@aglyn/plugins-crm 1.0.0 → 1.1.0

package/src/lib/server/email-send.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/email-send.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  type AglynOrgBilling,\n  type AglynOrgMember,\n  buildCrmEmailActivity,\n  contactCaptureHostIds,\n  CRM_ACTIVITY_LOG_FULL_MESSAGE,\n  CRM_COLLECTIONS,\n  CRM_EMAIL_BODY_MAX,\n  CRM_EMAIL_CONTEXT,\n  CRM_EMAIL_SUBJECT_MAX,\n  type CrmActivityLink,\n  crmActivityLogHasRoom,\n  crmEmailDeliveryTags,\n  emailStateRefusal,\n  type CrmMergeContext,\n  crmMergeFieldsIn,\n  crmScopeTokens,\n  isOrgWideMember,\n  normalizeContactEmail,\n  type PluginApiHandler,\n  type PluginApiRequest,\n  type PluginApiResponse,\n  readContactFacet,\n  readEmailState,\n  readMarketingBasis,\n  renderCrmMergeFields,\n  resolveOrgEntitlements,\n  visibleToHost,\n} from '@aglyn/aglyn/server'\nimport {\n  isEmailConfigured,\n  sendEmail,\n  sendFailureReason,\n  type SendEmailResult,\n} from '@aglyn/shared-util-email'\nimport {\n  consentGroupForSite,\n  consumeRateLimit,\n  countCrmActivitiesForRecord,\n  filterSendableForHost,\n  firebaseAdmin,\n  getHostDocAdmin,\n  getOrgForHost,\n  hostSendingIdentity,\n  logOrgActivity,\n  memberHasOrgPermission,\n  orgDataCollectionForHost,\n  readLeadForHost,\n  readOrgEmailRamp,\n  recordEmailSends,\n  releaseCrmEmailSend,\n  reserveCrmEmailSend,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport {\n  authorizeOrgCaller,\n  type CrmRouteScope,\n  orgHostIds,\n  readCrmRouteScope,\n} from './org-caller'\nimport { crmSuiteRefusal } from './suite-gate'\nimport { newCrmActivityRef, writeCrmEmailActivity } from './crm-email-activity'\n\n/**\n * `POST /api/crm/email-send` — one email to one person, from their record\n * (AGL-2615).\n *\n * Body: `{ hostId, contactId? | leadId? | dealId?, subject, body }`. Answers\n * `{ ok: true, activityId, to, from, logged }` once the provider accepted\n * the message, and a refusal with a `reason` the dialog can act on\n * otherwise. The subject and the body may carry merge fields —\n * `{{contact.firstName}}`, `{{deal.amount}}` (AGL-2658) — which this route\n * fills from the record before the send, so the timeline row is the letter\n * as it left; see `crm-email-templates.ts` for the grammar.\n *\n * ## What it is, and what it is not\n *\n * A message a teammate wrote to one person they have a relationship with —\n * a reply to a lead, a follow-up on a deal. It is not marketing: no\n * campaign audience, no unsubscribe pair, no frequency window, no consent\n * split. What it does owe is everything a bounce or a complaint owes the\n * shared sending domain, which is why BOTH suppression lists are consulted\n * and why a person's own stated refusal — a `declined` basis — is a hard\n * stop even though the message is not the kind of mail that basis governs.\n * The recipient asked this site not to write; the kind of writing is not\n * the point.\n *\n * ## Why the recipient is resolved here and not taken from the body\n *\n * The dialog shows the address the record carries, and this route reads it\n * again off the record the caller named, through the same visibility check\n * every other CRM route makes. A `to` in the body would make this a route\n * that sends the site's mail to any address a member types, which is a\n * different product with a different abuse surface.\n *\n * ## The organization variant (AGL-2634)\n *\n * `{ orgId, hostId?, … }` from the org-level hub. The caller is authorized\n * by the org — an org-wide member holding `data.manage` — and the record is\n * read with no site's visibility to check, because an org-wide member reads\n * every row. What the org level cannot do away with is the SITE the message\n * leaves from: the sending identity, the suppression list and the person's\n * stated refusal are each a site's. So the org variant still names one —\n * the record's own capturing site or the site the reader picked, in the\n * body; failing that the record's own site read off the document; failing\n * that the org's only site — and refuses, with a `site` reason, when the\n * org has several and none was named. The row it writes is visible to\n * whoever may see the RECORD, so an email to a person another site\n * captured shows on their timeline under that site's hub; the act is\n * logged in the org's feed.\n *\n * ## The order of the gates\n *\n * Cheap and certain first. A malformed body and a missing token cost\n * nothing; the per-user pace is one counter; the record is one read and\n * decides everything after it; the ceiling one aggregate; the two\n * suppression lists two keyed reads; the sending identity next, because it\n * is the most expensive and the one a workspace fixes once. The daily cap\n * comes LAST and is the one gate that writes before the provider is called\n * (AGL-2645): the send is reserved on today's counter inside a transaction,\n * so two reps at the last slot cannot both pass one reading of it, and a\n * message the provider refuses gives the slot back. After the provider has\n * accepted, two more things are written, neither able to fail the send:\n * the activity row and the org's cost meter.\n *\n * ## The new-workspace ramp is part of that cap, not a gate beside it\n *\n * A message from a workspace created this morning lands on the sending\n * domain every other tenant's receipts leave on, so the plan's day is held\n * to the share of it the workspace has earned — the same ramp the campaign\n * path is paced by, `readOrgEmailRamp`, taken to the allowance this surface\n * meters instead of the campaign ceiling. It is handed to the reservation\n * rather than checked before it, so the ceiling and the count it is judged\n * against come out of the one transactional read; a ramp consulted\n * separately would be a second ceiling and two reps could pass it at once.\n * A workspace past its first week is not ramped and pays nothing to find\n * that out.\n */\n\n/** How many one-to-one emails one person may send in one minute. */\nexport const CRM_EMAIL_SENDS_PER_MINUTE = 20\nconst CRM_EMAIL_RATE_WINDOW_MS = 60_000\n\n/** What the route says when the plan carries no one-to-one email at all. */\nexport const CRM_EMAIL_NOT_INCLUDED_MESSAGE =\n  'Your plan does not include one-to-one email. Upgrade in Billing to email ' +\n  'people from their records.'\n\n/** What the route says at the daily cap; `included` is the plan's figure. */\nexport function crmEmailCapReachedMessage(included: number): string {\n  return (\n    `Today's one-to-one email limit (${included.toLocaleString('en-US')}) is ` +\n    'reached. It resets at midnight UTC — see Billing for the count.'\n  )\n}\n\n/**\n * What the route says when the NEW-WORKSPACE RAMP is the ceiling that was\n * reached, rather than the plan's own.\n *\n * The campaign path's wording, pointed at this surface: the number, what was\n * spent against it, that nothing was sent or counted, and when it lifts. A\n * workspace told only \"limit reached\" against a figure far below the one its\n * plan page advertises would read it as a billing fault.\n */\nexport function crmEmailRampReachedMessage(\n  ceiling: number,\n  used: number,\n): string {\n  return (\n    `This workspace may send ${ceiling.toLocaleString('en-US')} one-to-one ` +\n    `email${ceiling === 1 ? '' : 's'} a day while it establishes a sending ` +\n    `history, and has sent ${used.toLocaleString('en-US')} today. Nothing ` +\n    'has been sent and nothing has been counted — the allowance grows as ' +\n    \"the workspace sends, and is the plan's in full after its first week. \" +\n    'It resets at midnight UTC.'\n  )\n}\n\n/** What the route says when the ramp's own history could not be read. */\nexport const CRM_EMAIL_RAMP_UNAVAILABLE_MESSAGE =\n  \"This workspace's sending history could not be read just now, so how much \" +\n  'of its first-week email allowance it has earned is not known. Nothing has ' +\n  'been sent and nothing has been counted — try again in a moment.'\n\nexport const CRM_EMAIL_SUPPRESSED_MESSAGE =\n  'This address has bounced or reported a message as spam, so it cannot be ' +\n  'emailed.'\n\nexport const CRM_EMAIL_DECLINED_MESSAGE =\n  'This person asked not to be emailed by this site.'\n\nexport const CRM_EMAIL_RATE_MESSAGE =\n  'You have sent too many emails in the last minute. Wait a moment and try again.'\n\n/** What the org variant says when no site was named and the org has several. */\nexport const CRM_EMAIL_PICK_SITE_MESSAGE =\n  'Pick the site this email leaves from — its sending address is what the ' +\n  'message is sent as.'\n\ntype Refusal = { ok: false; status: number; body: Record<string, unknown> }\n\nconst refuse = (\n  status: number,\n  error: string,\n  extra: Record<string, unknown> = {},\n): Refusal => ({ ok: false, status, body: { error, ...extra } })\n\n/** One typed field, trimmed and bounded. */\nfunction typed(value: unknown, max: number): string {\n  return String(value ?? '')\n    .trim()\n    .slice(0, max)\n}\n\ninterface Sender {\n  ok: true\n  uid: string\n  /** The address replies go to — the token's, never the body's. */\n  email: string\n  /** The name in front of the sending address, when the token carries one. */\n  name: string\n  orgId: string\n  org: Partial<AglynOrgBilling>\n}\n\n/**\n * Who is sending, and whether they may: a verified ID token, then\n * `data.manage` on the site's org through the same three-layer read the\n * create route makes, admitted only for a site the member reaches. Staff\n * pass the permission check as they do on every CRM route, and send as\n * themselves.\n */\nasync function authorizeSender(\n  req: PluginApiRequest,\n  hostId: string,\n): Promise<Sender | Refusal> {\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return refuse(401, 'Unauthenticated')\n  let decoded: { uid: string; email?: string; name?: string; staff?: unknown }\n  try {\n    decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n  } catch (error) {\n    // A refused credential is the caller's 401; a failure to check one is\n    // ours and keeps a 5xx (AGL-2852).\n    if (isRefusedIdToken(error)) return refuse(401, 'Unauthenticated')\n    console.error('[crm] email-send could not verify the sender', error)\n    return refuse(500, 'The sign-in could not be checked. Try again.')\n  }\n  const resolved = await getOrgForHost(hostId).catch(() => null)\n  if (!resolved) return refuse(404, 'Unknown site')\n  const { orgId } = resolved\n  const org = (resolved.org ?? {}) as Partial<AglynOrgBilling>\n  if (decoded.staff !== true) {\n    const membership = await resolveOrgMembership(decoded.uid, orgId).catch(\n      () => null,\n    )\n    const member = (membership?.member ?? null) as Partial<AglynOrgMember> | null\n    const reaches =\n      isOrgWideMember(member) || Boolean(member?.hostAccess?.[hostId])\n    const allowed =\n      member &&\n      reaches &&\n      (await memberHasOrgPermission(orgId, member, 'data.manage'))\n    if (!allowed) {\n      return refuse(\n        403,\n        'Sending email from a record requires the data.manage permission on this site',\n      )\n    }\n  }\n  const email = normalizeContactEmail(decoded.email)\n  if (!email) {\n    // A reply-to is owed and the token is the only place it can honestly\n    // come from; an account with no address cannot be replied to.\n    return refuse(403, 'Your account has no email address to receive replies at.')\n  }\n  return {\n    ok: true,\n    uid: decoded.uid,\n    email,\n    name: typed(decoded.name, 120),\n    orgId,\n    org,\n  }\n}\n\n/**\n * The org variant's sender (AGL-2634): authorized by the org for an\n * org-wide member holding `data.manage`, with the same reply-to rule.\n */\nasync function authorizeOrgSender(\n  req: PluginApiRequest,\n  orgId: string,\n): Promise<Sender | Refusal> {\n  const caller = await authorizeOrgCaller(req, orgId, {\n    needs: 'data.manage',\n    refusal:\n      'Sending email at the organization level requires the data.manage ' +\n      'permission across the whole workspace',\n  })\n  if (caller.ok === false) return refuse(caller.status, caller.error)\n  const email = normalizeContactEmail(caller.email)\n  if (!email) {\n    return refuse(403, 'Your account has no email address to receive replies at.')\n  }\n  return {\n    ok: true,\n    uid: caller.uid,\n    email,\n    name: caller.name,\n    orgId,\n    org: caller.org as Partial<AglynOrgBilling>,\n  }\n}\n\ninterface Recipient {\n  ok: true\n  email: string\n  /** The document the consent basis is read off — the contact, or the lead. */\n  record: Record<string, unknown>\n  /** The contact document, when one was read — where the company link is. */\n  contact: Record<string, unknown> | null\n  link: CrmActivityLink\n  /**\n   * The site the record itself names — a contact's first capturing site, a\n   * deal's own, a lead's — which is the site an org-level send leaves from\n   * when the body named none.\n   */\n  siteHint: string\n  /** The deal document, when one was named — what `{{deal.*}}` reads (AGL-2658). */\n  deal: Record<string, unknown> | null\n  /** The lead document, when the recipient is a lead — what `{{lead.*}}` reads. */\n  lead: Record<string, unknown> | null\n}\n\n/**\n * The person the named record is about, as THIS site may see them.\n *\n * A deal names its contact; a lead carries its own address; a contact is\n * itself. Each is looked up by id and then checked against what the site\n * may read — the Admin SDK evaluates no rules, and a member of site A must\n * not be able to mail site B's contact by guessing an id. The links the\n * activity is filed under are whatever resolved: a deal's email is also the\n * contact's, so it lands on both timelines.\n *\n * At the organization level there is no site to check against and none is\n * checked: the caller was admitted as an org-wide member, who reads every\n * row. A lead still needs its site named — a lead lives under one.\n */\nasync function resolveRecipient(\n  firestore: FirebaseFirestore.Firestore,\n  scope: CrmRouteScope,\n  orgId: string,\n  ids: { contactId: string; leadId: string; dealId: string },\n): Promise<Recipient | Refusal> {\n  const link: CrmActivityLink = {}\n  const { hostId } = scope\n  const scoped = scope.level === 'site'\n  const visible = (tokens: unknown) =>\n    !scoped || visibleToHost(tokens as readonly string[], hostId)\n  let contactId = ids.contactId\n  let siteHint = ''\n  let dealRecord: Record<string, unknown> | null = null\n\n  if (ids.dealId) {\n    const deal = await firestore\n      .collection('orgs')\n      .doc(orgId)\n      .collection(CRM_COLLECTIONS.deals)\n      .doc(ids.dealId)\n      .get()\n    if (!deal.exists || !visible(deal.get('visibleTo'))) {\n      return refuse(404, 'Unknown deal')\n    }\n    link.dealId = deal.id\n    dealRecord = (deal.data() ?? {}) as Record<string, unknown>\n    siteHint = typed(deal.get('hostId'), 128)\n    contactId = contactId || String(deal.get('contactId') ?? '').trim()\n    if (!contactId) {\n      return refuse(400, 'This deal names no contact to email.')\n    }\n  }\n\n  if (contactId) {\n    const contacts = scoped\n      ? await orgDataCollectionForHost(hostId, 'contacts')\n      : firestore.collection('orgs').doc(orgId).collection('contacts')\n    const contact = await contacts.doc(contactId).get()\n    if (!contact.exists || !visible(contact.get('visibleTo'))) {\n      return refuse(404, 'Unknown contact')\n    }\n    const email = normalizeContactEmail(contact.get('email'))\n    if (!email) return refuse(400, 'This contact has no email address.')\n    const record = (contact.data() ?? {}) as Record<string, unknown>\n    link.contactId = contact.id\n    if (ids.leadId) link.leadId = ids.leadId\n    siteHint =\n      siteHint || typed(record['hostId'], 128) || contactCaptureHostIds(record)[0] || ''\n    return { ok: true, email, record, contact: record, link, siteHint, deal: dealRecord, lead: null }\n  }\n\n  if (ids.leadId) {\n    if (!hostId) return refuse(400, 'Name the site the lead lives under.')\n    const lead = await readLeadForHost(hostId, ids.leadId)\n    if (!lead) return refuse(404, 'Unknown lead')\n    const email = normalizeContactEmail(lead.get('email'))\n    if (!email) return refuse(400, 'This lead has no email address.')\n    const record = (lead.data() ?? {}) as Record<string, unknown>\n    link.leadId = lead.id\n    // A converted lead's email belongs on the contact it became as well.\n    const converted = String(lead.get('convertedContactId') ?? '').trim()\n    if (converted) link.contactId = converted\n    return { ok: true, email, record, contact: null, link, siteHint: hostId, deal: null, lead: record }\n  }\n\n  return refuse(400, 'Name a contact, lead or deal to email.')\n}\n\n/**\n * The site an org-level send leaves from (AGL-2634): the body's, else the\n * record's own, else the org's only site — and a refusal the dialog turns\n * into a Site picker when the org has several and none was named.\n */\nasync function resolveSendingSite(\n  firestore: FirebaseFirestore.Firestore,\n  scope: CrmRouteScope,\n  orgId: string,\n  siteHint: string,\n): Promise<{ ok: true; hostId: string } | Refusal> {\n  if (scope.hostId) return { ok: true, hostId: scope.hostId }\n  if (siteHint) return { ok: true, hostId: siteHint }\n  const hosts = await orgHostIds(firestore, orgId)\n  if (hosts.length === 1) return { ok: true, hostId: hosts[0] }\n  return refuse(409, CRM_EMAIL_PICK_SITE_MESSAGE, { reason: 'site' })\n}\n\n/** The HTTP shape of a send the provider did not accept. */\nfunction sendRefusal(result: SendEmailResult): Refusal {\n  const reason = sendFailureReason(result)\n  const detail = String((result as { detail?: unknown }).detail ?? '')\n  if (reason === 'unverified-domain') {\n    return refuse(409, detail || 'This site has no verified sending identity.', {\n      reason: 'sending-identity',\n    })\n  }\n  if (reason === 'suppressed' || reason === 'unengaged') {\n    return refuse(409, CRM_EMAIL_SUPPRESSED_MESSAGE, { reason: 'suppressed' })\n  }\n  // The deliverability preflight (AGL-3328): the recipient's domain takes\n  // no mail. A standing fact about the address, said in the engine's words\n  // — not a provider fault the rep should retry.\n  if (reason === 'undeliverable' || reason === 'gateway-held') {\n    return refuse(409, detail || 'This address cannot receive email.', { reason: 'undeliverable' })\n  }\n  if (reason === 'rate-limited') {\n    const retryAtMs = Number((result as { retryAtMs?: unknown }).retryAtMs)\n    return refuse(\n      503,\n      'The mail provider asked us to slow down. Try again in a minute.',\n      {\n        reason: 'provider-rate',\n        retryAfterSeconds: Number.isFinite(retryAtMs)\n          ? Math.max(1, Math.ceil((retryAtMs - Date.now()) / 1000))\n          : 60,\n      },\n    )\n  }\n  if (reason === 'unconfigured') {\n    return refuse(501, 'Email is not configured on this deployment.', {\n      reason: 'unconfigured',\n    })\n  }\n  return refuse(502, 'The email could not be sent.', { reason: 'send-failed' })\n}\n\n/** What the route says when a subject or a message is nothing once its fields are filled. */\nexport const CRM_EMAIL_EMPTY_AFTER_MERGE_MESSAGE =\n  'The subject and the message are empty once their merge fields are filled ' +\n  'in. Check the fields against this record.'\n\n/**\n * What `{{…}}` reads from, for this send (AGL-2658): the documents already\n * in hand — the contact, the deal, the lead — the sender off their token,\n * and the site's name, read only when a field asks for it. The contact's\n * facet is the SENDING site's group's, because a name, a job title and a\n * company are one holder's knowledge of a person.\n */\nasync function mergeContextFor(options: {\n  recipient: Recipient\n  sender: Sender\n  hostId: string\n  groupId: string\n  fields: readonly string[]\n}): Promise<CrmMergeContext> {\n  const { recipient, sender, hostId, groupId, fields } = options\n  const wantsSite = fields.some((field) => field.startsWith('site.'))\n  const host = wantsSite ? await getHostDocAdmin(hostId).catch(() => null) : null\n  return {\n    contact: recipient.contact,\n    contactGroupId: groupId,\n    lead: recipient.lead,\n    deal: recipient.deal,\n    sender: { name: sender.name, email: sender.email },\n    site: { name: typed(host?.['displayName'], 200) },\n  }\n}\n\nfunction answer(res: PluginApiResponse, refusal: Refusal): void {\n  const retry = refusal.body['retryAfterSeconds']\n  if (typeof retry === 'number') res.setHeader('Retry-After', String(retry))\n  res.status(refusal.status).json(refusal.body)\n}\n\nexport const crmEmailSendHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  const body = (req.body ?? {}) as Record<string, unknown>\n  const routeScope = readCrmRouteScope(body)\n  if (!routeScope) {\n    res.status(400).json({ error: 'Missing hostId' })\n    return\n  }\n  const ids = {\n    contactId: typed(body['contactId'], 128),\n    leadId: typed(body['leadId'], 128),\n    dealId: typed(body['dealId'], 128),\n  }\n  if (!ids.contactId && !ids.leadId && !ids.dealId) {\n    res.status(400).json({ error: 'Name a contact, lead or deal to email.' })\n    return\n  }\n  const draftSubject = typed(body['subject'], CRM_EMAIL_SUBJECT_MAX)\n  if (!draftSubject) {\n    res.status(400).json({ error: 'Enter a subject.' })\n    return\n  }\n  // Paragraphs are what the dialog offers, and a plain-text part is what a\n  // paragraph is; line endings are normalized so the stored body and the\n  // sent body are one string.\n  const draftText = String(body['body'] ?? '')\n    .replace(/\\r\\n?/g, '\\n')\n    .trim()\n    .slice(0, CRM_EMAIL_BODY_MAX)\n  if (!draftText) {\n    res.status(400).json({ error: 'Write the message.' })\n    return\n  }\n\n  try {\n    const sender =\n      routeScope.level === 'org'\n        ? await authorizeOrgSender(req, routeScope.orgId)\n        : await authorizeSender(req, routeScope.hostId)\n    if (sender.ok === false) return answer(res, sender)\n    const { orgId, org } = sender\n    /*\n     * THE PLAN, before the pace and the cap (AGL-2787). One-to-one email is\n     * the suite's; a plan without the suite is refused as such, rather than\n     * reaching the daily cap and being told about a zero it has no way to\n     * raise short of the upgrade this names.\n     */\n    const suite = crmSuiteRefusal(org, 'Emailing one person from their record')\n    if (suite) return answer(res, { ok: false, status: suite.status, body: suite.body })\n\n    /*\n     * THE PER-USER PACE, on its own key. The console dispatcher already\n     * counts this write against the person's general console budget; this\n     * is the narrower bucket the feature owes — twenty a minute is a rep\n     * writing, and past it is a script — keyed by the uid the token proved\n     * so one person cannot spend the bucket of everyone on their address.\n     */\n    const rate = await consumeRateLimit(`crm-email-send:uid:${sender.uid}`, {\n      limit: CRM_EMAIL_SENDS_PER_MINUTE,\n      windowMs: CRM_EMAIL_RATE_WINDOW_MS,\n    })\n    if (!rate.allowed) {\n      return answer(\n        res,\n        refuse(429, CRM_EMAIL_RATE_MESSAGE, {\n          reason: 'rate',\n          retryAfterSeconds: Math.max(\n            1,\n            Math.ceil((rate.resetMs - Date.now()) / 1000),\n          ),\n        }),\n      )\n    }\n\n    const firestore = firebaseAdmin.app().firestore()\n    const recipient = await resolveRecipient(firestore, routeScope, orgId, ids)\n    if (recipient.ok === false) return answer(res, recipient)\n    // The site the message leaves from — the mounted one under a site, and\n    // at the organization level whatever the body, the record or the org\n    // can answer.\n    const site = await resolveSendingSite(firestore, routeScope, orgId, recipient.siteHint)\n    if (site.ok === false) return answer(res, site)\n    const { hostId } = site\n    const group = await consentGroupForSite(hostId, org as Record<string, unknown>)\n    // The company the sending site files this person under, so the email\n    // shows on the company's log as the automation step's rows do.\n    if (recipient.contact) {\n      const facet = readContactFacet(recipient.contact, group.groupId)\n      if (facet.companyId) recipient.link.companyId = facet.companyId\n    }\n\n    /*\n     * MERGE FIELDS (AGL-2658), filled here rather than in the dialog: the\n     * dialog previews with the same resolver, but what leaves and what is\n     * logged is rendered by the route, off the documents it read to find\n     * the recipient, so a preview the rep did not look at cannot differ\n     * from the letter. A subject or a message that is nothing once its\n     * fields are filled is refused before any gate is spent on it.\n     */\n    const fields = crmMergeFieldsIn(`${draftSubject}\\n${draftText}`)\n    const merge = fields.length\n      ? await mergeContextFor({ recipient, sender, hostId, groupId: group.groupId, fields })\n      : null\n    const subject = merge\n      ? renderCrmMergeFields(draftSubject, merge).trim().slice(0, CRM_EMAIL_SUBJECT_MAX)\n      : draftSubject\n    const text = merge\n      ? renderCrmMergeFields(draftText, merge).trim().slice(0, CRM_EMAIL_BODY_MAX)\n      : draftText\n    if (!subject || !text) {\n      return answer(res, refuse(400, CRM_EMAIL_EMPTY_AFTER_MERGE_MESSAGE, { reason: 'merge' }))\n    }\n\n    // The per-record ceiling, before the send: an email that could not be\n    // logged would be a message the timeline never shows, and the timeline\n    // is the reason the send lives on the record.\n    const orgRef = firestore.collection('orgs').doc(orgId)\n    if (!crmActivityLogHasRoom(await countCrmActivitiesForRecord(orgRef, recipient.link))) {\n      return answer(res, refuse(409, CRM_ACTIVITY_LOG_FULL_MESSAGE, { reason: 'ceiling' }))\n    }\n\n    // Both suppression lists, then the person's own refusal — each read\n    // across the sending site's consent group, so leaving one site of a\n    // declared group stops this one writing too.\n    const sendable = await filterSendableForHost(\n      hostId,\n      [recipient.email],\n      undefined,\n      group,\n    )\n    if (!sendable.length) {\n      return answer(res, refuse(409, CRM_EMAIL_SUPPRESSED_MESSAGE, { reason: 'suppressed' }))\n    }\n    if (readMarketingBasis(recipient.record, group).basis === 'declined') {\n      return answer(res, refuse(409, CRM_EMAIL_DECLINED_MESSAGE, { reason: 'declined' }))\n    }\n    // The record's own verdict (AGL-3245): what the lists hold, in the words\n    // the page shows — a bounce, a gateway block, a do-not-contact mark the\n    // suppression lists do not carry.\n    const stateRefusal = emailStateRefusal(readEmailState(recipient.record))\n    if (stateRefusal) {\n      return answer(res, refuse(409, stateRefusal, { reason: 'email-state' }))\n    }\n\n    if (!isEmailConfigured()) {\n      return answer(\n        res,\n        refuse(501, 'Email is not configured on this deployment.', {\n          reason: 'unconfigured',\n        }),\n      )\n    }\n    const identity = await hostSendingIdentity(hostId)\n    if (identity.refusal) {\n      return answer(\n        res,\n        refuse(409, identity.refusal.message, { reason: 'sending-identity' }),\n      )\n    }\n\n    const now = new Date()\n    /*\n     * THE NEW-WORKSPACE RAMP, resolved for the ceiling below.\n     *\n     * A workspace past its first week graduates off the org record alone and\n     * pays no read for this. One that is still on the ramp needs its\n     * delivery history to know which step it has earned, and when that\n     * history is unreadable the step is a floor rather than an answer.\n     *\n     * A floor is enough for a campaign, which defers what it cannot send\n     * today and delivers it tomorrow. It is not enough here: this route\n     * admits or refuses ONE message and has no third answer, so a ramp that\n     * cannot say what a workspace has earned refuses and says so. The\n     * refusal is transient by construction — it lasts as long as the window\n     * read is failing — and it reaches only workspaces inside their first\n     * week, since every other one graduated before the window was consulted.\n     */\n    const { ramp, degraded } = await readOrgEmailRamp({\n      orgId,\n      createdAt: (org as Record<string, unknown>)['createdAt'],\n      now: now.getTime(),\n    })\n    if (degraded) {\n      return answer(\n        res,\n        refuse(503, CRM_EMAIL_RAMP_UNAVAILABLE_MESSAGE, {\n          reason: 'ramp-unavailable',\n        }),\n      )\n    }\n\n    // THE DAILY CAP (AGL-2611), taken as a slot rather than read as a\n    // figure (AGL-2645): the transaction reads today's counter, judges it\n    // with `checkCrmEmailQuota` against the ramp's share of the plan's day\n    // and raises it in one step, so the count the cap enforces is the count\n    // this send was admitted on.\n    const claim = await reserveCrmEmailSend(firestore, orgId, org, now, ramp)\n    if (!claim.ok) {\n      const { quota } = claim\n      // WHICH ceiling was reached, in the org's own terms. The reservation\n      // answers with the number it judged, which is the plan's day unless\n      // the ramp held this workspace below it — and a workspace shown a\n      // figure under the one its plan page advertises is owed the reason.\n      const rampBound =\n        quota.included < resolveOrgEntitlements(org).crmEmailsPerDay\n      return answer(\n        res,\n        refuse(\n          409,\n          quota.included <= 0\n            ? CRM_EMAIL_NOT_INCLUDED_MESSAGE\n            : rampBound\n              ? crmEmailRampReachedMessage(quota.included, quota.used)\n              : crmEmailCapReachedMessage(quota.included),\n          {\n            reason: rampBound ? 'ramp' : 'quota',\n            included: quota.included,\n            used: quota.used,\n            resetsAtMs: quota.resetsAt.getTime(),\n          },\n        ),\n      )\n    }\n\n    // The row's id, minted before the send so the delivery webhook can find\n    // it from the tags alone; written only once the message has left.\n    const activityRef = newCrmActivityRef(firestore, orgId)\n    let result: SendEmailResult\n    try {\n      result = await sendEmail({\n        to: recipient.email,\n        subject,\n        text,\n        sendingIdentity: identity,\n        audience: 'tenant',\n        context: CRM_EMAIL_CONTEXT,\n        replyTo: sender.email,\n        ...(sender.name ? { fromName: sender.name } : {}),\n        tags: crmEmailDeliveryTags({ orgId, hostId, activityId: activityRef.id }),\n      })\n    } catch (error) {\n      // The provider never answered, so no message left: the slot goes\n      // back before the failure is reported.\n      await releaseCrmEmailSend(firestore, claim.reservation)\n      throw error\n    }\n    if (!result.sent) {\n      await releaseCrmEmailSend(firestore, claim.reservation)\n      return answer(res, sendRefusal(result))\n    }\n\n    const sentAtMs = Date.now()\n    let logged = true\n    /*\n     * Who may list the row. Under a site, what a record created there is\n     * stamped with. At the organization level the RECORD's own tokens, so\n     * an email to a person another site captured shows on their timeline\n     * under that site's hub — a row stamped with the sending site alone\n     * would be invisible where the person is read.\n     */\n    const recordTokens = recipient.record['visibleTo']\n    const visibleTo =\n      routeScope.level === 'org' && Array.isArray(recordTokens) && recordTokens.length\n        ? recordTokens.map(String)\n        : crmScopeTokens(org as Record<string, unknown>, group)\n    try {\n      await writeCrmEmailActivity(\n        activityRef,\n        buildCrmEmailActivity({\n          subject,\n          body: text,\n          to: recipient.email,\n          atMs: sentAtMs,\n          byUid: sender.uid,\n          ...(sender.name ? { byName: sender.name } : {}),\n          link: recipient.link,\n          hostId,\n          visibleTo,\n        }),\n      )\n    } catch (error) {\n      // The message has left. A row that could not be written is a gap on\n      // the timeline, not a failed send, and it is said so in the answer.\n      console.error('[crm] email activity write failed', orgId, activityRef.id, error)\n      logged = false\n    }\n    // The cap's count was taken with the reservation; the org's cost meter\n    // for COGS is stamped after delivery, unable to fail the send.\n    await recordEmailSends({\n      scope: { kind: 'org', orgId },\n      count: 1,\n      sendClass: 'transactional',\n      firestore,\n    })\n    // The org-level act, in the org's feed: the site variant's is the\n    // timeline row itself, under the site the record page is on.\n    if (routeScope.level === 'org') {\n      await logOrgActivity(\n        orgId,\n        { uid: sender.uid, email: sender.email },\n        'Sent email',\n        recipient.link.contactId\n          ? { type: 'contact', id: recipient.link.contactId, name: recipient.email }\n          : { type: 'lead', id: recipient.link.leadId, name: recipient.email },\n      )\n    }\n    res.status(200).json({\n      ok: true,\n      activityId: activityRef.id,\n      to: recipient.email,\n      from: identity.from,\n      logged,\n    })\n  } catch (error) {\n    console.error('[crm] email-send failed', routeScope, error)\n    res.status(500).json({ error: 'The email could not be sent.' })\n  }\n}\n\nexport default crmEmailSendHandler\n"],"names":["buildCrmEmailActivity","contactCaptureHostIds","CRM_ACTIVITY_LOG_FULL_MESSAGE","CRM_COLLECTIONS","CRM_EMAIL_BODY_MAX","CRM_EMAIL_CONTEXT","CRM_EMAIL_SUBJECT_MAX","crmActivityLogHasRoom","crmEmailDeliveryTags","emailStateRefusal","crmMergeFieldsIn","crmScopeTokens","isOrgWideMember","normalizeContactEmail","readContactFacet","readEmailState","readMarketingBasis","renderCrmMergeFields","resolveOrgEntitlements","visibleToHost","isEmailConfigured","sendEmail","sendFailureReason","consentGroupForSite","consumeRateLimit","countCrmActivitiesForRecord","filterSendableForHost","firebaseAdmin","getHostDocAdmin","getOrgForHost","hostSendingIdentity","logOrgActivity","memberHasOrgPermission","orgDataCollectionForHost","readLeadForHost","readOrgEmailRamp","recordEmailSends","releaseCrmEmailSend","reserveCrmEmailSend","resolveOrgMembership","isRefusedIdToken","authorizeOrgCaller","orgHostIds","readCrmRouteScope","crmSuiteRefusal","newCrmActivityRef","writeCrmEmailActivity","CRM_EMAIL_SENDS_PER_MINUTE","CRM_EMAIL_RATE_WINDOW_MS","CRM_EMAIL_NOT_INCLUDED_MESSAGE","crmEmailCapReachedMessage","included","toLocaleString","crmEmailRampReachedMessage","ceiling","used","CRM_EMAIL_RAMP_UNAVAILABLE_MESSAGE","CRM_EMAIL_SUPPRESSED_MESSAGE","CRM_EMAIL_DECLINED_MESSAGE","CRM_EMAIL_RATE_MESSAGE","CRM_EMAIL_PICK_SITE_MESSAGE","refuse","status","error","extra","ok","body","typed","value","max","String","trim","slice","authorizeSender","req","hostId","resolved","authorization","headers","idToken","startsWith","length","undefined","decoded","app","auth","verifyIdToken","console","catch","orgId","org","staff","member","membership","uid","reaches","Boolean","hostAccess","allowed","email","name","authorizeOrgSender","caller","needs","refusal","resolveRecipient","firestore","scope","ids","link","scoped","level","visible","tokens","contactId","siteHint","dealRecord","dealId","deal","collection","doc","deals","get","exists","id","data","contact","contacts","record","leadId","lead","converted","resolveSendingSite","hosts","reason","sendRefusal","result","detail","retryAtMs","Number","retryAfterSeconds","isFinite","Math","ceil","Date","now","CRM_EMAIL_EMPTY_AFTER_MERGE_MESSAGE","mergeContextFor","options","recipient","sender","groupId","fields","wantsSite","some","field","host","contactGroupId","site","answer","res","retry","setHeader","json","crmEmailSendHandler","method","routeScope","draftSubject","draftText","replace","suite","rate","limit","windowMs","resetMs","group","facet","companyId","merge","subject","text","orgRef","sendable","basis","stateRefusal","identity","message","ramp","degraded","createdAt","getTime","claim","quota","rampBound","crmEmailsPerDay","resetsAtMs","resetsAt","activityRef","to","sendingIdentity","audience","context","replyTo","fromName","tags","activityId","reservation","sent","sentAtMs","logged","recordTokens","visibleTo","Array","isArray","map","atMs","byUid","byName","kind","count","sendClass","type","from"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAGEA,qBAAqB,EACrBC,qBAAqB,EACrBC,6BAA6B,EAC7BC,eAAe,EACfC,kBAAkB,EAClBC,iBAAiB,EACjBC,qBAAqB,EAErBC,qBAAqB,EACrBC,oBAAoB,EACpBC,iBAAiB,EAEjBC,gBAAgB,EAChBC,cAAc,EACdC,eAAe,EACfC,qBAAqB,EAIrBC,gBAAgB,EAChBC,cAAc,EACdC,kBAAkB,EAClBC,oBAAoB,EACpBC,sBAAsB,EACtBC,aAAa,QACR,sBAAqB;AAC5B,SACEC,iBAAiB,EACjBC,SAAS,EACTC,iBAAiB,QAEZ,2BAA0B;AACjC,SACEC,mBAAmB,EACnBC,gBAAgB,EAChBC,2BAA2B,EAC3BC,qBAAqB,EACrBC,aAAa,EACbC,eAAe,EACfC,aAAa,EACbC,mBAAmB,EACnBC,cAAc,EACdC,sBAAsB,EACtBC,wBAAwB,EACxBC,eAAe,EACfC,gBAAgB,EAChBC,gBAAgB,EAChBC,mBAAmB,EACnBC,mBAAmB,EACnBC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,gBAAgB,QAAQ,mDAAkD;AACnF,SACEC,kBAAkB,EAElBC,UAAU,EACVC,iBAAiB,QACZ,kBAAc;AACrB,SAASC,eAAe,QAAQ,kBAAc;AAC9C,SAASC,iBAAiB,EAAEC,qBAAqB,QAAQ,0BAAsB;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0EC,GAED,kEAAkE,GAClE,OAAO,MAAMC,6BAA6B,GAAE;AAC5C,MAAMC,2BAA2B;AAEjC,0EAA0E,GAC1E,OAAO,MAAMC,iCACX,8EACA,6BAA4B;AAE9B,2EAA2E,GAC3E,OAAO,SAASC,0BAA0BC,QAAgB;IACxD,OACE,CAAC,gCAAgC,EAAEA,SAASC,cAAc,CAAC,SAAS,KAAK,CAAC,GAC1E;AAEJ;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASC,2BACdC,OAAe,EACfC,IAAY;IAEZ,OACE,CAAC,wBAAwB,EAAED,QAAQF,cAAc,CAAC,SAAS,YAAY,CAAC,GACxE,CAAC,KAAK,EAAEE,YAAY,IAAI,KAAK,IAAI,sCAAsC,CAAC,GACxE,CAAC,sBAAsB,EAAEC,KAAKH,cAAc,CAAC,SAAS,gBAAgB,CAAC,GACvE,yEACA,0EACA;AAEJ;AAEA,uEAAuE,GACvE,OAAO,MAAMI,qCACX,8EACA,+EACA,kEAAiE;AAEnE,OAAO,MAAMC,+BACX,6EACA,WAAU;AAEZ,OAAO,MAAMC,6BACX,oDAAmD;AAErD,OAAO,MAAMC,yBACX,iFAAgF;AAElF,8EAA8E,GAC9E,OAAO,MAAMC,8BACX,4EACA,sBAAqB;AAIvB,MAAMC,SAAS,CACbC,QACAC,OACAC,QAAiC,CAAC,CAAC,GACtB,CAAA;QAAEC,IAAI;QAAOH;QAAQI,MAAM;YAAEH;WAAUC;IAAQ,CAAA;AAE9D,0CAA0C,GAC1C,SAASG,MAAMC,KAAc,EAAEC,GAAW;IACxC,OAAOC,OAAOF,gBAAAA,QAAS,IACpBG,IAAI,GACJC,KAAK,CAAC,GAAGH;AACd;AAaA;;;;;;CAMC,GACD,eAAeI,gBACbC,GAAqB,EACrBC,MAAc;QAEeD,4BAkBhBE;IAlBb,MAAMC,gBAAgBP,QAAOI,6BAAAA,IAAII,OAAO,CAACD,aAAa,YAAzBH,6BAA6B;IAC1D,MAAMK,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcL,KAAK,CAAC,UAAUS,MAAM,IACpCC;IACJ,IAAI,CAACH,SAAS,OAAOlB,OAAO,KAAK;IACjC,IAAIsB;IACJ,IAAI;QACFA,UAAU,MAAMxD,cAAcyD,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACP;IAC3D,EAAE,OAAOhB,OAAO;QACd,sEAAsE;QACtE,mCAAmC;QACnC,IAAIvB,iBAAiBuB,QAAQ,OAAOF,OAAO,KAAK;QAChD0B,QAAQxB,KAAK,CAAC,gDAAgDA;QAC9D,OAAOF,OAAO,KAAK;IACrB;IACA,MAAMe,WAAW,MAAM/C,cAAc8C,QAAQa,KAAK,CAAC,IAAM;IACzD,IAAI,CAACZ,UAAU,OAAOf,OAAO,KAAK;IAClC,MAAM,EAAE4B,KAAK,EAAE,GAAGb;IAClB,MAAMc,OAAOd,gBAAAA,SAASc,GAAG,YAAZd,gBAAgB,CAAC;IAC9B,IAAIO,QAAQQ,KAAK,KAAK,MAAM;;YAMWC;QALrC,MAAMC,aAAa,MAAMtD,qBAAqB4C,QAAQW,GAAG,EAAEL,OAAOD,KAAK,CACrE,IAAM;QAER,MAAMI,iBAAUC,8BAAAA,WAAYD,MAAM,mBAAI;QACtC,MAAMG,UACJnF,gBAAgBgF,WAAWI,QAAQJ,2BAAAA,qBAAAA,OAAQK,UAAU,qBAAlBL,kBAAoB,CAACjB,OAAO;QACjE,MAAMuB,UACJN,UACAG,WACC,MAAM/D,uBAAuByD,OAAOG,QAAQ;QAC/C,IAAI,CAACM,SAAS;YACZ,OAAOrC,OACL,KACA;QAEJ;IACF;IACA,MAAMsC,QAAQtF,sBAAsBsE,QAAQgB,KAAK;IACjD,IAAI,CAACA,OAAO;QACV,qEAAqE;QACrE,8DAA8D;QAC9D,OAAOtC,OAAO,KAAK;IACrB;IACA,OAAO;QACLI,IAAI;QACJ6B,KAAKX,QAAQW,GAAG;QAChBK;QACAC,MAAMjC,MAAMgB,QAAQiB,IAAI,EAAE;QAC1BX;QACAC;IACF;AACF;AAEA;;;CAGC,GACD,eAAeW,mBACb3B,GAAqB,EACrBe,KAAa;IAEb,MAAMa,SAAS,MAAM7D,mBAAmBiC,KAAKe,OAAO;QAClDc,OAAO;QACPC,SACE,sEACA;IACJ;IACA,IAAIF,OAAOrC,EAAE,KAAK,OAAO,OAAOJ,OAAOyC,OAAOxC,MAAM,EAAEwC,OAAOvC,KAAK;IAClE,MAAMoC,QAAQtF,sBAAsByF,OAAOH,KAAK;IAChD,IAAI,CAACA,OAAO;QACV,OAAOtC,OAAO,KAAK;IACrB;IACA,OAAO;QACLI,IAAI;QACJ6B,KAAKQ,OAAOR,GAAG;QACfK;QACAC,MAAME,OAAOF,IAAI;QACjBX;QACAC,KAAKY,OAAOZ,GAAG;IACjB;AACF;AAsBA;;;;;;;;;;;;;CAaC,GACD,eAAee,iBACbC,SAAsC,EACtCC,KAAoB,EACpBlB,KAAa,EACbmB,GAA0D;IAE1D,MAAMC,OAAwB,CAAC;IAC/B,MAAM,EAAElC,MAAM,EAAE,GAAGgC;IACnB,MAAMG,SAASH,MAAMI,KAAK,KAAK;IAC/B,MAAMC,UAAU,CAACC,SACf,CAACH,UAAU3F,cAAc8F,QAA6BtC;IACxD,IAAIuC,YAAYN,IAAIM,SAAS;IAC7B,IAAIC,WAAW;IACf,IAAIC,aAA6C;IAEjD,IAAIR,IAAIS,MAAM,EAAE;YAWAC,YAEkBA;QAZhC,MAAMA,OAAO,MAAMZ,UAChBa,UAAU,CAAC,QACXC,GAAG,CAAC/B,OACJ8B,UAAU,CAACpH,gBAAgBsH,KAAK,EAChCD,GAAG,CAACZ,IAAIS,MAAM,EACdK,GAAG;QACN,IAAI,CAACJ,KAAKK,MAAM,IAAI,CAACX,QAAQM,KAAKI,GAAG,CAAC,eAAe;YACnD,OAAO7D,OAAO,KAAK;QACrB;QACAgD,KAAKQ,MAAM,GAAGC,KAAKM,EAAE;QACrBR,cAAcE,aAAAA,KAAKO,IAAI,cAATP,aAAe,CAAC;QAC9BH,WAAWhD,MAAMmD,KAAKI,GAAG,CAAC,WAAW;QACrCR,YAAYA,aAAa5C,QAAOgD,YAAAA,KAAKI,GAAG,CAAC,wBAATJ,YAAyB,IAAI/C,IAAI;QACjE,IAAI,CAAC2C,WAAW;YACd,OAAOrD,OAAO,KAAK;QACrB;IACF;IAEA,IAAIqD,WAAW;YAUGY;QAThB,MAAMC,WAAWjB,SACb,MAAM7E,yBAAyB0C,QAAQ,cACvC+B,UAAUa,UAAU,CAAC,QAAQC,GAAG,CAAC/B,OAAO8B,UAAU,CAAC;QACvD,MAAMO,UAAU,MAAMC,SAASP,GAAG,CAACN,WAAWQ,GAAG;QACjD,IAAI,CAACI,QAAQH,MAAM,IAAI,CAACX,QAAQc,QAAQJ,GAAG,CAAC,eAAe;YACzD,OAAO7D,OAAO,KAAK;QACrB;QACA,MAAMsC,QAAQtF,sBAAsBiH,QAAQJ,GAAG,CAAC;QAChD,IAAI,CAACvB,OAAO,OAAOtC,OAAO,KAAK;QAC/B,MAAMmE,UAAUF,gBAAAA,QAAQD,IAAI,cAAZC,gBAAkB,CAAC;QACnCjB,KAAKK,SAAS,GAAGY,QAAQF,EAAE;QAC3B,IAAIhB,IAAIqB,MAAM,EAAEpB,KAAKoB,MAAM,GAAGrB,IAAIqB,MAAM;QACxCd,WACEA,YAAYhD,MAAM6D,MAAM,CAAC,SAAS,EAAE,QAAQ/H,sBAAsB+H,OAAO,CAAC,EAAE,IAAI;QAClF,OAAO;YAAE/D,IAAI;YAAMkC;YAAO6B;YAAQF,SAASE;YAAQnB;YAAMM;YAAUG,MAAMF;YAAYc,MAAM;QAAK;IAClG;IAEA,IAAItB,IAAIqB,MAAM,EAAE;YAMEC,YAGSA;QARzB,IAAI,CAACvD,QAAQ,OAAOd,OAAO,KAAK;QAChC,MAAMqE,OAAO,MAAMhG,gBAAgByC,QAAQiC,IAAIqB,MAAM;QACrD,IAAI,CAACC,MAAM,OAAOrE,OAAO,KAAK;QAC9B,MAAMsC,QAAQtF,sBAAsBqH,KAAKR,GAAG,CAAC;QAC7C,IAAI,CAACvB,OAAO,OAAOtC,OAAO,KAAK;QAC/B,MAAMmE,UAAUE,aAAAA,KAAKL,IAAI,cAATK,aAAe,CAAC;QAChCrB,KAAKoB,MAAM,GAAGC,KAAKN,EAAE;QACrB,qEAAqE;QACrE,MAAMO,YAAY7D,QAAO4D,YAAAA,KAAKR,GAAG,CAAC,iCAATQ,YAAkC,IAAI3D,IAAI;QACnE,IAAI4D,WAAWtB,KAAKK,SAAS,GAAGiB;QAChC,OAAO;YAAElE,IAAI;YAAMkC;YAAO6B;YAAQF,SAAS;YAAMjB;YAAMM,UAAUxC;YAAQ2C,MAAM;YAAMY,MAAMF;QAAO;IACpG;IAEA,OAAOnE,OAAO,KAAK;AACrB;AAEA;;;;CAIC,GACD,eAAeuE,mBACb1B,SAAsC,EACtCC,KAAoB,EACpBlB,KAAa,EACb0B,QAAgB;IAEhB,IAAIR,MAAMhC,MAAM,EAAE,OAAO;QAAEV,IAAI;QAAMU,QAAQgC,MAAMhC,MAAM;IAAC;IAC1D,IAAIwC,UAAU,OAAO;QAAElD,IAAI;QAAMU,QAAQwC;IAAS;IAClD,MAAMkB,QAAQ,MAAM3F,WAAWgE,WAAWjB;IAC1C,IAAI4C,MAAMpD,MAAM,KAAK,GAAG,OAAO;QAAEhB,IAAI;QAAMU,QAAQ0D,KAAK,CAAC,EAAE;IAAC;IAC5D,OAAOxE,OAAO,KAAKD,6BAA6B;QAAE0E,QAAQ;IAAO;AACnE;AAEA,0DAA0D,GAC1D,SAASC,YAAYC,MAAuB;QAEpB;IADtB,MAAMF,SAAShH,kBAAkBkH;IACjC,MAAMC,SAASnE,QAAO,iBAAA,AAACkE,OAAgCC,MAAM,YAAvC,iBAA2C;IACjE,IAAIH,WAAW,qBAAqB;QAClC,OAAOzE,OAAO,KAAK4E,UAAU,+CAA+C;YAC1EH,QAAQ;QACV;IACF;IACA,IAAIA,WAAW,gBAAgBA,WAAW,aAAa;QACrD,OAAOzE,OAAO,KAAKJ,8BAA8B;YAAE6E,QAAQ;QAAa;IAC1E;IACA,wEAAwE;IACxE,yEAAyE;IACzE,+CAA+C;IAC/C,IAAIA,WAAW,mBAAmBA,WAAW,gBAAgB;QAC3D,OAAOzE,OAAO,KAAK4E,UAAU,sCAAsC;YAAEH,QAAQ;QAAgB;IAC/F;IACA,IAAIA,WAAW,gBAAgB;QAC7B,MAAMI,YAAYC,OAAO,AAACH,OAAmCE,SAAS;QACtE,OAAO7E,OACL,KACA,mEACA;YACEyE,QAAQ;YACRM,mBAAmBD,OAAOE,QAAQ,CAACH,aAC/BI,KAAKzE,GAAG,CAAC,GAAGyE,KAAKC,IAAI,CAAC,AAACL,CAAAA,YAAYM,KAAKC,GAAG,EAAC,IAAK,SACjD;QACN;IAEJ;IACA,IAAIX,WAAW,gBAAgB;QAC7B,OAAOzE,OAAO,KAAK,+CAA+C;YAChEyE,QAAQ;QACV;IACF;IACA,OAAOzE,OAAO,KAAK,gCAAgC;QAAEyE,QAAQ;IAAc;AAC7E;AAEA,2FAA2F,GAC3F,OAAO,MAAMY,sCACX,8EACA,4CAA2C;AAE7C;;;;;;CAMC,GACD,eAAeC,gBAAgBC,OAM9B;IACC,MAAM,EAAEC,SAAS,EAAEC,MAAM,EAAE3E,MAAM,EAAE4E,OAAO,EAAEC,MAAM,EAAE,GAAGJ;IACvD,MAAMK,YAAYD,OAAOE,IAAI,CAAC,CAACC,QAAUA,MAAM3E,UAAU,CAAC;IAC1D,MAAM4E,OAAOH,YAAY,MAAM7H,gBAAgB+C,QAAQa,KAAK,CAAC,IAAM,QAAQ;IAC3E,OAAO;QACLsC,SAASuB,UAAUvB,OAAO;QAC1B+B,gBAAgBN;QAChBrB,MAAMmB,UAAUnB,IAAI;QACpBZ,MAAM+B,UAAU/B,IAAI;QACpBgC,QAAQ;YAAElD,MAAMkD,OAAOlD,IAAI;YAAED,OAAOmD,OAAOnD,KAAK;QAAC;QACjD2D,MAAM;YAAE1D,MAAMjC,MAAMyF,wBAAAA,IAAM,CAAC,cAAc,EAAE;QAAK;IAClD;AACF;AAEA,SAASG,OAAOC,GAAsB,EAAExD,OAAgB;IACtD,MAAMyD,QAAQzD,QAAQtC,IAAI,CAAC,oBAAoB;IAC/C,IAAI,OAAO+F,UAAU,UAAUD,IAAIE,SAAS,CAAC,eAAe5F,OAAO2F;IACnED,IAAIlG,MAAM,CAAC0C,QAAQ1C,MAAM,EAAEqG,IAAI,CAAC3D,QAAQtC,IAAI;AAC9C;AAEA,OAAO,MAAMkG,sBAAwC,OAAO1F,KAAKsF;QAMjDtF,WAuBWR;IA5BzB,IAAIQ,IAAI2F,MAAM,KAAK,QAAQ;QACzBL,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIlG,MAAM,CAAC,KAAKqG,IAAI,CAAC;YAAEpG,OAAO;QAAqB;QACnD;IACF;IACA,MAAMG,QAAQQ,YAAAA,IAAIR,IAAI,YAARQ,YAAY,CAAC;IAC3B,MAAM4F,aAAa3H,kBAAkBuB;IACrC,IAAI,CAACoG,YAAY;QACfN,IAAIlG,MAAM,CAAC,KAAKqG,IAAI,CAAC;YAAEpG,OAAO;QAAiB;QAC/C;IACF;IACA,MAAM6C,MAAM;QACVM,WAAW/C,MAAMD,IAAI,CAAC,YAAY,EAAE;QACpC+D,QAAQ9D,MAAMD,IAAI,CAAC,SAAS,EAAE;QAC9BmD,QAAQlD,MAAMD,IAAI,CAAC,SAAS,EAAE;IAChC;IACA,IAAI,CAAC0C,IAAIM,SAAS,IAAI,CAACN,IAAIqB,MAAM,IAAI,CAACrB,IAAIS,MAAM,EAAE;QAChD2C,IAAIlG,MAAM,CAAC,KAAKqG,IAAI,CAAC;YAAEpG,OAAO;QAAyC;QACvE;IACF;IACA,MAAMwG,eAAepG,MAAMD,IAAI,CAAC,UAAU,EAAE5D;IAC5C,IAAI,CAACiK,cAAc;QACjBP,IAAIlG,MAAM,CAAC,KAAKqG,IAAI,CAAC;YAAEpG,OAAO;QAAmB;QACjD;IACF;IACA,yEAAyE;IACzE,uEAAuE;IACvE,4BAA4B;IAC5B,MAAMyG,YAAYlG,QAAOJ,aAAAA,IAAI,CAAC,OAAO,YAAZA,aAAgB,IACtCuG,OAAO,CAAC,UAAU,MAClBlG,IAAI,GACJC,KAAK,CAAC,GAAGpE;IACZ,IAAI,CAACoK,WAAW;QACdR,IAAIlG,MAAM,CAAC,KAAKqG,IAAI,CAAC;YAAEpG,OAAO;QAAqB;QACnD;IACF;IAEA,IAAI;QACF,MAAMuF,SACJgB,WAAWvD,KAAK,KAAK,QACjB,MAAMV,mBAAmB3B,KAAK4F,WAAW7E,KAAK,IAC9C,MAAMhB,gBAAgBC,KAAK4F,WAAW3F,MAAM;QAClD,IAAI2E,OAAOrF,EAAE,KAAK,OAAO,OAAO8F,OAAOC,KAAKV;QAC5C,MAAM,EAAE7D,KAAK,EAAEC,GAAG,EAAE,GAAG4D;QACvB;;;;;KAKC,GACD,MAAMoB,QAAQ9H,gBAAgB8C,KAAK;QACnC,IAAIgF,OAAO,OAAOX,OAAOC,KAAK;YAAE/F,IAAI;YAAOH,QAAQ4G,MAAM5G,MAAM;YAAEI,MAAMwG,MAAMxG,IAAI;QAAC;QAElF;;;;;;KAMC,GACD,MAAMyG,OAAO,MAAMnJ,iBAAiB,CAAC,mBAAmB,EAAE8H,OAAOxD,GAAG,EAAE,EAAE;YACtE8E,OAAO7H;YACP8H,UAAU7H;QACZ;QACA,IAAI,CAAC2H,KAAKzE,OAAO,EAAE;YACjB,OAAO6D,OACLC,KACAnG,OAAO,KAAKF,wBAAwB;gBAClC2E,QAAQ;gBACRM,mBAAmBE,KAAKzE,GAAG,CACzB,GACAyE,KAAKC,IAAI,CAAC,AAAC4B,CAAAA,KAAKG,OAAO,GAAG9B,KAAKC,GAAG,EAAC,IAAK;YAE5C;QAEJ;QAEA,MAAMvC,YAAY/E,cAAcyD,GAAG,GAAGsB,SAAS;QAC/C,MAAM2C,YAAY,MAAM5C,iBAAiBC,WAAW4D,YAAY7E,OAAOmB;QACvE,IAAIyC,UAAUpF,EAAE,KAAK,OAAO,OAAO8F,OAAOC,KAAKX;QAC/C,uEAAuE;QACvE,qEAAqE;QACrE,cAAc;QACd,MAAMS,OAAO,MAAM1B,mBAAmB1B,WAAW4D,YAAY7E,OAAO4D,UAAUlC,QAAQ;QACtF,IAAI2C,KAAK7F,EAAE,KAAK,OAAO,OAAO8F,OAAOC,KAAKF;QAC1C,MAAM,EAAEnF,MAAM,EAAE,GAAGmF;QACnB,MAAMiB,QAAQ,MAAMxJ,oBAAoBoD,QAAQe;QAChD,qEAAqE;QACrE,+DAA+D;QAC/D,IAAI2D,UAAUvB,OAAO,EAAE;YACrB,MAAMkD,QAAQlK,iBAAiBuI,UAAUvB,OAAO,EAAEiD,MAAMxB,OAAO;YAC/D,IAAIyB,MAAMC,SAAS,EAAE5B,UAAUxC,IAAI,CAACoE,SAAS,GAAGD,MAAMC,SAAS;QACjE;QAEA;;;;;;;KAOC,GACD,MAAMzB,SAAS9I,iBAAiB,GAAG6J,aAAa,EAAE,EAAEC,WAAW;QAC/D,MAAMU,QAAQ1B,OAAOvE,MAAM,GACvB,MAAMkE,gBAAgB;YAAEE;YAAWC;YAAQ3E;YAAQ4E,SAASwB,MAAMxB,OAAO;YAAEC;QAAO,KAClF;QACJ,MAAM2B,UAAUD,QACZjK,qBAAqBsJ,cAAcW,OAAO3G,IAAI,GAAGC,KAAK,CAAC,GAAGlE,yBAC1DiK;QACJ,MAAMa,OAAOF,QACTjK,qBAAqBuJ,WAAWU,OAAO3G,IAAI,GAAGC,KAAK,CAAC,GAAGpE,sBACvDoK;QACJ,IAAI,CAACW,WAAW,CAACC,MAAM;YACrB,OAAOrB,OAAOC,KAAKnG,OAAO,KAAKqF,qCAAqC;gBAAEZ,QAAQ;YAAQ;QACxF;QAEA,sEAAsE;QACtE,uEAAuE;QACvE,8CAA8C;QAC9C,MAAM+C,SAAS3E,UAAUa,UAAU,CAAC,QAAQC,GAAG,CAAC/B;QAChD,IAAI,CAAClF,sBAAsB,MAAMkB,4BAA4B4J,QAAQhC,UAAUxC,IAAI,IAAI;YACrF,OAAOkD,OAAOC,KAAKnG,OAAO,KAAK3D,+BAA+B;gBAAEoI,QAAQ;YAAU;QACpF;QAEA,oEAAoE;QACpE,oEAAoE;QACpE,6CAA6C;QAC7C,MAAMgD,WAAW,MAAM5J,sBACrBiD,QACA;YAAC0E,UAAUlD,KAAK;SAAC,EACjBjB,WACA6F;QAEF,IAAI,CAACO,SAASrG,MAAM,EAAE;YACpB,OAAO8E,OAAOC,KAAKnG,OAAO,KAAKJ,8BAA8B;gBAAE6E,QAAQ;YAAa;QACtF;QACA,IAAItH,mBAAmBqI,UAAUrB,MAAM,EAAE+C,OAAOQ,KAAK,KAAK,YAAY;YACpE,OAAOxB,OAAOC,KAAKnG,OAAO,KAAKH,4BAA4B;gBAAE4E,QAAQ;YAAW;QAClF;QACA,yEAAyE;QACzE,wEAAwE;QACxE,kCAAkC;QAClC,MAAMkD,eAAe/K,kBAAkBM,eAAesI,UAAUrB,MAAM;QACtE,IAAIwD,cAAc;YAChB,OAAOzB,OAAOC,KAAKnG,OAAO,KAAK2H,cAAc;gBAAElD,QAAQ;YAAc;QACvE;QAEA,IAAI,CAAClH,qBAAqB;YACxB,OAAO2I,OACLC,KACAnG,OAAO,KAAK,+CAA+C;gBACzDyE,QAAQ;YACV;QAEJ;QACA,MAAMmD,WAAW,MAAM3J,oBAAoB6C;QAC3C,IAAI8G,SAASjF,OAAO,EAAE;YACpB,OAAOuD,OACLC,KACAnG,OAAO,KAAK4H,SAASjF,OAAO,CAACkF,OAAO,EAAE;gBAAEpD,QAAQ;YAAmB;QAEvE;QAEA,MAAMW,MAAM,IAAID;QAChB;;;;;;;;;;;;;;;KAeC,GACD,MAAM,EAAE2C,IAAI,EAAEC,QAAQ,EAAE,GAAG,MAAMzJ,iBAAiB;YAChDsD;YACAoG,WAAW,AAACnG,GAA+B,CAAC,YAAY;YACxDuD,KAAKA,IAAI6C,OAAO;QAClB;QACA,IAAIF,UAAU;YACZ,OAAO7B,OACLC,KACAnG,OAAO,KAAKL,oCAAoC;gBAC9C8E,QAAQ;YACV;QAEJ;QAEA,kEAAkE;QAClE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,6BAA6B;QAC7B,MAAMyD,QAAQ,MAAMzJ,oBAAoBoE,WAAWjB,OAAOC,KAAKuD,KAAK0C;QACpE,IAAI,CAACI,MAAM9H,EAAE,EAAE;YACb,MAAM,EAAE+H,KAAK,EAAE,GAAGD;YAClB,qEAAqE;YACrE,oEAAoE;YACpE,kEAAkE;YAClE,oEAAoE;YACpE,MAAME,YACJD,MAAM7I,QAAQ,GAAGjC,uBAAuBwE,KAAKwG,eAAe;YAC9D,OAAOnC,OACLC,KACAnG,OACE,KACAmI,MAAM7I,QAAQ,IAAI,IACdF,iCACAgJ,YACE5I,2BAA2B2I,MAAM7I,QAAQ,EAAE6I,MAAMzI,IAAI,IACrDL,0BAA0B8I,MAAM7I,QAAQ,GAC9C;gBACEmF,QAAQ2D,YAAY,SAAS;gBAC7B9I,UAAU6I,MAAM7I,QAAQ;gBACxBI,MAAMyI,MAAMzI,IAAI;gBAChB4I,YAAYH,MAAMI,QAAQ,CAACN,OAAO;YACpC;QAGN;QAEA,wEAAwE;QACxE,kEAAkE;QAClE,MAAMO,cAAcxJ,kBAAkB6D,WAAWjB;QACjD,IAAI+C;QACJ,IAAI;YACFA,SAAS,MAAMnH,UAAU;gBACvBiL,IAAIjD,UAAUlD,KAAK;gBACnBgF;gBACAC;gBACAmB,iBAAiBd;gBACjBe,UAAU;gBACVC,SAASpM;gBACTqM,SAASpD,OAAOnD,KAAK;eACjBmD,OAAOlD,IAAI,GAAG;gBAAEuG,UAAUrD,OAAOlD,IAAI;YAAC,IAAI,CAAC;gBAC/CwG,MAAMpM,qBAAqB;oBAAEiF;oBAAOd;oBAAQkI,YAAYR,YAAYzE,EAAE;gBAAC;;QAE3E,EAAE,OAAO7D,OAAO;YACd,iEAAiE;YACjE,uCAAuC;YACvC,MAAM1B,oBAAoBqE,WAAWqF,MAAMe,WAAW;YACtD,MAAM/I;QACR;QACA,IAAI,CAACyE,OAAOuE,IAAI,EAAE;YAChB,MAAM1K,oBAAoBqE,WAAWqF,MAAMe,WAAW;YACtD,OAAO/C,OAAOC,KAAKzB,YAAYC;QACjC;QAEA,MAAMwE,WAAWhE,KAAKC,GAAG;QACzB,IAAIgE,SAAS;QACb;;;;;;KAMC,GACD,MAAMC,eAAe7D,UAAUrB,MAAM,CAAC,YAAY;QAClD,MAAMmF,YACJ7C,WAAWvD,KAAK,KAAK,SAASqG,MAAMC,OAAO,CAACH,iBAAiBA,aAAajI,MAAM,GAC5EiI,aAAaI,GAAG,CAAChJ,UACjB3D,eAAe+E,KAAgCqF;QACrD,IAAI;YACF,MAAMjI,sBACJuJ,aACArM,sBAAsB;gBACpBmL;gBACAjH,MAAMkH;gBACNkB,IAAIjD,UAAUlD,KAAK;gBACnBoH,MAAMP;gBACNQ,OAAOlE,OAAOxD,GAAG;eACbwD,OAAOlD,IAAI,GAAG;gBAAEqH,QAAQnE,OAAOlD,IAAI;YAAC,IAAI,CAAC;gBAC7CS,MAAMwC,UAAUxC,IAAI;gBACpBlC;gBACAwI;;QAGN,EAAE,OAAOpJ,OAAO;YACd,oEAAoE;YACpE,oEAAoE;YACpEwB,QAAQxB,KAAK,CAAC,qCAAqC0B,OAAO4G,YAAYzE,EAAE,EAAE7D;YAC1EkJ,SAAS;QACX;QACA,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM7K,iBAAiB;YACrBuE,OAAO;gBAAE+G,MAAM;gBAAOjI;YAAM;YAC5BkI,OAAO;YACPC,WAAW;YACXlH;QACF;QACA,kEAAkE;QAClE,6DAA6D;QAC7D,IAAI4D,WAAWvD,KAAK,KAAK,OAAO;YAC9B,MAAMhF,eACJ0D,OACA;gBAAEK,KAAKwD,OAAOxD,GAAG;gBAAEK,OAAOmD,OAAOnD,KAAK;YAAC,GACvC,cACAkD,UAAUxC,IAAI,CAACK,SAAS,GACpB;gBAAE2G,MAAM;gBAAWjG,IAAIyB,UAAUxC,IAAI,CAACK,SAAS;gBAAEd,MAAMiD,UAAUlD,KAAK;YAAC,IACvE;gBAAE0H,MAAM;gBAAQjG,IAAIyB,UAAUxC,IAAI,CAACoB,MAAM;gBAAE7B,MAAMiD,UAAUlD,KAAK;YAAC;QAEzE;QACA6D,IAAIlG,MAAM,CAAC,KAAKqG,IAAI,CAAC;YACnBlG,IAAI;YACJ4I,YAAYR,YAAYzE,EAAE;YAC1B0E,IAAIjD,UAAUlD,KAAK;YACnB2H,MAAMrC,SAASqC,IAAI;YACnBb;QACF;IACF,EAAE,OAAOlJ,OAAO;QACdwB,QAAQxB,KAAK,CAAC,2BAA2BuG,YAAYvG;QACrDiG,IAAIlG,MAAM,CAAC,KAAKqG,IAAI,CAAC;YAAEpG,OAAO;QAA+B;IAC/D;AACF,EAAC;AAED,eAAeqG,oBAAmB"}
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/email-send.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  type AglynOrgBilling,\n  type AglynOrgMember,\n  buildCrmEmailActivity,\n  contactCaptureHostIds,\n  CRM_ACTIVITY_LOG_FULL_MESSAGE,\n  CRM_COLLECTIONS,\n  CRM_EMAIL_BODY_MAX,\n  CRM_EMAIL_CONTEXT,\n  CRM_EMAIL_SUBJECT_MAX,\n  type CrmActivityLink,\n  crmActivityLogHasRoom,\n  crmEmailDeliveryTags,\n  emailStateRefusal,\n  type CrmMergeContext,\n  crmMergeFieldsIn,\n  crmScopeTokens,\n  isOrgWideMember,\n  normalizeContactEmail,\n  type PluginApiHandler,\n  type PluginApiRequest,\n  type PluginApiResponse,\n  readEmailState,\n  readMarketingBasis,\n  renderCrmMergeFields,\n  resolveOrgEntitlements,\n  visibleToHost,\n} from '@aglyn/aglyn/server'\nimport {\n  isEmailConfigured,\n  sendEmail,\n  sendFailureReason,\n  type SendEmailResult,\n} from '@aglyn/shared-util-email'\nimport {\n  consentGroupForSite,\n  consumeRateLimit,\n  countCrmActivitiesForRecord,\n  filterSendableForHost,\n  firebaseAdmin,\n  getHostDocAdmin,\n  getOrgForHost,\n  hostSendingIdentity,\n  logOrgActivity,\n  memberHasOrgPermission,\n  orgDataCollectionForHost,\n  readLeadForHost,\n  readOrgEmailRamp,\n  recordEmailSends,\n  releaseCrmEmailSend,\n  reserveCrmEmailSend,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport {\n  authorizeOrgCaller,\n  type CrmRouteScope,\n  orgHostIds,\n  readCrmRouteScope,\n} from './org-caller'\nimport { crmSuiteRefusal } from './suite-gate'\nimport { crmActivityLinkWithCompany } from './crm-activity-company'\nimport { newCrmActivityRef, writeCrmEmailActivity } from './crm-email-activity'\n\n/**\n * `POST /api/crm/email-send` — one email to one person, from their record\n * (AGL-2615).\n *\n * Body: `{ hostId, contactId? | leadId? | dealId?, subject, body }`. Answers\n * `{ ok: true, activityId, to, from, logged }` once the provider accepted\n * the message, and a refusal with a `reason` the dialog can act on\n * otherwise. The subject and the body may carry merge fields —\n * `{{contact.firstName}}`, `{{deal.amount}}` (AGL-2658) — which this route\n * fills from the record before the send, so the timeline row is the letter\n * as it left; see `crm-email-templates.ts` for the grammar.\n *\n * ## What it is, and what it is not\n *\n * A message a teammate wrote to one person they have a relationship with —\n * a reply to a lead, a follow-up on a deal. It is not marketing: no\n * campaign audience, no unsubscribe pair, no frequency window, no consent\n * split. What it does owe is everything a bounce or a complaint owes the\n * shared sending domain, which is why BOTH suppression lists are consulted\n * and why a person's own stated refusal — a `declined` basis — is a hard\n * stop even though the message is not the kind of mail that basis governs.\n * The recipient asked this site not to write; the kind of writing is not\n * the point.\n *\n * ## Why the recipient is resolved here and not taken from the body\n *\n * The dialog shows the address the record carries, and this route reads it\n * again off the record the caller named, through the same visibility check\n * every other CRM route makes. A `to` in the body would make this a route\n * that sends the site's mail to any address a member types, which is a\n * different product with a different abuse surface.\n *\n * ## The organization variant (AGL-2634)\n *\n * `{ orgId, hostId?, … }` from the org-level hub. The caller is authorized\n * by the org — an org-wide member holding `data.manage` — and the record is\n * read with no site's visibility to check, because an org-wide member reads\n * every row. What the org level cannot do away with is the SITE the message\n * leaves from: the sending identity, the suppression list and the person's\n * stated refusal are each a site's. So the org variant still names one —\n * the record's own capturing site or the site the reader picked, in the\n * body; failing that the record's own site read off the document; failing\n * that the org's only site — and refuses, with a `site` reason, when the\n * org has several and none was named. The row it writes is visible to\n * whoever may see the RECORD, so an email to a person another site\n * captured shows on their timeline under that site's hub; the act is\n * logged in the org's feed.\n *\n * ## The order of the gates\n *\n * Cheap and certain first. A malformed body and a missing token cost\n * nothing; the per-user pace is one counter; the record is one read and\n * decides everything after it; the ceiling one aggregate; the two\n * suppression lists two keyed reads; the sending identity next, because it\n * is the most expensive and the one a workspace fixes once. The daily cap\n * comes LAST and is the one gate that writes before the provider is called\n * (AGL-2645): the send is reserved on today's counter inside a transaction,\n * so two reps at the last slot cannot both pass one reading of it, and a\n * message the provider refuses gives the slot back. After the provider has\n * accepted, two more things are written, neither able to fail the send:\n * the activity row and the org's cost meter.\n *\n * ## The new-workspace ramp is part of that cap, not a gate beside it\n *\n * A message from a workspace created this morning lands on the sending\n * domain every other tenant's receipts leave on, so the plan's day is held\n * to the share of it the workspace has earned — the same ramp the campaign\n * path is paced by, `readOrgEmailRamp`, taken to the allowance this surface\n * meters instead of the campaign ceiling. It is handed to the reservation\n * rather than checked before it, so the ceiling and the count it is judged\n * against come out of the one transactional read; a ramp consulted\n * separately would be a second ceiling and two reps could pass it at once.\n * A workspace past its first week is not ramped and pays nothing to find\n * that out.\n */\n\n/** How many one-to-one emails one person may send in one minute. */\nexport const CRM_EMAIL_SENDS_PER_MINUTE = 20\nconst CRM_EMAIL_RATE_WINDOW_MS = 60_000\n\n/** What the route says when the plan carries no one-to-one email at all. */\nexport const CRM_EMAIL_NOT_INCLUDED_MESSAGE =\n  'Your plan does not include one-to-one email. Upgrade in Billing to email ' +\n  'people from their records.'\n\n/** What the route says at the daily cap; `included` is the plan's figure. */\nexport function crmEmailCapReachedMessage(included: number): string {\n  return (\n    `Today's one-to-one email limit (${included.toLocaleString('en-US')}) is ` +\n    'reached. It resets at midnight UTC — see Billing for the count.'\n  )\n}\n\n/**\n * What the route says when the NEW-WORKSPACE RAMP is the ceiling that was\n * reached, rather than the plan's own.\n *\n * The campaign path's wording, pointed at this surface: the number, what was\n * spent against it, that nothing was sent or counted, and when it lifts. A\n * workspace told only \"limit reached\" against a figure far below the one its\n * plan page advertises would read it as a billing fault.\n */\nexport function crmEmailRampReachedMessage(\n  ceiling: number,\n  used: number,\n): string {\n  return (\n    `This workspace may send ${ceiling.toLocaleString('en-US')} one-to-one ` +\n    `email${ceiling === 1 ? '' : 's'} a day while it establishes a sending ` +\n    `history, and has sent ${used.toLocaleString('en-US')} today. Nothing ` +\n    'has been sent and nothing has been counted — the allowance grows as ' +\n    \"the workspace sends, and is the plan's in full after its first week. \" +\n    'It resets at midnight UTC.'\n  )\n}\n\n/** What the route says when the ramp's own history could not be read. */\nexport const CRM_EMAIL_RAMP_UNAVAILABLE_MESSAGE =\n  \"This workspace's sending history could not be read just now, so how much \" +\n  'of its first-week email allowance it has earned is not known. Nothing has ' +\n  'been sent and nothing has been counted — try again in a moment.'\n\nexport const CRM_EMAIL_SUPPRESSED_MESSAGE =\n  'This address has bounced or reported a message as spam, so it cannot be ' +\n  'emailed.'\n\nexport const CRM_EMAIL_DECLINED_MESSAGE =\n  'This person asked not to be emailed by this site.'\n\nexport const CRM_EMAIL_RATE_MESSAGE =\n  'You have sent too many emails in the last minute. Wait a moment and try again.'\n\n/** What the org variant says when no site was named and the org has several. */\nexport const CRM_EMAIL_PICK_SITE_MESSAGE =\n  'Pick the site this email leaves from — its sending address is what the ' +\n  'message is sent as.'\n\ntype Refusal = { ok: false; status: number; body: Record<string, unknown> }\n\nconst refuse = (\n  status: number,\n  error: string,\n  extra: Record<string, unknown> = {},\n): Refusal => ({ ok: false, status, body: { error, ...extra } })\n\n/** One typed field, trimmed and bounded. */\nfunction typed(value: unknown, max: number): string {\n  return String(value ?? '')\n    .trim()\n    .slice(0, max)\n}\n\ninterface Sender {\n  ok: true\n  uid: string\n  /** The address replies go to — the token's, never the body's. */\n  email: string\n  /** The name in front of the sending address, when the token carries one. */\n  name: string\n  orgId: string\n  org: Partial<AglynOrgBilling>\n}\n\n/**\n * Who is sending, and whether they may: a verified ID token, then\n * `data.manage` on the site's org through the same three-layer read the\n * create route makes, admitted only for a site the member reaches. Staff\n * pass the permission check as they do on every CRM route, and send as\n * themselves.\n */\nasync function authorizeSender(\n  req: PluginApiRequest,\n  hostId: string,\n): Promise<Sender | Refusal> {\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return refuse(401, 'Unauthenticated')\n  let decoded: { uid: string; email?: string; name?: string; staff?: unknown }\n  try {\n    decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n  } catch (error) {\n    // A refused credential is the caller's 401; a failure to check one is\n    // ours and keeps a 5xx (AGL-2852).\n    if (isRefusedIdToken(error)) return refuse(401, 'Unauthenticated')\n    console.error('[crm] email-send could not verify the sender', error)\n    return refuse(500, 'The sign-in could not be checked. Try again.')\n  }\n  const resolved = await getOrgForHost(hostId).catch(() => null)\n  if (!resolved) return refuse(404, 'Unknown site')\n  const { orgId } = resolved\n  const org = (resolved.org ?? {}) as Partial<AglynOrgBilling>\n  if (decoded.staff !== true) {\n    const membership = await resolveOrgMembership(decoded.uid, orgId).catch(\n      () => null,\n    )\n    const member = (membership?.member ?? null) as Partial<AglynOrgMember> | null\n    const reaches =\n      isOrgWideMember(member) || Boolean(member?.hostAccess?.[hostId])\n    const allowed =\n      member &&\n      reaches &&\n      (await memberHasOrgPermission(orgId, member, 'data.manage'))\n    if (!allowed) {\n      return refuse(\n        403,\n        'Sending email from a record requires the data.manage permission on this site',\n      )\n    }\n  }\n  const email = normalizeContactEmail(decoded.email)\n  if (!email) {\n    // A reply-to is owed and the token is the only place it can honestly\n    // come from; an account with no address cannot be replied to.\n    return refuse(403, 'Your account has no email address to receive replies at.')\n  }\n  return {\n    ok: true,\n    uid: decoded.uid,\n    email,\n    name: typed(decoded.name, 120),\n    orgId,\n    org,\n  }\n}\n\n/**\n * The org variant's sender (AGL-2634): authorized by the org for an\n * org-wide member holding `data.manage`, with the same reply-to rule.\n */\nasync function authorizeOrgSender(\n  req: PluginApiRequest,\n  orgId: string,\n): Promise<Sender | Refusal> {\n  const caller = await authorizeOrgCaller(req, orgId, {\n    needs: 'data.manage',\n    refusal:\n      'Sending email at the organization level requires the data.manage ' +\n      'permission across the whole workspace',\n  })\n  if (caller.ok === false) return refuse(caller.status, caller.error)\n  const email = normalizeContactEmail(caller.email)\n  if (!email) {\n    return refuse(403, 'Your account has no email address to receive replies at.')\n  }\n  return {\n    ok: true,\n    uid: caller.uid,\n    email,\n    name: caller.name,\n    orgId,\n    org: caller.org as Partial<AglynOrgBilling>,\n  }\n}\n\ninterface Recipient {\n  ok: true\n  email: string\n  /** The document the consent basis is read off — the contact, or the lead. */\n  record: Record<string, unknown>\n  /** The contact document, when one was read — where the company link is. */\n  contact: Record<string, unknown> | null\n  link: CrmActivityLink\n  /**\n   * The site the record itself names — a contact's first capturing site, a\n   * deal's own, a lead's — which is the site an org-level send leaves from\n   * when the body named none.\n   */\n  siteHint: string\n  /** The deal document, when one was named — what `{{deal.*}}` reads (AGL-2658). */\n  deal: Record<string, unknown> | null\n  /** The lead document, when the recipient is a lead — what `{{lead.*}}` reads. */\n  lead: Record<string, unknown> | null\n}\n\n/**\n * The person the named record is about, as THIS site may see them.\n *\n * A deal names its contact; a lead carries its own address; a contact is\n * itself. Each is looked up by id and then checked against what the site\n * may read — the Admin SDK evaluates no rules, and a member of site A must\n * not be able to mail site B's contact by guessing an id. The links the\n * activity is filed under are whatever resolved: a deal's email is also the\n * contact's, so it lands on both timelines.\n *\n * At the organization level there is no site to check against and none is\n * checked: the caller was admitted as an org-wide member, who reads every\n * row. A lead still needs its site named — a lead lives under one.\n */\nasync function resolveRecipient(\n  firestore: FirebaseFirestore.Firestore,\n  scope: CrmRouteScope,\n  orgId: string,\n  ids: { contactId: string; leadId: string; dealId: string },\n): Promise<Recipient | Refusal> {\n  const link: CrmActivityLink = {}\n  const { hostId } = scope\n  const scoped = scope.level === 'site'\n  const visible = (tokens: unknown) =>\n    !scoped || visibleToHost(tokens as readonly string[], hostId)\n  let contactId = ids.contactId\n  let siteHint = ''\n  let dealRecord: Record<string, unknown> | null = null\n\n  if (ids.dealId) {\n    const deal = await firestore\n      .collection('orgs')\n      .doc(orgId)\n      .collection(CRM_COLLECTIONS.deals)\n      .doc(ids.dealId)\n      .get()\n    if (!deal.exists || !visible(deal.get('visibleTo'))) {\n      return refuse(404, 'Unknown deal')\n    }\n    link.dealId = deal.id\n    dealRecord = (deal.data() ?? {}) as Record<string, unknown>\n    siteHint = typed(deal.get('hostId'), 128)\n    contactId = contactId || String(deal.get('contactId') ?? '').trim()\n    if (!contactId) {\n      return refuse(400, 'This deal names no contact to email.')\n    }\n  }\n\n  if (contactId) {\n    const contacts = scoped\n      ? await orgDataCollectionForHost(hostId, 'contacts')\n      : firestore.collection('orgs').doc(orgId).collection('contacts')\n    const contact = await contacts.doc(contactId).get()\n    if (!contact.exists || !visible(contact.get('visibleTo'))) {\n      return refuse(404, 'Unknown contact')\n    }\n    const email = normalizeContactEmail(contact.get('email'))\n    if (!email) return refuse(400, 'This contact has no email address.')\n    const record = (contact.data() ?? {}) as Record<string, unknown>\n    link.contactId = contact.id\n    if (ids.leadId) link.leadId = ids.leadId\n    siteHint =\n      siteHint || typed(record['hostId'], 128) || contactCaptureHostIds(record)[0] || ''\n    return { ok: true, email, record, contact: record, link, siteHint, deal: dealRecord, lead: null }\n  }\n\n  if (ids.leadId) {\n    if (!hostId) return refuse(400, 'Name the site the lead lives under.')\n    const lead = await readLeadForHost(hostId, ids.leadId)\n    if (!lead) return refuse(404, 'Unknown lead')\n    const email = normalizeContactEmail(lead.get('email'))\n    if (!email) return refuse(400, 'This lead has no email address.')\n    const record = (lead.data() ?? {}) as Record<string, unknown>\n    link.leadId = lead.id\n    // A converted lead's email belongs on the contact it became as well.\n    const converted = String(lead.get('convertedContactId') ?? '').trim()\n    if (converted) link.contactId = converted\n    return { ok: true, email, record, contact: null, link, siteHint: hostId, deal: null, lead: record }\n  }\n\n  return refuse(400, 'Name a contact, lead or deal to email.')\n}\n\n/**\n * The site an org-level send leaves from (AGL-2634): the body's, else the\n * record's own, else the org's only site — and a refusal the dialog turns\n * into a Site picker when the org has several and none was named.\n */\nasync function resolveSendingSite(\n  firestore: FirebaseFirestore.Firestore,\n  scope: CrmRouteScope,\n  orgId: string,\n  siteHint: string,\n): Promise<{ ok: true; hostId: string } | Refusal> {\n  if (scope.hostId) return { ok: true, hostId: scope.hostId }\n  if (siteHint) return { ok: true, hostId: siteHint }\n  const hosts = await orgHostIds(firestore, orgId)\n  if (hosts.length === 1) return { ok: true, hostId: hosts[0] }\n  return refuse(409, CRM_EMAIL_PICK_SITE_MESSAGE, { reason: 'site' })\n}\n\n/** The HTTP shape of a send the provider did not accept. */\nfunction sendRefusal(result: SendEmailResult): Refusal {\n  const reason = sendFailureReason(result)\n  const detail = String((result as { detail?: unknown }).detail ?? '')\n  if (reason === 'unverified-domain') {\n    return refuse(409, detail || 'This site has no verified sending identity.', {\n      reason: 'sending-identity',\n    })\n  }\n  if (reason === 'suppressed' || reason === 'unengaged') {\n    return refuse(409, CRM_EMAIL_SUPPRESSED_MESSAGE, { reason: 'suppressed' })\n  }\n  // The deliverability preflight (AGL-3328): the recipient's domain takes\n  // no mail. A standing fact about the address, said in the engine's words\n  // — not a provider fault the rep should retry.\n  if (reason === 'undeliverable' || reason === 'gateway-held') {\n    return refuse(409, detail || 'This address cannot receive email.', { reason: 'undeliverable' })\n  }\n  if (reason === 'rate-limited') {\n    const retryAtMs = Number((result as { retryAtMs?: unknown }).retryAtMs)\n    return refuse(\n      503,\n      'The mail provider asked us to slow down. Try again in a minute.',\n      {\n        reason: 'provider-rate',\n        retryAfterSeconds: Number.isFinite(retryAtMs)\n          ? Math.max(1, Math.ceil((retryAtMs - Date.now()) / 1000))\n          : 60,\n      },\n    )\n  }\n  if (reason === 'unconfigured') {\n    return refuse(501, 'Email is not configured on this deployment.', {\n      reason: 'unconfigured',\n    })\n  }\n  return refuse(502, 'The email could not be sent.', { reason: 'send-failed' })\n}\n\n/** What the route says when a subject or a message is nothing once its fields are filled. */\nexport const CRM_EMAIL_EMPTY_AFTER_MERGE_MESSAGE =\n  'The subject and the message are empty once their merge fields are filled ' +\n  'in. Check the fields against this record.'\n\n/**\n * What `{{…}}` reads from, for this send (AGL-2658): the documents already\n * in hand — the contact, the deal, the lead — the sender off their token,\n * and the site's name, read only when a field asks for it. The contact's\n * facet is the SENDING site's group's, because a name, a job title and a\n * company are one holder's knowledge of a person.\n */\nasync function mergeContextFor(options: {\n  recipient: Recipient\n  sender: Sender\n  hostId: string\n  groupId: string\n  fields: readonly string[]\n}): Promise<CrmMergeContext> {\n  const { recipient, sender, hostId, groupId, fields } = options\n  const wantsSite = fields.some((field) => field.startsWith('site.'))\n  const host = wantsSite ? await getHostDocAdmin(hostId).catch(() => null) : null\n  return {\n    contact: recipient.contact,\n    contactGroupId: groupId,\n    lead: recipient.lead,\n    deal: recipient.deal,\n    sender: { name: sender.name, email: sender.email },\n    site: { name: typed(host?.['displayName'], 200) },\n  }\n}\n\nfunction answer(res: PluginApiResponse, refusal: Refusal): void {\n  const retry = refusal.body['retryAfterSeconds']\n  if (typeof retry === 'number') res.setHeader('Retry-After', String(retry))\n  res.status(refusal.status).json(refusal.body)\n}\n\nexport const crmEmailSendHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  const body = (req.body ?? {}) as Record<string, unknown>\n  const routeScope = readCrmRouteScope(body)\n  if (!routeScope) {\n    res.status(400).json({ error: 'Missing hostId' })\n    return\n  }\n  const ids = {\n    contactId: typed(body['contactId'], 128),\n    leadId: typed(body['leadId'], 128),\n    dealId: typed(body['dealId'], 128),\n  }\n  if (!ids.contactId && !ids.leadId && !ids.dealId) {\n    res.status(400).json({ error: 'Name a contact, lead or deal to email.' })\n    return\n  }\n  const draftSubject = typed(body['subject'], CRM_EMAIL_SUBJECT_MAX)\n  if (!draftSubject) {\n    res.status(400).json({ error: 'Enter a subject.' })\n    return\n  }\n  // Paragraphs are what the dialog offers, and a plain-text part is what a\n  // paragraph is; line endings are normalized so the stored body and the\n  // sent body are one string.\n  const draftText = String(body['body'] ?? '')\n    .replace(/\\r\\n?/g, '\\n')\n    .trim()\n    .slice(0, CRM_EMAIL_BODY_MAX)\n  if (!draftText) {\n    res.status(400).json({ error: 'Write the message.' })\n    return\n  }\n\n  try {\n    const sender =\n      routeScope.level === 'org'\n        ? await authorizeOrgSender(req, routeScope.orgId)\n        : await authorizeSender(req, routeScope.hostId)\n    if (sender.ok === false) return answer(res, sender)\n    const { orgId, org } = sender\n    /*\n     * THE PLAN, before the pace and the cap (AGL-2787). One-to-one email is\n     * the suite's; a plan without the suite is refused as such, rather than\n     * reaching the daily cap and being told about a zero it has no way to\n     * raise short of the upgrade this names.\n     */\n    const suite = crmSuiteRefusal(org, 'Emailing one person from their record')\n    if (suite) return answer(res, { ok: false, status: suite.status, body: suite.body })\n\n    /*\n     * THE PER-USER PACE, on its own key. The console dispatcher already\n     * counts this write against the person's general console budget; this\n     * is the narrower bucket the feature owes — twenty a minute is a rep\n     * writing, and past it is a script — keyed by the uid the token proved\n     * so one person cannot spend the bucket of everyone on their address.\n     */\n    const rate = await consumeRateLimit(`crm-email-send:uid:${sender.uid}`, {\n      limit: CRM_EMAIL_SENDS_PER_MINUTE,\n      windowMs: CRM_EMAIL_RATE_WINDOW_MS,\n    })\n    if (!rate.allowed) {\n      return answer(\n        res,\n        refuse(429, CRM_EMAIL_RATE_MESSAGE, {\n          reason: 'rate',\n          retryAfterSeconds: Math.max(\n            1,\n            Math.ceil((rate.resetMs - Date.now()) / 1000),\n          ),\n        }),\n      )\n    }\n\n    const firestore = firebaseAdmin.app().firestore()\n    const recipient = await resolveRecipient(firestore, routeScope, orgId, ids)\n    if (recipient.ok === false) return answer(res, recipient)\n    // The site the message leaves from — the mounted one under a site, and\n    // at the organization level whatever the body, the record or the org\n    // can answer.\n    const site = await resolveSendingSite(firestore, routeScope, orgId, recipient.siteHint)\n    if (site.ok === false) return answer(res, site)\n    const { hostId } = site\n    const group = await consentGroupForSite(hostId, org as Record<string, unknown>)\n    const orgRef = firestore.collection('orgs').doc(orgId)\n    // The deal's company, else the one the sending site files this person\n    // under, so the email shows on the company's log as every activity does.\n    recipient.link = await crmActivityLinkWithCompany(orgRef, recipient.link, {\n      deal: recipient.deal,\n      contact: recipient.contact,\n      groupId: group.groupId,\n    })\n\n    /*\n     * MERGE FIELDS (AGL-2658), filled here rather than in the dialog: the\n     * dialog previews with the same resolver, but what leaves and what is\n     * logged is rendered by the route, off the documents it read to find\n     * the recipient, so a preview the rep did not look at cannot differ\n     * from the letter. A subject or a message that is nothing once its\n     * fields are filled is refused before any gate is spent on it.\n     */\n    const fields = crmMergeFieldsIn(`${draftSubject}\\n${draftText}`)\n    const merge = fields.length\n      ? await mergeContextFor({ recipient, sender, hostId, groupId: group.groupId, fields })\n      : null\n    const subject = merge\n      ? renderCrmMergeFields(draftSubject, merge).trim().slice(0, CRM_EMAIL_SUBJECT_MAX)\n      : draftSubject\n    const text = merge\n      ? renderCrmMergeFields(draftText, merge).trim().slice(0, CRM_EMAIL_BODY_MAX)\n      : draftText\n    if (!subject || !text) {\n      return answer(res, refuse(400, CRM_EMAIL_EMPTY_AFTER_MERGE_MESSAGE, { reason: 'merge' }))\n    }\n\n    // The per-record ceiling, before the send: an email that could not be\n    // logged would be a message the timeline never shows, and the timeline\n    // is the reason the send lives on the record.\n    if (!crmActivityLogHasRoom(await countCrmActivitiesForRecord(orgRef, recipient.link))) {\n      return answer(res, refuse(409, CRM_ACTIVITY_LOG_FULL_MESSAGE, { reason: 'ceiling' }))\n    }\n\n    // Both suppression lists, then the person's own refusal — each read\n    // across the sending site's consent group, so leaving one site of a\n    // declared group stops this one writing too.\n    const sendable = await filterSendableForHost(\n      hostId,\n      [recipient.email],\n      undefined,\n      group,\n    )\n    if (!sendable.length) {\n      return answer(res, refuse(409, CRM_EMAIL_SUPPRESSED_MESSAGE, { reason: 'suppressed' }))\n    }\n    if (readMarketingBasis(recipient.record, group).basis === 'declined') {\n      return answer(res, refuse(409, CRM_EMAIL_DECLINED_MESSAGE, { reason: 'declined' }))\n    }\n    // The record's own verdict (AGL-3245): what the lists hold, in the words\n    // the page shows — a bounce, a gateway block, a do-not-contact mark the\n    // suppression lists do not carry.\n    const stateRefusal = emailStateRefusal(readEmailState(recipient.record))\n    if (stateRefusal) {\n      return answer(res, refuse(409, stateRefusal, { reason: 'email-state' }))\n    }\n\n    if (!isEmailConfigured()) {\n      return answer(\n        res,\n        refuse(501, 'Email is not configured on this deployment.', {\n          reason: 'unconfigured',\n        }),\n      )\n    }\n    const identity = await hostSendingIdentity(hostId)\n    if (identity.refusal) {\n      return answer(\n        res,\n        refuse(409, identity.refusal.message, { reason: 'sending-identity' }),\n      )\n    }\n\n    const now = new Date()\n    /*\n     * THE NEW-WORKSPACE RAMP, resolved for the ceiling below.\n     *\n     * A workspace past its first week graduates off the org record alone and\n     * pays no read for this. One that is still on the ramp needs its\n     * delivery history to know which step it has earned, and when that\n     * history is unreadable the step is a floor rather than an answer.\n     *\n     * A floor is enough for a campaign, which defers what it cannot send\n     * today and delivers it tomorrow. It is not enough here: this route\n     * admits or refuses ONE message and has no third answer, so a ramp that\n     * cannot say what a workspace has earned refuses and says so. The\n     * refusal is transient by construction — it lasts as long as the window\n     * read is failing — and it reaches only workspaces inside their first\n     * week, since every other one graduated before the window was consulted.\n     */\n    const { ramp, degraded } = await readOrgEmailRamp({\n      orgId,\n      createdAt: (org as Record<string, unknown>)['createdAt'],\n      now: now.getTime(),\n    })\n    if (degraded) {\n      return answer(\n        res,\n        refuse(503, CRM_EMAIL_RAMP_UNAVAILABLE_MESSAGE, {\n          reason: 'ramp-unavailable',\n        }),\n      )\n    }\n\n    // THE DAILY CAP (AGL-2611), taken as a slot rather than read as a\n    // figure (AGL-2645): the transaction reads today's counter, judges it\n    // with `checkCrmEmailQuota` against the ramp's share of the plan's day\n    // and raises it in one step, so the count the cap enforces is the count\n    // this send was admitted on.\n    const claim = await reserveCrmEmailSend(firestore, orgId, org, now, ramp)\n    if (!claim.ok) {\n      const { quota } = claim\n      // WHICH ceiling was reached, in the org's own terms. The reservation\n      // answers with the number it judged, which is the plan's day unless\n      // the ramp held this workspace below it — and a workspace shown a\n      // figure under the one its plan page advertises is owed the reason.\n      const rampBound =\n        quota.included < resolveOrgEntitlements(org).crmEmailsPerDay\n      return answer(\n        res,\n        refuse(\n          409,\n          quota.included <= 0\n            ? CRM_EMAIL_NOT_INCLUDED_MESSAGE\n            : rampBound\n              ? crmEmailRampReachedMessage(quota.included, quota.used)\n              : crmEmailCapReachedMessage(quota.included),\n          {\n            reason: rampBound ? 'ramp' : 'quota',\n            included: quota.included,\n            used: quota.used,\n            resetsAtMs: quota.resetsAt.getTime(),\n          },\n        ),\n      )\n    }\n\n    // The row's id, minted before the send so the delivery webhook can find\n    // it from the tags alone; written only once the message has left.\n    const activityRef = newCrmActivityRef(firestore, orgId)\n    let result: SendEmailResult\n    try {\n      result = await sendEmail({\n        to: recipient.email,\n        subject,\n        text,\n        sendingIdentity: identity,\n        audience: 'tenant',\n        context: CRM_EMAIL_CONTEXT,\n        replyTo: sender.email,\n        ...(sender.name ? { fromName: sender.name } : {}),\n        tags: crmEmailDeliveryTags({ orgId, hostId, activityId: activityRef.id }),\n      })\n    } catch (error) {\n      // The provider never answered, so no message left: the slot goes\n      // back before the failure is reported.\n      await releaseCrmEmailSend(firestore, claim.reservation)\n      throw error\n    }\n    if (!result.sent) {\n      await releaseCrmEmailSend(firestore, claim.reservation)\n      return answer(res, sendRefusal(result))\n    }\n\n    const sentAtMs = Date.now()\n    let logged = true\n    /*\n     * Who may list the row. Under a site, what a record created there is\n     * stamped with. At the organization level the RECORD's own tokens, so\n     * an email to a person another site captured shows on their timeline\n     * under that site's hub — a row stamped with the sending site alone\n     * would be invisible where the person is read.\n     */\n    const recordTokens = recipient.record['visibleTo']\n    const visibleTo =\n      routeScope.level === 'org' && Array.isArray(recordTokens) && recordTokens.length\n        ? recordTokens.map(String)\n        : crmScopeTokens(org as Record<string, unknown>, group)\n    try {\n      await writeCrmEmailActivity(\n        activityRef,\n        buildCrmEmailActivity({\n          subject,\n          body: text,\n          to: recipient.email,\n          atMs: sentAtMs,\n          byUid: sender.uid,\n          ...(sender.name ? { byName: sender.name } : {}),\n          link: recipient.link,\n          hostId,\n          visibleTo,\n        }),\n      )\n    } catch (error) {\n      // The message has left. A row that could not be written is a gap on\n      // the timeline, not a failed send, and it is said so in the answer.\n      console.error('[crm] email activity write failed', orgId, activityRef.id, error)\n      logged = false\n    }\n    // The cap's count was taken with the reservation; the org's cost meter\n    // for COGS is stamped after delivery, unable to fail the send.\n    await recordEmailSends({\n      scope: { kind: 'org', orgId },\n      count: 1,\n      sendClass: 'transactional',\n      firestore,\n    })\n    // The org-level act, in the org's feed: the site variant's is the\n    // timeline row itself, under the site the record page is on.\n    if (routeScope.level === 'org') {\n      await logOrgActivity(\n        orgId,\n        { uid: sender.uid, email: sender.email },\n        'Sent email',\n        recipient.link.contactId\n          ? { type: 'contact', id: recipient.link.contactId, name: recipient.email }\n          : { type: 'lead', id: recipient.link.leadId, name: recipient.email },\n      )\n    }\n    res.status(200).json({\n      ok: true,\n      activityId: activityRef.id,\n      to: recipient.email,\n      from: identity.from,\n      logged,\n    })\n  } catch (error) {\n    console.error('[crm] email-send failed', routeScope, error)\n    res.status(500).json({ error: 'The email could not be sent.' })\n  }\n}\n\nexport default crmEmailSendHandler\n"],"names":["buildCrmEmailActivity","contactCaptureHostIds","CRM_ACTIVITY_LOG_FULL_MESSAGE","CRM_COLLECTIONS","CRM_EMAIL_BODY_MAX","CRM_EMAIL_CONTEXT","CRM_EMAIL_SUBJECT_MAX","crmActivityLogHasRoom","crmEmailDeliveryTags","emailStateRefusal","crmMergeFieldsIn","crmScopeTokens","isOrgWideMember","normalizeContactEmail","readEmailState","readMarketingBasis","renderCrmMergeFields","resolveOrgEntitlements","visibleToHost","isEmailConfigured","sendEmail","sendFailureReason","consentGroupForSite","consumeRateLimit","countCrmActivitiesForRecord","filterSendableForHost","firebaseAdmin","getHostDocAdmin","getOrgForHost","hostSendingIdentity","logOrgActivity","memberHasOrgPermission","orgDataCollectionForHost","readLeadForHost","readOrgEmailRamp","recordEmailSends","releaseCrmEmailSend","reserveCrmEmailSend","resolveOrgMembership","isRefusedIdToken","authorizeOrgCaller","orgHostIds","readCrmRouteScope","crmSuiteRefusal","crmActivityLinkWithCompany","newCrmActivityRef","writeCrmEmailActivity","CRM_EMAIL_SENDS_PER_MINUTE","CRM_EMAIL_RATE_WINDOW_MS","CRM_EMAIL_NOT_INCLUDED_MESSAGE","crmEmailCapReachedMessage","included","toLocaleString","crmEmailRampReachedMessage","ceiling","used","CRM_EMAIL_RAMP_UNAVAILABLE_MESSAGE","CRM_EMAIL_SUPPRESSED_MESSAGE","CRM_EMAIL_DECLINED_MESSAGE","CRM_EMAIL_RATE_MESSAGE","CRM_EMAIL_PICK_SITE_MESSAGE","refuse","status","error","extra","ok","body","typed","value","max","String","trim","slice","authorizeSender","req","hostId","resolved","authorization","headers","idToken","startsWith","length","undefined","decoded","app","auth","verifyIdToken","console","catch","orgId","org","staff","member","membership","uid","reaches","Boolean","hostAccess","allowed","email","name","authorizeOrgSender","caller","needs","refusal","resolveRecipient","firestore","scope","ids","link","scoped","level","visible","tokens","contactId","siteHint","dealRecord","dealId","deal","collection","doc","deals","get","exists","id","data","contact","contacts","record","leadId","lead","converted","resolveSendingSite","hosts","reason","sendRefusal","result","detail","retryAtMs","Number","retryAfterSeconds","isFinite","Math","ceil","Date","now","CRM_EMAIL_EMPTY_AFTER_MERGE_MESSAGE","mergeContextFor","options","recipient","sender","groupId","fields","wantsSite","some","field","host","contactGroupId","site","answer","res","retry","setHeader","json","crmEmailSendHandler","method","routeScope","draftSubject","draftText","replace","suite","rate","limit","windowMs","resetMs","group","orgRef","merge","subject","text","sendable","basis","stateRefusal","identity","message","ramp","degraded","createdAt","getTime","claim","quota","rampBound","crmEmailsPerDay","resetsAtMs","resetsAt","activityRef","to","sendingIdentity","audience","context","replyTo","fromName","tags","activityId","reservation","sent","sentAtMs","logged","recordTokens","visibleTo","Array","isArray","map","atMs","byUid","byName","kind","count","sendClass","type","from"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAGEA,qBAAqB,EACrBC,qBAAqB,EACrBC,6BAA6B,EAC7BC,eAAe,EACfC,kBAAkB,EAClBC,iBAAiB,EACjBC,qBAAqB,EAErBC,qBAAqB,EACrBC,oBAAoB,EACpBC,iBAAiB,EAEjBC,gBAAgB,EAChBC,cAAc,EACdC,eAAe,EACfC,qBAAqB,EAIrBC,cAAc,EACdC,kBAAkB,EAClBC,oBAAoB,EACpBC,sBAAsB,EACtBC,aAAa,QACR,sBAAqB;AAC5B,SACEC,iBAAiB,EACjBC,SAAS,EACTC,iBAAiB,QAEZ,2BAA0B;AACjC,SACEC,mBAAmB,EACnBC,gBAAgB,EAChBC,2BAA2B,EAC3BC,qBAAqB,EACrBC,aAAa,EACbC,eAAe,EACfC,aAAa,EACbC,mBAAmB,EACnBC,cAAc,EACdC,sBAAsB,EACtBC,wBAAwB,EACxBC,eAAe,EACfC,gBAAgB,EAChBC,gBAAgB,EAChBC,mBAAmB,EACnBC,mBAAmB,EACnBC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,gBAAgB,QAAQ,mDAAkD;AACnF,SACEC,kBAAkB,EAElBC,UAAU,EACVC,iBAAiB,QACZ,kBAAc;AACrB,SAASC,eAAe,QAAQ,kBAAc;AAC9C,SAASC,0BAA0B,QAAQ,4BAAwB;AACnE,SAASC,iBAAiB,EAAEC,qBAAqB,QAAQ,0BAAsB;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0EC,GAED,kEAAkE,GAClE,OAAO,MAAMC,6BAA6B,GAAE;AAC5C,MAAMC,2BAA2B;AAEjC,0EAA0E,GAC1E,OAAO,MAAMC,iCACX,8EACA,6BAA4B;AAE9B,2EAA2E,GAC3E,OAAO,SAASC,0BAA0BC,QAAgB;IACxD,OACE,CAAC,gCAAgC,EAAEA,SAASC,cAAc,CAAC,SAAS,KAAK,CAAC,GAC1E;AAEJ;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASC,2BACdC,OAAe,EACfC,IAAY;IAEZ,OACE,CAAC,wBAAwB,EAAED,QAAQF,cAAc,CAAC,SAAS,YAAY,CAAC,GACxE,CAAC,KAAK,EAAEE,YAAY,IAAI,KAAK,IAAI,sCAAsC,CAAC,GACxE,CAAC,sBAAsB,EAAEC,KAAKH,cAAc,CAAC,SAAS,gBAAgB,CAAC,GACvE,yEACA,0EACA;AAEJ;AAEA,uEAAuE,GACvE,OAAO,MAAMI,qCACX,8EACA,+EACA,kEAAiE;AAEnE,OAAO,MAAMC,+BACX,6EACA,WAAU;AAEZ,OAAO,MAAMC,6BACX,oDAAmD;AAErD,OAAO,MAAMC,yBACX,iFAAgF;AAElF,8EAA8E,GAC9E,OAAO,MAAMC,8BACX,4EACA,sBAAqB;AAIvB,MAAMC,SAAS,CACbC,QACAC,OACAC,QAAiC,CAAC,CAAC,GACtB,CAAA;QAAEC,IAAI;QAAOH;QAAQI,MAAM;YAAEH;WAAUC;IAAQ,CAAA;AAE9D,0CAA0C,GAC1C,SAASG,MAAMC,KAAc,EAAEC,GAAW;IACxC,OAAOC,OAAOF,gBAAAA,QAAS,IACpBG,IAAI,GACJC,KAAK,CAAC,GAAGH;AACd;AAaA;;;;;;CAMC,GACD,eAAeI,gBACbC,GAAqB,EACrBC,MAAc;QAEeD,4BAkBhBE;IAlBb,MAAMC,gBAAgBP,QAAOI,6BAAAA,IAAII,OAAO,CAACD,aAAa,YAAzBH,6BAA6B;IAC1D,MAAMK,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcL,KAAK,CAAC,UAAUS,MAAM,IACpCC;IACJ,IAAI,CAACH,SAAS,OAAOlB,OAAO,KAAK;IACjC,IAAIsB;IACJ,IAAI;QACFA,UAAU,MAAMzD,cAAc0D,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACP;IAC3D,EAAE,OAAOhB,OAAO;QACd,sEAAsE;QACtE,mCAAmC;QACnC,IAAIxB,iBAAiBwB,QAAQ,OAAOF,OAAO,KAAK;QAChD0B,QAAQxB,KAAK,CAAC,gDAAgDA;QAC9D,OAAOF,OAAO,KAAK;IACrB;IACA,MAAMe,WAAW,MAAMhD,cAAc+C,QAAQa,KAAK,CAAC,IAAM;IACzD,IAAI,CAACZ,UAAU,OAAOf,OAAO,KAAK;IAClC,MAAM,EAAE4B,KAAK,EAAE,GAAGb;IAClB,MAAMc,OAAOd,gBAAAA,SAASc,GAAG,YAAZd,gBAAgB,CAAC;IAC9B,IAAIO,QAAQQ,KAAK,KAAK,MAAM;;YAMWC;QALrC,MAAMC,aAAa,MAAMvD,qBAAqB6C,QAAQW,GAAG,EAAEL,OAAOD,KAAK,CACrE,IAAM;QAER,MAAMI,iBAAUC,8BAAAA,WAAYD,MAAM,mBAAI;QACtC,MAAMG,UACJnF,gBAAgBgF,WAAWI,QAAQJ,2BAAAA,qBAAAA,OAAQK,UAAU,qBAAlBL,kBAAoB,CAACjB,OAAO;QACjE,MAAMuB,UACJN,UACAG,WACC,MAAMhE,uBAAuB0D,OAAOG,QAAQ;QAC/C,IAAI,CAACM,SAAS;YACZ,OAAOrC,OACL,KACA;QAEJ;IACF;IACA,MAAMsC,QAAQtF,sBAAsBsE,QAAQgB,KAAK;IACjD,IAAI,CAACA,OAAO;QACV,qEAAqE;QACrE,8DAA8D;QAC9D,OAAOtC,OAAO,KAAK;IACrB;IACA,OAAO;QACLI,IAAI;QACJ6B,KAAKX,QAAQW,GAAG;QAChBK;QACAC,MAAMjC,MAAMgB,QAAQiB,IAAI,EAAE;QAC1BX;QACAC;IACF;AACF;AAEA;;;CAGC,GACD,eAAeW,mBACb3B,GAAqB,EACrBe,KAAa;IAEb,MAAMa,SAAS,MAAM9D,mBAAmBkC,KAAKe,OAAO;QAClDc,OAAO;QACPC,SACE,sEACA;IACJ;IACA,IAAIF,OAAOrC,EAAE,KAAK,OAAO,OAAOJ,OAAOyC,OAAOxC,MAAM,EAAEwC,OAAOvC,KAAK;IAClE,MAAMoC,QAAQtF,sBAAsByF,OAAOH,KAAK;IAChD,IAAI,CAACA,OAAO;QACV,OAAOtC,OAAO,KAAK;IACrB;IACA,OAAO;QACLI,IAAI;QACJ6B,KAAKQ,OAAOR,GAAG;QACfK;QACAC,MAAME,OAAOF,IAAI;QACjBX;QACAC,KAAKY,OAAOZ,GAAG;IACjB;AACF;AAsBA;;;;;;;;;;;;;CAaC,GACD,eAAee,iBACbC,SAAsC,EACtCC,KAAoB,EACpBlB,KAAa,EACbmB,GAA0D;IAE1D,MAAMC,OAAwB,CAAC;IAC/B,MAAM,EAAElC,MAAM,EAAE,GAAGgC;IACnB,MAAMG,SAASH,MAAMI,KAAK,KAAK;IAC/B,MAAMC,UAAU,CAACC,SACf,CAACH,UAAU5F,cAAc+F,QAA6BtC;IACxD,IAAIuC,YAAYN,IAAIM,SAAS;IAC7B,IAAIC,WAAW;IACf,IAAIC,aAA6C;IAEjD,IAAIR,IAAIS,MAAM,EAAE;YAWAC,YAEkBA;QAZhC,MAAMA,OAAO,MAAMZ,UAChBa,UAAU,CAAC,QACXC,GAAG,CAAC/B,OACJ8B,UAAU,CAACpH,gBAAgBsH,KAAK,EAChCD,GAAG,CAACZ,IAAIS,MAAM,EACdK,GAAG;QACN,IAAI,CAACJ,KAAKK,MAAM,IAAI,CAACX,QAAQM,KAAKI,GAAG,CAAC,eAAe;YACnD,OAAO7D,OAAO,KAAK;QACrB;QACAgD,KAAKQ,MAAM,GAAGC,KAAKM,EAAE;QACrBR,cAAcE,aAAAA,KAAKO,IAAI,cAATP,aAAe,CAAC;QAC9BH,WAAWhD,MAAMmD,KAAKI,GAAG,CAAC,WAAW;QACrCR,YAAYA,aAAa5C,QAAOgD,YAAAA,KAAKI,GAAG,CAAC,wBAATJ,YAAyB,IAAI/C,IAAI;QACjE,IAAI,CAAC2C,WAAW;YACd,OAAOrD,OAAO,KAAK;QACrB;IACF;IAEA,IAAIqD,WAAW;YAUGY;QAThB,MAAMC,WAAWjB,SACb,MAAM9E,yBAAyB2C,QAAQ,cACvC+B,UAAUa,UAAU,CAAC,QAAQC,GAAG,CAAC/B,OAAO8B,UAAU,CAAC;QACvD,MAAMO,UAAU,MAAMC,SAASP,GAAG,CAACN,WAAWQ,GAAG;QACjD,IAAI,CAACI,QAAQH,MAAM,IAAI,CAACX,QAAQc,QAAQJ,GAAG,CAAC,eAAe;YACzD,OAAO7D,OAAO,KAAK;QACrB;QACA,MAAMsC,QAAQtF,sBAAsBiH,QAAQJ,GAAG,CAAC;QAChD,IAAI,CAACvB,OAAO,OAAOtC,OAAO,KAAK;QAC/B,MAAMmE,UAAUF,gBAAAA,QAAQD,IAAI,cAAZC,gBAAkB,CAAC;QACnCjB,KAAKK,SAAS,GAAGY,QAAQF,EAAE;QAC3B,IAAIhB,IAAIqB,MAAM,EAAEpB,KAAKoB,MAAM,GAAGrB,IAAIqB,MAAM;QACxCd,WACEA,YAAYhD,MAAM6D,MAAM,CAAC,SAAS,EAAE,QAAQ/H,sBAAsB+H,OAAO,CAAC,EAAE,IAAI;QAClF,OAAO;YAAE/D,IAAI;YAAMkC;YAAO6B;YAAQF,SAASE;YAAQnB;YAAMM;YAAUG,MAAMF;YAAYc,MAAM;QAAK;IAClG;IAEA,IAAItB,IAAIqB,MAAM,EAAE;YAMEC,YAGSA;QARzB,IAAI,CAACvD,QAAQ,OAAOd,OAAO,KAAK;QAChC,MAAMqE,OAAO,MAAMjG,gBAAgB0C,QAAQiC,IAAIqB,MAAM;QACrD,IAAI,CAACC,MAAM,OAAOrE,OAAO,KAAK;QAC9B,MAAMsC,QAAQtF,sBAAsBqH,KAAKR,GAAG,CAAC;QAC7C,IAAI,CAACvB,OAAO,OAAOtC,OAAO,KAAK;QAC/B,MAAMmE,UAAUE,aAAAA,KAAKL,IAAI,cAATK,aAAe,CAAC;QAChCrB,KAAKoB,MAAM,GAAGC,KAAKN,EAAE;QACrB,qEAAqE;QACrE,MAAMO,YAAY7D,QAAO4D,YAAAA,KAAKR,GAAG,CAAC,iCAATQ,YAAkC,IAAI3D,IAAI;QACnE,IAAI4D,WAAWtB,KAAKK,SAAS,GAAGiB;QAChC,OAAO;YAAElE,IAAI;YAAMkC;YAAO6B;YAAQF,SAAS;YAAMjB;YAAMM,UAAUxC;YAAQ2C,MAAM;YAAMY,MAAMF;QAAO;IACpG;IAEA,OAAOnE,OAAO,KAAK;AACrB;AAEA;;;;CAIC,GACD,eAAeuE,mBACb1B,SAAsC,EACtCC,KAAoB,EACpBlB,KAAa,EACb0B,QAAgB;IAEhB,IAAIR,MAAMhC,MAAM,EAAE,OAAO;QAAEV,IAAI;QAAMU,QAAQgC,MAAMhC,MAAM;IAAC;IAC1D,IAAIwC,UAAU,OAAO;QAAElD,IAAI;QAAMU,QAAQwC;IAAS;IAClD,MAAMkB,QAAQ,MAAM5F,WAAWiE,WAAWjB;IAC1C,IAAI4C,MAAMpD,MAAM,KAAK,GAAG,OAAO;QAAEhB,IAAI;QAAMU,QAAQ0D,KAAK,CAAC,EAAE;IAAC;IAC5D,OAAOxE,OAAO,KAAKD,6BAA6B;QAAE0E,QAAQ;IAAO;AACnE;AAEA,0DAA0D,GAC1D,SAASC,YAAYC,MAAuB;QAEpB;IADtB,MAAMF,SAASjH,kBAAkBmH;IACjC,MAAMC,SAASnE,QAAO,iBAAA,AAACkE,OAAgCC,MAAM,YAAvC,iBAA2C;IACjE,IAAIH,WAAW,qBAAqB;QAClC,OAAOzE,OAAO,KAAK4E,UAAU,+CAA+C;YAC1EH,QAAQ;QACV;IACF;IACA,IAAIA,WAAW,gBAAgBA,WAAW,aAAa;QACrD,OAAOzE,OAAO,KAAKJ,8BAA8B;YAAE6E,QAAQ;QAAa;IAC1E;IACA,wEAAwE;IACxE,yEAAyE;IACzE,+CAA+C;IAC/C,IAAIA,WAAW,mBAAmBA,WAAW,gBAAgB;QAC3D,OAAOzE,OAAO,KAAK4E,UAAU,sCAAsC;YAAEH,QAAQ;QAAgB;IAC/F;IACA,IAAIA,WAAW,gBAAgB;QAC7B,MAAMI,YAAYC,OAAO,AAACH,OAAmCE,SAAS;QACtE,OAAO7E,OACL,KACA,mEACA;YACEyE,QAAQ;YACRM,mBAAmBD,OAAOE,QAAQ,CAACH,aAC/BI,KAAKzE,GAAG,CAAC,GAAGyE,KAAKC,IAAI,CAAC,AAACL,CAAAA,YAAYM,KAAKC,GAAG,EAAC,IAAK,SACjD;QACN;IAEJ;IACA,IAAIX,WAAW,gBAAgB;QAC7B,OAAOzE,OAAO,KAAK,+CAA+C;YAChEyE,QAAQ;QACV;IACF;IACA,OAAOzE,OAAO,KAAK,gCAAgC;QAAEyE,QAAQ;IAAc;AAC7E;AAEA,2FAA2F,GAC3F,OAAO,MAAMY,sCACX,8EACA,4CAA2C;AAE7C;;;;;;CAMC,GACD,eAAeC,gBAAgBC,OAM9B;IACC,MAAM,EAAEC,SAAS,EAAEC,MAAM,EAAE3E,MAAM,EAAE4E,OAAO,EAAEC,MAAM,EAAE,GAAGJ;IACvD,MAAMK,YAAYD,OAAOE,IAAI,CAAC,CAACC,QAAUA,MAAM3E,UAAU,CAAC;IAC1D,MAAM4E,OAAOH,YAAY,MAAM9H,gBAAgBgD,QAAQa,KAAK,CAAC,IAAM,QAAQ;IAC3E,OAAO;QACLsC,SAASuB,UAAUvB,OAAO;QAC1B+B,gBAAgBN;QAChBrB,MAAMmB,UAAUnB,IAAI;QACpBZ,MAAM+B,UAAU/B,IAAI;QACpBgC,QAAQ;YAAElD,MAAMkD,OAAOlD,IAAI;YAAED,OAAOmD,OAAOnD,KAAK;QAAC;QACjD2D,MAAM;YAAE1D,MAAMjC,MAAMyF,wBAAAA,IAAM,CAAC,cAAc,EAAE;QAAK;IAClD;AACF;AAEA,SAASG,OAAOC,GAAsB,EAAExD,OAAgB;IACtD,MAAMyD,QAAQzD,QAAQtC,IAAI,CAAC,oBAAoB;IAC/C,IAAI,OAAO+F,UAAU,UAAUD,IAAIE,SAAS,CAAC,eAAe5F,OAAO2F;IACnED,IAAIlG,MAAM,CAAC0C,QAAQ1C,MAAM,EAAEqG,IAAI,CAAC3D,QAAQtC,IAAI;AAC9C;AAEA,OAAO,MAAMkG,sBAAwC,OAAO1F,KAAKsF;QAMjDtF,WAuBWR;IA5BzB,IAAIQ,IAAI2F,MAAM,KAAK,QAAQ;QACzBL,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIlG,MAAM,CAAC,KAAKqG,IAAI,CAAC;YAAEpG,OAAO;QAAqB;QACnD;IACF;IACA,MAAMG,QAAQQ,YAAAA,IAAIR,IAAI,YAARQ,YAAY,CAAC;IAC3B,MAAM4F,aAAa5H,kBAAkBwB;IACrC,IAAI,CAACoG,YAAY;QACfN,IAAIlG,MAAM,CAAC,KAAKqG,IAAI,CAAC;YAAEpG,OAAO;QAAiB;QAC/C;IACF;IACA,MAAM6C,MAAM;QACVM,WAAW/C,MAAMD,IAAI,CAAC,YAAY,EAAE;QACpC+D,QAAQ9D,MAAMD,IAAI,CAAC,SAAS,EAAE;QAC9BmD,QAAQlD,MAAMD,IAAI,CAAC,SAAS,EAAE;IAChC;IACA,IAAI,CAAC0C,IAAIM,SAAS,IAAI,CAACN,IAAIqB,MAAM,IAAI,CAACrB,IAAIS,MAAM,EAAE;QAChD2C,IAAIlG,MAAM,CAAC,KAAKqG,IAAI,CAAC;YAAEpG,OAAO;QAAyC;QACvE;IACF;IACA,MAAMwG,eAAepG,MAAMD,IAAI,CAAC,UAAU,EAAE5D;IAC5C,IAAI,CAACiK,cAAc;QACjBP,IAAIlG,MAAM,CAAC,KAAKqG,IAAI,CAAC;YAAEpG,OAAO;QAAmB;QACjD;IACF;IACA,yEAAyE;IACzE,uEAAuE;IACvE,4BAA4B;IAC5B,MAAMyG,YAAYlG,QAAOJ,aAAAA,IAAI,CAAC,OAAO,YAAZA,aAAgB,IACtCuG,OAAO,CAAC,UAAU,MAClBlG,IAAI,GACJC,KAAK,CAAC,GAAGpE;IACZ,IAAI,CAACoK,WAAW;QACdR,IAAIlG,MAAM,CAAC,KAAKqG,IAAI,CAAC;YAAEpG,OAAO;QAAqB;QACnD;IACF;IAEA,IAAI;QACF,MAAMuF,SACJgB,WAAWvD,KAAK,KAAK,QACjB,MAAMV,mBAAmB3B,KAAK4F,WAAW7E,KAAK,IAC9C,MAAMhB,gBAAgBC,KAAK4F,WAAW3F,MAAM;QAClD,IAAI2E,OAAOrF,EAAE,KAAK,OAAO,OAAO8F,OAAOC,KAAKV;QAC5C,MAAM,EAAE7D,KAAK,EAAEC,GAAG,EAAE,GAAG4D;QACvB;;;;;KAKC,GACD,MAAMoB,QAAQ/H,gBAAgB+C,KAAK;QACnC,IAAIgF,OAAO,OAAOX,OAAOC,KAAK;YAAE/F,IAAI;YAAOH,QAAQ4G,MAAM5G,MAAM;YAAEI,MAAMwG,MAAMxG,IAAI;QAAC;QAElF;;;;;;KAMC,GACD,MAAMyG,OAAO,MAAMpJ,iBAAiB,CAAC,mBAAmB,EAAE+H,OAAOxD,GAAG,EAAE,EAAE;YACtE8E,OAAO7H;YACP8H,UAAU7H;QACZ;QACA,IAAI,CAAC2H,KAAKzE,OAAO,EAAE;YACjB,OAAO6D,OACLC,KACAnG,OAAO,KAAKF,wBAAwB;gBAClC2E,QAAQ;gBACRM,mBAAmBE,KAAKzE,GAAG,CACzB,GACAyE,KAAKC,IAAI,CAAC,AAAC4B,CAAAA,KAAKG,OAAO,GAAG9B,KAAKC,GAAG,EAAC,IAAK;YAE5C;QAEJ;QAEA,MAAMvC,YAAYhF,cAAc0D,GAAG,GAAGsB,SAAS;QAC/C,MAAM2C,YAAY,MAAM5C,iBAAiBC,WAAW4D,YAAY7E,OAAOmB;QACvE,IAAIyC,UAAUpF,EAAE,KAAK,OAAO,OAAO8F,OAAOC,KAAKX;QAC/C,uEAAuE;QACvE,qEAAqE;QACrE,cAAc;QACd,MAAMS,OAAO,MAAM1B,mBAAmB1B,WAAW4D,YAAY7E,OAAO4D,UAAUlC,QAAQ;QACtF,IAAI2C,KAAK7F,EAAE,KAAK,OAAO,OAAO8F,OAAOC,KAAKF;QAC1C,MAAM,EAAEnF,MAAM,EAAE,GAAGmF;QACnB,MAAMiB,QAAQ,MAAMzJ,oBAAoBqD,QAAQe;QAChD,MAAMsF,SAAStE,UAAUa,UAAU,CAAC,QAAQC,GAAG,CAAC/B;QAChD,sEAAsE;QACtE,yEAAyE;QACzE4D,UAAUxC,IAAI,GAAG,MAAMjE,2BAA2BoI,QAAQ3B,UAAUxC,IAAI,EAAE;YACxES,MAAM+B,UAAU/B,IAAI;YACpBQ,SAASuB,UAAUvB,OAAO;YAC1ByB,SAASwB,MAAMxB,OAAO;QACxB;QAEA;;;;;;;KAOC,GACD,MAAMC,SAAS9I,iBAAiB,GAAG6J,aAAa,EAAE,EAAEC,WAAW;QAC/D,MAAMS,QAAQzB,OAAOvE,MAAM,GACvB,MAAMkE,gBAAgB;YAAEE;YAAWC;YAAQ3E;YAAQ4E,SAASwB,MAAMxB,OAAO;YAAEC;QAAO,KAClF;QACJ,MAAM0B,UAAUD,QACZjK,qBAAqBuJ,cAAcU,OAAO1G,IAAI,GAAGC,KAAK,CAAC,GAAGlE,yBAC1DiK;QACJ,MAAMY,OAAOF,QACTjK,qBAAqBwJ,WAAWS,OAAO1G,IAAI,GAAGC,KAAK,CAAC,GAAGpE,sBACvDoK;QACJ,IAAI,CAACU,WAAW,CAACC,MAAM;YACrB,OAAOpB,OAAOC,KAAKnG,OAAO,KAAKqF,qCAAqC;gBAAEZ,QAAQ;YAAQ;QACxF;QAEA,sEAAsE;QACtE,uEAAuE;QACvE,8CAA8C;QAC9C,IAAI,CAAC/H,sBAAsB,MAAMiB,4BAA4BwJ,QAAQ3B,UAAUxC,IAAI,IAAI;YACrF,OAAOkD,OAAOC,KAAKnG,OAAO,KAAK3D,+BAA+B;gBAAEoI,QAAQ;YAAU;QACpF;QAEA,oEAAoE;QACpE,oEAAoE;QACpE,6CAA6C;QAC7C,MAAM8C,WAAW,MAAM3J,sBACrBkD,QACA;YAAC0E,UAAUlD,KAAK;SAAC,EACjBjB,WACA6F;QAEF,IAAI,CAACK,SAASnG,MAAM,EAAE;YACpB,OAAO8E,OAAOC,KAAKnG,OAAO,KAAKJ,8BAA8B;gBAAE6E,QAAQ;YAAa;QACtF;QACA,IAAIvH,mBAAmBsI,UAAUrB,MAAM,EAAE+C,OAAOM,KAAK,KAAK,YAAY;YACpE,OAAOtB,OAAOC,KAAKnG,OAAO,KAAKH,4BAA4B;gBAAE4E,QAAQ;YAAW;QAClF;QACA,yEAAyE;QACzE,wEAAwE;QACxE,kCAAkC;QAClC,MAAMgD,eAAe7K,kBAAkBK,eAAeuI,UAAUrB,MAAM;QACtE,IAAIsD,cAAc;YAChB,OAAOvB,OAAOC,KAAKnG,OAAO,KAAKyH,cAAc;gBAAEhD,QAAQ;YAAc;QACvE;QAEA,IAAI,CAACnH,qBAAqB;YACxB,OAAO4I,OACLC,KACAnG,OAAO,KAAK,+CAA+C;gBACzDyE,QAAQ;YACV;QAEJ;QACA,MAAMiD,WAAW,MAAM1J,oBAAoB8C;QAC3C,IAAI4G,SAAS/E,OAAO,EAAE;YACpB,OAAOuD,OACLC,KACAnG,OAAO,KAAK0H,SAAS/E,OAAO,CAACgF,OAAO,EAAE;gBAAElD,QAAQ;YAAmB;QAEvE;QAEA,MAAMW,MAAM,IAAID;QAChB;;;;;;;;;;;;;;;KAeC,GACD,MAAM,EAAEyC,IAAI,EAAEC,QAAQ,EAAE,GAAG,MAAMxJ,iBAAiB;YAChDuD;YACAkG,WAAW,AAACjG,GAA+B,CAAC,YAAY;YACxDuD,KAAKA,IAAI2C,OAAO;QAClB;QACA,IAAIF,UAAU;YACZ,OAAO3B,OACLC,KACAnG,OAAO,KAAKL,oCAAoC;gBAC9C8E,QAAQ;YACV;QAEJ;QAEA,kEAAkE;QAClE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,6BAA6B;QAC7B,MAAMuD,QAAQ,MAAMxJ,oBAAoBqE,WAAWjB,OAAOC,KAAKuD,KAAKwC;QACpE,IAAI,CAACI,MAAM5H,EAAE,EAAE;YACb,MAAM,EAAE6H,KAAK,EAAE,GAAGD;YAClB,qEAAqE;YACrE,oEAAoE;YACpE,kEAAkE;YAClE,oEAAoE;YACpE,MAAME,YACJD,MAAM3I,QAAQ,GAAGlC,uBAAuByE,KAAKsG,eAAe;YAC9D,OAAOjC,OACLC,KACAnG,OACE,KACAiI,MAAM3I,QAAQ,IAAI,IACdF,iCACA8I,YACE1I,2BAA2ByI,MAAM3I,QAAQ,EAAE2I,MAAMvI,IAAI,IACrDL,0BAA0B4I,MAAM3I,QAAQ,GAC9C;gBACEmF,QAAQyD,YAAY,SAAS;gBAC7B5I,UAAU2I,MAAM3I,QAAQ;gBACxBI,MAAMuI,MAAMvI,IAAI;gBAChB0I,YAAYH,MAAMI,QAAQ,CAACN,OAAO;YACpC;QAGN;QAEA,wEAAwE;QACxE,kEAAkE;QAClE,MAAMO,cAActJ,kBAAkB6D,WAAWjB;QACjD,IAAI+C;QACJ,IAAI;YACFA,SAAS,MAAMpH,UAAU;gBACvBgL,IAAI/C,UAAUlD,KAAK;gBACnB+E;gBACAC;gBACAkB,iBAAiBd;gBACjBe,UAAU;gBACVC,SAASlM;gBACTmM,SAASlD,OAAOnD,KAAK;eACjBmD,OAAOlD,IAAI,GAAG;gBAAEqG,UAAUnD,OAAOlD,IAAI;YAAC,IAAI,CAAC;gBAC/CsG,MAAMlM,qBAAqB;oBAAEiF;oBAAOd;oBAAQgI,YAAYR,YAAYvE,EAAE;gBAAC;;QAE3E,EAAE,OAAO7D,OAAO;YACd,iEAAiE;YACjE,uCAAuC;YACvC,MAAM3B,oBAAoBsE,WAAWmF,MAAMe,WAAW;YACtD,MAAM7I;QACR;QACA,IAAI,CAACyE,OAAOqE,IAAI,EAAE;YAChB,MAAMzK,oBAAoBsE,WAAWmF,MAAMe,WAAW;YACtD,OAAO7C,OAAOC,KAAKzB,YAAYC;QACjC;QAEA,MAAMsE,WAAW9D,KAAKC,GAAG;QACzB,IAAI8D,SAAS;QACb;;;;;;KAMC,GACD,MAAMC,eAAe3D,UAAUrB,MAAM,CAAC,YAAY;QAClD,MAAMiF,YACJ3C,WAAWvD,KAAK,KAAK,SAASmG,MAAMC,OAAO,CAACH,iBAAiBA,aAAa/H,MAAM,GAC5E+H,aAAaI,GAAG,CAAC9I,UACjB3D,eAAe+E,KAAgCqF;QACrD,IAAI;YACF,MAAMjI,sBACJqJ,aACAnM,sBAAsB;gBACpBkL;gBACAhH,MAAMiH;gBACNiB,IAAI/C,UAAUlD,KAAK;gBACnBkH,MAAMP;gBACNQ,OAAOhE,OAAOxD,GAAG;eACbwD,OAAOlD,IAAI,GAAG;gBAAEmH,QAAQjE,OAAOlD,IAAI;YAAC,IAAI,CAAC;gBAC7CS,MAAMwC,UAAUxC,IAAI;gBACpBlC;gBACAsI;;QAGN,EAAE,OAAOlJ,OAAO;YACd,oEAAoE;YACpE,oEAAoE;YACpEwB,QAAQxB,KAAK,CAAC,qCAAqC0B,OAAO0G,YAAYvE,EAAE,EAAE7D;YAC1EgJ,SAAS;QACX;QACA,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM5K,iBAAiB;YACrBwE,OAAO;gBAAE6G,MAAM;gBAAO/H;YAAM;YAC5BgI,OAAO;YACPC,WAAW;YACXhH;QACF;QACA,kEAAkE;QAClE,6DAA6D;QAC7D,IAAI4D,WAAWvD,KAAK,KAAK,OAAO;YAC9B,MAAMjF,eACJ2D,OACA;gBAAEK,KAAKwD,OAAOxD,GAAG;gBAAEK,OAAOmD,OAAOnD,KAAK;YAAC,GACvC,cACAkD,UAAUxC,IAAI,CAACK,SAAS,GACpB;gBAAEyG,MAAM;gBAAW/F,IAAIyB,UAAUxC,IAAI,CAACK,SAAS;gBAAEd,MAAMiD,UAAUlD,KAAK;YAAC,IACvE;gBAAEwH,MAAM;gBAAQ/F,IAAIyB,UAAUxC,IAAI,CAACoB,MAAM;gBAAE7B,MAAMiD,UAAUlD,KAAK;YAAC;QAEzE;QACA6D,IAAIlG,MAAM,CAAC,KAAKqG,IAAI,CAAC;YACnBlG,IAAI;YACJ0I,YAAYR,YAAYvE,EAAE;YAC1BwE,IAAI/C,UAAUlD,KAAK;YACnByH,MAAMrC,SAASqC,IAAI;YACnBb;QACF;IACF,EAAE,OAAOhJ,OAAO;QACdwB,QAAQxB,KAAK,CAAC,2BAA2BuG,YAAYvG;QACrDiG,IAAIlG,MAAM,CAAC,KAAKqG,IAAI,CAAC;YAAEpG,OAAO;QAA+B;IAC/D;AACF,EAAC;AAED,eAAeqG,oBAAmB"}

package/src/lib/server/merge-contacts.js

@@ -60,6 +60,7 @@ import { settleCompanyContactsCounts } from "@aglyn/tenant-data-admin/server/con
 import { restampCrmListFieldsAt } from "@aglyn/tenant-data-admin/server/crm-records";
 import { logHostActivity } from "@aglyn/tenant-data-admin/server/organizations";
 import { recomputeCrmNextTaskAt } from "./crm-next-activity.js";
+import { crmActivityLinkWithCompany } from "./crm-activity-company.js";
 /** How many pointing rows one repoint pass reads — and one batch writes. */ const REPOINT_PAGE = 400;
 /** A ceiling on passes, so a query that keeps answering cannot loop forever. */ const REPOINT_PASSES = 25;
 /**
@@ -246,6 +247,10 @@ export async function mergeContacts(options) {
    * not read as a merge that did not happen.
    */ try {
         var _survivorData_hostId;
+        // Read after the swap, so a company only the merged record named counts.
+        const link = await crmActivityLinkWithCompany(orgRef, {
+            contactId: survivorId
+        });
         await orgRef.collection(CRM_COLLECTIONS.activities).add(_extends({
             kind: 'note',
             body: `Merged with ${mergedEmail}`,
@@ -253,8 +258,7 @@ export async function mergeContacts(options) {
             byUid: actor.uid
         }, options.actorName || actor.email ? {
             byName: options.actorName || actor.email
-        } : {}, {
-            contactId: survivorId,
+        } : {}, link, {
             visibleTo: plan.visibleTo,
             hostId: hostId != null ? hostId : String((_survivorData_hostId = survivorData['hostId']) != null ? _survivorData_hostId : ''),
             createdByUid: actor.uid,

package/src/lib/server/merge-contacts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/merge-contacts.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * MERGING TWO CONTACTS — the write (AGL-2625).\n *\n * `planContactMerge` says what the survivor becomes; this performs it, and\n * moves everything that pointed at the merged record. One function behind\n * two doors — the console's `crm/contacts-merge` route and\n * `POST /v1/contacts/{id}/merge` — so the REST caller and the record page\n * cannot merge two different ways.\n *\n * ## The order is the crash-safety argument\n *\n *  1. Every deal, task and activity naming the merged contact is repointed\n *     at the survivor — on a deal, its contact roles too (AGL-3521) — and\n *     every lead converted into it, and every contact that reports to it\n *     (AGL-3515), in each holder's facet. Batched,\n *     bounded, idempotent: a re-run finds nothing left to move.\n *  2. Then, in ONE transaction: the survivor takes the plan, every address\n *     it now answers to is indexed at it, and the merged document is\n *     deleted — with both records re-read inside the transaction, so two\n *     merges racing on one pair cannot both succeed and a plan is never\n *     computed on a document that changed under it.\n *\n * Children first because a process that dies between the two steps leaves\n * children pointing at a record that EXISTS — the survivor — while the merged\n * document is still there for a retry to fold in. The other order would\n * leave deals pointing at a deleted contact, which is a record nobody can\n * open from anywhere.\n *\n * ## What it does not move\n *\n * List memberships, suppression entries and the delivery log are keyed by\n * ADDRESS, not by contact id, and stay under the merged address; a capture\n * on that address resolves to the survivor through the index, which is the\n * fact those keys need. A company's contacts count drops only for a company\n * both records named — the survivor still names the rest.\n */\n\nimport { CONTACT_EMAIL_INDEX_COLLECTION, contactEmails } from '@aglyn/aglyn/app-utils/contacts'\nimport type { HostActivityActor } from '@aglyn/aglyn/app-utils/activity-presenter'\nimport { planContactMerge } from '../model/contact-merge'\nimport { contactFacetHolders, repointContactReportsTo } from './contact-reports-to'\nimport { sweepDealContactRoles } from './deal-contact-roles'\nimport { CRM_COLLECTIONS } from '@aglyn/aglyn/app-utils/crm'\nimport { personKey } from '@aglyn/aglyn/app-utils/person-key'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { settleCompanyContactsCounts } from '@aglyn/tenant-data-admin/server/contact-company-link'\nimport { restampCrmListFieldsAt } from '@aglyn/tenant-data-admin/server/crm-records'\nimport { logHostActivity } from '@aglyn/tenant-data-admin/server/organizations'\nimport { recomputeCrmNextTaskAt } from './crm-next-activity'\n\n/** How many pointing rows one repoint pass reads — and one batch writes. */\nconst REPOINT_PAGE = 400\n/** A ceiling on passes, so a query that keeps answering cannot loop forever. */\nconst REPOINT_PASSES = 25\n\nexport interface MergeContactsOptions {\n  firestore: FirebaseFirestore.Firestore\n  /** `orgs/{orgId}` — the org whose contacts both records are. */\n  orgRef: FirebaseFirestore.DocumentReference\n  /** The record that stays, and keeps its address as the identity. */\n  survivorId: string\n  /** The record folded in and deleted. */\n  mergedId: string\n  actor: HostActivityActor\n  /**\n   * The site whose console did the work: where the activity feed entry\n   * lands, and the site a timeline note is filed under. `null` for a door\n   * with no site — the REST API — which logs no host entry.\n   */\n  hostId: string | null\n  /** The actor's display name for the timeline note, when the door knows it. */\n  actorName?: string | null\n}\n\nexport interface MergeContactsRepointed {\n  deals: number\n  tasks: number\n  activities: number\n  leads: number\n}\n\nexport type MergeContactsResult =\n  | {\n      ok: true\n      survivorId: string\n      survivorEmail: string\n      mergedId: string\n      mergedEmail: string\n      /** Every address the survivor answers to now, primary first. */\n      emails: string[]\n      repointed: MergeContactsRepointed\n    }\n  | { ok: false; reason: 'same-record' | 'survivor-missing' | 'merged-missing' }\n\n/**\n * Point every row of `collection` whose `contactId` is `from` at `to`.\n *\n * Page, batch, repeat: each pass reads the rows still pointing at the\n * merged record — the ones a previous pass moved no longer match — so the\n * loop ends when a pass finds nothing. `updatedAt` moves with the pointer\n * because an integration syncing by `updatedAfter` has to see the change.\n */\nasync function repointContactId(\n  firestore: FirebaseFirestore.Firestore,\n  collection: FirebaseFirestore.CollectionReference,\n  from: string,\n  to: string,\n): Promise<number> {\n  let moved = 0\n  for (let pass = 0; pass < REPOINT_PASSES; pass += 1) {\n    const page = await collection\n      .where('contactId', '==', from)\n      .limit(REPOINT_PAGE)\n      .get()\n    if (page.empty) break\n    const batch = firestore.batch()\n    for (const row of page.docs) {\n      batch.update(row.ref, {\n        contactId: to,\n        updatedAt: FieldValue.serverTimestamp(),\n      })\n    }\n    await batch.commit()\n    moved += page.size\n    if (page.size < REPOINT_PAGE) break\n  }\n  return moved\n}\n\n/**\n * The leads converted into the merged contact, restamped at the survivor.\n *\n * A lead lives at `orgs/{orgId}/leads/{personKey(email)}` (AGL-3275), so there\n * is still no query — one document per address, asked for directly. This used\n * to be bounded by sites TIMES addresses because a lead lived under each site;\n * it is bounded by addresses now, and the sites drop out of the signature\n * because the collection no longer has one per site to walk.\n */\nasync function repointLeads(\n  orgRef: FirebaseFirestore.DocumentReference,\n  emails: readonly string[],\n  from: string,\n  to: string,\n): Promise<number> {\n  let moved = 0\n  /*\n   * ONE ROW PER ADDRESS, on the org (AGL-3275). This walked the sites because\n   * there was a lead under each of them; re-pointing the same document once\n   * per site would now be the same write repeated, and the second would find\n   * `convertedContactId` already moved and skip — a silent undercount rather\n   * than a wrong answer, but an undercount the caller reports to the operator.\n   */\n  for (const email of emails) {\n    const key = personKey(email)\n    if (!key) continue\n    const leadRef = orgRef.collection('leads').doc(key)\n    const lead = await leadRef.get()\n    if (!lead.exists || lead.get('convertedContactId') !== from) continue\n    await leadRef.update({\n      convertedContactId: to,\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n    moved += 1\n  }\n  return moved\n}\n\nexport async function mergeContacts(\n  options: MergeContactsOptions,\n): Promise<MergeContactsResult> {\n  const { firestore, orgRef, survivorId, mergedId, actor, hostId } = options\n  if (!survivorId || !mergedId || survivorId === mergedId) {\n    return { ok: false, reason: 'same-record' }\n  }\n  const contactsRef = orgRef.collection('contacts')\n  const survivorRef = contactsRef.doc(survivorId)\n  const mergedRef = contactsRef.doc(mergedId)\n  const [survivorBefore, mergedBefore] = await Promise.all([\n    survivorRef.get(),\n    mergedRef.get(),\n  ])\n  if (!survivorBefore.exists) return { ok: false, reason: 'survivor-missing' }\n  if (!mergedBefore.exists) return { ok: false, reason: 'merged-missing' }\n  const mergedData = (mergedBefore.data() ?? {}) as Record<string, unknown>\n  const survivorData = (survivorBefore.data() ?? {}) as Record<string, unknown>\n\n  /*==========================================\n   * 1. THE CHILDREN — before the parent, for the reason the header gives.\n   *=========================================*/\n  const [deals, tasks, activities] = await Promise.all([\n    // A deal names the merged record as a contact role or as its Primary\n    // (AGL-3521); both move, and a deal naming both records keeps one row.\n    sweepDealContactRoles(\n      firestore,\n      orgRef.collection(CRM_COLLECTIONS.deals),\n      mergedId,\n      survivorId,\n      'contact merge',\n    ),\n    repointContactId(firestore, orgRef.collection(CRM_COLLECTIONS.tasks), mergedId, survivorId),\n    repointContactId(\n      firestore,\n      orgRef.collection(CRM_COLLECTIONS.activities),\n      mergedId,\n      survivorId,\n    ),\n  ])\n  const leads = await repointLeads(\n    orgRef,\n    contactEmails(mergedData),\n    mergedId,\n    survivorId,\n  )\n  /*\n   * Whoever reported to the merged record reports to the survivor now. A\n   * holder can point only at a contact it holds, so the holders of either\n   * record are every facet a pointer can sit in; the survivor's own pointer\n   * at the merged record is cleared rather than turned on itself.\n   */\n  await repointContactReportsTo(\n    firestore,\n    contactsRef,\n    [...contactFacetHolders(mergedData), ...contactFacetHolders(survivorData)],\n    mergedId,\n    survivorId,\n    'contact merge',\n  )\n\n  /*==========================================\n   * 2. THE SWAP — one transaction over both documents and the index.\n   *=========================================*/\n  const index = orgRef.collection(CONTACT_EMAIL_INDEX_COLLECTION)\n  const swapped = await firestore.runTransaction(async (transaction) => {\n    const [survivor, merged] = await Promise.all([\n      transaction.get(survivorRef),\n      transaction.get(mergedRef),\n    ])\n    if (!survivor.exists) return { reason: 'survivor-missing' as const }\n    if (!merged.exists) return { reason: 'merged-missing' as const }\n    const plan = planContactMerge(\n      (survivor.data() ?? {}) as Record<string, unknown>,\n      (merged.data() ?? {}) as Record<string, unknown>,\n      { survivorId, mergedId },\n    )\n    transaction.set(\n      survivorRef,\n      { ...plan.survivor, updatedAt: FieldValue.serverTimestamp() },\n      { merge: true },\n    )\n    for (const email of plan.emails) {\n      const key = personKey(email)\n      if (!key) continue\n      transaction.set(\n        index.doc(key),\n        { email, contactId: survivorId, updatedAt: FieldValue.serverTimestamp() },\n        { merge: true },\n      )\n    }\n    transaction.delete(mergedRef)\n    return { plan, survivor: (survivor.data() ?? {}) as Record<string, unknown> }\n  })\n  if ('reason' in swapped) return { ok: false, reason: swapped.reason }\n  const { plan } = swapped\n  // The survivor now carries both records' addresses, holders and facets —\n  // what the Contacts list searches and filters by (AGL-3321).\n  await restampCrmListFieldsAt(survivorRef, 'contacts')\n\n  /*\n   * The companies both records named counted two people and now count one\n   * (AGL-2613). Settled after the swap the way the capture settles its\n   * counts: a figure that could not move is logged, and the company page's\n   * live aggregate corrects it.\n   */\n  await settleCompanyContactsCounts(orgRef.collection(CRM_COLLECTIONS.companies), {\n    companyId: null,\n    mirror: null,\n    counts: plan.companyCounts,\n  })\n  /*\n   * The survivor now owns the merged record's open tasks too, so its next\n   * activity is the earliest of both (AGL-2661). Settled the same way: a\n   * figure that could not move is logged, and the Fields section's\n   * recompute corrects it.\n   */\n  await recomputeCrmNextTaskAt(firestore, orgRef.id, [{ contactId: survivorId }]).catch(\n    (error: unknown) => {\n      console.error('contact merge next activity could not be recomputed', survivorId, error)\n    },\n  )\n\n  const mergedEmail = contactEmails(mergedData)[0] ?? ''\n  const survivorEmail = plan.emails[0] ?? ''\n  // The canonical name — the one identity every holder shares — for the\n  // feed; the address stands in for a person nobody has named.\n  const survivorName =\n    typeof swapped.survivor['name'] === 'string' ? swapped.survivor['name'] : ''\n\n  /*\n   * THE TIMELINE NOTE, on the survivor: the merge is an event in this\n   * person's history, and the record page is where a reader looks for one.\n   * Filed under the calling site, or the survivor's first site for a door\n   * with none; its own catch, because a note that could not be written must\n   * not read as a merge that did not happen.\n   */\n  try {\n    await orgRef.collection(CRM_COLLECTIONS.activities).add({\n      kind: 'note',\n      body: `Merged with ${mergedEmail}`,\n      atMs: Date.now(),\n      byUid: actor.uid,\n      ...(options.actorName || actor.email\n        ? { byName: options.actorName || actor.email }\n        : {}),\n      contactId: survivorId,\n      visibleTo: plan.visibleTo,\n      hostId: hostId ?? String(survivorData['hostId'] ?? ''),\n      createdByUid: actor.uid,\n      createdAt: FieldValue.serverTimestamp(),\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n  } catch (error) {\n    console.error('[contact-merge] timeline note failed', survivorId, error)\n  }\n\n  // The audit line (AGL-2622), in the feed of the site whose console did\n  // the work. A door with no site — the API — has no host feed to write.\n  if (hostId) {\n    await logHostActivity(hostId, actor, `Merged with ${mergedEmail}`, {\n      type: 'contact',\n      id: survivorId,\n      name: survivorName || survivorEmail,\n    })\n  }\n\n  return {\n    ok: true,\n    survivorId,\n    survivorEmail,\n    mergedId,\n    mergedEmail,\n    emails: plan.emails,\n    repointed: { deals, tasks, activities, leads },\n  }\n}\n"],"names":["CONTACT_EMAIL_INDEX_COLLECTION","contactEmails","planContactMerge","contactFacetHolders","repointContactReportsTo","sweepDealContactRoles","CRM_COLLECTIONS","personKey","FieldValue","settleCompanyContactsCounts","restampCrmListFieldsAt","logHostActivity","recomputeCrmNextTaskAt","REPOINT_PAGE","REPOINT_PASSES","repointContactId","firestore","collection","from","to","moved","pass","page","where","limit","get","empty","batch","row","docs","update","ref","contactId","updatedAt","serverTimestamp","commit","size","repointLeads","orgRef","emails","email","key","leadRef","doc","lead","exists","convertedContactId","mergeContacts","options","mergedBefore","survivorBefore","plan","survivorId","mergedId","actor","hostId","ok","reason","contactsRef","survivorRef","mergedRef","Promise","all","mergedData","data","survivorData","deals","tasks","activities","leads","index","swapped","runTransaction","transaction","survivor","merged","set","merge","delete","companies","companyId","mirror","counts","companyCounts","id","catch","error","console","mergedEmail","survivorEmail","survivorName","add","kind","body","atMs","Date","now","byUid","uid","actorName","byName","visibleTo","String","createdByUid","createdAt","type","name","repointed"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCC,GAED,SAASA,8BAA8B,EAAEC,aAAa,QAAQ,kCAAiC;AAE/F,SAASC,gBAAgB,QAAQ,4BAAwB;AACzD,SAASC,mBAAmB,EAAEC,uBAAuB,QAAQ,0BAAsB;AACnF,SAASC,qBAAqB,QAAQ,0BAAsB;AAC5D,SAASC,eAAe,QAAQ,6BAA4B;AAC5D,SAASC,SAAS,QAAQ,oCAAmC;AAC7D,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,2BAA2B,QAAQ,uDAAsD;AAClG,SAASC,sBAAsB,QAAQ,8CAA6C;AACpF,SAASC,eAAe,QAAQ,gDAA+C;AAC/E,SAASC,sBAAsB,QAAQ,yBAAqB;AAE5D,0EAA0E,GAC1E,MAAMC,eAAe;AACrB,8EAA8E,GAC9E,MAAMC,iBAAiB;AAyCvB;;;;;;;CAOC,GACD,eAAeC,iBACbC,SAAsC,EACtCC,UAAiD,EACjDC,IAAY,EACZC,EAAU;IAEV,IAAIC,QAAQ;IACZ,IAAK,IAAIC,OAAO,GAAGA,OAAOP,gBAAgBO,QAAQ,EAAG;QACnD,MAAMC,OAAO,MAAML,WAChBM,KAAK,CAAC,aAAa,MAAML,MACzBM,KAAK,CAACX,cACNY,GAAG;QACN,IAAIH,KAAKI,KAAK,EAAE;QAChB,MAAMC,QAAQX,UAAUW,KAAK;QAC7B,KAAK,MAAMC,OAAON,KAAKO,IAAI,CAAE;YAC3BF,MAAMG,MAAM,CAACF,IAAIG,GAAG,EAAE;gBACpBC,WAAWb;gBACXc,WAAWzB,WAAW0B,eAAe;YACvC;QACF;QACA,MAAMP,MAAMQ,MAAM;QAClBf,SAASE,KAAKc,IAAI;QAClB,IAAId,KAAKc,IAAI,GAAGvB,cAAc;IAChC;IACA,OAAOO;AACT;AAEA;;;;;;;;CAQC,GACD,eAAeiB,aACbC,MAA2C,EAC3CC,MAAyB,EACzBrB,IAAY,EACZC,EAAU;IAEV,IAAIC,QAAQ;IACZ;;;;;;GAMC,GACD,KAAK,MAAMoB,SAASD,OAAQ;QAC1B,MAAME,MAAMlC,UAAUiC;QACtB,IAAI,CAACC,KAAK;QACV,MAAMC,UAAUJ,OAAOrB,UAAU,CAAC,SAAS0B,GAAG,CAACF;QAC/C,MAAMG,OAAO,MAAMF,QAAQjB,GAAG;QAC9B,IAAI,CAACmB,KAAKC,MAAM,IAAID,KAAKnB,GAAG,CAAC,0BAA0BP,MAAM;QAC7D,MAAMwB,QAAQZ,MAAM,CAAC;YACnBgB,oBAAoB3B;YACpBc,WAAWzB,WAAW0B,eAAe;QACvC;QACAd,SAAS;IACX;IACA,OAAOA;AACT;AAEA,OAAO,eAAe2B,cACpBC,OAA6B;QAeTC,oBACEC,sBA0GFjD,iBACEkD;IAzHtB,MAAM,EAAEnC,SAAS,EAAEsB,MAAM,EAAEc,UAAU,EAAEC,QAAQ,EAAEC,KAAK,EAAEC,MAAM,EAAE,GAAGP;IACnE,IAAI,CAACI,cAAc,CAACC,YAAYD,eAAeC,UAAU;QACvD,OAAO;YAAEG,IAAI;YAAOC,QAAQ;QAAc;IAC5C;IACA,MAAMC,cAAcpB,OAAOrB,UAAU,CAAC;IACtC,MAAM0C,cAAcD,YAAYf,GAAG,CAACS;IACpC,MAAMQ,YAAYF,YAAYf,GAAG,CAACU;IAClC,MAAM,CAACH,gBAAgBD,aAAa,GAAG,MAAMY,QAAQC,GAAG,CAAC;QACvDH,YAAYlC,GAAG;QACfmC,UAAUnC,GAAG;KACd;IACD,IAAI,CAACyB,eAAeL,MAAM,EAAE,OAAO;QAAEW,IAAI;QAAOC,QAAQ;IAAmB;IAC3E,IAAI,CAACR,aAAaJ,MAAM,EAAE,OAAO;QAAEW,IAAI;QAAOC,QAAQ;IAAiB;IACvE,MAAMM,cAAcd,qBAAAA,aAAae,IAAI,cAAjBf,qBAAuB,CAAC;IAC5C,MAAMgB,gBAAgBf,uBAAAA,eAAec,IAAI,cAAnBd,uBAAyB,CAAC;IAEhD;;6CAE2C,GAC3C,MAAM,CAACgB,OAAOC,OAAOC,WAAW,GAAG,MAAMP,QAAQC,GAAG,CAAC;QACnD,qEAAqE;QACrE,uEAAuE;QACvEzD,sBACEW,WACAsB,OAAOrB,UAAU,CAACX,gBAAgB4D,KAAK,GACvCb,UACAD,YACA;QAEFrC,iBAAiBC,WAAWsB,OAAOrB,UAAU,CAACX,gBAAgB6D,KAAK,GAAGd,UAAUD;QAChFrC,iBACEC,WACAsB,OAAOrB,UAAU,CAACX,gBAAgB8D,UAAU,GAC5Cf,UACAD;KAEH;IACD,MAAMiB,QAAQ,MAAMhC,aAClBC,QACArC,cAAc8D,aACdV,UACAD;IAEF;;;;;GAKC,GACD,MAAMhD,wBACJY,WACA0C,aACA;WAAIvD,oBAAoB4D;WAAgB5D,oBAAoB8D;KAAc,EAC1EZ,UACAD,YACA;IAGF;;6CAE2C,GAC3C,MAAMkB,QAAQhC,OAAOrB,UAAU,CAACjB;IAChC,MAAMuE,UAAU,MAAMvD,UAAUwD,cAAc,CAAC,OAAOC;YAQjDC,gBACAC,cAkBuBD;QA1B1B,MAAM,CAACA,UAAUC,OAAO,GAAG,MAAMd,QAAQC,GAAG,CAAC;YAC3CW,YAAYhD,GAAG,CAACkC;YAChBc,YAAYhD,GAAG,CAACmC;SACjB;QACD,IAAI,CAACc,SAAS7B,MAAM,EAAE,OAAO;YAAEY,QAAQ;QAA4B;QACnE,IAAI,CAACkB,OAAO9B,MAAM,EAAE,OAAO;YAAEY,QAAQ;QAA0B;QAC/D,MAAMN,OAAOjD,kBACVwE,iBAAAA,SAASV,IAAI,cAAbU,iBAAmB,CAAC,IACpBC,eAAAA,OAAOX,IAAI,cAAXW,eAAiB,CAAC,GACnB;YAAEvB;YAAYC;QAAS;QAEzBoB,YAAYG,GAAG,CACbjB,aACA,aAAKR,KAAKuB,QAAQ;YAAEzC,WAAWzB,WAAW0B,eAAe;YACzD;YAAE2C,OAAO;QAAK;QAEhB,KAAK,MAAMrC,SAASW,KAAKZ,MAAM,CAAE;YAC/B,MAAME,MAAMlC,UAAUiC;YACtB,IAAI,CAACC,KAAK;YACVgC,YAAYG,GAAG,CACbN,MAAM3B,GAAG,CAACF,MACV;gBAAED;gBAAOR,WAAWoB;gBAAYnB,WAAWzB,WAAW0B,eAAe;YAAG,GACxE;gBAAE2C,OAAO;YAAK;QAElB;QACAJ,YAAYK,MAAM,CAAClB;QACnB,OAAO;YAAET;YAAMuB,QAAQ,GAAGA,kBAAAA,SAASV,IAAI,cAAbU,kBAAmB,CAAC;QAA8B;IAC9E;IACA,IAAI,YAAYH,SAAS,OAAO;QAAEf,IAAI;QAAOC,QAAQc,QAAQd,MAAM;IAAC;IACpE,MAAM,EAAEN,IAAI,EAAE,GAAGoB;IACjB,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM7D,uBAAuBiD,aAAa;IAE1C;;;;;GAKC,GACD,MAAMlD,4BAA4B6B,OAAOrB,UAAU,CAACX,gBAAgByE,SAAS,GAAG;QAC9EC,WAAW;QACXC,QAAQ;QACRC,QAAQ/B,KAAKgC,aAAa;IAC5B;IACA;;;;;GAKC,GACD,MAAMvE,uBAAuBI,WAAWsB,OAAO8C,EAAE,EAAE;QAAC;YAAEpD,WAAWoB;QAAW;KAAE,EAAEiC,KAAK,CACnF,CAACC;QACCC,QAAQD,KAAK,CAAC,uDAAuDlC,YAAYkC;IACnF;IAGF,MAAME,eAAcvF,kBAAAA,cAAc8D,WAAW,CAAC,EAAE,YAA5B9D,kBAAgC;IACpD,MAAMwF,iBAAgBtC,gBAAAA,KAAKZ,MAAM,CAAC,EAAE,YAAdY,gBAAkB;IACxC,sEAAsE;IACtE,6DAA6D;IAC7D,MAAMuC,eACJ,OAAOnB,QAAQG,QAAQ,CAAC,OAAO,KAAK,WAAWH,QAAQG,QAAQ,CAAC,OAAO,GAAG;IAE5E;;;;;;GAMC,GACD,IAAI;YAWyBT;QAV3B,MAAM3B,OAAOrB,UAAU,CAACX,gBAAgB8D,UAAU,EAAEuB,GAAG,CAAC;YACtDC,MAAM;YACNC,MAAM,CAAC,YAAY,EAAEL,aAAa;YAClCM,MAAMC,KAAKC,GAAG;YACdC,OAAO3C,MAAM4C,GAAG;WACZlD,QAAQmD,SAAS,IAAI7C,MAAMd,KAAK,GAChC;YAAE4D,QAAQpD,QAAQmD,SAAS,IAAI7C,MAAMd,KAAK;QAAC,IAC3C,CAAC;YACLR,WAAWoB;YACXiD,WAAWlD,KAAKkD,SAAS;YACzB9C,MAAM,EAAEA,iBAAAA,SAAU+C,QAAOrC,uBAAAA,YAAY,CAAC,SAAS,YAAtBA,uBAA0B;YACnDsC,cAAcjD,MAAM4C,GAAG;YACvBM,WAAWhG,WAAW0B,eAAe;YACrCD,WAAWzB,WAAW0B,eAAe;;IAEzC,EAAE,OAAOoD,OAAO;QACdC,QAAQD,KAAK,CAAC,wCAAwClC,YAAYkC;IACpE;IAEA,uEAAuE;IACvE,uEAAuE;IACvE,IAAI/B,QAAQ;QACV,MAAM5C,gBAAgB4C,QAAQD,OAAO,CAAC,YAAY,EAAEkC,aAAa,EAAE;YACjEiB,MAAM;YACNrB,IAAIhC;YACJsD,MAAMhB,gBAAgBD;QACxB;IACF;IAEA,OAAO;QACLjC,IAAI;QACJJ;QACAqC;QACApC;QACAmC;QACAjD,QAAQY,KAAKZ,MAAM;QACnBoE,WAAW;YAAEzC;YAAOC;YAAOC;YAAYC;QAAM;IAC/C;AACF"}
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/merge-contacts.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * MERGING TWO CONTACTS — the write (AGL-2625).\n *\n * `planContactMerge` says what the survivor becomes; this performs it, and\n * moves everything that pointed at the merged record. One function behind\n * two doors — the console's `crm/contacts-merge` route and\n * `POST /v1/contacts/{id}/merge` — so the REST caller and the record page\n * cannot merge two different ways.\n *\n * ## The order is the crash-safety argument\n *\n *  1. Every deal, task and activity naming the merged contact is repointed\n *     at the survivor — on a deal, its contact roles too (AGL-3521) — and\n *     every lead converted into it, and every contact that reports to it\n *     (AGL-3515), in each holder's facet. Batched,\n *     bounded, idempotent: a re-run finds nothing left to move.\n *  2. Then, in ONE transaction: the survivor takes the plan, every address\n *     it now answers to is indexed at it, and the merged document is\n *     deleted — with both records re-read inside the transaction, so two\n *     merges racing on one pair cannot both succeed and a plan is never\n *     computed on a document that changed under it.\n *\n * Children first because a process that dies between the two steps leaves\n * children pointing at a record that EXISTS — the survivor — while the merged\n * document is still there for a retry to fold in. The other order would\n * leave deals pointing at a deleted contact, which is a record nobody can\n * open from anywhere.\n *\n * ## What it does not move\n *\n * List memberships, suppression entries and the delivery log are keyed by\n * ADDRESS, not by contact id, and stay under the merged address; a capture\n * on that address resolves to the survivor through the index, which is the\n * fact those keys need. A company's contacts count drops only for a company\n * both records named — the survivor still names the rest.\n */\n\nimport { CONTACT_EMAIL_INDEX_COLLECTION, contactEmails } from '@aglyn/aglyn/app-utils/contacts'\nimport type { HostActivityActor } from '@aglyn/aglyn/app-utils/activity-presenter'\nimport { planContactMerge } from '../model/contact-merge'\nimport { contactFacetHolders, repointContactReportsTo } from './contact-reports-to'\nimport { sweepDealContactRoles } from './deal-contact-roles'\nimport { CRM_COLLECTIONS } from '@aglyn/aglyn/app-utils/crm'\nimport { personKey } from '@aglyn/aglyn/app-utils/person-key'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { settleCompanyContactsCounts } from '@aglyn/tenant-data-admin/server/contact-company-link'\nimport { restampCrmListFieldsAt } from '@aglyn/tenant-data-admin/server/crm-records'\nimport { logHostActivity } from '@aglyn/tenant-data-admin/server/organizations'\nimport { recomputeCrmNextTaskAt } from './crm-next-activity'\nimport { crmActivityLinkWithCompany } from './crm-activity-company'\n\n/** How many pointing rows one repoint pass reads — and one batch writes. */\nconst REPOINT_PAGE = 400\n/** A ceiling on passes, so a query that keeps answering cannot loop forever. */\nconst REPOINT_PASSES = 25\n\nexport interface MergeContactsOptions {\n  firestore: FirebaseFirestore.Firestore\n  /** `orgs/{orgId}` — the org whose contacts both records are. */\n  orgRef: FirebaseFirestore.DocumentReference\n  /** The record that stays, and keeps its address as the identity. */\n  survivorId: string\n  /** The record folded in and deleted. */\n  mergedId: string\n  actor: HostActivityActor\n  /**\n   * The site whose console did the work: where the activity feed entry\n   * lands, and the site a timeline note is filed under. `null` for a door\n   * with no site — the REST API — which logs no host entry.\n   */\n  hostId: string | null\n  /** The actor's display name for the timeline note, when the door knows it. */\n  actorName?: string | null\n}\n\nexport interface MergeContactsRepointed {\n  deals: number\n  tasks: number\n  activities: number\n  leads: number\n}\n\nexport type MergeContactsResult =\n  | {\n      ok: true\n      survivorId: string\n      survivorEmail: string\n      mergedId: string\n      mergedEmail: string\n      /** Every address the survivor answers to now, primary first. */\n      emails: string[]\n      repointed: MergeContactsRepointed\n    }\n  | { ok: false; reason: 'same-record' | 'survivor-missing' | 'merged-missing' }\n\n/**\n * Point every row of `collection` whose `contactId` is `from` at `to`.\n *\n * Page, batch, repeat: each pass reads the rows still pointing at the\n * merged record — the ones a previous pass moved no longer match — so the\n * loop ends when a pass finds nothing. `updatedAt` moves with the pointer\n * because an integration syncing by `updatedAfter` has to see the change.\n */\nasync function repointContactId(\n  firestore: FirebaseFirestore.Firestore,\n  collection: FirebaseFirestore.CollectionReference,\n  from: string,\n  to: string,\n): Promise<number> {\n  let moved = 0\n  for (let pass = 0; pass < REPOINT_PASSES; pass += 1) {\n    const page = await collection\n      .where('contactId', '==', from)\n      .limit(REPOINT_PAGE)\n      .get()\n    if (page.empty) break\n    const batch = firestore.batch()\n    for (const row of page.docs) {\n      batch.update(row.ref, {\n        contactId: to,\n        updatedAt: FieldValue.serverTimestamp(),\n      })\n    }\n    await batch.commit()\n    moved += page.size\n    if (page.size < REPOINT_PAGE) break\n  }\n  return moved\n}\n\n/**\n * The leads converted into the merged contact, restamped at the survivor.\n *\n * A lead lives at `orgs/{orgId}/leads/{personKey(email)}` (AGL-3275), so there\n * is still no query — one document per address, asked for directly. This used\n * to be bounded by sites TIMES addresses because a lead lived under each site;\n * it is bounded by addresses now, and the sites drop out of the signature\n * because the collection no longer has one per site to walk.\n */\nasync function repointLeads(\n  orgRef: FirebaseFirestore.DocumentReference,\n  emails: readonly string[],\n  from: string,\n  to: string,\n): Promise<number> {\n  let moved = 0\n  /*\n   * ONE ROW PER ADDRESS, on the org (AGL-3275). This walked the sites because\n   * there was a lead under each of them; re-pointing the same document once\n   * per site would now be the same write repeated, and the second would find\n   * `convertedContactId` already moved and skip — a silent undercount rather\n   * than a wrong answer, but an undercount the caller reports to the operator.\n   */\n  for (const email of emails) {\n    const key = personKey(email)\n    if (!key) continue\n    const leadRef = orgRef.collection('leads').doc(key)\n    const lead = await leadRef.get()\n    if (!lead.exists || lead.get('convertedContactId') !== from) continue\n    await leadRef.update({\n      convertedContactId: to,\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n    moved += 1\n  }\n  return moved\n}\n\nexport async function mergeContacts(\n  options: MergeContactsOptions,\n): Promise<MergeContactsResult> {\n  const { firestore, orgRef, survivorId, mergedId, actor, hostId } = options\n  if (!survivorId || !mergedId || survivorId === mergedId) {\n    return { ok: false, reason: 'same-record' }\n  }\n  const contactsRef = orgRef.collection('contacts')\n  const survivorRef = contactsRef.doc(survivorId)\n  const mergedRef = contactsRef.doc(mergedId)\n  const [survivorBefore, mergedBefore] = await Promise.all([\n    survivorRef.get(),\n    mergedRef.get(),\n  ])\n  if (!survivorBefore.exists) return { ok: false, reason: 'survivor-missing' }\n  if (!mergedBefore.exists) return { ok: false, reason: 'merged-missing' }\n  const mergedData = (mergedBefore.data() ?? {}) as Record<string, unknown>\n  const survivorData = (survivorBefore.data() ?? {}) as Record<string, unknown>\n\n  /*==========================================\n   * 1. THE CHILDREN — before the parent, for the reason the header gives.\n   *=========================================*/\n  const [deals, tasks, activities] = await Promise.all([\n    // A deal names the merged record as a contact role or as its Primary\n    // (AGL-3521); both move, and a deal naming both records keeps one row.\n    sweepDealContactRoles(\n      firestore,\n      orgRef.collection(CRM_COLLECTIONS.deals),\n      mergedId,\n      survivorId,\n      'contact merge',\n    ),\n    repointContactId(firestore, orgRef.collection(CRM_COLLECTIONS.tasks), mergedId, survivorId),\n    repointContactId(\n      firestore,\n      orgRef.collection(CRM_COLLECTIONS.activities),\n      mergedId,\n      survivorId,\n    ),\n  ])\n  const leads = await repointLeads(\n    orgRef,\n    contactEmails(mergedData),\n    mergedId,\n    survivorId,\n  )\n  /*\n   * Whoever reported to the merged record reports to the survivor now. A\n   * holder can point only at a contact it holds, so the holders of either\n   * record are every facet a pointer can sit in; the survivor's own pointer\n   * at the merged record is cleared rather than turned on itself.\n   */\n  await repointContactReportsTo(\n    firestore,\n    contactsRef,\n    [...contactFacetHolders(mergedData), ...contactFacetHolders(survivorData)],\n    mergedId,\n    survivorId,\n    'contact merge',\n  )\n\n  /*==========================================\n   * 2. THE SWAP — one transaction over both documents and the index.\n   *=========================================*/\n  const index = orgRef.collection(CONTACT_EMAIL_INDEX_COLLECTION)\n  const swapped = await firestore.runTransaction(async (transaction) => {\n    const [survivor, merged] = await Promise.all([\n      transaction.get(survivorRef),\n      transaction.get(mergedRef),\n    ])\n    if (!survivor.exists) return { reason: 'survivor-missing' as const }\n    if (!merged.exists) return { reason: 'merged-missing' as const }\n    const plan = planContactMerge(\n      (survivor.data() ?? {}) as Record<string, unknown>,\n      (merged.data() ?? {}) as Record<string, unknown>,\n      { survivorId, mergedId },\n    )\n    transaction.set(\n      survivorRef,\n      { ...plan.survivor, updatedAt: FieldValue.serverTimestamp() },\n      { merge: true },\n    )\n    for (const email of plan.emails) {\n      const key = personKey(email)\n      if (!key) continue\n      transaction.set(\n        index.doc(key),\n        { email, contactId: survivorId, updatedAt: FieldValue.serverTimestamp() },\n        { merge: true },\n      )\n    }\n    transaction.delete(mergedRef)\n    return { plan, survivor: (survivor.data() ?? {}) as Record<string, unknown> }\n  })\n  if ('reason' in swapped) return { ok: false, reason: swapped.reason }\n  const { plan } = swapped\n  // The survivor now carries both records' addresses, holders and facets —\n  // what the Contacts list searches and filters by (AGL-3321).\n  await restampCrmListFieldsAt(survivorRef, 'contacts')\n\n  /*\n   * The companies both records named counted two people and now count one\n   * (AGL-2613). Settled after the swap the way the capture settles its\n   * counts: a figure that could not move is logged, and the company page's\n   * live aggregate corrects it.\n   */\n  await settleCompanyContactsCounts(orgRef.collection(CRM_COLLECTIONS.companies), {\n    companyId: null,\n    mirror: null,\n    counts: plan.companyCounts,\n  })\n  /*\n   * The survivor now owns the merged record's open tasks too, so its next\n   * activity is the earliest of both (AGL-2661). Settled the same way: a\n   * figure that could not move is logged, and the Fields section's\n   * recompute corrects it.\n   */\n  await recomputeCrmNextTaskAt(firestore, orgRef.id, [{ contactId: survivorId }]).catch(\n    (error: unknown) => {\n      console.error('contact merge next activity could not be recomputed', survivorId, error)\n    },\n  )\n\n  const mergedEmail = contactEmails(mergedData)[0] ?? ''\n  const survivorEmail = plan.emails[0] ?? ''\n  // The canonical name — the one identity every holder shares — for the\n  // feed; the address stands in for a person nobody has named.\n  const survivorName =\n    typeof swapped.survivor['name'] === 'string' ? swapped.survivor['name'] : ''\n\n  /*\n   * THE TIMELINE NOTE, on the survivor: the merge is an event in this\n   * person's history, and the record page is where a reader looks for one.\n   * Filed under the calling site, or the survivor's first site for a door\n   * with none; its own catch, because a note that could not be written must\n   * not read as a merge that did not happen.\n   */\n  try {\n    // Read after the swap, so a company only the merged record named counts.\n    const link = await crmActivityLinkWithCompany(orgRef, { contactId: survivorId })\n    await orgRef.collection(CRM_COLLECTIONS.activities).add({\n      kind: 'note',\n      body: `Merged with ${mergedEmail}`,\n      atMs: Date.now(),\n      byUid: actor.uid,\n      ...(options.actorName || actor.email\n        ? { byName: options.actorName || actor.email }\n        : {}),\n      ...link,\n      visibleTo: plan.visibleTo,\n      hostId: hostId ?? String(survivorData['hostId'] ?? ''),\n      createdByUid: actor.uid,\n      createdAt: FieldValue.serverTimestamp(),\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n  } catch (error) {\n    console.error('[contact-merge] timeline note failed', survivorId, error)\n  }\n\n  // The audit line (AGL-2622), in the feed of the site whose console did\n  // the work. A door with no site — the API — has no host feed to write.\n  if (hostId) {\n    await logHostActivity(hostId, actor, `Merged with ${mergedEmail}`, {\n      type: 'contact',\n      id: survivorId,\n      name: survivorName || survivorEmail,\n    })\n  }\n\n  return {\n    ok: true,\n    survivorId,\n    survivorEmail,\n    mergedId,\n    mergedEmail,\n    emails: plan.emails,\n    repointed: { deals, tasks, activities, leads },\n  }\n}\n"],"names":["CONTACT_EMAIL_INDEX_COLLECTION","contactEmails","planContactMerge","contactFacetHolders","repointContactReportsTo","sweepDealContactRoles","CRM_COLLECTIONS","personKey","FieldValue","settleCompanyContactsCounts","restampCrmListFieldsAt","logHostActivity","recomputeCrmNextTaskAt","crmActivityLinkWithCompany","REPOINT_PAGE","REPOINT_PASSES","repointContactId","firestore","collection","from","to","moved","pass","page","where","limit","get","empty","batch","row","docs","update","ref","contactId","updatedAt","serverTimestamp","commit","size","repointLeads","orgRef","emails","email","key","leadRef","doc","lead","exists","convertedContactId","mergeContacts","options","mergedBefore","survivorBefore","plan","survivorId","mergedId","actor","hostId","ok","reason","contactsRef","survivorRef","mergedRef","Promise","all","mergedData","data","survivorData","deals","tasks","activities","leads","index","swapped","runTransaction","transaction","survivor","merged","set","merge","delete","companies","companyId","mirror","counts","companyCounts","id","catch","error","console","mergedEmail","survivorEmail","survivorName","link","add","kind","body","atMs","Date","now","byUid","uid","actorName","byName","visibleTo","String","createdByUid","createdAt","type","name","repointed"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCC,GAED,SAASA,8BAA8B,EAAEC,aAAa,QAAQ,kCAAiC;AAE/F,SAASC,gBAAgB,QAAQ,4BAAwB;AACzD,SAASC,mBAAmB,EAAEC,uBAAuB,QAAQ,0BAAsB;AACnF,SAASC,qBAAqB,QAAQ,0BAAsB;AAC5D,SAASC,eAAe,QAAQ,6BAA4B;AAC5D,SAASC,SAAS,QAAQ,oCAAmC;AAC7D,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,2BAA2B,QAAQ,uDAAsD;AAClG,SAASC,sBAAsB,QAAQ,8CAA6C;AACpF,SAASC,eAAe,QAAQ,gDAA+C;AAC/E,SAASC,sBAAsB,QAAQ,yBAAqB;AAC5D,SAASC,0BAA0B,QAAQ,4BAAwB;AAEnE,0EAA0E,GAC1E,MAAMC,eAAe;AACrB,8EAA8E,GAC9E,MAAMC,iBAAiB;AAyCvB;;;;;;;CAOC,GACD,eAAeC,iBACbC,SAAsC,EACtCC,UAAiD,EACjDC,IAAY,EACZC,EAAU;IAEV,IAAIC,QAAQ;IACZ,IAAK,IAAIC,OAAO,GAAGA,OAAOP,gBAAgBO,QAAQ,EAAG;QACnD,MAAMC,OAAO,MAAML,WAChBM,KAAK,CAAC,aAAa,MAAML,MACzBM,KAAK,CAACX,cACNY,GAAG;QACN,IAAIH,KAAKI,KAAK,EAAE;QAChB,MAAMC,QAAQX,UAAUW,KAAK;QAC7B,KAAK,MAAMC,OAAON,KAAKO,IAAI,CAAE;YAC3BF,MAAMG,MAAM,CAACF,IAAIG,GAAG,EAAE;gBACpBC,WAAWb;gBACXc,WAAW1B,WAAW2B,eAAe;YACvC;QACF;QACA,MAAMP,MAAMQ,MAAM;QAClBf,SAASE,KAAKc,IAAI;QAClB,IAAId,KAAKc,IAAI,GAAGvB,cAAc;IAChC;IACA,OAAOO;AACT;AAEA;;;;;;;;CAQC,GACD,eAAeiB,aACbC,MAA2C,EAC3CC,MAAyB,EACzBrB,IAAY,EACZC,EAAU;IAEV,IAAIC,QAAQ;IACZ;;;;;;GAMC,GACD,KAAK,MAAMoB,SAASD,OAAQ;QAC1B,MAAME,MAAMnC,UAAUkC;QACtB,IAAI,CAACC,KAAK;QACV,MAAMC,UAAUJ,OAAOrB,UAAU,CAAC,SAAS0B,GAAG,CAACF;QAC/C,MAAMG,OAAO,MAAMF,QAAQjB,GAAG;QAC9B,IAAI,CAACmB,KAAKC,MAAM,IAAID,KAAKnB,GAAG,CAAC,0BAA0BP,MAAM;QAC7D,MAAMwB,QAAQZ,MAAM,CAAC;YACnBgB,oBAAoB3B;YACpBc,WAAW1B,WAAW2B,eAAe;QACvC;QACAd,SAAS;IACX;IACA,OAAOA;AACT;AAEA,OAAO,eAAe2B,cACpBC,OAA6B;QAeTC,oBACEC,sBA0GFlD,iBACEmD;IAzHtB,MAAM,EAAEnC,SAAS,EAAEsB,MAAM,EAAEc,UAAU,EAAEC,QAAQ,EAAEC,KAAK,EAAEC,MAAM,EAAE,GAAGP;IACnE,IAAI,CAACI,cAAc,CAACC,YAAYD,eAAeC,UAAU;QACvD,OAAO;YAAEG,IAAI;YAAOC,QAAQ;QAAc;IAC5C;IACA,MAAMC,cAAcpB,OAAOrB,UAAU,CAAC;IACtC,MAAM0C,cAAcD,YAAYf,GAAG,CAACS;IACpC,MAAMQ,YAAYF,YAAYf,GAAG,CAACU;IAClC,MAAM,CAACH,gBAAgBD,aAAa,GAAG,MAAMY,QAAQC,GAAG,CAAC;QACvDH,YAAYlC,GAAG;QACfmC,UAAUnC,GAAG;KACd;IACD,IAAI,CAACyB,eAAeL,MAAM,EAAE,OAAO;QAAEW,IAAI;QAAOC,QAAQ;IAAmB;IAC3E,IAAI,CAACR,aAAaJ,MAAM,EAAE,OAAO;QAAEW,IAAI;QAAOC,QAAQ;IAAiB;IACvE,MAAMM,cAAcd,qBAAAA,aAAae,IAAI,cAAjBf,qBAAuB,CAAC;IAC5C,MAAMgB,gBAAgBf,uBAAAA,eAAec,IAAI,cAAnBd,uBAAyB,CAAC;IAEhD;;6CAE2C,GAC3C,MAAM,CAACgB,OAAOC,OAAOC,WAAW,GAAG,MAAMP,QAAQC,GAAG,CAAC;QACnD,qEAAqE;QACrE,uEAAuE;QACvE1D,sBACEY,WACAsB,OAAOrB,UAAU,CAACZ,gBAAgB6D,KAAK,GACvCb,UACAD,YACA;QAEFrC,iBAAiBC,WAAWsB,OAAOrB,UAAU,CAACZ,gBAAgB8D,KAAK,GAAGd,UAAUD;QAChFrC,iBACEC,WACAsB,OAAOrB,UAAU,CAACZ,gBAAgB+D,UAAU,GAC5Cf,UACAD;KAEH;IACD,MAAMiB,QAAQ,MAAMhC,aAClBC,QACAtC,cAAc+D,aACdV,UACAD;IAEF;;;;;GAKC,GACD,MAAMjD,wBACJa,WACA0C,aACA;WAAIxD,oBAAoB6D;WAAgB7D,oBAAoB+D;KAAc,EAC1EZ,UACAD,YACA;IAGF;;6CAE2C,GAC3C,MAAMkB,QAAQhC,OAAOrB,UAAU,CAAClB;IAChC,MAAMwE,UAAU,MAAMvD,UAAUwD,cAAc,CAAC,OAAOC;YAQjDC,gBACAC,cAkBuBD;QA1B1B,MAAM,CAACA,UAAUC,OAAO,GAAG,MAAMd,QAAQC,GAAG,CAAC;YAC3CW,YAAYhD,GAAG,CAACkC;YAChBc,YAAYhD,GAAG,CAACmC;SACjB;QACD,IAAI,CAACc,SAAS7B,MAAM,EAAE,OAAO;YAAEY,QAAQ;QAA4B;QACnE,IAAI,CAACkB,OAAO9B,MAAM,EAAE,OAAO;YAAEY,QAAQ;QAA0B;QAC/D,MAAMN,OAAOlD,kBACVyE,iBAAAA,SAASV,IAAI,cAAbU,iBAAmB,CAAC,IACpBC,eAAAA,OAAOX,IAAI,cAAXW,eAAiB,CAAC,GACnB;YAAEvB;YAAYC;QAAS;QAEzBoB,YAAYG,GAAG,CACbjB,aACA,aAAKR,KAAKuB,QAAQ;YAAEzC,WAAW1B,WAAW2B,eAAe;YACzD;YAAE2C,OAAO;QAAK;QAEhB,KAAK,MAAMrC,SAASW,KAAKZ,MAAM,CAAE;YAC/B,MAAME,MAAMnC,UAAUkC;YACtB,IAAI,CAACC,KAAK;YACVgC,YAAYG,GAAG,CACbN,MAAM3B,GAAG,CAACF,MACV;gBAAED;gBAAOR,WAAWoB;gBAAYnB,WAAW1B,WAAW2B,eAAe;YAAG,GACxE;gBAAE2C,OAAO;YAAK;QAElB;QACAJ,YAAYK,MAAM,CAAClB;QACnB,OAAO;YAAET;YAAMuB,QAAQ,GAAGA,kBAAAA,SAASV,IAAI,cAAbU,kBAAmB,CAAC;QAA8B;IAC9E;IACA,IAAI,YAAYH,SAAS,OAAO;QAAEf,IAAI;QAAOC,QAAQc,QAAQd,MAAM;IAAC;IACpE,MAAM,EAAEN,IAAI,EAAE,GAAGoB;IACjB,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM9D,uBAAuBkD,aAAa;IAE1C;;;;;GAKC,GACD,MAAMnD,4BAA4B8B,OAAOrB,UAAU,CAACZ,gBAAgB0E,SAAS,GAAG;QAC9EC,WAAW;QACXC,QAAQ;QACRC,QAAQ/B,KAAKgC,aAAa;IAC5B;IACA;;;;;GAKC,GACD,MAAMxE,uBAAuBK,WAAWsB,OAAO8C,EAAE,EAAE;QAAC;YAAEpD,WAAWoB;QAAW;KAAE,EAAEiC,KAAK,CACnF,CAACC;QACCC,QAAQD,KAAK,CAAC,uDAAuDlC,YAAYkC;IACnF;IAGF,MAAME,eAAcxF,kBAAAA,cAAc+D,WAAW,CAAC,EAAE,YAA5B/D,kBAAgC;IACpD,MAAMyF,iBAAgBtC,gBAAAA,KAAKZ,MAAM,CAAC,EAAE,YAAdY,gBAAkB;IACxC,sEAAsE;IACtE,6DAA6D;IAC7D,MAAMuC,eACJ,OAAOnB,QAAQG,QAAQ,CAAC,OAAO,KAAK,WAAWH,QAAQG,QAAQ,CAAC,OAAO,GAAG;IAE5E;;;;;;GAMC,GACD,IAAI;YAayBT;QAZ3B,yEAAyE;QACzE,MAAM0B,OAAO,MAAM/E,2BAA2B0B,QAAQ;YAAEN,WAAWoB;QAAW;QAC9E,MAAMd,OAAOrB,UAAU,CAACZ,gBAAgB+D,UAAU,EAAEwB,GAAG,CAAC;YACtDC,MAAM;YACNC,MAAM,CAAC,YAAY,EAAEN,aAAa;YAClCO,MAAMC,KAAKC,GAAG;YACdC,OAAO5C,MAAM6C,GAAG;WACZnD,QAAQoD,SAAS,IAAI9C,MAAMd,KAAK,GAChC;YAAE6D,QAAQrD,QAAQoD,SAAS,IAAI9C,MAAMd,KAAK;QAAC,IAC3C,CAAC,GACFmD;YACHW,WAAWnD,KAAKmD,SAAS;YACzB/C,MAAM,EAAEA,iBAAAA,SAAUgD,QAAOtC,uBAAAA,YAAY,CAAC,SAAS,YAAtBA,uBAA0B;YACnDuC,cAAclD,MAAM6C,GAAG;YACvBM,WAAWlG,WAAW2B,eAAe;YACrCD,WAAW1B,WAAW2B,eAAe;;IAEzC,EAAE,OAAOoD,OAAO;QACdC,QAAQD,KAAK,CAAC,wCAAwClC,YAAYkC;IACpE;IAEA,uEAAuE;IACvE,uEAAuE;IACvE,IAAI/B,QAAQ;QACV,MAAM7C,gBAAgB6C,QAAQD,OAAO,CAAC,YAAY,EAAEkC,aAAa,EAAE;YACjEkB,MAAM;YACNtB,IAAIhC;YACJuD,MAAMjB,gBAAgBD;QACxB;IACF;IAEA,OAAO;QACLjC,IAAI;QACJJ;QACAqC;QACApC;QACAmC;QACAjD,QAAQY,KAAKZ,MAAM;QACnBqE,WAAW;YAAE1C;YAAOC;YAAOC;YAAYC;QAAM;IAC/C;AACF"}

package/src/lib/server/org-caller.d.ts

@@ -113,6 +113,14 @@ export declare function authorizeOrgCaller(req: PluginApiRequest, orgId: string,
     needs: OrgCallerRequirement;
     refusal: string;
 }): Promise<OrgCaller | OrgCallerRefusal>;
+/**
+ * The organization a create names when it comes with no site, in the shape
+ * `getOrgForHost` answers for one that does, or `null` when there is none.
+ */
+export declare function readOrgForCreate(orgId: string): Promise<{
+    orgId: string;
+    org: Partial<AglynOrganization>;
+} | null>;
 /**
  * Every site of the organization, by document id — the host set an
  * org-level act sweeps when it needs one (AGL-2634). One equality on

package/src/lib/server/org-caller.js

@@ -157,6 +157,16 @@ export function readCrmRouteScope(body) {
         org
     };
 }
+/**
+ * The organization a create names when it comes with no site, in the shape
+ * `getOrgForHost` answers for one that does, or `null` when there is none.
+ */ export async function readOrgForCreate(orgId) {
+    const org = await getOrgDoc(orgId).catch(()=>null);
+    return org ? {
+        orgId,
+        org
+    } : null;
+}
 /**
  * Every site of the organization, by document id — the host set an
  * org-level act sweeps when it needs one (AGL-2634). One equality on

package/src/lib/server/org-caller.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/org-caller.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * WHO IS CALLING AT THE ORGANIZATION LEVEL (AGL-2634).\n *\n * The CRM's host-routed actions — a stage move, a merge, an erasure, an\n * email — were written for the site hub: each resolves the org FROM the\n * site, checks the caller's role ON that site, and logs into that site's\n * feed. The organization-level hub (AGL-2630) mounts the same surfaces with\n * no site, and for a while every one of those actions ran \"as the record's\n * own capturing site\", which left a record nobody's site had captured with\n * nothing to run as. The org variant of each route authorizes HERE instead:\n * by the org the body names, for an org-wide member, with the permission\n * the whole CRM is gated on — the same three facts the org hub's own page\n * gate checks (`resolveOrgCrmAccess`), so what the console offers and what\n * the server admits cannot drift.\n *\n * A ROLE IS NOT A REACH. A site collaborator is a real member document\n * carrying `role: 'editor'`, and that role holds `data.manage` — so a gate\n * that read the permission alone would admit a contractor on one microsite\n * to act over every site in the agency. `orgWide` is checked first and\n * separately, and no permission grant restores it; this is the boundary the\n * host variants get for free from the site role, spelled out for the variant\n * that has no site.\n */\n\nimport { type AglynOrganization, canManageOrg, type PluginApiRequest } from '@aglyn/aglyn/server'\nimport {\n  firebaseAdmin,\n  getOrgDoc,\n  memberHasOrgPermission,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\n\n/**\n * Which level a CRM route runs at, read off its body once.\n *\n * `orgId` present is the ORGANIZATION variant, whatever else the body\n * carries: the org-level console always names its org, and a `hostId`\n * beside it is the record's own site or the site an email leaves from —\n * never what the caller is authorized against. `hostId` alone is the site\n * variant every route has always had.\n */\nexport interface CrmRouteScope {\n  level: 'site' | 'org'\n  hostId: string\n  orgId: string\n}\n\nexport function readCrmRouteScope(\n  body: Record<string, unknown> | null | undefined,\n): CrmRouteScope | null {\n  const hostId = String(body?.['hostId'] ?? '')\n    .trim()\n    .slice(0, 128)\n  const orgId = String(body?.['orgId'] ?? '')\n    .trim()\n    .slice(0, 128)\n  if (orgId) return { level: 'org', hostId, orgId }\n  if (hostId) return { level: 'site', hostId, orgId: '' }\n  return null\n}\n\n/**\n * Whether `uid` holds `data.manage` in `orgId`, as the permission catalog\n * resolves it: the member's role, a custom role and per-member overrides\n * (AGL-2843).\n *\n * Asked of `memberHasOrgPermission`, never of the `permissions` map\n * `resolveOrgPermissions` returns. That map is the legacy six keys plus the\n * keys plugins register (`ResolvedOrgPermissionSet`), and `data.manage` is a\n * catalog key, so it is never in it: a gate that read it there would refuse\n * everyone but staff. A lookup that fails answers `false`.\n */\nexport async function holdsDataManage(\n  orgId: string | null | undefined,\n  uid: string,\n): Promise<boolean> {\n  if (!orgId) return false\n  try {\n    const membership = await resolveOrgMembership(uid, orgId)\n    const member = membership?.member ?? null\n    if (!member) return false\n    return (await memberHasOrgPermission(orgId, member, 'data.manage')) === true\n  } catch {\n    return false\n  }\n}\n\nexport interface OrgCaller {\n  ok: true\n  uid: string\n  /** The token's address, or null for an account with none. */\n  email: string | null\n  /** The token's display name, `''` when it carries none. */\n  name: string\n  staff: boolean\n  orgId: string\n  org: Partial<AglynOrganization>\n}\n\nexport interface OrgCallerRefusal {\n  ok: false\n  status: number\n  error: string\n}\n\n/** What the caller must hold over the whole organization. */\nexport type OrgCallerRequirement =\n  /** `data.manage`, org-wide — the key the CRM is gated on. Staff pass. */\n  | 'data.manage'\n  /** A workspace owner or admin, org-wide. Staff acting alone do NOT pass. */\n  | 'manage-org'\n  /**\n   * \"Privacy requests\" (`org.privacy`, AGL-4047), org-wide — who may file a\n   * person's erasure. On for owners and admins by default. Staff acting\n   * alone do NOT pass.\n   */\n  | 'org.privacy'\n\n/**\n * Whether `uid` holds a catalog key in `orgId` as the catalog resolves it —\n * their role, a custom role and per-member overrides — asked of\n * `memberHasOrgPermission`. A lookup that fails answers `false`.\n */\nexport async function holdsOrgPermission(\n  orgId: string | null | undefined,\n  uid: string,\n  permission: 'org.privacy',\n): Promise<boolean> {\n  if (!orgId) return false\n  try {\n    const membership = await resolveOrgMembership(uid, orgId)\n    const member = membership?.member ?? null\n    if (!member) return false\n    return (await memberHasOrgPermission(orgId, member, permission)) === true\n  } catch {\n    return false\n  }\n}\n\n/**\n * A verified session, org-wide reach in `orgId`, and the requirement — in\n * that order, the cheapest refusal first — then the org document, which\n * every org variant needs for the plan and the consent groups.\n *\n * Staff are admitted to the `data.manage` requirement as every CRM route\n * admits them, and refused the `manage-org` and `org.privacy` ones as the\n * erasure route refuses them: the workspace is the controller of its\n * people's data and the instruction to erase has to come from it.\n */\nexport async function authorizeOrgCaller(\n  req: PluginApiRequest,\n  orgId: string,\n  options: { needs: OrgCallerRequirement; refusal: string },\n): Promise<OrgCaller | OrgCallerRefusal> {\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return { ok: false, status: 401, error: 'Unauthenticated' }\n  let decoded: { uid: string; email?: string; name?: string; staff?: unknown }\n  try {\n    decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n  } catch (error) {\n    // A refused credential is the caller's 401. A failure to check one is\n    // ours and keeps a 5xx, so an outage pages instead of reading as a bad\n    // token (AGL-2852).\n    if (isRefusedIdToken(error)) return { ok: false, status: 401, error: 'Unauthenticated' }\n    console.error('[crm] the organization caller could not be verified', error)\n    return { ok: false, status: 500, error: 'The sign-in could not be checked. Try again.' }\n  }\n  const staff = decoded.staff === true\n  const membership = await resolveOrgPermissions(decoded.uid, { orgId }).catch(\n    () => null,\n  )\n  const orgWide = Boolean(membership?.orgWide) && membership?.orgId === orgId\n  const admitted =\n    options.needs === 'data.manage'\n      ? staff || (orgWide && (await holdsDataManage(orgId, decoded.uid)))\n      : options.needs === 'org.privacy'\n        ? orgWide && (await holdsOrgPermission(orgId, decoded.uid, 'org.privacy'))\n        : orgWide && canManageOrg(membership?.role ?? null)\n  if (!admitted) return { ok: false, status: 403, error: options.refusal }\n  const org = await getOrgDoc(orgId).catch(() => null)\n  if (!org) return { ok: false, status: 404, error: 'Unknown organization' }\n  return {\n    ok: true,\n    uid: decoded.uid,\n    email: decoded.email ?? null,\n    name: String(decoded.name ?? '')\n      .trim()\n      .slice(0, 120),\n    staff,\n    orgId,\n    org,\n  }\n}\n\n/**\n * Every site of the organization, by document id — the host set an\n * org-level act sweeps when it needs one (AGL-2634). One equality on\n * `hosts.orgId`, the query the erasure route already ran, which needs no\n * composite index.\n */\nexport async function orgHostIds(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n): Promise<string[]> {\n  const hosts = await firestore.collection('hosts').where('orgId', '==', orgId).get()\n  return hosts.docs.map((doc: { id: string }) => String(doc.id))\n}\n"],"names":["canManageOrg","firebaseAdmin","getOrgDoc","memberHasOrgPermission","resolveOrgMembership","isRefusedIdToken","resolveOrgPermissions","readCrmRouteScope","body","hostId","String","trim","slice","orgId","level","holdsDataManage","uid","membership","member","holdsOrgPermission","permission","authorizeOrgCaller","req","options","decoded","authorization","headers","idToken","startsWith","length","undefined","ok","status","error","app","auth","verifyIdToken","console","staff","catch","orgWide","Boolean","admitted","needs","role","refusal","org","email","name","orgHostIds","firestore","hosts","collection","where","get","docs","map","doc","id"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;CAsBC,GAED,SAAiCA,YAAY,QAA+B,sBAAqB;AACjG,SACEC,aAAa,EACbC,SAAS,EACTC,sBAAsB,EACtBC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,gBAAgB,QAAQ,mDAAkD;AACnF,SAASC,qBAAqB,QAAQ,wCAAuC;AAiB7E,OAAO,SAASC,kBACdC,IAAgD;;IAEhD,MAAMC,SAASC,eAAOF,wBAAAA,IAAM,CAAC,SAAS,mBAAI,IACvCG,IAAI,GACJC,KAAK,CAAC,GAAG;IACZ,MAAMC,QAAQH,gBAAOF,wBAAAA,IAAM,CAAC,QAAQ,oBAAI,IACrCG,IAAI,GACJC,KAAK,CAAC,GAAG;IACZ,IAAIC,OAAO,OAAO;QAAEC,OAAO;QAAOL;QAAQI;IAAM;IAChD,IAAIJ,QAAQ,OAAO;QAAEK,OAAO;QAAQL;QAAQI,OAAO;IAAG;IACtD,OAAO;AACT;AAEA;;;;;;;;;;CAUC,GACD,OAAO,eAAeE,gBACpBF,KAAgC,EAChCG,GAAW;IAEX,IAAI,CAACH,OAAO,OAAO;IACnB,IAAI;;QACF,MAAMI,aAAa,MAAMb,qBAAqBY,KAAKH;QACnD,MAAMK,iBAASD,8BAAAA,WAAYC,MAAM,mBAAI;QACrC,IAAI,CAACA,QAAQ,OAAO;QACpB,OAAO,AAAC,MAAMf,uBAAuBU,OAAOK,QAAQ,mBAAoB;IAC1E,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAiCA;;;;CAIC,GACD,OAAO,eAAeC,mBACpBN,KAAgC,EAChCG,GAAW,EACXI,UAAyB;IAEzB,IAAI,CAACP,OAAO,OAAO;IACnB,IAAI;;QACF,MAAMI,aAAa,MAAMb,qBAAqBY,KAAKH;QACnD,MAAMK,iBAASD,8BAAAA,WAAYC,MAAM,mBAAI;QACrC,IAAI,CAACA,QAAQ,OAAO;QACpB,OAAO,AAAC,MAAMf,uBAAuBU,OAAOK,QAAQE,gBAAiB;IACvE,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAeC,mBACpBC,GAAqB,EACrBT,KAAa,EACbU,OAAyD;QAE5BD,kCAiCpBE,gBACMA;IAlCf,MAAMC,gBAAgBf,QAAOY,6BAAAA,IAAII,OAAO,CAACD,aAAa,YAAzBH,6BAA6B;IAC1D,MAAMK,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcb,KAAK,CAAC,UAAUiB,MAAM,IACpCC;IACJ,IAAI,CAACH,SAAS,OAAO;QAAEI,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAkB;IACxE,IAAIT;IACJ,IAAI;QACFA,UAAU,MAAMvB,cAAciC,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACT;IAC3D,EAAE,OAAOM,OAAO;QACd,sEAAsE;QACtE,uEAAuE;QACvE,oBAAoB;QACpB,IAAI5B,iBAAiB4B,QAAQ,OAAO;YAAEF,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAkB;QACvFI,QAAQJ,KAAK,CAAC,uDAAuDA;QACrE,OAAO;YAAEF,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAA+C;IACzF;IACA,MAAMK,QAAQd,QAAQc,KAAK,KAAK;IAChC,MAAMrB,aAAa,MAAMX,sBAAsBkB,QAAQR,GAAG,EAAE;QAAEH;IAAM,GAAG0B,KAAK,CAC1E,IAAM;IAER,MAAMC,UAAUC,QAAQxB,8BAAAA,WAAYuB,OAAO,KAAKvB,CAAAA,8BAAAA,WAAYJ,KAAK,MAAKA;IACtE,MAAM6B,WACJnB,QAAQoB,KAAK,KAAK,gBACdL,SAAUE,WAAY,MAAMzB,gBAAgBF,OAAOW,QAAQR,GAAG,IAC9DO,QAAQoB,KAAK,KAAK,gBAChBH,WAAY,MAAMrB,mBAAmBN,OAAOW,QAAQR,GAAG,EAAE,iBACzDwB,WAAWxC,qBAAaiB,8BAAAA,WAAY2B,IAAI,mBAAI;IACpD,IAAI,CAACF,UAAU,OAAO;QAAEX,IAAI;QAAOC,QAAQ;QAAKC,OAAOV,QAAQsB,OAAO;IAAC;IACvE,MAAMC,MAAM,MAAM5C,UAAUW,OAAO0B,KAAK,CAAC,IAAM;IAC/C,IAAI,CAACO,KAAK,OAAO;QAAEf,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAuB;IACzE,OAAO;QACLF,IAAI;QACJf,KAAKQ,QAAQR,GAAG;QAChB+B,KAAK,GAAEvB,iBAAAA,QAAQuB,KAAK,YAAbvB,iBAAiB;QACxBwB,MAAMtC,QAAOc,gBAAAA,QAAQwB,IAAI,YAAZxB,gBAAgB,IAC1Bb,IAAI,GACJC,KAAK,CAAC,GAAG;QACZ0B;QACAzB;QACAiC;IACF;AACF;AAEA;;;;;CAKC,GACD,OAAO,eAAeG,WACpBC,SAAsC,EACtCrC,KAAa;IAEb,MAAMsC,QAAQ,MAAMD,UAAUE,UAAU,CAAC,SAASC,KAAK,CAAC,SAAS,MAAMxC,OAAOyC,GAAG;IACjF,OAAOH,MAAMI,IAAI,CAACC,GAAG,CAAC,CAACC,MAAwB/C,OAAO+C,IAAIC,EAAE;AAC9D"}
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/org-caller.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * WHO IS CALLING AT THE ORGANIZATION LEVEL (AGL-2634).\n *\n * The CRM's host-routed actions — a stage move, a merge, an erasure, an\n * email — were written for the site hub: each resolves the org FROM the\n * site, checks the caller's role ON that site, and logs into that site's\n * feed. The organization-level hub (AGL-2630) mounts the same surfaces with\n * no site, and for a while every one of those actions ran \"as the record's\n * own capturing site\", which left a record nobody's site had captured with\n * nothing to run as. The org variant of each route authorizes HERE instead:\n * by the org the body names, for an org-wide member, with the permission\n * the whole CRM is gated on — the same three facts the org hub's own page\n * gate checks (`resolveOrgCrmAccess`), so what the console offers and what\n * the server admits cannot drift.\n *\n * A ROLE IS NOT A REACH. A site collaborator is a real member document\n * carrying `role: 'editor'`, and that role holds `data.manage` — so a gate\n * that read the permission alone would admit a contractor on one microsite\n * to act over every site in the agency. `orgWide` is checked first and\n * separately, and no permission grant restores it; this is the boundary the\n * host variants get for free from the site role, spelled out for the variant\n * that has no site.\n */\n\nimport { type AglynOrganization, canManageOrg, type PluginApiRequest } from '@aglyn/aglyn/server'\nimport {\n  firebaseAdmin,\n  getOrgDoc,\n  memberHasOrgPermission,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\n\n/**\n * Which level a CRM route runs at, read off its body once.\n *\n * `orgId` present is the ORGANIZATION variant, whatever else the body\n * carries: the org-level console always names its org, and a `hostId`\n * beside it is the record's own site or the site an email leaves from —\n * never what the caller is authorized against. `hostId` alone is the site\n * variant every route has always had.\n */\nexport interface CrmRouteScope {\n  level: 'site' | 'org'\n  hostId: string\n  orgId: string\n}\n\nexport function readCrmRouteScope(\n  body: Record<string, unknown> | null | undefined,\n): CrmRouteScope | null {\n  const hostId = String(body?.['hostId'] ?? '')\n    .trim()\n    .slice(0, 128)\n  const orgId = String(body?.['orgId'] ?? '')\n    .trim()\n    .slice(0, 128)\n  if (orgId) return { level: 'org', hostId, orgId }\n  if (hostId) return { level: 'site', hostId, orgId: '' }\n  return null\n}\n\n/**\n * Whether `uid` holds `data.manage` in `orgId`, as the permission catalog\n * resolves it: the member's role, a custom role and per-member overrides\n * (AGL-2843).\n *\n * Asked of `memberHasOrgPermission`, never of the `permissions` map\n * `resolveOrgPermissions` returns. That map is the legacy six keys plus the\n * keys plugins register (`ResolvedOrgPermissionSet`), and `data.manage` is a\n * catalog key, so it is never in it: a gate that read it there would refuse\n * everyone but staff. A lookup that fails answers `false`.\n */\nexport async function holdsDataManage(\n  orgId: string | null | undefined,\n  uid: string,\n): Promise<boolean> {\n  if (!orgId) return false\n  try {\n    const membership = await resolveOrgMembership(uid, orgId)\n    const member = membership?.member ?? null\n    if (!member) return false\n    return (await memberHasOrgPermission(orgId, member, 'data.manage')) === true\n  } catch {\n    return false\n  }\n}\n\nexport interface OrgCaller {\n  ok: true\n  uid: string\n  /** The token's address, or null for an account with none. */\n  email: string | null\n  /** The token's display name, `''` when it carries none. */\n  name: string\n  staff: boolean\n  orgId: string\n  org: Partial<AglynOrganization>\n}\n\nexport interface OrgCallerRefusal {\n  ok: false\n  status: number\n  error: string\n}\n\n/** What the caller must hold over the whole organization. */\nexport type OrgCallerRequirement =\n  /** `data.manage`, org-wide — the key the CRM is gated on. Staff pass. */\n  | 'data.manage'\n  /** A workspace owner or admin, org-wide. Staff acting alone do NOT pass. */\n  | 'manage-org'\n  /**\n   * \"Privacy requests\" (`org.privacy`, AGL-4047), org-wide — who may file a\n   * person's erasure. On for owners and admins by default. Staff acting\n   * alone do NOT pass.\n   */\n  | 'org.privacy'\n\n/**\n * Whether `uid` holds a catalog key in `orgId` as the catalog resolves it —\n * their role, a custom role and per-member overrides — asked of\n * `memberHasOrgPermission`. A lookup that fails answers `false`.\n */\nexport async function holdsOrgPermission(\n  orgId: string | null | undefined,\n  uid: string,\n  permission: 'org.privacy',\n): Promise<boolean> {\n  if (!orgId) return false\n  try {\n    const membership = await resolveOrgMembership(uid, orgId)\n    const member = membership?.member ?? null\n    if (!member) return false\n    return (await memberHasOrgPermission(orgId, member, permission)) === true\n  } catch {\n    return false\n  }\n}\n\n/**\n * A verified session, org-wide reach in `orgId`, and the requirement — in\n * that order, the cheapest refusal first — then the org document, which\n * every org variant needs for the plan and the consent groups.\n *\n * Staff are admitted to the `data.manage` requirement as every CRM route\n * admits them, and refused the `manage-org` and `org.privacy` ones as the\n * erasure route refuses them: the workspace is the controller of its\n * people's data and the instruction to erase has to come from it.\n */\nexport async function authorizeOrgCaller(\n  req: PluginApiRequest,\n  orgId: string,\n  options: { needs: OrgCallerRequirement; refusal: string },\n): Promise<OrgCaller | OrgCallerRefusal> {\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return { ok: false, status: 401, error: 'Unauthenticated' }\n  let decoded: { uid: string; email?: string; name?: string; staff?: unknown }\n  try {\n    decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n  } catch (error) {\n    // A refused credential is the caller's 401. A failure to check one is\n    // ours and keeps a 5xx, so an outage pages instead of reading as a bad\n    // token (AGL-2852).\n    if (isRefusedIdToken(error)) return { ok: false, status: 401, error: 'Unauthenticated' }\n    console.error('[crm] the organization caller could not be verified', error)\n    return { ok: false, status: 500, error: 'The sign-in could not be checked. Try again.' }\n  }\n  const staff = decoded.staff === true\n  const membership = await resolveOrgPermissions(decoded.uid, { orgId }).catch(\n    () => null,\n  )\n  const orgWide = Boolean(membership?.orgWide) && membership?.orgId === orgId\n  const admitted =\n    options.needs === 'data.manage'\n      ? staff || (orgWide && (await holdsDataManage(orgId, decoded.uid)))\n      : options.needs === 'org.privacy'\n        ? orgWide && (await holdsOrgPermission(orgId, decoded.uid, 'org.privacy'))\n        : orgWide && canManageOrg(membership?.role ?? null)\n  if (!admitted) return { ok: false, status: 403, error: options.refusal }\n  const org = await getOrgDoc(orgId).catch(() => null)\n  if (!org) return { ok: false, status: 404, error: 'Unknown organization' }\n  return {\n    ok: true,\n    uid: decoded.uid,\n    email: decoded.email ?? null,\n    name: String(decoded.name ?? '')\n      .trim()\n      .slice(0, 120),\n    staff,\n    orgId,\n    org,\n  }\n}\n\n/**\n * The organization a create names when it comes with no site, in the shape\n * `getOrgForHost` answers for one that does, or `null` when there is none.\n */\nexport async function readOrgForCreate(\n  orgId: string,\n): Promise<{ orgId: string; org: Partial<AglynOrganization> } | null> {\n  const org = await getOrgDoc(orgId).catch(() => null)\n  return org ? { orgId, org } : null\n}\n\n/**\n * Every site of the organization, by document id — the host set an\n * org-level act sweeps when it needs one (AGL-2634). One equality on\n * `hosts.orgId`, the query the erasure route already ran, which needs no\n * composite index.\n */\nexport async function orgHostIds(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n): Promise<string[]> {\n  const hosts = await firestore.collection('hosts').where('orgId', '==', orgId).get()\n  return hosts.docs.map((doc: { id: string }) => String(doc.id))\n}\n"],"names":["canManageOrg","firebaseAdmin","getOrgDoc","memberHasOrgPermission","resolveOrgMembership","isRefusedIdToken","resolveOrgPermissions","readCrmRouteScope","body","hostId","String","trim","slice","orgId","level","holdsDataManage","uid","membership","member","holdsOrgPermission","permission","authorizeOrgCaller","req","options","decoded","authorization","headers","idToken","startsWith","length","undefined","ok","status","error","app","auth","verifyIdToken","console","staff","catch","orgWide","Boolean","admitted","needs","role","refusal","org","email","name","readOrgForCreate","orgHostIds","firestore","hosts","collection","where","get","docs","map","doc","id"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;CAsBC,GAED,SAAiCA,YAAY,QAA+B,sBAAqB;AACjG,SACEC,aAAa,EACbC,SAAS,EACTC,sBAAsB,EACtBC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,gBAAgB,QAAQ,mDAAkD;AACnF,SAASC,qBAAqB,QAAQ,wCAAuC;AAiB7E,OAAO,SAASC,kBACdC,IAAgD;;IAEhD,MAAMC,SAASC,eAAOF,wBAAAA,IAAM,CAAC,SAAS,mBAAI,IACvCG,IAAI,GACJC,KAAK,CAAC,GAAG;IACZ,MAAMC,QAAQH,gBAAOF,wBAAAA,IAAM,CAAC,QAAQ,oBAAI,IACrCG,IAAI,GACJC,KAAK,CAAC,GAAG;IACZ,IAAIC,OAAO,OAAO;QAAEC,OAAO;QAAOL;QAAQI;IAAM;IAChD,IAAIJ,QAAQ,OAAO;QAAEK,OAAO;QAAQL;QAAQI,OAAO;IAAG;IACtD,OAAO;AACT;AAEA;;;;;;;;;;CAUC,GACD,OAAO,eAAeE,gBACpBF,KAAgC,EAChCG,GAAW;IAEX,IAAI,CAACH,OAAO,OAAO;IACnB,IAAI;;QACF,MAAMI,aAAa,MAAMb,qBAAqBY,KAAKH;QACnD,MAAMK,iBAASD,8BAAAA,WAAYC,MAAM,mBAAI;QACrC,IAAI,CAACA,QAAQ,OAAO;QACpB,OAAO,AAAC,MAAMf,uBAAuBU,OAAOK,QAAQ,mBAAoB;IAC1E,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAiCA;;;;CAIC,GACD,OAAO,eAAeC,mBACpBN,KAAgC,EAChCG,GAAW,EACXI,UAAyB;IAEzB,IAAI,CAACP,OAAO,OAAO;IACnB,IAAI;;QACF,MAAMI,aAAa,MAAMb,qBAAqBY,KAAKH;QACnD,MAAMK,iBAASD,8BAAAA,WAAYC,MAAM,mBAAI;QACrC,IAAI,CAACA,QAAQ,OAAO;QACpB,OAAO,AAAC,MAAMf,uBAAuBU,OAAOK,QAAQE,gBAAiB;IACvE,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAeC,mBACpBC,GAAqB,EACrBT,KAAa,EACbU,OAAyD;QAE5BD,kCAiCpBE,gBACMA;IAlCf,MAAMC,gBAAgBf,QAAOY,6BAAAA,IAAII,OAAO,CAACD,aAAa,YAAzBH,6BAA6B;IAC1D,MAAMK,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcb,KAAK,CAAC,UAAUiB,MAAM,IACpCC;IACJ,IAAI,CAACH,SAAS,OAAO;QAAEI,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAkB;IACxE,IAAIT;IACJ,IAAI;QACFA,UAAU,MAAMvB,cAAciC,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACT;IAC3D,EAAE,OAAOM,OAAO;QACd,sEAAsE;QACtE,uEAAuE;QACvE,oBAAoB;QACpB,IAAI5B,iBAAiB4B,QAAQ,OAAO;YAAEF,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAkB;QACvFI,QAAQJ,KAAK,CAAC,uDAAuDA;QACrE,OAAO;YAAEF,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAA+C;IACzF;IACA,MAAMK,QAAQd,QAAQc,KAAK,KAAK;IAChC,MAAMrB,aAAa,MAAMX,sBAAsBkB,QAAQR,GAAG,EAAE;QAAEH;IAAM,GAAG0B,KAAK,CAC1E,IAAM;IAER,MAAMC,UAAUC,QAAQxB,8BAAAA,WAAYuB,OAAO,KAAKvB,CAAAA,8BAAAA,WAAYJ,KAAK,MAAKA;IACtE,MAAM6B,WACJnB,QAAQoB,KAAK,KAAK,gBACdL,SAAUE,WAAY,MAAMzB,gBAAgBF,OAAOW,QAAQR,GAAG,IAC9DO,QAAQoB,KAAK,KAAK,gBAChBH,WAAY,MAAMrB,mBAAmBN,OAAOW,QAAQR,GAAG,EAAE,iBACzDwB,WAAWxC,qBAAaiB,8BAAAA,WAAY2B,IAAI,mBAAI;IACpD,IAAI,CAACF,UAAU,OAAO;QAAEX,IAAI;QAAOC,QAAQ;QAAKC,OAAOV,QAAQsB,OAAO;IAAC;IACvE,MAAMC,MAAM,MAAM5C,UAAUW,OAAO0B,KAAK,CAAC,IAAM;IAC/C,IAAI,CAACO,KAAK,OAAO;QAAEf,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAuB;IACzE,OAAO;QACLF,IAAI;QACJf,KAAKQ,QAAQR,GAAG;QAChB+B,KAAK,GAAEvB,iBAAAA,QAAQuB,KAAK,YAAbvB,iBAAiB;QACxBwB,MAAMtC,QAAOc,gBAAAA,QAAQwB,IAAI,YAAZxB,gBAAgB,IAC1Bb,IAAI,GACJC,KAAK,CAAC,GAAG;QACZ0B;QACAzB;QACAiC;IACF;AACF;AAEA;;;CAGC,GACD,OAAO,eAAeG,iBACpBpC,KAAa;IAEb,MAAMiC,MAAM,MAAM5C,UAAUW,OAAO0B,KAAK,CAAC,IAAM;IAC/C,OAAOO,MAAM;QAAEjC;QAAOiC;IAAI,IAAI;AAChC;AAEA;;;;;CAKC,GACD,OAAO,eAAeI,WACpBC,SAAsC,EACtCtC,KAAa;IAEb,MAAMuC,QAAQ,MAAMD,UAAUE,UAAU,CAAC,SAASC,KAAK,CAAC,SAAS,MAAMzC,OAAO0C,GAAG;IACjF,OAAOH,MAAMI,IAAI,CAACC,GAAG,CAAC,CAACC,MAAwBhD,OAAOgD,IAAIC,EAAE;AAC9D"}

package/src/lib/server/record-timeline.d.ts

@@ -37,7 +37,9 @@ import { type PluginRecordTimelineWriter } from '@aglyn/aglyn/plugin-manager/plu
  *  6. a bounce or a complaint on a filed email (AGL-3245) advances that
  *     email's own delivery state — the row the send was filed under, found
  *     by its `Message-ID` — exactly as the campaign webhook advances one,
- *     so the timeline reads Sent, then Bounced, with what the server said.
+ *     so the timeline reads Sent, then Bounced, with what the server said;
+ *  7. an activity rolls up to its deal's company, else its contact's
+ *     (AGL-4123), as every writer's does.
  *
  * Each entry names the plugin that filed it (`sourcePluginId`), and a task's
  * `nextTaskAtMs` is recomputed on the records it names, as every server

package/src/lib/server/record-timeline.js

@@ -26,6 +26,7 @@ import { readCrmTaskPicklists } from "./read-picklist.js";
 import { CRM_SUITE_FEATURE } from "./suite-gate.js";
 import { crmTaskReminderAfterEdit } from "../model/crm-task-reminders.js";
 import { recomputeCrmNextTaskAt } from "./crm-next-activity.js";
+import { crmActivityLinkWithCompany } from "./crm-activity-company.js";
 import { createCrmEmailActivity, crmActivityRef, crmCapturedEmailActivityRef, crmEmailDeliveryStateForEvent, recordCrmEmailDelivery } from "./crm-email-activity.js";
 /** gRPC `ALREADY_EXISTS`, which `create()` rejects with when the document is there. */ const ALREADY_EXISTS = 6;
 /** The longest task title the CRM keeps, as its own forms do. */ const TASK_TITLE_MAX = 200;
@@ -181,7 +182,8 @@ export function createCrmRecordTimelineWriter(deps) {
             firestore,
             orgRef,
             link,
-            visibleTo: crmScopeTokens(org, group)
+            visibleTo: crmScopeTokens(org, group),
+            groupId: group.groupId
         }, holderUid ? {
             holderUid
         } : {});
@@ -203,7 +205,7 @@ export function createCrmRecordTimelineWriter(deps) {
             if (!isCrmActivityKind(request.kind)) return refuse(400, `"${String(request.kind)}" isn't an activity.`);
             const admitted = await admit(request);
             if ('ok' in admitted) return admitted;
-            const { firestore, orgRef, link, visibleTo } = admitted;
+            const { firestore, orgRef, link, visibleTo, groupId } = admitted;
             const orgId = orgRef.id;
             let ref;
             let activity;
@@ -255,7 +257,13 @@ export function createCrmRecordTimelineWriter(deps) {
             if (!crmActivityLogHasRoom(await countCrmActivitiesForRecord(orgRef, link))) {
                 return refuse(409, CRM_ACTIVITY_LOG_FULL_MESSAGE);
             }
-            const stamped = _extends({}, activity, {
+            // After the refusals, so an entry answered off one read costs no others.
+            const { companyId } = await crmActivityLinkWithCompany(orgRef, link, {
+                groupId
+            });
+            const stamped = _extends({}, activity, companyId ? {
+                companyId
+            } : {}, {
                 sourcePluginId: request.sourcePluginId
             });
             const created = request.kind === 'email' ? await createCrmEmailActivity(ref, stamped) === 'created' : await createOnce(ref, stamped);