@aglyn/plugins-crm 1.0.0-beta.296 → 1.1.0

package/src/lib/server.js

@@ -57,6 +57,12 @@ import { CONTACT_ERASED_MESSAGE, CONTACT_FIELDS_MAX_PER_ORG, contactFacetPath, c
 import { consentGroupForSite, firebaseAdmin, getOrgForHost, logHostActivity, memberHasOrgPermission, orgDataCollectionForHost, resolveOrgMembership, restampCrmListFieldsAt } from "@aglyn/tenant-data-admin";
 import { isRefusedIdToken } from "@aglyn/tenant-data-admin/server/id-token-refusal";
 import { emitHostEvent } from "@aglyn/tenant-runtime";
+import { ORG_CONTACT_HOLDER_ID } from "@aglyn/aglyn/app-utils/contacts";
+import { crmDefaultScopeOf } from "@aglyn/aglyn/app-utils/crm";
+import { logOrgActivity } from "@aglyn/tenant-data-admin/server/organizations";
+import { contactPrimaryGroup } from "./model/contact-holder.js";
+import { addContactByHand } from "./server/add-contact-by-hand.js";
+import { authorizeOrgCaller, readOrgForCreate } from "./server/org-caller.js";
 import { captureHostContact } from "./server/capture-host-contact.js";
 import { FieldValue } from "firebase-admin/firestore";
 import { CRM_API_ROUTES } from "./constants/api-routes.js";
@@ -198,8 +204,8 @@ import { CRM_RECIPE_INSTALL_ROUTE, CRM_RECIPE_STATUS_ROUTE, crmRecipeInstallHand
  * must not be able to restage a contact only site B holds by guessing its
  * id, and the scoped query the list uses is not available to a `doc()` read.
  */ export const contactStageHandler = async (req, res)=>{
-    var _ref, _ref1;
-    var _req_body, _req_body1, _req_body2;
+    var _ref, _ref1, _ref2;
+    var _req_body, _req_body1, _req_body2, _req_body3;
     if (req.method !== 'POST') {
         res.setHeader('Allow', 'POST');
         res.status(405).json({
@@ -208,9 +214,10 @@ import { CRM_RECIPE_INSTALL_ROUTE, CRM_RECIPE_STATUS_ROUTE, crmRecipeInstallHand
         return;
     }
     const hostId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.hostId) != null ? _ref : '').trim();
-    const contactId = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.contactId) != null ? _ref1 : '').trim();
-    const requested = (_req_body2 = req.body) == null ? void 0 : _req_body2.lifecycleStage;
-    if (!hostId || !contactId) {
+    const orgId = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.orgId) != null ? _ref1 : '').trim();
+    const contactId = String((_ref2 = (_req_body2 = req.body) == null ? void 0 : _req_body2.contactId) != null ? _ref2 : '').trim();
+    const requested = (_req_body3 = req.body) == null ? void 0 : _req_body3.lifecycleStage;
+    if (!hostId && !orgId || !contactId) {
         res.status(400).json({
             error: 'Missing hostId or contactId'
         });
@@ -225,6 +232,65 @@ import { CRM_RECIPE_INSTALL_ROUTE, CRM_RECIPE_STATUS_ROUTE, crmRecipeInstallHand
         });
         return;
     }
+    /*
+   * A person no site holds is staged at the organization level (AGL-4122): the
+   * stage is in their org-held facet, and no site has an automation to tell.
+   */ if (!hostId) {
+        const caller = await authorizeOrgCaller(req, orgId, {
+            needs: 'data.manage',
+            refusal: 'Moving a contact’s stage requires the "Manage data" permission.'
+        });
+        if (caller.ok === false) {
+            res.status(caller.status).json({
+                error: caller.error
+            });
+            return;
+        }
+        try {
+            var _readContactFacet_lifecycleStage;
+            const suite = crmSuiteRefusal(caller.org, "Moving a contact's lifecycle stage");
+            if (suite) {
+                res.status(suite.status).json(suite.body);
+                return;
+            }
+            const snapshot = await firebaseAdmin.app().firestore().collection('orgs').doc(orgId).collection('contacts').doc(contactId).get();
+            if (!snapshot.exists) {
+                res.status(404).json({
+                    error: 'Unknown contact'
+                });
+                return;
+            }
+            const data = snapshot.data();
+            const groupId = contactPrimaryGroup(data, caller.org).groupId || ORG_CONTACT_HOLDER_ID;
+            const previousStage = (_readContactFacet_lifecycleStage = readContactFacet(data, groupId).lifecycleStage) != null ? _readContactFacet_lifecycleStage : '';
+            if (previousStage === lifecycleStage) {
+                res.status(200).json({
+                    ok: true,
+                    changed: false,
+                    lifecycleStage,
+                    previousStage
+                });
+                return;
+            }
+            await snapshot.ref.update({
+                [contactFacetPath(groupId, 'lifecycleStage')]: clearing ? FieldValue.delete() : lifecycleStage,
+                updatedAt: FieldValue.serverTimestamp()
+            });
+            await restampCrmListFieldsAt(snapshot.ref, 'contacts');
+            res.status(200).json({
+                ok: true,
+                changed: true,
+                lifecycleStage,
+                previousStage
+            });
+        } catch (error) {
+            console.error('[crm] contact-stage failed', orgId, contactId, error);
+            res.status(500).json({
+                error: 'The stage could not be changed'
+            });
+        }
+        return;
+    }
     const caller = await authorizeSiteEditor(req, hostId);
     if (caller.ok === false) {
         res.status(caller.status).json({
@@ -377,14 +443,18 @@ import { CRM_RECIPE_INSTALL_ROUTE, CRM_RECIPE_STATUS_ROUTE, crmRecipeInstallHand
     }
     const body = (_req_body = req.body) != null ? _req_body : {};
     const hostId = typed(body['hostId'], 128);
-    if (!hostId) {
+    // The organization, for a person added there with no Source site (AGL-4122).
+    const orgIdInBody = typed(body['orgId'], 128);
+    if (!hostId && !orgIdInBody) {
         res.status(400).json({
             error: 'Missing hostId'
         });
         return;
     }
-    const email = normalizeContactEmail(body['email']);
-    if (!email) {
+    // An address is optional, and one that was typed still has to be an address.
+    const rawEmail = typed(body['email'], 320);
+    const email = rawEmail ? normalizeContactEmail(rawEmail) : null;
+    if (rawEmail && !email) {
         res.status(400).json({
             error: 'Enter a valid email address.'
         });
@@ -414,6 +484,13 @@ import { CRM_RECIPE_INSTALL_ROUTE, CRM_RECIPE_STATUS_ROUTE, crmRecipeInstallHand
     }
     const extras = profile.fields;
     const name = typed(body['name'], 120);
+    // Somebody to call them: a name, an address or a number (AGL-4122).
+    if (!email && !phone && !extras.mobilePhone && !name && !composeContactName(extras.firstName, extras.lastName)) {
+        res.status(400).json({
+            error: 'Enter a name, an email or a phone number.'
+        });
+        return;
+    }
     const jobTitle = typed(body['jobTitle'], 120);
     let companyName = typed(body['companyName'], 120);
     const companyId = typed(body['companyId'], 128);
@@ -446,10 +523,18 @@ import { CRM_RECIPE_INSTALL_ROUTE, CRM_RECIPE_STATUS_ROUTE, crmRecipeInstallHand
     try {
         var _decoded_email;
         const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
-        const resolved = await getOrgForHost(hostId);
+        const resolved = hostId ? await getOrgForHost(hostId) : await readOrgForCreate(orgIdInBody);
         if (!resolved) {
             res.status(404).json({
-                error: 'Unknown site'
+                error: hostId ? 'Unknown site' : 'Unknown workspace'
+            });
+            return;
+        }
+        // The org's records belong to every site unless it keeps them apart, and
+        // then a record has to come from one (AGL-4122).
+        if (!hostId && crmDefaultScopeOf(resolved.org) !== 'org') {
+            res.status(400).json({
+                error: 'Choose the site this contact came from.'
             });
             return;
         }
@@ -459,7 +544,7 @@ import { CRM_RECIPE_INSTALL_ROUTE, CRM_RECIPE_STATUS_ROUTE, crmRecipeInstallHand
             var _member_hostAccess;
             const membership = await resolveOrgMembership(decoded.uid, resolved.orgId);
             const member = (_ref = membership == null ? void 0 : membership.member) != null ? _ref : null;
-            const reaches = isOrgWideMember(member) || Boolean(member == null ? void 0 : (_member_hostAccess = member.hostAccess) == null ? void 0 : _member_hostAccess[hostId]);
+            const reaches = isOrgWideMember(member) || Boolean(hostId && (member == null ? void 0 : (_member_hostAccess = member.hostAccess) == null ? void 0 : _member_hostAccess[hostId]));
             const allowed = member && reaches && await memberHasOrgPermission(resolved.orgId, member, 'data.manage');
             if (!allowed) {
                 res.status(403).json({
@@ -511,11 +596,11 @@ import { CRM_RECIPE_INSTALL_ROUTE, CRM_RECIPE_STATUS_ROUTE, crmRecipeInstallHand
             custom = judged.values;
         }
         if (companyId) {
-            const group = await consentGroupForSite(hostId, resolved.org);
-            const readable = new Set(crmReadTokens(group));
+            // With no site the caller is org-wide, and every company is theirs.
+            const readable = hostId ? new Set(crmReadTokens(await consentGroupForSite(hostId, resolved.org))) : null;
             const companySnapshot = await firebaseAdmin.app().firestore().collection('orgs').doc(resolved.orgId).collection(CRM_COLLECTIONS.companies).doc(companyId).get();
             const tokens = companySnapshot.exists ? companySnapshot.get('visibleTo') : undefined;
-            const visible = Array.isArray(tokens) && tokens.some((token)=>readable.has(String(token)));
+            const visible = companySnapshot.exists && (!readable || Array.isArray(tokens) && tokens.some((token)=>readable.has(String(token))));
             if (!visible) {
                 res.status(404).json({
                     error: 'Unknown company'
@@ -524,9 +609,34 @@ import { CRM_RECIPE_INSTALL_ROUTE, CRM_RECIPE_STATUS_ROUTE, crmRecipeInstallHand
             }
             companyName = typed(companySnapshot.get('name'), 120) || companyName;
         }
-        const result = await captureHostContact(_extends({
+        const facet = _extends({}, phone ? {
+            phone
+        } : {}, jobTitle ? {
+            jobTitle
+        } : {}, Object.fromEntries(Object.entries(_extends({}, extras, {
+            salutation
+        })).filter(([key, value])=>key !== 'doNotCall' && key !== 'otherAddress' && typeof value === 'string' && value)), extras.otherAddress ? {
+            otherAddress: extras.otherAddress
+        } : {}, extras.doNotCall ? {
+            doNotCall: true
+        } : {}, companyId ? {
+            companyId
+        } : {}, address ? {
+            address
+        } : {}, ownerUid ? {
+            ownerUid
+        } : {}, custom && Object.keys(custom).length ? {
+            custom
+        } : {});
+        const stage = rawStage && isContactLifecycleStage(rawStage) ? {
+            lifecycleStage: rawStage
+        } : {};
+        // A site and an address are a capture. Anything less is the team adding a
+        // person no capture door could take (AGL-4122).
+        const captured = Boolean(hostId && email);
+        const result = captured ? await captureHostContact(_extends({
             hostId,
-            email
+            email: email
         }, name ? {
             name
         } : {}, {
@@ -543,28 +653,24 @@ import { CRM_RECIPE_INSTALL_ROUTE, CRM_RECIPE_STATUS_ROUTE, crmRecipeInstallHand
         }, marketingConsent && disclosedConsentGroup ? {
             disclosedConsentGroup
         } : {}, {
-            facet: _extends({}, phone ? {
-                phone
-            } : {}, jobTitle ? {
-                jobTitle
-            } : {}, Object.fromEntries(Object.entries(_extends({}, extras, {
-                salutation
-            })).filter(([key, value])=>key !== 'doNotCall' && key !== 'otherAddress' && typeof value === 'string' && value)), extras.otherAddress ? {
-                otherAddress: extras.otherAddress
-            } : {}, extras.doNotCall ? {
-                doNotCall: true
-            } : {}, companyId ? {
-                companyId
-            } : {}, address ? {
-                address
-            } : {}, ownerUid ? {
-                ownerUid
-            } : {}, rawStage && isContactLifecycleStage(rawStage) ? {
-                lifecycleStage: rawStage
-            } : {}, custom && Object.keys(custom).length ? {
-                custom
-            } : {})
-        }));
+            // The door's stage is the one the drawer picked, or none at all.
+            facet: _extends({}, facet, stage /* lifecycleStage */ )
+        })) : await addContactByHand(_extends({
+            orgId: resolved.orgId,
+            org: resolved.org,
+            sourceHostId: hostId || null,
+            email
+        }, name ? {
+            name
+        } : {}, {
+            facet: _extends({}, facet, stage, companyName ? {
+                companyName
+            } : {}),
+            tags,
+            marketingConsent
+        }, disclosedConsentGroup ? {
+            disclosedConsentGroup
+        } : {}));
         if ('refused' in result) {
             if (result.refused === 'band') {
                 res.status(409).json({
@@ -594,7 +700,7 @@ import { CRM_RECIPE_INSTALL_ROUTE, CRM_RECIPE_STATUS_ROUTE, crmRecipeInstallHand
             });
             return;
         }
-        if (tags.length || companyName) {
+        if (captured && (tags.length || companyName)) {
             const group = await consentGroupForSite(hostId, resolved.org);
             const contacts = await orgDataCollectionForHost(hostId, 'contacts');
             await contacts.doc(result.contactId).update(_extends({}, tags.length ? {
@@ -616,14 +722,17 @@ import { CRM_RECIPE_INSTALL_ROUTE, CRM_RECIPE_STATUS_ROUTE, crmRecipeInstallHand
      * reason `check-activity-coverage.mjs` counts this file. A merge into
      * a person the org already held is said to be one — the row was
      * updated, not added — so the feed cannot claim two people for one.
-     */ await logHostActivity(hostId, {
+     */ const added = result.created ? 'Added contact' : 'Updated contact';
+        const addedActor = {
             uid: decoded.uid,
             email: (_decoded_email = decoded.email) != null ? _decoded_email : null
-        }, result.created ? 'Added contact' : 'Updated contact', {
+        };
+        const addedTarget = {
             type: 'contact',
             id: result.contactId,
-            name: name || composeContactName(extras.firstName, extras.lastName) || email
-        });
+            name: name || composeContactName(extras.firstName, extras.lastName) || email || phone || ''
+        };
+        await (hostId ? logHostActivity(hostId, addedActor, added, addedTarget) : logOrgActivity(resolved.orgId, addedActor, added, addedTarget));
         res.status(result.created ? 201 : 200).json({
             contactId: result.contactId,
             created: result.created

package/src/lib/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/plugins/crm/src/lib/server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The Contacts plugin's SERVER half (AGL-2595).\n *\n * Contacts CRM v1 had none: every console write was client-direct against\n * the Firestore rules, and the one server path that creates a contact —\n * `upsertHostContact` — belongs to the capture doors, not to this plugin.\n * v2 needs a server for the things a browser must not do alone: an import\n * that dedupes forty thousand rows, a bulk action over a selection, an\n * auto-association of contacts to companies by domain. Each of those lands\n * as a `crm/<route>` handler registered here.\n *\n * `crm/ping` exists so the wiring is PROVEN rather than assumed:\n * `plugins.config.json` names this module's register function and the\n * `crm` API prefix, the generated server manifest loads this file, and the\n * console's `/api/[...pluginApi]` dispatcher reaches the handler. A plugin\n * whose first real route also had to be its first wiring test would have\n * two things to debug at once.\n *\n * The real routes are the writes with a side effect outside the document:\n * `crm/contact-stage` (AGL-2605) exists for the EVENT — `contactStageChanged`\n * can only be emitted by a server path that performed the write, so a record\n * page that moved the stage client-direct would move the person and tell no\n * automation; the task routes (AGL-2599) carry an assignee's notification and\n * the `taskCompleted` event. Every CRM file is imported through the\n * transfer framework (AGL-3527, AGL-3528, `transfer/`), whose writes go\n * through the same doors every other server path uses.\n * `crm/deal-stage` (AGL-2598) is the one writer of a deal's stage, won and lost,\n * because a stage change is what automations listen for (`server-deal-stage.ts`).\n * `crm/contacts-create` (AGL-2596) is a person typed into the console by a\n * member of the team — a server route because the dedupe against every\n * holder's rows and the audience band are judgments the browser cannot make.\n * `crm/contact-update` (AGL-2804) is every other write to a contact's facets:\n * the rules cannot tell one field of a holder's facet from another, so they\n * leave a client nothing there, and the plan is asked here about the fields\n * a save carries. `crm/contact-remove` (AGL-3338) is a holder letting a\n * contact go: the refusals the document holds are kept, which a client\n * write could not be trusted to do.\n */\n\nimport { registerDealFigureReaders } from './server/deal-figures'\nimport { registerPeopleFigureReader } from './server/people-figures'\nimport {\n  CONTACT_ERASED_MESSAGE,\n  CONTACT_FIELDS_MAX_PER_ORG,\n  contactFacetPath,\n  composeContactName,\n  type ContactCustomValue,\n  type ContactFieldDefinition,\n  CRM_COLLECTIONS,\n  CRM_SALUTATION_PICKLIST,\n  crmReadTokens,\n  isContactLifecycleStage,\n  isOrgWideMember,\n  judgeCrmPicklistValue,\n  normalizeAddress,\n  normalizeContactEmail,\n  normalizePhone,\n  type AglynPostalAddress,\n  type PluginApiHandler,\n  type PluginApiRequest,\n  readContactFacet,\n  readCrmCustomInput,\n  registerPluginApiRoute,\n  visibleToHost,\n} from '@aglyn/aglyn/server'\nimport {\n  consentGroupForSite,\n  firebaseAdmin,\n  getOrgForHost,\n  logHostActivity,\n  memberHasOrgPermission,\n  orgDataCollectionForHost,\n  resolveOrgMembership,\n  restampCrmListFieldsAt,\n} from '@aglyn/tenant-data-admin'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport { emitHostEvent } from '@aglyn/tenant-runtime'\nimport { captureHostContact } from './server/capture-host-contact'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { CRM_API_ROUTES } from './constants/api-routes'\nimport { registerCrmServerDeclarations } from './declarations.server'\nimport { BUNDLE_ID } from './constants/bundle-common'\nimport { CRM_NEXT_ACTIVITY_ROUTE } from './model/next-activity'\nimport { CRM_LIST_FIELDS_ROUTE } from './model/list-fields'\nimport { CRM_LEAD_SOURCE_VALUES_ROUTE, CRM_PICKLIST_VALUES_ROUTE } from './model/picklist-values'\nimport { CRM_TASK_ROUTES } from './model/task-routes'\nimport { crmNextActivityHandler } from './server/next-activity-routes'\nimport { crmListFieldsHandler } from './server/list-fields-routes'\nimport { crmLeadSourceValuesHandler, crmPicklistValuesHandler } from './server/picklist-values'\nimport { registerCrmRecordEmailStateWriter } from './server/record-email-state'\nimport { registerCrmRecordTimelineWriter } from './server/record-timeline'\nimport { crmTaskCompleteHandler, crmTaskSaveHandler } from './server/task-routes'\nimport { crmDealStageHandler } from './server-deal-stage'\nimport { crmEmailSendHandler } from './server/email-send'\nimport { CRM_EMAIL_CHECK_ROUTE, crmEmailCheckHandler } from './server/email-check'\nimport { leadConvertHandler } from './server/lead-convert'\nimport { leadCreateHandler } from './server/lead-create'\nimport {\n  CONTACT_EMAIL_HISTORY_ROUTE,\n  contactEmailHistoryHandler,\n} from './server/contact-email-history'\nimport { CONTACTS_MERGE_ROUTE, contactsMergeHandler } from './server/contacts-merge'\nimport { CRM_ERASE_PERSON_ROUTE, crmErasePersonHandler } from './server/erase-person'\nimport { CRM_ORG_ACTIVITY_ROUTE, crmOrgActivityHandler } from './server/org-activity'\nimport { CRM_INBOUND_ADDRESS_ROUTE, crmInboundAddressHandler } from './server/inbound-address'\nimport { crmCompanyDeleteHandler } from './server/company-delete'\nimport { crmSharingHandler } from './server/crm-sharing'\nimport { CRM_SHARING_ROUTE } from './model/crm-sharing'\nimport { CONTACT_PHONE_REFUSAL, normalizeTags, typed } from './server/contact-profile'\nimport { crmContactUpdateHandler, readContactCreateProfile } from './server/contact-update'\nimport { readCrmPicklist } from './server/read-picklist'\nimport { crmContactRemoveHandler } from './server/contact-remove'\nimport {\n  CRM_EMAIL_TEMPLATE_DUPLICATE_ROUTE,\n  crmEmailTemplateDuplicateHandler,\n} from './server/email-template-duplicate'\nimport { registerCrmRecordFactsReaders } from './server/record-facts'\nimport { crmSuiteRefusal } from './server/suite-gate'\nimport {\n  CRM_RECIPE_INSTALL_ROUTE,\n  CRM_RECIPE_STATUS_ROUTE,\n  crmRecipeInstallHandler,\n  crmRecipeStatusHandler,\n} from './server/recipe-routes'\n\n/**\n * `GET /api/crm/ping` → `{ ok: true, plugin: 'crm' }`.\n *\n * No auth, no host, no data: it answers whether the plugin's server bundle\n * was loaded and its routes registered, which is a fact about the process\n * and not about any org. Anything that reads a document goes behind the\n * same session and role checks the other plugins' console routes use.\n */\nexport const crmPingHandler: PluginApiHandler = (req, res) => {\n  if (req.method !== 'GET') {\n    res.setHeader('Allow', 'GET')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  res.status(200).json({ ok: true, plugin: BUNDLE_ID })\n}\n\ntype Refusal = { ok: false; status: number; error: string }\n\n/**\n * Who is calling, and whether they may edit this site's CRM.\n *\n * The same check the inbox, bookings and email console routes make: a\n * bearer ID token, verified, and an `admin` or `editor` role on the host\n * document. A contact is a site's business record, so the site's own role\n * map is the right authority; org-wide reach is not required, because a\n * site editor who can open the record in the console can already write\n * every other field on it client-direct.\n */\nasync function authorizeSiteEditor(\n  req: PluginApiRequest,\n  hostId: string,\n): Promise<{ ok: true; uid: string; email: string | null } | Refusal> {\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return { ok: false, status: 401, error: 'Unauthenticated' }\n  let uid: string\n  let email: string | null\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    uid = decoded.uid\n    email = typeof decoded.email === 'string' ? decoded.email : null\n  } catch (error) {\n    // A refused credential is the caller's 401; a failure to check one is\n    // ours and keeps a 5xx (AGL-2852).\n    if (isRefusedIdToken(error)) return { ok: false, status: 401, error: 'Unauthenticated' }\n    console.error('[crm] the site editor could not be verified', error)\n    return { ok: false, status: 500, error: 'The sign-in could not be checked. Try again.' }\n  }\n  const hostSnapshot = await firebaseAdmin\n    .app()\n    .firestore()\n    .collection('hosts')\n    .doc(hostId)\n    .get()\n  if (!hostSnapshot.exists) {\n    return { ok: false, status: 404, error: 'Unknown site' }\n  }\n  const memberRole = (hostSnapshot.get('memberRoles') ?? {})[uid]\n  if (memberRole !== 'admin' && memberRole !== 'editor') {\n    return { ok: false, status: 403, error: 'Not a site admin or editor' }\n  }\n  return { ok: true, uid, email }\n}\n\n/**\n * `POST /api/crm/contact-stage` with `{ hostId, contactId, lifecycleStage }`.\n *\n * Writes the stage into THIS site's facet on the contact — a dotted\n * `update()`, never a top-level field, because the row is shared by every\n * site in the org and a stage is one holder's reading of the person — and\n * then announces `contactStageChanged` with the stage it replaced.\n *\n * A stage set to what it already is writes nothing and announces nothing:\n * the response says `changed: false`, and no automation listening for a\n * change hears one that did not happen.\n *\n * `lifecycleStage: null` CLEARS the stage (AGL-2804). A facet is the\n * server's to write, so \"not placed yet\" comes through the route that owns\n * the stage rather than as a client-direct delete, and it is refused to a\n * plan without the suite the way a move is. There is no event for \"no\n * stage\", so a clear announces nothing; an empty string names no stage and\n * is refused like any other the list does not have.\n *\n * The contact is looked up by id and then checked against `visibleTo`,\n * because the Admin SDK evaluates no rules: a caller who can edit site A\n * must not be able to restage a contact only site B holds by guessing its\n * id, and the scoped query the list uses is not available to a `doc()` read.\n */\nexport const contactStageHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  const hostId = String(req.body?.hostId ?? '').trim()\n  const contactId = String(req.body?.contactId ?? '').trim()\n  const requested: unknown = req.body?.lifecycleStage\n  if (!hostId || !contactId) {\n    res.status(400).json({ error: 'Missing hostId or contactId' })\n    return\n  }\n  // `null` clears the stage; anything else has to be one of the list's.\n  const clearing = requested === null\n  const lifecycleStage = clearing\n    ? ''\n    : isContactLifecycleStage(requested)\n      ? requested\n      : null\n  if (lifecycleStage === null) {\n    res.status(400).json({ error: 'Pick a lifecycle stage' })\n    return\n  }\n  const caller = await authorizeSiteEditor(req, hostId)\n  if (caller.ok === false) {\n    res.status(caller.status).json({ error: caller.error })\n    return\n  }\n  try {\n    // A lifecycle stage is the suite's (AGL-2787) — see `suite-gate.ts`.\n    const owner = await getOrgForHost(hostId)\n    if (!owner) {\n      res.status(404).json({ error: 'Unknown site' })\n      return\n    }\n    const suite = crmSuiteRefusal(owner.org, \"Moving a contact's lifecycle stage\")\n    if (suite) {\n      res.status(suite.status).json(suite.body)\n      return\n    }\n    const contactsRef = await orgDataCollectionForHost(hostId, 'contacts')\n    const snapshot = await contactsRef.doc(contactId).get()\n    if (!snapshot.exists || !visibleToHost(snapshot.get('visibleTo'), hostId)) {\n      res.status(404).json({ error: 'Unknown contact' })\n      return\n    }\n    const group = await consentGroupForSite(hostId)\n    const facet = readContactFacet(\n      snapshot.data() as Record<string, unknown>,\n      group.groupId,\n    )\n    const previousStage = facet.lifecycleStage ?? ''\n    if (previousStage === lifecycleStage) {\n      res\n        .status(200)\n        .json({ ok: true, changed: false, lifecycleStage, previousStage })\n      return\n    }\n    await snapshot.ref.update({\n      [contactFacetPath(group.groupId, 'lifecycleStage')]: clearing\n        ? FieldValue.delete()\n        : lifecycleStage,\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n    // The stage is what the Contacts list filters by (AGL-3321).\n    await restampCrmListFieldsAt(snapshot.ref, 'contacts')\n    // Awaited, not floated: a serverless response ending cancels in-flight\n    // work, and the event is the reason this route exists. A clear has none.\n    if (!clearing) {\n      await emitHostEvent(\n        hostId,\n        'contactStageChanged',\n        {\n          contactId,\n          email: String(snapshot.get('email') ?? ''),\n          lifecycleStage,\n          previousStage,\n        },\n        { actor: { kind: 'member', uid: caller.uid, email: caller.email } },\n      )\n    }\n    res\n      .status(200)\n      .json({ ok: true, changed: true, lifecycleStage, previousStage })\n  } catch (error) {\n    console.error('[crm] contact-stage failed', hostId, contactId, error)\n    res.status(500).json({ error: 'The stage could not be changed' })\n  }\n}\n\n/**\n * What the create route says when the band refused (AGL-2596).\n *\n * The contacts list's own alert, in the past tense: the list says new\n * visitors are \"no longer captured\", and this says the one contact the\n * reader just tried to add was not. The remedy is the same sentence in both\n * places, so a reader who sees one and then the other is told one thing.\n */\nexport const CONTACT_BAND_FULL_MESSAGE =\n  'Contact limit reached — this contact was not added. Upgrade in Billing ' +\n  'to keep collecting.'\n\n/**\n * `POST /api/crm/contacts-create` — a person added by hand (AGL-2596).\n *\n * Body: `{ hostId, email, name?, phone?, jobTitle?, companyName?,\n * companyId?, address?, ownerUid?, lifecycleStage?, tags?,\n * marketingConsent?, disclosedConsentGroup? }`, plus any of Salesforce's\n * standard contact fields `crm/contact-update` reads but the reports-to\n * (`CONTACT_CREATE_PROFILE_FIELDS`, AGL-3515) — read by the same rules, the\n * salutation judged against the org's list, and the holder's name composed\n * from a first and last name when either is given. Answers\n * `{ contactId, created }`: `created` is\n * false when the address already belonged to somebody, in which case what\n * was typed MERGES into the existing row — the dedupe the shared address\n * book exists for, and the reason a second \"create\" of one person is not\n * an error.\n *\n * ## Who may call it\n *\n * The caller's ID token, then `data.manage` on the site's org — the same key\n * the console surface itself is gated on, resolved through the same\n * three-layer permission read the members route uses. A scoped member is\n * admitted only for a site they reach: the rules would refuse a browser\n * write outside their tokens, and a server route that admitted it would be\n * a way round the rules rather than a service in front of them.\n *\n * ## What it refuses, and how\n *\n * A malformed email or phone number is a 400 with a sentence the drawer can\n * show under the field. The band is a 409 carrying the list's own wording:\n * it is not a bad request and not a server fault, it is the plan saying no,\n * and the drawer relays the sentence rather than inventing one.\n *\n * ## The company (AGL-2613)\n *\n * `companyId` is the picker's choice, and it is checked before anything is\n * written: the company has to exist and be visible to the capturing site's\n * scope, or a caller could file a person under a record they cannot open —\n * the same refusal the lead conversion makes. It reaches the upsert as\n * `facet.companyId`, which is where the link is kept in step with its mirror\n * and the company's contacts count; a merge onto somebody already at another\n * company is a MOVE there, not a second link. The stored company's own name\n * is what is echoed, over whatever the client sent, because the name on the\n * record is the company's and not the form's.\n *\n * ## What it writes beyond the upsert\n *\n * `upsertHostContact` takes the profile — phone, title, address, owner,\n * stage, company — and writes it into the capturing group's facet. The two\n * things it does not take are written here by DOTTED path afterwards: the\n * tags, which union into whatever the person already carried, and the\n * company name — the picked company's, or free text for a person filed\n * under a name no company record carries yet. Dotted paths because this is\n * an `update()`, and only an update reads a dot as a path — a nested object\n * here would replace the facet map and take every other holder's records\n * with it.\n */\nexport const crmContactsCreateHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n\n  const body = (req.body ?? {}) as Record<string, unknown>\n  const hostId = typed(body['hostId'], 128)\n  if (!hostId) {\n    res.status(400).json({ error: 'Missing hostId' })\n    return\n  }\n  const email = normalizeContactEmail(body['email'])\n  if (!email) {\n    res.status(400).json({ error: 'Enter a valid email address.' })\n    return\n  }\n  const rawPhone = typed(body['phone'], 40)\n  const phone = rawPhone ? normalizePhone(rawPhone) : null\n  if (rawPhone && !phone) {\n    res.status(400).json({ error: CONTACT_PHONE_REFUSAL })\n    return\n  }\n  const rawStage = typed(body['lifecycleStage'], 40)\n  if (rawStage && !isContactLifecycleStage(rawStage)) {\n    res.status(400).json({ error: 'Unknown lifecycle stage.' })\n    return\n  }\n  const profile = readContactCreateProfile(body)\n  if (profile.ok === false) {\n    res.status(400).json({ error: profile.error })\n    return\n  }\n  const extras = profile.fields\n  const name = typed(body['name'], 120)\n  const jobTitle = typed(body['jobTitle'], 120)\n  let companyName = typed(body['companyName'], 120)\n  const companyId = typed(body['companyId'], 128)\n  const ownerUid = typed(body['ownerUid'], 128)\n  const address =\n    body['address'] && typeof body['address'] === 'object'\n      ? normalizeAddress(body['address'] as AglynPostalAddress)\n      : null\n  const tags = normalizeTags(body['tags'])\n  const marketingConsent = body['marketingConsent'] === true\n  // The key of the consent-group sentence the drawer showed beside the box\n  // (AGL-3320): the opt-in covers the site's group only while it is the\n  // group's current one, and the capturing site alone otherwise.\n  const disclosedConsentGroup = typed(body['disclosedConsentGroup'], 64)\n  // The org's own contact fields, sent in this same call (AGL-3971): a\n  // value the create dropped would read as saved and be gone, and a second\n  // write after it could land half. Judged below against the definitions.\n  const rawCustom = body['custom']\n  if (\n    rawCustom !== undefined &&\n    (!rawCustom || typeof rawCustom !== 'object' || Array.isArray(rawCustom))\n  ) {\n    res.status(400).json({ error: 'Custom fields must be values keyed by field key.' })\n    return\n  }\n\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) {\n    res.status(401).json({ error: 'Unauthenticated' })\n    return\n  }\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const resolved = await getOrgForHost(hostId)\n    if (!resolved) {\n      res.status(404).json({ error: 'Unknown site' })\n      return\n    }\n    const isStaff = decoded['staff'] === true\n    if (!isStaff) {\n      const membership = await resolveOrgMembership(decoded.uid, resolved.orgId)\n      const member = membership?.member ?? null\n      const reaches =\n        isOrgWideMember(member) || Boolean(member?.hostAccess?.[hostId])\n      const allowed =\n        member &&\n        reaches &&\n        (await memberHasOrgPermission(resolved.orgId, member, 'data.manage'))\n      if (!allowed) {\n        res.status(403).json({\n          error: 'Adding contacts requires the data.manage permission on this site',\n        })\n        return\n      }\n    }\n\n    // A person typed in by the team is the suite's; the capture doors that\n    // fill a Free workspace's contacts do not come through here (AGL-2787).\n    const suite = crmSuiteRefusal(resolved.org, 'Adding a contact by hand')\n    if (suite) {\n      res.status(suite.status).json(suite.body)\n      return\n    }\n\n    // The salutation, judged against the org's list (AGL-3515).\n    let salutation = ''\n    if (extras.salutation) {\n      const judged = judgeCrmPicklistValue(\n        CRM_SALUTATION_PICKLIST,\n        await readCrmPicklist(\n          firebaseAdmin.app().firestore(),\n          resolved.orgId,\n          CRM_SALUTATION_PICKLIST,\n        ),\n        extras.salutation,\n      )\n      if (judged.ok === false) {\n        res.status(400).json({ error: judged.error })\n        return\n      }\n      salutation = judged.value ?? ''\n    }\n\n    /*\n     * The custom values, judged exactly as `crm/contact-update` judges them\n     * (AGL-3971): the org's definitions read only when the body carried a\n     * map, an unknown, retired or mistyped key refused with the definition\n     * reader's own sentence, and a currency amount stored as that field's\n     * minor units. Before any write, so a refusal leaves nothing behind.\n     */\n    let custom: Record<string, ContactCustomValue> | undefined\n    if (rawCustom !== undefined) {\n      const definitions = await firebaseAdmin\n        .app()\n        .firestore()\n        .collection('orgs')\n        .doc(resolved.orgId)\n        .collection(CRM_COLLECTIONS.contactFields)\n        .limit(CONTACT_FIELDS_MAX_PER_ORG)\n        .get()\n      const judged = readCrmCustomInput(\n        rawCustom,\n        definitions.docs.map((entry) => entry.data() as ContactFieldDefinition),\n        'contact',\n      )\n      if ('errors' in judged) {\n        const [field, message] = Object.entries(judged.errors)[0] ?? []\n        res.status(400).json({\n          error: message ?? 'A custom value could not be saved.',\n          ...(field ? { field } : {}),\n        })\n        return\n      }\n      custom = judged.values\n    }\n\n    if (companyId) {\n      const group = await consentGroupForSite(\n        hostId,\n        resolved.org as Record<string, unknown>,\n      )\n      const readable = new Set<string>(crmReadTokens(group))\n      const companySnapshot = await firebaseAdmin\n        .app()\n        .firestore()\n        .collection('orgs')\n        .doc(resolved.orgId)\n        .collection(CRM_COLLECTIONS.companies)\n        .doc(companyId)\n        .get()\n      const tokens: unknown = companySnapshot.exists\n        ? companySnapshot.get('visibleTo')\n        : undefined\n      const visible =\n        Array.isArray(tokens) && tokens.some((token) => readable.has(String(token)))\n      if (!visible) {\n        res.status(404).json({ error: 'Unknown company' })\n        return\n      }\n      companyName = typed(companySnapshot.get('name'), 120) || companyName\n    }\n\n    const result = await captureHostContact({\n      hostId,\n      email,\n      ...(name ? { name } : {}),\n      source: 'manual',\n      interaction: { summary: 'Added by hand' },\n      actor: {\n        kind: 'member',\n        uid: decoded.uid,\n        email: typeof decoded.email === 'string' ? decoded.email : null,\n      },\n      marketingConsent,\n      ...(marketingConsent && disclosedConsentGroup\n        ? { disclosedConsentGroup }\n        : {}),\n      facet: {\n        ...(phone ? { phone } : {}),\n        ...(jobTitle ? { jobTitle } : {}),\n        // Salesforce's standard fields (AGL-3515); the capture composes the\n        // holder's name from the first and last names.\n        ...Object.fromEntries(\n          Object.entries({ ...extras, salutation }).filter(\n            ([key, value]) =>\n              key !== 'doNotCall' && key !== 'otherAddress' && typeof value === 'string' && value,\n          ),\n        ),\n        ...(extras.otherAddress ? { otherAddress: extras.otherAddress } : {}),\n        ...(extras.doNotCall ? { doNotCall: true } : {}),\n        ...(companyId ? { companyId } : {}),\n        ...(address ? { address } : {}),\n        ...(ownerUid ? { ownerUid } : {}),\n        ...(rawStage && isContactLifecycleStage(rawStage)\n          ? { lifecycleStage: rawStage }\n          : {}),\n        // Written nested into the capturing holder's facet by the upsert,\n        // on a new person and on a merge alike.\n        ...(custom && Object.keys(custom).length ? { custom } : {}),\n      },\n    })\n\n    if ('refused' in result) {\n      if (result.refused === 'band') {\n        res.status(409).json({ error: CONTACT_BAND_FULL_MESSAGE, reason: 'band' })\n        return\n      }\n      if (result.refused === 'invalid-email') {\n        res.status(400).json({ error: 'Enter a valid email address.' })\n        return\n      }\n      // The person was erased from this workspace (AGL-2623). A conflict,\n      // like the band: the request was well-formed and the answer is a\n      // standing fact about the address, not a fault in the call.\n      if (result.refused === 'erased') {\n        res.status(409).json({ error: CONTACT_ERASED_MESSAGE, reason: 'erased' })\n        return\n      }\n      res.status(500).json({ error: 'The contact could not be saved.' })\n      return\n    }\n\n    if (tags.length || companyName) {\n      const group = await consentGroupForSite(\n        hostId,\n        resolved.org as Record<string, unknown>,\n      )\n      const contacts = await orgDataCollectionForHost(hostId, 'contacts')\n      await contacts.doc(result.contactId).update({\n        ...(tags.length\n          ? {\n              [contactFacetPath(group.groupId, 'tags')]: FieldValue.arrayUnion(\n                ...tags,\n              ),\n            }\n          : {}),\n        ...(companyName\n          ? {\n              [contactFacetPath(group.groupId, 'companyName')]: companyName,\n              // The search echo — see `HostContact.companyName`.\n              companyName,\n            }\n          : {}),\n        updatedAt: FieldValue.serverTimestamp(),\n      })\n      // The tags are what the Contacts list filters by (AGL-3321).\n      await restampCrmListFieldsAt(contacts.doc(result.contactId), 'contacts')\n    }\n\n    /*\n     * The audit line, written HERE rather than by the console (AGL-2622):\n     * a route that verified the caller and performed the write is the one\n     * writer that cannot record an act that did not happen, which is the\n     * reason `check-activity-coverage.mjs` counts this file. A merge into\n     * a person the org already held is said to be one — the row was\n     * updated, not added — so the feed cannot claim two people for one.\n     */\n    await logHostActivity(\n      hostId,\n      { uid: decoded.uid, email: decoded.email ?? null },\n      result.created ? 'Added contact' : 'Updated contact',\n      {\n        type: 'contact',\n        id: result.contactId,\n        name: name || composeContactName(extras.firstName, extras.lastName) || email,\n      },\n    )\n\n    res\n      .status(result.created ? 201 : 200)\n      .json({ contactId: result.contactId, created: result.created })\n  } catch (error) {\n    console.error('[crm] contact create failed', error)\n    res.status(500).json({ error: 'The contact could not be saved.' })\n  }\n}\n\n/** Console API registration, named in `plugins.config.json` as `consoleApi`. */\nexport function registerCrmConsoleApi(): void {\n  // The pipeline and the deals closed, as figure tables (AGL-3603), for the\n  // AI plugin's insights to read by id; the console runs insight jobs.\n  registerDealFigureReaders(() => firebaseAdmin.app().firestore())\n  // And the leads and contacts gained over a window (AGL-3867), for the\n  // weekly summary and for insights.\n  registerPeopleFigureReader(() => firebaseAdmin.app().firestore())\n  /*\n   * The contact-capture writer, again (AGL-3080). Both apps run it at boot\n   * from their generated server-declarations manifest, and this is the\n   * backstop for a process whose boot did not: the first CRM door to load\n   * registers it. Registering twice replaces in place.\n   */\n  registerCrmServerDeclarations()\n  registerPluginApiRoute(CRM_API_ROUTES.ping, crmPingHandler)\n  registerPluginApiRoute(CRM_API_ROUTES.contactStage, contactStageHandler)\n  // Every other console write to a contact's facets (AGL-2804): the rules\n  // cannot tell one facet field from another, so the plan is asked here.\n  registerPluginApiRoute(CRM_API_ROUTES.contactUpdate, crmContactUpdateHandler)\n  registerPluginApiRoute(CRM_API_ROUTES.contactRemove, crmContactRemoveHandler)\n  // A company's contacts unlinked, then the company (AGL-2804): the unlink\n  // clears a facet, which is the server's to write.\n  registerPluginApiRoute(CRM_API_ROUTES.companyDelete, crmCompanyDeleteHandler)\n  // Tasks (AGL-2599): the two writes with a side effect outside the document\n  // — an assignee's notification, and the `taskCompleted` host event.\n  registerPluginApiRoute(CRM_TASK_ROUTES.save, crmTaskSaveHandler)\n  registerPluginApiRoute(CRM_TASK_ROUTES.complete, crmTaskCompleteHandler)\n  // A client-direct task write's door to `nextTaskAtMs` (AGL-2661).\n  registerPluginApiRoute(CRM_NEXT_ACTIVITY_ROUTE, crmNextActivityHandler)\n  // What a client-direct write the browser cannot follow up asks for: the\n  // fields the CRM lists query, restamped from the record (AGL-3321).\n  registerPluginApiRoute(CRM_LIST_FIELDS_ROUTE, crmListFieldsHandler)\n  // Sharing records with other sites (AGL-3336): a manager's share and\n  // unshare, the org's sharing rules and their recompute, and the rules'\n  // re-evaluation a client-direct write owes.\n  registerPluginApiRoute(CRM_SHARING_ROUTE, crmSharingHandler)\n  // A picklist value renamed or deleted (AGL-3298, AGL-3510): the list and\n  // every record holding the old label, in one request. The lead source's\n  // own address stays registered for a request that names no picklist.\n  registerPluginApiRoute(CRM_PICKLIST_VALUES_ROUTE, crmPicklistValuesHandler)\n  registerPluginApiRoute(CRM_LEAD_SOURCE_VALUES_ROUTE, crmLeadSourceValuesHandler)\n  // The one writer of a deal's stage, won and lost (AGL-2598): the browser\n  // could write the field, but only a server can emit the event an\n  // automation listens for.\n  registerPluginApiRoute('crm/deal-stage', crmDealStageHandler)\n  // A person typed into the console (AGL-2596): the capture doors' own\n  // function behind a session check, so the dedupe and the band are judged\n  // where every other door judges them.\n  registerPluginApiRoute('crm/contacts-create', crmContactsCreateHandler)\n  // A lead becomes a contact, a company and a deal (AGL-2608) — the one CRM\n  // write a browser cannot make alone, because only the server may create a\n  // contact through the dedupe-and-meter door.\n  registerPluginApiRoute('crm/lead-convert', leadConvertHandler)\n  // A lead entered by hand (AGL-3231): the New lead drawer's route.\n  registerPluginApiRoute('crm/leads-create', leadCreateHandler)\n  // The one READ behind a route (AGL-2616): the per-recipient delivery log\n  // is closed to clients, so a contact's campaign mail is projected here.\n  registerPluginApiRoute(CONTACT_EMAIL_HISTORY_ROUTE, contactEmailHistoryHandler)\n  // One email to one person from their record (AGL-2615): the recipient is\n  // read off the record, the daily cap and both suppression lists are\n  // judged, and the message leaves on the site's sending identity.\n  registerPluginApiRoute(CRM_API_ROUTES.emailSend, crmEmailSendHandler)\n  // What the platform knows about one address before somebody writes to it\n  // (AGL-3328): the gateway chip on a record page, and the composer's\n  // warning about a domain with no mail server or a gateway holding this\n  // site's mail. DNS and the ledger are the server's.\n  registerPluginApiRoute(CRM_EMAIL_CHECK_ROUTE, crmEmailCheckHandler)\n  // Two records for one person become one (AGL-2625): the repoint of every\n  // row naming the merged record and the transaction over both documents\n  // are the server's, and the address index it writes is closed to clients.\n  registerPluginApiRoute(CONTACTS_MERGE_ROUTE, contactsMergeHandler)\n  // Files a person's privacy erasure for the daily job (AGL-2623);\n  // workspace admins only.\n  registerPluginApiRoute(CRM_ERASE_PERSON_ROUTE, crmErasePersonHandler)\n  // One line in the organization's activity feed for an act the org-level\n  // hub performed client-direct (AGL-2634): the feed is closed to clients,\n  // so the bulk bars' lines come through here.\n  registerPluginApiRoute(CRM_ORG_ACTIVITY_ROUTE, crmOrgActivityHandler)\n  // A recipe's action written into one site's automations from the org\n  // hub (AGL-2639), stamped and deduplicated by the server, and the stamps\n  // read back per site so the hub can say which sites carry which recipe.\n  registerPluginApiRoute(CRM_RECIPE_INSTALL_ROUTE, crmRecipeInstallHandler)\n  registerPluginApiRoute(CRM_RECIPE_STATUS_ROUTE, crmRecipeStatusHandler)\n  // The workspace's email capture address (AGL-2657): the token is minted\n  // and rotated here, behind the CRM's own gate, and the org document that\n  // carries it is closed to every client.\n  registerPluginApiRoute(CRM_INBOUND_ADDRESS_ROUTE, crmInboundAddressHandler)\n  /*\n   * The three doors a MACHINE calls (AGL-3080), at the paths they have\n   * always answered on: the scheduler's daily digest and hourly task\n   * reminders, on the cron secret, and the mail provider's capture webhook,\n   * on its signature. None names a site or a member, so each is registered\n   * as a machine's route — the dispatcher leaves the plugin's release and\n   * enablement gates and its write limit to it — and each judges the CRM's\n   * plan and flag for every organization it resolves. Loaded with the\n   * first call, not with the surface.\n   */\n  registerPluginApiRoute(\n    CRM_API_ROUTES.dailyDigest,\n    {\n      web: async (request) =>\n        (await import('./server/daily-digest-route')).crmDailyDigestRoute(request),\n    },\n    { machine: true },\n  )\n  registerPluginApiRoute(\n    CRM_API_ROUTES.taskReminders,\n    {\n      web: async (request) =>\n        (await import('./server/task-reminders-route')).crmTaskRemindersRoute(request),\n    },\n    { machine: true },\n  )\n  registerPluginApiRoute(\n    CRM_API_ROUTES.inbound,\n    {\n      web: async (request) => (await import('./server/inbound-route')).crmInboundRoute(request),\n    },\n    { machine: true },\n  )\n  registerPluginApiRoute(\n    CRM_EMAIL_TEMPLATE_DUPLICATE_ROUTE,\n    crmEmailTemplateDuplicateHandler,\n  )\n  // The facts of a contact, company, deal or lead, and an import's field\n  // catalog, for another plugin in this process (AGL-2917): read on the core's\n  // record-facts seam under the rules every CRM door applies, and written\n  // nowhere.\n  registerCrmRecordFactsReaders()\n  // The CRM as the workspace's record system on the core's record-timeline\n  // seam (AGL-2981): another plugin files an email, a reply or a task on a\n  // record through it, under the CRM's own scope, dedupe and ceiling.\n  registerCrmRecordTimelineWriter()\n  // And on the record email-state seam (AGL-3245): a sender that filed a\n  // verdict on an address — a bounce, a complaint, an unsubscribe, a\n  // do-not-contact mark — stamps the lead and the contact through it.\n  registerCrmRecordEmailStateWriter()\n}\n\n// Type-only (AGL-3080): the plugin's entitlement keys, declared by module\n// augmentation, for every program that loads this entry point.\nexport type { crmPlanEntitlements } from './plan-entitlements'\n"],"names":["registerDealFigureReaders","registerPeopleFigureReader","CONTACT_ERASED_MESSAGE","CONTACT_FIELDS_MAX_PER_ORG","contactFacetPath","composeContactName","CRM_COLLECTIONS","CRM_SALUTATION_PICKLIST","crmReadTokens","isContactLifecycleStage","isOrgWideMember","judgeCrmPicklistValue","normalizeAddress","normalizeContactEmail","normalizePhone","readContactFacet","readCrmCustomInput","registerPluginApiRoute","visibleToHost","consentGroupForSite","firebaseAdmin","getOrgForHost","logHostActivity","memberHasOrgPermission","orgDataCollectionForHost","resolveOrgMembership","restampCrmListFieldsAt","isRefusedIdToken","emitHostEvent","captureHostContact","FieldValue","CRM_API_ROUTES","registerCrmServerDeclarations","BUNDLE_ID","CRM_NEXT_ACTIVITY_ROUTE","CRM_LIST_FIELDS_ROUTE","CRM_LEAD_SOURCE_VALUES_ROUTE","CRM_PICKLIST_VALUES_ROUTE","CRM_TASK_ROUTES","crmNextActivityHandler","crmListFieldsHandler","crmLeadSourceValuesHandler","crmPicklistValuesHandler","registerCrmRecordEmailStateWriter","registerCrmRecordTimelineWriter","crmTaskCompleteHandler","crmTaskSaveHandler","crmDealStageHandler","crmEmailSendHandler","CRM_EMAIL_CHECK_ROUTE","crmEmailCheckHandler","leadConvertHandler","leadCreateHandler","CONTACT_EMAIL_HISTORY_ROUTE","contactEmailHistoryHandler","CONTACTS_MERGE_ROUTE","contactsMergeHandler","CRM_ERASE_PERSON_ROUTE","crmErasePersonHandler","CRM_ORG_ACTIVITY_ROUTE","crmOrgActivityHandler","CRM_INBOUND_ADDRESS_ROUTE","crmInboundAddressHandler","crmCompanyDeleteHandler","crmSharingHandler","CRM_SHARING_ROUTE","CONTACT_PHONE_REFUSAL","normalizeTags","typed","crmContactUpdateHandler","readContactCreateProfile","readCrmPicklist","crmContactRemoveHandler","CRM_EMAIL_TEMPLATE_DUPLICATE_ROUTE","crmEmailTemplateDuplicateHandler","registerCrmRecordFactsReaders","crmSuiteRefusal","CRM_RECIPE_INSTALL_ROUTE","CRM_RECIPE_STATUS_ROUTE","crmRecipeInstallHandler","crmRecipeStatusHandler","crmPingHandler","req","res","method","setHeader","status","json","error","ok","plugin","authorizeSiteEditor","hostId","hostSnapshot","authorization","String","headers","idToken","startsWith","slice","length","undefined","uid","email","decoded","app","auth","verifyIdToken","console","firestore","collection","doc","get","exists","memberRole","contactStageHandler","body","trim","contactId","requested","lifecycleStage","clearing","caller","facet","owner","suite","org","contactsRef","snapshot","group","data","groupId","previousStage","changed","ref","update","delete","updatedAt","serverTimestamp","actor","kind","CONTACT_BAND_FULL_MESSAGE","crmContactsCreateHandler","rawPhone","phone","rawStage","profile","extras","fields","name","jobTitle","companyName","companyId","ownerUid","address","tags","marketingConsent","disclosedConsentGroup","rawCustom","Array","isArray","resolved","isStaff","member","membership","orgId","reaches","Boolean","hostAccess","allowed","salutation","judged","value","custom","definitions","contactFields","limit","docs","map","entry","Object","field","message","entries","errors","values","readable","Set","companySnapshot","companies","tokens","visible","some","token","has","result","source","interaction","summary","fromEntries","filter","key","otherAddress","doNotCall","keys","refused","reason","contacts","arrayUnion","created","type","id","firstName","lastName","registerCrmConsoleApi","ping","contactStage","contactUpdate","contactRemove","companyDelete","save","complete","emailSend","dailyDigest","web","request","crmDailyDigestRoute","machine","taskReminders","crmTaskRemindersRoute","inbound","crmInboundRoute"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCC,GAED,SAASA,yBAAyB,QAAQ,2BAAuB;AACjE,SAASC,0BAA0B,QAAQ,6BAAyB;AACpE,SACEC,sBAAsB,EACtBC,0BAA0B,EAC1BC,gBAAgB,EAChBC,kBAAkB,EAGlBC,eAAe,EACfC,uBAAuB,EACvBC,aAAa,EACbC,uBAAuB,EACvBC,eAAe,EACfC,qBAAqB,EACrBC,gBAAgB,EAChBC,qBAAqB,EACrBC,cAAc,EAIdC,gBAAgB,EAChBC,kBAAkB,EAClBC,sBAAsB,EACtBC,aAAa,QACR,sBAAqB;AAC5B,SACEC,mBAAmB,EACnBC,aAAa,EACbC,aAAa,EACbC,eAAe,EACfC,sBAAsB,EACtBC,wBAAwB,EACxBC,oBAAoB,EACpBC,sBAAsB,QACjB,2BAA0B;AACjC,SAASC,gBAAgB,QAAQ,mDAAkD;AACnF,SAASC,aAAa,QAAQ,wBAAuB;AACrD,SAASC,kBAAkB,QAAQ,mCAA+B;AAClE,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,cAAc,QAAQ,4BAAwB;AACvD,SAASC,6BAA6B,QAAQ,2BAAuB;AACrE,SAASC,SAAS,QAAQ,+BAA2B;AACrD,SAASC,uBAAuB,QAAQ,2BAAuB;AAC/D,SAASC,qBAAqB,QAAQ,yBAAqB;AAC3D,SAASC,4BAA4B,EAAEC,yBAAyB,QAAQ,6BAAyB;AACjG,SAASC,eAAe,QAAQ,yBAAqB;AACrD,SAASC,sBAAsB,QAAQ,mCAA+B;AACtE,SAASC,oBAAoB,QAAQ,iCAA6B;AAClE,SAASC,0BAA0B,EAAEC,wBAAwB,QAAQ,8BAA0B;AAC/F,SAASC,iCAAiC,QAAQ,iCAA6B;AAC/E,SAASC,+BAA+B,QAAQ,8BAA0B;AAC1E,SAASC,sBAAsB,EAAEC,kBAAkB,QAAQ,0BAAsB;AACjF,SAASC,mBAAmB,QAAQ,yBAAqB;AACzD,SAASC,mBAAmB,QAAQ,yBAAqB;AACzD,SAASC,qBAAqB,EAAEC,oBAAoB,QAAQ,0BAAsB;AAClF,SAASC,kBAAkB,QAAQ,2BAAuB;AAC1D,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SACEC,2BAA2B,EAC3BC,0BAA0B,QACrB,oCAAgC;AACvC,SAASC,oBAAoB,EAAEC,oBAAoB,QAAQ,6BAAyB;AACpF,SAASC,sBAAsB,EAAEC,qBAAqB,QAAQ,2BAAuB;AACrF,SAASC,sBAAsB,EAAEC,qBAAqB,QAAQ,2BAAuB;AACrF,SAASC,yBAAyB,EAAEC,wBAAwB,QAAQ,8BAA0B;AAC9F,SAASC,uBAAuB,QAAQ,6BAAyB;AACjE,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SAASC,iBAAiB,QAAQ,yBAAqB;AACvD,SAASC,qBAAqB,EAAEC,aAAa,EAAEC,KAAK,QAAQ,8BAA0B;AACtF,SAASC,uBAAuB,EAAEC,wBAAwB,QAAQ,6BAAyB;AAC3F,SAASC,eAAe,QAAQ,4BAAwB;AACxD,SAASC,uBAAuB,QAAQ,6BAAyB;AACjE,SACEC,kCAAkC,EAClCC,gCAAgC,QAC3B,uCAAmC;AAC1C,SAASC,6BAA6B,QAAQ,2BAAuB;AACrE,SAASC,eAAe,QAAQ,yBAAqB;AACrD,SACEC,wBAAwB,EACxBC,uBAAuB,EACvBC,uBAAuB,EACvBC,sBAAsB,QACjB,4BAAwB;AAE/B;;;;;;;CAOC,GACD,OAAO,MAAMC,iBAAmC,CAACC,KAAKC;IACpD,IAAID,IAAIE,MAAM,KAAK,OAAO;QACxBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACnD;IACF;IACAL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEE,IAAI;QAAMC,QAAQzD;IAAU;AACrD,EAAC;AAID;;;;;;;;;CASC,GACD,eAAe0D,oBACbT,GAAqB,EACrBU,MAAc;QAEeV,4BA2BTW;IA3BpB,MAAMC,gBAAgBC,QAAOb,6BAAAA,IAAIc,OAAO,CAACF,aAAa,YAAzBZ,6BAA6B;IAC1D,MAAMe,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAO;QAAER,IAAI;QAAOH,QAAQ;QAAKE,OAAO;IAAkB;IACxE,IAAIc;IACJ,IAAIC;IACJ,IAAI;QACF,MAAMC,UAAU,MAAMpF,cAAcqF,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACV;QAC/DK,MAAME,QAAQF,GAAG;QACjBC,QAAQ,OAAOC,QAAQD,KAAK,KAAK,WAAWC,QAAQD,KAAK,GAAG;IAC9D,EAAE,OAAOf,OAAO;QACd,sEAAsE;QACtE,mCAAmC;QACnC,IAAI7D,iBAAiB6D,QAAQ,OAAO;YAAEC,IAAI;YAAOH,QAAQ;YAAKE,OAAO;QAAkB;QACvFoB,QAAQpB,KAAK,CAAC,+CAA+CA;QAC7D,OAAO;YAAEC,IAAI;YAAOH,QAAQ;YAAKE,OAAO;QAA+C;IACzF;IACA,MAAMK,eAAe,MAAMzE,cACxBqF,GAAG,GACHI,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAACnB,QACJoB,GAAG;IACN,IAAI,CAACnB,aAAaoB,MAAM,EAAE;QACxB,OAAO;YAAExB,IAAI;YAAOH,QAAQ;YAAKE,OAAO;QAAe;IACzD;IACA,MAAM0B,aAAa,EAACrB,oBAAAA,aAAamB,GAAG,CAAC,0BAAjBnB,oBAAmC,CAAC,EAAE,CAACS,IAAI;IAC/D,IAAIY,eAAe,WAAWA,eAAe,UAAU;QACrD,OAAO;YAAEzB,IAAI;YAAOH,QAAQ;YAAKE,OAAO;QAA6B;IACvE;IACA,OAAO;QAAEC,IAAI;QAAMa;QAAKC;IAAM;AAChC;AAEA;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,OAAO,MAAMY,sBAAwC,OAAOjC,KAAKC;;QAMzCD,WACGA,YACEA;IAP3B,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACnD;IACF;IACA,MAAMI,SAASG,gBAAOb,YAAAA,IAAIkC,IAAI,qBAARlC,UAAUU,MAAM,mBAAI,IAAIyB,IAAI;IAClD,MAAMC,YAAYvB,iBAAOb,aAAAA,IAAIkC,IAAI,qBAARlC,WAAUoC,SAAS,oBAAI,IAAID,IAAI;IACxD,MAAME,aAAqBrC,aAAAA,IAAIkC,IAAI,qBAARlC,WAAUsC,cAAc;IACnD,IAAI,CAAC5B,UAAU,CAAC0B,WAAW;QACzBnC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA8B;QAC5D;IACF;IACA,sEAAsE;IACtE,MAAMiC,WAAWF,cAAc;IAC/B,MAAMC,iBAAiBC,WACnB,KACAhH,wBAAwB8G,aACtBA,YACA;IACN,IAAIC,mBAAmB,MAAM;QAC3BrC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAyB;QACvD;IACF;IACA,MAAMkC,SAAS,MAAM/B,oBAAoBT,KAAKU;IAC9C,IAAI8B,OAAOjC,EAAE,KAAK,OAAO;QACvBN,IAAIG,MAAM,CAACoC,OAAOpC,MAAM,EAAEC,IAAI,CAAC;YAAEC,OAAOkC,OAAOlC,KAAK;QAAC;QACrD;IACF;IACA,IAAI;YAuBoBmC;QAtBtB,qEAAqE;QACrE,MAAMC,QAAQ,MAAMvG,cAAcuE;QAClC,IAAI,CAACgC,OAAO;YACVzC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;YAC7C;QACF;QACA,MAAMqC,QAAQjD,gBAAgBgD,MAAME,GAAG,EAAE;QACzC,IAAID,OAAO;YACT1C,IAAIG,MAAM,CAACuC,MAAMvC,MAAM,EAAEC,IAAI,CAACsC,MAAMT,IAAI;YACxC;QACF;QACA,MAAMW,cAAc,MAAMvG,yBAAyBoE,QAAQ;QAC3D,MAAMoC,WAAW,MAAMD,YAAYhB,GAAG,CAACO,WAAWN,GAAG;QACrD,IAAI,CAACgB,SAASf,MAAM,IAAI,CAAC/F,cAAc8G,SAAShB,GAAG,CAAC,cAAcpB,SAAS;YACzET,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkB;YAChD;QACF;QACA,MAAMyC,QAAQ,MAAM9G,oBAAoByE;QACxC,MAAM+B,QAAQ5G,iBACZiH,SAASE,IAAI,IACbD,MAAME,OAAO;QAEf,MAAMC,iBAAgBT,wBAAAA,MAAMH,cAAc,YAApBG,wBAAwB;QAC9C,IAAIS,kBAAkBZ,gBAAgB;YACpCrC,IACGG,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAEE,IAAI;gBAAM4C,SAAS;gBAAOb;gBAAgBY;YAAc;YAClE;QACF;QACA,MAAMJ,SAASM,GAAG,CAACC,MAAM,CAAC;YACxB,CAACnI,iBAAiB6H,MAAME,OAAO,EAAE,kBAAkB,EAAEV,WACjD3F,WAAW0G,MAAM,KACjBhB;YACJiB,WAAW3G,WAAW4G,eAAe;QACvC;QACA,6DAA6D;QAC7D,MAAMhH,uBAAuBsG,SAASM,GAAG,EAAE;QAC3C,uEAAuE;QACvE,yEAAyE;QACzE,IAAI,CAACb,UAAU;gBAMKO;YALlB,MAAMpG,cACJgE,QACA,uBACA;gBACE0B;gBACAf,OAAOR,QAAOiC,gBAAAA,SAAShB,GAAG,CAAC,oBAAbgB,gBAAyB;gBACvCR;gBACAY;YACF,GACA;gBAAEO,OAAO;oBAAEC,MAAM;oBAAUtC,KAAKoB,OAAOpB,GAAG;oBAAEC,OAAOmB,OAAOnB,KAAK;gBAAC;YAAE;QAEtE;QACApB,IACGG,MAAM,CAAC,KACPC,IAAI,CAAC;YAAEE,IAAI;YAAM4C,SAAS;YAAMb;YAAgBY;QAAc;IACnE,EAAE,OAAO5C,OAAO;QACdoB,QAAQpB,KAAK,CAAC,8BAA8BI,QAAQ0B,WAAW9B;QAC/DL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiC;IACjE;AACF,EAAC;AAED;;;;;;;CAOC,GACD,OAAO,MAAMqD,4BACX,4EACA,sBAAqB;AAEvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDC,GACD,OAAO,MAAMC,2BAA6C,OAAO5D,KAAKC;QAOtDD,WAuDeA;IA7D7B,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACnD;IACF;IAEA,MAAM4B,QAAQlC,YAAAA,IAAIkC,IAAI,YAARlC,YAAY,CAAC;IAC3B,MAAMU,SAASxB,MAAMgD,IAAI,CAAC,SAAS,EAAE;IACrC,IAAI,CAACxB,QAAQ;QACXT,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;QAC/C;IACF;IACA,MAAMe,QAAQ1F,sBAAsBuG,IAAI,CAAC,QAAQ;IACjD,IAAI,CAACb,OAAO;QACVpB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA+B;QAC7D;IACF;IACA,MAAMuD,WAAW3E,MAAMgD,IAAI,CAAC,QAAQ,EAAE;IACtC,MAAM4B,QAAQD,WAAWjI,eAAeiI,YAAY;IACpD,IAAIA,YAAY,CAACC,OAAO;QACtB7D,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOtB;QAAsB;QACpD;IACF;IACA,MAAM+E,WAAW7E,MAAMgD,IAAI,CAAC,iBAAiB,EAAE;IAC/C,IAAI6B,YAAY,CAACxI,wBAAwBwI,WAAW;QAClD9D,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA2B;QACzD;IACF;IACA,MAAM0D,UAAU5E,yBAAyB8C;IACzC,IAAI8B,QAAQzD,EAAE,KAAK,OAAO;QACxBN,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO0D,QAAQ1D,KAAK;QAAC;QAC5C;IACF;IACA,MAAM2D,SAASD,QAAQE,MAAM;IAC7B,MAAMC,OAAOjF,MAAMgD,IAAI,CAAC,OAAO,EAAE;IACjC,MAAMkC,WAAWlF,MAAMgD,IAAI,CAAC,WAAW,EAAE;IACzC,IAAImC,cAAcnF,MAAMgD,IAAI,CAAC,cAAc,EAAE;IAC7C,MAAMoC,YAAYpF,MAAMgD,IAAI,CAAC,YAAY,EAAE;IAC3C,MAAMqC,WAAWrF,MAAMgD,IAAI,CAAC,WAAW,EAAE;IACzC,MAAMsC,UACJtC,IAAI,CAAC,UAAU,IAAI,OAAOA,IAAI,CAAC,UAAU,KAAK,WAC1CxG,iBAAiBwG,IAAI,CAAC,UAAU,IAChC;IACN,MAAMuC,OAAOxF,cAAciD,IAAI,CAAC,OAAO;IACvC,MAAMwC,mBAAmBxC,IAAI,CAAC,mBAAmB,KAAK;IACtD,yEAAyE;IACzE,sEAAsE;IACtE,+DAA+D;IAC/D,MAAMyC,wBAAwBzF,MAAMgD,IAAI,CAAC,wBAAwB,EAAE;IACnE,qEAAqE;IACrE,yEAAyE;IACzE,wEAAwE;IACxE,MAAM0C,YAAY1C,IAAI,CAAC,SAAS;IAChC,IACE0C,cAAczD,aACb,CAAA,CAACyD,aAAa,OAAOA,cAAc,YAAYC,MAAMC,OAAO,CAACF,UAAS,GACvE;QACA3E,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAmD;QACjF;IACF;IAEA,MAAMM,gBAAgBC,QAAOb,6BAAAA,IAAIc,OAAO,CAACF,aAAa,YAAzBZ,6BAA6B;IAC1D,MAAMe,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS;QACZd,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkB;QAChD;IACF;IAEA,IAAI;YAgN2BgB;QA/M7B,MAAMA,UAAU,MAAMpF,cAAcqF,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACV;QAC/D,MAAMgE,WAAW,MAAM5I,cAAcuE;QACrC,IAAI,CAACqE,UAAU;YACb9E,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;YAC7C;QACF;QACA,MAAM0E,UAAU1D,OAAO,CAAC,QAAQ,KAAK;QACrC,IAAI,CAAC0D,SAAS;;gBAIyBC;YAHrC,MAAMC,aAAa,MAAM3I,qBAAqB+E,QAAQF,GAAG,EAAE2D,SAASI,KAAK;YACzE,MAAMF,iBAASC,8BAAAA,WAAYD,MAAM,mBAAI;YACrC,MAAMG,UACJ5J,gBAAgByJ,WAAWI,QAAQJ,2BAAAA,qBAAAA,OAAQK,UAAU,qBAAlBL,kBAAoB,CAACvE,OAAO;YACjE,MAAM6E,UACJN,UACAG,WACC,MAAM/I,uBAAuB0I,SAASI,KAAK,EAAEF,QAAQ;YACxD,IAAI,CAACM,SAAS;gBACZtF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBACnBC,OAAO;gBACT;gBACA;YACF;QACF;QAEA,uEAAuE;QACvE,wEAAwE;QACxE,MAAMqC,QAAQjD,gBAAgBqF,SAASnC,GAAG,EAAE;QAC5C,IAAID,OAAO;YACT1C,IAAIG,MAAM,CAACuC,MAAMvC,MAAM,EAAEC,IAAI,CAACsC,MAAMT,IAAI;YACxC;QACF;QAEA,4DAA4D;QAC5D,IAAIsD,aAAa;QACjB,IAAIvB,OAAOuB,UAAU,EAAE;gBAcRC;YAbb,MAAMA,SAAShK,sBACbJ,yBACA,MAAMgE,gBACJnD,cAAcqF,GAAG,GAAGI,SAAS,IAC7BoD,SAASI,KAAK,EACd9J,0BAEF4I,OAAOuB,UAAU;YAEnB,IAAIC,OAAOlF,EAAE,KAAK,OAAO;gBACvBN,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAOmF,OAAOnF,KAAK;gBAAC;gBAC3C;YACF;YACAkF,cAAaC,gBAAAA,OAAOC,KAAK,YAAZD,gBAAgB;QAC/B;QAEA;;;;;;KAMC,GACD,IAAIE;QACJ,IAAIf,cAAczD,WAAW;YAC3B,MAAMyE,cAAc,MAAM1J,cACvBqF,GAAG,GACHI,SAAS,GACTC,UAAU,CAAC,QACXC,GAAG,CAACkD,SAASI,KAAK,EAClBvD,UAAU,CAACxG,gBAAgByK,aAAa,EACxCC,KAAK,CAAC7K,4BACN6G,GAAG;YACN,MAAM2D,SAAS3J,mBACb8I,WACAgB,YAAYG,IAAI,CAACC,GAAG,CAAC,CAACC,QAAUA,MAAMjD,IAAI,KAC1C;YAEF,IAAI,YAAYyC,QAAQ;oBACGS;gBAAzB,MAAM,CAACC,OAAOC,QAAQ,IAAGF,mBAAAA,OAAOG,OAAO,CAACZ,OAAOa,MAAM,CAAC,CAAC,EAAE,YAAhCJ,mBAAoC,EAAE;gBAC/DjG,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBACnBC,KAAK,EAAE8F,kBAAAA,UAAW;mBACdD,QAAQ;oBAAEA;gBAAM,IAAI,CAAC;gBAE3B;YACF;YACAR,SAASF,OAAOc,MAAM;QACxB;QAEA,IAAIjC,WAAW;YACb,MAAMvB,QAAQ,MAAM9G,oBAClByE,QACAqE,SAASnC,GAAG;YAEd,MAAM4D,WAAW,IAAIC,IAAYnL,cAAcyH;YAC/C,MAAM2D,kBAAkB,MAAMxK,cAC3BqF,GAAG,GACHI,SAAS,GACTC,UAAU,CAAC,QACXC,GAAG,CAACkD,SAASI,KAAK,EAClBvD,UAAU,CAACxG,gBAAgBuL,SAAS,EACpC9E,GAAG,CAACyC,WACJxC,GAAG;YACN,MAAM8E,SAAkBF,gBAAgB3E,MAAM,GAC1C2E,gBAAgB5E,GAAG,CAAC,eACpBX;YACJ,MAAM0F,UACJhC,MAAMC,OAAO,CAAC8B,WAAWA,OAAOE,IAAI,CAAC,CAACC,QAAUP,SAASQ,GAAG,CAACnG,OAAOkG;YACtE,IAAI,CAACF,SAAS;gBACZ5G,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAO;gBAAkB;gBAChD;YACF;YACA+D,cAAcnF,MAAMwH,gBAAgB5E,GAAG,CAAC,SAAS,QAAQuC;QAC3D;QAEA,MAAM4C,SAAS,MAAMtK,mBAAmB;YACtC+D;YACAW;WACI8C,OAAO;YAAEA;QAAK,IAAI,CAAC;YACvB+C,QAAQ;YACRC,aAAa;gBAAEC,SAAS;YAAgB;YACxC3D,OAAO;gBACLC,MAAM;gBACNtC,KAAKE,QAAQF,GAAG;gBAChBC,OAAO,OAAOC,QAAQD,KAAK,KAAK,WAAWC,QAAQD,KAAK,GAAG;YAC7D;YACAqD;WACIA,oBAAoBC,wBACpB;YAAEA;QAAsB,IACxB,CAAC;YACLlC,OAAO,aACDqB,QAAQ;gBAAEA;YAAM,IAAI,CAAC,GACrBM,WAAW;gBAAEA;YAAS,IAAI,CAAC,GAG5B8B,OAAOmB,WAAW,CACnBnB,OAAOG,OAAO,CAAC,aAAKpC;gBAAQuB;gBAAc8B,MAAM,CAC9C,CAAC,CAACC,KAAK7B,MAAM,GACX6B,QAAQ,eAAeA,QAAQ,kBAAkB,OAAO7B,UAAU,YAAYA,SAGhFzB,OAAOuD,YAAY,GAAG;gBAAEA,cAAcvD,OAAOuD,YAAY;YAAC,IAAI,CAAC,GAC/DvD,OAAOwD,SAAS,GAAG;gBAAEA,WAAW;YAAK,IAAI,CAAC,GAC1CnD,YAAY;gBAAEA;YAAU,IAAI,CAAC,GAC7BE,UAAU;gBAAEA;YAAQ,IAAI,CAAC,GACzBD,WAAW;gBAAEA;YAAS,IAAI,CAAC,GAC3BR,YAAYxI,wBAAwBwI,YACpC;gBAAEzB,gBAAgByB;YAAS,IAC3B,CAAC,GAGD4B,UAAUO,OAAOwB,IAAI,CAAC/B,QAAQzE,MAAM,GAAG;gBAAEyE;YAAO,IAAI,CAAC;;QAI7D,IAAI,aAAasB,QAAQ;YACvB,IAAIA,OAAOU,OAAO,KAAK,QAAQ;gBAC7B1H,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAOqD;oBAA2BiE,QAAQ;gBAAO;gBACxE;YACF;YACA,IAAIX,OAAOU,OAAO,KAAK,iBAAiB;gBACtC1H,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAO;gBAA+B;gBAC7D;YACF;YACA,oEAAoE;YACpE,iEAAiE;YACjE,4DAA4D;YAC5D,IAAI2G,OAAOU,OAAO,KAAK,UAAU;gBAC/B1H,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAOtF;oBAAwB4M,QAAQ;gBAAS;gBACvE;YACF;YACA3H,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkC;YAChE;QACF;QAEA,IAAImE,KAAKvD,MAAM,IAAImD,aAAa;YAC9B,MAAMtB,QAAQ,MAAM9G,oBAClByE,QACAqE,SAASnC,GAAG;YAEd,MAAMiF,WAAW,MAAMvL,yBAAyBoE,QAAQ;YACxD,MAAMmH,SAAShG,GAAG,CAACoF,OAAO7E,SAAS,EAAEiB,MAAM,CAAC,aACtCoB,KAAKvD,MAAM,GACX;gBACE,CAAChG,iBAAiB6H,MAAME,OAAO,EAAE,QAAQ,EAAErG,WAAWkL,UAAU,IAC3DrD;YAEP,IACA,CAAC,GACDJ,cACA;gBACE,CAACnJ,iBAAiB6H,MAAME,OAAO,EAAE,eAAe,EAAEoB;gBAClD,mDAAmD;gBACnDA;YACF,IACA,CAAC;gBACLd,WAAW3G,WAAW4G,eAAe;;YAEvC,6DAA6D;YAC7D,MAAMhH,uBAAuBqL,SAAShG,GAAG,CAACoF,OAAO7E,SAAS,GAAG;QAC/D;QAEA;;;;;;;KAOC,GACD,MAAMhG,gBACJsE,QACA;YAAEU,KAAKE,QAAQF,GAAG;YAAEC,KAAK,GAAEC,iBAAAA,QAAQD,KAAK,YAAbC,iBAAiB;QAAK,GACjD2F,OAAOc,OAAO,GAAG,kBAAkB,mBACnC;YACEC,MAAM;YACNC,IAAIhB,OAAO7E,SAAS;YACpB+B,MAAMA,QAAQhJ,mBAAmB8I,OAAOiE,SAAS,EAAEjE,OAAOkE,QAAQ,KAAK9G;QACzE;QAGFpB,IACGG,MAAM,CAAC6G,OAAOc,OAAO,GAAG,MAAM,KAC9B1H,IAAI,CAAC;YAAE+B,WAAW6E,OAAO7E,SAAS;YAAE2F,SAASd,OAAOc,OAAO;QAAC;IACjE,EAAE,OAAOzH,OAAO;QACdoB,QAAQpB,KAAK,CAAC,+BAA+BA;QAC7CL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkC;IAClE;AACF,EAAC;AAED,8EAA8E,GAC9E,OAAO,SAAS8H;IACd,0EAA0E;IAC1E,qEAAqE;IACrEtN,0BAA0B,IAAMoB,cAAcqF,GAAG,GAAGI,SAAS;IAC7D,sEAAsE;IACtE,mCAAmC;IACnC5G,2BAA2B,IAAMmB,cAAcqF,GAAG,GAAGI,SAAS;IAC9D;;;;;GAKC,GACD7E;IACAf,uBAAuBc,eAAewL,IAAI,EAAEtI;IAC5ChE,uBAAuBc,eAAeyL,YAAY,EAAErG;IACpD,wEAAwE;IACxE,uEAAuE;IACvElG,uBAAuBc,eAAe0L,aAAa,EAAEpJ;IACrDpD,uBAAuBc,eAAe2L,aAAa,EAAElJ;IACrD,yEAAyE;IACzE,kDAAkD;IAClDvD,uBAAuBc,eAAe4L,aAAa,EAAE5J;IACrD,2EAA2E;IAC3E,oEAAoE;IACpE9C,uBAAuBqB,gBAAgBsL,IAAI,EAAE9K;IAC7C7B,uBAAuBqB,gBAAgBuL,QAAQ,EAAEhL;IACjD,kEAAkE;IAClE5B,uBAAuBiB,yBAAyBK;IAChD,wEAAwE;IACxE,oEAAoE;IACpEtB,uBAAuBkB,uBAAuBK;IAC9C,qEAAqE;IACrE,uEAAuE;IACvE,4CAA4C;IAC5CvB,uBAAuBgD,mBAAmBD;IAC1C,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE/C,uBAAuBoB,2BAA2BK;IAClDzB,uBAAuBmB,8BAA8BK;IACrD,yEAAyE;IACzE,iEAAiE;IACjE,0BAA0B;IAC1BxB,uBAAuB,kBAAkB8B;IACzC,qEAAqE;IACrE,yEAAyE;IACzE,sCAAsC;IACtC9B,uBAAuB,uBAAuB6H;IAC9C,0EAA0E;IAC1E,0EAA0E;IAC1E,6CAA6C;IAC7C7H,uBAAuB,oBAAoBkC;IAC3C,kEAAkE;IAClElC,uBAAuB,oBAAoBmC;IAC3C,yEAAyE;IACzE,wEAAwE;IACxEnC,uBAAuBoC,6BAA6BC;IACpD,yEAAyE;IACzE,oEAAoE;IACpE,iEAAiE;IACjErC,uBAAuBc,eAAe+L,SAAS,EAAE9K;IACjD,yEAAyE;IACzE,oEAAoE;IACpE,uEAAuE;IACvE,oDAAoD;IACpD/B,uBAAuBgC,uBAAuBC;IAC9C,yEAAyE;IACzE,uEAAuE;IACvE,0EAA0E;IAC1EjC,uBAAuBsC,sBAAsBC;IAC7C,iEAAiE;IACjE,yBAAyB;IACzBvC,uBAAuBwC,wBAAwBC;IAC/C,wEAAwE;IACxE,yEAAyE;IACzE,6CAA6C;IAC7CzC,uBAAuB0C,wBAAwBC;IAC/C,qEAAqE;IACrE,yEAAyE;IACzE,wEAAwE;IACxE3C,uBAAuB4D,0BAA0BE;IACjD9D,uBAAuB6D,yBAAyBE;IAChD,wEAAwE;IACxE,yEAAyE;IACzE,wCAAwC;IACxC/D,uBAAuB4C,2BAA2BC;IAClD;;;;;;;;;GASC,GACD7C,uBACEc,eAAegM,WAAW,EAC1B;QACEC,KAAK,OAAOC,UACV,AAAC,CAAA,MAAM,MAAM,CAAC,iCAA6B,EAAGC,mBAAmB,CAACD;IACtE,GACA;QAAEE,SAAS;IAAK;IAElBlN,uBACEc,eAAeqM,aAAa,EAC5B;QACEJ,KAAK,OAAOC,UACV,AAAC,CAAA,MAAM,MAAM,CAAC,mCAA+B,EAAGI,qBAAqB,CAACJ;IAC1E,GACA;QAAEE,SAAS;IAAK;IAElBlN,uBACEc,eAAeuM,OAAO,EACtB;QACEN,KAAK,OAAOC,UAAY,AAAC,CAAA,MAAM,MAAM,CAAC,4BAAwB,EAAGM,eAAe,CAACN;IACnF,GACA;QAAEE,SAAS;IAAK;IAElBlN,uBACEwD,oCACAC;IAEF,uEAAuE;IACvE,6EAA6E;IAC7E,wEAAwE;IACxE,WAAW;IACXC;IACA,yEAAyE;IACzE,yEAAyE;IACzE,oEAAoE;IACpE/B;IACA,uEAAuE;IACvE,mEAAmE;IACnE,oEAAoE;IACpED;AACF"}
+{"version":3,"sources":["../../../../../../libs/plugins/crm/src/lib/server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The Contacts plugin's SERVER half (AGL-2595).\n *\n * Contacts CRM v1 had none: every console write was client-direct against\n * the Firestore rules, and the one server path that creates a contact —\n * `upsertHostContact` — belongs to the capture doors, not to this plugin.\n * v2 needs a server for the things a browser must not do alone: an import\n * that dedupes forty thousand rows, a bulk action over a selection, an\n * auto-association of contacts to companies by domain. Each of those lands\n * as a `crm/<route>` handler registered here.\n *\n * `crm/ping` exists so the wiring is PROVEN rather than assumed:\n * `plugins.config.json` names this module's register function and the\n * `crm` API prefix, the generated server manifest loads this file, and the\n * console's `/api/[...pluginApi]` dispatcher reaches the handler. A plugin\n * whose first real route also had to be its first wiring test would have\n * two things to debug at once.\n *\n * The real routes are the writes with a side effect outside the document:\n * `crm/contact-stage` (AGL-2605) exists for the EVENT — `contactStageChanged`\n * can only be emitted by a server path that performed the write, so a record\n * page that moved the stage client-direct would move the person and tell no\n * automation; the task routes (AGL-2599) carry an assignee's notification and\n * the `taskCompleted` event. Every CRM file is imported through the\n * transfer framework (AGL-3527, AGL-3528, `transfer/`), whose writes go\n * through the same doors every other server path uses.\n * `crm/deal-stage` (AGL-2598) is the one writer of a deal's stage, won and lost,\n * because a stage change is what automations listen for (`server-deal-stage.ts`).\n * `crm/contacts-create` (AGL-2596) is a person typed into the console by a\n * member of the team — a server route because the dedupe against every\n * holder's rows and the audience band are judgments the browser cannot make.\n * `crm/contact-update` (AGL-2804) is every other write to a contact's facets:\n * the rules cannot tell one field of a holder's facet from another, so they\n * leave a client nothing there, and the plan is asked here about the fields\n * a save carries. `crm/contact-remove` (AGL-3338) is a holder letting a\n * contact go: the refusals the document holds are kept, which a client\n * write could not be trusted to do.\n */\n\nimport { registerDealFigureReaders } from './server/deal-figures'\nimport { registerPeopleFigureReader } from './server/people-figures'\nimport {\n  CONTACT_ERASED_MESSAGE,\n  CONTACT_FIELDS_MAX_PER_ORG,\n  contactFacetPath,\n  composeContactName,\n  type ContactCustomValue,\n  type ContactFieldDefinition,\n  CRM_COLLECTIONS,\n  CRM_SALUTATION_PICKLIST,\n  crmReadTokens,\n  isContactLifecycleStage,\n  isOrgWideMember,\n  judgeCrmPicklistValue,\n  normalizeAddress,\n  normalizeContactEmail,\n  normalizePhone,\n  type AglynPostalAddress,\n  type PluginApiHandler,\n  type PluginApiRequest,\n  readContactFacet,\n  readCrmCustomInput,\n  registerPluginApiRoute,\n  visibleToHost,\n} from '@aglyn/aglyn/server'\nimport {\n  consentGroupForSite,\n  firebaseAdmin,\n  getOrgForHost,\n  logHostActivity,\n  memberHasOrgPermission,\n  orgDataCollectionForHost,\n  resolveOrgMembership,\n  restampCrmListFieldsAt,\n} from '@aglyn/tenant-data-admin'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport { emitHostEvent } from '@aglyn/tenant-runtime'\nimport { ORG_CONTACT_HOLDER_ID } from '@aglyn/aglyn/app-utils/contacts'\nimport { crmDefaultScopeOf } from '@aglyn/aglyn/app-utils/crm'\nimport { logOrgActivity } from '@aglyn/tenant-data-admin/server/organizations'\nimport { contactPrimaryGroup } from './model/contact-holder'\nimport { addContactByHand } from './server/add-contact-by-hand'\nimport { authorizeOrgCaller, readOrgForCreate } from './server/org-caller'\nimport { captureHostContact } from './server/capture-host-contact'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { CRM_API_ROUTES } from './constants/api-routes'\nimport { registerCrmServerDeclarations } from './declarations.server'\nimport { BUNDLE_ID } from './constants/bundle-common'\nimport { CRM_NEXT_ACTIVITY_ROUTE } from './model/next-activity'\nimport { CRM_LIST_FIELDS_ROUTE } from './model/list-fields'\nimport { CRM_LEAD_SOURCE_VALUES_ROUTE, CRM_PICKLIST_VALUES_ROUTE } from './model/picklist-values'\nimport { CRM_TASK_ROUTES } from './model/task-routes'\nimport { crmNextActivityHandler } from './server/next-activity-routes'\nimport { crmListFieldsHandler } from './server/list-fields-routes'\nimport { crmLeadSourceValuesHandler, crmPicklistValuesHandler } from './server/picklist-values'\nimport { registerCrmRecordEmailStateWriter } from './server/record-email-state'\nimport { registerCrmRecordTimelineWriter } from './server/record-timeline'\nimport { crmTaskCompleteHandler, crmTaskSaveHandler } from './server/task-routes'\nimport { crmDealStageHandler } from './server-deal-stage'\nimport { crmEmailSendHandler } from './server/email-send'\nimport { CRM_EMAIL_CHECK_ROUTE, crmEmailCheckHandler } from './server/email-check'\nimport { leadConvertHandler } from './server/lead-convert'\nimport { leadCreateHandler } from './server/lead-create'\nimport {\n  CONTACT_EMAIL_HISTORY_ROUTE,\n  contactEmailHistoryHandler,\n} from './server/contact-email-history'\nimport { CONTACTS_MERGE_ROUTE, contactsMergeHandler } from './server/contacts-merge'\nimport { CRM_ERASE_PERSON_ROUTE, crmErasePersonHandler } from './server/erase-person'\nimport { CRM_ORG_ACTIVITY_ROUTE, crmOrgActivityHandler } from './server/org-activity'\nimport { CRM_INBOUND_ADDRESS_ROUTE, crmInboundAddressHandler } from './server/inbound-address'\nimport { crmCompanyDeleteHandler } from './server/company-delete'\nimport { crmSharingHandler } from './server/crm-sharing'\nimport { CRM_SHARING_ROUTE } from './model/crm-sharing'\nimport { CONTACT_PHONE_REFUSAL, normalizeTags, typed } from './server/contact-profile'\nimport { crmContactUpdateHandler, readContactCreateProfile } from './server/contact-update'\nimport { readCrmPicklist } from './server/read-picklist'\nimport { crmContactRemoveHandler } from './server/contact-remove'\nimport {\n  CRM_EMAIL_TEMPLATE_DUPLICATE_ROUTE,\n  crmEmailTemplateDuplicateHandler,\n} from './server/email-template-duplicate'\nimport { registerCrmRecordFactsReaders } from './server/record-facts'\nimport { crmSuiteRefusal } from './server/suite-gate'\nimport {\n  CRM_RECIPE_INSTALL_ROUTE,\n  CRM_RECIPE_STATUS_ROUTE,\n  crmRecipeInstallHandler,\n  crmRecipeStatusHandler,\n} from './server/recipe-routes'\n\n/**\n * `GET /api/crm/ping` → `{ ok: true, plugin: 'crm' }`.\n *\n * No auth, no host, no data: it answers whether the plugin's server bundle\n * was loaded and its routes registered, which is a fact about the process\n * and not about any org. Anything that reads a document goes behind the\n * same session and role checks the other plugins' console routes use.\n */\nexport const crmPingHandler: PluginApiHandler = (req, res) => {\n  if (req.method !== 'GET') {\n    res.setHeader('Allow', 'GET')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  res.status(200).json({ ok: true, plugin: BUNDLE_ID })\n}\n\ntype Refusal = { ok: false; status: number; error: string }\n\n/**\n * Who is calling, and whether they may edit this site's CRM.\n *\n * The same check the inbox, bookings and email console routes make: a\n * bearer ID token, verified, and an `admin` or `editor` role on the host\n * document. A contact is a site's business record, so the site's own role\n * map is the right authority; org-wide reach is not required, because a\n * site editor who can open the record in the console can already write\n * every other field on it client-direct.\n */\nasync function authorizeSiteEditor(\n  req: PluginApiRequest,\n  hostId: string,\n): Promise<{ ok: true; uid: string; email: string | null } | Refusal> {\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return { ok: false, status: 401, error: 'Unauthenticated' }\n  let uid: string\n  let email: string | null\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    uid = decoded.uid\n    email = typeof decoded.email === 'string' ? decoded.email : null\n  } catch (error) {\n    // A refused credential is the caller's 401; a failure to check one is\n    // ours and keeps a 5xx (AGL-2852).\n    if (isRefusedIdToken(error)) return { ok: false, status: 401, error: 'Unauthenticated' }\n    console.error('[crm] the site editor could not be verified', error)\n    return { ok: false, status: 500, error: 'The sign-in could not be checked. Try again.' }\n  }\n  const hostSnapshot = await firebaseAdmin\n    .app()\n    .firestore()\n    .collection('hosts')\n    .doc(hostId)\n    .get()\n  if (!hostSnapshot.exists) {\n    return { ok: false, status: 404, error: 'Unknown site' }\n  }\n  const memberRole = (hostSnapshot.get('memberRoles') ?? {})[uid]\n  if (memberRole !== 'admin' && memberRole !== 'editor') {\n    return { ok: false, status: 403, error: 'Not a site admin or editor' }\n  }\n  return { ok: true, uid, email }\n}\n\n/**\n * `POST /api/crm/contact-stage` with `{ hostId, contactId, lifecycleStage }`.\n *\n * Writes the stage into THIS site's facet on the contact — a dotted\n * `update()`, never a top-level field, because the row is shared by every\n * site in the org and a stage is one holder's reading of the person — and\n * then announces `contactStageChanged` with the stage it replaced.\n *\n * A stage set to what it already is writes nothing and announces nothing:\n * the response says `changed: false`, and no automation listening for a\n * change hears one that did not happen.\n *\n * `lifecycleStage: null` CLEARS the stage (AGL-2804). A facet is the\n * server's to write, so \"not placed yet\" comes through the route that owns\n * the stage rather than as a client-direct delete, and it is refused to a\n * plan without the suite the way a move is. There is no event for \"no\n * stage\", so a clear announces nothing; an empty string names no stage and\n * is refused like any other the list does not have.\n *\n * The contact is looked up by id and then checked against `visibleTo`,\n * because the Admin SDK evaluates no rules: a caller who can edit site A\n * must not be able to restage a contact only site B holds by guessing its\n * id, and the scoped query the list uses is not available to a `doc()` read.\n */\nexport const contactStageHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  const hostId = String(req.body?.hostId ?? '').trim()\n  const orgId = String(req.body?.orgId ?? '').trim()\n  const contactId = String(req.body?.contactId ?? '').trim()\n  const requested: unknown = req.body?.lifecycleStage\n  if ((!hostId && !orgId) || !contactId) {\n    res.status(400).json({ error: 'Missing hostId or contactId' })\n    return\n  }\n  // `null` clears the stage; anything else has to be one of the list's.\n  const clearing = requested === null\n  const lifecycleStage = clearing\n    ? ''\n    : isContactLifecycleStage(requested)\n      ? requested\n      : null\n  if (lifecycleStage === null) {\n    res.status(400).json({ error: 'Pick a lifecycle stage' })\n    return\n  }\n  /*\n   * A person no site holds is staged at the organization level (AGL-4122): the\n   * stage is in their org-held facet, and no site has an automation to tell.\n   */\n  if (!hostId) {\n    const caller = await authorizeOrgCaller(req, orgId, {\n      needs: 'data.manage',\n      refusal: 'Moving a contact’s stage requires the \"Manage data\" permission.',\n    })\n    if (caller.ok === false) {\n      res.status(caller.status).json({ error: caller.error })\n      return\n    }\n    try {\n      const suite = crmSuiteRefusal(caller.org, \"Moving a contact's lifecycle stage\")\n      if (suite) {\n        res.status(suite.status).json(suite.body)\n        return\n      }\n      const snapshot = await firebaseAdmin\n        .app()\n        .firestore()\n        .collection('orgs')\n        .doc(orgId)\n        .collection('contacts')\n        .doc(contactId)\n        .get()\n      if (!snapshot.exists) {\n        res.status(404).json({ error: 'Unknown contact' })\n        return\n      }\n      const data = snapshot.data() as Record<string, unknown>\n      const groupId =\n        contactPrimaryGroup(data, caller.org as Record<string, unknown>).groupId ||\n        ORG_CONTACT_HOLDER_ID\n      const previousStage = readContactFacet(data, groupId).lifecycleStage ?? ''\n      if (previousStage === lifecycleStage) {\n        res.status(200).json({ ok: true, changed: false, lifecycleStage, previousStage })\n        return\n      }\n      await snapshot.ref.update({\n        [contactFacetPath(groupId, 'lifecycleStage')]: clearing\n          ? FieldValue.delete()\n          : lifecycleStage,\n        updatedAt: FieldValue.serverTimestamp(),\n      })\n      await restampCrmListFieldsAt(snapshot.ref, 'contacts')\n      res.status(200).json({ ok: true, changed: true, lifecycleStage, previousStage })\n    } catch (error) {\n      console.error('[crm] contact-stage failed', orgId, contactId, error)\n      res.status(500).json({ error: 'The stage could not be changed' })\n    }\n    return\n  }\n  const caller = await authorizeSiteEditor(req, hostId)\n  if (caller.ok === false) {\n    res.status(caller.status).json({ error: caller.error })\n    return\n  }\n  try {\n    // A lifecycle stage is the suite's (AGL-2787) — see `suite-gate.ts`.\n    const owner = await getOrgForHost(hostId)\n    if (!owner) {\n      res.status(404).json({ error: 'Unknown site' })\n      return\n    }\n    const suite = crmSuiteRefusal(owner.org, \"Moving a contact's lifecycle stage\")\n    if (suite) {\n      res.status(suite.status).json(suite.body)\n      return\n    }\n    const contactsRef = await orgDataCollectionForHost(hostId, 'contacts')\n    const snapshot = await contactsRef.doc(contactId).get()\n    if (!snapshot.exists || !visibleToHost(snapshot.get('visibleTo'), hostId)) {\n      res.status(404).json({ error: 'Unknown contact' })\n      return\n    }\n    const group = await consentGroupForSite(hostId)\n    const facet = readContactFacet(\n      snapshot.data() as Record<string, unknown>,\n      group.groupId,\n    )\n    const previousStage = facet.lifecycleStage ?? ''\n    if (previousStage === lifecycleStage) {\n      res\n        .status(200)\n        .json({ ok: true, changed: false, lifecycleStage, previousStage })\n      return\n    }\n    await snapshot.ref.update({\n      [contactFacetPath(group.groupId, 'lifecycleStage')]: clearing\n        ? FieldValue.delete()\n        : lifecycleStage,\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n    // The stage is what the Contacts list filters by (AGL-3321).\n    await restampCrmListFieldsAt(snapshot.ref, 'contacts')\n    // Awaited, not floated: a serverless response ending cancels in-flight\n    // work, and the event is the reason this route exists. A clear has none.\n    if (!clearing) {\n      await emitHostEvent(\n        hostId,\n        'contactStageChanged',\n        {\n          contactId,\n          email: String(snapshot.get('email') ?? ''),\n          lifecycleStage,\n          previousStage,\n        },\n        { actor: { kind: 'member', uid: caller.uid, email: caller.email } },\n      )\n    }\n    res\n      .status(200)\n      .json({ ok: true, changed: true, lifecycleStage, previousStage })\n  } catch (error) {\n    console.error('[crm] contact-stage failed', hostId, contactId, error)\n    res.status(500).json({ error: 'The stage could not be changed' })\n  }\n}\n\n/**\n * What the create route says when the band refused (AGL-2596).\n *\n * The contacts list's own alert, in the past tense: the list says new\n * visitors are \"no longer captured\", and this says the one contact the\n * reader just tried to add was not. The remedy is the same sentence in both\n * places, so a reader who sees one and then the other is told one thing.\n */\nexport const CONTACT_BAND_FULL_MESSAGE =\n  'Contact limit reached — this contact was not added. Upgrade in Billing ' +\n  'to keep collecting.'\n\n/**\n * `POST /api/crm/contacts-create` — a person added by hand (AGL-2596).\n *\n * Body: `{ hostId, email, name?, phone?, jobTitle?, companyName?,\n * companyId?, address?, ownerUid?, lifecycleStage?, tags?,\n * marketingConsent?, disclosedConsentGroup? }`, plus any of Salesforce's\n * standard contact fields `crm/contact-update` reads but the reports-to\n * (`CONTACT_CREATE_PROFILE_FIELDS`, AGL-3515) — read by the same rules, the\n * salutation judged against the org's list, and the holder's name composed\n * from a first and last name when either is given. Answers\n * `{ contactId, created }`: `created` is\n * false when the address already belonged to somebody, in which case what\n * was typed MERGES into the existing row — the dedupe the shared address\n * book exists for, and the reason a second \"create\" of one person is not\n * an error.\n *\n * ## Who may call it\n *\n * The caller's ID token, then `data.manage` on the site's org — the same key\n * the console surface itself is gated on, resolved through the same\n * three-layer permission read the members route uses. A scoped member is\n * admitted only for a site they reach: the rules would refuse a browser\n * write outside their tokens, and a server route that admitted it would be\n * a way round the rules rather than a service in front of them.\n *\n * ## What it refuses, and how\n *\n * A malformed email or phone number is a 400 with a sentence the drawer can\n * show under the field. The band is a 409 carrying the list's own wording:\n * it is not a bad request and not a server fault, it is the plan saying no,\n * and the drawer relays the sentence rather than inventing one.\n *\n * ## The company (AGL-2613)\n *\n * `companyId` is the picker's choice, and it is checked before anything is\n * written: the company has to exist and be visible to the capturing site's\n * scope, or a caller could file a person under a record they cannot open —\n * the same refusal the lead conversion makes. It reaches the upsert as\n * `facet.companyId`, which is where the link is kept in step with its mirror\n * and the company's contacts count; a merge onto somebody already at another\n * company is a MOVE there, not a second link. The stored company's own name\n * is what is echoed, over whatever the client sent, because the name on the\n * record is the company's and not the form's.\n *\n * ## What it writes beyond the upsert\n *\n * `upsertHostContact` takes the profile — phone, title, address, owner,\n * stage, company — and writes it into the capturing group's facet. The two\n * things it does not take are written here by DOTTED path afterwards: the\n * tags, which union into whatever the person already carried, and the\n * company name — the picked company's, or free text for a person filed\n * under a name no company record carries yet. Dotted paths because this is\n * an `update()`, and only an update reads a dot as a path — a nested object\n * here would replace the facet map and take every other holder's records\n * with it.\n */\nexport const crmContactsCreateHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n\n  const body = (req.body ?? {}) as Record<string, unknown>\n  const hostId = typed(body['hostId'], 128)\n  // The organization, for a person added there with no Source site (AGL-4122).\n  const orgIdInBody = typed(body['orgId'], 128)\n  if (!hostId && !orgIdInBody) {\n    res.status(400).json({ error: 'Missing hostId' })\n    return\n  }\n  // An address is optional, and one that was typed still has to be an address.\n  const rawEmail = typed(body['email'], 320)\n  const email = rawEmail ? normalizeContactEmail(rawEmail) : null\n  if (rawEmail && !email) {\n    res.status(400).json({ error: 'Enter a valid email address.' })\n    return\n  }\n  const rawPhone = typed(body['phone'], 40)\n  const phone = rawPhone ? normalizePhone(rawPhone) : null\n  if (rawPhone && !phone) {\n    res.status(400).json({ error: CONTACT_PHONE_REFUSAL })\n    return\n  }\n  const rawStage = typed(body['lifecycleStage'], 40)\n  if (rawStage && !isContactLifecycleStage(rawStage)) {\n    res.status(400).json({ error: 'Unknown lifecycle stage.' })\n    return\n  }\n  const profile = readContactCreateProfile(body)\n  if (profile.ok === false) {\n    res.status(400).json({ error: profile.error })\n    return\n  }\n  const extras = profile.fields\n  const name = typed(body['name'], 120)\n  // Somebody to call them: a name, an address or a number (AGL-4122).\n  if (\n    !email &&\n    !phone &&\n    !extras.mobilePhone &&\n    !name &&\n    !composeContactName(extras.firstName, extras.lastName)\n  ) {\n    res.status(400).json({ error: 'Enter a name, an email or a phone number.' })\n    return\n  }\n  const jobTitle = typed(body['jobTitle'], 120)\n  let companyName = typed(body['companyName'], 120)\n  const companyId = typed(body['companyId'], 128)\n  const ownerUid = typed(body['ownerUid'], 128)\n  const address =\n    body['address'] && typeof body['address'] === 'object'\n      ? normalizeAddress(body['address'] as AglynPostalAddress)\n      : null\n  const tags = normalizeTags(body['tags'])\n  const marketingConsent = body['marketingConsent'] === true\n  // The key of the consent-group sentence the drawer showed beside the box\n  // (AGL-3320): the opt-in covers the site's group only while it is the\n  // group's current one, and the capturing site alone otherwise.\n  const disclosedConsentGroup = typed(body['disclosedConsentGroup'], 64)\n  // The org's own contact fields, sent in this same call (AGL-3971): a\n  // value the create dropped would read as saved and be gone, and a second\n  // write after it could land half. Judged below against the definitions.\n  const rawCustom = body['custom']\n  if (\n    rawCustom !== undefined &&\n    (!rawCustom || typeof rawCustom !== 'object' || Array.isArray(rawCustom))\n  ) {\n    res.status(400).json({ error: 'Custom fields must be values keyed by field key.' })\n    return\n  }\n\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) {\n    res.status(401).json({ error: 'Unauthenticated' })\n    return\n  }\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const resolved = hostId\n      ? await getOrgForHost(hostId)\n      : await readOrgForCreate(orgIdInBody)\n    if (!resolved) {\n      res.status(404).json({ error: hostId ? 'Unknown site' : 'Unknown workspace' })\n      return\n    }\n    // The org's records belong to every site unless it keeps them apart, and\n    // then a record has to come from one (AGL-4122).\n    if (\n      !hostId &&\n      crmDefaultScopeOf(resolved.org as Record<string, unknown>) !== 'org'\n    ) {\n      res.status(400).json({ error: 'Choose the site this contact came from.' })\n      return\n    }\n    const isStaff = decoded['staff'] === true\n    if (!isStaff) {\n      const membership = await resolveOrgMembership(decoded.uid, resolved.orgId)\n      const member = membership?.member ?? null\n      const reaches =\n        isOrgWideMember(member) ||\n        Boolean(hostId && member?.hostAccess?.[hostId])\n      const allowed =\n        member &&\n        reaches &&\n        (await memberHasOrgPermission(resolved.orgId, member, 'data.manage'))\n      if (!allowed) {\n        res.status(403).json({\n          error: 'Adding contacts requires the data.manage permission on this site',\n        })\n        return\n      }\n    }\n\n    // A person typed in by the team is the suite's; the capture doors that\n    // fill a Free workspace's contacts do not come through here (AGL-2787).\n    const suite = crmSuiteRefusal(resolved.org, 'Adding a contact by hand')\n    if (suite) {\n      res.status(suite.status).json(suite.body)\n      return\n    }\n\n    // The salutation, judged against the org's list (AGL-3515).\n    let salutation = ''\n    if (extras.salutation) {\n      const judged = judgeCrmPicklistValue(\n        CRM_SALUTATION_PICKLIST,\n        await readCrmPicklist(\n          firebaseAdmin.app().firestore(),\n          resolved.orgId,\n          CRM_SALUTATION_PICKLIST,\n        ),\n        extras.salutation,\n      )\n      if (judged.ok === false) {\n        res.status(400).json({ error: judged.error })\n        return\n      }\n      salutation = judged.value ?? ''\n    }\n\n    /*\n     * The custom values, judged exactly as `crm/contact-update` judges them\n     * (AGL-3971): the org's definitions read only when the body carried a\n     * map, an unknown, retired or mistyped key refused with the definition\n     * reader's own sentence, and a currency amount stored as that field's\n     * minor units. Before any write, so a refusal leaves nothing behind.\n     */\n    let custom: Record<string, ContactCustomValue> | undefined\n    if (rawCustom !== undefined) {\n      const definitions = await firebaseAdmin\n        .app()\n        .firestore()\n        .collection('orgs')\n        .doc(resolved.orgId)\n        .collection(CRM_COLLECTIONS.contactFields)\n        .limit(CONTACT_FIELDS_MAX_PER_ORG)\n        .get()\n      const judged = readCrmCustomInput(\n        rawCustom,\n        definitions.docs.map((entry) => entry.data() as ContactFieldDefinition),\n        'contact',\n      )\n      if ('errors' in judged) {\n        const [field, message] = Object.entries(judged.errors)[0] ?? []\n        res.status(400).json({\n          error: message ?? 'A custom value could not be saved.',\n          ...(field ? { field } : {}),\n        })\n        return\n      }\n      custom = judged.values\n    }\n\n    if (companyId) {\n      // With no site the caller is org-wide, and every company is theirs.\n      const readable = hostId\n        ? new Set<string>(\n            crmReadTokens(\n              await consentGroupForSite(\n                hostId,\n                resolved.org as Record<string, unknown>,\n              ),\n            ),\n          )\n        : null\n      const companySnapshot = await firebaseAdmin\n        .app()\n        .firestore()\n        .collection('orgs')\n        .doc(resolved.orgId)\n        .collection(CRM_COLLECTIONS.companies)\n        .doc(companyId)\n        .get()\n      const tokens: unknown = companySnapshot.exists\n        ? companySnapshot.get('visibleTo')\n        : undefined\n      const visible =\n        companySnapshot.exists &&\n        (!readable ||\n          (Array.isArray(tokens) && tokens.some((token) => readable.has(String(token)))))\n      if (!visible) {\n        res.status(404).json({ error: 'Unknown company' })\n        return\n      }\n      companyName = typed(companySnapshot.get('name'), 120) || companyName\n    }\n\n    const facet = {\n        ...(phone ? { phone } : {}),\n        ...(jobTitle ? { jobTitle } : {}),\n        // Salesforce's standard fields (AGL-3515); the capture composes the\n        // holder's name from the first and last names.\n        ...Object.fromEntries(\n          Object.entries({ ...extras, salutation }).filter(\n            ([key, value]) =>\n              key !== 'doNotCall' && key !== 'otherAddress' && typeof value === 'string' && value,\n          ),\n        ),\n        ...(extras.otherAddress ? { otherAddress: extras.otherAddress } : {}),\n        ...(extras.doNotCall ? { doNotCall: true } : {}),\n        ...(companyId ? { companyId } : {}),\n        ...(address ? { address } : {}),\n        ...(ownerUid ? { ownerUid } : {}),\n        // Written nested into the capturing holder's facet by the upsert,\n        // on a new person and on a merge alike.\n        ...(custom && Object.keys(custom).length ? { custom } : {}),\n    }\n    const stage =\n      rawStage && isContactLifecycleStage(rawStage) ? { lifecycleStage: rawStage } : {}\n    // A site and an address are a capture. Anything less is the team adding a\n    // person no capture door could take (AGL-4122).\n    const captured = Boolean(hostId && email)\n    const result = captured\n      ? await captureHostContact({\n          hostId,\n          email: email as string,\n          ...(name ? { name } : {}),\n          source: 'manual',\n          interaction: { summary: 'Added by hand' },\n          actor: {\n            kind: 'member',\n            uid: decoded.uid,\n            email: typeof decoded.email === 'string' ? decoded.email : null,\n          },\n          marketingConsent,\n          ...(marketingConsent && disclosedConsentGroup\n            ? { disclosedConsentGroup }\n            : {}),\n          // The door's stage is the one the drawer picked, or none at all.\n          facet: { ...facet, ...stage /* lifecycleStage */ },\n        })\n      : await addContactByHand({\n          orgId: resolved.orgId,\n          org: resolved.org as Record<string, unknown>,\n          sourceHostId: hostId || null,\n          email,\n          ...(name ? { name } : {}),\n          facet: {\n            ...facet,\n            ...stage,\n            ...(companyName ? { companyName } : {}),\n          },\n          tags,\n          marketingConsent,\n          ...(disclosedConsentGroup ? { disclosedConsentGroup } : {}),\n        })\n\n    if ('refused' in result) {\n      if (result.refused === 'band') {\n        res.status(409).json({ error: CONTACT_BAND_FULL_MESSAGE, reason: 'band' })\n        return\n      }\n      if (result.refused === 'invalid-email') {\n        res.status(400).json({ error: 'Enter a valid email address.' })\n        return\n      }\n      // The person was erased from this workspace (AGL-2623). A conflict,\n      // like the band: the request was well-formed and the answer is a\n      // standing fact about the address, not a fault in the call.\n      if (result.refused === 'erased') {\n        res.status(409).json({ error: CONTACT_ERASED_MESSAGE, reason: 'erased' })\n        return\n      }\n      res.status(500).json({ error: 'The contact could not be saved.' })\n      return\n    }\n\n    if (captured && (tags.length || companyName)) {\n      const group = await consentGroupForSite(\n        hostId,\n        resolved.org as Record<string, unknown>,\n      )\n      const contacts = await orgDataCollectionForHost(hostId, 'contacts')\n      await contacts.doc(result.contactId).update({\n        ...(tags.length\n          ? {\n              [contactFacetPath(group.groupId, 'tags')]: FieldValue.arrayUnion(\n                ...tags,\n              ),\n            }\n          : {}),\n        ...(companyName\n          ? {\n              [contactFacetPath(group.groupId, 'companyName')]: companyName,\n              // The search echo — see `HostContact.companyName`.\n              companyName,\n            }\n          : {}),\n        updatedAt: FieldValue.serverTimestamp(),\n      })\n      // The tags are what the Contacts list filters by (AGL-3321).\n      await restampCrmListFieldsAt(contacts.doc(result.contactId), 'contacts')\n    }\n\n    /*\n     * The audit line, written HERE rather than by the console (AGL-2622):\n     * a route that verified the caller and performed the write is the one\n     * writer that cannot record an act that did not happen, which is the\n     * reason `check-activity-coverage.mjs` counts this file. A merge into\n     * a person the org already held is said to be one — the row was\n     * updated, not added — so the feed cannot claim two people for one.\n     */\n    const added = result.created ? 'Added contact' : 'Updated contact'\n    const addedActor = { uid: decoded.uid, email: decoded.email ?? null }\n    const addedTarget = {\n      type: 'contact' as const,\n      id: result.contactId,\n      name:\n        name ||\n        composeContactName(extras.firstName, extras.lastName) ||\n        email ||\n        phone ||\n        '',\n    }\n    await (hostId\n      ? logHostActivity(hostId, addedActor, added, addedTarget)\n      : logOrgActivity(resolved.orgId, addedActor, added, addedTarget))\n\n    res\n      .status(result.created ? 201 : 200)\n      .json({ contactId: result.contactId, created: result.created })\n  } catch (error) {\n    console.error('[crm] contact create failed', error)\n    res.status(500).json({ error: 'The contact could not be saved.' })\n  }\n}\n\n/** Console API registration, named in `plugins.config.json` as `consoleApi`. */\nexport function registerCrmConsoleApi(): void {\n  // The pipeline and the deals closed, as figure tables (AGL-3603), for the\n  // AI plugin's insights to read by id; the console runs insight jobs.\n  registerDealFigureReaders(() => firebaseAdmin.app().firestore())\n  // And the leads and contacts gained over a window (AGL-3867), for the\n  // weekly summary and for insights.\n  registerPeopleFigureReader(() => firebaseAdmin.app().firestore())\n  /*\n   * The contact-capture writer, again (AGL-3080). Both apps run it at boot\n   * from their generated server-declarations manifest, and this is the\n   * backstop for a process whose boot did not: the first CRM door to load\n   * registers it. Registering twice replaces in place.\n   */\n  registerCrmServerDeclarations()\n  registerPluginApiRoute(CRM_API_ROUTES.ping, crmPingHandler)\n  registerPluginApiRoute(CRM_API_ROUTES.contactStage, contactStageHandler)\n  // Every other console write to a contact's facets (AGL-2804): the rules\n  // cannot tell one facet field from another, so the plan is asked here.\n  registerPluginApiRoute(CRM_API_ROUTES.contactUpdate, crmContactUpdateHandler)\n  registerPluginApiRoute(CRM_API_ROUTES.contactRemove, crmContactRemoveHandler)\n  // A company's contacts unlinked, then the company (AGL-2804): the unlink\n  // clears a facet, which is the server's to write.\n  registerPluginApiRoute(CRM_API_ROUTES.companyDelete, crmCompanyDeleteHandler)\n  // Tasks (AGL-2599): the two writes with a side effect outside the document\n  // — an assignee's notification, and the `taskCompleted` host event.\n  registerPluginApiRoute(CRM_TASK_ROUTES.save, crmTaskSaveHandler)\n  registerPluginApiRoute(CRM_TASK_ROUTES.complete, crmTaskCompleteHandler)\n  // A client-direct task write's door to `nextTaskAtMs` (AGL-2661).\n  registerPluginApiRoute(CRM_NEXT_ACTIVITY_ROUTE, crmNextActivityHandler)\n  // What a client-direct write the browser cannot follow up asks for: the\n  // fields the CRM lists query, restamped from the record (AGL-3321).\n  registerPluginApiRoute(CRM_LIST_FIELDS_ROUTE, crmListFieldsHandler)\n  // Sharing records with other sites (AGL-3336): a manager's share and\n  // unshare, the org's sharing rules and their recompute, and the rules'\n  // re-evaluation a client-direct write owes.\n  registerPluginApiRoute(CRM_SHARING_ROUTE, crmSharingHandler)\n  // A picklist value renamed or deleted (AGL-3298, AGL-3510): the list and\n  // every record holding the old label, in one request. The lead source's\n  // own address stays registered for a request that names no picklist.\n  registerPluginApiRoute(CRM_PICKLIST_VALUES_ROUTE, crmPicklistValuesHandler)\n  registerPluginApiRoute(CRM_LEAD_SOURCE_VALUES_ROUTE, crmLeadSourceValuesHandler)\n  // The one writer of a deal's stage, won and lost (AGL-2598): the browser\n  // could write the field, but only a server can emit the event an\n  // automation listens for.\n  registerPluginApiRoute('crm/deal-stage', crmDealStageHandler)\n  // A person typed into the console (AGL-2596): the capture doors' own\n  // function behind a session check, so the dedupe and the band are judged\n  // where every other door judges them.\n  registerPluginApiRoute('crm/contacts-create', crmContactsCreateHandler)\n  // A lead becomes a contact, a company and a deal (AGL-2608) — the one CRM\n  // write a browser cannot make alone, because only the server may create a\n  // contact through the dedupe-and-meter door.\n  registerPluginApiRoute('crm/lead-convert', leadConvertHandler)\n  // A lead entered by hand (AGL-3231): the New lead drawer's route.\n  registerPluginApiRoute('crm/leads-create', leadCreateHandler)\n  // The one READ behind a route (AGL-2616): the per-recipient delivery log\n  // is closed to clients, so a contact's campaign mail is projected here.\n  registerPluginApiRoute(CONTACT_EMAIL_HISTORY_ROUTE, contactEmailHistoryHandler)\n  // One email to one person from their record (AGL-2615): the recipient is\n  // read off the record, the daily cap and both suppression lists are\n  // judged, and the message leaves on the site's sending identity.\n  registerPluginApiRoute(CRM_API_ROUTES.emailSend, crmEmailSendHandler)\n  // What the platform knows about one address before somebody writes to it\n  // (AGL-3328): the gateway chip on a record page, and the composer's\n  // warning about a domain with no mail server or a gateway holding this\n  // site's mail. DNS and the ledger are the server's.\n  registerPluginApiRoute(CRM_EMAIL_CHECK_ROUTE, crmEmailCheckHandler)\n  // Two records for one person become one (AGL-2625): the repoint of every\n  // row naming the merged record and the transaction over both documents\n  // are the server's, and the address index it writes is closed to clients.\n  registerPluginApiRoute(CONTACTS_MERGE_ROUTE, contactsMergeHandler)\n  // Files a person's privacy erasure for the daily job (AGL-2623);\n  // workspace admins only.\n  registerPluginApiRoute(CRM_ERASE_PERSON_ROUTE, crmErasePersonHandler)\n  // One line in the organization's activity feed for an act the org-level\n  // hub performed client-direct (AGL-2634): the feed is closed to clients,\n  // so the bulk bars' lines come through here.\n  registerPluginApiRoute(CRM_ORG_ACTIVITY_ROUTE, crmOrgActivityHandler)\n  // A recipe's action written into one site's automations from the org\n  // hub (AGL-2639), stamped and deduplicated by the server, and the stamps\n  // read back per site so the hub can say which sites carry which recipe.\n  registerPluginApiRoute(CRM_RECIPE_INSTALL_ROUTE, crmRecipeInstallHandler)\n  registerPluginApiRoute(CRM_RECIPE_STATUS_ROUTE, crmRecipeStatusHandler)\n  // The workspace's email capture address (AGL-2657): the token is minted\n  // and rotated here, behind the CRM's own gate, and the org document that\n  // carries it is closed to every client.\n  registerPluginApiRoute(CRM_INBOUND_ADDRESS_ROUTE, crmInboundAddressHandler)\n  /*\n   * The three doors a MACHINE calls (AGL-3080), at the paths they have\n   * always answered on: the scheduler's daily digest and hourly task\n   * reminders, on the cron secret, and the mail provider's capture webhook,\n   * on its signature. None names a site or a member, so each is registered\n   * as a machine's route — the dispatcher leaves the plugin's release and\n   * enablement gates and its write limit to it — and each judges the CRM's\n   * plan and flag for every organization it resolves. Loaded with the\n   * first call, not with the surface.\n   */\n  registerPluginApiRoute(\n    CRM_API_ROUTES.dailyDigest,\n    {\n      web: async (request) =>\n        (await import('./server/daily-digest-route')).crmDailyDigestRoute(request),\n    },\n    { machine: true },\n  )\n  registerPluginApiRoute(\n    CRM_API_ROUTES.taskReminders,\n    {\n      web: async (request) =>\n        (await import('./server/task-reminders-route')).crmTaskRemindersRoute(request),\n    },\n    { machine: true },\n  )\n  registerPluginApiRoute(\n    CRM_API_ROUTES.inbound,\n    {\n      web: async (request) => (await import('./server/inbound-route')).crmInboundRoute(request),\n    },\n    { machine: true },\n  )\n  registerPluginApiRoute(\n    CRM_EMAIL_TEMPLATE_DUPLICATE_ROUTE,\n    crmEmailTemplateDuplicateHandler,\n  )\n  // The facts of a contact, company, deal or lead, and an import's field\n  // catalog, for another plugin in this process (AGL-2917): read on the core's\n  // record-facts seam under the rules every CRM door applies, and written\n  // nowhere.\n  registerCrmRecordFactsReaders()\n  // The CRM as the workspace's record system on the core's record-timeline\n  // seam (AGL-2981): another plugin files an email, a reply or a task on a\n  // record through it, under the CRM's own scope, dedupe and ceiling.\n  registerCrmRecordTimelineWriter()\n  // And on the record email-state seam (AGL-3245): a sender that filed a\n  // verdict on an address — a bounce, a complaint, an unsubscribe, a\n  // do-not-contact mark — stamps the lead and the contact through it.\n  registerCrmRecordEmailStateWriter()\n}\n\n// Type-only (AGL-3080): the plugin's entitlement keys, declared by module\n// augmentation, for every program that loads this entry point.\nexport type { crmPlanEntitlements } from './plan-entitlements'\n"],"names":["registerDealFigureReaders","registerPeopleFigureReader","CONTACT_ERASED_MESSAGE","CONTACT_FIELDS_MAX_PER_ORG","contactFacetPath","composeContactName","CRM_COLLECTIONS","CRM_SALUTATION_PICKLIST","crmReadTokens","isContactLifecycleStage","isOrgWideMember","judgeCrmPicklistValue","normalizeAddress","normalizeContactEmail","normalizePhone","readContactFacet","readCrmCustomInput","registerPluginApiRoute","visibleToHost","consentGroupForSite","firebaseAdmin","getOrgForHost","logHostActivity","memberHasOrgPermission","orgDataCollectionForHost","resolveOrgMembership","restampCrmListFieldsAt","isRefusedIdToken","emitHostEvent","ORG_CONTACT_HOLDER_ID","crmDefaultScopeOf","logOrgActivity","contactPrimaryGroup","addContactByHand","authorizeOrgCaller","readOrgForCreate","captureHostContact","FieldValue","CRM_API_ROUTES","registerCrmServerDeclarations","BUNDLE_ID","CRM_NEXT_ACTIVITY_ROUTE","CRM_LIST_FIELDS_ROUTE","CRM_LEAD_SOURCE_VALUES_ROUTE","CRM_PICKLIST_VALUES_ROUTE","CRM_TASK_ROUTES","crmNextActivityHandler","crmListFieldsHandler","crmLeadSourceValuesHandler","crmPicklistValuesHandler","registerCrmRecordEmailStateWriter","registerCrmRecordTimelineWriter","crmTaskCompleteHandler","crmTaskSaveHandler","crmDealStageHandler","crmEmailSendHandler","CRM_EMAIL_CHECK_ROUTE","crmEmailCheckHandler","leadConvertHandler","leadCreateHandler","CONTACT_EMAIL_HISTORY_ROUTE","contactEmailHistoryHandler","CONTACTS_MERGE_ROUTE","contactsMergeHandler","CRM_ERASE_PERSON_ROUTE","crmErasePersonHandler","CRM_ORG_ACTIVITY_ROUTE","crmOrgActivityHandler","CRM_INBOUND_ADDRESS_ROUTE","crmInboundAddressHandler","crmCompanyDeleteHandler","crmSharingHandler","CRM_SHARING_ROUTE","CONTACT_PHONE_REFUSAL","normalizeTags","typed","crmContactUpdateHandler","readContactCreateProfile","readCrmPicklist","crmContactRemoveHandler","CRM_EMAIL_TEMPLATE_DUPLICATE_ROUTE","crmEmailTemplateDuplicateHandler","registerCrmRecordFactsReaders","crmSuiteRefusal","CRM_RECIPE_INSTALL_ROUTE","CRM_RECIPE_STATUS_ROUTE","crmRecipeInstallHandler","crmRecipeStatusHandler","crmPingHandler","req","res","method","setHeader","status","json","error","ok","plugin","authorizeSiteEditor","hostId","hostSnapshot","authorization","String","headers","idToken","startsWith","slice","length","undefined","uid","email","decoded","app","auth","verifyIdToken","console","firestore","collection","doc","get","exists","memberRole","contactStageHandler","body","trim","orgId","contactId","requested","lifecycleStage","clearing","caller","needs","refusal","suite","org","snapshot","data","groupId","previousStage","changed","ref","update","delete","updatedAt","serverTimestamp","facet","owner","contactsRef","group","actor","kind","CONTACT_BAND_FULL_MESSAGE","crmContactsCreateHandler","orgIdInBody","rawEmail","rawPhone","phone","rawStage","profile","extras","fields","name","mobilePhone","firstName","lastName","jobTitle","companyName","companyId","ownerUid","address","tags","marketingConsent","disclosedConsentGroup","rawCustom","Array","isArray","resolved","isStaff","member","membership","reaches","Boolean","hostAccess","allowed","salutation","judged","value","custom","definitions","contactFields","limit","docs","map","entry","Object","field","message","entries","errors","values","readable","Set","companySnapshot","companies","tokens","visible","some","token","has","fromEntries","filter","key","otherAddress","doNotCall","keys","stage","captured","result","source","interaction","summary","sourceHostId","refused","reason","contacts","arrayUnion","added","created","addedActor","addedTarget","type","id","registerCrmConsoleApi","ping","contactStage","contactUpdate","contactRemove","companyDelete","save","complete","emailSend","dailyDigest","web","request","crmDailyDigestRoute","machine","taskReminders","crmTaskRemindersRoute","inbound","crmInboundRoute"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCC,GAED,SAASA,yBAAyB,QAAQ,2BAAuB;AACjE,SAASC,0BAA0B,QAAQ,6BAAyB;AACpE,SACEC,sBAAsB,EACtBC,0BAA0B,EAC1BC,gBAAgB,EAChBC,kBAAkB,EAGlBC,eAAe,EACfC,uBAAuB,EACvBC,aAAa,EACbC,uBAAuB,EACvBC,eAAe,EACfC,qBAAqB,EACrBC,gBAAgB,EAChBC,qBAAqB,EACrBC,cAAc,EAIdC,gBAAgB,EAChBC,kBAAkB,EAClBC,sBAAsB,EACtBC,aAAa,QACR,sBAAqB;AAC5B,SACEC,mBAAmB,EACnBC,aAAa,EACbC,aAAa,EACbC,eAAe,EACfC,sBAAsB,EACtBC,wBAAwB,EACxBC,oBAAoB,EACpBC,sBAAsB,QACjB,2BAA0B;AACjC,SAASC,gBAAgB,QAAQ,mDAAkD;AACnF,SAASC,aAAa,QAAQ,wBAAuB;AACrD,SAASC,qBAAqB,QAAQ,kCAAiC;AACvE,SAASC,iBAAiB,QAAQ,6BAA4B;AAC9D,SAASC,cAAc,QAAQ,gDAA+C;AAC9E,SAASC,mBAAmB,QAAQ,4BAAwB;AAC5D,SAASC,gBAAgB,QAAQ,kCAA8B;AAC/D,SAASC,kBAAkB,EAAEC,gBAAgB,QAAQ,yBAAqB;AAC1E,SAASC,kBAAkB,QAAQ,mCAA+B;AAClE,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,cAAc,QAAQ,4BAAwB;AACvD,SAASC,6BAA6B,QAAQ,2BAAuB;AACrE,SAASC,SAAS,QAAQ,+BAA2B;AACrD,SAASC,uBAAuB,QAAQ,2BAAuB;AAC/D,SAASC,qBAAqB,QAAQ,yBAAqB;AAC3D,SAASC,4BAA4B,EAAEC,yBAAyB,QAAQ,6BAAyB;AACjG,SAASC,eAAe,QAAQ,yBAAqB;AACrD,SAASC,sBAAsB,QAAQ,mCAA+B;AACtE,SAASC,oBAAoB,QAAQ,iCAA6B;AAClE,SAASC,0BAA0B,EAAEC,wBAAwB,QAAQ,8BAA0B;AAC/F,SAASC,iCAAiC,QAAQ,iCAA6B;AAC/E,SAASC,+BAA+B,QAAQ,8BAA0B;AAC1E,SAASC,sBAAsB,EAAEC,kBAAkB,QAAQ,0BAAsB;AACjF,SAASC,mBAAmB,QAAQ,yBAAqB;AACzD,SAASC,mBAAmB,QAAQ,yBAAqB;AACzD,SAASC,qBAAqB,EAAEC,oBAAoB,QAAQ,0BAAsB;AAClF,SAASC,kBAAkB,QAAQ,2BAAuB;AAC1D,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SACEC,2BAA2B,EAC3BC,0BAA0B,QACrB,oCAAgC;AACvC,SAASC,oBAAoB,EAAEC,oBAAoB,QAAQ,6BAAyB;AACpF,SAASC,sBAAsB,EAAEC,qBAAqB,QAAQ,2BAAuB;AACrF,SAASC,sBAAsB,EAAEC,qBAAqB,QAAQ,2BAAuB;AACrF,SAASC,yBAAyB,EAAEC,wBAAwB,QAAQ,8BAA0B;AAC9F,SAASC,uBAAuB,QAAQ,6BAAyB;AACjE,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SAASC,iBAAiB,QAAQ,yBAAqB;AACvD,SAASC,qBAAqB,EAAEC,aAAa,EAAEC,KAAK,QAAQ,8BAA0B;AACtF,SAASC,uBAAuB,EAAEC,wBAAwB,QAAQ,6BAAyB;AAC3F,SAASC,eAAe,QAAQ,4BAAwB;AACxD,SAASC,uBAAuB,QAAQ,6BAAyB;AACjE,SACEC,kCAAkC,EAClCC,gCAAgC,QAC3B,uCAAmC;AAC1C,SAASC,6BAA6B,QAAQ,2BAAuB;AACrE,SAASC,eAAe,QAAQ,yBAAqB;AACrD,SACEC,wBAAwB,EACxBC,uBAAuB,EACvBC,uBAAuB,EACvBC,sBAAsB,QACjB,4BAAwB;AAE/B;;;;;;;CAOC,GACD,OAAO,MAAMC,iBAAmC,CAACC,KAAKC;IACpD,IAAID,IAAIE,MAAM,KAAK,OAAO;QACxBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACnD;IACF;IACAL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEE,IAAI;QAAMC,QAAQzD;IAAU;AACrD,EAAC;AAID;;;;;;;;;CASC,GACD,eAAe0D,oBACbT,GAAqB,EACrBU,MAAc;QAEeV,4BA2BTW;IA3BpB,MAAMC,gBAAgBC,QAAOb,6BAAAA,IAAIc,OAAO,CAACF,aAAa,YAAzBZ,6BAA6B;IAC1D,MAAMe,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAO;QAAER,IAAI;QAAOH,QAAQ;QAAKE,OAAO;IAAkB;IACxE,IAAIc;IACJ,IAAIC;IACJ,IAAI;QACF,MAAMC,UAAU,MAAM3F,cAAc4F,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACV;QAC/DK,MAAME,QAAQF,GAAG;QACjBC,QAAQ,OAAOC,QAAQD,KAAK,KAAK,WAAWC,QAAQD,KAAK,GAAG;IAC9D,EAAE,OAAOf,OAAO;QACd,sEAAsE;QACtE,mCAAmC;QACnC,IAAIpE,iBAAiBoE,QAAQ,OAAO;YAAEC,IAAI;YAAOH,QAAQ;YAAKE,OAAO;QAAkB;QACvFoB,QAAQpB,KAAK,CAAC,+CAA+CA;QAC7D,OAAO;YAAEC,IAAI;YAAOH,QAAQ;YAAKE,OAAO;QAA+C;IACzF;IACA,MAAMK,eAAe,MAAMhF,cACxB4F,GAAG,GACHI,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAACnB,QACJoB,GAAG;IACN,IAAI,CAACnB,aAAaoB,MAAM,EAAE;QACxB,OAAO;YAAExB,IAAI;YAAOH,QAAQ;YAAKE,OAAO;QAAe;IACzD;IACA,MAAM0B,aAAa,EAACrB,oBAAAA,aAAamB,GAAG,CAAC,0BAAjBnB,oBAAmC,CAAC,EAAE,CAACS,IAAI;IAC/D,IAAIY,eAAe,WAAWA,eAAe,UAAU;QACrD,OAAO;YAAEzB,IAAI;YAAOH,QAAQ;YAAKE,OAAO;QAA6B;IACvE;IACA,OAAO;QAAEC,IAAI;QAAMa;QAAKC;IAAM;AAChC;AAEA;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,OAAO,MAAMY,sBAAwC,OAAOjC,KAAKC;;QAMzCD,WACDA,YACIA,YACEA;IAR3B,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACnD;IACF;IACA,MAAMI,SAASG,gBAAOb,YAAAA,IAAIkC,IAAI,qBAARlC,UAAUU,MAAM,mBAAI,IAAIyB,IAAI;IAClD,MAAMC,QAAQvB,iBAAOb,aAAAA,IAAIkC,IAAI,qBAARlC,WAAUoC,KAAK,oBAAI,IAAID,IAAI;IAChD,MAAME,YAAYxB,iBAAOb,aAAAA,IAAIkC,IAAI,qBAARlC,WAAUqC,SAAS,oBAAI,IAAIF,IAAI;IACxD,MAAMG,aAAqBtC,aAAAA,IAAIkC,IAAI,qBAARlC,WAAUuC,cAAc;IACnD,IAAI,AAAC,CAAC7B,UAAU,CAAC0B,SAAU,CAACC,WAAW;QACrCpC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA8B;QAC5D;IACF;IACA,sEAAsE;IACtE,MAAMkC,WAAWF,cAAc;IAC/B,MAAMC,iBAAiBC,WACnB,KACAxH,wBAAwBsH,aACtBA,YACA;IACN,IAAIC,mBAAmB,MAAM;QAC3BtC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAyB;QACvD;IACF;IACA;;;GAGC,GACD,IAAI,CAACI,QAAQ;QACX,MAAM+B,SAAS,MAAMhG,mBAAmBuD,KAAKoC,OAAO;YAClDM,OAAO;YACPC,SAAS;QACX;QACA,IAAIF,OAAOlC,EAAE,KAAK,OAAO;YACvBN,IAAIG,MAAM,CAACqC,OAAOrC,MAAM,EAAEC,IAAI,CAAC;gBAAEC,OAAOmC,OAAOnC,KAAK;YAAC;YACrD;QACF;QACA,IAAI;gBAsBoBhF;YArBtB,MAAMsH,QAAQlD,gBAAgB+C,OAAOI,GAAG,EAAE;YAC1C,IAAID,OAAO;gBACT3C,IAAIG,MAAM,CAACwC,MAAMxC,MAAM,EAAEC,IAAI,CAACuC,MAAMV,IAAI;gBACxC;YACF;YACA,MAAMY,WAAW,MAAMnH,cACpB4F,GAAG,GACHI,SAAS,GACTC,UAAU,CAAC,QACXC,GAAG,CAACO,OACJR,UAAU,CAAC,YACXC,GAAG,CAACQ,WACJP,GAAG;YACN,IAAI,CAACgB,SAASf,MAAM,EAAE;gBACpB9B,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAO;gBAAkB;gBAChD;YACF;YACA,MAAMyC,OAAOD,SAASC,IAAI;YAC1B,MAAMC,UACJzG,oBAAoBwG,MAAMN,OAAOI,GAAG,EAA6BG,OAAO,IACxE5G;YACF,MAAM6G,iBAAgB3H,mCAAAA,iBAAiByH,MAAMC,SAAST,cAAc,YAA9CjH,mCAAkD;YACxE,IAAI2H,kBAAkBV,gBAAgB;gBACpCtC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEE,IAAI;oBAAM2C,SAAS;oBAAOX;oBAAgBU;gBAAc;gBAC/E;YACF;YACA,MAAMH,SAASK,GAAG,CAACC,MAAM,CAAC;gBACxB,CAACzI,iBAAiBqI,SAAS,kBAAkB,EAAER,WAC3C5F,WAAWyG,MAAM,KACjBd;gBACJe,WAAW1G,WAAW2G,eAAe;YACvC;YACA,MAAMtH,uBAAuB6G,SAASK,GAAG,EAAE;YAC3ClD,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEE,IAAI;gBAAM2C,SAAS;gBAAMX;gBAAgBU;YAAc;QAChF,EAAE,OAAO3C,OAAO;YACdoB,QAAQpB,KAAK,CAAC,8BAA8B8B,OAAOC,WAAW/B;YAC9DL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAiC;QACjE;QACA;IACF;IACA,MAAMmC,SAAS,MAAMhC,oBAAoBT,KAAKU;IAC9C,IAAI+B,OAAOlC,EAAE,KAAK,OAAO;QACvBN,IAAIG,MAAM,CAACqC,OAAOrC,MAAM,EAAEC,IAAI,CAAC;YAAEC,OAAOmC,OAAOnC,KAAK;QAAC;QACrD;IACF;IACA,IAAI;YAuBoBkD;QAtBtB,qEAAqE;QACrE,MAAMC,QAAQ,MAAM7H,cAAc8E;QAClC,IAAI,CAAC+C,OAAO;YACVxD,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;YAC7C;QACF;QACA,MAAMsC,QAAQlD,gBAAgB+D,MAAMZ,GAAG,EAAE;QACzC,IAAID,OAAO;YACT3C,IAAIG,MAAM,CAACwC,MAAMxC,MAAM,EAAEC,IAAI,CAACuC,MAAMV,IAAI;YACxC;QACF;QACA,MAAMwB,cAAc,MAAM3H,yBAAyB2E,QAAQ;QAC3D,MAAMoC,WAAW,MAAMY,YAAY7B,GAAG,CAACQ,WAAWP,GAAG;QACrD,IAAI,CAACgB,SAASf,MAAM,IAAI,CAACtG,cAAcqH,SAAShB,GAAG,CAAC,cAAcpB,SAAS;YACzET,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkB;YAChD;QACF;QACA,MAAMqD,QAAQ,MAAMjI,oBAAoBgF;QACxC,MAAM8C,QAAQlI,iBACZwH,SAASC,IAAI,IACbY,MAAMX,OAAO;QAEf,MAAMC,iBAAgBO,wBAAAA,MAAMjB,cAAc,YAApBiB,wBAAwB;QAC9C,IAAIP,kBAAkBV,gBAAgB;YACpCtC,IACGG,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAEE,IAAI;gBAAM2C,SAAS;gBAAOX;gBAAgBU;YAAc;YAClE;QACF;QACA,MAAMH,SAASK,GAAG,CAACC,MAAM,CAAC;YACxB,CAACzI,iBAAiBgJ,MAAMX,OAAO,EAAE,kBAAkB,EAAER,WACjD5F,WAAWyG,MAAM,KACjBd;YACJe,WAAW1G,WAAW2G,eAAe;QACvC;QACA,6DAA6D;QAC7D,MAAMtH,uBAAuB6G,SAASK,GAAG,EAAE;QAC3C,uEAAuE;QACvE,yEAAyE;QACzE,IAAI,CAACX,UAAU;gBAMKM;YALlB,MAAM3G,cACJuE,QACA,uBACA;gBACE2B;gBACAhB,OAAOR,QAAOiC,gBAAAA,SAAShB,GAAG,CAAC,oBAAbgB,gBAAyB;gBACvCP;gBACAU;YACF,GACA;gBAAEW,OAAO;oBAAEC,MAAM;oBAAUzC,KAAKqB,OAAOrB,GAAG;oBAAEC,OAAOoB,OAAOpB,KAAK;gBAAC;YAAE;QAEtE;QACApB,IACGG,MAAM,CAAC,KACPC,IAAI,CAAC;YAAEE,IAAI;YAAM2C,SAAS;YAAMX;YAAgBU;QAAc;IACnE,EAAE,OAAO3C,OAAO;QACdoB,QAAQpB,KAAK,CAAC,8BAA8BI,QAAQ2B,WAAW/B;QAC/DL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiC;IACjE;AACF,EAAC;AAED;;;;;;;CAOC,GACD,OAAO,MAAMwD,4BACX,4EACA,sBAAqB;AAEvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDC,GACD,OAAO,MAAMC,2BAA6C,OAAO/D,KAAKC;QAOtDD,WAsEeA;IA5E7B,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACnD;IACF;IAEA,MAAM4B,QAAQlC,YAAAA,IAAIkC,IAAI,YAARlC,YAAY,CAAC;IAC3B,MAAMU,SAASxB,MAAMgD,IAAI,CAAC,SAAS,EAAE;IACrC,6EAA6E;IAC7E,MAAM8B,cAAc9E,MAAMgD,IAAI,CAAC,QAAQ,EAAE;IACzC,IAAI,CAACxB,UAAU,CAACsD,aAAa;QAC3B/D,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;QAC/C;IACF;IACA,6EAA6E;IAC7E,MAAM2D,WAAW/E,MAAMgD,IAAI,CAAC,QAAQ,EAAE;IACtC,MAAMb,QAAQ4C,WAAW7I,sBAAsB6I,YAAY;IAC3D,IAAIA,YAAY,CAAC5C,OAAO;QACtBpB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA+B;QAC7D;IACF;IACA,MAAM4D,WAAWhF,MAAMgD,IAAI,CAAC,QAAQ,EAAE;IACtC,MAAMiC,QAAQD,WAAW7I,eAAe6I,YAAY;IACpD,IAAIA,YAAY,CAACC,OAAO;QACtBlE,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOtB;QAAsB;QACpD;IACF;IACA,MAAMoF,WAAWlF,MAAMgD,IAAI,CAAC,iBAAiB,EAAE;IAC/C,IAAIkC,YAAY,CAACpJ,wBAAwBoJ,WAAW;QAClDnE,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA2B;QACzD;IACF;IACA,MAAM+D,UAAUjF,yBAAyB8C;IACzC,IAAImC,QAAQ9D,EAAE,KAAK,OAAO;QACxBN,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO+D,QAAQ/D,KAAK;QAAC;QAC5C;IACF;IACA,MAAMgE,SAASD,QAAQE,MAAM;IAC7B,MAAMC,OAAOtF,MAAMgD,IAAI,CAAC,OAAO,EAAE;IACjC,oEAAoE;IACpE,IACE,CAACb,SACD,CAAC8C,SACD,CAACG,OAAOG,WAAW,IACnB,CAACD,QACD,CAAC5J,mBAAmB0J,OAAOI,SAAS,EAAEJ,OAAOK,QAAQ,GACrD;QACA1E,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA4C;QAC1E;IACF;IACA,MAAMsE,WAAW1F,MAAMgD,IAAI,CAAC,WAAW,EAAE;IACzC,IAAI2C,cAAc3F,MAAMgD,IAAI,CAAC,cAAc,EAAE;IAC7C,MAAM4C,YAAY5F,MAAMgD,IAAI,CAAC,YAAY,EAAE;IAC3C,MAAM6C,WAAW7F,MAAMgD,IAAI,CAAC,WAAW,EAAE;IACzC,MAAM8C,UACJ9C,IAAI,CAAC,UAAU,IAAI,OAAOA,IAAI,CAAC,UAAU,KAAK,WAC1C/G,iBAAiB+G,IAAI,CAAC,UAAU,IAChC;IACN,MAAM+C,OAAOhG,cAAciD,IAAI,CAAC,OAAO;IACvC,MAAMgD,mBAAmBhD,IAAI,CAAC,mBAAmB,KAAK;IACtD,yEAAyE;IACzE,sEAAsE;IACtE,+DAA+D;IAC/D,MAAMiD,wBAAwBjG,MAAMgD,IAAI,CAAC,wBAAwB,EAAE;IACnE,qEAAqE;IACrE,yEAAyE;IACzE,wEAAwE;IACxE,MAAMkD,YAAYlD,IAAI,CAAC,SAAS;IAChC,IACEkD,cAAcjE,aACb,CAAA,CAACiE,aAAa,OAAOA,cAAc,YAAYC,MAAMC,OAAO,CAACF,UAAS,GACvE;QACAnF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAmD;QACjF;IACF;IAEA,MAAMM,gBAAgBC,QAAOb,6BAAAA,IAAIc,OAAO,CAACF,aAAa,YAAzBZ,6BAA6B;IAC1D,MAAMe,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS;QACZd,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkB;QAChD;IACF;IAEA,IAAI;YAuP4CgB;QAtP9C,MAAMA,UAAU,MAAM3F,cAAc4F,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACV;QAC/D,MAAMwE,WAAW7E,SACb,MAAM9E,cAAc8E,UACpB,MAAMhE,iBAAiBsH;QAC3B,IAAI,CAACuB,UAAU;YACbtF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAOI,SAAS,iBAAiB;YAAoB;YAC5E;QACF;QACA,yEAAyE;QACzE,iDAAiD;QACjD,IACE,CAACA,UACDrE,kBAAkBkJ,SAAS1C,GAAG,MAAiC,OAC/D;YACA5C,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA0C;YACxE;QACF;QACA,MAAMkF,UAAUlE,OAAO,CAAC,QAAQ,KAAK;QACrC,IAAI,CAACkE,SAAS;;gBAKQC;YAJpB,MAAMC,aAAa,MAAM1J,qBAAqBsF,QAAQF,GAAG,EAAEmE,SAASnD,KAAK;YACzE,MAAMqD,iBAASC,8BAAAA,WAAYD,MAAM,mBAAI;YACrC,MAAME,UACJ1K,gBAAgBwK,WAChBG,QAAQlF,WAAU+E,2BAAAA,qBAAAA,OAAQI,UAAU,qBAAlBJ,kBAAoB,CAAC/E,OAAO;YAChD,MAAMoF,UACJL,UACAE,WACC,MAAM7J,uBAAuByJ,SAASnD,KAAK,EAAEqD,QAAQ;YACxD,IAAI,CAACK,SAAS;gBACZ7F,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBACnBC,OAAO;gBACT;gBACA;YACF;QACF;QAEA,uEAAuE;QACvE,wEAAwE;QACxE,MAAMsC,QAAQlD,gBAAgB6F,SAAS1C,GAAG,EAAE;QAC5C,IAAID,OAAO;YACT3C,IAAIG,MAAM,CAACwC,MAAMxC,MAAM,EAAEC,IAAI,CAACuC,MAAMV,IAAI;YACxC;QACF;QAEA,4DAA4D;QAC5D,IAAI6D,aAAa;QACjB,IAAIzB,OAAOyB,UAAU,EAAE;gBAcRC;YAbb,MAAMA,SAAS9K,sBACbJ,yBACA,MAAMuE,gBACJ1D,cAAc4F,GAAG,GAAGI,SAAS,IAC7B4D,SAASnD,KAAK,EACdtH,0BAEFwJ,OAAOyB,UAAU;YAEnB,IAAIC,OAAOzF,EAAE,KAAK,OAAO;gBACvBN,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAO0F,OAAO1F,KAAK;gBAAC;gBAC3C;YACF;YACAyF,cAAaC,gBAAAA,OAAOC,KAAK,YAAZD,gBAAgB;QAC/B;QAEA;;;;;;KAMC,GACD,IAAIE;QACJ,IAAId,cAAcjE,WAAW;YAC3B,MAAMgF,cAAc,MAAMxK,cACvB4F,GAAG,GACHI,SAAS,GACTC,UAAU,CAAC,QACXC,GAAG,CAAC0D,SAASnD,KAAK,EAClBR,UAAU,CAAC/G,gBAAgBuL,aAAa,EACxCC,KAAK,CAAC3L,4BACNoH,GAAG;YACN,MAAMkE,SAASzK,mBACb6J,WACAe,YAAYG,IAAI,CAACC,GAAG,CAAC,CAACC,QAAUA,MAAMzD,IAAI,KAC1C;YAEF,IAAI,YAAYiD,QAAQ;oBACGS;gBAAzB,MAAM,CAACC,OAAOC,QAAQ,IAAGF,mBAAAA,OAAOG,OAAO,CAACZ,OAAOa,MAAM,CAAC,CAAC,EAAE,YAAhCJ,mBAAoC,EAAE;gBAC/DxG,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBACnBC,KAAK,EAAEqG,kBAAAA,UAAW;mBACdD,QAAQ;oBAAEA;gBAAM,IAAI,CAAC;gBAE3B;YACF;YACAR,SAASF,OAAOc,MAAM;QACxB;QAEA,IAAIhC,WAAW;YACb,oEAAoE;YACpE,MAAMiC,WAAWrG,SACb,IAAIsG,IACFjM,cACE,MAAMW,oBACJgF,QACA6E,SAAS1C,GAAG,MAIlB;YACJ,MAAMoE,kBAAkB,MAAMtL,cAC3B4F,GAAG,GACHI,SAAS,GACTC,UAAU,CAAC,QACXC,GAAG,CAAC0D,SAASnD,KAAK,EAClBR,UAAU,CAAC/G,gBAAgBqM,SAAS,EACpCrF,GAAG,CAACiD,WACJhD,GAAG;YACN,MAAMqF,SAAkBF,gBAAgBlF,MAAM,GAC1CkF,gBAAgBnF,GAAG,CAAC,eACpBX;YACJ,MAAMiG,UACJH,gBAAgBlF,MAAM,IACrB,CAAA,CAACgF,YACC1B,MAAMC,OAAO,CAAC6B,WAAWA,OAAOE,IAAI,CAAC,CAACC,QAAUP,SAASQ,GAAG,CAAC1G,OAAOyG,QAAQ;YACjF,IAAI,CAACF,SAAS;gBACZnH,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAO;gBAAkB;gBAChD;YACF;YACAuE,cAAc3F,MAAM+H,gBAAgBnF,GAAG,CAAC,SAAS,QAAQ+C;QAC3D;QAEA,MAAMrB,QAAQ,aACNW,QAAQ;YAAEA;QAAM,IAAI,CAAC,GACrBS,WAAW;YAAEA;QAAS,IAAI,CAAC,GAG5B6B,OAAOe,WAAW,CACnBf,OAAOG,OAAO,CAAC,aAAKtC;YAAQyB;YAAc0B,MAAM,CAC9C,CAAC,CAACC,KAAKzB,MAAM,GACXyB,QAAQ,eAAeA,QAAQ,kBAAkB,OAAOzB,UAAU,YAAYA,SAGhF3B,OAAOqD,YAAY,GAAG;YAAEA,cAAcrD,OAAOqD,YAAY;QAAC,IAAI,CAAC,GAC/DrD,OAAOsD,SAAS,GAAG;YAAEA,WAAW;QAAK,IAAI,CAAC,GAC1C9C,YAAY;YAAEA;QAAU,IAAI,CAAC,GAC7BE,UAAU;YAAEA;QAAQ,IAAI,CAAC,GACzBD,WAAW;YAAEA;QAAS,IAAI,CAAC,GAG3BmB,UAAUO,OAAOoB,IAAI,CAAC3B,QAAQhF,MAAM,GAAG;YAAEgF;QAAO,IAAI,CAAC;QAE7D,MAAM4B,QACJ1D,YAAYpJ,wBAAwBoJ,YAAY;YAAE7B,gBAAgB6B;QAAS,IAAI,CAAC;QAClF,0EAA0E;QAC1E,gDAAgD;QAChD,MAAM2D,WAAWnC,QAAQlF,UAAUW;QACnC,MAAM2G,SAASD,WACX,MAAMpL,mBAAmB;YACvB+D;YACAW,OAAOA;WACHmD,OAAO;YAAEA;QAAK,IAAI,CAAC;YACvByD,QAAQ;YACRC,aAAa;gBAAEC,SAAS;YAAgB;YACxCvE,OAAO;gBACLC,MAAM;gBACNzC,KAAKE,QAAQF,GAAG;gBAChBC,OAAO,OAAOC,QAAQD,KAAK,KAAK,WAAWC,QAAQD,KAAK,GAAG;YAC7D;YACA6D;WACIA,oBAAoBC,wBACpB;YAAEA;QAAsB,IACxB,CAAC;YACL,iEAAiE;YACjE3B,OAAO,aAAKA,OAAUsE,MAAM,kBAAkB;cAEhD,MAAMtL,iBAAiB;YACrB4F,OAAOmD,SAASnD,KAAK;YACrBS,KAAK0C,SAAS1C,GAAG;YACjBuF,cAAc1H,UAAU;YACxBW;WACImD,OAAO;YAAEA;QAAK,IAAI,CAAC;YACvBhB,OAAO,aACFA,OACAsE,OACCjD,cAAc;gBAAEA;YAAY,IAAI,CAAC;YAEvCI;YACAC;WACIC,wBAAwB;YAAEA;QAAsB,IAAI,CAAC;QAG/D,IAAI,aAAa6C,QAAQ;YACvB,IAAIA,OAAOK,OAAO,KAAK,QAAQ;gBAC7BpI,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAOwD;oBAA2BwE,QAAQ;gBAAO;gBACxE;YACF;YACA,IAAIN,OAAOK,OAAO,KAAK,iBAAiB;gBACtCpI,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAO;gBAA+B;gBAC7D;YACF;YACA,oEAAoE;YACpE,iEAAiE;YACjE,4DAA4D;YAC5D,IAAI0H,OAAOK,OAAO,KAAK,UAAU;gBAC/BpI,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAO7F;oBAAwB6N,QAAQ;gBAAS;gBACvE;YACF;YACArI,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkC;YAChE;QACF;QAEA,IAAIyH,YAAa9C,CAAAA,KAAK/D,MAAM,IAAI2D,WAAU,GAAI;YAC5C,MAAMlB,QAAQ,MAAMjI,oBAClBgF,QACA6E,SAAS1C,GAAG;YAEd,MAAM0F,WAAW,MAAMxM,yBAAyB2E,QAAQ;YACxD,MAAM6H,SAAS1G,GAAG,CAACmG,OAAO3F,SAAS,EAAEe,MAAM,CAAC,aACtC6B,KAAK/D,MAAM,GACX;gBACE,CAACvG,iBAAiBgJ,MAAMX,OAAO,EAAE,QAAQ,EAAEpG,WAAW4L,UAAU,IAC3DvD;YAEP,IACA,CAAC,GACDJ,cACA;gBACE,CAAClK,iBAAiBgJ,MAAMX,OAAO,EAAE,eAAe,EAAE6B;gBAClD,mDAAmD;gBACnDA;YACF,IACA,CAAC;gBACLvB,WAAW1G,WAAW2G,eAAe;;YAEvC,6DAA6D;YAC7D,MAAMtH,uBAAuBsM,SAAS1G,GAAG,CAACmG,OAAO3F,SAAS,GAAG;QAC/D;QAEA;;;;;;;KAOC,GACD,MAAMoG,QAAQT,OAAOU,OAAO,GAAG,kBAAkB;QACjD,MAAMC,aAAa;YAAEvH,KAAKE,QAAQF,GAAG;YAAEC,KAAK,GAAEC,iBAAAA,QAAQD,KAAK,YAAbC,iBAAiB;QAAK;QACpE,MAAMsH,cAAc;YAClBC,MAAM;YACNC,IAAId,OAAO3F,SAAS;YACpBmC,MACEA,QACA5J,mBAAmB0J,OAAOI,SAAS,EAAEJ,OAAOK,QAAQ,KACpDtD,SACA8C,SACA;QACJ;QACA,MAAOzD,CAAAA,SACH7E,gBAAgB6E,QAAQiI,YAAYF,OAAOG,eAC3CtM,eAAeiJ,SAASnD,KAAK,EAAEuG,YAAYF,OAAOG,YAAW;QAEjE3I,IACGG,MAAM,CAAC4H,OAAOU,OAAO,GAAG,MAAM,KAC9BrI,IAAI,CAAC;YAAEgC,WAAW2F,OAAO3F,SAAS;YAAEqG,SAASV,OAAOU,OAAO;QAAC;IACjE,EAAE,OAAOpI,OAAO;QACdoB,QAAQpB,KAAK,CAAC,+BAA+BA;QAC7CL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkC;IAClE;AACF,EAAC;AAED,8EAA8E,GAC9E,OAAO,SAASyI;IACd,0EAA0E;IAC1E,qEAAqE;IACrExO,0BAA0B,IAAMoB,cAAc4F,GAAG,GAAGI,SAAS;IAC7D,sEAAsE;IACtE,mCAAmC;IACnCnH,2BAA2B,IAAMmB,cAAc4F,GAAG,GAAGI,SAAS;IAC9D;;;;;GAKC,GACD7E;IACAtB,uBAAuBqB,eAAemM,IAAI,EAAEjJ;IAC5CvE,uBAAuBqB,eAAeoM,YAAY,EAAEhH;IACpD,wEAAwE;IACxE,uEAAuE;IACvEzG,uBAAuBqB,eAAeqM,aAAa,EAAE/J;IACrD3D,uBAAuBqB,eAAesM,aAAa,EAAE7J;IACrD,yEAAyE;IACzE,kDAAkD;IAClD9D,uBAAuBqB,eAAeuM,aAAa,EAAEvK;IACrD,2EAA2E;IAC3E,oEAAoE;IACpErD,uBAAuB4B,gBAAgBiM,IAAI,EAAEzL;IAC7CpC,uBAAuB4B,gBAAgBkM,QAAQ,EAAE3L;IACjD,kEAAkE;IAClEnC,uBAAuBwB,yBAAyBK;IAChD,wEAAwE;IACxE,oEAAoE;IACpE7B,uBAAuByB,uBAAuBK;IAC9C,qEAAqE;IACrE,uEAAuE;IACvE,4CAA4C;IAC5C9B,uBAAuBuD,mBAAmBD;IAC1C,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrEtD,uBAAuB2B,2BAA2BK;IAClDhC,uBAAuB0B,8BAA8BK;IACrD,yEAAyE;IACzE,iEAAiE;IACjE,0BAA0B;IAC1B/B,uBAAuB,kBAAkBqC;IACzC,qEAAqE;IACrE,yEAAyE;IACzE,sCAAsC;IACtCrC,uBAAuB,uBAAuBuI;IAC9C,0EAA0E;IAC1E,0EAA0E;IAC1E,6CAA6C;IAC7CvI,uBAAuB,oBAAoByC;IAC3C,kEAAkE;IAClEzC,uBAAuB,oBAAoB0C;IAC3C,yEAAyE;IACzE,wEAAwE;IACxE1C,uBAAuB2C,6BAA6BC;IACpD,yEAAyE;IACzE,oEAAoE;IACpE,iEAAiE;IACjE5C,uBAAuBqB,eAAe0M,SAAS,EAAEzL;IACjD,yEAAyE;IACzE,oEAAoE;IACpE,uEAAuE;IACvE,oDAAoD;IACpDtC,uBAAuBuC,uBAAuBC;IAC9C,yEAAyE;IACzE,uEAAuE;IACvE,0EAA0E;IAC1ExC,uBAAuB6C,sBAAsBC;IAC7C,iEAAiE;IACjE,yBAAyB;IACzB9C,uBAAuB+C,wBAAwBC;IAC/C,wEAAwE;IACxE,yEAAyE;IACzE,6CAA6C;IAC7ChD,uBAAuBiD,wBAAwBC;IAC/C,qEAAqE;IACrE,yEAAyE;IACzE,wEAAwE;IACxElD,uBAAuBmE,0BAA0BE;IACjDrE,uBAAuBoE,yBAAyBE;IAChD,wEAAwE;IACxE,yEAAyE;IACzE,wCAAwC;IACxCtE,uBAAuBmD,2BAA2BC;IAClD;;;;;;;;;GASC,GACDpD,uBACEqB,eAAe2M,WAAW,EAC1B;QACEC,KAAK,OAAOC,UACV,AAAC,CAAA,MAAM,MAAM,CAAC,iCAA6B,EAAGC,mBAAmB,CAACD;IACtE,GACA;QAAEE,SAAS;IAAK;IAElBpO,uBACEqB,eAAegN,aAAa,EAC5B;QACEJ,KAAK,OAAOC,UACV,AAAC,CAAA,MAAM,MAAM,CAAC,mCAA+B,EAAGI,qBAAqB,CAACJ;IAC1E,GACA;QAAEE,SAAS;IAAK;IAElBpO,uBACEqB,eAAekN,OAAO,EACtB;QACEN,KAAK,OAAOC,UAAY,AAAC,CAAA,MAAM,MAAM,CAAC,4BAAwB,EAAGM,eAAe,CAACN;IACnF,GACA;QAAEE,SAAS;IAAK;IAElBpO,uBACE+D,oCACAC;IAEF,uEAAuE;IACvE,6EAA6E;IAC7E,wEAAwE;IACxE,WAAW;IACXC;IACA,yEAAyE;IACzE,yEAAyE;IACzE,oEAAoE;IACpE/B;IACA,uEAAuE;IACvE,mEAAmE;IACnE,oEAAoE;IACpED;AACF"}