@aglyn/plugins-crm 1.0.0-beta.220 → 1.0.0-beta.222

package/src/lib/server/export-route.js

@@ -1,447 +0,0 @@
-import { _ as _extends } from "@swc/helpers/_/_extends";
-/**
- * @license
- * Copyright 2026 Aglyn LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */ import { checkEntitlement, consentGroupForHost, CRM_COLLECTIONS, csvCell, hostScopeToken, isOrgWideMember, MAX_SCOPE_HOSTS, memberCanSee, memberScopeTokens, scopeTokensForHost, planLabelGrantingFeature, pluginRequestFromWeb } from "@aglyn/aglyn/server";
-import { emailUnverifiedResponse, firebaseAdmin, isImpersonationSession, isServerReleaseFlagOnForOrg, lockdownRefusal, memberHasOrgPermission, resolveOrgMembership } from "@aglyn/tenant-data-admin";
-import { FieldPath, FieldValue } from "firebase-admin/firestore";
-import { addAdminAudit } from "@aglyn/tenant-data-admin/server/admin-audit-write";
-import { invalidIdTokenResponse } from "@aglyn/tenant-data-admin/server/id-token-refusal";
-import { contactCsvRowFromDoc, crmExportCells, crmExportHeader, isCrmExportResource } from "../model/crm-csv.js";
-import { contactPrimaryGroup } from "../model/contact-holder.js";
-/**
- * Documents read per round trip. Not a cap — the stream keeps paging until
- * the collection is exhausted. It bounds what is held at once, which is the
- * only thing a page size should ever bound.
- */ const PAGE_SIZE = 500;
-/** Sites read per page when the leads file spans an organization. */ const HOST_PAGE = 100;
-/**
- * The most sites one organization-level leads file reads from.
- *
- * A ceiling rather than an unbounded sweep, and it is REPORTED: the file's
- * row header counts only what was read, so a short file is provably short
- * rather than quietly partial.
- */ const HOST_CEILING = 200;
-/** The most linked records a tasks file resolves names for before writing ids. */ const NAME_CACHE_CEILING = 2000;
-/** Header naming the row count the server undertook to send. */ export const EXPORT_ROWS_HEADER = 'X-Aglyn-Export-Rows';
-const json = (body, status)=>Response.json(body, {
-        status
-    });
-/** Which collection under the org root each resource is, bar leads. */ const ORG_COLLECTION = {
-    contacts: 'contacts',
-    companies: CRM_COLLECTIONS.companies,
-    deals: CRM_COLLECTIONS.deals,
-    tasks: CRM_COLLECTIONS.tasks
-};
-/** The file's name, before the date stamp. */ const FILE_BASE = {
-    contacts: 'contacts',
-    companies: 'companies',
-    deals: 'deals',
-    tasks: 'tasks',
-    leads: 'leads'
-};
-/**
- * THE WHOLE COLLECTION, STREAMED (AGL-2662).
- *
- * ## What this fixes
- *
- * Every CRM export until now wrote the rows the LIST had loaded — a
- * `limit(1000)` window for contacts, a `limit(200)` view for tasks — and
- * called the file `contacts.csv`. A merchant with 40,000 contacts got 1,000
- * of them and nothing on screen or in the file said so. `docs/bulk-actions.md`
- * said it in prose, which is not where somebody opening a spreadsheet looks.
- * This is the same file over every row there is, and it carries
- * `X-Aglyn-Export-Rows` so the client can prove what it received is whole —
- * a stream that dies halfway yields a perfectly well-formed shorter file, and
- * nothing about the bytes says they are short.
- *
- * ## Why it is a route and not a bigger client read
- *
- * A browser cannot hold an unbounded collection, and the tier that most
- * needs a complete export is the tier with the most rows. Cursor-paged and
- * streamed, completeness costs neither a hang nor a buffer.
- *
- * ## The columns are the client's columns
- *
- * `crmExportHeader` and `crmExportCells` (`model/crm-csv.ts`) are the
- * writers each section's Export button uses. One feature, one file format.
- *
- * ## The order is by document id, deliberately
- *
- * Firestore DROPS every document missing the ordered field, so ordering by
- * `updatedAt` or `dueAtMs` would silently omit rows written before that
- * field existed — the exact silent loss an export must not have. A document
- * id is on every document and is a total order.
- *
- * ## Scope is enforced here, because nothing else can
- *
- * The Admin SDK bypasses the rules, so `memberScopeTokens` IS the
- * enforcement: an org-wide member reads every row, and a scoped
- * collaborator's query carries their own tokens as the `array-contains-any`
- * the rules would have evaluated. Leads are host data by path, so the
- * equivalent check is whether the caller reaches the site.
- */ export async function crmExportRoute(request) {
-    var _headers_authorization, _ref, _ref1, _ref2;
-    const { method, query, headers: rawHeaders } = await pluginRequestFromWeb(request);
-    const headers = rawHeaders;
-    if (method !== 'GET') return json({
-        error: 'Method not allowed'
-    }, 405);
-    const authorization = (_headers_authorization = headers.authorization) != null ? _headers_authorization : '';
-    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
-    if (!idToken) return json({
-        error: 'Unauthenticated'
-    }, 401);
-    const orgId = String((_ref = query == null ? void 0 : query['orgId']) != null ? _ref : '');
-    const resource = String((_ref1 = query == null ? void 0 : query['resource']) != null ? _ref1 : '');
-    const hostId = String((_ref2 = query == null ? void 0 : query['hostId']) != null ? _ref2 : '');
-    if (!orgId || !isCrmExportResource(resource)) {
-        return json({
-            error: 'Missing orgId or resource'
-        }, 400);
-    }
-    try {
-        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
-        if (!decoded.email_verified && !isImpersonationSession(decoded)) {
-            return emailUnverifiedResponse();
-        }
-        const staff = decoded['staff'] === true;
-        const membership = await resolveOrgMembership(decoded.uid, orgId);
-        const member = membership == null ? void 0 : membership.member;
-        if (!member && !staff) return json({
-            error: 'Not found'
-        }, 404);
-        /*
-     * THE PEOPLE FILES ARE EVERY WORKSPACE'S (AGL-2839, AGL-2851).
-     *
-     * Exporting the contacts and leads a workspace holds is an obligation,
-     * not a CRM feature — a Free workspace takes them from its Privacy
-     * settings — so neither the release flag nor the plan is asked of those
-     * two. The CRM's own records, companies, deals and tasks, are asked
-     * both: the flag here, and the plan once the org has been read.
-     */ const peopleFile = resource === 'contacts' || resource === 'leads';
-        if (!peopleFile && !staff && !await isServerReleaseFlagOnForOrg('release_crm', orgId)) {
-            return json({
-                error: 'Not available'
-            }, 404);
-        }
-        // The permission the CRM's own rules read for. Reading is not writing,
-        // but these records ARE the audience: `data.manage` is what admits a
-        // person to the list this file copies.
-        if (!staff && !await memberHasOrgPermission(orgId, member, 'data.manage')) {
-            return json({
-                error: 'Not found'
-            }, 404);
-        }
-        const firestore = firebaseAdmin.app().firestore();
-        const orgRef = firestore.collection('orgs').doc(orgId);
-        const orgSnapshot = await orgRef.get();
-        if (!orgSnapshot.exists) return json({
-            error: 'Unknown organization'
-        }, 404);
-        const org = orgSnapshot.data();
-        const locked = await lockdownRefusal({
-            request,
-            staff,
-            uid: decoded.uid,
-            org
-        });
-        if (locked) return locked;
-        // The CRM's own records on a plan without the CRM, staff included: the
-        // refusal every `crm/*` route gives, after the caller is known.
-        if (!peopleFile && !checkEntitlement(org, 'crm')) {
-            const plan = planLabelGrantingFeature('crm');
-            return json({
-                error: `Exporting ${resource} is part of the CRM, which is not included in ` + 'your current plan. Manage your plan and add-ons from Billing.' + (plan ? ` Included from ${plan}.` : ''),
-                reason: 'plan_required',
-                code: 'crm'
-            }, 403);
-        }
-        const orgWide = staff || isOrgWideMember(member);
-        // `array-contains-any` takes at most thirty values, which is also the
-        // widest a consent group can be — a reader past that is the org-wide
-        // case and never reaches here.
-        const tokens = memberScopeTokens(member).slice(0, MAX_SCOPE_HOSTS);
-        if (!orgWide && !tokens.length) return json({
-            error: 'Not found'
-        }, 404);
-        /* The roster, once, so every owner and assignee cell is an address. */ const ownerEmails = new Map();
-        for (const entry of (await orgRef.collection('members').get()).docs){
-            var _ref3;
-            var _entry_data;
-            const email = String((_ref3 = (_entry_data = entry.data()) == null ? void 0 : _entry_data['email']) != null ? _ref3 : '');
-            if (email) ownerEmails.set(entry.id, email);
-        }
-        const ownerEmail = (uid)=>{
-            var _ownerEmails_get;
-            return (_ownerEmails_get = ownerEmails.get(uid)) != null ? _ownerEmails_get : uid;
-        };
-        const options = {
-            ownerEmail,
-            assigneeEmail: ownerEmail
-        };
-        if (resource === 'contacts') {
-            /*
-       * A contact's fields live in one holder's FACET, so the file has to
-       * say which. Under a site that is the site's own group, for every
-       * row; at the organization level it is each row's PRIMARY holder —
-       * the same answer the org-level Contacts list flattens by, so the
-       * file and the table read one profile per person. What a file must
-       * never do is read the top of the document, which is where the
-       * pre-facet migration left one holder's fields.
-       */ if (!hostId && !orgWide) return json({
-                error: 'Missing hostId'
-            }, 400);
-            const fields = await orgRef.collection(CRM_COLLECTIONS.contactFields).get();
-            options.customFields = fields.docs.map((entry)=>{
-                var _ref, _ref1;
-                var _entry_data, _entry_data1, _entry_data2;
-                return {
-                    key: String((_ref = (_entry_data = entry.data()) == null ? void 0 : _entry_data['key']) != null ? _ref : entry.id),
-                    label: String((_ref1 = (_entry_data1 = entry.data()) == null ? void 0 : _entry_data1['label']) != null ? _ref1 : entry.id),
-                    archivedAt: (_entry_data2 = entry.data()) == null ? void 0 : _entry_data2['archivedAt']
-                };
-            }).filter((field)=>!field.archivedAt).map(({ key, label })=>({
-                    key,
-                    label
-                }));
-        }
-        if (resource === 'deals') {
-            const pipelines = await orgRef.collection(CRM_COLLECTIONS.pipelines).get();
-            const names = new Map();
-            const stages = new Map();
-            for (const entry of pipelines.docs){
-                var _entry_data1, _data_name, _data_stages;
-                const data = (_entry_data1 = entry.data()) != null ? _entry_data1 : {};
-                names.set(entry.id, String((_data_name = data['name']) != null ? _data_name : entry.id));
-                for (const stage of (_data_stages = data['stages']) != null ? _data_stages : []){
-                    var _ref4;
-                    const stageId = String((_ref4 = stage == null ? void 0 : stage['id']) != null ? _ref4 : '');
-                    if (stageId) {
-                        var _ref5;
-                        stages.set(`${entry.id}/${stageId}`, String((_ref5 = stage == null ? void 0 : stage['name']) != null ? _ref5 : stageId));
-                    }
-                }
-            }
-            options.pipelineName = (id)=>names.get(id);
-            options.stageName = (pipelineId, stageId)=>stages.get(`${pipelineId}/${stageId}`);
-        }
-        /*
-     * A task names its contact, company and deal by ID, and a spreadsheet
-     * cannot read one. The list resolves them from rows it already holds;
-     * the server looks them up as it meets them — batched per page,
-     * remembered, and capped, so a tasks file costs reads in proportion to
-     * the records it actually references rather than to the org. Past the
-     * cap the id is written, which is the documented degradation everywhere
-     * else in these files.
-     */ const recordNames = new Map();
-        const resolveNames = async (wanted)=>{
-            const missing = wanted.filter((entry)=>entry.id && !recordNames.has(`${entry.kind}:${entry.id}`) && recordNames.size < NAME_CACHE_CEILING);
-            if (!missing.length) return;
-            const refs = missing.map((entry)=>orgRef.collection(entry.kind === 'contact' ? 'contacts' : entry.kind === 'company' ? CRM_COLLECTIONS.companies : CRM_COLLECTIONS.deals).doc(entry.id));
-            const snapshots = await firestore.getAll(...refs);
-            snapshots.forEach((snapshot, index)=>{
-                var _snapshot_data, _data_title, _ref, _data_name;
-                const entry = missing[index];
-                const data = (_snapshot_data = snapshot.data()) != null ? _snapshot_data : {};
-                const name = entry.kind === 'deal' ? String((_data_title = data['title']) != null ? _data_title : '') : String((_ref = (_data_name = data['name']) != null ? _data_name : data['email']) != null ? _ref : '');
-                recordNames.set(`${entry.kind}:${entry.id}`, name || entry.id);
-            });
-        };
-        if (resource === 'tasks') {
-            options.recordName = (kind, id)=>recordNames.get(`${kind}:${id}`);
-        }
-        /*
-     * LEADS ARE HOST DATA BY PATH. Under one site the file is that site's;
-     * with no site named, an org-wide member takes every site's leads in one
-     * file with a `Site` column — the same file the organization-level Leads
-     * list writes. A scoped collaborator must name a site they reach.
-     */ const siteNames = new Map();
-        let leadHostIds = [];
-        if (resource === 'leads') {
-            if (hostId) {
-                if (!orgWide && !memberCanSee(member, [
-                    hostScopeToken(hostId)
-                ])) {
-                    return json({
-                        error: 'Not found'
-                    }, 404);
-                }
-                leadHostIds = [
-                    hostId
-                ];
-            } else {
-                if (!orgWide) return json({
-                    error: 'Missing hostId'
-                }, 400);
-                let cursor = null;
-                for(;;){
-                    let page = firestore.collection('hosts').where('orgId', '==', orgId).orderBy(FieldPath.documentId()).limit(HOST_PAGE);
-                    if (cursor) page = page.startAfter(firestore.collection('hosts').doc(cursor));
-                    const snapshot = await page.get();
-                    for (const entry of snapshot.docs){
-                        var _ref6, _ref7;
-                        var _entry_data2, _entry_data3;
-                        leadHostIds.push(entry.id);
-                        siteNames.set(entry.id, String((_ref6 = (_ref7 = (_entry_data2 = entry.data()) == null ? void 0 : _entry_data2['displayName']) != null ? _ref7 : (_entry_data3 = entry.data()) == null ? void 0 : _entry_data3['subdomain']) != null ? _ref6 : entry.id));
-                    }
-                    if (snapshot.docs.length < HOST_PAGE) break;
-                    if (leadHostIds.length >= HOST_CEILING) break;
-                    cursor = snapshot.docs[snapshot.docs.length - 1].id;
-                }
-                options.siteName = (id)=>siteNames.get(id);
-            }
-        }
-        /** One resource's rows, as a query per collection the file spans. */ const sources = resource === 'leads' ? leadHostIds.map((id)=>({
-                hostId: id,
-                /*
-             * The org collection, narrowed per SITE (AGL-3275).
-             *
-             * One source per site is still right — the file names the site a
-             * row came from — but a site's leads are selected by `visibleTo`
-             * now rather than by the collection's parent, so the narrowing
-             * moves onto the reference itself. It cannot use the `scoped`
-             * flag below: that applies the MEMBER's tokens, and here each
-             * source needs the tokens of its own site.
-             */ reference: orgRef.collection('leads').where('visibleTo', 'array-contains-any', scopeTokensForHost(id)),
-                scoped: false
-            })) : [
-            {
-                hostId: '',
-                reference: orgRef.collection(ORG_COLLECTION[resource]),
-                scoped: !orgWide
-            }
-        ];
-        // Taken BEFORE the first page, so it describes the collections the
-        // export started from. A `count()` aggregate bills one read per 1,000
-        // documents — cheap next to the export it is describing, and the only
-        // way the client can tell a complete file from a truncated one.
-        let total = 0;
-        for (const source of sources){
-            var _data_count;
-            const counted = source.scoped ? source.reference.where('visibleTo', 'array-contains-any', tokens) : source.reference;
-            total += Number((_data_count = (await counted.count().get()).data().count) != null ? _data_count : 0);
-        }
-        /** The holder one contact is written through, resolved per level. */ const holderFor = (document)=>{
-            const group = hostId ? consentGroupForHost(org, hostId) : contactPrimaryGroup(document, org);
-            return {
-                groupId: group.groupId,
-                hostIds: group.hostIds
-            };
-        };
-        const encoder = new TextEncoder();
-        const encode = (text)=>encoder.encode(text);
-        const line = (cells)=>cells.map(csvCell).join(',');
-        let sourceIndex = 0;
-        let cursor = null;
-        let phase = 'head';
-        const stream = new ReadableStream({
-            async pull (controller) {
-                try {
-                    if (phase === 'head') {
-                        phase = sources.length ? 'body' : 'tail';
-                        controller.enqueue(encode(line(crmExportHeader(resource, options))));
-                        return;
-                    }
-                    if (phase === 'body') {
-                        var _snapshot_docs_;
-                        const source = sources[sourceIndex];
-                        let page = source.reference;
-                        if (source.scoped) {
-                            page = page.where('visibleTo', 'array-contains-any', tokens);
-                        }
-                        page = page.orderBy(FieldPath.documentId()).limit(PAGE_SIZE);
-                        if (cursor) page = page.startAfter(cursor);
-                        const snapshot = await page.get();
-                        const exhausted = snapshot.docs.length < PAGE_SIZE;
-                        cursor = exhausted ? null : (_snapshot_docs_ = snapshot.docs[snapshot.docs.length - 1]) != null ? _snapshot_docs_ : null;
-                        if (exhausted) {
-                            sourceIndex += 1;
-                            if (sourceIndex >= sources.length) phase = 'tail';
-                        }
-                        if (!snapshot.empty) {
-                            const documents = snapshot.docs.map((entry)=>{
-                                var _entry_data;
-                                return _extends({}, (_entry_data = entry.data()) != null ? _entry_data : {}, {
-                                    $id: entry.id
-                                }, source.hostId ? {
-                                    hostId: source.hostId
-                                } : {});
-                            });
-                            if (resource === 'tasks') {
-                                await resolveNames(documents.flatMap((document)=>[
-                                        'contact',
-                                        'company',
-                                        'deal'
-                                    ].map((kind)=>{
-                                        var _document_;
-                                        return {
-                                            kind,
-                                            id: String((_document_ = document[kind === 'contact' ? 'contactId' : kind === 'company' ? 'companyId' : 'dealId']) != null ? _document_ : '')
-                                        };
-                                    })));
-                            }
-                            const lines = documents.map((document)=>line(crmExportCells(resource, resource === 'contacts' ? contactCsvRowFromDoc(document, holderFor(document)) : document, options)));
-                            controller.enqueue(encode(`\n${lines.join('\n')}`));
-                            return;
-                        }
-                        if (phase === 'body') return;
-                    }
-                    controller.enqueue(encode('\n'));
-                    controller.close();
-                } catch (error) {
-                    // Erroring the stream truncates the download rather than
-                    // completing it short — a half-written file the browser reports
-                    // as a failed transfer, not a quiet partial handover.
-                    controller.error(error);
-                }
-            }
-        });
-        // Ids and counts only, never content: a full copy of an audience
-        // leaving the platform is worth a row; who was in it is not ours to log.
-        void addAdminAudit(firestore, {
-            actorUid: decoded.uid,
-            action: 'crm.exported',
-            target: `orgs/${orgId}/${resource}`,
-            before: null,
-            after: {
-                resource,
-                rows: total,
-                hostId: hostId || null
-            },
-            at: FieldValue.serverTimestamp()
-        }).catch(()=>undefined);
-        const stamp = new Date().toISOString().slice(0, 10);
-        return new Response(stream, {
-            status: 200,
-            headers: {
-                'Content-Type': 'text/csv; charset=utf-8',
-                'Content-Disposition': `attachment; filename="${FILE_BASE[resource]}-${stamp}.csv"`,
-                [EXPORT_ROWS_HEADER]: String(total),
-                'Cache-Control': 'no-store, private'
-            }
-        });
-    } catch (error) {
-        // A refused credential is a 401, not a fault of ours (AGL-1993). Null
-        // for anything else, so a real failure keeps the answer below.
-        const unauthenticated = invalidIdTokenResponse(error);
-        if (unauthenticated) return unauthenticated;
-        return json({
-            error: 'Export failed'
-        }, 500);
-    }
-}
-
-//# sourceMappingURL=export-route.js.map

package/src/lib/server/export-route.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/export-route.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  checkEntitlement,\n  consentGroupForHost,\n  CRM_COLLECTIONS,\n  csvCell,\n  hostScopeToken,\n  isOrgWideMember,\n  MAX_SCOPE_HOSTS,\n  memberCanSee,\n  memberScopeTokens,\n  scopeTokensForHost,\n  planLabelGrantingFeature,\n  pluginRequestFromWeb,\n} from '@aglyn/aglyn/server'\nimport {\n  emailUnverifiedResponse,\n  firebaseAdmin,\n  isImpersonationSession,\n  isServerReleaseFlagOnForOrg,\n  lockdownRefusal,\n  memberHasOrgPermission,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin'\nimport { FieldPath, FieldValue } from 'firebase-admin/firestore'\nimport { addAdminAudit } from '@aglyn/tenant-data-admin/server/admin-audit-write'\nimport { invalidIdTokenResponse } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport {\n  contactCsvRowFromDoc,\n  crmExportCells,\n  crmExportHeader,\n  type CrmExportOptions,\n  type CrmExportResource,\n  isCrmExportResource,\n} from '../model/crm-csv'\nimport { contactPrimaryGroup } from '../model/contact-holder'\n\n/**\n * Documents read per round trip. Not a cap — the stream keeps paging until\n * the collection is exhausted. It bounds what is held at once, which is the\n * only thing a page size should ever bound.\n */\nconst PAGE_SIZE = 500\n\n/** Sites read per page when the leads file spans an organization. */\nconst HOST_PAGE = 100\n\n/**\n * The most sites one organization-level leads file reads from.\n *\n * A ceiling rather than an unbounded sweep, and it is REPORTED: the file's\n * row header counts only what was read, so a short file is provably short\n * rather than quietly partial.\n */\nconst HOST_CEILING = 200\n\n/** The most linked records a tasks file resolves names for before writing ids. */\nconst NAME_CACHE_CEILING = 2000\n\n/** Header naming the row count the server undertook to send. */\nexport const EXPORT_ROWS_HEADER = 'X-Aglyn-Export-Rows'\n\nconst json = (body: unknown, status: number) => Response.json(body, { status })\n\n/** Which collection under the org root each resource is, bar leads. */\nconst ORG_COLLECTION: Record<Exclude<CrmExportResource, 'leads'>, string> = {\n  contacts: 'contacts',\n  companies: CRM_COLLECTIONS.companies,\n  deals: CRM_COLLECTIONS.deals,\n  tasks: CRM_COLLECTIONS.tasks,\n}\n\n/** The file's name, before the date stamp. */\nconst FILE_BASE: Record<CrmExportResource, string> = {\n  contacts: 'contacts',\n  companies: 'companies',\n  deals: 'deals',\n  tasks: 'tasks',\n  leads: 'leads',\n}\n\n/**\n * THE WHOLE COLLECTION, STREAMED (AGL-2662).\n *\n * ## What this fixes\n *\n * Every CRM export until now wrote the rows the LIST had loaded — a\n * `limit(1000)` window for contacts, a `limit(200)` view for tasks — and\n * called the file `contacts.csv`. A merchant with 40,000 contacts got 1,000\n * of them and nothing on screen or in the file said so. `docs/bulk-actions.md`\n * said it in prose, which is not where somebody opening a spreadsheet looks.\n * This is the same file over every row there is, and it carries\n * `X-Aglyn-Export-Rows` so the client can prove what it received is whole —\n * a stream that dies halfway yields a perfectly well-formed shorter file, and\n * nothing about the bytes says they are short.\n *\n * ## Why it is a route and not a bigger client read\n *\n * A browser cannot hold an unbounded collection, and the tier that most\n * needs a complete export is the tier with the most rows. Cursor-paged and\n * streamed, completeness costs neither a hang nor a buffer.\n *\n * ## The columns are the client's columns\n *\n * `crmExportHeader` and `crmExportCells` (`model/crm-csv.ts`) are the\n * writers each section's Export button uses. One feature, one file format.\n *\n * ## The order is by document id, deliberately\n *\n * Firestore DROPS every document missing the ordered field, so ordering by\n * `updatedAt` or `dueAtMs` would silently omit rows written before that\n * field existed — the exact silent loss an export must not have. A document\n * id is on every document and is a total order.\n *\n * ## Scope is enforced here, because nothing else can\n *\n * The Admin SDK bypasses the rules, so `memberScopeTokens` IS the\n * enforcement: an org-wide member reads every row, and a scoped\n * collaborator's query carries their own tokens as the `array-contains-any`\n * the rules would have evaluated. Leads are host data by path, so the\n * equivalent check is whether the caller reaches the site.\n */\nexport async function crmExportRoute(request: Request): Promise<Response> {\n  const { method, query, headers: rawHeaders } =\n    await pluginRequestFromWeb(request)\n  const headers = rawHeaders as Partial<Record<string, string>>\n  if (method !== 'GET') return json({ error: 'Method not allowed' }, 405)\n\n  const authorization = headers.authorization ?? ''\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return json({ error: 'Unauthenticated' }, 401)\n\n  const orgId = String(query?.['orgId'] ?? '')\n  const resource = String(query?.['resource'] ?? '')\n  const hostId = String(query?.['hostId'] ?? '')\n  if (!orgId || !isCrmExportResource(resource)) {\n    return json({ error: 'Missing orgId or resource' }, 400)\n  }\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    if (!decoded.email_verified && !isImpersonationSession(decoded)) {\n      return emailUnverifiedResponse()\n    }\n    const staff = decoded['staff'] === true\n    const membership = await resolveOrgMembership(decoded.uid, orgId)\n    const member = membership?.member\n    if (!member && !staff) return json({ error: 'Not found' }, 404)\n\n    /*\n     * THE PEOPLE FILES ARE EVERY WORKSPACE'S (AGL-2839, AGL-2851).\n     *\n     * Exporting the contacts and leads a workspace holds is an obligation,\n     * not a CRM feature — a Free workspace takes them from its Privacy\n     * settings — so neither the release flag nor the plan is asked of those\n     * two. The CRM's own records, companies, deals and tasks, are asked\n     * both: the flag here, and the plan once the org has been read.\n     */\n    const peopleFile = resource === 'contacts' || resource === 'leads'\n    if (!peopleFile && !staff && !(await isServerReleaseFlagOnForOrg('release_crm', orgId))) {\n      return json({ error: 'Not available' }, 404)\n    }\n    // The permission the CRM's own rules read for. Reading is not writing,\n    // but these records ARE the audience: `data.manage` is what admits a\n    // person to the list this file copies.\n    if (!staff && !(await memberHasOrgPermission(orgId, member, 'data.manage'))) {\n      return json({ error: 'Not found' }, 404)\n    }\n\n    const firestore = firebaseAdmin.app().firestore()\n    const orgRef = firestore.collection('orgs').doc(orgId)\n    const orgSnapshot = await orgRef.get()\n    if (!orgSnapshot.exists) return json({ error: 'Unknown organization' }, 404)\n    const org = orgSnapshot.data()\n\n    const locked = await lockdownRefusal({\n      request,\n      staff,\n      uid: decoded.uid,\n      org,\n    })\n    if (locked) return locked\n\n    // The CRM's own records on a plan without the CRM, staff included: the\n    // refusal every `crm/*` route gives, after the caller is known.\n    if (!peopleFile && !checkEntitlement(org as never, 'crm')) {\n      const plan = planLabelGrantingFeature('crm')\n      return json(\n        {\n          error:\n            `Exporting ${resource} is part of the CRM, which is not included in ` +\n            'your current plan. Manage your plan and add-ons from Billing.' +\n            (plan ? ` Included from ${plan}.` : ''),\n          reason: 'plan_required',\n          code: 'crm',\n        },\n        403,\n      )\n    }\n\n    const orgWide = staff || isOrgWideMember(member)\n    // `array-contains-any` takes at most thirty values, which is also the\n    // widest a consent group can be — a reader past that is the org-wide\n    // case and never reaches here.\n    const tokens = memberScopeTokens(member).slice(0, MAX_SCOPE_HOSTS)\n    if (!orgWide && !tokens.length) return json({ error: 'Not found' }, 404)\n\n    /* The roster, once, so every owner and assignee cell is an address. */\n    const ownerEmails = new Map<string, string>()\n    for (const entry of (await orgRef.collection('members').get()).docs) {\n      const email = String(entry.data()?.['email'] ?? '')\n      if (email) ownerEmails.set(entry.id, email)\n    }\n    const ownerEmail = (uid: string) => ownerEmails.get(uid) ?? uid\n\n    const options: CrmExportOptions = { ownerEmail, assigneeEmail: ownerEmail }\n\n    if (resource === 'contacts') {\n      /*\n       * A contact's fields live in one holder's FACET, so the file has to\n       * say which. Under a site that is the site's own group, for every\n       * row; at the organization level it is each row's PRIMARY holder —\n       * the same answer the org-level Contacts list flattens by, so the\n       * file and the table read one profile per person. What a file must\n       * never do is read the top of the document, which is where the\n       * pre-facet migration left one holder's fields.\n       */\n      if (!hostId && !orgWide) return json({ error: 'Missing hostId' }, 400)\n      const fields = await orgRef.collection(CRM_COLLECTIONS.contactFields).get()\n      options.customFields = fields.docs\n        .map((entry) => ({\n          key: String(entry.data()?.['key'] ?? entry.id),\n          label: String(entry.data()?.['label'] ?? entry.id),\n          archivedAt: entry.data()?.['archivedAt'],\n        }))\n        .filter((field) => !field.archivedAt)\n        .map(({ key, label }) => ({ key, label }))\n    }\n\n    if (resource === 'deals') {\n      const pipelines = await orgRef.collection(CRM_COLLECTIONS.pipelines).get()\n      const names = new Map<string, string>()\n      const stages = new Map<string, string>()\n      for (const entry of pipelines.docs) {\n        const data = entry.data() ?? {}\n        names.set(entry.id, String(data['name'] ?? entry.id))\n        for (const stage of (data['stages'] ?? []) as Array<Record<string, unknown>>) {\n          const stageId = String(stage?.['id'] ?? '')\n          if (stageId) {\n            stages.set(`${entry.id}/${stageId}`, String(stage?.['name'] ?? stageId))\n          }\n        }\n      }\n      options.pipelineName = (id) => names.get(id)\n      options.stageName = (pipelineId, stageId) =>\n        stages.get(`${pipelineId}/${stageId}`)\n    }\n\n    /*\n     * A task names its contact, company and deal by ID, and a spreadsheet\n     * cannot read one. The list resolves them from rows it already holds;\n     * the server looks them up as it meets them — batched per page,\n     * remembered, and capped, so a tasks file costs reads in proportion to\n     * the records it actually references rather than to the org. Past the\n     * cap the id is written, which is the documented degradation everywhere\n     * else in these files.\n     */\n    const recordNames = new Map<string, string>()\n    const resolveNames = async (\n      wanted: ReadonlyArray<{ kind: 'contact' | 'company' | 'deal'; id: string }>,\n    ) => {\n      const missing = wanted.filter(\n        (entry) =>\n          entry.id &&\n          !recordNames.has(`${entry.kind}:${entry.id}`) &&\n          recordNames.size < NAME_CACHE_CEILING,\n      )\n      if (!missing.length) return\n      const refs = missing.map((entry) =>\n        orgRef\n          .collection(\n            entry.kind === 'contact'\n              ? 'contacts'\n              : entry.kind === 'company'\n                ? CRM_COLLECTIONS.companies\n                : CRM_COLLECTIONS.deals,\n          )\n          .doc(entry.id),\n      )\n      const snapshots = await firestore.getAll(...refs)\n      snapshots.forEach((snapshot, index) => {\n        const entry = missing[index]\n        const data = snapshot.data() ?? {}\n        const name =\n          entry.kind === 'deal'\n            ? String(data['title'] ?? '')\n            : String(data['name'] ?? data['email'] ?? '')\n        recordNames.set(`${entry.kind}:${entry.id}`, name || entry.id)\n      })\n    }\n    if (resource === 'tasks') {\n      options.recordName = (kind, id) => recordNames.get(`${kind}:${id}`)\n    }\n\n    /*\n     * LEADS ARE HOST DATA BY PATH. Under one site the file is that site's;\n     * with no site named, an org-wide member takes every site's leads in one\n     * file with a `Site` column — the same file the organization-level Leads\n     * list writes. A scoped collaborator must name a site they reach.\n     */\n    const siteNames = new Map<string, string>()\n    let leadHostIds: string[] = []\n    if (resource === 'leads') {\n      if (hostId) {\n        if (!orgWide && !memberCanSee(member, [hostScopeToken(hostId)])) {\n          return json({ error: 'Not found' }, 404)\n        }\n        leadHostIds = [hostId]\n      } else {\n        if (!orgWide) return json({ error: 'Missing hostId' }, 400)\n        let cursor: string | null = null\n        for (;;) {\n          let page = firestore\n            .collection('hosts')\n            .where('orgId', '==', orgId)\n            .orderBy(FieldPath.documentId())\n            .limit(HOST_PAGE)\n          if (cursor) page = page.startAfter(firestore.collection('hosts').doc(cursor))\n          const snapshot = await page.get()\n          for (const entry of snapshot.docs) {\n            leadHostIds.push(entry.id)\n            siteNames.set(\n              entry.id,\n              String(\n                entry.data()?.['displayName'] ??\n                  entry.data()?.['subdomain'] ??\n                  entry.id,\n              ),\n            )\n          }\n          if (snapshot.docs.length < HOST_PAGE) break\n          if (leadHostIds.length >= HOST_CEILING) break\n          cursor = snapshot.docs[snapshot.docs.length - 1].id\n        }\n        options.siteName = (id) => siteNames.get(id)\n      }\n    }\n\n    /** One resource's rows, as a query per collection the file spans. */\n    const sources =\n      resource === 'leads'\n        ? leadHostIds.map((id) => ({\n            hostId: id,\n            /*\n             * The org collection, narrowed per SITE (AGL-3275).\n             *\n             * One source per site is still right — the file names the site a\n             * row came from — but a site's leads are selected by `visibleTo`\n             * now rather than by the collection's parent, so the narrowing\n             * moves onto the reference itself. It cannot use the `scoped`\n             * flag below: that applies the MEMBER's tokens, and here each\n             * source needs the tokens of its own site.\n             */\n            reference: orgRef\n              .collection('leads')\n              .where('visibleTo', 'array-contains-any', scopeTokensForHost(id)),\n            scoped: false,\n          }))\n        : [\n            {\n              hostId: '',\n              reference: orgRef.collection(\n                ORG_COLLECTION[resource as Exclude<CrmExportResource, 'leads'>],\n              ),\n              scoped: !orgWide,\n            },\n          ]\n\n    // Taken BEFORE the first page, so it describes the collections the\n    // export started from. A `count()` aggregate bills one read per 1,000\n    // documents — cheap next to the export it is describing, and the only\n    // way the client can tell a complete file from a truncated one.\n    let total = 0\n    for (const source of sources) {\n      const counted = source.scoped\n        ? source.reference.where('visibleTo', 'array-contains-any', tokens)\n        : source.reference\n      total += Number((await counted.count().get()).data().count ?? 0)\n    }\n\n    /** The holder one contact is written through, resolved per level. */\n    const holderFor = (document: Record<string, unknown>) => {\n      const group = hostId\n        ? consentGroupForHost(org as Record<string, unknown>, hostId)\n        : contactPrimaryGroup(document, org as Record<string, unknown>)\n      return { groupId: group.groupId, hostIds: group.hostIds }\n    }\n\n    const encoder = new TextEncoder()\n    const encode = (text: string) => encoder.encode(text)\n    const line = (cells: readonly unknown[]) => cells.map(csvCell).join(',')\n    let sourceIndex = 0\n    let cursor: FirebaseFirestore.QueryDocumentSnapshot | null = null\n    let phase: 'head' | 'body' | 'tail' = 'head'\n\n    const stream = new ReadableStream<Uint8Array>({\n      async pull(controller) {\n        try {\n          if (phase === 'head') {\n            phase = sources.length ? 'body' : 'tail'\n            controller.enqueue(encode(line(crmExportHeader(resource, options))))\n            return\n          }\n          if (phase === 'body') {\n            const source = sources[sourceIndex]\n            let page: FirebaseFirestore.Query = source.reference\n            if (source.scoped) {\n              page = page.where('visibleTo', 'array-contains-any', tokens)\n            }\n            page = page.orderBy(FieldPath.documentId()).limit(PAGE_SIZE)\n            if (cursor) page = page.startAfter(cursor)\n            const snapshot = await page.get()\n            const exhausted = snapshot.docs.length < PAGE_SIZE\n            cursor = exhausted\n              ? null\n              : (snapshot.docs[snapshot.docs.length - 1] ?? null)\n            if (exhausted) {\n              sourceIndex += 1\n              if (sourceIndex >= sources.length) phase = 'tail'\n            }\n            if (!snapshot.empty) {\n              const documents = snapshot.docs.map((entry) => ({\n                ...(entry.data() ?? {}),\n                $id: entry.id,\n                ...(source.hostId ? { hostId: source.hostId } : {}),\n              }))\n              if (resource === 'tasks') {\n                await resolveNames(\n                  documents.flatMap((document) =>\n                    (['contact', 'company', 'deal'] as const).map((kind) => ({\n                      kind,\n                      id: String(\n                        document[\n                          kind === 'contact'\n                            ? 'contactId'\n                            : kind === 'company'\n                              ? 'companyId'\n                              : 'dealId'\n                        ] ?? '',\n                      ),\n                    })),\n                  ),\n                )\n              }\n              const lines = documents.map((document) =>\n                line(\n                  crmExportCells(\n                    resource,\n                    resource === 'contacts'\n                      ? (contactCsvRowFromDoc(\n                          document,\n                          holderFor(document),\n                        ) as Record<string, unknown>)\n                      : document,\n                    options,\n                  ),\n                ),\n              )\n              controller.enqueue(encode(`\\n${lines.join('\\n')}`))\n              return\n            }\n            if (phase === 'body') return\n          }\n          controller.enqueue(encode('\\n'))\n          controller.close()\n        } catch (error) {\n          // Erroring the stream truncates the download rather than\n          // completing it short — a half-written file the browser reports\n          // as a failed transfer, not a quiet partial handover.\n          controller.error(error)\n        }\n      },\n    })\n\n    // Ids and counts only, never content: a full copy of an audience\n    // leaving the platform is worth a row; who was in it is not ours to log.\n    void addAdminAudit(firestore, {\n      actorUid: decoded.uid,\n      action: 'crm.exported',\n      target: `orgs/${orgId}/${resource}`,\n      before: null,\n      after: { resource, rows: total, hostId: hostId || null },\n      at: FieldValue.serverTimestamp(),\n    })\n      .catch(() => undefined)\n\n    const stamp = new Date().toISOString().slice(0, 10)\n    return new Response(stream, {\n      status: 200,\n      headers: {\n        'Content-Type': 'text/csv; charset=utf-8',\n        'Content-Disposition': `attachment; filename=\"${FILE_BASE[resource]}-${stamp}.csv\"`,\n        [EXPORT_ROWS_HEADER]: String(total),\n        'Cache-Control': 'no-store, private',\n      },\n    })\n  } catch (error) {\n    // A refused credential is a 401, not a fault of ours (AGL-1993). Null\n    // for anything else, so a real failure keeps the answer below.\n    const unauthenticated = invalidIdTokenResponse(error)\n    if (unauthenticated) return unauthenticated\n    return json({ error: 'Export failed' }, 500)\n  }\n}\n\n"],"names":["checkEntitlement","consentGroupForHost","CRM_COLLECTIONS","csvCell","hostScopeToken","isOrgWideMember","MAX_SCOPE_HOSTS","memberCanSee","memberScopeTokens","scopeTokensForHost","planLabelGrantingFeature","pluginRequestFromWeb","emailUnverifiedResponse","firebaseAdmin","isImpersonationSession","isServerReleaseFlagOnForOrg","lockdownRefusal","memberHasOrgPermission","resolveOrgMembership","FieldPath","FieldValue","addAdminAudit","invalidIdTokenResponse","contactCsvRowFromDoc","crmExportCells","crmExportHeader","isCrmExportResource","contactPrimaryGroup","PAGE_SIZE","HOST_PAGE","HOST_CEILING","NAME_CACHE_CEILING","EXPORT_ROWS_HEADER","json","body","status","Response","ORG_COLLECTION","contacts","companies","deals","tasks","FILE_BASE","leads","crmExportRoute","request","headers","method","query","rawHeaders","error","authorization","idToken","startsWith","slice","length","undefined","orgId","String","resource","hostId","decoded","app","auth","verifyIdToken","email_verified","staff","membership","uid","member","peopleFile","firestore","orgRef","collection","doc","orgSnapshot","get","exists","org","data","locked","plan","reason","code","orgWide","tokens","ownerEmails","Map","entry","docs","email","set","id","ownerEmail","options","assigneeEmail","fields","contactFields","customFields","map","key","label","archivedAt","filter","field","pipelines","names","stages","stage","stageId","pipelineName","stageName","pipelineId","recordNames","resolveNames","wanted","missing","has","kind","size","refs","snapshots","getAll","forEach","snapshot","index","name","recordName","siteNames","leadHostIds","cursor","page","where","orderBy","documentId","limit","startAfter","push","siteName","sources","reference","scoped","total","source","counted","Number","count","holderFor","document","group","groupId","hostIds","encoder","TextEncoder","encode","text","line","cells","join","sourceIndex","phase","stream","ReadableStream","pull","controller","enqueue","exhausted","empty","documents","$id","flatMap","lines","close","actorUid","action","target","before","after","rows","at","serverTimestamp","catch","stamp","Date","toISOString","unauthenticated"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,gBAAgB,EAChBC,mBAAmB,EACnBC,eAAe,EACfC,OAAO,EACPC,cAAc,EACdC,eAAe,EACfC,eAAe,EACfC,YAAY,EACZC,iBAAiB,EACjBC,kBAAkB,EAClBC,wBAAwB,EACxBC,oBAAoB,QACf,sBAAqB;AAC5B,SACEC,uBAAuB,EACvBC,aAAa,EACbC,sBAAsB,EACtBC,2BAA2B,EAC3BC,eAAe,EACfC,sBAAsB,EACtBC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,SAAS,EAAEC,UAAU,QAAQ,2BAA0B;AAChE,SAASC,aAAa,QAAQ,oDAAmD;AACjF,SAASC,sBAAsB,QAAQ,mDAAkD;AACzF,SACEC,oBAAoB,EACpBC,cAAc,EACdC,eAAe,EAGfC,mBAAmB,QACd,sBAAkB;AACzB,SAASC,mBAAmB,QAAQ,6BAAyB;AAE7D;;;;CAIC,GACD,MAAMC,YAAY;AAElB,mEAAmE,GACnE,MAAMC,YAAY;AAElB;;;;;;CAMC,GACD,MAAMC,eAAe;AAErB,gFAAgF,GAChF,MAAMC,qBAAqB;AAE3B,8DAA8D,GAC9D,OAAO,MAAMC,qBAAqB,sBAAqB;AAEvD,MAAMC,OAAO,CAACC,MAAeC,SAAmBC,SAASH,IAAI,CAACC,MAAM;QAAEC;IAAO;AAE7E,qEAAqE,GACrE,MAAME,iBAAsE;IAC1EC,UAAU;IACVC,WAAWrC,gBAAgBqC,SAAS;IACpCC,OAAOtC,gBAAgBsC,KAAK;IAC5BC,OAAOvC,gBAAgBuC,KAAK;AAC9B;AAEA,4CAA4C,GAC5C,MAAMC,YAA+C;IACnDJ,UAAU;IACVC,WAAW;IACXC,OAAO;IACPC,OAAO;IACPE,OAAO;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCC,GACD,OAAO,eAAeC,eAAeC,OAAgB;QAM7BC;IALtB,MAAM,EAAEC,MAAM,EAAEC,KAAK,EAAEF,SAASG,UAAU,EAAE,GAC1C,MAAMtC,qBAAqBkC;IAC7B,MAAMC,UAAUG;IAChB,IAAIF,WAAW,OAAO,OAAOd,KAAK;QAAEiB,OAAO;IAAqB,GAAG;IAEnE,MAAMC,iBAAgBL,yBAAAA,QAAQK,aAAa,YAArBL,yBAAyB;IAC/C,MAAMM,UAAUD,cAAcE,UAAU,CAAC,aACrCF,cAAcG,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOnB,KAAK;QAAEiB,OAAO;IAAkB,GAAG;IAExD,MAAMO,QAAQC,eAAOV,yBAAAA,KAAO,CAAC,QAAQ,mBAAI;IACzC,MAAMW,WAAWD,gBAAOV,yBAAAA,KAAO,CAAC,WAAW,oBAAI;IAC/C,MAAMY,SAASF,gBAAOV,yBAAAA,KAAO,CAAC,SAAS,oBAAI;IAC3C,IAAI,CAACS,SAAS,CAAC/B,oBAAoBiC,WAAW;QAC5C,OAAO1B,KAAK;YAAEiB,OAAO;QAA4B,GAAG;IACtD;IAEA,IAAI;QACF,MAAMW,UAAU,MAAMhD,cAAciD,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACZ;QAC/D,IAAI,CAACS,QAAQI,cAAc,IAAI,CAACnD,uBAAuB+C,UAAU;YAC/D,OAAOjD;QACT;QACA,MAAMsD,QAAQL,OAAO,CAAC,QAAQ,KAAK;QACnC,MAAMM,aAAa,MAAMjD,qBAAqB2C,QAAQO,GAAG,EAAEX;QAC3D,MAAMY,SAASF,8BAAAA,WAAYE,MAAM;QACjC,IAAI,CAACA,UAAU,CAACH,OAAO,OAAOjC,KAAK;YAAEiB,OAAO;QAAY,GAAG;QAE3D;;;;;;;;KAQC,GACD,MAAMoB,aAAaX,aAAa,cAAcA,aAAa;QAC3D,IAAI,CAACW,cAAc,CAACJ,SAAS,CAAE,MAAMnD,4BAA4B,eAAe0C,QAAS;YACvF,OAAOxB,KAAK;gBAAEiB,OAAO;YAAgB,GAAG;QAC1C;QACA,uEAAuE;QACvE,qEAAqE;QACrE,uCAAuC;QACvC,IAAI,CAACgB,SAAS,CAAE,MAAMjD,uBAAuBwC,OAAOY,QAAQ,gBAAiB;YAC3E,OAAOpC,KAAK;gBAAEiB,OAAO;YAAY,GAAG;QACtC;QAEA,MAAMqB,YAAY1D,cAAciD,GAAG,GAAGS,SAAS;QAC/C,MAAMC,SAASD,UAAUE,UAAU,CAAC,QAAQC,GAAG,CAACjB;QAChD,MAAMkB,cAAc,MAAMH,OAAOI,GAAG;QACpC,IAAI,CAACD,YAAYE,MAAM,EAAE,OAAO5C,KAAK;YAAEiB,OAAO;QAAuB,GAAG;QACxE,MAAM4B,MAAMH,YAAYI,IAAI;QAE5B,MAAMC,SAAS,MAAMhE,gBAAgB;YACnC6B;YACAqB;YACAE,KAAKP,QAAQO,GAAG;YAChBU;QACF;QACA,IAAIE,QAAQ,OAAOA;QAEnB,uEAAuE;QACvE,gEAAgE;QAChE,IAAI,CAACV,cAAc,CAACtE,iBAAiB8E,KAAc,QAAQ;YACzD,MAAMG,OAAOvE,yBAAyB;YACtC,OAAOuB,KACL;gBACEiB,OACE,CAAC,UAAU,EAAES,SAAS,8CAA8C,CAAC,GACrE,kEACCsB,CAAAA,OAAO,CAAC,eAAe,EAAEA,KAAK,CAAC,CAAC,GAAG,EAAC;gBACvCC,QAAQ;gBACRC,MAAM;YACR,GACA;QAEJ;QAEA,MAAMC,UAAUlB,SAAS7D,gBAAgBgE;QACzC,sEAAsE;QACtE,qEAAqE;QACrE,+BAA+B;QAC/B,MAAMgB,SAAS7E,kBAAkB6D,QAAQf,KAAK,CAAC,GAAGhD;QAClD,IAAI,CAAC8E,WAAW,CAACC,OAAO9B,MAAM,EAAE,OAAOtB,KAAK;YAAEiB,OAAO;QAAY,GAAG;QAEpE,qEAAqE,GACrE,MAAMoC,cAAc,IAAIC;QACxB,KAAK,MAAMC,SAAS,AAAC,CAAA,MAAMhB,OAAOC,UAAU,CAAC,WAAWG,GAAG,EAAC,EAAGa,IAAI,CAAE;;gBAC9CD;YAArB,MAAME,QAAQhC,iBAAO8B,cAAAA,MAAMT,IAAI,uBAAVS,WAAc,CAAC,QAAQ,oBAAI;YAChD,IAAIE,OAAOJ,YAAYK,GAAG,CAACH,MAAMI,EAAE,EAAEF;QACvC;QACA,MAAMG,aAAa,CAACzB;gBAAgBkB;oBAAAA,mBAAAA,YAAYV,GAAG,CAACR,gBAAhBkB,mBAAwBlB;;QAE5D,MAAM0B,UAA4B;YAAED;YAAYE,eAAeF;QAAW;QAE1E,IAAIlC,aAAa,YAAY;YAC3B;;;;;;;;OAQC,GACD,IAAI,CAACC,UAAU,CAACwB,SAAS,OAAOnD,KAAK;gBAAEiB,OAAO;YAAiB,GAAG;YAClE,MAAM8C,SAAS,MAAMxB,OAAOC,UAAU,CAACvE,gBAAgB+F,aAAa,EAAErB,GAAG;YACzEkB,QAAQI,YAAY,GAAGF,OAAOP,IAAI,CAC/BU,GAAG,CAAC,CAACX;;oBACQA,aACEA,cACFA;uBAHG;oBACfY,KAAK1C,gBAAO8B,cAAAA,MAAMT,IAAI,uBAAVS,WAAc,CAAC,MAAM,mBAAIA,MAAMI,EAAE;oBAC7CS,OAAO3C,iBAAO8B,eAAAA,MAAMT,IAAI,uBAAVS,YAAc,CAAC,QAAQ,oBAAIA,MAAMI,EAAE;oBACjDU,UAAU,GAAEd,eAAAA,MAAMT,IAAI,uBAAVS,YAAc,CAAC,aAAa;gBAC1C;eACCe,MAAM,CAAC,CAACC,QAAU,CAACA,MAAMF,UAAU,EACnCH,GAAG,CAAC,CAAC,EAAEC,GAAG,EAAEC,KAAK,EAAE,GAAM,CAAA;oBAAED;oBAAKC;gBAAM,CAAA;QAC3C;QAEA,IAAI1C,aAAa,SAAS;YACxB,MAAM8C,YAAY,MAAMjC,OAAOC,UAAU,CAACvE,gBAAgBuG,SAAS,EAAE7B,GAAG;YACxE,MAAM8B,QAAQ,IAAInB;YAClB,MAAMoB,SAAS,IAAIpB;YACnB,KAAK,MAAMC,SAASiB,UAAUhB,IAAI,CAAE;oBACrBD,cACcT,YACNA;gBAFrB,MAAMA,QAAOS,eAAAA,MAAMT,IAAI,cAAVS,eAAgB,CAAC;gBAC9BkB,MAAMf,GAAG,CAACH,MAAMI,EAAE,EAAElC,QAAOqB,aAAAA,IAAI,CAAC,OAAO,YAAZA,aAAgBS,MAAMI,EAAE;gBACnD,KAAK,MAAMgB,UAAU7B,eAAAA,IAAI,CAAC,SAAS,YAAdA,eAAkB,EAAE,CAAqC;;oBAC5E,MAAM8B,UAAUnD,gBAAOkD,yBAAAA,KAAO,CAAC,KAAK,oBAAI;oBACxC,IAAIC,SAAS;;wBACXF,OAAOhB,GAAG,CAAC,GAAGH,MAAMI,EAAE,CAAC,CAAC,EAAEiB,SAAS,EAAEnD,gBAAOkD,yBAAAA,KAAO,CAAC,OAAO,oBAAIC;oBACjE;gBACF;YACF;YACAf,QAAQgB,YAAY,GAAG,CAAClB,KAAOc,MAAM9B,GAAG,CAACgB;YACzCE,QAAQiB,SAAS,GAAG,CAACC,YAAYH,UAC/BF,OAAO/B,GAAG,CAAC,GAAGoC,WAAW,CAAC,EAAEH,SAAS;QACzC;QAEA;;;;;;;;KAQC,GACD,MAAMI,cAAc,IAAI1B;QACxB,MAAM2B,eAAe,OACnBC;YAEA,MAAMC,UAAUD,OAAOZ,MAAM,CAC3B,CAACf,QACCA,MAAMI,EAAE,IACR,CAACqB,YAAYI,GAAG,CAAC,GAAG7B,MAAM8B,IAAI,CAAC,CAAC,EAAE9B,MAAMI,EAAE,EAAE,KAC5CqB,YAAYM,IAAI,GAAGxF;YAEvB,IAAI,CAACqF,QAAQ7D,MAAM,EAAE;YACrB,MAAMiE,OAAOJ,QAAQjB,GAAG,CAAC,CAACX,QACxBhB,OACGC,UAAU,CACTe,MAAM8B,IAAI,KAAK,YACX,aACA9B,MAAM8B,IAAI,KAAK,YACbpH,gBAAgBqC,SAAS,GACzBrC,gBAAgBsC,KAAK,EAE5BkC,GAAG,CAACc,MAAMI,EAAE;YAEjB,MAAM6B,YAAY,MAAMlD,UAAUmD,MAAM,IAAIF;YAC5CC,UAAUE,OAAO,CAAC,CAACC,UAAUC;oBAEdD,gBAGA7C,aACAA,MAAAA;gBALb,MAAMS,QAAQ4B,OAAO,CAACS,MAAM;gBAC5B,MAAM9C,QAAO6C,iBAAAA,SAAS7C,IAAI,cAAb6C,iBAAmB,CAAC;gBACjC,MAAME,OACJtC,MAAM8B,IAAI,KAAK,SACX5D,QAAOqB,cAAAA,IAAI,CAAC,QAAQ,YAAbA,cAAiB,MACxBrB,QAAOqB,QAAAA,aAAAA,IAAI,CAAC,OAAO,YAAZA,aAAgBA,IAAI,CAAC,QAAQ,YAA7BA,OAAiC;gBAC9CkC,YAAYtB,GAAG,CAAC,GAAGH,MAAM8B,IAAI,CAAC,CAAC,EAAE9B,MAAMI,EAAE,EAAE,EAAEkC,QAAQtC,MAAMI,EAAE;YAC/D;QACF;QACA,IAAIjC,aAAa,SAAS;YACxBmC,QAAQiC,UAAU,GAAG,CAACT,MAAM1B,KAAOqB,YAAYrC,GAAG,CAAC,GAAG0C,KAAK,CAAC,EAAE1B,IAAI;QACpE;QAEA;;;;;KAKC,GACD,MAAMoC,YAAY,IAAIzC;QACtB,IAAI0C,cAAwB,EAAE;QAC9B,IAAItE,aAAa,SAAS;YACxB,IAAIC,QAAQ;gBACV,IAAI,CAACwB,WAAW,CAAC7E,aAAa8D,QAAQ;oBAACjE,eAAewD;iBAAQ,GAAG;oBAC/D,OAAO3B,KAAK;wBAAEiB,OAAO;oBAAY,GAAG;gBACtC;gBACA+E,cAAc;oBAACrE;iBAAO;YACxB,OAAO;gBACL,IAAI,CAACwB,SAAS,OAAOnD,KAAK;oBAAEiB,OAAO;gBAAiB,GAAG;gBACvD,IAAIgF,SAAwB;gBAC5B,OAAS;oBACP,IAAIC,OAAO5D,UACRE,UAAU,CAAC,SACX2D,KAAK,CAAC,SAAS,MAAM3E,OACrB4E,OAAO,CAAClH,UAAUmH,UAAU,IAC5BC,KAAK,CAAC1G;oBACT,IAAIqG,QAAQC,OAAOA,KAAKK,UAAU,CAACjE,UAAUE,UAAU,CAAC,SAASC,GAAG,CAACwD;oBACrE,MAAMN,WAAW,MAAMO,KAAKvD,GAAG;oBAC/B,KAAK,MAAMY,SAASoC,SAASnC,IAAI,CAAE;4BAK7BD;4BAAAA,cACEA;wBALNyC,YAAYQ,IAAI,CAACjD,MAAMI,EAAE;wBACzBoC,UAAUrC,GAAG,CACXH,MAAMI,EAAE,EACRlC,QACE8B,kBAAAA,eAAAA,MAAMT,IAAI,uBAAVS,YAAc,CAAC,cAAc,qBAC3BA,eAAAA,MAAMT,IAAI,uBAAVS,YAAc,CAAC,YAAY,YAD7BA,QAEEA,MAAMI,EAAE;oBAGhB;oBACA,IAAIgC,SAASnC,IAAI,CAAClC,MAAM,GAAG1B,WAAW;oBACtC,IAAIoG,YAAY1E,MAAM,IAAIzB,cAAc;oBACxCoG,SAASN,SAASnC,IAAI,CAACmC,SAASnC,IAAI,CAAClC,MAAM,GAAG,EAAE,CAACqC,EAAE;gBACrD;gBACAE,QAAQ4C,QAAQ,GAAG,CAAC9C,KAAOoC,UAAUpD,GAAG,CAACgB;YAC3C;QACF;QAEA,mEAAmE,GACnE,MAAM+C,UACJhF,aAAa,UACTsE,YAAY9B,GAAG,CAAC,CAACP,KAAQ,CAAA;gBACvBhC,QAAQgC;gBACR;;;;;;;;;aASC,GACDgD,WAAWpE,OACRC,UAAU,CAAC,SACX2D,KAAK,CAAC,aAAa,sBAAsB3H,mBAAmBmF;gBAC/DiD,QAAQ;YACV,CAAA,KACA;YACE;gBACEjF,QAAQ;gBACRgF,WAAWpE,OAAOC,UAAU,CAC1BpC,cAAc,CAACsB,SAAgD;gBAEjEkF,QAAQ,CAACzD;YACX;SACD;QAEP,mEAAmE;QACnE,sEAAsE;QACtE,sEAAsE;QACtE,gEAAgE;QAChE,IAAI0D,QAAQ;QACZ,KAAK,MAAMC,UAAUJ,QAAS;gBAIZ;YAHhB,MAAMK,UAAUD,OAAOF,MAAM,GACzBE,OAAOH,SAAS,CAACR,KAAK,CAAC,aAAa,sBAAsB/C,UAC1D0D,OAAOH,SAAS;YACpBE,SAASG,QAAO,cAAA,AAAC,CAAA,MAAMD,QAAQE,KAAK,GAAGtE,GAAG,EAAC,EAAGG,IAAI,GAAGmE,KAAK,YAA1C,cAA8C;QAChE;QAEA,mEAAmE,GACnE,MAAMC,YAAY,CAACC;YACjB,MAAMC,QAAQzF,SACV3D,oBAAoB6E,KAAgClB,UACpDjC,oBAAoByH,UAAUtE;YAClC,OAAO;gBAAEwE,SAASD,MAAMC,OAAO;gBAAEC,SAASF,MAAME,OAAO;YAAC;QAC1D;QAEA,MAAMC,UAAU,IAAIC;QACpB,MAAMC,SAAS,CAACC,OAAiBH,QAAQE,MAAM,CAACC;QAChD,MAAMC,OAAO,CAACC,QAA8BA,MAAM1D,GAAG,CAAChG,SAAS2J,IAAI,CAAC;QACpE,IAAIC,cAAc;QAClB,IAAI7B,SAAyD;QAC7D,IAAI8B,QAAkC;QAEtC,MAAMC,SAAS,IAAIC,eAA2B;YAC5C,MAAMC,MAAKC,UAAU;gBACnB,IAAI;oBACF,IAAIJ,UAAU,QAAQ;wBACpBA,QAAQrB,QAAQpF,MAAM,GAAG,SAAS;wBAClC6G,WAAWC,OAAO,CAACX,OAAOE,KAAKnI,gBAAgBkC,UAAUmC;wBACzD;oBACF;oBACA,IAAIkE,UAAU,QAAQ;4BAYfpC;wBAXL,MAAMmB,SAASJ,OAAO,CAACoB,YAAY;wBACnC,IAAI5B,OAAgCY,OAAOH,SAAS;wBACpD,IAAIG,OAAOF,MAAM,EAAE;4BACjBV,OAAOA,KAAKC,KAAK,CAAC,aAAa,sBAAsB/C;wBACvD;wBACA8C,OAAOA,KAAKE,OAAO,CAAClH,UAAUmH,UAAU,IAAIC,KAAK,CAAC3G;wBAClD,IAAIsG,QAAQC,OAAOA,KAAKK,UAAU,CAACN;wBACnC,MAAMN,WAAW,MAAMO,KAAKvD,GAAG;wBAC/B,MAAM0F,YAAY1C,SAASnC,IAAI,CAAClC,MAAM,GAAG3B;wBACzCsG,SAASoC,YACL,QACC1C,kBAAAA,SAASnC,IAAI,CAACmC,SAASnC,IAAI,CAAClC,MAAM,GAAG,EAAE,YAAvCqE,kBAA2C;wBAChD,IAAI0C,WAAW;4BACbP,eAAe;4BACf,IAAIA,eAAepB,QAAQpF,MAAM,EAAEyG,QAAQ;wBAC7C;wBACA,IAAI,CAACpC,SAAS2C,KAAK,EAAE;4BACnB,MAAMC,YAAY5C,SAASnC,IAAI,CAACU,GAAG,CAAC,CAACX;oCAC/BA;uCAD0C,cAC1CA,cAAAA,MAAMT,IAAI,cAAVS,cAAgB,CAAC;oCACrBiF,KAAKjF,MAAMI,EAAE;mCACTmD,OAAOnF,MAAM,GAAG;oCAAEA,QAAQmF,OAAOnF,MAAM;gCAAC,IAAI,CAAC;;4BAEnD,IAAID,aAAa,SAAS;gCACxB,MAAMuD,aACJsD,UAAUE,OAAO,CAAC,CAACtB,WACjB,AAAC;wCAAC;wCAAW;wCAAW;qCAAO,CAAWjD,GAAG,CAAC,CAACmB;4CAG3C8B;+CAHqD;4CACvD9B;4CACA1B,IAAIlC,QACF0F,aAAAA,QAAQ,CACN9B,SAAS,YACL,cACAA,SAAS,YACP,cACA,SACP,YAND8B,aAMK;wCAET;;4BAGN;4BACA,MAAMuB,QAAQH,UAAUrE,GAAG,CAAC,CAACiD,WAC3BQ,KACEpI,eACEmC,UACAA,aAAa,aACRpC,qBACC6H,UACAD,UAAUC,aAEZA,UACJtD;4BAINsE,WAAWC,OAAO,CAACX,OAAO,CAAC,EAAE,EAAEiB,MAAMb,IAAI,CAAC,OAAO;4BACjD;wBACF;wBACA,IAAIE,UAAU,QAAQ;oBACxB;oBACAI,WAAWC,OAAO,CAACX,OAAO;oBAC1BU,WAAWQ,KAAK;gBAClB,EAAE,OAAO1H,OAAO;oBACd,yDAAyD;oBACzD,gEAAgE;oBAChE,sDAAsD;oBACtDkH,WAAWlH,KAAK,CAACA;gBACnB;YACF;QACF;QAEA,iEAAiE;QACjE,yEAAyE;QACzE,KAAK7B,cAAckD,WAAW;YAC5BsG,UAAUhH,QAAQO,GAAG;YACrB0G,QAAQ;YACRC,QAAQ,CAAC,KAAK,EAAEtH,MAAM,CAAC,EAAEE,UAAU;YACnCqH,QAAQ;YACRC,OAAO;gBAAEtH;gBAAUuH,MAAMpC;gBAAOlF,QAAQA,UAAU;YAAK;YACvDuH,IAAI/J,WAAWgK,eAAe;QAChC,GACGC,KAAK,CAAC,IAAM7H;QAEf,MAAM8H,QAAQ,IAAIC,OAAOC,WAAW,GAAGlI,KAAK,CAAC,GAAG;QAChD,OAAO,IAAIlB,SAAS6H,QAAQ;YAC1B9H,QAAQ;YACRW,SAAS;gBACP,gBAAgB;gBAChB,uBAAuB,CAAC,sBAAsB,EAAEJ,SAAS,CAACiB,SAAS,CAAC,CAAC,EAAE2H,MAAM,KAAK,CAAC;gBACnF,CAACtJ,mBAAmB,EAAE0B,OAAOoF;gBAC7B,iBAAiB;YACnB;QACF;IACF,EAAE,OAAO5F,OAAO;QACd,sEAAsE;QACtE,+DAA+D;QAC/D,MAAMuI,kBAAkBnK,uBAAuB4B;QAC/C,IAAIuI,iBAAiB,OAAOA;QAC5B,OAAOxJ,KAAK;YAAEiB,OAAO;QAAgB,GAAG;IAC1C;AACF"}

package/src/lib/server/import-context.d.ts

@@ -1,87 +0,0 @@
-/**
- * @license
- * Copyright 2026 Aglyn LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-/**
- * WHAT EVERY CSV IMPORT ROUTE ASKS BEFORE IT READS A ROW (AGL-2602, shared
- * by the companies import since AGL-2621).
- *
- * Who is asking and on whose behalf, whether the request is the size a
- * chunk is allowed to be, and — when a row names an owner — which member
- * of the org that address is. The contacts route settled each answer; the
- * companies route needs the same three and must not spell them
- * differently, because two gates for one permission is how one of them
- * comes to be wider.
- *
- * ## Who may call an import
- *
- * The same two gates the rules put on every CRM collection: a site role
- * on the host the request names, AND the organization's `data.manage`
- * permission resolved through the member's custom role and overrides. The
- * Admin SDK evaluates no rules, so this is the enforcement rather than an
- * echo of it — and `data.manage` rather than the raw role because an owner
- * who unticked "Manage data" on a custom role meant it. A staff token
- * passes both gates the way it does on every console route: support
- * importing a customer's file for them is the support act this exists for.
- */
-import { type PluginApiHandler } from '@aglyn/aglyn/server';
-/** Everything an import needs about who is asking, or the refusal to send back. */
-export type ImportContext = {
-    ok: true;
-    uid: string;
-    /** The importer's address, for who set off the runs it causes (AGL-3376). */
-    email: string | null;
-    hostId: string;
-    orgId: string;
-    org: Record<string, unknown>;
-    /**
-     * The stamp a record CREATED by this import carries — the org, when
-     * the org widened its default, and otherwise the capturing group.
-     */
-    scopeTokens: string[];
-    /**
-     * The tokens a record must overlap to be SEEN from this site: the
-     * group's own, plus `org`, because an org-wide record is visible to
-     * every site in the account. The reader's set is wider than the
-     * creator's stamp, exactly as it is on the collection listeners.
-     */
-    readTokens: string[];
-} | {
-    ok: false;
-    status: number;
-    body: Record<string, unknown>;
-};
-export type ImportRequest = Parameters<PluginApiHandler>[0];
-/** Who is asking, and on whose behalf. */
-export declare function resolveImportContext(req: ImportRequest): Promise<ImportContext>;
-/** The rows a request may carry, or the refusal to send back. */
-export declare function readImportRows<R>(req: ImportRequest, limits: {
-    maxBodyBytes: number;
-    chunkSize: number;
-}): {
-    rows: R[];
-} | {
-    status: number;
-    error: string;
-};
-/**
- * The org's members by address, read only when a row names an owner.
- *
- * A file with no owner column costs no roster read; a file with one costs
- * exactly one, however many rows it has.
- */
-export declare function ownerDirectory(orgId: string, rows: readonly {
-    ownerEmail?: string;
-}[]): Promise<Map<string, string>>;