@aglyn/plugins-crm 1.0.0-beta.221 → 1.0.0-beta.223

package/src/lib/server/crm-next-activity.js

@@ -0,0 +1,194 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The `nextTaskAtMs` a record carries, as the Admin SDK writes it (AGL-2661).
+ *
+ * A contact, a company and a deal each denormalize when their earliest OPEN
+ * task is due, so a list can draw a "Next activity" column and answer
+ * "which deals have nothing scheduled" without a task query per row. This
+ * is the writer: given the records a task names, read that record's tasks
+ * back and store the answer `nextTaskAtMsOf` gives. Every server-side task
+ * writer — the console's task routes, the REST resource, the workflow step
+ * that files a task, the merge that repoints one — calls it after its own
+ * write; a client-direct task write asks the console's `crm/next-activity`
+ * route, which calls it too.
+ *
+ * Imported by module path rather than from the `@aglyn/aglyn/server`
+ * barrel, for the reason `contact-company-link.ts` gives.
+ *
+ * The task query is ONE equality on the link field, the query the record
+ * cards already run, and the status is judged in memory — no composite
+ * index, and a record with a hundred done tasks reads a hundred small
+ * documents once per write against it, which is the price of never being
+ * wrong. The record write is a bare `update()` of the one field, so
+ * `updatedAt` stays where the person's last edit left it: a task moving is
+ * not the record being edited, and the lists order by `updatedAt`.
+ */ import { CRM_COLLECTIONS } from "@aglyn/aglyn/app-utils/crm";
+import { CRM_NEXT_ACTIVITY_FIELD, mergeNextActivityLinks, nextActivityLinksOfTask, nextTaskAtMsOf, readNextTaskAtMs } from "../model/crm-next-activity.js";
+/** The collection each link field's record lives in, under `orgs/{orgId}/`. */ export const CRM_NEXT_ACTIVITY_COLLECTIONS = {
+    contactId: 'contacts',
+    companyId: CRM_COLLECTIONS.companies,
+    dealId: CRM_COLLECTIONS.deals
+};
+const isNotFound = (error)=>{
+    const { code, message } = error != null ? error : {};
+    return code === 5 || code === 'not-found' || code === 'NOT_FOUND' || typeof message === 'string' && message.includes('NOT_FOUND');
+};
+/**
+ * Store one record's `nextTaskAtMs` from its tasks. `null` for a record
+ * that no longer exists, else the value written.
+ */ async function recomputeOne(orgRef, field, id) {
+    const tasks = await orgRef.collection(CRM_COLLECTIONS.tasks).where(field, '==', id).get();
+    const value = nextTaskAtMsOf(tasks.docs.map((doc)=>({
+            status: doc.get('status'),
+            dueAtMs: doc.get('dueAtMs')
+        })));
+    try {
+        await orgRef.collection(CRM_NEXT_ACTIVITY_COLLECTIONS[field]).doc(id).update({
+            [CRM_NEXT_ACTIVITY_FIELD]: value
+        });
+    } catch (error) {
+        if (isNotFound(error)) return {
+            written: false
+        };
+        throw error;
+    }
+    return {
+        written: true,
+        value
+    };
+}
+/**
+ * Recompute `nextTaskAtMs` for every record the links name, once each.
+ *
+ * Hand in BOTH sides of a change — the links a task carried before an
+ * update and the ones it carries after — so a task moved from one deal to
+ * another leaves neither stale. A record the task named that has since been
+ * deleted is counted in `missing` and skipped; nothing here creates one.
+ */ export async function recomputeCrmNextTaskAt(firestore, orgId, links) {
+    const orgRef = firestore.collection('orgs').doc(orgId);
+    const result = {
+        records: 0,
+        missing: 0
+    };
+    for (const { field, id } of mergeNextActivityLinks(links)){
+        const outcome = await recomputeOne(orgRef, field, id);
+        if (outcome.written) result.records += 1;
+        else result.missing += 1;
+    }
+    return result;
+}
+/**
+ * The same, from a task document rather than a link — what a writer holds
+ * after it has read the task it is about to change or has just changed.
+ */ export function crmNextActivityLinksOf(task) {
+    return nextActivityLinksOfTask(task);
+}
+/** The most open tasks one org-wide recompute walks. */ export const CRM_NEXT_ACTIVITY_SWEEP_MAX = 20000;
+/**
+ * The one-off recompute for a whole organization — the Fields section's
+ * "Recompute next activity" (AGL-2661), for the records written before the
+ * field existed and for whatever a client-direct write left behind.
+ *
+ * Two passes and no per-record task query: every OPEN task once, grouped
+ * by the records it names, so each record with something scheduled is
+ * written its earliest due time; then every record in the three
+ * collections that CARRIES a time and was not in that group, cleared to
+ * `null`. A record that was never written is left alone — every reader
+ * already treats absent as `null`, and writing a null onto every contact
+ * an org holds would cost a write per person to say nothing.
+ *
+ * The clearing pass runs only when the first pass read EVERY open task.
+ * "No open task names this record" is a statement about all of them, and
+ * an organization holding more than the cap has open tasks the sweep never
+ * saw — clearing on a partial read would blank records that are perfectly
+ * scheduled. Past the cap the sweep is the writing half alone, and
+ * `truncated` says so.
+ */ export async function sweepCrmNextTaskAt(firestore, orgId, options = {}) {
+    var _options_max;
+    const max = (_options_max = options.max) != null ? _options_max : CRM_NEXT_ACTIVITY_SWEEP_MAX;
+    const orgRef = firestore.collection('orgs').doc(orgId);
+    const open = await orgRef.collection(CRM_COLLECTIONS.tasks).where('status', '==', 'open').limit(max + 1).get();
+    const truncated = open.docs.length > max;
+    const docs = open.docs.slice(0, max);
+    const earliest = new Map();
+    for (const field of Object.keys(CRM_NEXT_ACTIVITY_COLLECTIONS)){
+        earliest.set(field, new Map());
+    }
+    for (const doc of docs){
+        const task = {
+            status: doc.get('status'),
+            dueAtMs: doc.get('dueAtMs')
+        };
+        const links = nextActivityLinksOfTask({
+            contactId: doc.get('contactId'),
+            companyId: doc.get('companyId'),
+            dealId: doc.get('dealId')
+        });
+        for (const { field, id } of mergeNextActivityLinks([
+            links
+        ])){
+            var _byId_get;
+            const byId = earliest.get(field);
+            byId.set(id, nextTaskAtMsOf([
+                task,
+                {
+                    status: 'open',
+                    dueAtMs: (_byId_get = byId.get(id)) != null ? _byId_get : null
+                }
+            ]));
+        }
+    }
+    const sweep = {
+        tasks: docs.length,
+        scheduled: 0,
+        cleared: 0,
+        truncated
+    };
+    for (const [field, byId] of earliest){
+        const records = orgRef.collection(CRM_NEXT_ACTIVITY_COLLECTIONS[field]);
+        for (const [id, value] of byId){
+            try {
+                await records.doc(id).update({
+                    [CRM_NEXT_ACTIVITY_FIELD]: value
+                });
+                sweep.scheduled += 1;
+            } catch (error) {
+                if (!isNotFound(error)) throw error;
+            }
+        }
+        /*
+     * The stale half: a record that says something is scheduled when no
+     * open task names it any more. `> 0` is the one query a stored time
+     * answers without an index of its own, and matches what
+     * `readNextTaskAtMs` calls a usable value.
+     */ if (truncated) continue;
+        const carrying = await records.where(CRM_NEXT_ACTIVITY_FIELD, '>', 0).get();
+        for (const doc of carrying.docs){
+            if (byId.has(doc.id)) continue;
+            if (readNextTaskAtMs({
+                nextTaskAtMs: doc.get(CRM_NEXT_ACTIVITY_FIELD)
+            }) === null) continue;
+            await doc.ref.update({
+                [CRM_NEXT_ACTIVITY_FIELD]: null
+            });
+            sweep.cleared += 1;
+        }
+    }
+    return sweep;
+}
+
+//# sourceMappingURL=crm-next-activity.js.map

package/src/lib/server/crm-next-activity.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/crm-next-activity.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The `nextTaskAtMs` a record carries, as the Admin SDK writes it (AGL-2661).\n *\n * A contact, a company and a deal each denormalize when their earliest OPEN\n * task is due, so a list can draw a \"Next activity\" column and answer\n * \"which deals have nothing scheduled\" without a task query per row. This\n * is the writer: given the records a task names, read that record's tasks\n * back and store the answer `nextTaskAtMsOf` gives. Every server-side task\n * writer — the console's task routes, the REST resource, the workflow step\n * that files a task, the merge that repoints one — calls it after its own\n * write; a client-direct task write asks the console's `crm/next-activity`\n * route, which calls it too.\n *\n * Imported by module path rather than from the `@aglyn/aglyn/server`\n * barrel, for the reason `contact-company-link.ts` gives.\n *\n * The task query is ONE equality on the link field, the query the record\n * cards already run, and the status is judged in memory — no composite\n * index, and a record with a hundred done tasks reads a hundred small\n * documents once per write against it, which is the price of never being\n * wrong. The record write is a bare `update()` of the one field, so\n * `updatedAt` stays where the person's last edit left it: a task moving is\n * not the record being edited, and the lists order by `updatedAt`.\n */\n\nimport { CRM_COLLECTIONS } from '@aglyn/aglyn/app-utils/crm'\nimport {\n  CRM_NEXT_ACTIVITY_FIELD,\n  type CrmNextActivityLink,\n  type CrmNextActivityLinkField,\n  mergeNextActivityLinks,\n  nextActivityLinksOfTask,\n  nextTaskAtMsOf,\n  readNextTaskAtMs,\n} from '../model/crm-next-activity'\n\n/** The collection each link field's record lives in, under `orgs/{orgId}/`. */\nexport const CRM_NEXT_ACTIVITY_COLLECTIONS: Readonly<Record<CrmNextActivityLinkField, string>> = {\n  contactId: 'contacts',\n  companyId: CRM_COLLECTIONS.companies,\n  dealId: CRM_COLLECTIONS.deals,\n}\n\nexport interface CrmNextActivityRecompute {\n  /** Records whose stored value was written (or rewritten to the same figure). */\n  records: number\n  /** Records that no longer exist — a task can outlive what it was filed against. */\n  missing: number\n}\n\nconst isNotFound = (error: unknown): boolean => {\n  const { code, message } = (error ?? {}) as { code?: unknown; message?: unknown }\n  return (\n    code === 5 ||\n    code === 'not-found' ||\n    code === 'NOT_FOUND' ||\n    (typeof message === 'string' && message.includes('NOT_FOUND'))\n  )\n}\n\n/**\n * Store one record's `nextTaskAtMs` from its tasks. `null` for a record\n * that no longer exists, else the value written.\n */\nasync function recomputeOne(\n  orgRef: FirebaseFirestore.DocumentReference,\n  field: CrmNextActivityLinkField,\n  id: string,\n): Promise<{ written: true; value: number | null } | { written: false }> {\n  const tasks = await orgRef\n    .collection(CRM_COLLECTIONS.tasks)\n    .where(field, '==', id)\n    .get()\n  const value = nextTaskAtMsOf(\n    tasks.docs.map((doc) => ({\n      status: doc.get('status'),\n      dueAtMs: doc.get('dueAtMs'),\n    })),\n  )\n  try {\n    await orgRef\n      .collection(CRM_NEXT_ACTIVITY_COLLECTIONS[field])\n      .doc(id)\n      .update({ [CRM_NEXT_ACTIVITY_FIELD]: value })\n  } catch (error) {\n    if (isNotFound(error)) return { written: false }\n    throw error\n  }\n  return { written: true, value }\n}\n\n/**\n * Recompute `nextTaskAtMs` for every record the links name, once each.\n *\n * Hand in BOTH sides of a change — the links a task carried before an\n * update and the ones it carries after — so a task moved from one deal to\n * another leaves neither stale. A record the task named that has since been\n * deleted is counted in `missing` and skipped; nothing here creates one.\n */\nexport async function recomputeCrmNextTaskAt(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n  links: readonly (CrmNextActivityLink | null | undefined)[],\n): Promise<CrmNextActivityRecompute> {\n  const orgRef = firestore.collection('orgs').doc(orgId)\n  const result: CrmNextActivityRecompute = { records: 0, missing: 0 }\n  for (const { field, id } of mergeNextActivityLinks(links)) {\n    const outcome = await recomputeOne(orgRef, field, id)\n    if (outcome.written) result.records += 1\n    else result.missing += 1\n  }\n  return result\n}\n\n/**\n * The same, from a task document rather than a link — what a writer holds\n * after it has read the task it is about to change or has just changed.\n */\nexport function crmNextActivityLinksOf(\n  task: Record<string, unknown> | null | undefined,\n): CrmNextActivityLink {\n  return nextActivityLinksOfTask(task as Parameters<typeof nextActivityLinksOfTask>[0])\n}\n\n/** The most open tasks one org-wide recompute walks. */\nexport const CRM_NEXT_ACTIVITY_SWEEP_MAX = 20_000\n\nexport interface CrmNextActivitySweep {\n  /** Open tasks read. */\n  tasks: number\n  /** Records that now carry a time. */\n  scheduled: number\n  /** Records that carried a time and now carry `null`. */\n  cleared: number\n  /** Whether the org held more open tasks than the sweep reads. */\n  truncated: boolean\n}\n\n/**\n * The one-off recompute for a whole organization — the Fields section's\n * \"Recompute next activity\" (AGL-2661), for the records written before the\n * field existed and for whatever a client-direct write left behind.\n *\n * Two passes and no per-record task query: every OPEN task once, grouped\n * by the records it names, so each record with something scheduled is\n * written its earliest due time; then every record in the three\n * collections that CARRIES a time and was not in that group, cleared to\n * `null`. A record that was never written is left alone — every reader\n * already treats absent as `null`, and writing a null onto every contact\n * an org holds would cost a write per person to say nothing.\n *\n * The clearing pass runs only when the first pass read EVERY open task.\n * \"No open task names this record\" is a statement about all of them, and\n * an organization holding more than the cap has open tasks the sweep never\n * saw — clearing on a partial read would blank records that are perfectly\n * scheduled. Past the cap the sweep is the writing half alone, and\n * `truncated` says so.\n */\nexport async function sweepCrmNextTaskAt(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n  options: { max?: number } = {},\n): Promise<CrmNextActivitySweep> {\n  const max = options.max ?? CRM_NEXT_ACTIVITY_SWEEP_MAX\n  const orgRef = firestore.collection('orgs').doc(orgId)\n  const open = await orgRef\n    .collection(CRM_COLLECTIONS.tasks)\n    .where('status', '==', 'open')\n    .limit(max + 1)\n    .get()\n  const truncated = open.docs.length > max\n  const docs = open.docs.slice(0, max)\n\n  const earliest = new Map<CrmNextActivityLinkField, Map<string, number | null>>()\n  for (const field of Object.keys(CRM_NEXT_ACTIVITY_COLLECTIONS) as CrmNextActivityLinkField[]) {\n    earliest.set(field, new Map())\n  }\n  for (const doc of docs) {\n    const task = { status: doc.get('status'), dueAtMs: doc.get('dueAtMs') }\n    const links = nextActivityLinksOfTask({\n      contactId: doc.get('contactId'),\n      companyId: doc.get('companyId'),\n      dealId: doc.get('dealId'),\n    })\n    for (const { field, id } of mergeNextActivityLinks([links])) {\n      const byId = earliest.get(field) as Map<string, number | null>\n      byId.set(id, nextTaskAtMsOf([task, { status: 'open', dueAtMs: byId.get(id) ?? null }]))\n    }\n  }\n\n  const sweep: CrmNextActivitySweep = { tasks: docs.length, scheduled: 0, cleared: 0, truncated }\n  for (const [field, byId] of earliest) {\n    const records = orgRef.collection(CRM_NEXT_ACTIVITY_COLLECTIONS[field])\n    for (const [id, value] of byId) {\n      try {\n        await records.doc(id).update({ [CRM_NEXT_ACTIVITY_FIELD]: value })\n        sweep.scheduled += 1\n      } catch (error) {\n        if (!isNotFound(error)) throw error\n      }\n    }\n    /*\n     * The stale half: a record that says something is scheduled when no\n     * open task names it any more. `> 0` is the one query a stored time\n     * answers without an index of its own, and matches what\n     * `readNextTaskAtMs` calls a usable value.\n     */\n    if (truncated) continue\n    const carrying = await records.where(CRM_NEXT_ACTIVITY_FIELD, '>', 0).get()\n    for (const doc of carrying.docs) {\n      if (byId.has(doc.id)) continue\n      if (readNextTaskAtMs({ nextTaskAtMs: doc.get(CRM_NEXT_ACTIVITY_FIELD) }) === null) continue\n      await doc.ref.update({ [CRM_NEXT_ACTIVITY_FIELD]: null })\n      sweep.cleared += 1\n    }\n  }\n  return sweep\n}\n"],"names":["CRM_COLLECTIONS","CRM_NEXT_ACTIVITY_FIELD","mergeNextActivityLinks","nextActivityLinksOfTask","nextTaskAtMsOf","readNextTaskAtMs","CRM_NEXT_ACTIVITY_COLLECTIONS","contactId","companyId","companies","dealId","deals","isNotFound","error","code","message","includes","recomputeOne","orgRef","field","id","tasks","collection","where","get","value","docs","map","doc","status","dueAtMs","update","written","recomputeCrmNextTaskAt","firestore","orgId","links","result","records","missing","outcome","crmNextActivityLinksOf","task","CRM_NEXT_ACTIVITY_SWEEP_MAX","sweepCrmNextTaskAt","options","max","open","limit","truncated","length","slice","earliest","Map","Object","keys","set","byId","sweep","scheduled","cleared","carrying","has","nextTaskAtMs","ref"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED,SAASA,eAAe,QAAQ,6BAA4B;AAC5D,SACEC,uBAAuB,EAGvBC,sBAAsB,EACtBC,uBAAuB,EACvBC,cAAc,EACdC,gBAAgB,QACX,gCAA4B;AAEnC,6EAA6E,GAC7E,OAAO,MAAMC,gCAAoF;IAC/FC,WAAW;IACXC,WAAWR,gBAAgBS,SAAS;IACpCC,QAAQV,gBAAgBW,KAAK;AAC/B,EAAC;AASD,MAAMC,aAAa,CAACC;IAClB,MAAM,EAAEC,IAAI,EAAEC,OAAO,EAAE,GAAIF,gBAAAA,QAAS,CAAC;IACrC,OACEC,SAAS,KACTA,SAAS,eACTA,SAAS,eACR,OAAOC,YAAY,YAAYA,QAAQC,QAAQ,CAAC;AAErD;AAEA;;;CAGC,GACD,eAAeC,aACbC,MAA2C,EAC3CC,KAA+B,EAC/BC,EAAU;IAEV,MAAMC,QAAQ,MAAMH,OACjBI,UAAU,CAACtB,gBAAgBqB,KAAK,EAChCE,KAAK,CAACJ,OAAO,MAAMC,IACnBI,GAAG;IACN,MAAMC,QAAQrB,eACZiB,MAAMK,IAAI,CAACC,GAAG,CAAC,CAACC,MAAS,CAAA;YACvBC,QAAQD,IAAIJ,GAAG,CAAC;YAChBM,SAASF,IAAIJ,GAAG,CAAC;QACnB,CAAA;IAEF,IAAI;QACF,MAAMN,OACHI,UAAU,CAAChB,6BAA6B,CAACa,MAAM,EAC/CS,GAAG,CAACR,IACJW,MAAM,CAAC;YAAE,CAAC9B,wBAAwB,EAAEwB;QAAM;IAC/C,EAAE,OAAOZ,OAAO;QACd,IAAID,WAAWC,QAAQ,OAAO;YAAEmB,SAAS;QAAM;QAC/C,MAAMnB;IACR;IACA,OAAO;QAAEmB,SAAS;QAAMP;IAAM;AAChC;AAEA;;;;;;;CAOC,GACD,OAAO,eAAeQ,uBACpBC,SAAsC,EACtCC,KAAa,EACbC,KAA0D;IAE1D,MAAMlB,SAASgB,UAAUZ,UAAU,CAAC,QAAQM,GAAG,CAACO;IAChD,MAAME,SAAmC;QAAEC,SAAS;QAAGC,SAAS;IAAE;IAClE,KAAK,MAAM,EAAEpB,KAAK,EAAEC,EAAE,EAAE,IAAIlB,uBAAuBkC,OAAQ;QACzD,MAAMI,UAAU,MAAMvB,aAAaC,QAAQC,OAAOC;QAClD,IAAIoB,QAAQR,OAAO,EAAEK,OAAOC,OAAO,IAAI;aAClCD,OAAOE,OAAO,IAAI;IACzB;IACA,OAAOF;AACT;AAEA;;;CAGC,GACD,OAAO,SAASI,uBACdC,IAAgD;IAEhD,OAAOvC,wBAAwBuC;AACjC;AAEA,sDAAsD,GACtD,OAAO,MAAMC,8BAA8B,MAAM;AAajD;;;;;;;;;;;;;;;;;;;CAmBC,GACD,OAAO,eAAeC,mBACpBV,SAAsC,EACtCC,KAAa,EACbU,UAA4B,CAAC,CAAC;QAElBA;IAAZ,MAAMC,OAAMD,eAAAA,QAAQC,GAAG,YAAXD,eAAeF;IAC3B,MAAMzB,SAASgB,UAAUZ,UAAU,CAAC,QAAQM,GAAG,CAACO;IAChD,MAAMY,OAAO,MAAM7B,OAChBI,UAAU,CAACtB,gBAAgBqB,KAAK,EAChCE,KAAK,CAAC,UAAU,MAAM,QACtByB,KAAK,CAACF,MAAM,GACZtB,GAAG;IACN,MAAMyB,YAAYF,KAAKrB,IAAI,CAACwB,MAAM,GAAGJ;IACrC,MAAMpB,OAAOqB,KAAKrB,IAAI,CAACyB,KAAK,CAAC,GAAGL;IAEhC,MAAMM,WAAW,IAAIC;IACrB,KAAK,MAAMlC,SAASmC,OAAOC,IAAI,CAACjD,+BAA8D;QAC5F8C,SAASI,GAAG,CAACrC,OAAO,IAAIkC;IAC1B;IACA,KAAK,MAAMzB,OAAOF,KAAM;QACtB,MAAMgB,OAAO;YAAEb,QAAQD,IAAIJ,GAAG,CAAC;YAAWM,SAASF,IAAIJ,GAAG,CAAC;QAAW;QACtE,MAAMY,QAAQjC,wBAAwB;YACpCI,WAAWqB,IAAIJ,GAAG,CAAC;YACnBhB,WAAWoB,IAAIJ,GAAG,CAAC;YACnBd,QAAQkB,IAAIJ,GAAG,CAAC;QAClB;QACA,KAAK,MAAM,EAAEL,KAAK,EAAEC,EAAE,EAAE,IAAIlB,uBAAuB;YAACkC;SAAM,EAAG;gBAEGqB;YAD9D,MAAMA,OAAOL,SAAS5B,GAAG,CAACL;YAC1BsC,KAAKD,GAAG,CAACpC,IAAIhB,eAAe;gBAACsC;gBAAM;oBAAEb,QAAQ;oBAAQC,OAAO,GAAE2B,YAAAA,KAAKjC,GAAG,CAACJ,eAATqC,YAAgB;gBAAK;aAAE;QACvF;IACF;IAEA,MAAMC,QAA8B;QAAErC,OAAOK,KAAKwB,MAAM;QAAES,WAAW;QAAGC,SAAS;QAAGX;IAAU;IAC9F,KAAK,MAAM,CAAC9B,OAAOsC,KAAK,IAAIL,SAAU;QACpC,MAAMd,UAAUpB,OAAOI,UAAU,CAAChB,6BAA6B,CAACa,MAAM;QACtE,KAAK,MAAM,CAACC,IAAIK,MAAM,IAAIgC,KAAM;YAC9B,IAAI;gBACF,MAAMnB,QAAQV,GAAG,CAACR,IAAIW,MAAM,CAAC;oBAAE,CAAC9B,wBAAwB,EAAEwB;gBAAM;gBAChEiC,MAAMC,SAAS,IAAI;YACrB,EAAE,OAAO9C,OAAO;gBACd,IAAI,CAACD,WAAWC,QAAQ,MAAMA;YAChC;QACF;QACA;;;;;KAKC,GACD,IAAIoC,WAAW;QACf,MAAMY,WAAW,MAAMvB,QAAQf,KAAK,CAACtB,yBAAyB,KAAK,GAAGuB,GAAG;QACzE,KAAK,MAAMI,OAAOiC,SAASnC,IAAI,CAAE;YAC/B,IAAI+B,KAAKK,GAAG,CAAClC,IAAIR,EAAE,GAAG;YACtB,IAAIf,iBAAiB;gBAAE0D,cAAcnC,IAAIJ,GAAG,CAACvB;YAAyB,OAAO,MAAM;YACnF,MAAM2B,IAAIoC,GAAG,CAACjC,MAAM,CAAC;gBAAE,CAAC9B,wBAAwB,EAAE;YAAK;YACvDyD,MAAME,OAAO,IAAI;QACnB;IACF;IACA,OAAOF;AACT"}

package/src/lib/server/crm-record-indexes.d.ts

@@ -0,0 +1,45 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginIndexedRecord, PluginRecordIndex } from '@aglyn/aglyn/plugin-manager/plugin-record-index';
+/**
+ * Two more of the CRM's record kinds, as another plugin reads them on the
+ * server (AGL-3080) — a sales sequence judging the company a person works
+ * for, and sending the body of a template a rep wrote — without knowing where
+ * either is stored.
+ *
+ * Both org-scoped (`orgId` required; a site-only scope answers nothing). With
+ * a `hostId`, only what that site may see.
+ *
+ * `company` — `name` is the company's, else its domain, else its id. Its
+ * `facts` are the company as the CRM stores it: `name`, `domain`, `address`
+ * (`{ line1, city, region, postalCode, country }`), `phone`, `website`,
+ * `industry` and the rest of the record's fields.
+ *
+ * `messageTemplate` — the CRM's email templates and snippets, by the name a
+ * rep gave it; one saved without a name is left out. Its `facts`:
+ * `{ kind: 'template' | 'snippet', subject: string, body: string }`, the body
+ * in the CRM's merge-field grammar.
+ */
+type Firestore = FirebaseFirestore.Firestore;
+export declare function companyIndexedRecord(id: string, data: Record<string, unknown> | undefined): PluginIndexedRecord | null;
+export declare function messageTemplateIndexedRecord(id: string, data: Record<string, unknown> | undefined): PluginIndexedRecord | null;
+/** Builds the two indexes over a Firestore; the CRM registers them over the admin app's. */
+export declare function crmRecordIndexes(firestore?: () => Firestore): {
+    company: PluginRecordIndex;
+    messageTemplate: PluginRecordIndex;
+};
+export {};

package/src/lib/server/crm-record-indexes.js

@@ -0,0 +1,78 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { CRM_COLLECTIONS } from "@aglyn/aglyn/app-utils/crm";
+import { normalizeCrmEmailTemplate } from "@aglyn/aglyn/app-utils/crm-email-templates";
+import { visibleToHost } from "@aglyn/aglyn/app-utils/scope-tokens";
+import { firebaseAdmin } from "@aglyn/tenant-data-admin/server/firebase-admin";
+const str = (value)=>typeof value === 'string' ? value.trim() : '';
+export function companyIndexedRecord(id, data) {
+    if (!data) return null;
+    return {
+        id,
+        name: str(data['name']) || str(data['domain']) || id,
+        facts: _extends({}, data)
+    };
+}
+export function messageTemplateIndexedRecord(id, data) {
+    if (!data) return null;
+    const template = normalizeCrmEmailTemplate(data);
+    if (!template.name) return null;
+    return {
+        id,
+        name: template.name,
+        facts: {
+            kind: template.kind,
+            subject: template.subject,
+            body: template.body
+        }
+    };
+}
+function orgIndex(collection, record, firestore) {
+    const of = (orgId)=>firestore().collection('orgs').doc(orgId).collection(collection);
+    const visible = (data, hostId)=>!hostId || visibleToHost(data == null ? void 0 : data['visibleTo'], hostId);
+    return {
+        async list ({ orgId, hostId, limit }) {
+            if (!orgId || limit <= 0) return {
+                records: [],
+                truncated: false
+            };
+            // One more than asked, so `truncated` is a fact; scope and names are
+            // applied after the read.
+            const snapshot = await of(orgId).orderBy('name').limit(limit + 1).get();
+            const records = snapshot.docs.slice(0, limit).filter((doc)=>visible(doc.data(), hostId)).map((doc)=>record(doc.id, doc.data())).filter((entry)=>entry !== null);
+            return {
+                records,
+                truncated: snapshot.docs.length > limit
+            };
+        },
+        async get ({ orgId, hostId, id }) {
+            if (!orgId || !id) return null;
+            const snapshot = await of(orgId).doc(id).get();
+            if (!snapshot.exists || !visible(snapshot.data(), hostId)) return null;
+            return record(snapshot.id, snapshot.data());
+        }
+    };
+}
+const adminFirestore = ()=>firebaseAdmin.app().firestore();
+/** Builds the two indexes over a Firestore; the CRM registers them over the admin app's. */ export function crmRecordIndexes(firestore = adminFirestore) {
+    return {
+        company: orgIndex(CRM_COLLECTIONS.companies, companyIndexedRecord, firestore),
+        messageTemplate: orgIndex(CRM_COLLECTIONS.emailTemplates, messageTemplateIndexedRecord, firestore)
+    };
+}
+
+//# sourceMappingURL=crm-record-indexes.js.map

package/src/lib/server/crm-record-indexes.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/crm-record-indexes.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { CRM_COLLECTIONS } from '@aglyn/aglyn/app-utils/crm'\nimport { normalizeCrmEmailTemplate } from '@aglyn/aglyn/app-utils/crm-email-templates'\nimport { visibleToHost } from '@aglyn/aglyn/app-utils/scope-tokens'\nimport type {\n  PluginIndexedRecord,\n  PluginRecordIndex,\n} from '@aglyn/aglyn/plugin-manager/plugin-record-index'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin/server/firebase-admin'\n\n/**\n * Two more of the CRM's record kinds, as another plugin reads them on the\n * server (AGL-3080) — a sales sequence judging the company a person works\n * for, and sending the body of a template a rep wrote — without knowing where\n * either is stored.\n *\n * Both org-scoped (`orgId` required; a site-only scope answers nothing). With\n * a `hostId`, only what that site may see.\n *\n * `company` — `name` is the company's, else its domain, else its id. Its\n * `facts` are the company as the CRM stores it: `name`, `domain`, `address`\n * (`{ line1, city, region, postalCode, country }`), `phone`, `website`,\n * `industry` and the rest of the record's fields.\n *\n * `messageTemplate` — the CRM's email templates and snippets, by the name a\n * rep gave it; one saved without a name is left out. Its `facts`:\n * `{ kind: 'template' | 'snippet', subject: string, body: string }`, the body\n * in the CRM's merge-field grammar.\n */\n\ntype Firestore = FirebaseFirestore.Firestore\n\nconst str = (value: unknown): string => (typeof value === 'string' ? value.trim() : '')\n\nexport function companyIndexedRecord(\n  id: string,\n  data: Record<string, unknown> | undefined,\n): PluginIndexedRecord | null {\n  if (!data) return null\n  return { id, name: str(data['name']) || str(data['domain']) || id, facts: { ...data } }\n}\n\nexport function messageTemplateIndexedRecord(\n  id: string,\n  data: Record<string, unknown> | undefined,\n): PluginIndexedRecord | null {\n  if (!data) return null\n  const template = normalizeCrmEmailTemplate(data)\n  if (!template.name) return null\n  return {\n    id,\n    name: template.name,\n    facts: { kind: template.kind, subject: template.subject, body: template.body },\n  }\n}\n\nfunction orgIndex(\n  collection: string,\n  record: (id: string, data: Record<string, unknown> | undefined) => PluginIndexedRecord | null,\n  firestore: () => Firestore,\n): PluginRecordIndex {\n  const of = (orgId: string) => firestore().collection('orgs').doc(orgId).collection(collection)\n  const visible = (data: Record<string, unknown> | undefined, hostId: string | null | undefined) =>\n    !hostId || visibleToHost(data?.['visibleTo'] as string[] | undefined, hostId)\n  return {\n    async list({ orgId, hostId, limit }) {\n      if (!orgId || limit <= 0) return { records: [], truncated: false }\n      // One more than asked, so `truncated` is a fact; scope and names are\n      // applied after the read.\n      const snapshot = await of(orgId).orderBy('name').limit(limit + 1).get()\n      const records = snapshot.docs\n        .slice(0, limit)\n        .filter((doc) => visible(doc.data(), hostId))\n        .map((doc) => record(doc.id, doc.data()))\n        .filter((entry): entry is PluginIndexedRecord => entry !== null)\n      return { records, truncated: snapshot.docs.length > limit }\n    },\n    async get({ orgId, hostId, id }) {\n      if (!orgId || !id) return null\n      const snapshot = await of(orgId).doc(id).get()\n      if (!snapshot.exists || !visible(snapshot.data(), hostId)) return null\n      return record(snapshot.id, snapshot.data())\n    },\n  }\n}\n\nconst adminFirestore = () => firebaseAdmin.app().firestore()\n\n/** Builds the two indexes over a Firestore; the CRM registers them over the admin app's. */\nexport function crmRecordIndexes(firestore: () => Firestore = adminFirestore): {\n  company: PluginRecordIndex\n  messageTemplate: PluginRecordIndex\n} {\n  return {\n    company: orgIndex(CRM_COLLECTIONS.companies, companyIndexedRecord, firestore),\n    messageTemplate: orgIndex(CRM_COLLECTIONS.emailTemplates, messageTemplateIndexedRecord, firestore),\n  }\n}\n"],"names":["CRM_COLLECTIONS","normalizeCrmEmailTemplate","visibleToHost","firebaseAdmin","str","value","trim","companyIndexedRecord","id","data","name","facts","messageTemplateIndexedRecord","template","kind","subject","body","orgIndex","collection","record","firestore","of","orgId","doc","visible","hostId","list","limit","records","truncated","snapshot","orderBy","get","docs","slice","filter","map","entry","length","exists","adminFirestore","app","crmRecordIndexes","company","companies","messageTemplate","emailTemplates"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,eAAe,QAAQ,6BAA4B;AAC5D,SAASC,yBAAyB,QAAQ,6CAA4C;AACtF,SAASC,aAAa,QAAQ,sCAAqC;AAKnE,SAASC,aAAa,QAAQ,iDAAgD;AAwB9E,MAAMC,MAAM,CAACC,QAA4B,OAAOA,UAAU,WAAWA,MAAMC,IAAI,KAAK;AAEpF,OAAO,SAASC,qBACdC,EAAU,EACVC,IAAyC;IAEzC,IAAI,CAACA,MAAM,OAAO;IAClB,OAAO;QAAED;QAAIE,MAAMN,IAAIK,IAAI,CAAC,OAAO,KAAKL,IAAIK,IAAI,CAAC,SAAS,KAAKD;QAAIG,OAAO,aAAKF;IAAO;AACxF;AAEA,OAAO,SAASG,6BACdJ,EAAU,EACVC,IAAyC;IAEzC,IAAI,CAACA,MAAM,OAAO;IAClB,MAAMI,WAAWZ,0BAA0BQ;IAC3C,IAAI,CAACI,SAASH,IAAI,EAAE,OAAO;IAC3B,OAAO;QACLF;QACAE,MAAMG,SAASH,IAAI;QACnBC,OAAO;YAAEG,MAAMD,SAASC,IAAI;YAAEC,SAASF,SAASE,OAAO;YAAEC,MAAMH,SAASG,IAAI;QAAC;IAC/E;AACF;AAEA,SAASC,SACPC,UAAkB,EAClBC,MAA6F,EAC7FC,SAA0B;IAE1B,MAAMC,KAAK,CAACC,QAAkBF,YAAYF,UAAU,CAAC,QAAQK,GAAG,CAACD,OAAOJ,UAAU,CAACA;IACnF,MAAMM,UAAU,CAACf,MAA2CgB,SAC1D,CAACA,UAAUvB,cAAcO,wBAAAA,IAAM,CAAC,YAAY,EAA0BgB;IACxE,OAAO;QACL,MAAMC,MAAK,EAAEJ,KAAK,EAAEG,MAAM,EAAEE,KAAK,EAAE;YACjC,IAAI,CAACL,SAASK,SAAS,GAAG,OAAO;gBAAEC,SAAS,EAAE;gBAAEC,WAAW;YAAM;YACjE,qEAAqE;YACrE,0BAA0B;YAC1B,MAAMC,WAAW,MAAMT,GAAGC,OAAOS,OAAO,CAAC,QAAQJ,KAAK,CAACA,QAAQ,GAAGK,GAAG;YACrE,MAAMJ,UAAUE,SAASG,IAAI,CAC1BC,KAAK,CAAC,GAAGP,OACTQ,MAAM,CAAC,CAACZ,MAAQC,QAAQD,IAAId,IAAI,IAAIgB,SACpCW,GAAG,CAAC,CAACb,MAAQJ,OAAOI,IAAIf,EAAE,EAAEe,IAAId,IAAI,KACpC0B,MAAM,CAAC,CAACE,QAAwCA,UAAU;YAC7D,OAAO;gBAAET;gBAASC,WAAWC,SAASG,IAAI,CAACK,MAAM,GAAGX;YAAM;QAC5D;QACA,MAAMK,KAAI,EAAEV,KAAK,EAAEG,MAAM,EAAEjB,EAAE,EAAE;YAC7B,IAAI,CAACc,SAAS,CAACd,IAAI,OAAO;YAC1B,MAAMsB,WAAW,MAAMT,GAAGC,OAAOC,GAAG,CAACf,IAAIwB,GAAG;YAC5C,IAAI,CAACF,SAASS,MAAM,IAAI,CAACf,QAAQM,SAASrB,IAAI,IAAIgB,SAAS,OAAO;YAClE,OAAON,OAAOW,SAAStB,EAAE,EAAEsB,SAASrB,IAAI;QAC1C;IACF;AACF;AAEA,MAAM+B,iBAAiB,IAAMrC,cAAcsC,GAAG,GAAGrB,SAAS;AAE1D,0FAA0F,GAC1F,OAAO,SAASsB,iBAAiBtB,YAA6BoB,cAAc;IAI1E,OAAO;QACLG,SAAS1B,SAASjB,gBAAgB4C,SAAS,EAAErC,sBAAsBa;QACnEyB,iBAAiB5B,SAASjB,gBAAgB8C,cAAc,EAAElC,8BAA8BQ;IAC1F;AACF"}

package/src/lib/server/crm-sharing.d.ts

@@ -15,7 +15,7 @@
  * limitations under the License.
  */
 import type { PluginApiHandler } from '@aglyn/aglyn/server';
-import { type CrmShareGrant, type CrmSharingObject, type CrmSharingRule, type CrmSharingSite } from '../model/crm-sharing';
+import { type CrmShareGrant, type CrmSharingContext, type CrmSharingObject, type CrmSharingRule, type CrmSharingSite } from '../model/crm-sharing';
 type Firestore = FirebaseFirestore.Firestore;
 /** Test seam, and what a rule write calls so its own process reads it fresh. */
 export declare function forgetCrmSharingRules(orgId?: string): void;
@@ -26,6 +26,12 @@ export declare function crmSharingRulesOf(firestore: Firestore, orgId: string, o
     rules: CrmSharingRule[];
     fresh: boolean;
 }>;
+/**
+ * What the rules for `object` are evaluated against beyond the record: the
+ * org's Lead source list, read only when an active rule asks a lead source
+ * direction (AGL-3511) — an org whose rules never do pays no read for it.
+ */
+export declare function crmSharingContextFor(firestore: Firestore, orgId: string, rules: readonly CrmSharingRule[], object: CrmSharingObject): Promise<CrmSharingContext>;
 export interface RecomputeRecordSharingInput {
     firestore: Firestore;
     orgId: string;
@@ -37,6 +43,8 @@ export interface RecomputeRecordSharingInput {
     fresh: boolean;
     /** The hand shares' change, for a share or an unshare. */
     manual?: (grants: Record<string, CrmShareGrant>) => Record<string, CrmShareGrant>;
+    /** What the rules are evaluated against beyond the record — see {@link crmSharingContextFor}. */
+    context?: CrmSharingContext;
     atMs: number;
 }
 export type RecomputeOutcome = 'changed' | 'unchanged' | 'missing';

package/src/lib/server/crm-sharing.js

@@ -39,7 +39,8 @@ import { firebaseAdmin, getOrgForHost, logOrgActivity } from "@aglyn/tenant-data
 import { countCrmActivitiesForRecord } from "@aglyn/tenant-data-admin/server/crm-records";
 import { FieldPath, FieldValue } from "firebase-admin/firestore";
 import { BUNDLE_ID } from "../constants/bundle-common.js";
-import { activeSharingRules, CRM_SHARING_CRITERIA_FOR, CRM_SHARING_CRITERIA_KEYS, CRM_SHARING_FIELD, CRM_SHARING_IDS_MAX, CRM_SHARING_OBJECT_LABELS, CRM_SHARING_RULE_IDS_PATH, CRM_SHARING_RULES_MAX, CRM_WRITE_SCOPE_FIELD, describeShareTargets, evaluateRecordGrants, isCrmShareAccess, isCrmSharingObject, planRecordSharing, readCrmSharingRule, readCrmSharingRules, recordHeldScope, sharingPlanChanges, shareTargetsFrom, withManualShares, withoutManualShares } from "../model/crm-sharing.js";
+import { activeSharingRules, CRM_SHARING_CRITERIA_FOR, CRM_SHARING_CRITERIA_KEYS, CRM_SHARING_FIELD, CRM_SHARING_IDS_MAX, CRM_SHARING_OBJECT_LABELS, CRM_SHARING_RULE_IDS_PATH, CRM_SHARING_RULES_MAX, CRM_WRITE_SCOPE_FIELD, describeShareTargets, evaluateRecordGrants, isCrmShareAccess, isCrmSharingObject, planRecordSharing, readCrmSharingRule, readCrmSharingRules, recordHeldScope, sharingPlanChanges, shareTargetsFrom, sharingRulesAskLeadSourceDirection, withManualShares, withoutManualShares } from "../model/crm-sharing.js";
+import { readLeadSourcePicklist } from "./lead-source-picklist.js";
 import { authorizeOrgCaller, orgHostIds, readCrmRouteScope } from "./org-caller.js";
 import { crmSuiteRefusal } from "./suite-gate.js";
 import { authorizeCrmWriter } from "./task-routes.js";
@@ -76,11 +77,22 @@ export async function crmSharingRulesOf(firestore, orgId, options = {}) {
         fresh: true
     };
 }
+/**
+ * What the rules for `object` are evaluated against beyond the record: the
+ * org's Lead source list, read only when an active rule asks a lead source
+ * direction (AGL-3511) — an org whose rules never do pays no read for it.
+ */ export async function crmSharingContextFor(firestore, orgId, rules, object) {
+    if (!sharingRulesAskLeadSourceDirection(rules, object)) return {};
+    return {
+        leadSources: await readLeadSourcePicklist(firestore, orgId)
+    };
+}
 export async function recomputeRecordSharing(input) {
     const { firestore, orgId, object, id, atMs } = input;
     const ref = firestore.collection('orgs').doc(orgId).collection(object).doc(id);
     return await firestore.runTransaction(async (tx)=>{
         var _snapshot_data, _plan_writeTo, _plan_sharing, _plan_writeTo1, _plan_sharing1;
+        var _input_context;
         const snapshot = await tx.get(ref);
         if (!snapshot.exists) return 'missing';
         const record = (_snapshot_data = snapshot.data()) != null ? _snapshot_data : {};
@@ -100,7 +112,9 @@ export async function recomputeRecordSharing(input) {
                 rules = readCrmSharingRules((_org_data = org.data()) != null ? _org_data : null);
             }
         }
-        let grants = evaluateRecordGrants(object, record, rules, atMs);
+        // A rule read afresh above may ask a direction the caller's context was not read for.
+        const context = ((_input_context = input.context) == null ? void 0 : _input_context.leadSources) || rules === input.rules ? input.context : await crmSharingContextFor(firestore, orgId, rules, object);
+        let grants = evaluateRecordGrants(object, record, rules, atMs, context);
         if (input.manual) grants = input.manual(grants);
         const plan = planRecordSharing(record, grants);
         if (!sharingPlanChanges(record, plan)) return 'unchanged';
@@ -151,12 +165,14 @@ export async function recomputeRecordSharing(input) {
         changed: 0,
         missing: 0
     };
+    const context = await crmSharingContextFor(firestore, orgId, rules, object);
     const outcome = await recomputeMany({
         firestore,
         orgId,
         object,
         rules,
         fresh,
+        context,
         atMs: Date.now()
     }, ids);
     return {
@@ -404,6 +420,7 @@ const ORG_TARGET = {
             const { rules } = await crmSharingRulesOf(firestore, orgId, {
                 fresh: true
             });
+            const context = await crmSharingContextFor(firestore, orgId, rules, rule.object);
             let page;
             if (run.mode === 'apply') {
                 let query = records.orderBy(FieldPath.documentId()).limit(RUN_PAGE);
@@ -417,7 +434,7 @@ const ORG_TARGET = {
             const moving = page.docs.filter((doc)=>{
                 var _doc_data;
                 const record = (_doc_data = doc.data()) != null ? _doc_data : {};
-                const plan = planRecordSharing(record, evaluateRecordGrants(rule.object, record, rules, atMs));
+                const plan = planRecordSharing(record, evaluateRecordGrants(rule.object, record, rules, atMs, context));
                 return sharingPlanChanges(record, plan);
             }).map((doc)=>doc.id);
             if (run.mode === 'remove' && page.docs.length && page.docs.every((doc)=>seen.has(doc.id))) {
@@ -430,6 +447,7 @@ const ORG_TARGET = {
                 object: rule.object,
                 rules,
                 fresh: true,
+                context,
                 atMs
             }, moving);
             const done = run.mode === 'apply' ? page.size < RUN_PAGE : page.empty;
@@ -593,12 +611,14 @@ function readIds(raw) {
             }
             const access = body['access'] === 'edit' ? 'edit' : 'read';
             const { rules, fresh } = await crmSharingRulesOf(firestore, orgId);
+            const context = await crmSharingContextFor(firestore, orgId, rules, object);
             const outcome = await recomputeMany({
                 firestore,
                 orgId,
                 object,
                 rules,
                 fresh,
+                context,
                 atMs: nowMs,
                 manual: (grants)=>action === 'share' ? withManualShares(grants, targets, access, {
                         uid: caller.uid,