@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/contact-suppression.js

@@ -0,0 +1,259 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The do-not-contact list, `contactSuppressions/{nationalKey}` (AGL-1592).
+ *
+ * WHY THIS EXISTS
+ *
+ * Privacy Policy v4 §11 tells users they may opt out of marketing calls and
+ * texts, and may ask us to delete the phone number we hold. Neither had a
+ * mechanism. This is the first half — the durable record that makes "never
+ * contact me again" survivable. The second half (`forgetUserPhoneNumber`)
+ * lives in `user-profiles.ts`, next to the seed it has to defeat.
+ *
+ * THE TENSION, AND HOW IT IS RESOLVED
+ *
+ * "Delete my phone number" and "stop contacting me" are DIFFERENT REQUESTS
+ * WITH OPPOSITE DATA OUTCOMES, and §11 currently offers both in one sentence.
+ * A suppression list that forgets the identifier cannot suppress anything: the
+ * only way to guarantee a number is never dialled is to keep the number and
+ * check it before dialling. Forgetting it does not protect the person — it
+ * removes the one artefact that could have protected them, and the next list
+ * imported from a customer's CRM re-adds them silently.
+ *
+ * So the two requests are implemented as two operations:
+ *
+ *   - "stop contacting me"  → `suppressPhoneContact`. The number is RETAINED,
+ *                             here and only here. Whatever copy the profile
+ *                             holds is left alone; they did not ask us to
+ *                             drop it.
+ *   - "delete my number"    → `forgetUserPhoneNumber` (user-profiles.ts).
+ *                             The profile copy is cleared, the account is
+ *                             marked so an IdP cannot re-assert it, AND a
+ *                             suppression record is written here with
+ *                             `erasePhoneOnFile: true`.
+ *
+ * That last clause is the whole point: a number we no longer hold anywhere is
+ * a number we cannot recognise, and therefore a number we will happily dial
+ * the day it arrives from somewhere else. Deletion WITHOUT suppression is the
+ * outcome that gets the person called. So the minimal retained record is not
+ * a hedge against the deletion request — it is the only way to honour what the
+ * person actually wanted.
+ *
+ * This carve-out is the standard one and is not optional: CCPA §1798.105(d)
+ * lets a business keep what it needs to honour an opt-out, and the TSR's
+ * entity-specific do-not-call duty is unmeetable without a retained list.
+ * §11's current wording does not say so, and should — see the wording proposal
+ * recorded on AGL-1592.
+ *
+ * WHY KEYED ON THE NUMBER AND NOT ON A `uid`
+ *
+ * The number is what gets dialled. At dial time an outbound programme holds a
+ * phone number and often nothing else, so the check has to be answerable from
+ * the number alone — one `get()` by document id, no query, no composite index
+ * that could go missing and fail the lookup open.
+ *
+ * It is also the only key that spans accounts. One human can reach us as a
+ * self-serve signup AND as an SSO account in their employer's GCIP tenant,
+ * with a different `uid` in each and a third if they are ever reprovisioned.
+ * A `uid`-keyed record would suppress one of those and leave the same person
+ * reachable on the same handset through the others.
+ *
+ * WHY THE RECORD IS NOT HASHED
+ *
+ * A phone number is a low-entropy identifier — NANP is ~10^10 values, which a
+ * laptop enumerates against SHA-256 in minutes. Hashing it would buy the
+ * appearance of de-identification and none of the substance, while making the
+ * record unauditable by the person who has to honour it. The collection is
+ * Admin-SDK-only in rules (`read, write: if false`), which is strictly less
+ * exposed than `users/{uid}.phoneNumber` already is — that one is readable by
+ * its owner.
+ *
+ * WHY A REVOCATION IS A FIELD AND NOT A DELETE
+ *
+ * Same reasoning as the clickwrap acceptances: the record exists to be
+ * evidence. Deleting it on opt-in destroys the proof that the opt-out was
+ * honoured for the period it was in force. `revokedAt` is set instead, and
+ * every read treats a revoked record as not suppressed.
+ */ import { normalizePhone } from "@aglyn/aglyn/server";
+import { FieldValue } from "firebase-admin/firestore";
+import firebaseAdmin from "./firebase-admin.js";
+const firestore = ()=>firebaseAdmin.app().firestore();
+export const CONTACT_SUPPRESSIONS_COLLECTION = 'contactSuppressions';
+/**
+ * The channels §11 names. Kept as an explicit list rather than a boolean
+ * because they are governed differently — a STOP text is a texting opt-out by
+ * statute, and reading it as a calling opt-out too would be us inventing a
+ * request the person did not make. Callers that mean both say both.
+ */ export const CONTACT_CHANNELS = [
+    'calls',
+    'texts'
+];
+/**
+ * Document id for an E.164 number: the digits, with the `+` dropped.
+ *
+ * The `+` is a legal Firestore id character, but it is also the one character
+ * that means "space" in a form-encoded query string, so a number carried
+ * through a URL somewhere down the line would silently become a different
+ * number. Dropping it here costs nothing — the full E.164 is stored in the
+ * document — and removes the whole class of bug in advance.
+ *
+ * @returns the id, or `null` when the input is not a number we can be sure of.
+ *          Never a best-guess id: suppressing the wrong subscriber and
+ *          believing you suppressed the right one is worse than refusing.
+ */ export function contactSuppressionKey(phoneNumber) {
+    const e164 = normalizePhone(phoneNumber);
+    return e164 ? e164.slice(1) : null;
+}
+/**
+ * Record a do-not-contact request. Idempotent by document id, so a retried
+ * request or a second STOP cannot produce a second record.
+ *
+ * Merging rather than replacing, and the channel list UNIONS with whatever is
+ * already recorded: someone who opted out of texts in March and calls in June
+ * is opted out of both in July. Narrowing a suppression is `releasePhoneContact`
+ * and nothing else — no write on this path may ever make a person MORE
+ * reachable than they already were.
+ *
+ * A previously revoked record is un-revoked, because a fresh request is a
+ * fresh request.
+ *
+ * @throws when the number cannot be normalized. Deliberately NOT best-effort:
+ *         a silently dropped opt-out is the exact failure this issue exists to
+ *         fix, so the caller has to see it.
+ */ export async function suppressPhoneContact(input) {
+    var _input_firestore, _ref, _input_uid, _input_recordedByUid, _input_note;
+    var _input_channels;
+    const e164 = normalizePhone(input.phoneNumber);
+    const key = e164 ? e164.slice(1) : null;
+    if (!e164 || !key) {
+        throw new Error(`[contact-suppression] cannot normalize phone number for suppression`);
+    }
+    const db = (_input_firestore = input.firestore) != null ? _input_firestore : firestore();
+    const ref = db.collection(CONTACT_SUPPRESSIONS_COLLECTION).doc(key);
+    const snapshot = await ref.get();
+    const requested = (((_input_channels = input.channels) == null ? void 0 : _input_channels.length) ? input.channels : CONTACT_CHANNELS).filter((channel)=>CONTACT_CHANNELS.includes(channel));
+    const existing = Array.isArray(snapshot.get('channels')) ? snapshot.get('channels') : [];
+    const channels = CONTACT_CHANNELS.filter((channel)=>requested.includes(channel) || existing.includes(channel));
+    await ref.set(_extends({
+        phoneNumber: e164,
+        channels,
+        source: input.source,
+        uid: (_ref = (_input_uid = input.uid) != null ? _input_uid : snapshot.get('uid')) != null ? _ref : null,
+        recordedByUid: (_input_recordedByUid = input.recordedByUid) != null ? _input_recordedByUid : null,
+        note: (_input_note = input.note) != null ? _input_note : null,
+        // Sticky: an erasure request recorded in March is still an erasure
+        // request after a plain "stop texting me" arrives in June. Only an
+        // explicit re-supply of the number clears it, and that happens on the
+        // profile, not here.
+        erasePhoneOnFile: input.erasePhoneOnFile === true || snapshot.get('erasePhoneOnFile') === true,
+        revokedAt: null,
+        updatedAt: FieldValue.serverTimestamp()
+    }, snapshot.exists ? {} : {
+        createdAt: FieldValue.serverTimestamp()
+    }), {
+        merge: true
+    });
+    return {
+        phoneNumber: e164,
+        channels,
+        created: !snapshot.exists
+    };
+}
+/**
+ * Opt back in (a START/UNSTOP reply, or a staff correction of a mis-recorded
+ * opt-out). The record is kept and marked revoked, never deleted.
+ *
+ * IMPORTANT — this does NOT create consent. Clearing a suppression only
+ * removes a prohibition; it does not manufacture the prior express written
+ * consent that TCPA requires before a marketing call or text may be placed at
+ * all. That mechanism does not exist yet (AGL-1564, and the privacy benchmark
+ * items 9–10), so after this call the correct number of marketing messages to
+ * send is still zero.
+ *
+ * @returns false when there was no record to revoke.
+ */ export async function releasePhoneContact(input) {
+    var _input_firestore, _input_releasedByUid, _input_note;
+    const key = contactSuppressionKey(input.phoneNumber);
+    if (!key) return false;
+    const db = (_input_firestore = input.firestore) != null ? _input_firestore : firestore();
+    const ref = db.collection(CONTACT_SUPPRESSIONS_COLLECTION).doc(key);
+    const snapshot = await ref.get();
+    if (!snapshot.exists || snapshot.get('revokedAt')) return false;
+    await ref.set({
+        revokedAt: FieldValue.serverTimestamp(),
+        revokedByUid: (_input_releasedByUid = input.releasedByUid) != null ? _input_releasedByUid : null,
+        revokedNote: (_input_note = input.note) != null ? _input_note : null
+    }, {
+        merge: true
+    });
+    return true;
+}
+/**
+ * The dial-time gate. Every outbound marketing call or text MUST pass through
+ * this before the number reaches a provider.
+ *
+ * FAILS CLOSED. A read that throws — rules, quota, a cold Firestore — answers
+ * `true`, meaning "treat as suppressed". The alternative is a list outage that
+ * silently turns into a round of calls to people who asked us never to call
+ * again, which is a statutory violation per call rather than a delayed
+ * campaign. Never "fix" a flaky read here by returning false.
+ */ export async function isPhoneContactSuppressed(phoneNumber, channel, injectedFirestore) {
+    const key = contactSuppressionKey(phoneNumber);
+    // An unrecognizable number is one we cannot check against the list, so it is
+    // one we must not dial. Same fail-closed rule.
+    if (!key) return true;
+    try {
+        const db = injectedFirestore != null ? injectedFirestore : firestore();
+        const snapshot = await db.collection(CONTACT_SUPPRESSIONS_COLLECTION).doc(key).get();
+        if (!snapshot.exists) return false;
+        if (snapshot.get('revokedAt')) return false;
+        if (!channel) return true;
+        const channels = snapshot.get('channels');
+        return Array.isArray(channels) ? channels.includes(channel) : true;
+    } catch (error) {
+        console.error('[contact-suppression] lookup failed; failing closed', error);
+        return true;
+    }
+}
+/**
+ * Read one record, for the staff surface and for `seedUserProfile`'s
+ * re-assertion guard.
+ */ export async function getContactSuppression(phoneNumber, injectedFirestore) {
+    const key = contactSuppressionKey(phoneNumber);
+    if (!key) return null;
+    const db = injectedFirestore != null ? injectedFirestore : firestore();
+    const snapshot = await db.collection(CONTACT_SUPPRESSIONS_COLLECTION).doc(key).get();
+    if (!snapshot.exists) return null;
+    return _extends({
+        $id: snapshot.id
+    }, snapshot.data());
+}
+/**
+ * The staff queue, newest first. Ordered by `updatedAt` so a re-recorded or
+ * revoked entry surfaces again — the operator's question is "what changed",
+ * not "what was first written".
+ */ export async function listContactSuppressions(options) {
+    var _ref, _ref1;
+    const db = (_ref = options == null ? void 0 : options.firestore) != null ? _ref : firestore();
+    const snapshot = await db.collection(CONTACT_SUPPRESSIONS_COLLECTION).orderBy('updatedAt', 'desc').limit(Math.min(Math.max((_ref1 = options == null ? void 0 : options.limit) != null ? _ref1 : 100, 1), 500)).get();
+    return snapshot.docs.map((doc)=>_extends({
+            $id: doc.id
+        }, doc.data()));
+}
+
+//# sourceMappingURL=contact-suppression.js.map

package/src/lib/server/contact-suppression.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/contact-suppression.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The do-not-contact list, `contactSuppressions/{nationalKey}` (AGL-1592).\n *\n * WHY THIS EXISTS\n *\n * Privacy Policy v4 §11 tells users they may opt out of marketing calls and\n * texts, and may ask us to delete the phone number we hold. Neither had a\n * mechanism. This is the first half — the durable record that makes \"never\n * contact me again\" survivable. The second half (`forgetUserPhoneNumber`)\n * lives in `user-profiles.ts`, next to the seed it has to defeat.\n *\n * THE TENSION, AND HOW IT IS RESOLVED\n *\n * \"Delete my phone number\" and \"stop contacting me\" are DIFFERENT REQUESTS\n * WITH OPPOSITE DATA OUTCOMES, and §11 currently offers both in one sentence.\n * A suppression list that forgets the identifier cannot suppress anything: the\n * only way to guarantee a number is never dialled is to keep the number and\n * check it before dialling. Forgetting it does not protect the person — it\n * removes the one artefact that could have protected them, and the next list\n * imported from a customer's CRM re-adds them silently.\n *\n * So the two requests are implemented as two operations:\n *\n *   - \"stop contacting me\"  → `suppressPhoneContact`. The number is RETAINED,\n *                             here and only here. Whatever copy the profile\n *                             holds is left alone; they did not ask us to\n *                             drop it.\n *   - \"delete my number\"    → `forgetUserPhoneNumber` (user-profiles.ts).\n *                             The profile copy is cleared, the account is\n *                             marked so an IdP cannot re-assert it, AND a\n *                             suppression record is written here with\n *                             `erasePhoneOnFile: true`.\n *\n * That last clause is the whole point: a number we no longer hold anywhere is\n * a number we cannot recognise, and therefore a number we will happily dial\n * the day it arrives from somewhere else. Deletion WITHOUT suppression is the\n * outcome that gets the person called. So the minimal retained record is not\n * a hedge against the deletion request — it is the only way to honour what the\n * person actually wanted.\n *\n * This carve-out is the standard one and is not optional: CCPA §1798.105(d)\n * lets a business keep what it needs to honour an opt-out, and the TSR's\n * entity-specific do-not-call duty is unmeetable without a retained list.\n * §11's current wording does not say so, and should — see the wording proposal\n * recorded on AGL-1592.\n *\n * WHY KEYED ON THE NUMBER AND NOT ON A `uid`\n *\n * The number is what gets dialled. At dial time an outbound programme holds a\n * phone number and often nothing else, so the check has to be answerable from\n * the number alone — one `get()` by document id, no query, no composite index\n * that could go missing and fail the lookup open.\n *\n * It is also the only key that spans accounts. One human can reach us as a\n * self-serve signup AND as an SSO account in their employer's GCIP tenant,\n * with a different `uid` in each and a third if they are ever reprovisioned.\n * A `uid`-keyed record would suppress one of those and leave the same person\n * reachable on the same handset through the others.\n *\n * WHY THE RECORD IS NOT HASHED\n *\n * A phone number is a low-entropy identifier — NANP is ~10^10 values, which a\n * laptop enumerates against SHA-256 in minutes. Hashing it would buy the\n * appearance of de-identification and none of the substance, while making the\n * record unauditable by the person who has to honour it. The collection is\n * Admin-SDK-only in rules (`read, write: if false`), which is strictly less\n * exposed than `users/{uid}.phoneNumber` already is — that one is readable by\n * its owner.\n *\n * WHY A REVOCATION IS A FIELD AND NOT A DELETE\n *\n * Same reasoning as the clickwrap acceptances: the record exists to be\n * evidence. Deleting it on opt-in destroys the proof that the opt-out was\n * honoured for the period it was in force. `revokedAt` is set instead, and\n * every read treats a revoked record as not suppressed.\n */\n\nimport { normalizePhone } from '@aglyn/aglyn/server'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport firebaseAdmin from './firebase-admin'\n\nconst firestore = () => firebaseAdmin.app().firestore()\n\nexport const CONTACT_SUPPRESSIONS_COLLECTION = 'contactSuppressions'\n\n/**\n * The channels §11 names. Kept as an explicit list rather than a boolean\n * because they are governed differently — a STOP text is a texting opt-out by\n * statute, and reading it as a calling opt-out too would be us inventing a\n * request the person did not make. Callers that mean both say both.\n */\nexport const CONTACT_CHANNELS = ['calls', 'texts'] as const\nexport type ContactChannel = (typeof CONTACT_CHANNELS)[number]\n\n/** Where the request came in. Every route §11 offers, plus staff-initiated. */\nexport type ContactSuppressionSource =\n  /** Reply STOP (or another CTIA keyword) to a marketing text. */\n  | 'sms-keyword'\n  /** Emailed privacy@aglyn.com and a human recorded it. */\n  | 'email'\n  /** Said so on a call and a human recorded it. */\n  | 'verbal'\n  /** The user asked us to delete the number they had on file. */\n  | 'erasure-request'\n  /** Recorded by staff for any other reason (a complaint, a bounce, a court). */\n  | 'staff'\n\nexport interface SuppressPhoneContactInput {\n  /** Anything `normalizePhone` accepts; stored as E.164. */\n  phoneNumber: string\n  /** Defaults to BOTH channels — the conservative reading of an ambiguous ask. */\n  channels?: ContactChannel[]\n  source: ContactSuppressionSource\n  /** The account the request was matched to, when it was matched to one. */\n  uid?: string | null\n  /** Staff member who took the email or the call. */\n  recordedByUid?: string | null\n  /** Free text: what they actually said, the ticket id, the case number. */\n  note?: string | null\n  /**\n   * True only when the person also asked us to stop holding the number.\n   * `seedUserProfile` reads this to refuse an IdP re-assertion, so it is the\n   * difference between \"do not call me\" and \"do not keep my number\".\n   */\n  erasePhoneOnFile?: boolean\n  /** Injectable for tests; defaults to the admin app's Firestore. */\n  firestore?: any\n}\n\nexport interface ContactSuppressionRecord {\n  phoneNumber: string\n  channels: ContactChannel[]\n  source: ContactSuppressionSource\n  uid: string | null\n  recordedByUid: string | null\n  note: string | null\n  erasePhoneOnFile: boolean\n  /** Non-null once the person opted back in. A revoked record does not suppress. */\n  revokedAt: unknown | null\n}\n\n/**\n * Document id for an E.164 number: the digits, with the `+` dropped.\n *\n * The `+` is a legal Firestore id character, but it is also the one character\n * that means \"space\" in a form-encoded query string, so a number carried\n * through a URL somewhere down the line would silently become a different\n * number. Dropping it here costs nothing — the full E.164 is stored in the\n * document — and removes the whole class of bug in advance.\n *\n * @returns the id, or `null` when the input is not a number we can be sure of.\n *          Never a best-guess id: suppressing the wrong subscriber and\n *          believing you suppressed the right one is worse than refusing.\n */\nexport function contactSuppressionKey(\n  phoneNumber: string | null | undefined,\n): string | null {\n  const e164 = normalizePhone(phoneNumber)\n  return e164 ? e164.slice(1) : null\n}\n\n/**\n * Record a do-not-contact request. Idempotent by document id, so a retried\n * request or a second STOP cannot produce a second record.\n *\n * Merging rather than replacing, and the channel list UNIONS with whatever is\n * already recorded: someone who opted out of texts in March and calls in June\n * is opted out of both in July. Narrowing a suppression is `releasePhoneContact`\n * and nothing else — no write on this path may ever make a person MORE\n * reachable than they already were.\n *\n * A previously revoked record is un-revoked, because a fresh request is a\n * fresh request.\n *\n * @throws when the number cannot be normalized. Deliberately NOT best-effort:\n *         a silently dropped opt-out is the exact failure this issue exists to\n *         fix, so the caller has to see it.\n */\nexport async function suppressPhoneContact(\n  input: SuppressPhoneContactInput,\n): Promise<{ phoneNumber: string; channels: ContactChannel[]; created: boolean }> {\n  const e164 = normalizePhone(input.phoneNumber)\n  const key = e164 ? e164.slice(1) : null\n  if (!e164 || !key) {\n    throw new Error(\n      `[contact-suppression] cannot normalize phone number for suppression`,\n    )\n  }\n  const db = input.firestore ?? firestore()\n  const ref = db.collection(CONTACT_SUPPRESSIONS_COLLECTION).doc(key)\n  const snapshot = await ref.get()\n\n  const requested = (input.channels?.length ? input.channels : CONTACT_CHANNELS)\n    .filter((channel): channel is ContactChannel =>\n      (CONTACT_CHANNELS as readonly string[]).includes(channel),\n    )\n  const existing: ContactChannel[] = Array.isArray(snapshot.get('channels'))\n    ? snapshot.get('channels')\n    : []\n  const channels = CONTACT_CHANNELS.filter(\n    (channel) => requested.includes(channel) || existing.includes(channel),\n  )\n\n  await ref.set(\n    {\n      phoneNumber: e164,\n      channels,\n      source: input.source,\n      uid: input.uid ?? snapshot.get('uid') ?? null,\n      recordedByUid: input.recordedByUid ?? null,\n      note: input.note ?? null,\n      // Sticky: an erasure request recorded in March is still an erasure\n      // request after a plain \"stop texting me\" arrives in June. Only an\n      // explicit re-supply of the number clears it, and that happens on the\n      // profile, not here.\n      erasePhoneOnFile:\n        input.erasePhoneOnFile === true || snapshot.get('erasePhoneOnFile') === true,\n      revokedAt: null,\n      updatedAt: FieldValue.serverTimestamp(),\n      ...(snapshot.exists ? {} : { createdAt: FieldValue.serverTimestamp() }),\n    },\n    { merge: true },\n  )\n  return { phoneNumber: e164, channels, created: !snapshot.exists }\n}\n\n/**\n * Opt back in (a START/UNSTOP reply, or a staff correction of a mis-recorded\n * opt-out). The record is kept and marked revoked, never deleted.\n *\n * IMPORTANT — this does NOT create consent. Clearing a suppression only\n * removes a prohibition; it does not manufacture the prior express written\n * consent that TCPA requires before a marketing call or text may be placed at\n * all. That mechanism does not exist yet (AGL-1564, and the privacy benchmark\n * items 9–10), so after this call the correct number of marketing messages to\n * send is still zero.\n *\n * @returns false when there was no record to revoke.\n */\nexport async function releasePhoneContact(input: {\n  phoneNumber: string\n  releasedByUid?: string | null\n  note?: string | null\n  firestore?: any\n}): Promise<boolean> {\n  const key = contactSuppressionKey(input.phoneNumber)\n  if (!key) return false\n  const db = input.firestore ?? firestore()\n  const ref = db.collection(CONTACT_SUPPRESSIONS_COLLECTION).doc(key)\n  const snapshot = await ref.get()\n  if (!snapshot.exists || snapshot.get('revokedAt')) return false\n  await ref.set(\n    {\n      revokedAt: FieldValue.serverTimestamp(),\n      revokedByUid: input.releasedByUid ?? null,\n      revokedNote: input.note ?? null,\n    },\n    { merge: true },\n  )\n  return true\n}\n\n/**\n * The dial-time gate. Every outbound marketing call or text MUST pass through\n * this before the number reaches a provider.\n *\n * FAILS CLOSED. A read that throws — rules, quota, a cold Firestore — answers\n * `true`, meaning \"treat as suppressed\". The alternative is a list outage that\n * silently turns into a round of calls to people who asked us never to call\n * again, which is a statutory violation per call rather than a delayed\n * campaign. Never \"fix\" a flaky read here by returning false.\n */\nexport async function isPhoneContactSuppressed(\n  phoneNumber: string | null | undefined,\n  channel?: ContactChannel,\n  injectedFirestore?: any,\n): Promise<boolean> {\n  const key = contactSuppressionKey(phoneNumber)\n  // An unrecognizable number is one we cannot check against the list, so it is\n  // one we must not dial. Same fail-closed rule.\n  if (!key) return true\n  try {\n    const db = injectedFirestore ?? firestore()\n    const snapshot = await db\n      .collection(CONTACT_SUPPRESSIONS_COLLECTION)\n      .doc(key)\n      .get()\n    if (!snapshot.exists) return false\n    if (snapshot.get('revokedAt')) return false\n    if (!channel) return true\n    const channels = snapshot.get('channels')\n    return Array.isArray(channels) ? channels.includes(channel) : true\n  } catch (error) {\n    console.error('[contact-suppression] lookup failed; failing closed', error)\n    return true\n  }\n}\n\n/**\n * Read one record, for the staff surface and for `seedUserProfile`'s\n * re-assertion guard.\n */\nexport async function getContactSuppression(\n  phoneNumber: string | null | undefined,\n  injectedFirestore?: any,\n): Promise<(ContactSuppressionRecord & { $id: string }) | null> {\n  const key = contactSuppressionKey(phoneNumber)\n  if (!key) return null\n  const db = injectedFirestore ?? firestore()\n  const snapshot = await db\n    .collection(CONTACT_SUPPRESSIONS_COLLECTION)\n    .doc(key)\n    .get()\n  if (!snapshot.exists) return null\n  return { $id: snapshot.id, ...(snapshot.data() as ContactSuppressionRecord) }\n}\n\n/**\n * The staff queue, newest first. Ordered by `updatedAt` so a re-recorded or\n * revoked entry surfaces again — the operator's question is \"what changed\",\n * not \"what was first written\".\n */\nexport async function listContactSuppressions(options?: {\n  limit?: number\n  firestore?: any\n}): Promise<Array<ContactSuppressionRecord & { $id: string }>> {\n  const db = options?.firestore ?? firestore()\n  const snapshot = await db\n    .collection(CONTACT_SUPPRESSIONS_COLLECTION)\n    .orderBy('updatedAt', 'desc')\n    .limit(Math.min(Math.max(options?.limit ?? 100, 1), 500))\n    .get()\n  return snapshot.docs.map((doc: any) => ({\n    $id: doc.id,\n    ...(doc.data() as ContactSuppressionRecord),\n  }))\n}\n"],"names":["normalizePhone","FieldValue","firebaseAdmin","firestore","app","CONTACT_SUPPRESSIONS_COLLECTION","CONTACT_CHANNELS","contactSuppressionKey","phoneNumber","e164","slice","suppressPhoneContact","input","key","Error","db","ref","collection","doc","snapshot","get","requested","channels","length","filter","channel","includes","existing","Array","isArray","set","source","uid","recordedByUid","note","erasePhoneOnFile","revokedAt","updatedAt","serverTimestamp","exists","createdAt","merge","created","releasePhoneContact","revokedByUid","releasedByUid","revokedNote","isPhoneContactSuppressed","injectedFirestore","error","console","getContactSuppression","$id","id","data","listContactSuppressions","options","orderBy","limit","Math","min","max","docs","map"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2EC,GAED,SAASA,cAAc,QAAQ,sBAAqB;AACpD,SAASC,UAAU,QAAQ,2BAA0B;AACrD,OAAOC,mBAAmB,sBAAkB;AAE5C,MAAMC,YAAY,IAAMD,cAAcE,GAAG,GAAGD,SAAS;AAErD,OAAO,MAAME,kCAAkC,sBAAqB;AAEpE;;;;;CAKC,GACD,OAAO,MAAMC,mBAAmB;IAAC;IAAS;CAAQ,CAAS;AAkD3D;;;;;;;;;;;;CAYC,GACD,OAAO,SAASC,sBACdC,WAAsC;IAEtC,MAAMC,OAAOT,eAAeQ;IAC5B,OAAOC,OAAOA,KAAKC,KAAK,CAAC,KAAK;AAChC;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,eAAeC,qBACpBC,KAAgC;QASrBA,kBAoBFA,MAAAA,YACUA,sBACTA;QAlBSA;IAXnB,MAAMH,OAAOT,eAAeY,MAAMJ,WAAW;IAC7C,MAAMK,MAAMJ,OAAOA,KAAKC,KAAK,CAAC,KAAK;IACnC,IAAI,CAACD,QAAQ,CAACI,KAAK;QACjB,MAAM,IAAIC,MACR,CAAC,mEAAmE,CAAC;IAEzE;IACA,MAAMC,MAAKH,mBAAAA,MAAMT,SAAS,YAAfS,mBAAmBT;IAC9B,MAAMa,MAAMD,GAAGE,UAAU,CAACZ,iCAAiCa,GAAG,CAACL;IAC/D,MAAMM,WAAW,MAAMH,IAAII,GAAG;IAE9B,MAAMC,YAAY,AAACT,CAAAA,EAAAA,kBAAAA,MAAMU,QAAQ,qBAAdV,gBAAgBW,MAAM,IAAGX,MAAMU,QAAQ,GAAGhB,gBAAe,EACzEkB,MAAM,CAAC,CAACC,UACP,AAACnB,iBAAuCoB,QAAQ,CAACD;IAErD,MAAME,WAA6BC,MAAMC,OAAO,CAACV,SAASC,GAAG,CAAC,eAC1DD,SAASC,GAAG,CAAC,cACb,EAAE;IACN,MAAME,WAAWhB,iBAAiBkB,MAAM,CACtC,CAACC,UAAYJ,UAAUK,QAAQ,CAACD,YAAYE,SAASD,QAAQ,CAACD;IAGhE,MAAMT,IAAIc,GAAG,CACX;QACEtB,aAAaC;QACba;QACAS,QAAQnB,MAAMmB,MAAM;QACpBC,GAAG,GAAEpB,QAAAA,aAAAA,MAAMoB,GAAG,YAATpB,aAAaO,SAASC,GAAG,CAAC,kBAA1BR,OAAoC;QACzCqB,aAAa,GAAErB,uBAAAA,MAAMqB,aAAa,YAAnBrB,uBAAuB;QACtCsB,IAAI,GAAEtB,cAAAA,MAAMsB,IAAI,YAAVtB,cAAc;QACpB,mEAAmE;QACnE,mEAAmE;QACnE,sEAAsE;QACtE,qBAAqB;QACrBuB,kBACEvB,MAAMuB,gBAAgB,KAAK,QAAQhB,SAASC,GAAG,CAAC,wBAAwB;QAC1EgB,WAAW;QACXC,WAAWpC,WAAWqC,eAAe;OACjCnB,SAASoB,MAAM,GAAG,CAAC,IAAI;QAAEC,WAAWvC,WAAWqC,eAAe;IAAG,IAEvE;QAAEG,OAAO;IAAK;IAEhB,OAAO;QAAEjC,aAAaC;QAAMa;QAAUoB,SAAS,CAACvB,SAASoB,MAAM;IAAC;AAClE;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,eAAeI,oBAAoB/B,KAKzC;QAGYA,kBAOOA,sBACDA;IAVjB,MAAMC,MAAMN,sBAAsBK,MAAMJ,WAAW;IACnD,IAAI,CAACK,KAAK,OAAO;IACjB,MAAME,MAAKH,mBAAAA,MAAMT,SAAS,YAAfS,mBAAmBT;IAC9B,MAAMa,MAAMD,GAAGE,UAAU,CAACZ,iCAAiCa,GAAG,CAACL;IAC/D,MAAMM,WAAW,MAAMH,IAAII,GAAG;IAC9B,IAAI,CAACD,SAASoB,MAAM,IAAIpB,SAASC,GAAG,CAAC,cAAc,OAAO;IAC1D,MAAMJ,IAAIc,GAAG,CACX;QACEM,WAAWnC,WAAWqC,eAAe;QACrCM,YAAY,GAAEhC,uBAAAA,MAAMiC,aAAa,YAAnBjC,uBAAuB;QACrCkC,WAAW,GAAElC,cAAAA,MAAMsB,IAAI,YAAVtB,cAAc;IAC7B,GACA;QAAE6B,OAAO;IAAK;IAEhB,OAAO;AACT;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAeM,yBACpBvC,WAAsC,EACtCiB,OAAwB,EACxBuB,iBAAuB;IAEvB,MAAMnC,MAAMN,sBAAsBC;IAClC,6EAA6E;IAC7E,+CAA+C;IAC/C,IAAI,CAACK,KAAK,OAAO;IACjB,IAAI;QACF,MAAME,KAAKiC,4BAAAA,oBAAqB7C;QAChC,MAAMgB,WAAW,MAAMJ,GACpBE,UAAU,CAACZ,iCACXa,GAAG,CAACL,KACJO,GAAG;QACN,IAAI,CAACD,SAASoB,MAAM,EAAE,OAAO;QAC7B,IAAIpB,SAASC,GAAG,CAAC,cAAc,OAAO;QACtC,IAAI,CAACK,SAAS,OAAO;QACrB,MAAMH,WAAWH,SAASC,GAAG,CAAC;QAC9B,OAAOQ,MAAMC,OAAO,CAACP,YAAYA,SAASI,QAAQ,CAACD,WAAW;IAChE,EAAE,OAAOwB,OAAO;QACdC,QAAQD,KAAK,CAAC,uDAAuDA;QACrE,OAAO;IACT;AACF;AAEA;;;CAGC,GACD,OAAO,eAAeE,sBACpB3C,WAAsC,EACtCwC,iBAAuB;IAEvB,MAAMnC,MAAMN,sBAAsBC;IAClC,IAAI,CAACK,KAAK,OAAO;IACjB,MAAME,KAAKiC,4BAAAA,oBAAqB7C;IAChC,MAAMgB,WAAW,MAAMJ,GACpBE,UAAU,CAACZ,iCACXa,GAAG,CAACL,KACJO,GAAG;IACN,IAAI,CAACD,SAASoB,MAAM,EAAE,OAAO;IAC7B,OAAO;QAAEa,KAAKjC,SAASkC,EAAE;OAAMlC,SAASmC,IAAI;AAC9C;AAEA;;;;CAIC,GACD,OAAO,eAAeC,wBAAwBC,OAG7C;;IACC,MAAMzC,aAAKyC,2BAAAA,QAASrD,SAAS,mBAAIA;IACjC,MAAMgB,WAAW,MAAMJ,GACpBE,UAAU,CAACZ,iCACXoD,OAAO,CAAC,aAAa,QACrBC,KAAK,CAACC,KAAKC,GAAG,CAACD,KAAKE,GAAG,UAACL,2BAAAA,QAASE,KAAK,oBAAI,KAAK,IAAI,MACnDtC,GAAG;IACN,OAAOD,SAAS2C,IAAI,CAACC,GAAG,CAAC,CAAC7C,MAAc;YACtCkC,KAAKlC,IAAImC,EAAE;WACPnC,IAAIoC,IAAI;AAEhB"}

package/src/lib/server/crm-booking-activity.d.ts

@@ -0,0 +1,86 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type CrmActivityLink } from '@aglyn/aglyn/server';
+export interface CrmBookingRecordInput {
+    hostId: string;
+    /**
+     * The owning org, as `getOrgForHost` returns it — the plugin set, the
+     * consent groups and the scope default are all read off it.
+     */
+    org: Record<string, unknown> | null | undefined;
+    orgId: string;
+    /** The booking as its row was written. */
+    booking: {
+        id: string;
+        serviceId?: string;
+        serviceName?: string;
+        email?: string;
+        startsAtMs: number;
+        endsAtMs: number;
+        /** The `crm` query value the link carried, kept on the row. */
+        crmRef?: string | null;
+    };
+    /** The service as stored: its two CRM switches and its timezone. */
+    service: {
+        name?: string;
+        timezone?: string;
+        crmFollowUpTask?: boolean;
+        crmMeetingActivity?: boolean;
+    } | null | undefined;
+    /**
+     * The host document's plugin fields, when the caller already holds them;
+     * read here otherwise. The deny-list is per site, and a site that has
+     * switched the CRM off must file nothing.
+     */
+    host?: {
+        disabledPlugins?: string[];
+        enabledPlugins?: string[];
+    } | null;
+}
+export type CrmBookingRecordOutcome = {
+    filed: false;
+    reason: 
+    /** The CRM plugin does not run on this site. */
+    'crm-off'
+    /**
+     * The org's plan does not carry the CRM suite, whose activities and
+     * tasks these are (AGL-2787).
+     */
+     | 'not-entitled'
+    /** Neither the reference nor the address named a record. */
+     | 'no-record'
+    /** A meeting for this booking is already on the timeline. */
+     | 'already-filed'
+    /** The service asks for neither a meeting nor a follow-up. */
+     | 'nothing-to-file'
+    /** A read or a write threw; logged, and nothing is promised. */
+     | 'failed';
+} | {
+    filed: true;
+    /** How the record was found. */
+    matchedBy: 'crmRef' | 'email';
+    link: CrmActivityLink;
+    /** The meeting's id, or `null` when the service files no meeting. */
+    activityId: string | null;
+    /** The follow-up's id, or `null` when the service asks for none. */
+    taskId: string | null;
+};
+/**
+ * Files what a confirmed booking owes the CRM: the meeting, and the
+ * follow-up when the service asks for one. See the module comment.
+ */
+export declare function recordCrmBooking(firestore: FirebaseFirestore.Firestore, input: CrmBookingRecordInput): Promise<CrmBookingRecordOutcome>;

package/src/lib/server/crm-booking-activity.js

@@ -0,0 +1,251 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { checkEntitlement, consentGroupForHost, CRM_COLLECTIONS, crmActivityLogHasRoom, crmBookingFollowUpDueMs, crmBookingFollowUpTitle, crmBookingMeetingBody, crmScopeTokens, isHostPluginEnabled, parseCrmBookingRef, readContactFacet, visibleToHost } from "@aglyn/aglyn/server";
+import { FieldValue } from "firebase-admin/firestore";
+import { findContactByEmail } from "./contact-email-index.js";
+import { countCrmActivitiesForRecord } from "./crm-records.js";
+/**
+ * WHAT A BOOKING FILES ON THE CRM RECORD (AGL-2660).
+ *
+ * A confirmed booking is a meeting the record has on its calendar, and the
+ * timeline should say so without a rep logging it by hand. So once a
+ * booking's row is written — at creation for a free service, on payment
+ * for a paid one — the record is found and a `meeting` activity filed under
+ * it, with a follow-up task beside it when the service asks for one.
+ *
+ * ## Which record
+ *
+ * The reference the booking link carried wins: `crmRef` names the contact,
+ * lead or deal the rep dropped the link from, and a booking made through
+ * that link belongs to that record even when the booker typed a different
+ * address. Without one — a booking taken off the widget cold — the booker's
+ * address is looked up through the org's address index, narrowed to this
+ * site, exactly as the automation steps resolve an event's contact. A
+ * reference to a record the site cannot see, or that no longer exists,
+ * falls through to the address rather than filing under nobody.
+ *
+ * ## Where it lives
+ *
+ * In the admin library rather than the Bookings plugin, because the row is
+ * a CRM record: its scope, its ceiling and its collections are the CRM's,
+ * and a plugin that stamped its own would be a second creator to keep in
+ * step with `crmScopeTokens`. The Bookings plugin passes what it already
+ * holds and reads the outcome; the CRM plugin is never imported.
+ *
+ * Firestore is a parameter, as in `crm-records.ts`: the callers hold one,
+ * and a module that reached for the Admin app itself would drag it into
+ * every spec that only wants the arithmetic.
+ *
+ * ## Failure posture
+ *
+ * **Never throws.** A booking that could not be filed on the CRM is still
+ * a booking — the guest has the slot and the confirmation — so a failure
+ * here is logged and reported in the outcome, never raised into the
+ * request that took the booking or the webhook that confirmed it.
+ */ /** The CRM plugin's id, as `enabledPlugins` and `disabledPlugins` name it. */ const CRM_PLUGIN_ID = 'crm';
+/**
+ * The record a booking belongs to — the reference first, the address second.
+ */ async function resolveBookingRecord(firestore, input, groupId) {
+    var _hit_data;
+    const { hostId, orgId } = input;
+    const orgRef = firestore.collection('orgs').doc(orgId);
+    const contactsRef = orgRef.collection('contacts');
+    const ref = parseCrmBookingRef(input.booking.crmRef);
+    if ((ref == null ? void 0 : ref.kind) === 'contact') {
+        const contact = await contactsRef.doc(ref.id).get();
+        if (contact.exists && visibleToHost(contact.get('visibleTo'), hostId)) {
+            var _contact_data;
+            const facet = readContactFacet((_contact_data = contact.data()) != null ? _contact_data : {}, groupId);
+            return _extends({
+                link: _extends({
+                    contactId: contact.id
+                }, facet.companyId ? {
+                    companyId: facet.companyId
+                } : {}),
+                matchedBy: 'crmRef'
+            }, facet.ownerUid ? {
+                ownerUid: facet.ownerUid
+            } : {});
+        }
+    }
+    if ((ref == null ? void 0 : ref.kind) === 'deal') {
+        const deal = await orgRef.collection(CRM_COLLECTIONS.deals).doc(ref.id).get();
+        if (deal.exists && visibleToHost(deal.get('visibleTo'), hostId)) {
+            var _deal_get, _deal_get1, _deal_get2;
+            const contactId = String((_deal_get = deal.get('contactId')) != null ? _deal_get : '');
+            const companyId = String((_deal_get1 = deal.get('companyId')) != null ? _deal_get1 : '');
+            const ownerUid = String((_deal_get2 = deal.get('ownerUid')) != null ? _deal_get2 : '');
+            return _extends({
+                link: _extends({
+                    dealId: deal.id
+                }, contactId ? {
+                    contactId
+                } : {}, companyId ? {
+                    companyId
+                } : {}),
+                matchedBy: 'crmRef'
+            }, ownerUid ? {
+                ownerUid
+            } : {});
+        }
+    }
+    if ((ref == null ? void 0 : ref.kind) === 'lead') {
+        // A lead is host-scoped by path and carries no `visibleTo` of its own.
+        const lead = await firestore.collection('hosts').doc(hostId).collection('leads').doc(ref.id).get();
+        if (lead.exists) {
+            var _lead_get;
+            const ownerUid = String((_lead_get = lead.get('ownerUid')) != null ? _lead_get : '');
+            return _extends({
+                link: {
+                    leadId: lead.id
+                },
+                matchedBy: 'crmRef'
+            }, ownerUid ? {
+                ownerUid
+            } : {});
+        }
+    }
+    const hit = await findContactByEmail(contactsRef, input.booking.email, {
+        hostId
+    });
+    if (!hit) return null;
+    const facet = readContactFacet((_hit_data = hit.data()) != null ? _hit_data : {}, groupId);
+    return _extends({
+        link: _extends({
+            contactId: hit.id
+        }, facet.companyId ? {
+            companyId: facet.companyId
+        } : {}),
+        matchedBy: 'email'
+    }, facet.ownerUid ? {
+        ownerUid: facet.ownerUid
+    } : {});
+}
+/**
+ * Files what a confirmed booking owes the CRM: the meeting, and the
+ * follow-up when the service asks for one. See the module comment.
+ */ export async function recordCrmBooking(firestore, input) {
+    const { hostId, orgId, booking, service } = input;
+    try {
+        var _data, _input_org, _input_org1, _input_org2, _ref, _ref1;
+        if (!hostId || !orgId || !(booking == null ? void 0 : booking.id)) return {
+            filed: false,
+            reason: 'failed'
+        };
+        const wantsMeeting = (service == null ? void 0 : service.crmMeetingActivity) !== false;
+        const wantsTask = (service == null ? void 0 : service.crmFollowUpTask) === true;
+        if (!wantsMeeting && !wantsTask) return {
+            filed: false,
+            reason: 'nothing-to-file'
+        };
+        const host = input.host === undefined ? (_data = (await firestore.collection('hosts').doc(hostId).get()).data()) != null ? _data : null : input.host;
+        if (!isHostPluginEnabled((_input_org = input.org) != null ? _input_org : null, host, CRM_PLUGIN_ID)) {
+            return {
+                filed: false,
+                reason: 'crm-off'
+            };
+        }
+        if (!checkEntitlement(input.org, 'crm')) {
+            return {
+                filed: false,
+                reason: 'not-entitled'
+            };
+        }
+        const orgRef = firestore.collection('orgs').doc(orgId);
+        const activities = orgRef.collection(CRM_COLLECTIONS.activities);
+        // One meeting per booking, whatever path re-enters: the paid webhook is
+        // redelivered for days after any 500, and its own guard is the status,
+        // which this row is not part of.
+        const already = await activities.where('bookingId', '==', booking.id).limit(1).get();
+        if (!already.empty) return {
+            filed: false,
+            reason: 'already-filed'
+        };
+        const group = consentGroupForHost((_input_org1 = input.org) != null ? _input_org1 : null, hostId);
+        const record = await resolveBookingRecord(firestore, input, group.groupId);
+        if (!record) return {
+            filed: false,
+            reason: 'no-record'
+        };
+        const visibleTo = crmScopeTokens((_input_org2 = input.org) != null ? _input_org2 : null, group);
+        const serviceName = String((_ref = (_ref1 = service == null ? void 0 : service.name) != null ? _ref1 : booking.serviceName) != null ? _ref : '').trim();
+        const timezone = (service == null ? void 0 : service.timezone) || undefined;
+        let activityId = null;
+        if (wantsMeeting) {
+            // The per-record ceiling (AGL-2611): a full log refuses the meeting
+            // but not the follow-up — a task is owed either way.
+            const logged = await countCrmActivitiesForRecord(orgRef, record.link);
+            if (crmActivityLogHasRoom(logged)) {
+                const activity = _extends({
+                    kind: 'meeting',
+                    body: crmBookingMeetingBody({
+                        serviceName,
+                        startsAtMs: booking.startsAtMs,
+                        timezone
+                    }),
+                    // When it HAPPENS, which is the slot — not when it was booked.
+                    atMs: booking.startsAtMs,
+                    byUid: ''
+                }, record.link, {
+                    bookingId: booking.id,
+                    hostId,
+                    visibleTo,
+                    createdAt: FieldValue.serverTimestamp(),
+                    updatedAt: FieldValue.serverTimestamp()
+                });
+                const written = await activities.add(activity);
+                activityId = written.id;
+            }
+        }
+        let taskId = null;
+        if (wantsTask) {
+            const task = _extends({
+                title: crmBookingFollowUpTitle(serviceName),
+                kind: 'todo',
+                priority: 'normal',
+                status: 'open',
+                dueAtMs: crmBookingFollowUpDueMs(booking.endsAtMs, timezone)
+            }, record.ownerUid ? {
+                assigneeUid: record.ownerUid
+            } : {}, {
+                createdByUid: ''
+            }, record.link, {
+                hostId,
+                visibleTo,
+                createdAt: FieldValue.serverTimestamp(),
+                updatedAt: FieldValue.serverTimestamp()
+            });
+            const written = await orgRef.collection(CRM_COLLECTIONS.tasks).add(task);
+            taskId = written.id;
+        }
+        return {
+            filed: true,
+            matchedBy: record.matchedBy,
+            link: record.link,
+            activityId,
+            taskId
+        };
+    } catch (error) {
+        console.error('[crm] booking could not be filed', hostId, booking == null ? void 0 : booking.id, error);
+        return {
+            filed: false,
+            reason: 'failed'
+        };
+    }
+}
+
+//# sourceMappingURL=crm-booking-activity.js.map