@aglyn/plugins-crm 1.0.0-beta.221 → 1.0.0-beta.223

package/src/lib/server/contact-remove.js

@@ -57,7 +57,7 @@
  * Letting a holder go is the CRM's "Remove from this site", included from
  * Starter (AGL-2851), so a detach is refused on a plan without the CRM. A
  * delete is not: removing a workspace's own record stays open on every plan.
- */ import { consentGroupForHost, crmReadTokens, heldScopeTokens, isOrgWideMember, memberScopeTokens, planContactDetach, seenOnlyThroughGrant, visibleToTokens } from "@aglyn/aglyn/server";
+ */ import { consentGroupForHost, CRM_COLLECTIONS, crmReadTokens, heldScopeTokens, isOrgWideMember, memberScopeTokens, planContactDetach, seenOnlyThroughGrant, visibleToTokens } from "@aglyn/aglyn/server";
 import { firebaseAdmin, removeContactKeepingRefusals, restampCrmListFieldsOf } from "@aglyn/tenant-data-admin";
 import { CRM_CONTACT_REMOVE_MAX } from "../model/contact-remove.js";
 import { typed } from "./contact-profile.js";
@@ -65,6 +65,8 @@ import { readCrmRouteScope } from "./org-caller.js";
 import { crmSuiteRefusal } from "./suite-gate.js";
 import { authorizeCrmWriter, canReach } from "./task-routes.js";
 import { contactPrimaryGroup } from "../model/contact-holder.js";
+import { sweepDealContactRoles } from "./deal-contact-roles.js";
+import { clearReportsToOf, contactFacetHolders } from "./contact-reports-to.js";
 /** What the suite gate names for a detach on a plan without the CRM. */ export const CONTACT_DETACH_SUITE_ACT = 'Removing a contact from one site';
 /**
  * What a site is told for a contact it sees only because it was SHARED with
@@ -183,13 +185,28 @@ export const crmContactRemoveHandler = async (req, res)=>{
         };
         const outcomes = new Map();
         const detached = [];
+        /*
+     * The holders whose facets may point at each removed contact as their
+     * reports-to (AGL-3537), as decided: every holder of a deleted contact,
+     * and the one letting go of a detached one — which no longer holds the
+     * person it would point at.
+     */ const lettingGo = new Map();
+        const deciding = (contactId)=>(contact)=>{
+                const decided = decide(contact);
+                if (!('refused' in decided)) {
+                    lettingGo.set(contactId, decided.action === 'delete' ? contactFacetHolders(contact) : [
+                        (siteGroup != null ? siteGroup : contactPrimaryGroup(contact, writer.org)).groupId
+                    ]);
+                }
+                return decided;
+            };
         for(let at = 0; at < contactIds.length; at += CONCURRENCY){
             await Promise.all(contactIds.slice(at, at + CONCURRENCY).map(async (contactId)=>{
                 const contactRef = contacts.doc(contactId);
                 try {
                     const removal = await removeContactKeepingRefusals({
                         contactRef,
-                        decide,
+                        decide: deciding(contactId),
                         nowMs
                     });
                     if (removal.outcome === 'missing') {
@@ -197,18 +214,26 @@ export const crmContactRemoveHandler = async (req, res)=>{
                     } else if (removal.outcome === 'refused') {
                         outcomes.set(contactId, refused(contactId, removal.error));
                     } else if (removal.outcome === 'detached') {
+                        var _lettingGo_get;
                         detached.push(contactRef);
                         outcomes.set(contactId, {
                             contactId,
                             ok: true,
                             removed: 'detached'
                         });
+                        // The holder letting go points at the person no more (AGL-3537).
+                        await clearReportsToOf(firestore, contacts, (_lettingGo_get = lettingGo.get(contactId)) != null ? _lettingGo_get : [], contactId);
                     } else {
+                        var _lettingGo_get1;
                         outcomes.set(contactId, {
                             contactId,
                             ok: true,
                             removed: 'deleted'
                         });
+                        // Nobody reports to a deleted person (AGL-3537)…
+                        await clearReportsToOf(firestore, contacts, (_lettingGo_get1 = lettingGo.get(contactId)) != null ? _lettingGo_get1 : [], contactId);
+                        // …and they leave every deal's contact roles (AGL-3521).
+                        await sweepDealContactRoles(firestore, firestore.collection('orgs').doc(writer.orgId).collection(CRM_COLLECTIONS.deals), contactId, null, '[crm] contact-remove');
                     }
                 } catch (error) {
                     console.error('[crm] contact-remove could not remove a contact', contactId, error);

package/src/lib/server/contact-remove.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/contact-remove.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * `POST /api/crm/contact-remove` — a holder lets contacts go, and a person's\n * \"no\" to marketing stays (AGL-3338).\n *\n * Body: `{ hostId, contactIds }` under a site, or `{ orgId, hostId?,\n * contactIds }` at the organization level. Answers `ContactRemoveResponse`:\n * one outcome per contact, in the order the ids were sent.\n *\n * ## Delete is a detach, and a refusal is not let go\n *\n * A contact is shared by every site that captured the person. Removing it\n * from one drops that holder's facet, consent grants, capture attribution\n * and scope tokens, and the document is deleted only when nobody else holds\n * it (`planContactDetach`). A refusal of marketing email is kept either way:\n * a detach leaves it on the document for the holders that remain, and the\n * last holder's delete copies every refusal into the organization's retained\n * store in the same transaction (`removeContactKeepingRefusals`). The list\n * gate reads both, so deleting a person is not a way to put somebody who\n * said no on a list.\n *\n * ## Why a route\n *\n * The decision has to be made against the document's consent map, which a\n * table row does not project, and it has to land in one commit with the\n * retained store, which no client may write. So the rules close a client's\n * update and delete of a contact, and the console's removals arrive here.\n *\n * ## Who may call it\n *\n * The CRM writer the other contact routes admit (`authorizeCrmWriter`),\n * whose access reaches the site under a site. Each contact must be one the\n * caller may read and, under a site, one the site's hub lists. Then, as the\n * rules asked before the route existed:\n *\n *  - a DELETE needs the caller's reach to cover every holder of the row, so\n *    a site collaborator cannot delete a person another site also holds;\n *  - a DETACH changes who a record is shared with, which only an org-wide\n *    member may do (`scopeUnchanged()` in the rules).\n *\n * ## The plan\n *\n * Letting a holder go is the CRM's \"Remove from this site\", included from\n * Starter (AGL-2851), so a detach is refused on a plan without the CRM. A\n * delete is not: removing a workspace's own record stays open on every plan.\n */\n\nimport {\n  consentGroupForHost,\n  crmReadTokens,\n  heldScopeTokens,\n  isOrgWideMember,\n  memberScopeTokens,\n  planContactDetach,\n  type PluginApiHandler,\n  seenOnlyThroughGrant,\n  visibleToTokens,\n} from '@aglyn/aglyn/server'\nimport {\n  firebaseAdmin,\n  removeContactKeepingRefusals,\n  restampCrmListFieldsOf,\n} from '@aglyn/tenant-data-admin'\nimport {\n  type ContactRemoveOutcome,\n  type ContactRemoveResponse,\n  CRM_CONTACT_REMOVE_MAX,\n} from '../model/contact-remove'\nimport { typed } from './contact-profile'\nimport { readCrmRouteScope } from './org-caller'\nimport { crmSuiteRefusal } from './suite-gate'\nimport { authorizeCrmWriter, canReach, type Writer } from './task-routes'\nimport { contactPrimaryGroup } from '../model/contact-holder'\n\n/** What the suite gate names for a detach on a plan without the CRM. */\nexport const CONTACT_DETACH_SUITE_ACT = 'Removing a contact from one site'\n\n/**\n * What a site is told for a contact it sees only because it was SHARED with\n * it (AGL-3336): it holds nothing there to let go of, and taking the share\n * away is a manager's unshare, not a removal.\n */\nexport const CONTACT_REMOVE_SHARED_REFUSAL =\n  'This contact was shared with this site by another site. An owner or ' +\n  'admin can stop sharing it from its Sharing card.'\n\n/** A contact read at the organization level that no site has captured. */\nexport const CONTACT_REMOVE_NO_HOLDER =\n  'No site holds this contact yet, so there is no site to remove it from.'\n\n/** What a site collaborator is told for a person another site also holds. */\nexport const CONTACT_REMOVE_SCOPED_REFUSAL =\n  'Other sites hold this contact too, and your access is limited to ' +\n  'specific sites. Ask an organization administrator to remove it.'\n\n/** How many contacts are removed at once — each in its own transaction. */\nconst CONCURRENCY = 20\n\nconst refused = (contactId: string, error: string): ContactRemoveOutcome => ({\n  contactId,\n  ok: false,\n  error,\n})\n\n/** The ids a body names, deduplicated — or `null` when any is unreadable or there are too many. */\nfunction readContactIds(value: unknown): string[] | null {\n  if (!Array.isArray(value) || !value.length || value.length > CRM_CONTACT_REMOVE_MAX) {\n    return null\n  }\n  const ids = value.map((id) => typed(id, 200))\n  if (ids.some((id) => !id || id.includes('/'))) return null\n  return [...new Set(ids)]\n}\n\n/** Under a site, whether the caller's access reaches it. */\nfunction reachesSite(writer: Writer, hostId: string): boolean {\n  return (\n    writer.staff ||\n    isOrgWideMember(writer.member) ||\n    Boolean((writer.member?.hostAccess as Record<string, unknown> | undefined)?.[hostId])\n  )\n}\n\n/** Whether the caller's reach is the whole organization. */\nconst orgWide = (writer: Writer): boolean =>\n  writer.staff || writer.level === 'org' || isOrgWideMember(writer.member)\n\nexport const crmContactRemoveHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  const body = (req.body ?? {}) as Record<string, unknown>\n  const scope = readCrmRouteScope(body)\n  if (!scope) {\n    res.status(400).json({ error: 'Missing hostId' })\n    return\n  }\n  const contactIds = readContactIds(body['contactIds'])\n  if (!contactIds) {\n    res.status(400).json({ error: `Name between 1 and ${CRM_CONTACT_REMOVE_MAX} contacts.` })\n    return\n  }\n\n  try {\n    const writer = await authorizeCrmWriter(req, scope, { suiteAct: null })\n    if (writer.ok === false) {\n      res.status(writer.status).json(writer.body)\n      return\n    }\n    if (scope.level === 'site' && !reachesSite(writer, scope.hostId)) {\n      res.status(403).json({ error: 'Your access to this organization does not reach this site.' })\n      return\n    }\n\n    const firestore = firebaseAdmin.app().firestore()\n    const contacts = firestore.collection('orgs').doc(writer.orgId).collection('contacts')\n    const siteGroup =\n      scope.level === 'site' ? consentGroupForHost(writer.org, scope.hostId) : null\n    const siteTokens = siteGroup ? crmReadTokens(siteGroup) : null\n    const suite = crmSuiteRefusal(writer.org, CONTACT_DETACH_SUITE_ACT)\n    const callerTokens = new Set<string>(memberScopeTokens(writer.member))\n    const nowMs = Date.now()\n\n    /*\n     * Decided inside each contact's transaction, against the document as it\n     * was read there: the reach, the holder letting go, and what that means.\n     */\n    const decide = (contact: Record<string, unknown>) => {\n      const visibleTo = contact['visibleTo'] as string[] | undefined\n      if (!canReach(writer, visibleTo)) return { refused: 'That contact is not visible to you.' }\n      if (siteTokens && !visibleToTokens(visibleTo, siteTokens)) {\n        return { refused: 'That contact is not visible to this site.' }\n      }\n      if (siteGroup && siteGroup.hostIds.every((hostId) => seenOnlyThroughGrant(contact, hostId))) {\n        return { refused: CONTACT_REMOVE_SHARED_REFUSAL }\n      }\n      const group = siteGroup ?? contactPrimaryGroup(contact, writer.org)\n      if (!group.groupId || !group.hostIds.length) return { refused: CONTACT_REMOVE_NO_HOLDER }\n      const plan = planContactDetach(contact, group)\n      if (plan.action === 'delete') {\n        // The HOLDERS: a site the contact was only shared with holds\n        // nothing, so it never stands between a holder and its delete.\n        const holders = heldScopeTokens(contact)\n        if (!orgWide(writer) && !holders.every((token) => callerTokens.has(token))) {\n          return { refused: CONTACT_REMOVE_SCOPED_REFUSAL }\n        }\n        return plan\n      }\n      if (!orgWide(writer)) return { refused: CONTACT_REMOVE_SCOPED_REFUSAL }\n      if (suite) return { refused: suite.body.error }\n      return plan\n    }\n\n    const outcomes = new Map<string, ContactRemoveOutcome>()\n    const detached: FirebaseFirestore.DocumentReference[] = []\n    for (let at = 0; at < contactIds.length; at += CONCURRENCY) {\n      await Promise.all(\n        contactIds.slice(at, at + CONCURRENCY).map(async (contactId) => {\n          const contactRef = contacts.doc(contactId)\n          try {\n            const removal = await removeContactKeepingRefusals({ contactRef, decide, nowMs })\n            if (removal.outcome === 'missing') {\n              outcomes.set(contactId, refused(contactId, 'That contact no longer exists.'))\n            } else if (removal.outcome === 'refused') {\n              outcomes.set(contactId, refused(contactId, removal.error))\n            } else if (removal.outcome === 'detached') {\n              detached.push(contactRef)\n              outcomes.set(contactId, { contactId, ok: true, removed: 'detached' })\n            } else {\n              outcomes.set(contactId, { contactId, ok: true, removed: 'deleted' })\n            }\n          } catch (error) {\n            console.error('[crm] contact-remove could not remove a contact', contactId, error)\n            outcomes.set(contactId, refused(contactId, 'The contact could not be removed.'))\n          }\n        }),\n      )\n    }\n    // A detached row still carries the facet keys and scoped search tokens of\n    // the holder that let it go, which the Contacts list filters by (AGL-3321).\n    // Its own catch: the contacts are removed by now, and a list stamp that\n    // could not move is not a removal that failed.\n    if (detached.length) {\n      await restampCrmListFieldsOf(detached, 'contacts').catch((error: unknown) => {\n        console.error('[crm] contact-remove could not restamp list fields', error)\n      })\n    }\n\n    const answer: ContactRemoveResponse = {\n      ok: true,\n      results: contactIds.map(\n        (contactId) =>\n          outcomes.get(contactId) ?? refused(contactId, 'The contact could not be removed.'),\n      ),\n    }\n    res.status(200).json(answer)\n  } catch (error) {\n    console.error('[crm] contact-remove failed', error)\n    res.status(500).json({ error: 'The contacts could not be removed.' })\n  }\n}\n"],"names":["consentGroupForHost","crmReadTokens","heldScopeTokens","isOrgWideMember","memberScopeTokens","planContactDetach","seenOnlyThroughGrant","visibleToTokens","firebaseAdmin","removeContactKeepingRefusals","restampCrmListFieldsOf","CRM_CONTACT_REMOVE_MAX","typed","readCrmRouteScope","crmSuiteRefusal","authorizeCrmWriter","canReach","contactPrimaryGroup","CONTACT_DETACH_SUITE_ACT","CONTACT_REMOVE_SHARED_REFUSAL","CONTACT_REMOVE_NO_HOLDER","CONTACT_REMOVE_SCOPED_REFUSAL","CONCURRENCY","refused","contactId","error","ok","readContactIds","value","Array","isArray","length","ids","map","id","some","includes","Set","reachesSite","writer","hostId","staff","member","Boolean","hostAccess","orgWide","level","crmContactRemoveHandler","req","res","method","setHeader","status","json","body","scope","contactIds","suiteAct","firestore","app","contacts","collection","doc","orgId","siteGroup","org","siteTokens","suite","callerTokens","nowMs","Date","now","decide","contact","visibleTo","hostIds","every","group","groupId","plan","action","holders","token","has","outcomes","Map","detached","at","Promise","all","slice","contactRef","removal","outcome","set","push","removed","console","catch","answer","results","get"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CC,GAED,SACEA,mBAAmB,EACnBC,aAAa,EACbC,eAAe,EACfC,eAAe,EACfC,iBAAiB,EACjBC,iBAAiB,EAEjBC,oBAAoB,EACpBC,eAAe,QACV,sBAAqB;AAC5B,SACEC,aAAa,EACbC,4BAA4B,EAC5BC,sBAAsB,QACjB,2BAA0B;AACjC,SAGEC,sBAAsB,QACjB,6BAAyB;AAChC,SAASC,KAAK,QAAQ,uBAAmB;AACzC,SAASC,iBAAiB,QAAQ,kBAAc;AAChD,SAASC,eAAe,QAAQ,kBAAc;AAC9C,SAASC,kBAAkB,EAAEC,QAAQ,QAAqB,mBAAe;AACzE,SAASC,mBAAmB,QAAQ,6BAAyB;AAE7D,sEAAsE,GACtE,OAAO,MAAMC,2BAA2B,mCAAkC;AAE1E;;;;CAIC,GACD,OAAO,MAAMC,gCACX,yEACA,mDAAkD;AAEpD,wEAAwE,GACxE,OAAO,MAAMC,2BACX,yEAAwE;AAE1E,2EAA2E,GAC3E,OAAO,MAAMC,gCACX,sEACA,kEAAiE;AAEnE,yEAAyE,GACzE,MAAMC,cAAc;AAEpB,MAAMC,UAAU,CAACC,WAAmBC,QAAyC,CAAA;QAC3ED;QACAE,IAAI;QACJD;IACF,CAAA;AAEA,iGAAiG,GACjG,SAASE,eAAeC,KAAc;IACpC,IAAI,CAACC,MAAMC,OAAO,CAACF,UAAU,CAACA,MAAMG,MAAM,IAAIH,MAAMG,MAAM,GAAGpB,wBAAwB;QACnF,OAAO;IACT;IACA,MAAMqB,MAAMJ,MAAMK,GAAG,CAAC,CAACC,KAAOtB,MAAMsB,IAAI;IACxC,IAAIF,IAAIG,IAAI,CAAC,CAACD,KAAO,CAACA,MAAMA,GAAGE,QAAQ,CAAC,OAAO,OAAO;IACtD,OAAO;WAAI,IAAIC,IAAIL;KAAK;AAC1B;AAEA,0DAA0D,GAC1D,SAASM,YAAYC,MAAc,EAAEC,MAAc;QAItCD,2BAAAA;IAHX,OACEA,OAAOE,KAAK,IACZtC,gBAAgBoC,OAAOG,MAAM,KAC7BC,SAASJ,iBAAAA,OAAOG,MAAM,sBAAbH,4BAAAA,eAAeK,UAAU,qBAA1B,AAACL,yBAAmE,CAACC,OAAO;AAExF;AAEA,0DAA0D,GAC1D,MAAMK,UAAU,CAACN,SACfA,OAAOE,KAAK,IAAIF,OAAOO,KAAK,KAAK,SAAS3C,gBAAgBoC,OAAOG,MAAM;AAEzE,OAAO,MAAMK,0BAA4C,OAAOC,KAAKC;QAMrDD;IALd,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE5B,OAAO;QAAqB;QACnD;IACF;IACA,MAAM6B,QAAQN,YAAAA,IAAIM,IAAI,YAARN,YAAY,CAAC;IAC3B,MAAMO,QAAQ1C,kBAAkByC;IAChC,IAAI,CAACC,OAAO;QACVN,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE5B,OAAO;QAAiB;QAC/C;IACF;IACA,MAAM+B,aAAa7B,eAAe2B,IAAI,CAAC,aAAa;IACpD,IAAI,CAACE,YAAY;QACfP,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE5B,OAAO,CAAC,mBAAmB,EAAEd,uBAAuB,UAAU,CAAC;QAAC;QACvF;IACF;IAEA,IAAI;QACF,MAAM4B,SAAS,MAAMxB,mBAAmBiC,KAAKO,OAAO;YAAEE,UAAU;QAAK;QACrE,IAAIlB,OAAOb,EAAE,KAAK,OAAO;YACvBuB,IAAIG,MAAM,CAACb,OAAOa,MAAM,EAAEC,IAAI,CAACd,OAAOe,IAAI;YAC1C;QACF;QACA,IAAIC,MAAMT,KAAK,KAAK,UAAU,CAACR,YAAYC,QAAQgB,MAAMf,MAAM,GAAG;YAChES,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAE5B,OAAO;YAA6D;YAC3F;QACF;QAEA,MAAMiC,YAAYlD,cAAcmD,GAAG,GAAGD,SAAS;QAC/C,MAAME,WAAWF,UAAUG,UAAU,CAAC,QAAQC,GAAG,CAACvB,OAAOwB,KAAK,EAAEF,UAAU,CAAC;QAC3E,MAAMG,YACJT,MAAMT,KAAK,KAAK,SAAS9C,oBAAoBuC,OAAO0B,GAAG,EAAEV,MAAMf,MAAM,IAAI;QAC3E,MAAM0B,aAAaF,YAAY/D,cAAc+D,aAAa;QAC1D,MAAMG,QAAQrD,gBAAgByB,OAAO0B,GAAG,EAAE/C;QAC1C,MAAMkD,eAAe,IAAI/B,IAAYjC,kBAAkBmC,OAAOG,MAAM;QACpE,MAAM2B,QAAQC,KAAKC,GAAG;QAEtB;;;KAGC,GACD,MAAMC,SAAS,CAACC;YACd,MAAMC,YAAYD,OAAO,CAAC,YAAY;YACtC,IAAI,CAACzD,SAASuB,QAAQmC,YAAY,OAAO;gBAAEnD,SAAS;YAAsC;YAC1F,IAAI2C,cAAc,CAAC3D,gBAAgBmE,WAAWR,aAAa;gBACzD,OAAO;oBAAE3C,SAAS;gBAA4C;YAChE;YACA,IAAIyC,aAAaA,UAAUW,OAAO,CAACC,KAAK,CAAC,CAACpC,SAAWlC,qBAAqBmE,SAASjC,UAAU;gBAC3F,OAAO;oBAAEjB,SAASJ;gBAA8B;YAClD;YACA,MAAM0D,QAAQb,oBAAAA,YAAa/C,oBAAoBwD,SAASlC,OAAO0B,GAAG;YAClE,IAAI,CAACY,MAAMC,OAAO,IAAI,CAACD,MAAMF,OAAO,CAAC5C,MAAM,EAAE,OAAO;gBAAER,SAASH;YAAyB;YACxF,MAAM2D,OAAO1E,kBAAkBoE,SAASI;YACxC,IAAIE,KAAKC,MAAM,KAAK,UAAU;gBAC5B,6DAA6D;gBAC7D,+DAA+D;gBAC/D,MAAMC,UAAU/E,gBAAgBuE;gBAChC,IAAI,CAAC5B,QAAQN,WAAW,CAAC0C,QAAQL,KAAK,CAAC,CAACM,QAAUd,aAAae,GAAG,CAACD,SAAS;oBAC1E,OAAO;wBAAE3D,SAASF;oBAA8B;gBAClD;gBACA,OAAO0D;YACT;YACA,IAAI,CAAClC,QAAQN,SAAS,OAAO;gBAAEhB,SAASF;YAA8B;YACtE,IAAI8C,OAAO,OAAO;gBAAE5C,SAAS4C,MAAMb,IAAI,CAAC7B,KAAK;YAAC;YAC9C,OAAOsD;QACT;QAEA,MAAMK,WAAW,IAAIC;QACrB,MAAMC,WAAkD,EAAE;QAC1D,IAAK,IAAIC,KAAK,GAAGA,KAAK/B,WAAWzB,MAAM,EAAEwD,MAAMjE,YAAa;YAC1D,MAAMkE,QAAQC,GAAG,CACfjC,WAAWkC,KAAK,CAACH,IAAIA,KAAKjE,aAAaW,GAAG,CAAC,OAAOT;gBAChD,MAAMmE,aAAa/B,SAASE,GAAG,CAACtC;gBAChC,IAAI;oBACF,MAAMoE,UAAU,MAAMnF,6BAA6B;wBAAEkF;wBAAYnB;wBAAQH;oBAAM;oBAC/E,IAAIuB,QAAQC,OAAO,KAAK,WAAW;wBACjCT,SAASU,GAAG,CAACtE,WAAWD,QAAQC,WAAW;oBAC7C,OAAO,IAAIoE,QAAQC,OAAO,KAAK,WAAW;wBACxCT,SAASU,GAAG,CAACtE,WAAWD,QAAQC,WAAWoE,QAAQnE,KAAK;oBAC1D,OAAO,IAAImE,QAAQC,OAAO,KAAK,YAAY;wBACzCP,SAASS,IAAI,CAACJ;wBACdP,SAASU,GAAG,CAACtE,WAAW;4BAAEA;4BAAWE,IAAI;4BAAMsE,SAAS;wBAAW;oBACrE,OAAO;wBACLZ,SAASU,GAAG,CAACtE,WAAW;4BAAEA;4BAAWE,IAAI;4BAAMsE,SAAS;wBAAU;oBACpE;gBACF,EAAE,OAAOvE,OAAO;oBACdwE,QAAQxE,KAAK,CAAC,mDAAmDD,WAAWC;oBAC5E2D,SAASU,GAAG,CAACtE,WAAWD,QAAQC,WAAW;gBAC7C;YACF;QAEJ;QACA,0EAA0E;QAC1E,4EAA4E;QAC5E,wEAAwE;QACxE,+CAA+C;QAC/C,IAAI8D,SAASvD,MAAM,EAAE;YACnB,MAAMrB,uBAAuB4E,UAAU,YAAYY,KAAK,CAAC,CAACzE;gBACxDwE,QAAQxE,KAAK,CAAC,sDAAsDA;YACtE;QACF;QAEA,MAAM0E,SAAgC;YACpCzE,IAAI;YACJ0E,SAAS5C,WAAWvB,GAAG,CACrB,CAACT;oBACC4D;wBAAAA,gBAAAA,SAASiB,GAAG,CAAC7E,sBAAb4D,gBAA2B7D,QAAQC,WAAW;;QAEpD;QACAyB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC8C;IACvB,EAAE,OAAO1E,OAAO;QACdwE,QAAQxE,KAAK,CAAC,+BAA+BA;QAC7CwB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE5B,OAAO;QAAqC;IACrE;AACF,EAAC"}
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/contact-remove.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * `POST /api/crm/contact-remove` — a holder lets contacts go, and a person's\n * \"no\" to marketing stays (AGL-3338).\n *\n * Body: `{ hostId, contactIds }` under a site, or `{ orgId, hostId?,\n * contactIds }` at the organization level. Answers `ContactRemoveResponse`:\n * one outcome per contact, in the order the ids were sent.\n *\n * ## Delete is a detach, and a refusal is not let go\n *\n * A contact is shared by every site that captured the person. Removing it\n * from one drops that holder's facet, consent grants, capture attribution\n * and scope tokens, and the document is deleted only when nobody else holds\n * it (`planContactDetach`). A refusal of marketing email is kept either way:\n * a detach leaves it on the document for the holders that remain, and the\n * last holder's delete copies every refusal into the organization's retained\n * store in the same transaction (`removeContactKeepingRefusals`). The list\n * gate reads both, so deleting a person is not a way to put somebody who\n * said no on a list.\n *\n * ## Why a route\n *\n * The decision has to be made against the document's consent map, which a\n * table row does not project, and it has to land in one commit with the\n * retained store, which no client may write. So the rules close a client's\n * update and delete of a contact, and the console's removals arrive here.\n *\n * ## Who may call it\n *\n * The CRM writer the other contact routes admit (`authorizeCrmWriter`),\n * whose access reaches the site under a site. Each contact must be one the\n * caller may read and, under a site, one the site's hub lists. Then, as the\n * rules asked before the route existed:\n *\n *  - a DELETE needs the caller's reach to cover every holder of the row, so\n *    a site collaborator cannot delete a person another site also holds;\n *  - a DETACH changes who a record is shared with, which only an org-wide\n *    member may do (`scopeUnchanged()` in the rules).\n *\n * ## The plan\n *\n * Letting a holder go is the CRM's \"Remove from this site\", included from\n * Starter (AGL-2851), so a detach is refused on a plan without the CRM. A\n * delete is not: removing a workspace's own record stays open on every plan.\n */\n\nimport {\n  consentGroupForHost,\n  CRM_COLLECTIONS,\n  crmReadTokens,\n  heldScopeTokens,\n  isOrgWideMember,\n  memberScopeTokens,\n  planContactDetach,\n  type PluginApiHandler,\n  seenOnlyThroughGrant,\n  visibleToTokens,\n} from '@aglyn/aglyn/server'\nimport {\n  firebaseAdmin,\n  removeContactKeepingRefusals,\n  restampCrmListFieldsOf,\n} from '@aglyn/tenant-data-admin'\nimport {\n  type ContactRemoveOutcome,\n  type ContactRemoveResponse,\n  CRM_CONTACT_REMOVE_MAX,\n} from '../model/contact-remove'\nimport { typed } from './contact-profile'\nimport { readCrmRouteScope } from './org-caller'\nimport { crmSuiteRefusal } from './suite-gate'\nimport { authorizeCrmWriter, canReach, type Writer } from './task-routes'\nimport { contactPrimaryGroup } from '../model/contact-holder'\nimport { sweepDealContactRoles } from './deal-contact-roles'\nimport { clearReportsToOf, contactFacetHolders } from './contact-reports-to'\n\n/** What the suite gate names for a detach on a plan without the CRM. */\nexport const CONTACT_DETACH_SUITE_ACT = 'Removing a contact from one site'\n\n/**\n * What a site is told for a contact it sees only because it was SHARED with\n * it (AGL-3336): it holds nothing there to let go of, and taking the share\n * away is a manager's unshare, not a removal.\n */\nexport const CONTACT_REMOVE_SHARED_REFUSAL =\n  'This contact was shared with this site by another site. An owner or ' +\n  'admin can stop sharing it from its Sharing card.'\n\n/** A contact read at the organization level that no site has captured. */\nexport const CONTACT_REMOVE_NO_HOLDER =\n  'No site holds this contact yet, so there is no site to remove it from.'\n\n/** What a site collaborator is told for a person another site also holds. */\nexport const CONTACT_REMOVE_SCOPED_REFUSAL =\n  'Other sites hold this contact too, and your access is limited to ' +\n  'specific sites. Ask an organization administrator to remove it.'\n\n/** How many contacts are removed at once — each in its own transaction. */\nconst CONCURRENCY = 20\n\nconst refused = (contactId: string, error: string): ContactRemoveOutcome => ({\n  contactId,\n  ok: false,\n  error,\n})\n\n/** The ids a body names, deduplicated — or `null` when any is unreadable or there are too many. */\nfunction readContactIds(value: unknown): string[] | null {\n  if (!Array.isArray(value) || !value.length || value.length > CRM_CONTACT_REMOVE_MAX) {\n    return null\n  }\n  const ids = value.map((id) => typed(id, 200))\n  if (ids.some((id) => !id || id.includes('/'))) return null\n  return [...new Set(ids)]\n}\n\n/** Under a site, whether the caller's access reaches it. */\nfunction reachesSite(writer: Writer, hostId: string): boolean {\n  return (\n    writer.staff ||\n    isOrgWideMember(writer.member) ||\n    Boolean((writer.member?.hostAccess as Record<string, unknown> | undefined)?.[hostId])\n  )\n}\n\n/** Whether the caller's reach is the whole organization. */\nconst orgWide = (writer: Writer): boolean =>\n  writer.staff || writer.level === 'org' || isOrgWideMember(writer.member)\n\nexport const crmContactRemoveHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  const body = (req.body ?? {}) as Record<string, unknown>\n  const scope = readCrmRouteScope(body)\n  if (!scope) {\n    res.status(400).json({ error: 'Missing hostId' })\n    return\n  }\n  const contactIds = readContactIds(body['contactIds'])\n  if (!contactIds) {\n    res.status(400).json({ error: `Name between 1 and ${CRM_CONTACT_REMOVE_MAX} contacts.` })\n    return\n  }\n\n  try {\n    const writer = await authorizeCrmWriter(req, scope, { suiteAct: null })\n    if (writer.ok === false) {\n      res.status(writer.status).json(writer.body)\n      return\n    }\n    if (scope.level === 'site' && !reachesSite(writer, scope.hostId)) {\n      res.status(403).json({ error: 'Your access to this organization does not reach this site.' })\n      return\n    }\n\n    const firestore = firebaseAdmin.app().firestore()\n    const contacts = firestore.collection('orgs').doc(writer.orgId).collection('contacts')\n    const siteGroup =\n      scope.level === 'site' ? consentGroupForHost(writer.org, scope.hostId) : null\n    const siteTokens = siteGroup ? crmReadTokens(siteGroup) : null\n    const suite = crmSuiteRefusal(writer.org, CONTACT_DETACH_SUITE_ACT)\n    const callerTokens = new Set<string>(memberScopeTokens(writer.member))\n    const nowMs = Date.now()\n\n    /*\n     * Decided inside each contact's transaction, against the document as it\n     * was read there: the reach, the holder letting go, and what that means.\n     */\n    const decide = (contact: Record<string, unknown>) => {\n      const visibleTo = contact['visibleTo'] as string[] | undefined\n      if (!canReach(writer, visibleTo)) return { refused: 'That contact is not visible to you.' }\n      if (siteTokens && !visibleToTokens(visibleTo, siteTokens)) {\n        return { refused: 'That contact is not visible to this site.' }\n      }\n      if (siteGroup && siteGroup.hostIds.every((hostId) => seenOnlyThroughGrant(contact, hostId))) {\n        return { refused: CONTACT_REMOVE_SHARED_REFUSAL }\n      }\n      const group = siteGroup ?? contactPrimaryGroup(contact, writer.org)\n      if (!group.groupId || !group.hostIds.length) return { refused: CONTACT_REMOVE_NO_HOLDER }\n      const plan = planContactDetach(contact, group)\n      if (plan.action === 'delete') {\n        // The HOLDERS: a site the contact was only shared with holds\n        // nothing, so it never stands between a holder and its delete.\n        const holders = heldScopeTokens(contact)\n        if (!orgWide(writer) && !holders.every((token) => callerTokens.has(token))) {\n          return { refused: CONTACT_REMOVE_SCOPED_REFUSAL }\n        }\n        return plan\n      }\n      if (!orgWide(writer)) return { refused: CONTACT_REMOVE_SCOPED_REFUSAL }\n      if (suite) return { refused: suite.body.error }\n      return plan\n    }\n\n    const outcomes = new Map<string, ContactRemoveOutcome>()\n    const detached: FirebaseFirestore.DocumentReference[] = []\n    /*\n     * The holders whose facets may point at each removed contact as their\n     * reports-to (AGL-3537), as decided: every holder of a deleted contact,\n     * and the one letting go of a detached one — which no longer holds the\n     * person it would point at.\n     */\n    const lettingGo = new Map<string, string[]>()\n    const deciding = (contactId: string) => (contact: Record<string, unknown>) => {\n      const decided = decide(contact)\n      if (!('refused' in decided)) {\n        lettingGo.set(\n          contactId,\n          decided.action === 'delete'\n            ? contactFacetHolders(contact)\n            : [(siteGroup ?? contactPrimaryGroup(contact, writer.org)).groupId],\n        )\n      }\n      return decided\n    }\n    for (let at = 0; at < contactIds.length; at += CONCURRENCY) {\n      await Promise.all(\n        contactIds.slice(at, at + CONCURRENCY).map(async (contactId) => {\n          const contactRef = contacts.doc(contactId)\n          try {\n            const removal = await removeContactKeepingRefusals({\n              contactRef,\n              decide: deciding(contactId),\n              nowMs,\n            })\n            if (removal.outcome === 'missing') {\n              outcomes.set(contactId, refused(contactId, 'That contact no longer exists.'))\n            } else if (removal.outcome === 'refused') {\n              outcomes.set(contactId, refused(contactId, removal.error))\n            } else if (removal.outcome === 'detached') {\n              detached.push(contactRef)\n              outcomes.set(contactId, { contactId, ok: true, removed: 'detached' })\n              // The holder letting go points at the person no more (AGL-3537).\n              await clearReportsToOf(firestore, contacts, lettingGo.get(contactId) ?? [], contactId)\n            } else {\n              outcomes.set(contactId, { contactId, ok: true, removed: 'deleted' })\n              // Nobody reports to a deleted person (AGL-3537)…\n              await clearReportsToOf(firestore, contacts, lettingGo.get(contactId) ?? [], contactId)\n              // …and they leave every deal's contact roles (AGL-3521).\n              await sweepDealContactRoles(\n                firestore,\n                firestore.collection('orgs').doc(writer.orgId).collection(CRM_COLLECTIONS.deals),\n                contactId,\n                null,\n                '[crm] contact-remove',\n              )\n            }\n          } catch (error) {\n            console.error('[crm] contact-remove could not remove a contact', contactId, error)\n            outcomes.set(contactId, refused(contactId, 'The contact could not be removed.'))\n          }\n        }),\n      )\n    }\n    // A detached row still carries the facet keys and scoped search tokens of\n    // the holder that let it go, which the Contacts list filters by (AGL-3321).\n    // Its own catch: the contacts are removed by now, and a list stamp that\n    // could not move is not a removal that failed.\n    if (detached.length) {\n      await restampCrmListFieldsOf(detached, 'contacts').catch((error: unknown) => {\n        console.error('[crm] contact-remove could not restamp list fields', error)\n      })\n    }\n\n    const answer: ContactRemoveResponse = {\n      ok: true,\n      results: contactIds.map(\n        (contactId) =>\n          outcomes.get(contactId) ?? refused(contactId, 'The contact could not be removed.'),\n      ),\n    }\n    res.status(200).json(answer)\n  } catch (error) {\n    console.error('[crm] contact-remove failed', error)\n    res.status(500).json({ error: 'The contacts could not be removed.' })\n  }\n}\n"],"names":["consentGroupForHost","CRM_COLLECTIONS","crmReadTokens","heldScopeTokens","isOrgWideMember","memberScopeTokens","planContactDetach","seenOnlyThroughGrant","visibleToTokens","firebaseAdmin","removeContactKeepingRefusals","restampCrmListFieldsOf","CRM_CONTACT_REMOVE_MAX","typed","readCrmRouteScope","crmSuiteRefusal","authorizeCrmWriter","canReach","contactPrimaryGroup","sweepDealContactRoles","clearReportsToOf","contactFacetHolders","CONTACT_DETACH_SUITE_ACT","CONTACT_REMOVE_SHARED_REFUSAL","CONTACT_REMOVE_NO_HOLDER","CONTACT_REMOVE_SCOPED_REFUSAL","CONCURRENCY","refused","contactId","error","ok","readContactIds","value","Array","isArray","length","ids","map","id","some","includes","Set","reachesSite","writer","hostId","staff","member","Boolean","hostAccess","orgWide","level","crmContactRemoveHandler","req","res","method","setHeader","status","json","body","scope","contactIds","suiteAct","firestore","app","contacts","collection","doc","orgId","siteGroup","org","siteTokens","suite","callerTokens","nowMs","Date","now","decide","contact","visibleTo","hostIds","every","group","groupId","plan","action","holders","token","has","outcomes","Map","detached","lettingGo","deciding","decided","set","at","Promise","all","slice","contactRef","removal","outcome","push","removed","get","deals","console","catch","answer","results"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CC,GAED,SACEA,mBAAmB,EACnBC,eAAe,EACfC,aAAa,EACbC,eAAe,EACfC,eAAe,EACfC,iBAAiB,EACjBC,iBAAiB,EAEjBC,oBAAoB,EACpBC,eAAe,QACV,sBAAqB;AAC5B,SACEC,aAAa,EACbC,4BAA4B,EAC5BC,sBAAsB,QACjB,2BAA0B;AACjC,SAGEC,sBAAsB,QACjB,6BAAyB;AAChC,SAASC,KAAK,QAAQ,uBAAmB;AACzC,SAASC,iBAAiB,QAAQ,kBAAc;AAChD,SAASC,eAAe,QAAQ,kBAAc;AAC9C,SAASC,kBAAkB,EAAEC,QAAQ,QAAqB,mBAAe;AACzE,SAASC,mBAAmB,QAAQ,6BAAyB;AAC7D,SAASC,qBAAqB,QAAQ,0BAAsB;AAC5D,SAASC,gBAAgB,EAAEC,mBAAmB,QAAQ,0BAAsB;AAE5E,sEAAsE,GACtE,OAAO,MAAMC,2BAA2B,mCAAkC;AAE1E;;;;CAIC,GACD,OAAO,MAAMC,gCACX,yEACA,mDAAkD;AAEpD,wEAAwE,GACxE,OAAO,MAAMC,2BACX,yEAAwE;AAE1E,2EAA2E,GAC3E,OAAO,MAAMC,gCACX,sEACA,kEAAiE;AAEnE,yEAAyE,GACzE,MAAMC,cAAc;AAEpB,MAAMC,UAAU,CAACC,WAAmBC,QAAyC,CAAA;QAC3ED;QACAE,IAAI;QACJD;IACF,CAAA;AAEA,iGAAiG,GACjG,SAASE,eAAeC,KAAc;IACpC,IAAI,CAACC,MAAMC,OAAO,CAACF,UAAU,CAACA,MAAMG,MAAM,IAAIH,MAAMG,MAAM,GAAGvB,wBAAwB;QACnF,OAAO;IACT;IACA,MAAMwB,MAAMJ,MAAMK,GAAG,CAAC,CAACC,KAAOzB,MAAMyB,IAAI;IACxC,IAAIF,IAAIG,IAAI,CAAC,CAACD,KAAO,CAACA,MAAMA,GAAGE,QAAQ,CAAC,OAAO,OAAO;IACtD,OAAO;WAAI,IAAIC,IAAIL;KAAK;AAC1B;AAEA,0DAA0D,GAC1D,SAASM,YAAYC,MAAc,EAAEC,MAAc;QAItCD,2BAAAA;IAHX,OACEA,OAAOE,KAAK,IACZzC,gBAAgBuC,OAAOG,MAAM,KAC7BC,SAASJ,iBAAAA,OAAOG,MAAM,sBAAbH,4BAAAA,eAAeK,UAAU,qBAA1B,AAACL,yBAAmE,CAACC,OAAO;AAExF;AAEA,0DAA0D,GAC1D,MAAMK,UAAU,CAACN,SACfA,OAAOE,KAAK,IAAIF,OAAOO,KAAK,KAAK,SAAS9C,gBAAgBuC,OAAOG,MAAM;AAEzE,OAAO,MAAMK,0BAA4C,OAAOC,KAAKC;QAMrDD;IALd,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE5B,OAAO;QAAqB;QACnD;IACF;IACA,MAAM6B,QAAQN,YAAAA,IAAIM,IAAI,YAARN,YAAY,CAAC;IAC3B,MAAMO,QAAQ7C,kBAAkB4C;IAChC,IAAI,CAACC,OAAO;QACVN,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE5B,OAAO;QAAiB;QAC/C;IACF;IACA,MAAM+B,aAAa7B,eAAe2B,IAAI,CAAC,aAAa;IACpD,IAAI,CAACE,YAAY;QACfP,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE5B,OAAO,CAAC,mBAAmB,EAAEjB,uBAAuB,UAAU,CAAC;QAAC;QACvF;IACF;IAEA,IAAI;QACF,MAAM+B,SAAS,MAAM3B,mBAAmBoC,KAAKO,OAAO;YAAEE,UAAU;QAAK;QACrE,IAAIlB,OAAOb,EAAE,KAAK,OAAO;YACvBuB,IAAIG,MAAM,CAACb,OAAOa,MAAM,EAAEC,IAAI,CAACd,OAAOe,IAAI;YAC1C;QACF;QACA,IAAIC,MAAMT,KAAK,KAAK,UAAU,CAACR,YAAYC,QAAQgB,MAAMf,MAAM,GAAG;YAChES,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAE5B,OAAO;YAA6D;YAC3F;QACF;QAEA,MAAMiC,YAAYrD,cAAcsD,GAAG,GAAGD,SAAS;QAC/C,MAAME,WAAWF,UAAUG,UAAU,CAAC,QAAQC,GAAG,CAACvB,OAAOwB,KAAK,EAAEF,UAAU,CAAC;QAC3E,MAAMG,YACJT,MAAMT,KAAK,KAAK,SAASlD,oBAAoB2C,OAAO0B,GAAG,EAAEV,MAAMf,MAAM,IAAI;QAC3E,MAAM0B,aAAaF,YAAYlE,cAAckE,aAAa;QAC1D,MAAMG,QAAQxD,gBAAgB4B,OAAO0B,GAAG,EAAE/C;QAC1C,MAAMkD,eAAe,IAAI/B,IAAYpC,kBAAkBsC,OAAOG,MAAM;QACpE,MAAM2B,QAAQC,KAAKC,GAAG;QAEtB;;;KAGC,GACD,MAAMC,SAAS,CAACC;YACd,MAAMC,YAAYD,OAAO,CAAC,YAAY;YACtC,IAAI,CAAC5D,SAAS0B,QAAQmC,YAAY,OAAO;gBAAEnD,SAAS;YAAsC;YAC1F,IAAI2C,cAAc,CAAC9D,gBAAgBsE,WAAWR,aAAa;gBACzD,OAAO;oBAAE3C,SAAS;gBAA4C;YAChE;YACA,IAAIyC,aAAaA,UAAUW,OAAO,CAACC,KAAK,CAAC,CAACpC,SAAWrC,qBAAqBsE,SAASjC,UAAU;gBAC3F,OAAO;oBAAEjB,SAASJ;gBAA8B;YAClD;YACA,MAAM0D,QAAQb,oBAAAA,YAAalD,oBAAoB2D,SAASlC,OAAO0B,GAAG;YAClE,IAAI,CAACY,MAAMC,OAAO,IAAI,CAACD,MAAMF,OAAO,CAAC5C,MAAM,EAAE,OAAO;gBAAER,SAASH;YAAyB;YACxF,MAAM2D,OAAO7E,kBAAkBuE,SAASI;YACxC,IAAIE,KAAKC,MAAM,KAAK,UAAU;gBAC5B,6DAA6D;gBAC7D,+DAA+D;gBAC/D,MAAMC,UAAUlF,gBAAgB0E;gBAChC,IAAI,CAAC5B,QAAQN,WAAW,CAAC0C,QAAQL,KAAK,CAAC,CAACM,QAAUd,aAAae,GAAG,CAACD,SAAS;oBAC1E,OAAO;wBAAE3D,SAASF;oBAA8B;gBAClD;gBACA,OAAO0D;YACT;YACA,IAAI,CAAClC,QAAQN,SAAS,OAAO;gBAAEhB,SAASF;YAA8B;YACtE,IAAI8C,OAAO,OAAO;gBAAE5C,SAAS4C,MAAMb,IAAI,CAAC7B,KAAK;YAAC;YAC9C,OAAOsD;QACT;QAEA,MAAMK,WAAW,IAAIC;QACrB,MAAMC,WAAkD,EAAE;QAC1D;;;;;KAKC,GACD,MAAMC,YAAY,IAAIF;QACtB,MAAMG,WAAW,CAAChE,YAAsB,CAACiD;gBACvC,MAAMgB,UAAUjB,OAAOC;gBACvB,IAAI,CAAE,CAAA,aAAagB,OAAM,GAAI;oBAC3BF,UAAUG,GAAG,CACXlE,WACAiE,QAAQT,MAAM,KAAK,WACf/D,oBAAoBwD,WACpB;wBAAC,CAACT,oBAAAA,YAAalD,oBAAoB2D,SAASlC,OAAO0B,GAAG,GAAGa,OAAO;qBAAC;gBAEzE;gBACA,OAAOW;YACT;QACA,IAAK,IAAIE,KAAK,GAAGA,KAAKnC,WAAWzB,MAAM,EAAE4D,MAAMrE,YAAa;YAC1D,MAAMsE,QAAQC,GAAG,CACfrC,WAAWsC,KAAK,CAACH,IAAIA,KAAKrE,aAAaW,GAAG,CAAC,OAAOT;gBAChD,MAAMuE,aAAanC,SAASE,GAAG,CAACtC;gBAChC,IAAI;oBACF,MAAMwE,UAAU,MAAM1F,6BAA6B;wBACjDyF;wBACAvB,QAAQgB,SAAShE;wBACjB6C;oBACF;oBACA,IAAI2B,QAAQC,OAAO,KAAK,WAAW;wBACjCb,SAASM,GAAG,CAAClE,WAAWD,QAAQC,WAAW;oBAC7C,OAAO,IAAIwE,QAAQC,OAAO,KAAK,WAAW;wBACxCb,SAASM,GAAG,CAAClE,WAAWD,QAAQC,WAAWwE,QAAQvE,KAAK;oBAC1D,OAAO,IAAIuE,QAAQC,OAAO,KAAK,YAAY;4BAIGV;wBAH5CD,SAASY,IAAI,CAACH;wBACdX,SAASM,GAAG,CAAClE,WAAW;4BAAEA;4BAAWE,IAAI;4BAAMyE,SAAS;wBAAW;wBACnE,iEAAiE;wBACjE,MAAMnF,iBAAiB0C,WAAWE,WAAU2B,iBAAAA,UAAUa,GAAG,CAAC5E,sBAAd+D,iBAA4B,EAAE,EAAE/D;oBAC9E,OAAO;4BAGuC+D;wBAF5CH,SAASM,GAAG,CAAClE,WAAW;4BAAEA;4BAAWE,IAAI;4BAAMyE,SAAS;wBAAU;wBAClE,iDAAiD;wBACjD,MAAMnF,iBAAiB0C,WAAWE,WAAU2B,kBAAAA,UAAUa,GAAG,CAAC5E,sBAAd+D,kBAA4B,EAAE,EAAE/D;wBAC5E,yDAAyD;wBACzD,MAAMT,sBACJ2C,WACAA,UAAUG,UAAU,CAAC,QAAQC,GAAG,CAACvB,OAAOwB,KAAK,EAAEF,UAAU,CAAChE,gBAAgBwG,KAAK,GAC/E7E,WACA,MACA;oBAEJ;gBACF,EAAE,OAAOC,OAAO;oBACd6E,QAAQ7E,KAAK,CAAC,mDAAmDD,WAAWC;oBAC5E2D,SAASM,GAAG,CAAClE,WAAWD,QAAQC,WAAW;gBAC7C;YACF;QAEJ;QACA,0EAA0E;QAC1E,4EAA4E;QAC5E,wEAAwE;QACxE,+CAA+C;QAC/C,IAAI8D,SAASvD,MAAM,EAAE;YACnB,MAAMxB,uBAAuB+E,UAAU,YAAYiB,KAAK,CAAC,CAAC9E;gBACxD6E,QAAQ7E,KAAK,CAAC,sDAAsDA;YACtE;QACF;QAEA,MAAM+E,SAAgC;YACpC9E,IAAI;YACJ+E,SAASjD,WAAWvB,GAAG,CACrB,CAACT;oBACC4D;wBAAAA,gBAAAA,SAASgB,GAAG,CAAC5E,sBAAb4D,gBAA2B7D,QAAQC,WAAW;;QAEpD;QACAyB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAACmD;IACvB,EAAE,OAAO/E,OAAO;QACd6E,QAAQ7E,KAAK,CAAC,+BAA+BA;QAC7CwB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE5B,OAAO;QAAqC;IACrE;AACF,EAAC"}

package/src/lib/server/contact-reports-to.d.ts

@@ -0,0 +1,61 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * A CONTACT'S REPORTS-TO (AGL-3515): Salesforce's Reports To, the person's
+ * manager, as another contact's id in the holder's facet.
+ *
+ * The pointer is per holder like the rest of the profile, so a chain is
+ * walked through ONE holder's facets: who reports to whom is one business's
+ * knowledge of an org chart, and another holder's guess at it is not part
+ * of this one's chain.
+ */
+/** The longest chain a loop check walks — far past any real org chart. */
+export declare const CONTACT_REPORTS_TO_DEPTH = 25;
+export declare const CONTACT_REPORTS_TO_SELF_REFUSAL = "A contact cannot report to themselves.";
+export declare const CONTACT_REPORTS_TO_LOOP_REFUSAL = "That would make a loop: the person picked already reports, through others, to this contact.";
+/** A contact document by id, or `null` when there is none. */
+export type ContactReader = (contactId: string) => Promise<Record<string, unknown> | null>;
+/**
+ * Whether making `contactId` report to `managerId` closes a loop: the
+ * manager's own chain, through `groupId`'s facets, reaches `contactId`.
+ * A chain longer than {@link CONTACT_REPORTS_TO_DEPTH} is treated as a loop,
+ * because a walk that cannot finish cannot prove there is none.
+ */
+export declare function contactReportsToLoops(read: ContactReader, contactId: string, managerId: string, groupId: string): Promise<boolean>;
+/** A reader over one org's contacts that reads each document once. */
+export declare function cachedContactReader(contacts: FirebaseFirestore.CollectionReference): ContactReader;
+/**
+ * Every contact that reports to `from`, in any of `groupIds`' facets,
+ * pointed at `to` — or, with `to` null, cleared. A contact that would
+ * then report to itself is cleared instead. Answers how many pointers moved.
+ *
+ * Queried per holder, because the pointer lives at
+ * `facets.{groupId}.reportsToContactId` and a query names one path. Each
+ * failure is logged and the sweep goes on: a stale pointer is read as
+ * "nobody" by every surface, which is the safe way for one to be left.
+ */
+export declare function repointContactReportsTo(firestore: FirebaseFirestore.Firestore, contacts: FirebaseFirestore.CollectionReference, groupIds: Iterable<string>, from: string, to: string | null, label: string): Promise<number>;
+/** The holders a contact document carries a facet for — every facet a pointer at it can sit in. */
+export declare function contactFacetHolders(contact: Record<string, unknown>): string[];
+/**
+ * Every reports-to in `groupIds`' facets that names `contactId`, cleared —
+ * a contact deleted, or let go by those holders (AGL-3537). A holder can
+ * point only at a contact it holds, so the holders of the removed record
+ * are every facet a pointer can sit in; the sweep is `repointContactReportsTo`
+ * to nobody, which logs a failure and goes on rather than failing the removal.
+ */
+export declare function clearReportsToOf(firestore: FirebaseFirestore.Firestore, contacts: FirebaseFirestore.CollectionReference, groupIds: Iterable<string>, contactId: string): Promise<number>;

package/src/lib/server/contact-reports-to.js

@@ -0,0 +1,114 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { CONTACT_FACETS_FIELD, contactFacetPath, readContactFacet } from "@aglyn/aglyn/app-utils/contacts";
+import { FieldValue } from "firebase-admin/firestore";
+/**
+ * A CONTACT'S REPORTS-TO (AGL-3515): Salesforce's Reports To, the person's
+ * manager, as another contact's id in the holder's facet.
+ *
+ * The pointer is per holder like the rest of the profile, so a chain is
+ * walked through ONE holder's facets: who reports to whom is one business's
+ * knowledge of an org chart, and another holder's guess at it is not part
+ * of this one's chain.
+ */ /** The longest chain a loop check walks — far past any real org chart. */ export const CONTACT_REPORTS_TO_DEPTH = 25;
+export const CONTACT_REPORTS_TO_SELF_REFUSAL = 'A contact cannot report to themselves.';
+export const CONTACT_REPORTS_TO_LOOP_REFUSAL = 'That would make a loop: the person picked already reports, through others, to this contact.';
+/**
+ * Whether making `contactId` report to `managerId` closes a loop: the
+ * manager's own chain, through `groupId`'s facets, reaches `contactId`.
+ * A chain longer than {@link CONTACT_REPORTS_TO_DEPTH} is treated as a loop,
+ * because a walk that cannot finish cannot prove there is none.
+ */ export async function contactReportsToLoops(read, contactId, managerId, groupId) {
+    let current = managerId;
+    const seen = new Set();
+    for(let step = 0; current && step < CONTACT_REPORTS_TO_DEPTH; step += 1){
+        if (current === contactId) return true;
+        // A loop above the contact that does not pass through it is someone
+        // else's to untangle, and does not stop this write.
+        if (seen.has(current)) return false;
+        seen.add(current);
+        const doc = await read(current);
+        if (!doc) return false;
+        current = readContactFacet(doc, groupId).reportsToContactId || undefined;
+    }
+    return Boolean(current);
+}
+/** A reader over one org's contacts that reads each document once. */ export function cachedContactReader(contacts) {
+    const cache = new Map();
+    return (contactId)=>{
+        let pending = cache.get(contactId);
+        if (!pending) {
+            pending = contacts.doc(contactId).get().then((snapshot)=>{
+                var _snapshot_data;
+                return snapshot.exists ? (_snapshot_data = snapshot.data()) != null ? _snapshot_data : {} : null;
+            });
+            cache.set(contactId, pending);
+        }
+        return pending;
+    };
+}
+/** How many pointing rows one pass reads and one batch writes. */ const PAGE = 400;
+/** A ceiling on passes per holder. */ const PASSES = 25;
+/**
+ * Every contact that reports to `from`, in any of `groupIds`' facets,
+ * pointed at `to` — or, with `to` null, cleared. A contact that would
+ * then report to itself is cleared instead. Answers how many pointers moved.
+ *
+ * Queried per holder, because the pointer lives at
+ * `facets.{groupId}.reportsToContactId` and a query names one path. Each
+ * failure is logged and the sweep goes on: a stale pointer is read as
+ * "nobody" by every surface, which is the safe way for one to be left.
+ */ export async function repointContactReportsTo(firestore, contacts, groupIds, from, to, label) {
+    let moved = 0;
+    for (const groupId of new Set(groupIds)){
+        if (!groupId) continue;
+        const path = contactFacetPath(groupId, 'reportsToContactId');
+        try {
+            for(let pass = 0; pass < PASSES; pass += 1){
+                const page = await contacts.where(path, '==', from).limit(PAGE).get();
+                if (page.empty) break;
+                const batch = firestore.batch();
+                for (const row of page.docs){
+                    batch.update(row.ref, {
+                        [path]: to && row.id !== to ? to : FieldValue.delete(),
+                        updatedAt: FieldValue.serverTimestamp()
+                    });
+                }
+                await batch.commit();
+                moved += page.size;
+                if (page.size < PAGE) break;
+            }
+        } catch (error) {
+            console.error(`${label}: reports-to sweep failed for a holder`, error);
+        }
+    }
+    return moved;
+}
+/** The holders a contact document carries a facet for — every facet a pointer at it can sit in. */ export function contactFacetHolders(contact) {
+    const facets = contact[CONTACT_FACETS_FIELD];
+    return facets && typeof facets === 'object' && !Array.isArray(facets) ? Object.keys(facets) : [];
+}
+/**
+ * Every reports-to in `groupIds`' facets that names `contactId`, cleared —
+ * a contact deleted, or let go by those holders (AGL-3537). A holder can
+ * point only at a contact it holds, so the holders of the removed record
+ * are every facet a pointer can sit in; the sweep is `repointContactReportsTo`
+ * to nobody, which logs a failure and goes on rather than failing the removal.
+ */ export function clearReportsToOf(firestore, contacts, groupIds, contactId) {
+    return repointContactReportsTo(firestore, contacts, groupIds, contactId, null, 'contact delete');
+}
+
+//# sourceMappingURL=contact-reports-to.js.map

package/src/lib/server/contact-reports-to.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/contact-reports-to.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  CONTACT_FACETS_FIELD,\n  contactFacetPath,\n  readContactFacet,\n} from '@aglyn/aglyn/app-utils/contacts'\nimport { FieldValue } from 'firebase-admin/firestore'\n\n/**\n * A CONTACT'S REPORTS-TO (AGL-3515): Salesforce's Reports To, the person's\n * manager, as another contact's id in the holder's facet.\n *\n * The pointer is per holder like the rest of the profile, so a chain is\n * walked through ONE holder's facets: who reports to whom is one business's\n * knowledge of an org chart, and another holder's guess at it is not part\n * of this one's chain.\n */\n\n/** The longest chain a loop check walks — far past any real org chart. */\nexport const CONTACT_REPORTS_TO_DEPTH = 25\n\nexport const CONTACT_REPORTS_TO_SELF_REFUSAL = 'A contact cannot report to themselves.'\n\nexport const CONTACT_REPORTS_TO_LOOP_REFUSAL =\n  'That would make a loop: the person picked already reports, through others, to this contact.'\n\n/** A contact document by id, or `null` when there is none. */\nexport type ContactReader = (contactId: string) => Promise<Record<string, unknown> | null>\n\n/**\n * Whether making `contactId` report to `managerId` closes a loop: the\n * manager's own chain, through `groupId`'s facets, reaches `contactId`.\n * A chain longer than {@link CONTACT_REPORTS_TO_DEPTH} is treated as a loop,\n * because a walk that cannot finish cannot prove there is none.\n */\nexport async function contactReportsToLoops(\n  read: ContactReader,\n  contactId: string,\n  managerId: string,\n  groupId: string,\n): Promise<boolean> {\n  let current: string | undefined = managerId\n  const seen = new Set<string>()\n  for (let step = 0; current && step < CONTACT_REPORTS_TO_DEPTH; step += 1) {\n    if (current === contactId) return true\n    // A loop above the contact that does not pass through it is someone\n    // else's to untangle, and does not stop this write.\n    if (seen.has(current)) return false\n    seen.add(current)\n    const doc = await read(current)\n    if (!doc) return false\n    current = readContactFacet(doc, groupId).reportsToContactId || undefined\n  }\n  return Boolean(current)\n}\n\n/** A reader over one org's contacts that reads each document once. */\nexport function cachedContactReader(\n  contacts: FirebaseFirestore.CollectionReference,\n): ContactReader {\n  const cache = new Map<string, Promise<Record<string, unknown> | null>>()\n  return (contactId) => {\n    let pending = cache.get(contactId)\n    if (!pending) {\n      pending = contacts\n        .doc(contactId)\n        .get()\n        .then((snapshot) =>\n          snapshot.exists ? ((snapshot.data() ?? {}) as Record<string, unknown>) : null,\n        )\n      cache.set(contactId, pending)\n    }\n    return pending\n  }\n}\n\n/** How many pointing rows one pass reads and one batch writes. */\nconst PAGE = 400\n/** A ceiling on passes per holder. */\nconst PASSES = 25\n\n/**\n * Every contact that reports to `from`, in any of `groupIds`' facets,\n * pointed at `to` — or, with `to` null, cleared. A contact that would\n * then report to itself is cleared instead. Answers how many pointers moved.\n *\n * Queried per holder, because the pointer lives at\n * `facets.{groupId}.reportsToContactId` and a query names one path. Each\n * failure is logged and the sweep goes on: a stale pointer is read as\n * \"nobody\" by every surface, which is the safe way for one to be left.\n */\nexport async function repointContactReportsTo(\n  firestore: FirebaseFirestore.Firestore,\n  contacts: FirebaseFirestore.CollectionReference,\n  groupIds: Iterable<string>,\n  from: string,\n  to: string | null,\n  label: string,\n): Promise<number> {\n  let moved = 0\n  for (const groupId of new Set(groupIds)) {\n    if (!groupId) continue\n    const path = contactFacetPath(groupId, 'reportsToContactId')\n    try {\n      for (let pass = 0; pass < PASSES; pass += 1) {\n        const page = await contacts.where(path, '==', from).limit(PAGE).get()\n        if (page.empty) break\n        const batch = firestore.batch()\n        for (const row of page.docs) {\n          batch.update(row.ref, {\n            [path]: to && row.id !== to ? to : FieldValue.delete(),\n            updatedAt: FieldValue.serverTimestamp(),\n          })\n        }\n        await batch.commit()\n        moved += page.size\n        if (page.size < PAGE) break\n      }\n    } catch (error) {\n      console.error(`${label}: reports-to sweep failed for a holder`, error)\n    }\n  }\n  return moved\n}\n\n/** The holders a contact document carries a facet for — every facet a pointer at it can sit in. */\nexport function contactFacetHolders(contact: Record<string, unknown>): string[] {\n  const facets = contact[CONTACT_FACETS_FIELD]\n  return facets && typeof facets === 'object' && !Array.isArray(facets) ? Object.keys(facets) : []\n}\n\n/**\n * Every reports-to in `groupIds`' facets that names `contactId`, cleared —\n * a contact deleted, or let go by those holders (AGL-3537). A holder can\n * point only at a contact it holds, so the holders of the removed record\n * are every facet a pointer can sit in; the sweep is `repointContactReportsTo`\n * to nobody, which logs a failure and goes on rather than failing the removal.\n */\nexport function clearReportsToOf(\n  firestore: FirebaseFirestore.Firestore,\n  contacts: FirebaseFirestore.CollectionReference,\n  groupIds: Iterable<string>,\n  contactId: string,\n): Promise<number> {\n  return repointContactReportsTo(firestore, contacts, groupIds, contactId, null, 'contact delete')\n}\n"],"names":["CONTACT_FACETS_FIELD","contactFacetPath","readContactFacet","FieldValue","CONTACT_REPORTS_TO_DEPTH","CONTACT_REPORTS_TO_SELF_REFUSAL","CONTACT_REPORTS_TO_LOOP_REFUSAL","contactReportsToLoops","read","contactId","managerId","groupId","current","seen","Set","step","has","add","doc","reportsToContactId","undefined","Boolean","cachedContactReader","contacts","cache","Map","pending","get","then","snapshot","exists","data","set","PAGE","PASSES","repointContactReportsTo","firestore","groupIds","from","to","label","moved","path","pass","page","where","limit","empty","batch","row","docs","update","ref","id","delete","updatedAt","serverTimestamp","commit","size","error","console","contactFacetHolders","contact","facets","Array","isArray","Object","keys","clearReportsToOf"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,oBAAoB,EACpBC,gBAAgB,EAChBC,gBAAgB,QACX,kCAAiC;AACxC,SAASC,UAAU,QAAQ,2BAA0B;AAErD;;;;;;;;CAQC,GAED,wEAAwE,GACxE,OAAO,MAAMC,2BAA2B,GAAE;AAE1C,OAAO,MAAMC,kCAAkC,yCAAwC;AAEvF,OAAO,MAAMC,kCACX,8FAA6F;AAK/F;;;;;CAKC,GACD,OAAO,eAAeC,sBACpBC,IAAmB,EACnBC,SAAiB,EACjBC,SAAiB,EACjBC,OAAe;IAEf,IAAIC,UAA8BF;IAClC,MAAMG,OAAO,IAAIC;IACjB,IAAK,IAAIC,OAAO,GAAGH,WAAWG,OAAOX,0BAA0BW,QAAQ,EAAG;QACxE,IAAIH,YAAYH,WAAW,OAAO;QAClC,oEAAoE;QACpE,oDAAoD;QACpD,IAAII,KAAKG,GAAG,CAACJ,UAAU,OAAO;QAC9BC,KAAKI,GAAG,CAACL;QACT,MAAMM,MAAM,MAAMV,KAAKI;QACvB,IAAI,CAACM,KAAK,OAAO;QACjBN,UAAUV,iBAAiBgB,KAAKP,SAASQ,kBAAkB,IAAIC;IACjE;IACA,OAAOC,QAAQT;AACjB;AAEA,oEAAoE,GACpE,OAAO,SAASU,oBACdC,QAA+C;IAE/C,MAAMC,QAAQ,IAAIC;IAClB,OAAO,CAAChB;QACN,IAAIiB,UAAUF,MAAMG,GAAG,CAAClB;QACxB,IAAI,CAACiB,SAAS;YACZA,UAAUH,SACPL,GAAG,CAACT,WACJkB,GAAG,GACHC,IAAI,CAAC,CAACC;oBACeA;uBAApBA,SAASC,MAAM,IAAKD,iBAAAA,SAASE,IAAI,cAAbF,iBAAmB,CAAC,IAAiC;;YAE7EL,MAAMQ,GAAG,CAACvB,WAAWiB;QACvB;QACA,OAAOA;IACT;AACF;AAEA,gEAAgE,GAChE,MAAMO,OAAO;AACb,oCAAoC,GACpC,MAAMC,SAAS;AAEf;;;;;;;;;CASC,GACD,OAAO,eAAeC,wBACpBC,SAAsC,EACtCb,QAA+C,EAC/Cc,QAA0B,EAC1BC,IAAY,EACZC,EAAiB,EACjBC,KAAa;IAEb,IAAIC,QAAQ;IACZ,KAAK,MAAM9B,WAAW,IAAIG,IAAIuB,UAAW;QACvC,IAAI,CAAC1B,SAAS;QACd,MAAM+B,OAAOzC,iBAAiBU,SAAS;QACvC,IAAI;YACF,IAAK,IAAIgC,OAAO,GAAGA,OAAOT,QAAQS,QAAQ,EAAG;gBAC3C,MAAMC,OAAO,MAAMrB,SAASsB,KAAK,CAACH,MAAM,MAAMJ,MAAMQ,KAAK,CAACb,MAAMN,GAAG;gBACnE,IAAIiB,KAAKG,KAAK,EAAE;gBAChB,MAAMC,QAAQZ,UAAUY,KAAK;gBAC7B,KAAK,MAAMC,OAAOL,KAAKM,IAAI,CAAE;oBAC3BF,MAAMG,MAAM,CAACF,IAAIG,GAAG,EAAE;wBACpB,CAACV,KAAK,EAAEH,MAAMU,IAAII,EAAE,KAAKd,KAAKA,KAAKpC,WAAWmD,MAAM;wBACpDC,WAAWpD,WAAWqD,eAAe;oBACvC;gBACF;gBACA,MAAMR,MAAMS,MAAM;gBAClBhB,SAASG,KAAKc,IAAI;gBAClB,IAAId,KAAKc,IAAI,GAAGzB,MAAM;YACxB;QACF,EAAE,OAAO0B,OAAO;YACdC,QAAQD,KAAK,CAAC,GAAGnB,MAAM,sCAAsC,CAAC,EAAEmB;QAClE;IACF;IACA,OAAOlB;AACT;AAEA,iGAAiG,GACjG,OAAO,SAASoB,oBAAoBC,OAAgC;IAClE,MAAMC,SAASD,OAAO,CAAC9D,qBAAqB;IAC5C,OAAO+D,UAAU,OAAOA,WAAW,YAAY,CAACC,MAAMC,OAAO,CAACF,UAAUG,OAAOC,IAAI,CAACJ,UAAU,EAAE;AAClG;AAEA;;;;;;CAMC,GACD,OAAO,SAASK,iBACdhC,SAAsC,EACtCb,QAA+C,EAC/Cc,QAA0B,EAC1B5B,SAAiB;IAEjB,OAAO0B,wBAAwBC,WAAWb,UAAUc,UAAU5B,WAAW,MAAM;AACjF"}

package/src/lib/server/contact-update.d.ts

@@ -69,8 +69,10 @@
  * company deleted in between cannot fail the save of the people at it — the
  * company page's live aggregate is what corrects a count that did not move.
  */
-import { type PluginApiHandler } from '@aglyn/aglyn/server';
+import { type ContactCompanyLinkPlan, type ContactCustomValue, type PluginApiHandler } from '@aglyn/aglyn/server';
 import { type ContactUpdateFields } from '../model/contact-update';
+/** The sentence a `name` that contradicts the holder's first and last names is refused with. */
+export declare const CONTACT_COMPOSED_NAME_REFUSAL = "This person's name is made of their first and last name \u2014 change those instead.";
 /**
  * The act a request is refused for on a plan without the CRM: the first
  * field it carries, in the order the route reads them. Every field is the
@@ -89,4 +91,43 @@ export declare function readContactUpdateFields(input: unknown): {
     ok: false;
     error: string;
 };
+/**
+ * Salesforce's standard contact fields (AGL-3515) a create may carry beside
+ * the identity — every one `upsertHostContact` writes into the capturing
+ * facet. The reports-to is not one: it names another record, which only
+ * this route checks the holder can see.
+ */
+export declare const CONTACT_CREATE_PROFILE_FIELDS: readonly ["salutation", "firstName", "lastName", "department", "mobilePhone", "homePhone", "otherPhone", "fax", "birthdate", "assistantName", "assistantPhone", "otherAddress", "doNotCall"];
+/**
+ * Those fields of a create's body, read by the same rules an update reads
+ * them with — or the sentence refusing one. A body naming none of them
+ * reads as no fields.
+ */
+export declare function readContactCreateProfile(body: Record<string, unknown>): {
+    ok: true;
+    fields: ContactUpdateFields;
+} | {
+    ok: false;
+    error: string;
+};
+/** One contact's planned write, and the company counts it moves. */
+export interface ContactWrite {
+    contactId: string;
+    ref: FirebaseFirestore.DocumentReference;
+    update: Record<string, unknown>;
+    counts: ContactCompanyLinkPlan['counts'];
+}
+/**
+ * One contact's update for one holder, or the sentence refusing the row.
+ * `update` is `null` when the document already says everything asked — a tag
+ * the row already carries, a link already made.
+ */
+export declare function contactPatch(contact: Record<string, unknown>, groupId: string, fields: ContactUpdateFields, custom: Record<string, ContactCustomValue> | undefined, linkedCompanyName: string): {
+    update: Record<string, unknown> | null;
+    counts: ContactCompanyLinkPlan['counts'];
+} | {
+    refused: string;
+};
+/** Each company's contacts count moved once, by the sum of what the written links moved. */
+export declare function settleCompanyCounts(companies: FirebaseFirestore.CollectionReference, writes: readonly ContactWrite[]): Promise<void>;
 export declare const crmContactUpdateHandler: PluginApiHandler;