  Aglyn.registerConsoleExtension({\n    pluginId: BUNDLE_ID,\n    displayName: 'CRM',\n    /*\n     * WHO may open the CRM, declared so the shell enforces it.\n     *\n     * `navTabId` below is a release flag, not authorization: it says whether\n     * the surface has shipped, and `FeatureGate` reads it as\n     * `released || isStaff`. Nothing above this page decided who among a\n     * workspace's members may read it, and the page is a full editor over\n     * org-shared people data — names, addresses, order history, notes,\n     * consent, and a CSV export of all of it.\n     *\n     * `data.manage` rather than a key of this plugin's own, because it is\n     * the catalog key whose subject is exactly this data. The Firestore\n     * rules place contacts in the org-shared data block with datasets and\n     * gate writes on `canWriteOrgData()` — owner, admin, editor — which is\n     * the population `data.manage` defaults to, so the console gate and the\n     * rules agree on the built-in roles by construction. A custom role or a\n     * per-member override then narrows the console further, and the rules\n     * stay the boundary for the data itself.\n     *\n     * Minting a `contacts.*` key instead would advertise a control that does\n     * not exist. Console contact writes are client-direct against the rules,\n     * so a new key would have no server enforcement point to sit on, and a\n     * permission a customer can untick that changes nothing is worse than\n     * its absence.\n     *\n     * A SITE COLLABORATOR holding it reaches this page deliberately. They\n     * are a real org member document, so this gate is the first thing that\n     * has ever asked about them here — and the answer is yes, scoped: the\n     * listener filters on `visibleTo`, the rules prove the same predicate\n     * per document, and every field the page shows is read through the\n     * viewing group's own facet. Refusing them outright would delete a\n     * shipped capability rather than close a hole.\n     */\n    permission: 'data.manage',\n    /*\n     * WHAT the workspace must have bought (AGL-2851). The CRM is included\n     * from Starter and a Free workspace has none of it, so the flag is\n     * declared once, here, and the shell refuses every surface this\n     * registers on a plan without it: the hub body at both mounts, every\n     * section and record beneath it, drawn locked beside the upgrade notice,\n     * and the dashboard cards. The nav tab stays, as every plan-locked tab\n     * does, because it is the way to that notice. The CRM's routes, `/v1`\n     * and the Firestore rules ask the same question where the data is\n     * (`server/suite-gate.ts`).\n     */\n    featureFlag: 'crm',\n    /*\n     * Dashboard cards (AGL-2599, AGL-2604): the site dashboard's `hostDashboard`\n     * slot composes this extension's permission over each, so a card appears\n     * only where the CRM is enabled and only for a reader who may open it —\n     * registered here rather than imported by the dashboard so the shell's\n     * enablement and entitlement gate decides whether a site that never turned\n     * the CRM on sees them, the rule every card on that row follows. The tasks\n     * card is a glance at the reader's own overdue and due-today work and\n     * renders nothing on a workspace that has never made a task; the glance\n     * card is four server-counted figures, each a link into the hub.\n     *\n     * Both name `features.crm`, as the extension does (AGL-2611, AGL-2851):\n     * the slot composes the two, so a plan without the CRM gets neither card\n     * — absent, not upsold, the treatment every gated card gets.\n     *\n     * The same two cards again on the organization's `orgDashboard` slot\n     * (AGL-2636) — the org's sites page — under the same flag, with the same\n     * ids: the id names the card, and it is one card totaling the whole\n     * organization there instead of one site. The shell hands that slot the\n     * org mount as a prop, and `withCrmOrgMount` is what puts the mount's\n     * provider around each card, since the sites page cannot import one.\n     */\n    widgets: [\n      // Which contact field each of a form's fields saves to, on the form's\n      // own page. The forms plugin hosts the zone and writes the form\n      // document; what a contact's fields ARE is this plugin's, so the card\n      // is too.\n      {\n        slot: 'formContactFields',\n        widgetId: 'crm-form-contact-fields',\n        title: 'Saves to contact fields',\n        // A contact's custom fields are part of the suite, so a workspace\n        // without it has none to map a form's field onto.\n        featureFlag: 'crm',\n        Component: FormContactFieldsCard,\n      },\n      {\n        slot: Aglyn.CONSOLE_WIDGET_SLOTS.hostDashboard,\n        widgetId: 'crm-tasks-due',\n        title: 'Tasks due',\n        featureFlag: 'crm',\n        Component: CrmTasksDueCard,\n      },\n      {\n        slot: Aglyn.CONSOLE_WIDGET_SLOTS.hostDashboard,\n        widgetId: 'crm-glance',\n        title: 'CRM at a glance',\n        featureFlag: 'crm',\n        Component: CrmGlanceCard,\n      },\n      {\n        slot: Aglyn.CONSOLE_WIDGET_SLOTS.orgDashboard,\n        widgetId: 'crm-tasks-due',\n        title: 'Tasks due',\n        featureFlag: 'crm',\n        Component: withCrmOrgMount(CrmTasksDueCard),\n      },\n      {\n        slot: Aglyn.CONSOLE_WIDGET_SLOTS.orgDashboard,\n        widgetId: 'crm-glance',\n        title: 'CRM at a glance',\n        featureFlag: 'crm',\n        Component: withCrmOrgMount(CrmGlanceCard),\n      },\n    ],\n    navItems: [\n      {\n        label: 'CRM',\n        href: '/crm',\n        // The address the surface had while it was one list. A link kept\n        // from then — a bookmark, a docs page, an email — still opens the\n        // hub rather than the shell's \"not available\" notice.\n        legacyHrefs: ['/contacts'],\n        // Sections as ROUTES (AGL-2595): each is a real URL the shell\n        // resolves and gates, so the page mounts the one being read and a\n        // bare `/crm` lands on the first. Every section inherits this\n        // item's `release_crm` gate.\n        sections: CRM_CONSOLE_SECTIONS,\n        navTabId: 'nav-tab-contacts',\n        icon: { path: mdiCardAccountDetailsOutline.path },\n        header: {\n          title: 'CRM',\n          icon: { path: mdiCardAccountDetailsOutline.path },\n          docsTopic: 'crm',\n        },\n        Component: CrmConsolePage,\n      },\n    ],\n  })\n}\n"],"names":["Aglyn","mdiCardAccountDetailsOutline","lazy","CRM_CONSOLE_SECTIONS","CrmGlanceCard","BUNDLE_ID","withCrmOrgMount","registerCrmRecordRoutes","registerPluginZone","CRM_RECORD_ATTRIBUTION_ZONE","CRM_RECORD_BOOKING_ZONE","CrmConsolePage","FormContactFieldsCard","CrmTasksDueCard","registerCrmConsole","zone","label","surface","layout","description","pluginId","registerConsoleExtension","displayName","permission","featureFlag","widgets","slot","widgetId","title","Component","CONSOLE_WIDGET_SLOTS","hostDashboard","orgDashboard","navItems","href","legacyHrefs","sections","navTabId","icon","path","header","docsTopic"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,eAAc;AACrC,SAASC,4BAA4B,QAAQ,yBAAwB;AACrE,SAASC,IAAI,QAAQ,QAAO;AAC5B,SAASC,oBAAoB,QAAQ,uCAAmC;AACxE,SAASC,aAAa,QAAQ,kCAA8B;AAC5D,SAASC,SAAS,QAAQ,+BAA2B;AACrD,SAASC,eAAe,QAAQ,+BAA2B;AAC3D,SAASC,uBAAuB,QAAQ,+BAA2B;AACnE,SAASC,kBAAkB,QAAQ,2CAA0C;AAC7E,SAASC,2BAA2B,QAAQ,uCAAmC;AAC/E,SAASC,uBAAuB,QAAQ,mCAA+B;AAEvE,oDAAoD,GACpD,MAAMC,iBAAiBT,KACrB,IAAM,MAAM,CAAC;AAEf,iFAAiF,GACjF,2EAA2E,GAC3E,MAAMU,wBAAwBV,KAC5B,IAAM,MAAM,CAAC;AAGf,MAAMW,kBAAkBX,KACtB,IAAM,MAAM,CAAC;AAGf;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASY;IACdP;IACAC,mBACE;QACEO,MAAML;QACNM,OAAO;QACPC,SAAS;QACT,sEAAsE;QACtE,uEAAuE;QACvEC,QAAQ;QACRC,aACE;IACJ,GACA;QAAEC,UAAUf;IAAU;IAExBG,mBACE;QACEO,MAAMN;QACNO,OAAO;QACPC,SAAS;QACTE,aACE;IACJ,GACA;QAAEC,UAAUf;IAAU;IAExBL,MAAMqB,wBAAwB,CAAC;QAC7BD,UAAUf;QACViB,aAAa;QACb;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAgCC,GACDC,YAAY;QACZ;;;;;;;;;;KAUC,GACDC,aAAa;QACb;;;;;;;;;;;;;;;;;;;;;KAqBC,GACDC,SAAS;YACP,sEAAsE;YACtE,gEAAgE;YAChE,sEAAsE;YACtE,UAAU;YACV;gBACEC,MAAM;gBACNC,UAAU;gBACVC,OAAO;gBACP,kEAAkE;gBAClE,kDAAkD;gBAClDJ,aAAa;gBACbK,WAAWjB;YACb;YACA;gBACEc,MAAM1B,MAAM8B,oBAAoB,CAACC,aAAa;gBAC9CJ,UAAU;gBACVC,OAAO;gBACPJ,aAAa;gBACbK,WAAWhB;YACb;YACA;gBACEa,MAAM1B,MAAM8B,oBAAoB,CAACC,aAAa;gBAC9CJ,UAAU;gBACVC,OAAO;gBACPJ,aAAa;gBACbK,WAAWzB;YACb;YACA;gBACEsB,MAAM1B,MAAM8B,oBAAoB,CAACE,YAAY;gBAC7CL,UAAU;gBACVC,OAAO;gBACPJ,aAAa;gBACbK,WAAWvB,gBAAgBO;YAC7B;YACA;gBACEa,MAAM1B,MAAM8B,oBAAoB,CAACE,YAAY;gBAC7CL,UAAU;gBACVC,OAAO;gBACPJ,aAAa;gBACbK,WAAWvB,gBAAgBF;YAC7B;SACD;QACD6B,UAAU;YACR;gBACEjB,OAAO;gBACPkB,MAAM;gBACN,iEAAiE;gBACjE,kEAAkE;gBAClE,sDAAsD;gBACtDC,aAAa;oBAAC;iBAAY;gBAC1B,8DAA8D;gBAC9D,kEAAkE;gBAClE,8DAA8D;gBAC9D,6BAA6B;gBAC7BC,UAAUjC;gBACVkC,UAAU;gBACVC,MAAM;oBAAEC,MAAMtC,6BAA6BsC,IAAI;gBAAC;gBAChDC,QAAQ;oBACNZ,OAAO;oBACPU,MAAM;wBAAEC,MAAMtC,6BAA6BsC,IAAI;oBAAC;oBAChDE,WAAW;gBACb;gBACAZ,WAAWlB;YACb;SACD;IACH;AACF"}
+{"version":3,"sources":["../../../../../../libs/plugins/crm/src/lib/plugin.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn'\nimport { mdiCardAccountDetailsOutline } from '@aglyn/shared-data-mdi'\nimport { lazy } from 'react'\nimport { CRM_CONSOLE_SECTIONS } from './components/crm-console-sections'\nimport { CrmGlanceCard } from './components/crm-glance-card'\nimport { BUNDLE_ID } from './constants/bundle-common'\nimport { withCrmOrgMount } from './hooks/use-crm-org-mount'\nimport { registerCrmRecordRoutes } from './model/crm-record-routes'\nimport { CRM_SEARCH_SOURCES } from './model/crm-search-sources'\nimport { registerPluginZone } from '@aglyn/aglyn/plugin-manager/plugin-zones'\nimport { CRM_RECORD_ATTRIBUTION_ZONE } from './components/crm-attribution-zone'\nimport { CRM_RECORD_BOOKING_ZONE } from './components/crm-booking-zone'\n\n/** Code-split: the CRM hub only loads when opened. */\nconst CrmConsolePage = lazy(\n  () => import('./components/crm-console-page'),\n)\n/** The dashboard glance, split the same way: it loads where the slot mounts it. */\n/** Where a form's fields save on a contact, drawn on the form's own page. */\nconst FormContactFieldsCard = lazy(\n  () => import('./components/form-contact-fields-card'),\n)\n\nconst CrmTasksDueCard = lazy(\n  () => import('./components/crm-tasks-due-card'),\n)\n\n/**\n * CRM feature plugin (AGL-395, the hub since AGL-2595). Console-only — its\n * records live in Firestore and have no canvas element, so there is no UI\n * bundle. The console half declares the CRM nav + hub through the\n * ConsoleExtension registry (release_crm gate via the nav tab); the\n * contacts section reads the `contactsPerHost` quota off the shell-passed\n * `org`.\n *\n * The plugin id is `crm` (AGL-2595). It was `contacts` while the surface was\n * one list; the id is persisted in every org's `enabledPlugins` and every\n * host's `disabledPlugins`, so the runtime read the old value as this one\n * until the stored documents had been rewritten, and the alias was retired\n * once that backfill reported nothing left (AGL-2614). The `/contacts`\n * address is a URL, not a stored id, and the nav item keeps redirecting it.\n */\nexport function registerCrmConsole(): void {\n  registerCrmRecordRoutes()\n  registerPluginZone(\n    {\n      zone: CRM_RECORD_BOOKING_ZONE,\n      label: 'Book a meeting from a CRM record',\n      surface: 'console',\n      // One control in a record header's row of actions, and one beside the\n      // composer's fields: the page lays them out, so the zone adds nothing.\n      layout: 'bare',\n      description:\n        'In a record’s header and beside the one-to-one composer. A widget here offers the site’s bookable services and the link a visitor books one at; it is handed the site, the record and, from the composer, a way to insert the chosen link. It writes nothing.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  registerPluginZone(\n    {\n      zone: CRM_RECORD_ATTRIBUTION_ZONE,\n      label: 'Where a CRM record came from',\n      surface: 'console',\n      description:\n        'On a contact’s page and in a lead’s history. A widget here says which campaign or link brought the person; it is handed the site, what the record is and its id, and it writes nothing.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  Aglyn.registerConsoleExtension({\n    pluginId: BUNDLE_ID,\n    displayName: 'CRM',\n    /*\n     * WHO may open the CRM, declared so the shell enforces it.\n     *\n     * `navTabId` below is a release flag, not authorization: it says whether\n     * the surface has shipped, and `FeatureGate` reads it as\n     * `released || isStaff`. Nothing above this page decided who among a\n     * workspace's members may read it, and the page is a full editor over\n     * org-shared people data — names, addresses, order history, notes,\n     * consent, and a CSV export of all of it.\n     *\n     * `data.manage` rather than a key of this plugin's own, because it is\n     * the catalog key whose subject is exactly this data. The Firestore\n     * rules place contacts in the org-shared data block with datasets and\n     * gate writes on `canWriteOrgData()` — owner, admin, editor — which is\n     * the population `data.manage` defaults to, so the console gate and the\n     * rules agree on the built-in roles by construction. A custom role or a\n     * per-member override then narrows the console further, and the rules\n     * stay the boundary for the data itself.\n     *\n     * Minting a `contacts.*` key instead would advertise a control that does\n     * not exist. Console contact writes are client-direct against the rules,\n     * so a new key would have no server enforcement point to sit on, and a\n     * permission a customer can untick that changes nothing is worse than\n     * its absence.\n     *\n     * A SITE COLLABORATOR holding it reaches this page deliberately. They\n     * are a real org member document, so this gate is the first thing that\n     * has ever asked about them here — and the answer is yes, scoped: the\n     * listener filters on `visibleTo`, the rules prove the same predicate\n     * per document, and every field the page shows is read through the\n     * viewing group's own facet. Refusing them outright would delete a\n     * shipped capability rather than close a hole.\n     */\n    permission: 'data.manage',\n    /*\n     * WHAT the workspace must have bought (AGL-2851). The CRM is included\n     * from Starter and a Free workspace has none of it, so the flag is\n     * declared once, here, and the shell refuses every surface this\n     * registers on a plan without it: the hub body at both mounts, every\n     * section and record beneath it, drawn locked beside the upgrade notice,\n     * and the dashboard cards. The nav tab stays, as every plan-locked tab\n     * does, because it is the way to that notice. The CRM's routes, `/v1`\n     * and the Firestore rules ask the same question where the data is\n     * (`server/suite-gate.ts`).\n     */\n    featureFlag: 'crm',\n    // What the console's search finds here, under the two gates above.\n    searchSources: CRM_SEARCH_SOURCES,\n    /*\n     * Dashboard cards (AGL-2599, AGL-2604): the site dashboard's `hostDashboard`\n     * slot composes this extension's permission over each, so a card appears\n     * only where the CRM is enabled and only for a reader who may open it —\n     * registered here rather than imported by the dashboard so the shell's\n     * enablement and entitlement gate decides whether a site that never turned\n     * the CRM on sees them, the rule every card on that row follows. The tasks\n     * card is a glance at the reader's own overdue and due-today work and\n     * renders nothing on a workspace that has never made a task; the glance\n     * card is four server-counted figures, each a link into the hub.\n     *\n     * Both name `features.crm`, as the extension does (AGL-2611, AGL-2851):\n     * the slot composes the two, so a plan without the CRM gets neither card\n     * — absent, not upsold, the treatment every gated card gets.\n     *\n     * The same two cards again on the organization's `orgDashboard` slot\n     * (AGL-2636) — the org's sites page — under the same flag, with the same\n     * ids: the id names the card, and it is one card totaling the whole\n     * organization there instead of one site. The shell hands that slot the\n     * org mount as a prop, and `withCrmOrgMount` is what puts the mount's\n     * provider around each card, since the sites page cannot import one.\n     */\n    widgets: [\n      // Which contact field each of a form's fields saves to, on the form's\n      // own page. The forms plugin hosts the zone and writes the form\n      // document; what a contact's fields ARE is this plugin's, so the card\n      // is too.\n      {\n        slot: 'formContactFields',\n        widgetId: 'crm-form-contact-fields',\n        title: 'Saves to contact fields',\n        // A contact's custom fields are part of the suite, so a workspace\n        // without it has none to map a form's field onto.\n        featureFlag: 'crm',\n        Component: FormContactFieldsCard,\n      },\n      {\n        slot: Aglyn.CONSOLE_WIDGET_SLOTS.hostDashboard,\n        widgetId: 'crm-tasks-due',\n        title: 'Tasks due',\n        featureFlag: 'crm',\n        Component: CrmTasksDueCard,\n      },\n      {\n        slot: Aglyn.CONSOLE_WIDGET_SLOTS.hostDashboard,\n        widgetId: 'crm-glance',\n        title: 'CRM at a glance',\n        featureFlag: 'crm',\n        Component: CrmGlanceCard,\n      },\n      {\n        slot: Aglyn.CONSOLE_WIDGET_SLOTS.orgDashboard,\n        widgetId: 'crm-tasks-due',\n        title: 'Tasks due',\n        featureFlag: 'crm',\n        Component: withCrmOrgMount(CrmTasksDueCard),\n      },\n      {\n        slot: Aglyn.CONSOLE_WIDGET_SLOTS.orgDashboard,\n        widgetId: 'crm-glance',\n        title: 'CRM at a glance',\n        featureFlag: 'crm',\n        Component: withCrmOrgMount(CrmGlanceCard),\n      },\n    ],\n    navItems: [\n      {\n        label: 'CRM',\n        href: '/crm',\n        // The address the surface had while it was one list. A link kept\n        // from then — a bookmark, a docs page, an email — still opens the\n        // hub rather than the shell's \"not available\" notice.\n        legacyHrefs: ['/contacts'],\n        // Sections as ROUTES (AGL-2595): each is a real URL the shell\n        // resolves and gates, so the page mounts the one being read and a\n        // bare `/crm` lands on the first. Every section inherits this\n        // item's `release_crm` gate.\n        sections: CRM_CONSOLE_SECTIONS,\n        navTabId: 'nav-tab-contacts',\n        icon: { path: mdiCardAccountDetailsOutline.path },\n        header: {\n          title: 'CRM',\n          icon: { path: mdiCardAccountDetailsOutline.path },\n          docsTopic: 'crm',\n        },\n        Component: CrmConsolePage,\n      },\n    ],\n    /*\n     * The ORGANIZATION's CRM hub (AGL-2630), at `/[orgSlug]/crm`: the same\n     * sections over every site at once, mounted with no site and the org's\n     * sites as `orgMount`. Its listeners carry no scope clause, so the\n     * shell's org route refuses a site collaborator on REACH before it asks\n     * the `data.manage` declared above; a permission alone, which a\n     * collaborator's role can carry, never opens it.\n     *\n     * It carries the SITE tab's id on purpose: `release_contacts` names\n     * `nav-tab-contacts`, so one flag holds both halves of the CRM, and the\n     * org half cannot ship while the site half is switched off. First among\n     * the organization's plugin tabs, beside Data, the org's other shared\n     * collection of records. The help opens the docs heading about this\n     * mount. Its old address, `/[orgSlug]/contacts`, is a console redirect\n     * (`consoleRedirects`), so it needs no `legacyHrefs` here.\n     */\n    orgNavItems: [\n      {\n        label: 'CRM',\n        href: '/crm',\n        sections: CRM_CONSOLE_SECTIONS,\n        navTabId: 'nav-tab-contacts',\n        tabOrder: -100,\n        icon: { path: mdiCardAccountDetailsOutline.path },\n        header: {\n          title: 'CRM',\n          icon: { path: mdiCardAccountDetailsOutline.path },\n          docsTopic: 'crm',\n          docsAnchor: '#at-the-organization-level',\n        },\n        Component: CrmConsolePage,\n      },\n    ],\n  })\n}\n"],"names":["Aglyn","mdiCardAccountDetailsOutline","lazy","CRM_CONSOLE_SECTIONS","CrmGlanceCard","BUNDLE_ID","withCrmOrgMount","registerCrmRecordRoutes","CRM_SEARCH_SOURCES","registerPluginZone","CRM_RECORD_ATTRIBUTION_ZONE","CRM_RECORD_BOOKING_ZONE","CrmConsolePage","FormContactFieldsCard","CrmTasksDueCard","registerCrmConsole","zone","label","surface","layout","description","pluginId","registerConsoleExtension","displayName","permission","featureFlag","searchSources","widgets","slot","widgetId","title","Component","CONSOLE_WIDGET_SLOTS","hostDashboard","orgDashboard","navItems","href","legacyHrefs","sections","navTabId","icon","path","header","docsTopic","orgNavItems","tabOrder","docsAnchor"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,eAAc;AACrC,SAASC,4BAA4B,QAAQ,yBAAwB;AACrE,SAASC,IAAI,QAAQ,QAAO;AAC5B,SAASC,oBAAoB,QAAQ,uCAAmC;AACxE,SAASC,aAAa,QAAQ,kCAA8B;AAC5D,SAASC,SAAS,QAAQ,+BAA2B;AACrD,SAASC,eAAe,QAAQ,+BAA2B;AAC3D,SAASC,uBAAuB,QAAQ,+BAA2B;AACnE,SAASC,kBAAkB,QAAQ,gCAA4B;AAC/D,SAASC,kBAAkB,QAAQ,2CAA0C;AAC7E,SAASC,2BAA2B,QAAQ,uCAAmC;AAC/E,SAASC,uBAAuB,QAAQ,mCAA+B;AAEvE,oDAAoD,GACpD,MAAMC,iBAAiBV,KACrB,IAAM,MAAM,CAAC;AAEf,iFAAiF,GACjF,2EAA2E,GAC3E,MAAMW,wBAAwBX,KAC5B,IAAM,MAAM,CAAC;AAGf,MAAMY,kBAAkBZ,KACtB,IAAM,MAAM,CAAC;AAGf;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASa;IACdR;IACAE,mBACE;QACEO,MAAML;QACNM,OAAO;QACPC,SAAS;QACT,sEAAsE;QACtE,uEAAuE;QACvEC,QAAQ;QACRC,aACE;IACJ,GACA;QAAEC,UAAUhB;IAAU;IAExBI,mBACE;QACEO,MAAMN;QACNO,OAAO;QACPC,SAAS;QACTE,aACE;IACJ,GACA;QAAEC,UAAUhB;IAAU;IAExBL,MAAMsB,wBAAwB,CAAC;QAC7BD,UAAUhB;QACVkB,aAAa;QACb;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAgCC,GACDC,YAAY;QACZ;;;;;;;;;;KAUC,GACDC,aAAa;QACb,mEAAmE;QACnEC,eAAelB;QACf;;;;;;;;;;;;;;;;;;;;;KAqBC,GACDmB,SAAS;YACP,sEAAsE;YACtE,gEAAgE;YAChE,sEAAsE;YACtE,UAAU;YACV;gBACEC,MAAM;gBACNC,UAAU;gBACVC,OAAO;gBACP,kEAAkE;gBAClE,kDAAkD;gBAClDL,aAAa;gBACbM,WAAWlB;YACb;YACA;gBACEe,MAAM5B,MAAMgC,oBAAoB,CAACC,aAAa;gBAC9CJ,UAAU;gBACVC,OAAO;gBACPL,aAAa;gBACbM,WAAWjB;YACb;YACA;gBACEc,MAAM5B,MAAMgC,oBAAoB,CAACC,aAAa;gBAC9CJ,UAAU;gBACVC,OAAO;gBACPL,aAAa;gBACbM,WAAW3B;YACb;YACA;gBACEwB,MAAM5B,MAAMgC,oBAAoB,CAACE,YAAY;gBAC7CL,UAAU;gBACVC,OAAO;gBACPL,aAAa;gBACbM,WAAWzB,gBAAgBQ;YAC7B;YACA;gBACEc,MAAM5B,MAAMgC,oBAAoB,CAACE,YAAY;gBAC7CL,UAAU;gBACVC,OAAO;gBACPL,aAAa;gBACbM,WAAWzB,gBAAgBF;YAC7B;SACD;QACD+B,UAAU;YACR;gBACElB,OAAO;gBACPmB,MAAM;gBACN,iEAAiE;gBACjE,kEAAkE;gBAClE,sDAAsD;gBACtDC,aAAa;oBAAC;iBAAY;gBAC1B,8DAA8D;gBAC9D,kEAAkE;gBAClE,8DAA8D;gBAC9D,6BAA6B;gBAC7BC,UAAUnC;gBACVoC,UAAU;gBACVC,MAAM;oBAAEC,MAAMxC,6BAA6BwC,IAAI;gBAAC;gBAChDC,QAAQ;oBACNZ,OAAO;oBACPU,MAAM;wBAAEC,MAAMxC,6BAA6BwC,IAAI;oBAAC;oBAChDE,WAAW;gBACb;gBACAZ,WAAWnB;YACb;SACD;QACD;;;;;;;;;;;;;;;KAeC,GACDgC,aAAa;YACX;gBACE3B,OAAO;gBACPmB,MAAM;gBACNE,UAAUnC;gBACVoC,UAAU;gBACVM,UAAU,CAAC;gBACXL,MAAM;oBAAEC,MAAMxC,6BAA6BwC,IAAI;gBAAC;gBAChDC,QAAQ;oBACNZ,OAAO;oBACPU,MAAM;wBAAEC,MAAMxC,6BAA6BwC,IAAI;oBAAC;oBAChDE,WAAW;oBACXG,YAAY;gBACd;gBACAf,WAAWnB;YACb;SACD;IACH;AACF"}

package/src/lib/server/api-v1/contacts-merge.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type ApiV1Context } from '@aglyn/tenant-data-admin/server/api-v1-kit';
+/** The key an integration names the record to fold in by. */
+export declare const MERGE_SOURCE_FIELD = "sourceContactId";
+export declare function mergeContactRoute(request: Request, ctx: ApiV1Context, survivorRef: FirebaseFirestore.DocumentReference, view: (snapshot: FirebaseFirestore.DocumentSnapshot) => unknown): Promise<Response>;

package/src/lib/server/api-v1/contacts-merge.js

@@ -0,0 +1,120 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * `POST /v1/contacts/{contactId}/merge` (AGL-2625) — fold another contact
+ * into this one.
+ *
+ * The contact in the path SURVIVES: it keeps its address as the identity,
+ * and the record named by `sourceContactId` is folded into it and deleted.
+ * `mergeContacts` (`../merge-contacts.ts`) is the whole of the work — the same
+ * function behind the console's `crm/contacts-merge` — so an integration
+ * and a person at the record page cannot merge two different ways.
+ *
+ * ## Idempotency
+ *
+ * Takes an `Idempotency-Key` with the delete's exact semantics, and for the
+ * delete's reason: a merge destroys a record, and a retry after a lost
+ * response must be able to tell "already merged" from "wrong id". Without a
+ * key, a second call finds no source contact and answers `404`, which is
+ * true and is the confusion the key removes.
+ *
+ * ## What it answers
+ *
+ * The surviving contact, read back the way `GET` reads it — the
+ * organization-wide profile, or one site's through `?consentSiteId=` —
+ * with its `alternateEmails` now carrying the merged address.
+ */ import { ApiErrors, apiJson } from "@aglyn/tenant-data-admin";
+import { apiKeyActorLabel } from "@aglyn/aglyn/app-utils/activity-presenter";
+import { claimWrite, readJsonBody } from "@aglyn/tenant-data-admin/server/api-v1-kit";
+import { mergeContacts } from "../merge-contacts.js";
+/** The key an integration names the record to fold in by. */ export const MERGE_SOURCE_FIELD = 'sourceContactId';
+export async function mergeContactRoute(request, ctx, survivorRef, view) {
+    const body = await readJsonBody(request);
+    const raw = body[MERGE_SOURCE_FIELD];
+    const sourceId = typeof raw === 'string' ? raw.trim() : '';
+    const fields = {};
+    if (raw === undefined) fields[MERGE_SOURCE_FIELD] = 'Required — the contact to merge into this one';
+    else if (!sourceId) fields[MERGE_SOURCE_FIELD] = 'Must be a contact id';
+    else if (sourceId === survivorRef.id) {
+        fields[MERGE_SOURCE_FIELD] = 'Must be a different contact from the one in the path';
+    }
+    for (const key of Object.keys(body)){
+        if (key !== MERGE_SOURCE_FIELD) fields[key] = 'Not accepted on a merge';
+    }
+    if (Object.keys(fields).length) {
+        return ApiErrors.badRequest({
+            message: 'Merge failed validation',
+            code: 'validation_failed',
+            fields,
+            headers: ctx.headers
+        });
+    }
+    const claimed = await claimWrite(ctx, '*', request.headers.get('Idempotency-Key'), 'contact-merges');
+    if ('replay' in claimed) return claimed.replay;
+    const { claim } = claimed;
+    try {
+        const result = await mergeContacts({
+            firestore: ctx.firestore,
+            orgRef: ctx.firestore.collection('orgs').doc(ctx.orgId),
+            survivorId: survivorRef.id,
+            mergedId: sourceId,
+            // A key has no uid; `'api'` is the attribution every API-created CRM
+            // record carries in `createdByUid`, and the note it leaves names the
+            // key when the organization named it.
+            actor: {
+                uid: 'api',
+                email: null,
+                apiKeyName: ctx.keyName
+            },
+            hostId: null,
+            actorName: ctx.keyName ? apiKeyActorLabel(ctx.keyName) : 'API'
+        });
+        if (result.ok === false) {
+            await claim.release();
+            if (result.reason === 'survivor-missing') {
+                return ApiErrors.notFound({
+                    message: 'No such contact',
+                    headers: ctx.headers
+                });
+            }
+            if (result.reason === 'merged-missing') {
+                return ApiErrors.notFound({
+                    message: 'No such contact to merge',
+                    code: 'source_not_found',
+                    headers: ctx.headers
+                });
+            }
+            return ApiErrors.badRequest({
+                message: 'Merge failed validation',
+                code: 'validation_failed',
+                fields: {
+                    [MERGE_SOURCE_FIELD]: 'Must be a different contact from the one in the path'
+                },
+                headers: ctx.headers
+            });
+        }
+        const answer = view(await survivorRef.get());
+        await claim.record(200, answer);
+        return apiJson(answer, {
+            headers: ctx.headers
+        });
+    } catch (error) {
+        await claim.release();
+        throw error;
+    }
+}
+
+//# sourceMappingURL=contacts-merge.js.map

package/src/lib/server/api-v1/contacts-merge.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/plugins/crm/src/lib/server/api-v1/contacts-merge.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * `POST /v1/contacts/{contactId}/merge` (AGL-2625) — fold another contact\n * into this one.\n *\n * The contact in the path SURVIVES: it keeps its address as the identity,\n * and the record named by `sourceContactId` is folded into it and deleted.\n * `mergeContacts` (`../merge-contacts.ts`) is the whole of the work — the same\n * function behind the console's `crm/contacts-merge` — so an integration\n * and a person at the record page cannot merge two different ways.\n *\n * ## Idempotency\n *\n * Takes an `Idempotency-Key` with the delete's exact semantics, and for the\n * delete's reason: a merge destroys a record, and a retry after a lost\n * response must be able to tell \"already merged\" from \"wrong id\". Without a\n * key, a second call finds no source contact and answers `404`, which is\n * true and is the confusion the key removes.\n *\n * ## What it answers\n *\n * The surviving contact, read back the way `GET` reads it — the\n * organization-wide profile, or one site's through `?consentSiteId=` —\n * with its `alternateEmails` now carrying the merged address.\n */\n\nimport { ApiErrors, apiJson } from '@aglyn/tenant-data-admin'\nimport { apiKeyActorLabel } from '@aglyn/aglyn/app-utils/activity-presenter'\nimport {\n  type ApiV1Context,\n  claimWrite,\n  readJsonBody,\n} from '@aglyn/tenant-data-admin/server/api-v1-kit'\nimport { mergeContacts } from '../merge-contacts'\n\n/** The key an integration names the record to fold in by. */\nexport const MERGE_SOURCE_FIELD = 'sourceContactId'\n\nexport async function mergeContactRoute(\n  request: Request,\n  ctx: ApiV1Context,\n  survivorRef: FirebaseFirestore.DocumentReference,\n  view: (snapshot: FirebaseFirestore.DocumentSnapshot) => unknown,\n): Promise<Response> {\n  const body = await readJsonBody(request)\n  const raw = body[MERGE_SOURCE_FIELD]\n  const sourceId = typeof raw === 'string' ? raw.trim() : ''\n  const fields: Record<string, string> = {}\n  if (raw === undefined) fields[MERGE_SOURCE_FIELD] = 'Required — the contact to merge into this one'\n  else if (!sourceId) fields[MERGE_SOURCE_FIELD] = 'Must be a contact id'\n  else if (sourceId === survivorRef.id) {\n    fields[MERGE_SOURCE_FIELD] = 'Must be a different contact from the one in the path'\n  }\n  for (const key of Object.keys(body)) {\n    if (key !== MERGE_SOURCE_FIELD) fields[key] = 'Not accepted on a merge'\n  }\n  if (Object.keys(fields).length) {\n    return ApiErrors.badRequest({\n      message: 'Merge failed validation',\n      code: 'validation_failed',\n      fields,\n      headers: ctx.headers,\n    })\n  }\n\n  const claimed = await claimWrite(\n    ctx,\n    '*',\n    request.headers.get('Idempotency-Key'),\n    'contact-merges',\n  )\n  if ('replay' in claimed) return claimed.replay\n  const { claim } = claimed\n\n  try {\n    const result = await mergeContacts({\n      firestore: ctx.firestore,\n      orgRef: ctx.firestore.collection('orgs').doc(ctx.orgId),\n      survivorId: survivorRef.id,\n      mergedId: sourceId,\n      // A key has no uid; `'api'` is the attribution every API-created CRM\n      // record carries in `createdByUid`, and the note it leaves names the\n      // key when the organization named it.\n      actor: { uid: 'api', email: null, apiKeyName: ctx.keyName },\n      hostId: null,\n      actorName: ctx.keyName ? apiKeyActorLabel(ctx.keyName) : 'API',\n    })\n    if (result.ok === false) {\n      await claim.release()\n      if (result.reason === 'survivor-missing') {\n        return ApiErrors.notFound({ message: 'No such contact', headers: ctx.headers })\n      }\n      if (result.reason === 'merged-missing') {\n        return ApiErrors.notFound({\n          message: 'No such contact to merge',\n          code: 'source_not_found',\n          headers: ctx.headers,\n        })\n      }\n      return ApiErrors.badRequest({\n        message: 'Merge failed validation',\n        code: 'validation_failed',\n        fields: { [MERGE_SOURCE_FIELD]: 'Must be a different contact from the one in the path' },\n        headers: ctx.headers,\n      })\n    }\n    const answer = view(await survivorRef.get())\n    await claim.record(200, answer)\n    return apiJson(answer, { headers: ctx.headers })\n  } catch (error) {\n    await claim.release()\n    throw error\n  }\n}\n"],"names":["ApiErrors","apiJson","apiKeyActorLabel","claimWrite","readJsonBody","mergeContacts","MERGE_SOURCE_FIELD","mergeContactRoute","request","ctx","survivorRef","view","body","raw","sourceId","trim","fields","undefined","id","key","Object","keys","length","badRequest","message","code","headers","claimed","get","replay","claim","result","firestore","orgRef","collection","doc","orgId","survivorId","mergedId","actor","uid","email","apiKeyName","keyName","hostId","actorName","ok","release","reason","notFound","answer","record","error"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED,SAASA,SAAS,EAAEC,OAAO,QAAQ,2BAA0B;AAC7D,SAASC,gBAAgB,QAAQ,4CAA2C;AAC5E,SAEEC,UAAU,EACVC,YAAY,QACP,6CAA4C;AACnD,SAASC,aAAa,QAAQ,uBAAmB;AAEjD,2DAA2D,GAC3D,OAAO,MAAMC,qBAAqB,kBAAiB;AAEnD,OAAO,eAAeC,kBACpBC,OAAgB,EAChBC,GAAiB,EACjBC,WAAgD,EAChDC,IAA+D;IAE/D,MAAMC,OAAO,MAAMR,aAAaI;IAChC,MAAMK,MAAMD,IAAI,CAACN,mBAAmB;IACpC,MAAMQ,WAAW,OAAOD,QAAQ,WAAWA,IAAIE,IAAI,KAAK;IACxD,MAAMC,SAAiC,CAAC;IACxC,IAAIH,QAAQI,WAAWD,MAAM,CAACV,mBAAmB,GAAG;SAC/C,IAAI,CAACQ,UAAUE,MAAM,CAACV,mBAAmB,GAAG;SAC5C,IAAIQ,aAAaJ,YAAYQ,EAAE,EAAE;QACpCF,MAAM,CAACV,mBAAmB,GAAG;IAC/B;IACA,KAAK,MAAMa,OAAOC,OAAOC,IAAI,CAACT,MAAO;QACnC,IAAIO,QAAQb,oBAAoBU,MAAM,CAACG,IAAI,GAAG;IAChD;IACA,IAAIC,OAAOC,IAAI,CAACL,QAAQM,MAAM,EAAE;QAC9B,OAAOtB,UAAUuB,UAAU,CAAC;YAC1BC,SAAS;YACTC,MAAM;YACNT;YACAU,SAASjB,IAAIiB,OAAO;QACtB;IACF;IAEA,MAAMC,UAAU,MAAMxB,WACpBM,KACA,KACAD,QAAQkB,OAAO,CAACE,GAAG,CAAC,oBACpB;IAEF,IAAI,YAAYD,SAAS,OAAOA,QAAQE,MAAM;IAC9C,MAAM,EAAEC,KAAK,EAAE,GAAGH;IAElB,IAAI;QACF,MAAMI,SAAS,MAAM1B,cAAc;YACjC2B,WAAWvB,IAAIuB,SAAS;YACxBC,QAAQxB,IAAIuB,SAAS,CAACE,UAAU,CAAC,QAAQC,GAAG,CAAC1B,IAAI2B,KAAK;YACtDC,YAAY3B,YAAYQ,EAAE;YAC1BoB,UAAUxB;YACV,qEAAqE;YACrE,qEAAqE;YACrE,sCAAsC;YACtCyB,OAAO;gBAAEC,KAAK;gBAAOC,OAAO;gBAAMC,YAAYjC,IAAIkC,OAAO;YAAC;YAC1DC,QAAQ;YACRC,WAAWpC,IAAIkC,OAAO,GAAGzC,iBAAiBO,IAAIkC,OAAO,IAAI;QAC3D;QACA,IAAIZ,OAAOe,EAAE,KAAK,OAAO;YACvB,MAAMhB,MAAMiB,OAAO;YACnB,IAAIhB,OAAOiB,MAAM,KAAK,oBAAoB;gBACxC,OAAOhD,UAAUiD,QAAQ,CAAC;oBAAEzB,SAAS;oBAAmBE,SAASjB,IAAIiB,OAAO;gBAAC;YAC/E;YACA,IAAIK,OAAOiB,MAAM,KAAK,kBAAkB;gBACtC,OAAOhD,UAAUiD,QAAQ,CAAC;oBACxBzB,SAAS;oBACTC,MAAM;oBACNC,SAASjB,IAAIiB,OAAO;gBACtB;YACF;YACA,OAAO1B,UAAUuB,UAAU,CAAC;gBAC1BC,SAAS;gBACTC,MAAM;gBACNT,QAAQ;oBAAE,CAACV,mBAAmB,EAAE;gBAAuD;gBACvFoB,SAASjB,IAAIiB,OAAO;YACtB;QACF;QACA,MAAMwB,SAASvC,KAAK,MAAMD,YAAYkB,GAAG;QACzC,MAAME,MAAMqB,MAAM,CAAC,KAAKD;QACxB,OAAOjD,QAAQiD,QAAQ;YAAExB,SAASjB,IAAIiB,OAAO;QAAC;IAChD,EAAE,OAAO0B,OAAO;QACd,MAAMtB,MAAMiB,OAAO;QACnB,MAAMK;IACR;AACF"}

package/src/lib/server/api-v1/contacts.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type ApiV1Context } from '@aglyn/tenant-data-admin/server/api-v1-kit';
+export declare function handleContacts(request: Request, ctx: ApiV1Context, segments: string[], url: URL): Promise<Response>;