@aglyn/tenant-data-admin 1.0.0-beta.165 → 1.0.0-beta.166

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/tenant-data-admin",
-  "version": "1.0.0-beta.165",
+  "version": "1.0.0-beta.166",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,11 +25,11 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/aglyn": "1.0.0-beta.165",
-    "@aglyn/shared-util-email": "1.0.0-beta.165",
-    "@aglyn/shared-util-fbserver": "1.0.0-beta.165",
-    "@aglyn/shared-util-http": "1.0.0-beta.165",
-    "@aglyn/shared-util-tools": "1.0.0-beta.165",
+    "@aglyn/aglyn": "1.0.0-beta.166",
+    "@aglyn/shared-util-email": "1.0.0-beta.166",
+    "@aglyn/shared-util-fbserver": "1.0.0-beta.166",
+    "@aglyn/shared-util-http": "1.0.0-beta.166",
+    "@aglyn/shared-util-tools": "1.0.0-beta.166",
     "@msgpack/msgpack": "^3.1.3",
     "@swc/helpers": "0.5.23",
     "sharp": "^0.35.3",

package/src/lib/server/contact-merge.js

@@ -85,25 +85,30 @@ import { logHostActivity } from "./organizations.js";
 /**
  * The leads converted into the merged contact, restamped at the survivor.
  *
- * A lead lives at `hosts/{hostId}/leads/{personKey(email)}`, so there is no
- * query: each site that met either record is asked for a lead under each of
- * the merged record's addresses, and one that names the merged contact is
- * moved. Bounded by sites times addresses, both small.
- */ async function repointLeads(firestore, hostIds, emails, from, to) {
+ * A lead lives at `orgs/{orgId}/leads/{personKey(email)}` (AGL-3275), so there
+ * is still no query — one document per address, asked for directly. This used
+ * to be bounded by sites TIMES addresses because a lead lived under each site;
+ * it is bounded by addresses now, and the sites drop out of the signature
+ * because the collection no longer has one per site to walk.
+ */ async function repointLeads(orgRef, emails, from, to) {
     let moved = 0;
-    for (const hostId of hostIds){
-        for (const email of emails){
-            const key = personKey(email);
-            if (!key) continue;
-            const leadRef = firestore.collection('hosts').doc(hostId).collection('leads').doc(key);
-            const lead = await leadRef.get();
-            if (!lead.exists || lead.get('convertedContactId') !== from) continue;
-            await leadRef.update({
-                convertedContactId: to,
-                updatedAt: FieldValue.serverTimestamp()
-            });
-            moved += 1;
-        }
+    /*
+   * ONE ROW PER ADDRESS, on the org (AGL-3275). This walked the sites because
+   * there was a lead under each of them; re-pointing the same document once
+   * per site would now be the same write repeated, and the second would find
+   * `convertedContactId` already moved and skip — a silent undercount rather
+   * than a wrong answer, but an undercount the caller reports to the operator.
+   */ for (const email of emails){
+        const key = personKey(email);
+        if (!key) continue;
+        const leadRef = orgRef.collection('leads').doc(key);
+        const lead = await leadRef.get();
+        if (!lead.exists || lead.get('convertedContactId') !== from) continue;
+        await leadRef.update({
+            convertedContactId: to,
+            updatedAt: FieldValue.serverTimestamp()
+        });
+        moved += 1;
     }
     return moved;
 }
@@ -154,7 +159,7 @@ export async function mergeContacts(options) {
             ])
         ])
     ];
-    const leads = await repointLeads(firestore, leadHosts, contactEmails(mergedData), mergedId, survivorId);
+    const leads = await repointLeads(orgRef, contactEmails(mergedData), mergedId, survivorId);
     /*==========================================
    * 2. THE SWAP — one transaction over both documents and the index.
    *=========================================*/ const index = orgRef.collection(CONTACT_EMAIL_INDEX_COLLECTION);

package/src/lib/server/contact-merge.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/contact-merge.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * MERGING TWO CONTACTS — the write (AGL-2625).\n *\n * `planContactMerge` says what the survivor becomes; this performs it, and\n * moves everything that pointed at the merged record. One function behind\n * two doors — the console's `crm/contacts-merge` route and\n * `POST /v1/contacts/{id}/merge` — so the REST caller and the record page\n * cannot merge two different ways.\n *\n * ## The order is the crash-safety argument\n *\n *  1. Every deal, task and activity naming the merged contact is repointed\n *     at the survivor, and every lead converted into it. Batched, bounded,\n *     idempotent: a re-run finds nothing left to move.\n *  2. Then, in ONE transaction: the survivor takes the plan, every address\n *     it now answers to is indexed at it, and the merged document is\n *     deleted — with both records re-read inside the transaction, so two\n *     merges racing on one pair cannot both succeed and a plan is never\n *     computed on a document that changed under it.\n *\n * Children first because a process that dies between the two steps leaves\n * children pointing at a record that EXISTS — the survivor — while the merged\n * document is still there for a retry to fold in. The other order would\n * leave deals pointing at a deleted contact, which is a record nobody can\n * open from anywhere.\n *\n * ## What it does not move\n *\n * List memberships, suppression entries and the delivery log are keyed by\n * ADDRESS, not by contact id, and stay under the merged address; a capture\n * on that address resolves to the survivor through the index, which is the\n * fact those keys need. A company's contacts count drops only for a company\n * both records named — the survivor still names the rest.\n */\n\nimport {\n  CONTACT_EMAIL_INDEX_COLLECTION,\n  contactEmails,\n} from '@aglyn/aglyn/app-utils/contacts'\nimport type { HostActivityActor } from '@aglyn/aglyn/app-utils/activity-presenter'\nimport { planContactMerge } from '@aglyn/aglyn/app-utils/contact-merge'\nimport { CRM_COLLECTIONS } from '@aglyn/aglyn/app-utils/crm'\nimport { personKey } from '@aglyn/aglyn/app-utils/person-key'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { settleCompanyContactsCounts } from './contact-company-link'\nimport { recomputeCrmNextTaskAt } from './crm-next-activity'\nimport { logHostActivity } from './organizations'\n\n/** How many pointing rows one repoint pass reads — and one batch writes. */\nconst REPOINT_PAGE = 400\n/** A ceiling on passes, so a query that keeps answering cannot loop forever. */\nconst REPOINT_PASSES = 25\n\nexport interface MergeContactsOptions {\n  firestore: FirebaseFirestore.Firestore\n  /** `orgs/{orgId}` — the org whose contacts both records are. */\n  orgRef: FirebaseFirestore.DocumentReference\n  /** The record that stays, and keeps its address as the identity. */\n  survivorId: string\n  /** The record folded in and deleted. */\n  mergedId: string\n  actor: HostActivityActor\n  /**\n   * The site whose console did the work: where the activity feed entry\n   * lands, and the site a timeline note is filed under. `null` for a door\n   * with no site — the REST API — which logs no host entry.\n   */\n  hostId: string | null\n  /** The actor's display name for the timeline note, when the door knows it. */\n  actorName?: string | null\n}\n\nexport interface MergeContactsRepointed {\n  deals: number\n  tasks: number\n  activities: number\n  leads: number\n}\n\nexport type MergeContactsResult =\n  | {\n      ok: true\n      survivorId: string\n      survivorEmail: string\n      mergedId: string\n      mergedEmail: string\n      /** Every address the survivor answers to now, primary first. */\n      emails: string[]\n      repointed: MergeContactsRepointed\n    }\n  | { ok: false; reason: 'same-record' | 'survivor-missing' | 'merged-missing' }\n\n/**\n * Point every row of `collection` whose `contactId` is `from` at `to`.\n *\n * Page, batch, repeat: each pass reads the rows still pointing at the\n * merged record — the ones a previous pass moved no longer match — so the\n * loop ends when a pass finds nothing. `updatedAt` moves with the pointer\n * because an integration syncing by `updatedAfter` has to see the change.\n */\nasync function repointContactId(\n  firestore: FirebaseFirestore.Firestore,\n  collection: FirebaseFirestore.CollectionReference,\n  from: string,\n  to: string,\n): Promise<number> {\n  let moved = 0\n  for (let pass = 0; pass < REPOINT_PASSES; pass += 1) {\n    const page = await collection\n      .where('contactId', '==', from)\n      .limit(REPOINT_PAGE)\n      .get()\n    if (page.empty) break\n    const batch = firestore.batch()\n    for (const row of page.docs) {\n      batch.update(row.ref, {\n        contactId: to,\n        updatedAt: FieldValue.serverTimestamp(),\n      })\n    }\n    await batch.commit()\n    moved += page.size\n    if (page.size < REPOINT_PAGE) break\n  }\n  return moved\n}\n\n/**\n * The leads converted into the merged contact, restamped at the survivor.\n *\n * A lead lives at `hosts/{hostId}/leads/{personKey(email)}`, so there is no\n * query: each site that met either record is asked for a lead under each of\n * the merged record's addresses, and one that names the merged contact is\n * moved. Bounded by sites times addresses, both small.\n */\nasync function repointLeads(\n  firestore: FirebaseFirestore.Firestore,\n  hostIds: readonly string[],\n  emails: readonly string[],\n  from: string,\n  to: string,\n): Promise<number> {\n  let moved = 0\n  for (const hostId of hostIds) {\n    for (const email of emails) {\n      const key = personKey(email)\n      if (!key) continue\n      const leadRef = firestore\n        .collection('hosts')\n        .doc(hostId)\n        .collection('leads')\n        .doc(key)\n      const lead = await leadRef.get()\n      if (!lead.exists || lead.get('convertedContactId') !== from) continue\n      await leadRef.update({\n        convertedContactId: to,\n        updatedAt: FieldValue.serverTimestamp(),\n      })\n      moved += 1\n    }\n  }\n  return moved\n}\n\nfunction strings(value: unknown): string[] {\n  return Array.isArray(value)\n    ? value.filter((item): item is string => typeof item === 'string' && item !== '')\n    : []\n}\n\nexport async function mergeContacts(\n  options: MergeContactsOptions,\n): Promise<MergeContactsResult> {\n  const { firestore, orgRef, survivorId, mergedId, actor, hostId } = options\n  if (!survivorId || !mergedId || survivorId === mergedId) {\n    return { ok: false, reason: 'same-record' }\n  }\n  const contactsRef = orgRef.collection('contacts')\n  const survivorRef = contactsRef.doc(survivorId)\n  const mergedRef = contactsRef.doc(mergedId)\n  const [survivorBefore, mergedBefore] = await Promise.all([\n    survivorRef.get(),\n    mergedRef.get(),\n  ])\n  if (!survivorBefore.exists) return { ok: false, reason: 'survivor-missing' }\n  if (!mergedBefore.exists) return { ok: false, reason: 'merged-missing' }\n  const mergedData = (mergedBefore.data() ?? {}) as Record<string, unknown>\n  const survivorData = (survivorBefore.data() ?? {}) as Record<string, unknown>\n\n  /*==========================================\n   * 1. THE CHILDREN — before the parent, for the reason the header gives.\n   *=========================================*/\n  const [deals, tasks, activities] = await Promise.all([\n    repointContactId(firestore, orgRef.collection(CRM_COLLECTIONS.deals), mergedId, survivorId),\n    repointContactId(firestore, orgRef.collection(CRM_COLLECTIONS.tasks), mergedId, survivorId),\n    repointContactId(\n      firestore,\n      orgRef.collection(CRM_COLLECTIONS.activities),\n      mergedId,\n      survivorId,\n    ),\n  ])\n  const leadHosts = [\n    ...new Set([\n      ...strings(mergedData['capturedByHostIds']),\n      ...strings(survivorData['capturedByHostIds']),\n      ...strings([mergedData['hostId'], survivorData['hostId'], hostId]),\n    ]),\n  ]\n  const leads = await repointLeads(\n    firestore,\n    leadHosts,\n    contactEmails(mergedData),\n    mergedId,\n    survivorId,\n  )\n\n  /*==========================================\n   * 2. THE SWAP — one transaction over both documents and the index.\n   *=========================================*/\n  const index = orgRef.collection(CONTACT_EMAIL_INDEX_COLLECTION)\n  const swapped = await firestore.runTransaction(async (transaction) => {\n    const [survivor, merged] = await Promise.all([\n      transaction.get(survivorRef),\n      transaction.get(mergedRef),\n    ])\n    if (!survivor.exists) return { reason: 'survivor-missing' as const }\n    if (!merged.exists) return { reason: 'merged-missing' as const }\n    const plan = planContactMerge(\n      (survivor.data() ?? {}) as Record<string, unknown>,\n      (merged.data() ?? {}) as Record<string, unknown>,\n    )\n    transaction.set(\n      survivorRef,\n      { ...plan.survivor, updatedAt: FieldValue.serverTimestamp() },\n      { merge: true },\n    )\n    for (const email of plan.emails) {\n      const key = personKey(email)\n      if (!key) continue\n      transaction.set(\n        index.doc(key),\n        { email, contactId: survivorId, updatedAt: FieldValue.serverTimestamp() },\n        { merge: true },\n      )\n    }\n    transaction.delete(mergedRef)\n    return { plan, survivor: (survivor.data() ?? {}) as Record<string, unknown> }\n  })\n  if ('reason' in swapped) return { ok: false, reason: swapped.reason }\n  const { plan } = swapped\n\n  /*\n   * The companies both records named counted two people and now count one\n   * (AGL-2613). Settled after the swap the way the capture settles its\n   * counts: a figure that could not move is logged, and the company page's\n   * live aggregate corrects it.\n   */\n  await settleCompanyContactsCounts(orgRef.collection(CRM_COLLECTIONS.companies), {\n    companyId: null,\n    mirror: null,\n    counts: plan.companyCounts,\n  })\n  /*\n   * The survivor now owns the merged record's open tasks too, so its next\n   * activity is the earliest of both (AGL-2661). Settled the same way: a\n   * figure that could not move is logged, and the Fields section's\n   * recompute corrects it.\n   */\n  await recomputeCrmNextTaskAt(firestore, orgRef.id, [{ contactId: survivorId }]).catch(\n    (error: unknown) => {\n      console.error('contact merge next activity could not be recomputed', survivorId, error)\n    },\n  )\n\n  const mergedEmail = contactEmails(mergedData)[0] ?? ''\n  const survivorEmail = plan.emails[0] ?? ''\n  // The canonical name — the one identity every holder shares — for the\n  // feed; the address stands in for a person nobody has named.\n  const survivorName =\n    typeof swapped.survivor['name'] === 'string' ? swapped.survivor['name'] : ''\n\n  /*\n   * THE TIMELINE NOTE, on the survivor: the merge is an event in this\n   * person's history, and the record page is where a reader looks for one.\n   * Filed under the calling site, or the survivor's first site for a door\n   * with none; its own catch, because a note that could not be written must\n   * not read as a merge that did not happen.\n   */\n  try {\n    await orgRef.collection(CRM_COLLECTIONS.activities).add({\n      kind: 'note',\n      body: `Merged with ${mergedEmail}`,\n      atMs: Date.now(),\n      byUid: actor.uid,\n      ...(options.actorName || actor.email\n        ? { byName: options.actorName || actor.email }\n        : {}),\n      contactId: survivorId,\n      visibleTo: plan.visibleTo,\n      hostId: hostId ?? String(survivorData['hostId'] ?? ''),\n      createdByUid: actor.uid,\n      createdAt: FieldValue.serverTimestamp(),\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n  } catch (error) {\n    console.error('[contact-merge] timeline note failed', survivorId, error)\n  }\n\n  // The audit line (AGL-2622), in the feed of the site whose console did\n  // the work. A door with no site — the API — has no host feed to write.\n  if (hostId) {\n    await logHostActivity(hostId, actor, `Merged with ${mergedEmail}`, {\n      type: 'contact',\n      id: survivorId,\n      name: survivorName || survivorEmail,\n    })\n  }\n\n  return {\n    ok: true,\n    survivorId,\n    survivorEmail,\n    mergedId,\n    mergedEmail,\n    emails: plan.emails,\n    repointed: { deals, tasks, activities, leads },\n  }\n}\n"],"names":["CONTACT_EMAIL_INDEX_COLLECTION","contactEmails","planContactMerge","CRM_COLLECTIONS","personKey","FieldValue","settleCompanyContactsCounts","recomputeCrmNextTaskAt","logHostActivity","REPOINT_PAGE","REPOINT_PASSES","repointContactId","firestore","collection","from","to","moved","pass","page","where","limit","get","empty","batch","row","docs","update","ref","contactId","updatedAt","serverTimestamp","commit","size","repointLeads","hostIds","emails","hostId","email","key","leadRef","doc","lead","exists","convertedContactId","strings","value","Array","isArray","filter","item","mergeContacts","options","mergedBefore","survivorBefore","plan","orgRef","survivorId","mergedId","actor","ok","reason","contactsRef","survivorRef","mergedRef","Promise","all","mergedData","data","survivorData","deals","tasks","activities","leadHosts","Set","leads","index","swapped","runTransaction","transaction","survivor","merged","set","merge","delete","companies","companyId","mirror","counts","companyCounts","id","catch","error","console","mergedEmail","survivorEmail","survivorName","add","kind","body","atMs","Date","now","byUid","uid","actorName","byName","visibleTo","String","createdByUid","createdAt","type","name","repointed"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCC,GAED,SACEA,8BAA8B,EAC9BC,aAAa,QACR,kCAAiC;AAExC,SAASC,gBAAgB,QAAQ,uCAAsC;AACvE,SAASC,eAAe,QAAQ,6BAA4B;AAC5D,SAASC,SAAS,QAAQ,oCAAmC;AAC7D,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,2BAA2B,QAAQ,4BAAwB;AACpE,SAASC,sBAAsB,QAAQ,yBAAqB;AAC5D,SAASC,eAAe,QAAQ,qBAAiB;AAEjD,0EAA0E,GAC1E,MAAMC,eAAe;AACrB,8EAA8E,GAC9E,MAAMC,iBAAiB;AAyCvB;;;;;;;CAOC,GACD,eAAeC,iBACbC,SAAsC,EACtCC,UAAiD,EACjDC,IAAY,EACZC,EAAU;IAEV,IAAIC,QAAQ;IACZ,IAAK,IAAIC,OAAO,GAAGA,OAAOP,gBAAgBO,QAAQ,EAAG;QACnD,MAAMC,OAAO,MAAML,WAChBM,KAAK,CAAC,aAAa,MAAML,MACzBM,KAAK,CAACX,cACNY,GAAG;QACN,IAAIH,KAAKI,KAAK,EAAE;QAChB,MAAMC,QAAQX,UAAUW,KAAK;QAC7B,KAAK,MAAMC,OAAON,KAAKO,IAAI,CAAE;YAC3BF,MAAMG,MAAM,CAACF,IAAIG,GAAG,EAAE;gBACpBC,WAAWb;gBACXc,WAAWxB,WAAWyB,eAAe;YACvC;QACF;QACA,MAAMP,MAAMQ,MAAM;QAClBf,SAASE,KAAKc,IAAI;QAClB,IAAId,KAAKc,IAAI,GAAGvB,cAAc;IAChC;IACA,OAAOO;AACT;AAEA;;;;;;;CAOC,GACD,eAAeiB,aACbrB,SAAsC,EACtCsB,OAA0B,EAC1BC,MAAyB,EACzBrB,IAAY,EACZC,EAAU;IAEV,IAAIC,QAAQ;IACZ,KAAK,MAAMoB,UAAUF,QAAS;QAC5B,KAAK,MAAMG,SAASF,OAAQ;YAC1B,MAAMG,MAAMlC,UAAUiC;YACtB,IAAI,CAACC,KAAK;YACV,MAAMC,UAAU3B,UACbC,UAAU,CAAC,SACX2B,GAAG,CAACJ,QACJvB,UAAU,CAAC,SACX2B,GAAG,CAACF;YACP,MAAMG,OAAO,MAAMF,QAAQlB,GAAG;YAC9B,IAAI,CAACoB,KAAKC,MAAM,IAAID,KAAKpB,GAAG,CAAC,0BAA0BP,MAAM;YAC7D,MAAMyB,QAAQb,MAAM,CAAC;gBACnBiB,oBAAoB5B;gBACpBc,WAAWxB,WAAWyB,eAAe;YACvC;YACAd,SAAS;QACX;IACF;IACA,OAAOA;AACT;AAEA,SAAS4B,QAAQC,KAAc;IAC7B,OAAOC,MAAMC,OAAO,CAACF,SACjBA,MAAMG,MAAM,CAAC,CAACC,OAAyB,OAAOA,SAAS,YAAYA,SAAS,MAC5E,EAAE;AACR;AAEA,OAAO,eAAeC,cACpBC,OAA6B;QAeTC,oBACEC,sBAwFFpD,iBACEqD;IAvGtB,MAAM,EAAE1C,SAAS,EAAE2C,MAAM,EAAEC,UAAU,EAAEC,QAAQ,EAAEC,KAAK,EAAEtB,MAAM,EAAE,GAAGe;IACnE,IAAI,CAACK,cAAc,CAACC,YAAYD,eAAeC,UAAU;QACvD,OAAO;YAAEE,IAAI;YAAOC,QAAQ;QAAc;IAC5C;IACA,MAAMC,cAAcN,OAAO1C,UAAU,CAAC;IACtC,MAAMiD,cAAcD,YAAYrB,GAAG,CAACgB;IACpC,MAAMO,YAAYF,YAAYrB,GAAG,CAACiB;IAClC,MAAM,CAACJ,gBAAgBD,aAAa,GAAG,MAAMY,QAAQC,GAAG,CAAC;QACvDH,YAAYzC,GAAG;QACf0C,UAAU1C,GAAG;KACd;IACD,IAAI,CAACgC,eAAeX,MAAM,EAAE,OAAO;QAAEiB,IAAI;QAAOC,QAAQ;IAAmB;IAC3E,IAAI,CAACR,aAAaV,MAAM,EAAE,OAAO;QAAEiB,IAAI;QAAOC,QAAQ;IAAiB;IACvE,MAAMM,cAAcd,qBAAAA,aAAae,IAAI,cAAjBf,qBAAuB,CAAC;IAC5C,MAAMgB,gBAAgBf,uBAAAA,eAAec,IAAI,cAAnBd,uBAAyB,CAAC;IAEhD;;6CAE2C,GAC3C,MAAM,CAACgB,OAAOC,OAAOC,WAAW,GAAG,MAAMP,QAAQC,GAAG,CAAC;QACnDtD,iBAAiBC,WAAW2C,OAAO1C,UAAU,CAACV,gBAAgBkE,KAAK,GAAGZ,UAAUD;QAChF7C,iBAAiBC,WAAW2C,OAAO1C,UAAU,CAACV,gBAAgBmE,KAAK,GAAGb,UAAUD;QAChF7C,iBACEC,WACA2C,OAAO1C,UAAU,CAACV,gBAAgBoE,UAAU,GAC5Cd,UACAD;KAEH;IACD,MAAMgB,YAAY;WACb,IAAIC,IAAI;eACN7B,QAAQsB,UAAU,CAAC,oBAAoB;eACvCtB,QAAQwB,YAAY,CAAC,oBAAoB;eACzCxB,QAAQ;gBAACsB,UAAU,CAAC,SAAS;gBAAEE,YAAY,CAAC,SAAS;gBAAEhC;aAAO;SAClE;KACF;IACD,MAAMsC,QAAQ,MAAMzC,aAClBrB,WACA4D,WACAvE,cAAciE,aACdT,UACAD;IAGF;;6CAE2C,GAC3C,MAAMmB,QAAQpB,OAAO1C,UAAU,CAACb;IAChC,MAAM4E,UAAU,MAAMhE,UAAUiE,cAAc,CAAC,OAAOC;YAQjDC,gBACAC,cAiBuBD;QAzB1B,MAAM,CAACA,UAAUC,OAAO,GAAG,MAAMhB,QAAQC,GAAG,CAAC;YAC3Ca,YAAYzD,GAAG,CAACyC;YAChBgB,YAAYzD,GAAG,CAAC0C;SACjB;QACD,IAAI,CAACgB,SAASrC,MAAM,EAAE,OAAO;YAAEkB,QAAQ;QAA4B;QACnE,IAAI,CAACoB,OAAOtC,MAAM,EAAE,OAAO;YAAEkB,QAAQ;QAA0B;QAC/D,MAAMN,OAAOpD,kBACV6E,iBAAAA,SAASZ,IAAI,cAAbY,iBAAmB,CAAC,IACpBC,eAAAA,OAAOb,IAAI,cAAXa,eAAiB,CAAC;QAErBF,YAAYG,GAAG,CACbnB,aACA,aAAKR,KAAKyB,QAAQ;YAAElD,WAAWxB,WAAWyB,eAAe;YACzD;YAAEoD,OAAO;QAAK;QAEhB,KAAK,MAAM7C,SAASiB,KAAKnB,MAAM,CAAE;YAC/B,MAAMG,MAAMlC,UAAUiC;YACtB,IAAI,CAACC,KAAK;YACVwC,YAAYG,GAAG,CACbN,MAAMnC,GAAG,CAACF,MACV;gBAAED;gBAAOT,WAAW4B;gBAAY3B,WAAWxB,WAAWyB,eAAe;YAAG,GACxE;gBAAEoD,OAAO;YAAK;QAElB;QACAJ,YAAYK,MAAM,CAACpB;QACnB,OAAO;YAAET;YAAMyB,QAAQ,GAAGA,kBAAAA,SAASZ,IAAI,cAAbY,kBAAmB,CAAC;QAA8B;IAC9E;IACA,IAAI,YAAYH,SAAS,OAAO;QAAEjB,IAAI;QAAOC,QAAQgB,QAAQhB,MAAM;IAAC;IACpE,MAAM,EAAEN,IAAI,EAAE,GAAGsB;IAEjB;;;;;GAKC,GACD,MAAMtE,4BAA4BiD,OAAO1C,UAAU,CAACV,gBAAgBiF,SAAS,GAAG;QAC9EC,WAAW;QACXC,QAAQ;QACRC,QAAQjC,KAAKkC,aAAa;IAC5B;IACA;;;;;GAKC,GACD,MAAMjF,uBAAuBK,WAAW2C,OAAOkC,EAAE,EAAE;QAAC;YAAE7D,WAAW4B;QAAW;KAAE,EAAEkC,KAAK,CACnF,CAACC;QACCC,QAAQD,KAAK,CAAC,uDAAuDnC,YAAYmC;IACnF;IAGF,MAAME,eAAc5F,kBAAAA,cAAciE,WAAW,CAAC,EAAE,YAA5BjE,kBAAgC;IACpD,MAAM6F,iBAAgBxC,gBAAAA,KAAKnB,MAAM,CAAC,EAAE,YAAdmB,gBAAkB;IACxC,sEAAsE;IACtE,6DAA6D;IAC7D,MAAMyC,eACJ,OAAOnB,QAAQG,QAAQ,CAAC,OAAO,KAAK,WAAWH,QAAQG,QAAQ,CAAC,OAAO,GAAG;IAE5E;;;;;;GAMC,GACD,IAAI;YAWyBX;QAV3B,MAAMb,OAAO1C,UAAU,CAACV,gBAAgBoE,UAAU,EAAEyB,GAAG,CAAC;YACtDC,MAAM;YACNC,MAAM,CAAC,YAAY,EAAEL,aAAa;YAClCM,MAAMC,KAAKC,GAAG;YACdC,OAAO5C,MAAM6C,GAAG;WACZpD,QAAQqD,SAAS,IAAI9C,MAAMrB,KAAK,GAChC;YAAEoE,QAAQtD,QAAQqD,SAAS,IAAI9C,MAAMrB,KAAK;QAAC,IAC3C,CAAC;YACLT,WAAW4B;YACXkD,WAAWpD,KAAKoD,SAAS;YACzBtE,MAAM,EAAEA,iBAAAA,SAAUuE,QAAOvC,uBAAAA,YAAY,CAAC,SAAS,YAAtBA,uBAA0B;YACnDwC,cAAclD,MAAM6C,GAAG;YACvBM,WAAWxG,WAAWyB,eAAe;YACrCD,WAAWxB,WAAWyB,eAAe;;IAEzC,EAAE,OAAO6D,OAAO;QACdC,QAAQD,KAAK,CAAC,wCAAwCnC,YAAYmC;IACpE;IAEA,uEAAuE;IACvE,uEAAuE;IACvE,IAAIvD,QAAQ;QACV,MAAM5B,gBAAgB4B,QAAQsB,OAAO,CAAC,YAAY,EAAEmC,aAAa,EAAE;YACjEiB,MAAM;YACNrB,IAAIjC;YACJuD,MAAMhB,gBAAgBD;QACxB;IACF;IAEA,OAAO;QACLnC,IAAI;QACJH;QACAsC;QACArC;QACAoC;QACA1D,QAAQmB,KAAKnB,MAAM;QACnB6E,WAAW;YAAE3C;YAAOC;YAAOC;YAAYG;QAAM;IAC/C;AACF"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/contact-merge.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * MERGING TWO CONTACTS — the write (AGL-2625).\n *\n * `planContactMerge` says what the survivor becomes; this performs it, and\n * moves everything that pointed at the merged record. One function behind\n * two doors — the console's `crm/contacts-merge` route and\n * `POST /v1/contacts/{id}/merge` — so the REST caller and the record page\n * cannot merge two different ways.\n *\n * ## The order is the crash-safety argument\n *\n *  1. Every deal, task and activity naming the merged contact is repointed\n *     at the survivor, and every lead converted into it. Batched, bounded,\n *     idempotent: a re-run finds nothing left to move.\n *  2. Then, in ONE transaction: the survivor takes the plan, every address\n *     it now answers to is indexed at it, and the merged document is\n *     deleted — with both records re-read inside the transaction, so two\n *     merges racing on one pair cannot both succeed and a plan is never\n *     computed on a document that changed under it.\n *\n * Children first because a process that dies between the two steps leaves\n * children pointing at a record that EXISTS — the survivor — while the merged\n * document is still there for a retry to fold in. The other order would\n * leave deals pointing at a deleted contact, which is a record nobody can\n * open from anywhere.\n *\n * ## What it does not move\n *\n * List memberships, suppression entries and the delivery log are keyed by\n * ADDRESS, not by contact id, and stay under the merged address; a capture\n * on that address resolves to the survivor through the index, which is the\n * fact those keys need. A company's contacts count drops only for a company\n * both records named — the survivor still names the rest.\n */\n\nimport {\n  CONTACT_EMAIL_INDEX_COLLECTION,\n  contactEmails,\n} from '@aglyn/aglyn/app-utils/contacts'\nimport type { HostActivityActor } from '@aglyn/aglyn/app-utils/activity-presenter'\nimport { planContactMerge } from '@aglyn/aglyn/app-utils/contact-merge'\nimport { CRM_COLLECTIONS } from '@aglyn/aglyn/app-utils/crm'\nimport { personKey } from '@aglyn/aglyn/app-utils/person-key'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { settleCompanyContactsCounts } from './contact-company-link'\nimport { recomputeCrmNextTaskAt } from './crm-next-activity'\nimport { logHostActivity } from './organizations'\n\n/** How many pointing rows one repoint pass reads — and one batch writes. */\nconst REPOINT_PAGE = 400\n/** A ceiling on passes, so a query that keeps answering cannot loop forever. */\nconst REPOINT_PASSES = 25\n\nexport interface MergeContactsOptions {\n  firestore: FirebaseFirestore.Firestore\n  /** `orgs/{orgId}` — the org whose contacts both records are. */\n  orgRef: FirebaseFirestore.DocumentReference\n  /** The record that stays, and keeps its address as the identity. */\n  survivorId: string\n  /** The record folded in and deleted. */\n  mergedId: string\n  actor: HostActivityActor\n  /**\n   * The site whose console did the work: where the activity feed entry\n   * lands, and the site a timeline note is filed under. `null` for a door\n   * with no site — the REST API — which logs no host entry.\n   */\n  hostId: string | null\n  /** The actor's display name for the timeline note, when the door knows it. */\n  actorName?: string | null\n}\n\nexport interface MergeContactsRepointed {\n  deals: number\n  tasks: number\n  activities: number\n  leads: number\n}\n\nexport type MergeContactsResult =\n  | {\n      ok: true\n      survivorId: string\n      survivorEmail: string\n      mergedId: string\n      mergedEmail: string\n      /** Every address the survivor answers to now, primary first. */\n      emails: string[]\n      repointed: MergeContactsRepointed\n    }\n  | { ok: false; reason: 'same-record' | 'survivor-missing' | 'merged-missing' }\n\n/**\n * Point every row of `collection` whose `contactId` is `from` at `to`.\n *\n * Page, batch, repeat: each pass reads the rows still pointing at the\n * merged record — the ones a previous pass moved no longer match — so the\n * loop ends when a pass finds nothing. `updatedAt` moves with the pointer\n * because an integration syncing by `updatedAfter` has to see the change.\n */\nasync function repointContactId(\n  firestore: FirebaseFirestore.Firestore,\n  collection: FirebaseFirestore.CollectionReference,\n  from: string,\n  to: string,\n): Promise<number> {\n  let moved = 0\n  for (let pass = 0; pass < REPOINT_PASSES; pass += 1) {\n    const page = await collection\n      .where('contactId', '==', from)\n      .limit(REPOINT_PAGE)\n      .get()\n    if (page.empty) break\n    const batch = firestore.batch()\n    for (const row of page.docs) {\n      batch.update(row.ref, {\n        contactId: to,\n        updatedAt: FieldValue.serverTimestamp(),\n      })\n    }\n    await batch.commit()\n    moved += page.size\n    if (page.size < REPOINT_PAGE) break\n  }\n  return moved\n}\n\n/**\n * The leads converted into the merged contact, restamped at the survivor.\n *\n * A lead lives at `orgs/{orgId}/leads/{personKey(email)}` (AGL-3275), so there\n * is still no query — one document per address, asked for directly. This used\n * to be bounded by sites TIMES addresses because a lead lived under each site;\n * it is bounded by addresses now, and the sites drop out of the signature\n * because the collection no longer has one per site to walk.\n */\nasync function repointLeads(\n  orgRef: FirebaseFirestore.DocumentReference,\n  emails: readonly string[],\n  from: string,\n  to: string,\n): Promise<number> {\n  let moved = 0\n  /*\n   * ONE ROW PER ADDRESS, on the org (AGL-3275). This walked the sites because\n   * there was a lead under each of them; re-pointing the same document once\n   * per site would now be the same write repeated, and the second would find\n   * `convertedContactId` already moved and skip — a silent undercount rather\n   * than a wrong answer, but an undercount the caller reports to the operator.\n   */\n  for (const email of emails) {\n    const key = personKey(email)\n    if (!key) continue\n    const leadRef = orgRef.collection('leads').doc(key)\n    const lead = await leadRef.get()\n    if (!lead.exists || lead.get('convertedContactId') !== from) continue\n    await leadRef.update({\n      convertedContactId: to,\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n    moved += 1\n  }\n  return moved\n}\n\nfunction strings(value: unknown): string[] {\n  return Array.isArray(value)\n    ? value.filter((item): item is string => typeof item === 'string' && item !== '')\n    : []\n}\n\nexport async function mergeContacts(\n  options: MergeContactsOptions,\n): Promise<MergeContactsResult> {\n  const { firestore, orgRef, survivorId, mergedId, actor, hostId } = options\n  if (!survivorId || !mergedId || survivorId === mergedId) {\n    return { ok: false, reason: 'same-record' }\n  }\n  const contactsRef = orgRef.collection('contacts')\n  const survivorRef = contactsRef.doc(survivorId)\n  const mergedRef = contactsRef.doc(mergedId)\n  const [survivorBefore, mergedBefore] = await Promise.all([\n    survivorRef.get(),\n    mergedRef.get(),\n  ])\n  if (!survivorBefore.exists) return { ok: false, reason: 'survivor-missing' }\n  if (!mergedBefore.exists) return { ok: false, reason: 'merged-missing' }\n  const mergedData = (mergedBefore.data() ?? {}) as Record<string, unknown>\n  const survivorData = (survivorBefore.data() ?? {}) as Record<string, unknown>\n\n  /*==========================================\n   * 1. THE CHILDREN — before the parent, for the reason the header gives.\n   *=========================================*/\n  const [deals, tasks, activities] = await Promise.all([\n    repointContactId(firestore, orgRef.collection(CRM_COLLECTIONS.deals), mergedId, survivorId),\n    repointContactId(firestore, orgRef.collection(CRM_COLLECTIONS.tasks), mergedId, survivorId),\n    repointContactId(\n      firestore,\n      orgRef.collection(CRM_COLLECTIONS.activities),\n      mergedId,\n      survivorId,\n    ),\n  ])\n  const leadHosts = [\n    ...new Set([\n      ...strings(mergedData['capturedByHostIds']),\n      ...strings(survivorData['capturedByHostIds']),\n      ...strings([mergedData['hostId'], survivorData['hostId'], hostId]),\n    ]),\n  ]\n  const leads = await repointLeads(\n    orgRef,\n    contactEmails(mergedData),\n    mergedId,\n    survivorId,\n  )\n\n  /*==========================================\n   * 2. THE SWAP — one transaction over both documents and the index.\n   *=========================================*/\n  const index = orgRef.collection(CONTACT_EMAIL_INDEX_COLLECTION)\n  const swapped = await firestore.runTransaction(async (transaction) => {\n    const [survivor, merged] = await Promise.all([\n      transaction.get(survivorRef),\n      transaction.get(mergedRef),\n    ])\n    if (!survivor.exists) return { reason: 'survivor-missing' as const }\n    if (!merged.exists) return { reason: 'merged-missing' as const }\n    const plan = planContactMerge(\n      (survivor.data() ?? {}) as Record<string, unknown>,\n      (merged.data() ?? {}) as Record<string, unknown>,\n    )\n    transaction.set(\n      survivorRef,\n      { ...plan.survivor, updatedAt: FieldValue.serverTimestamp() },\n      { merge: true },\n    )\n    for (const email of plan.emails) {\n      const key = personKey(email)\n      if (!key) continue\n      transaction.set(\n        index.doc(key),\n        { email, contactId: survivorId, updatedAt: FieldValue.serverTimestamp() },\n        { merge: true },\n      )\n    }\n    transaction.delete(mergedRef)\n    return { plan, survivor: (survivor.data() ?? {}) as Record<string, unknown> }\n  })\n  if ('reason' in swapped) return { ok: false, reason: swapped.reason }\n  const { plan } = swapped\n\n  /*\n   * The companies both records named counted two people and now count one\n   * (AGL-2613). Settled after the swap the way the capture settles its\n   * counts: a figure that could not move is logged, and the company page's\n   * live aggregate corrects it.\n   */\n  await settleCompanyContactsCounts(orgRef.collection(CRM_COLLECTIONS.companies), {\n    companyId: null,\n    mirror: null,\n    counts: plan.companyCounts,\n  })\n  /*\n   * The survivor now owns the merged record's open tasks too, so its next\n   * activity is the earliest of both (AGL-2661). Settled the same way: a\n   * figure that could not move is logged, and the Fields section's\n   * recompute corrects it.\n   */\n  await recomputeCrmNextTaskAt(firestore, orgRef.id, [{ contactId: survivorId }]).catch(\n    (error: unknown) => {\n      console.error('contact merge next activity could not be recomputed', survivorId, error)\n    },\n  )\n\n  const mergedEmail = contactEmails(mergedData)[0] ?? ''\n  const survivorEmail = plan.emails[0] ?? ''\n  // The canonical name — the one identity every holder shares — for the\n  // feed; the address stands in for a person nobody has named.\n  const survivorName =\n    typeof swapped.survivor['name'] === 'string' ? swapped.survivor['name'] : ''\n\n  /*\n   * THE TIMELINE NOTE, on the survivor: the merge is an event in this\n   * person's history, and the record page is where a reader looks for one.\n   * Filed under the calling site, or the survivor's first site for a door\n   * with none; its own catch, because a note that could not be written must\n   * not read as a merge that did not happen.\n   */\n  try {\n    await orgRef.collection(CRM_COLLECTIONS.activities).add({\n      kind: 'note',\n      body: `Merged with ${mergedEmail}`,\n      atMs: Date.now(),\n      byUid: actor.uid,\n      ...(options.actorName || actor.email\n        ? { byName: options.actorName || actor.email }\n        : {}),\n      contactId: survivorId,\n      visibleTo: plan.visibleTo,\n      hostId: hostId ?? String(survivorData['hostId'] ?? ''),\n      createdByUid: actor.uid,\n      createdAt: FieldValue.serverTimestamp(),\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n  } catch (error) {\n    console.error('[contact-merge] timeline note failed', survivorId, error)\n  }\n\n  // The audit line (AGL-2622), in the feed of the site whose console did\n  // the work. A door with no site — the API — has no host feed to write.\n  if (hostId) {\n    await logHostActivity(hostId, actor, `Merged with ${mergedEmail}`, {\n      type: 'contact',\n      id: survivorId,\n      name: survivorName || survivorEmail,\n    })\n  }\n\n  return {\n    ok: true,\n    survivorId,\n    survivorEmail,\n    mergedId,\n    mergedEmail,\n    emails: plan.emails,\n    repointed: { deals, tasks, activities, leads },\n  }\n}\n"],"names":["CONTACT_EMAIL_INDEX_COLLECTION","contactEmails","planContactMerge","CRM_COLLECTIONS","personKey","FieldValue","settleCompanyContactsCounts","recomputeCrmNextTaskAt","logHostActivity","REPOINT_PAGE","REPOINT_PASSES","repointContactId","firestore","collection","from","to","moved","pass","page","where","limit","get","empty","batch","row","docs","update","ref","contactId","updatedAt","serverTimestamp","commit","size","repointLeads","orgRef","emails","email","key","leadRef","doc","lead","exists","convertedContactId","strings","value","Array","isArray","filter","item","mergeContacts","options","mergedBefore","survivorBefore","plan","survivorId","mergedId","actor","hostId","ok","reason","contactsRef","survivorRef","mergedRef","Promise","all","mergedData","data","survivorData","deals","tasks","activities","leadHosts","Set","leads","index","swapped","runTransaction","transaction","survivor","merged","set","merge","delete","companies","companyId","mirror","counts","companyCounts","id","catch","error","console","mergedEmail","survivorEmail","survivorName","add","kind","body","atMs","Date","now","byUid","uid","actorName","byName","visibleTo","String","createdByUid","createdAt","type","name","repointed"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCC,GAED,SACEA,8BAA8B,EAC9BC,aAAa,QACR,kCAAiC;AAExC,SAASC,gBAAgB,QAAQ,uCAAsC;AACvE,SAASC,eAAe,QAAQ,6BAA4B;AAC5D,SAASC,SAAS,QAAQ,oCAAmC;AAC7D,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,2BAA2B,QAAQ,4BAAwB;AACpE,SAASC,sBAAsB,QAAQ,yBAAqB;AAC5D,SAASC,eAAe,QAAQ,qBAAiB;AAEjD,0EAA0E,GAC1E,MAAMC,eAAe;AACrB,8EAA8E,GAC9E,MAAMC,iBAAiB;AAyCvB;;;;;;;CAOC,GACD,eAAeC,iBACbC,SAAsC,EACtCC,UAAiD,EACjDC,IAAY,EACZC,EAAU;IAEV,IAAIC,QAAQ;IACZ,IAAK,IAAIC,OAAO,GAAGA,OAAOP,gBAAgBO,QAAQ,EAAG;QACnD,MAAMC,OAAO,MAAML,WAChBM,KAAK,CAAC,aAAa,MAAML,MACzBM,KAAK,CAACX,cACNY,GAAG;QACN,IAAIH,KAAKI,KAAK,EAAE;QAChB,MAAMC,QAAQX,UAAUW,KAAK;QAC7B,KAAK,MAAMC,OAAON,KAAKO,IAAI,CAAE;YAC3BF,MAAMG,MAAM,CAACF,IAAIG,GAAG,EAAE;gBACpBC,WAAWb;gBACXc,WAAWxB,WAAWyB,eAAe;YACvC;QACF;QACA,MAAMP,MAAMQ,MAAM;QAClBf,SAASE,KAAKc,IAAI;QAClB,IAAId,KAAKc,IAAI,GAAGvB,cAAc;IAChC;IACA,OAAOO;AACT;AAEA;;;;;;;;CAQC,GACD,eAAeiB,aACbC,MAA2C,EAC3CC,MAAyB,EACzBrB,IAAY,EACZC,EAAU;IAEV,IAAIC,QAAQ;IACZ;;;;;;GAMC,GACD,KAAK,MAAMoB,SAASD,OAAQ;QAC1B,MAAME,MAAMjC,UAAUgC;QACtB,IAAI,CAACC,KAAK;QACV,MAAMC,UAAUJ,OAAOrB,UAAU,CAAC,SAAS0B,GAAG,CAACF;QAC/C,MAAMG,OAAO,MAAMF,QAAQjB,GAAG;QAC9B,IAAI,CAACmB,KAAKC,MAAM,IAAID,KAAKnB,GAAG,CAAC,0BAA0BP,MAAM;QAC7D,MAAMwB,QAAQZ,MAAM,CAAC;YACnBgB,oBAAoB3B;YACpBc,WAAWxB,WAAWyB,eAAe;QACvC;QACAd,SAAS;IACX;IACA,OAAOA;AACT;AAEA,SAAS2B,QAAQC,KAAc;IAC7B,OAAOC,MAAMC,OAAO,CAACF,SACjBA,MAAMG,MAAM,CAAC,CAACC,OAAyB,OAAOA,SAAS,YAAYA,SAAS,MAC5E,EAAE;AACR;AAEA,OAAO,eAAeC,cACpBC,OAA6B;QAeTC,oBACEC,sBAuFFnD,iBACEoD;IAtGtB,MAAM,EAAEzC,SAAS,EAAEsB,MAAM,EAAEoB,UAAU,EAAEC,QAAQ,EAAEC,KAAK,EAAEC,MAAM,EAAE,GAAGP;IACnE,IAAI,CAACI,cAAc,CAACC,YAAYD,eAAeC,UAAU;QACvD,OAAO;YAAEG,IAAI;YAAOC,QAAQ;QAAc;IAC5C;IACA,MAAMC,cAAc1B,OAAOrB,UAAU,CAAC;IACtC,MAAMgD,cAAcD,YAAYrB,GAAG,CAACe;IACpC,MAAMQ,YAAYF,YAAYrB,GAAG,CAACgB;IAClC,MAAM,CAACH,gBAAgBD,aAAa,GAAG,MAAMY,QAAQC,GAAG,CAAC;QACvDH,YAAYxC,GAAG;QACfyC,UAAUzC,GAAG;KACd;IACD,IAAI,CAAC+B,eAAeX,MAAM,EAAE,OAAO;QAAEiB,IAAI;QAAOC,QAAQ;IAAmB;IAC3E,IAAI,CAACR,aAAaV,MAAM,EAAE,OAAO;QAAEiB,IAAI;QAAOC,QAAQ;IAAiB;IACvE,MAAMM,cAAcd,qBAAAA,aAAae,IAAI,cAAjBf,qBAAuB,CAAC;IAC5C,MAAMgB,gBAAgBf,uBAAAA,eAAec,IAAI,cAAnBd,uBAAyB,CAAC;IAEhD;;6CAE2C,GAC3C,MAAM,CAACgB,OAAOC,OAAOC,WAAW,GAAG,MAAMP,QAAQC,GAAG,CAAC;QACnDrD,iBAAiBC,WAAWsB,OAAOrB,UAAU,CAACV,gBAAgBiE,KAAK,GAAGb,UAAUD;QAChF3C,iBAAiBC,WAAWsB,OAAOrB,UAAU,CAACV,gBAAgBkE,KAAK,GAAGd,UAAUD;QAChF3C,iBACEC,WACAsB,OAAOrB,UAAU,CAACV,gBAAgBmE,UAAU,GAC5Cf,UACAD;KAEH;IACD,MAAMiB,YAAY;WACb,IAAIC,IAAI;eACN7B,QAAQsB,UAAU,CAAC,oBAAoB;eACvCtB,QAAQwB,YAAY,CAAC,oBAAoB;eACzCxB,QAAQ;gBAACsB,UAAU,CAAC,SAAS;gBAAEE,YAAY,CAAC,SAAS;gBAAEV;aAAO;SAClE;KACF;IACD,MAAMgB,QAAQ,MAAMxC,aAClBC,QACAjC,cAAcgE,aACdV,UACAD;IAGF;;6CAE2C,GAC3C,MAAMoB,QAAQxC,OAAOrB,UAAU,CAACb;IAChC,MAAM2E,UAAU,MAAM/D,UAAUgE,cAAc,CAAC,OAAOC;YAQjDC,gBACAC,cAiBuBD;QAzB1B,MAAM,CAACA,UAAUC,OAAO,GAAG,MAAMhB,QAAQC,GAAG,CAAC;YAC3Ca,YAAYxD,GAAG,CAACwC;YAChBgB,YAAYxD,GAAG,CAACyC;SACjB;QACD,IAAI,CAACgB,SAASrC,MAAM,EAAE,OAAO;YAAEkB,QAAQ;QAA4B;QACnE,IAAI,CAACoB,OAAOtC,MAAM,EAAE,OAAO;YAAEkB,QAAQ;QAA0B;QAC/D,MAAMN,OAAOnD,kBACV4E,iBAAAA,SAASZ,IAAI,cAAbY,iBAAmB,CAAC,IACpBC,eAAAA,OAAOb,IAAI,cAAXa,eAAiB,CAAC;QAErBF,YAAYG,GAAG,CACbnB,aACA,aAAKR,KAAKyB,QAAQ;YAAEjD,WAAWxB,WAAWyB,eAAe;YACzD;YAAEmD,OAAO;QAAK;QAEhB,KAAK,MAAM7C,SAASiB,KAAKlB,MAAM,CAAE;YAC/B,MAAME,MAAMjC,UAAUgC;YACtB,IAAI,CAACC,KAAK;YACVwC,YAAYG,GAAG,CACbN,MAAMnC,GAAG,CAACF,MACV;gBAAED;gBAAOR,WAAW0B;gBAAYzB,WAAWxB,WAAWyB,eAAe;YAAG,GACxE;gBAAEmD,OAAO;YAAK;QAElB;QACAJ,YAAYK,MAAM,CAACpB;QACnB,OAAO;YAAET;YAAMyB,QAAQ,GAAGA,kBAAAA,SAASZ,IAAI,cAAbY,kBAAmB,CAAC;QAA8B;IAC9E;IACA,IAAI,YAAYH,SAAS,OAAO;QAAEjB,IAAI;QAAOC,QAAQgB,QAAQhB,MAAM;IAAC;IACpE,MAAM,EAAEN,IAAI,EAAE,GAAGsB;IAEjB;;;;;GAKC,GACD,MAAMrE,4BAA4B4B,OAAOrB,UAAU,CAACV,gBAAgBgF,SAAS,GAAG;QAC9EC,WAAW;QACXC,QAAQ;QACRC,QAAQjC,KAAKkC,aAAa;IAC5B;IACA;;;;;GAKC,GACD,MAAMhF,uBAAuBK,WAAWsB,OAAOsD,EAAE,EAAE;QAAC;YAAE5D,WAAW0B;QAAW;KAAE,EAAEmC,KAAK,CACnF,CAACC;QACCC,QAAQD,KAAK,CAAC,uDAAuDpC,YAAYoC;IACnF;IAGF,MAAME,eAAc3F,kBAAAA,cAAcgE,WAAW,CAAC,EAAE,YAA5BhE,kBAAgC;IACpD,MAAM4F,iBAAgBxC,gBAAAA,KAAKlB,MAAM,CAAC,EAAE,YAAdkB,gBAAkB;IACxC,sEAAsE;IACtE,6DAA6D;IAC7D,MAAMyC,eACJ,OAAOnB,QAAQG,QAAQ,CAAC,OAAO,KAAK,WAAWH,QAAQG,QAAQ,CAAC,OAAO,GAAG;IAE5E;;;;;;GAMC,GACD,IAAI;YAWyBX;QAV3B,MAAMjC,OAAOrB,UAAU,CAACV,gBAAgBmE,UAAU,EAAEyB,GAAG,CAAC;YACtDC,MAAM;YACNC,MAAM,CAAC,YAAY,EAAEL,aAAa;YAClCM,MAAMC,KAAKC,GAAG;YACdC,OAAO7C,MAAM8C,GAAG;WACZpD,QAAQqD,SAAS,IAAI/C,MAAMpB,KAAK,GAChC;YAAEoE,QAAQtD,QAAQqD,SAAS,IAAI/C,MAAMpB,KAAK;QAAC,IAC3C,CAAC;YACLR,WAAW0B;YACXmD,WAAWpD,KAAKoD,SAAS;YACzBhD,MAAM,EAAEA,iBAAAA,SAAUiD,QAAOvC,uBAAAA,YAAY,CAAC,SAAS,YAAtBA,uBAA0B;YACnDwC,cAAcnD,MAAM8C,GAAG;YACvBM,WAAWvG,WAAWyB,eAAe;YACrCD,WAAWxB,WAAWyB,eAAe;;IAEzC,EAAE,OAAO4D,OAAO;QACdC,QAAQD,KAAK,CAAC,wCAAwCpC,YAAYoC;IACpE;IAEA,uEAAuE;IACvE,uEAAuE;IACvE,IAAIjC,QAAQ;QACV,MAAMjD,gBAAgBiD,QAAQD,OAAO,CAAC,YAAY,EAAEoC,aAAa,EAAE;YACjEiB,MAAM;YACNrB,IAAIlC;YACJwD,MAAMhB,gBAAgBD;QACxB;IACF;IAEA,OAAO;QACLnC,IAAI;QACJJ;QACAuC;QACAtC;QACAqC;QACAzD,QAAQkB,KAAKlB,MAAM;QACnB4E,WAAW;YAAE3C;YAAOC;YAAOC;YAAYG;QAAM;IAC/C;AACF"}

package/src/lib/server/crm-booking-activity.js

@@ -17,6 +17,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  */ import { checkEntitlement, consentGroupForHost, CRM_COLLECTIONS, crmActivityLogHasRoom, crmBookingFollowUpDueMs, crmBookingFollowUpTitle, crmBookingMeetingBody, crmScopeTokens, isHostPluginEnabled, parseCrmBookingRef, readContactFacet, visibleToHost } from "@aglyn/aglyn/server";
 import { FieldValue } from "firebase-admin/firestore";
 import { findContactByEmail } from "./contact-email-index.js";
+import { readLeadForHost } from "./host-visitor-records.js";
 import { countCrmActivitiesForRecord } from "./crm-records.js";
 /**
  * WHAT A BOOKING FILES ON THE CRM RECORD (AGL-2660).
@@ -104,9 +105,13 @@ import { countCrmActivitiesForRecord } from "./crm-records.js";
         }
     }
     if ((ref == null ? void 0 : ref.kind) === 'lead') {
-        // A lead is host-scoped by path and carries no `visibleTo` of its own.
-        const lead = await firestore.collection('hosts').doc(hostId).collection('leads').doc(ref.id).get();
-        if (lead.exists) {
+        /*
+     * A lead carries its own `visibleTo` now (AGL-3275) — it used to be
+     * host-scoped by path, and the comment here said so. The seam reads the
+     * org row, and the site has to be allowed to see it before a booking is
+     * filed against it, or one brand's booking would name another's lead.
+     */ const lead = await readLeadForHost(hostId, ref.id);
+        if (lead && visibleToHost(lead.get('visibleTo'), hostId)) {
             var _lead_get;
             const ownerUid = String((_lead_get = lead.get('ownerUid')) != null ? _lead_get : '');
             return _extends({

package/src/lib/server/crm-booking-activity.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/crm-booking-activity.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  checkEntitlement,\n  consentGroupForHost,\n  CRM_COLLECTIONS,\n  type CrmActivity,\n  type CrmActivityLink,\n  type CrmTask,\n  crmActivityLogHasRoom,\n  crmBookingFollowUpDueMs,\n  crmBookingFollowUpTitle,\n  crmBookingMeetingBody,\n  crmScopeTokens,\n  isHostPluginEnabled,\n  parseCrmBookingRef,\n  readContactFacet,\n  visibleToHost,\n} from '@aglyn/aglyn/server'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { findContactByEmail } from './contact-email-index'\nimport { countCrmActivitiesForRecord } from './crm-records'\n\n/**\n * WHAT A BOOKING FILES ON THE CRM RECORD (AGL-2660).\n *\n * A confirmed booking is a meeting the record has on its calendar, and the\n * timeline should say so without a rep logging it by hand. So once a\n * booking's row is written — at creation for a free service, on payment\n * for a paid one — the record is found and a `meeting` activity filed under\n * it, with a follow-up task beside it when the service asks for one.\n *\n * ## Which record\n *\n * The reference the booking link carried wins: `crmRef` names the contact,\n * lead or deal the rep dropped the link from, and a booking made through\n * that link belongs to that record even when the booker typed a different\n * address. Without one — a booking taken off the widget cold — the booker's\n * address is looked up through the org's address index, narrowed to this\n * site, exactly as the automation steps resolve an event's contact. A\n * reference to a record the site cannot see, or that no longer exists,\n * falls through to the address rather than filing under nobody.\n *\n * ## Where it lives\n *\n * In the admin library rather than the Bookings plugin, because the row is\n * a CRM record: its scope, its ceiling and its collections are the CRM's,\n * and a plugin that stamped its own would be a second creator to keep in\n * step with `crmScopeTokens`. The Bookings plugin passes what it already\n * holds and reads the outcome; the CRM plugin is never imported.\n *\n * Firestore is a parameter, as in `crm-records.ts`: the callers hold one,\n * and a module that reached for the Admin app itself would drag it into\n * every spec that only wants the arithmetic.\n *\n * ## Failure posture\n *\n * **Never throws.** A booking that could not be filed on the CRM is still\n * a booking — the guest has the slot and the confirmation — so a failure\n * here is logged and reported in the outcome, never raised into the\n * request that took the booking or the webhook that confirmed it.\n */\n\n/** The CRM plugin's id, as `enabledPlugins` and `disabledPlugins` name it. */\nconst CRM_PLUGIN_ID = 'crm'\n\nexport interface CrmBookingRecordInput {\n  hostId: string\n  /**\n   * The owning org, as `getOrgForHost` returns it — the plugin set, the\n   * consent groups and the scope default are all read off it.\n   */\n  org: Record<string, unknown> | null | undefined\n  orgId: string\n  /** The booking as its row was written. */\n  booking: {\n    id: string\n    serviceId?: string\n    serviceName?: string\n    email?: string\n    startsAtMs: number\n    endsAtMs: number\n    /** The `crm` query value the link carried, kept on the row. */\n    crmRef?: string | null\n  }\n  /** The service as stored: its two CRM switches and its timezone. */\n  service:\n    | {\n        name?: string\n        timezone?: string\n        crmFollowUpTask?: boolean\n        crmMeetingActivity?: boolean\n      }\n    | null\n    | undefined\n  /**\n   * The host document's plugin fields, when the caller already holds them;\n   * read here otherwise. The deny-list is per site, and a site that has\n   * switched the CRM off must file nothing.\n   */\n  host?: { disabledPlugins?: string[]; enabledPlugins?: string[] } | null\n}\n\nexport type CrmBookingRecordOutcome =\n  | {\n      filed: false\n      reason:\n        /** The CRM plugin does not run on this site. */\n        | 'crm-off'\n        /**\n         * The org's plan does not carry the CRM suite, whose activities and\n         * tasks these are (AGL-2787).\n         */\n        | 'not-entitled'\n        /** Neither the reference nor the address named a record. */\n        | 'no-record'\n        /** A meeting for this booking is already on the timeline. */\n        | 'already-filed'\n        /** The service asks for neither a meeting nor a follow-up. */\n        | 'nothing-to-file'\n        /** A read or a write threw; logged, and nothing is promised. */\n        | 'failed'\n    }\n  | {\n      filed: true\n      /** How the record was found. */\n      matchedBy: 'crmRef' | 'email'\n      link: CrmActivityLink\n      /** The meeting's id, or `null` when the service files no meeting. */\n      activityId: string | null\n      /** The follow-up's id, or `null` when the service asks for none. */\n      taskId: string | null\n    }\n\ninterface ResolvedRecord {\n  link: CrmActivityLink\n  matchedBy: 'crmRef' | 'email'\n  /** Whoever holds the relationship, for the follow-up's assignee. */\n  ownerUid?: string\n}\n\n/**\n * The record a booking belongs to — the reference first, the address second.\n */\nasync function resolveBookingRecord(\n  firestore: FirebaseFirestore.Firestore,\n  input: CrmBookingRecordInput,\n  groupId: string,\n): Promise<ResolvedRecord | null> {\n  const { hostId, orgId } = input\n  const orgRef = firestore.collection('orgs').doc(orgId)\n  const contactsRef = orgRef.collection('contacts')\n  const ref = parseCrmBookingRef(input.booking.crmRef)\n  if (ref?.kind === 'contact') {\n    const contact = await contactsRef.doc(ref.id).get()\n    if (contact.exists && visibleToHost(contact.get('visibleTo'), hostId)) {\n      const facet = readContactFacet(contact.data() ?? {}, groupId)\n      return {\n        link: {\n          contactId: contact.id,\n          ...(facet.companyId ? { companyId: facet.companyId } : {}),\n        },\n        matchedBy: 'crmRef',\n        ...(facet.ownerUid ? { ownerUid: facet.ownerUid } : {}),\n      }\n    }\n  }\n  if (ref?.kind === 'deal') {\n    const deal = await orgRef.collection(CRM_COLLECTIONS.deals).doc(ref.id).get()\n    if (deal.exists && visibleToHost(deal.get('visibleTo'), hostId)) {\n      const contactId = String(deal.get('contactId') ?? '')\n      const companyId = String(deal.get('companyId') ?? '')\n      const ownerUid = String(deal.get('ownerUid') ?? '')\n      return {\n        link: {\n          dealId: deal.id,\n          ...(contactId ? { contactId } : {}),\n          ...(companyId ? { companyId } : {}),\n        },\n        matchedBy: 'crmRef',\n        ...(ownerUid ? { ownerUid } : {}),\n      }\n    }\n  }\n  if (ref?.kind === 'lead') {\n    // A lead is host-scoped by path and carries no `visibleTo` of its own.\n    const lead = await firestore\n      .collection('hosts')\n      .doc(hostId)\n      .collection('leads')\n      .doc(ref.id)\n      .get()\n    if (lead.exists) {\n      const ownerUid = String(lead.get('ownerUid') ?? '')\n      return {\n        link: { leadId: lead.id },\n        matchedBy: 'crmRef',\n        ...(ownerUid ? { ownerUid } : {}),\n      }\n    }\n  }\n  const hit = await findContactByEmail(contactsRef, input.booking.email, { hostId })\n  if (!hit) return null\n  const facet = readContactFacet(hit.data() ?? {}, groupId)\n  return {\n    link: {\n      contactId: hit.id,\n      ...(facet.companyId ? { companyId: facet.companyId } : {}),\n    },\n    matchedBy: 'email',\n    ...(facet.ownerUid ? { ownerUid: facet.ownerUid } : {}),\n  }\n}\n\n/**\n * Files what a confirmed booking owes the CRM: the meeting, and the\n * follow-up when the service asks for one. See the module comment.\n */\nexport async function recordCrmBooking(\n  firestore: FirebaseFirestore.Firestore,\n  input: CrmBookingRecordInput,\n): Promise<CrmBookingRecordOutcome> {\n  const { hostId, orgId, booking, service } = input\n  try {\n    if (!hostId || !orgId || !booking?.id) return { filed: false, reason: 'failed' }\n    const wantsMeeting = service?.crmMeetingActivity !== false\n    const wantsTask = service?.crmFollowUpTask === true\n    if (!wantsMeeting && !wantsTask) return { filed: false, reason: 'nothing-to-file' }\n\n    const host =\n      input.host === undefined\n        ? ((await firestore.collection('hosts').doc(hostId).get()).data() as\n            | { disabledPlugins?: string[]; enabledPlugins?: string[] }\n            | undefined) ?? null\n        : input.host\n    if (!isHostPluginEnabled(input.org ?? null, host, CRM_PLUGIN_ID)) {\n      return { filed: false, reason: 'crm-off' }\n    }\n    if (!checkEntitlement(input.org as Parameters<typeof checkEntitlement>[0], 'crm')) {\n      return { filed: false, reason: 'not-entitled' }\n    }\n\n    const orgRef = firestore.collection('orgs').doc(orgId)\n    const activities = orgRef.collection(CRM_COLLECTIONS.activities)\n    // One meeting per booking, whatever path re-enters: the paid webhook is\n    // redelivered for days after any 500, and its own guard is the status,\n    // which this row is not part of.\n    const already = await activities.where('bookingId', '==', booking.id).limit(1).get()\n    if (!already.empty) return { filed: false, reason: 'already-filed' }\n\n    const group = consentGroupForHost(input.org ?? null, hostId)\n    const record = await resolveBookingRecord(firestore, input, group.groupId)\n    if (!record) return { filed: false, reason: 'no-record' }\n\n    const visibleTo = crmScopeTokens(input.org ?? null, group)\n    const serviceName = String(service?.name ?? booking.serviceName ?? '').trim()\n    const timezone = service?.timezone || undefined\n\n    let activityId: string | null = null\n    if (wantsMeeting) {\n      // The per-record ceiling (AGL-2611): a full log refuses the meeting\n      // but not the follow-up — a task is owed either way.\n      const logged = await countCrmActivitiesForRecord(orgRef, record.link)\n      if (crmActivityLogHasRoom(logged)) {\n        const activity: CrmActivity = {\n          kind: 'meeting',\n          body: crmBookingMeetingBody({\n            serviceName,\n            startsAtMs: booking.startsAtMs,\n            timezone,\n          }),\n          // When it HAPPENS, which is the slot — not when it was booked.\n          atMs: booking.startsAtMs,\n          byUid: '',\n          ...record.link,\n          bookingId: booking.id,\n          hostId,\n          visibleTo,\n          createdAt: FieldValue.serverTimestamp(),\n          updatedAt: FieldValue.serverTimestamp(),\n        }\n        const written = await activities.add(activity)\n        activityId = written.id\n      }\n    }\n\n    let taskId: string | null = null\n    if (wantsTask) {\n      const task: CrmTask = {\n        title: crmBookingFollowUpTitle(serviceName),\n        kind: 'todo',\n        priority: 'normal',\n        status: 'open',\n        dueAtMs: crmBookingFollowUpDueMs(booking.endsAtMs, timezone),\n        ...(record.ownerUid ? { assigneeUid: record.ownerUid } : {}),\n        createdByUid: '',\n        ...record.link,\n        hostId,\n        visibleTo,\n        createdAt: FieldValue.serverTimestamp(),\n        updatedAt: FieldValue.serverTimestamp(),\n      }\n      const written = await orgRef.collection(CRM_COLLECTIONS.tasks).add(task)\n      taskId = written.id\n    }\n\n    return { filed: true, matchedBy: record.matchedBy, link: record.link, activityId, taskId }\n  } catch (error) {\n    console.error('[crm] booking could not be filed', hostId, booking?.id, error)\n    return { filed: false, reason: 'failed' }\n  }\n}\n"],"names":["checkEntitlement","consentGroupForHost","CRM_COLLECTIONS","crmActivityLogHasRoom","crmBookingFollowUpDueMs","crmBookingFollowUpTitle","crmBookingMeetingBody","crmScopeTokens","isHostPluginEnabled","parseCrmBookingRef","readContactFacet","visibleToHost","FieldValue","findContactByEmail","countCrmActivitiesForRecord","CRM_PLUGIN_ID","resolveBookingRecord","firestore","input","groupId","hit","hostId","orgId","orgRef","collection","doc","contactsRef","ref","booking","crmRef","kind","contact","id","get","exists","facet","data","link","contactId","companyId","matchedBy","ownerUid","deal","deals","String","dealId","lead","leadId","email","recordCrmBooking","service","filed","reason","wantsMeeting","crmMeetingActivity","wantsTask","crmFollowUpTask","host","undefined","org","activities","already","where","limit","empty","group","record","visibleTo","serviceName","name","trim","timezone","activityId","logged","activity","body","startsAtMs","atMs","byUid","bookingId","createdAt","serverTimestamp","updatedAt","written","add","taskId","task","title","priority","status","dueAtMs","endsAtMs","assigneeUid","createdByUid","tasks","error","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,gBAAgB,EAChBC,mBAAmB,EACnBC,eAAe,EAIfC,qBAAqB,EACrBC,uBAAuB,EACvBC,uBAAuB,EACvBC,qBAAqB,EACrBC,cAAc,EACdC,mBAAmB,EACnBC,kBAAkB,EAClBC,gBAAgB,EAChBC,aAAa,QACR,sBAAqB;AAC5B,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,kBAAkB,QAAQ,2BAAuB;AAC1D,SAASC,2BAA2B,QAAQ,mBAAe;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCC,GAED,4EAA4E,GAC5E,MAAMC,gBAAgB;AA6EtB;;CAEC,GACD,eAAeC,qBACbC,SAAsC,EACtCC,KAA4B,EAC5BC,OAAe;QAwDgBC;IAtD/B,MAAM,EAAEC,MAAM,EAAEC,KAAK,EAAE,GAAGJ;IAC1B,MAAMK,SAASN,UAAUO,UAAU,CAAC,QAAQC,GAAG,CAACH;IAChD,MAAMI,cAAcH,OAAOC,UAAU,CAAC;IACtC,MAAMG,MAAMlB,mBAAmBS,MAAMU,OAAO,CAACC,MAAM;IACnD,IAAIF,CAAAA,uBAAAA,IAAKG,IAAI,MAAK,WAAW;QAC3B,MAAMC,UAAU,MAAML,YAAYD,GAAG,CAACE,IAAIK,EAAE,EAAEC,GAAG;QACjD,IAAIF,QAAQG,MAAM,IAAIvB,cAAcoB,QAAQE,GAAG,CAAC,cAAcZ,SAAS;gBACtCU;YAA/B,MAAMI,QAAQzB,kBAAiBqB,gBAAAA,QAAQK,IAAI,cAAZL,gBAAkB,CAAC,GAAGZ;YACrD,OAAO;gBACLkB,MAAM;oBACJC,WAAWP,QAAQC,EAAE;mBACjBG,MAAMI,SAAS,GAAG;oBAAEA,WAAWJ,MAAMI,SAAS;gBAAC,IAAI,CAAC;gBAE1DC,WAAW;eACPL,MAAMM,QAAQ,GAAG;gBAAEA,UAAUN,MAAMM,QAAQ;YAAC,IAAI,CAAC;QAEzD;IACF;IACA,IAAId,CAAAA,uBAAAA,IAAKG,IAAI,MAAK,QAAQ;QACxB,MAAMY,OAAO,MAAMnB,OAAOC,UAAU,CAACtB,gBAAgByC,KAAK,EAAElB,GAAG,CAACE,IAAIK,EAAE,EAAEC,GAAG;QAC3E,IAAIS,KAAKR,MAAM,IAAIvB,cAAc+B,KAAKT,GAAG,CAAC,cAAcZ,SAAS;gBACtCqB,WACAA,YACDA;YAFxB,MAAMJ,YAAYM,QAAOF,YAAAA,KAAKT,GAAG,CAAC,wBAATS,YAAyB;YAClD,MAAMH,YAAYK,QAAOF,aAAAA,KAAKT,GAAG,CAAC,wBAATS,aAAyB;YAClD,MAAMD,WAAWG,QAAOF,aAAAA,KAAKT,GAAG,CAAC,uBAATS,aAAwB;YAChD,OAAO;gBACLL,MAAM;oBACJQ,QAAQH,KAAKV,EAAE;mBACXM,YAAY;oBAAEA;gBAAU,IAAI,CAAC,GAC7BC,YAAY;oBAAEA;gBAAU,IAAI,CAAC;gBAEnCC,WAAW;eACPC,WAAW;gBAAEA;YAAS,IAAI,CAAC;QAEnC;IACF;IACA,IAAId,CAAAA,uBAAAA,IAAKG,IAAI,MAAK,QAAQ;QACxB,uEAAuE;QACvE,MAAMgB,OAAO,MAAM7B,UAChBO,UAAU,CAAC,SACXC,GAAG,CAACJ,QACJG,UAAU,CAAC,SACXC,GAAG,CAACE,IAAIK,EAAE,EACVC,GAAG;QACN,IAAIa,KAAKZ,MAAM,EAAE;gBACSY;YAAxB,MAAML,WAAWG,QAAOE,YAAAA,KAAKb,GAAG,CAAC,uBAATa,YAAwB;YAChD,OAAO;gBACLT,MAAM;oBAAEU,QAAQD,KAAKd,EAAE;gBAAC;gBACxBQ,WAAW;eACPC,WAAW;gBAAEA;YAAS,IAAI,CAAC;QAEnC;IACF;IACA,MAAMrB,MAAM,MAAMP,mBAAmBa,aAAaR,MAAMU,OAAO,CAACoB,KAAK,EAAE;QAAE3B;IAAO;IAChF,IAAI,CAACD,KAAK,OAAO;IACjB,MAAMe,QAAQzB,kBAAiBU,YAAAA,IAAIgB,IAAI,cAARhB,YAAc,CAAC,GAAGD;IACjD,OAAO;QACLkB,MAAM;YACJC,WAAWlB,IAAIY,EAAE;WACbG,MAAMI,SAAS,GAAG;YAAEA,WAAWJ,MAAMI,SAAS;QAAC,IAAI,CAAC;QAE1DC,WAAW;OACPL,MAAMM,QAAQ,GAAG;QAAEA,UAAUN,MAAMM,QAAQ;IAAC,IAAI,CAAC;AAEzD;AAEA;;;CAGC,GACD,OAAO,eAAeQ,iBACpBhC,SAAsC,EACtCC,KAA4B;IAE5B,MAAM,EAAEG,MAAM,EAAEC,KAAK,EAAEM,OAAO,EAAEsB,OAAO,EAAE,GAAGhC;IAC5C,IAAI;YAQK,OAIkBA,YAeSA,aAIDA,aACNgC;QA/B3B,IAAI,CAAC7B,UAAU,CAACC,SAAS,EAACM,2BAAAA,QAASI,EAAE,GAAE,OAAO;YAAEmB,OAAO;YAAOC,QAAQ;QAAS;QAC/E,MAAMC,eAAeH,CAAAA,2BAAAA,QAASI,kBAAkB,MAAK;QACrD,MAAMC,YAAYL,CAAAA,2BAAAA,QAASM,eAAe,MAAK;QAC/C,IAAI,CAACH,gBAAgB,CAACE,WAAW,OAAO;YAAEJ,OAAO;YAAOC,QAAQ;QAAkB;QAElF,MAAMK,OACJvC,MAAMuC,IAAI,KAAKC,aACV,QAAA,AAAC,CAAA,MAAMzC,UAAUO,UAAU,CAAC,SAASC,GAAG,CAACJ,QAAQY,GAAG,EAAC,EAAGG,IAAI,cAA5D,QAEiB,OAClBlB,MAAMuC,IAAI;QAChB,IAAI,CAACjD,qBAAoBU,aAAAA,MAAMyC,GAAG,YAATzC,aAAa,MAAMuC,MAAM1C,gBAAgB;YAChE,OAAO;gBAAEoC,OAAO;gBAAOC,QAAQ;YAAU;QAC3C;QACA,IAAI,CAACpD,iBAAiBkB,MAAMyC,GAAG,EAA4C,QAAQ;YACjF,OAAO;gBAAER,OAAO;gBAAOC,QAAQ;YAAe;QAChD;QAEA,MAAM7B,SAASN,UAAUO,UAAU,CAAC,QAAQC,GAAG,CAACH;QAChD,MAAMsC,aAAarC,OAAOC,UAAU,CAACtB,gBAAgB0D,UAAU;QAC/D,wEAAwE;QACxE,uEAAuE;QACvE,iCAAiC;QACjC,MAAMC,UAAU,MAAMD,WAAWE,KAAK,CAAC,aAAa,MAAMlC,QAAQI,EAAE,EAAE+B,KAAK,CAAC,GAAG9B,GAAG;QAClF,IAAI,CAAC4B,QAAQG,KAAK,EAAE,OAAO;YAAEb,OAAO;YAAOC,QAAQ;QAAgB;QAEnE,MAAMa,QAAQhE,qBAAoBiB,cAAAA,MAAMyC,GAAG,YAATzC,cAAa,MAAMG;QACrD,MAAM6C,SAAS,MAAMlD,qBAAqBC,WAAWC,OAAO+C,MAAM9C,OAAO;QACzE,IAAI,CAAC+C,QAAQ,OAAO;YAAEf,OAAO;YAAOC,QAAQ;QAAY;QAExD,MAAMe,YAAY5D,gBAAeW,cAAAA,MAAMyC,GAAG,YAATzC,cAAa,MAAM+C;QACpD,MAAMG,cAAcxB,QAAOM,gBAAAA,2BAAAA,QAASmB,IAAI,oBAAIzC,QAAQwC,WAAW,YAApClB,OAAwC,IAAIoB,IAAI;QAC3E,MAAMC,WAAWrB,CAAAA,2BAAAA,QAASqB,QAAQ,KAAIb;QAEtC,IAAIc,aAA4B;QAChC,IAAInB,cAAc;YAChB,oEAAoE;YACpE,qDAAqD;YACrD,MAAMoB,SAAS,MAAM3D,4BAA4BS,QAAQ2C,OAAO7B,IAAI;YACpE,IAAIlC,sBAAsBsE,SAAS;gBACjC,MAAMC,WAAwB;oBAC5B5C,MAAM;oBACN6C,MAAMrE,sBAAsB;wBAC1B8D;wBACAQ,YAAYhD,QAAQgD,UAAU;wBAC9BL;oBACF;oBACA,+DAA+D;oBAC/DM,MAAMjD,QAAQgD,UAAU;oBACxBE,OAAO;mBACJZ,OAAO7B,IAAI;oBACd0C,WAAWnD,QAAQI,EAAE;oBACrBX;oBACA8C;oBACAa,WAAWpE,WAAWqE,eAAe;oBACrCC,WAAWtE,WAAWqE,eAAe;;gBAEvC,MAAME,UAAU,MAAMvB,WAAWwB,GAAG,CAACV;gBACrCF,aAAaW,QAAQnD,EAAE;YACzB;QACF;QAEA,IAAIqD,SAAwB;QAC5B,IAAI9B,WAAW;YACb,MAAM+B,OAAgB;gBACpBC,OAAOlF,wBAAwB+D;gBAC/BtC,MAAM;gBACN0D,UAAU;gBACVC,QAAQ;gBACRC,SAAStF,wBAAwBwB,QAAQ+D,QAAQ,EAAEpB;eAC/CL,OAAOzB,QAAQ,GAAG;gBAAEmD,aAAa1B,OAAOzB,QAAQ;YAAC,IAAI,CAAC;gBAC1DoD,cAAc;eACX3B,OAAO7B,IAAI;gBACdhB;gBACA8C;gBACAa,WAAWpE,WAAWqE,eAAe;gBACrCC,WAAWtE,WAAWqE,eAAe;;YAEvC,MAAME,UAAU,MAAM5D,OAAOC,UAAU,CAACtB,gBAAgB4F,KAAK,EAAEV,GAAG,CAACE;YACnED,SAASF,QAAQnD,EAAE;QACrB;QAEA,OAAO;YAAEmB,OAAO;YAAMX,WAAW0B,OAAO1B,SAAS;YAAEH,MAAM6B,OAAO7B,IAAI;YAAEmC;YAAYa;QAAO;IAC3F,EAAE,OAAOU,OAAO;QACdC,QAAQD,KAAK,CAAC,oCAAoC1E,QAAQO,2BAAAA,QAASI,EAAE,EAAE+D;QACvE,OAAO;YAAE5C,OAAO;YAAOC,QAAQ;QAAS;IAC1C;AACF"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/crm-booking-activity.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  checkEntitlement,\n  consentGroupForHost,\n  CRM_COLLECTIONS,\n  type CrmActivity,\n  type CrmActivityLink,\n  type CrmTask,\n  crmActivityLogHasRoom,\n  crmBookingFollowUpDueMs,\n  crmBookingFollowUpTitle,\n  crmBookingMeetingBody,\n  crmScopeTokens,\n  isHostPluginEnabled,\n  parseCrmBookingRef,\n  readContactFacet,\n  visibleToHost,\n} from '@aglyn/aglyn/server'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { findContactByEmail } from './contact-email-index'\nimport { readLeadForHost } from './host-visitor-records'\nimport { countCrmActivitiesForRecord } from './crm-records'\n\n/**\n * WHAT A BOOKING FILES ON THE CRM RECORD (AGL-2660).\n *\n * A confirmed booking is a meeting the record has on its calendar, and the\n * timeline should say so without a rep logging it by hand. So once a\n * booking's row is written — at creation for a free service, on payment\n * for a paid one — the record is found and a `meeting` activity filed under\n * it, with a follow-up task beside it when the service asks for one.\n *\n * ## Which record\n *\n * The reference the booking link carried wins: `crmRef` names the contact,\n * lead or deal the rep dropped the link from, and a booking made through\n * that link belongs to that record even when the booker typed a different\n * address. Without one — a booking taken off the widget cold — the booker's\n * address is looked up through the org's address index, narrowed to this\n * site, exactly as the automation steps resolve an event's contact. A\n * reference to a record the site cannot see, or that no longer exists,\n * falls through to the address rather than filing under nobody.\n *\n * ## Where it lives\n *\n * In the admin library rather than the Bookings plugin, because the row is\n * a CRM record: its scope, its ceiling and its collections are the CRM's,\n * and a plugin that stamped its own would be a second creator to keep in\n * step with `crmScopeTokens`. The Bookings plugin passes what it already\n * holds and reads the outcome; the CRM plugin is never imported.\n *\n * Firestore is a parameter, as in `crm-records.ts`: the callers hold one,\n * and a module that reached for the Admin app itself would drag it into\n * every spec that only wants the arithmetic.\n *\n * ## Failure posture\n *\n * **Never throws.** A booking that could not be filed on the CRM is still\n * a booking — the guest has the slot and the confirmation — so a failure\n * here is logged and reported in the outcome, never raised into the\n * request that took the booking or the webhook that confirmed it.\n */\n\n/** The CRM plugin's id, as `enabledPlugins` and `disabledPlugins` name it. */\nconst CRM_PLUGIN_ID = 'crm'\n\nexport interface CrmBookingRecordInput {\n  hostId: string\n  /**\n   * The owning org, as `getOrgForHost` returns it — the plugin set, the\n   * consent groups and the scope default are all read off it.\n   */\n  org: Record<string, unknown> | null | undefined\n  orgId: string\n  /** The booking as its row was written. */\n  booking: {\n    id: string\n    serviceId?: string\n    serviceName?: string\n    email?: string\n    startsAtMs: number\n    endsAtMs: number\n    /** The `crm` query value the link carried, kept on the row. */\n    crmRef?: string | null\n  }\n  /** The service as stored: its two CRM switches and its timezone. */\n  service:\n    | {\n        name?: string\n        timezone?: string\n        crmFollowUpTask?: boolean\n        crmMeetingActivity?: boolean\n      }\n    | null\n    | undefined\n  /**\n   * The host document's plugin fields, when the caller already holds them;\n   * read here otherwise. The deny-list is per site, and a site that has\n   * switched the CRM off must file nothing.\n   */\n  host?: { disabledPlugins?: string[]; enabledPlugins?: string[] } | null\n}\n\nexport type CrmBookingRecordOutcome =\n  | {\n      filed: false\n      reason:\n        /** The CRM plugin does not run on this site. */\n        | 'crm-off'\n        /**\n         * The org's plan does not carry the CRM suite, whose activities and\n         * tasks these are (AGL-2787).\n         */\n        | 'not-entitled'\n        /** Neither the reference nor the address named a record. */\n        | 'no-record'\n        /** A meeting for this booking is already on the timeline. */\n        | 'already-filed'\n        /** The service asks for neither a meeting nor a follow-up. */\n        | 'nothing-to-file'\n        /** A read or a write threw; logged, and nothing is promised. */\n        | 'failed'\n    }\n  | {\n      filed: true\n      /** How the record was found. */\n      matchedBy: 'crmRef' | 'email'\n      link: CrmActivityLink\n      /** The meeting's id, or `null` when the service files no meeting. */\n      activityId: string | null\n      /** The follow-up's id, or `null` when the service asks for none. */\n      taskId: string | null\n    }\n\ninterface ResolvedRecord {\n  link: CrmActivityLink\n  matchedBy: 'crmRef' | 'email'\n  /** Whoever holds the relationship, for the follow-up's assignee. */\n  ownerUid?: string\n}\n\n/**\n * The record a booking belongs to — the reference first, the address second.\n */\nasync function resolveBookingRecord(\n  firestore: FirebaseFirestore.Firestore,\n  input: CrmBookingRecordInput,\n  groupId: string,\n): Promise<ResolvedRecord | null> {\n  const { hostId, orgId } = input\n  const orgRef = firestore.collection('orgs').doc(orgId)\n  const contactsRef = orgRef.collection('contacts')\n  const ref = parseCrmBookingRef(input.booking.crmRef)\n  if (ref?.kind === 'contact') {\n    const contact = await contactsRef.doc(ref.id).get()\n    if (contact.exists && visibleToHost(contact.get('visibleTo'), hostId)) {\n      const facet = readContactFacet(contact.data() ?? {}, groupId)\n      return {\n        link: {\n          contactId: contact.id,\n          ...(facet.companyId ? { companyId: facet.companyId } : {}),\n        },\n        matchedBy: 'crmRef',\n        ...(facet.ownerUid ? { ownerUid: facet.ownerUid } : {}),\n      }\n    }\n  }\n  if (ref?.kind === 'deal') {\n    const deal = await orgRef.collection(CRM_COLLECTIONS.deals).doc(ref.id).get()\n    if (deal.exists && visibleToHost(deal.get('visibleTo'), hostId)) {\n      const contactId = String(deal.get('contactId') ?? '')\n      const companyId = String(deal.get('companyId') ?? '')\n      const ownerUid = String(deal.get('ownerUid') ?? '')\n      return {\n        link: {\n          dealId: deal.id,\n          ...(contactId ? { contactId } : {}),\n          ...(companyId ? { companyId } : {}),\n        },\n        matchedBy: 'crmRef',\n        ...(ownerUid ? { ownerUid } : {}),\n      }\n    }\n  }\n  if (ref?.kind === 'lead') {\n    /*\n     * A lead carries its own `visibleTo` now (AGL-3275) — it used to be\n     * host-scoped by path, and the comment here said so. The seam reads the\n     * org row, and the site has to be allowed to see it before a booking is\n     * filed against it, or one brand's booking would name another's lead.\n     */\n    const lead = await readLeadForHost(hostId, ref.id)\n    if (lead && visibleToHost(lead.get('visibleTo'), hostId)) {\n      const ownerUid = String(lead.get('ownerUid') ?? '')\n      return {\n        link: { leadId: lead.id },\n        matchedBy: 'crmRef',\n        ...(ownerUid ? { ownerUid } : {}),\n      }\n    }\n  }\n  const hit = await findContactByEmail(contactsRef, input.booking.email, { hostId })\n  if (!hit) return null\n  const facet = readContactFacet(hit.data() ?? {}, groupId)\n  return {\n    link: {\n      contactId: hit.id,\n      ...(facet.companyId ? { companyId: facet.companyId } : {}),\n    },\n    matchedBy: 'email',\n    ...(facet.ownerUid ? { ownerUid: facet.ownerUid } : {}),\n  }\n}\n\n/**\n * Files what a confirmed booking owes the CRM: the meeting, and the\n * follow-up when the service asks for one. See the module comment.\n */\nexport async function recordCrmBooking(\n  firestore: FirebaseFirestore.Firestore,\n  input: CrmBookingRecordInput,\n): Promise<CrmBookingRecordOutcome> {\n  const { hostId, orgId, booking, service } = input\n  try {\n    if (!hostId || !orgId || !booking?.id) return { filed: false, reason: 'failed' }\n    const wantsMeeting = service?.crmMeetingActivity !== false\n    const wantsTask = service?.crmFollowUpTask === true\n    if (!wantsMeeting && !wantsTask) return { filed: false, reason: 'nothing-to-file' }\n\n    const host =\n      input.host === undefined\n        ? ((await firestore.collection('hosts').doc(hostId).get()).data() as\n            | { disabledPlugins?: string[]; enabledPlugins?: string[] }\n            | undefined) ?? null\n        : input.host\n    if (!isHostPluginEnabled(input.org ?? null, host, CRM_PLUGIN_ID)) {\n      return { filed: false, reason: 'crm-off' }\n    }\n    if (!checkEntitlement(input.org as Parameters<typeof checkEntitlement>[0], 'crm')) {\n      return { filed: false, reason: 'not-entitled' }\n    }\n\n    const orgRef = firestore.collection('orgs').doc(orgId)\n    const activities = orgRef.collection(CRM_COLLECTIONS.activities)\n    // One meeting per booking, whatever path re-enters: the paid webhook is\n    // redelivered for days after any 500, and its own guard is the status,\n    // which this row is not part of.\n    const already = await activities.where('bookingId', '==', booking.id).limit(1).get()\n    if (!already.empty) return { filed: false, reason: 'already-filed' }\n\n    const group = consentGroupForHost(input.org ?? null, hostId)\n    const record = await resolveBookingRecord(firestore, input, group.groupId)\n    if (!record) return { filed: false, reason: 'no-record' }\n\n    const visibleTo = crmScopeTokens(input.org ?? null, group)\n    const serviceName = String(service?.name ?? booking.serviceName ?? '').trim()\n    const timezone = service?.timezone || undefined\n\n    let activityId: string | null = null\n    if (wantsMeeting) {\n      // The per-record ceiling (AGL-2611): a full log refuses the meeting\n      // but not the follow-up — a task is owed either way.\n      const logged = await countCrmActivitiesForRecord(orgRef, record.link)\n      if (crmActivityLogHasRoom(logged)) {\n        const activity: CrmActivity = {\n          kind: 'meeting',\n          body: crmBookingMeetingBody({\n            serviceName,\n            startsAtMs: booking.startsAtMs,\n            timezone,\n          }),\n          // When it HAPPENS, which is the slot — not when it was booked.\n          atMs: booking.startsAtMs,\n          byUid: '',\n          ...record.link,\n          bookingId: booking.id,\n          hostId,\n          visibleTo,\n          createdAt: FieldValue.serverTimestamp(),\n          updatedAt: FieldValue.serverTimestamp(),\n        }\n        const written = await activities.add(activity)\n        activityId = written.id\n      }\n    }\n\n    let taskId: string | null = null\n    if (wantsTask) {\n      const task: CrmTask = {\n        title: crmBookingFollowUpTitle(serviceName),\n        kind: 'todo',\n        priority: 'normal',\n        status: 'open',\n        dueAtMs: crmBookingFollowUpDueMs(booking.endsAtMs, timezone),\n        ...(record.ownerUid ? { assigneeUid: record.ownerUid } : {}),\n        createdByUid: '',\n        ...record.link,\n        hostId,\n        visibleTo,\n        createdAt: FieldValue.serverTimestamp(),\n        updatedAt: FieldValue.serverTimestamp(),\n      }\n      const written = await orgRef.collection(CRM_COLLECTIONS.tasks).add(task)\n      taskId = written.id\n    }\n\n    return { filed: true, matchedBy: record.matchedBy, link: record.link, activityId, taskId }\n  } catch (error) {\n    console.error('[crm] booking could not be filed', hostId, booking?.id, error)\n    return { filed: false, reason: 'failed' }\n  }\n}\n"],"names":["checkEntitlement","consentGroupForHost","CRM_COLLECTIONS","crmActivityLogHasRoom","crmBookingFollowUpDueMs","crmBookingFollowUpTitle","crmBookingMeetingBody","crmScopeTokens","isHostPluginEnabled","parseCrmBookingRef","readContactFacet","visibleToHost","FieldValue","findContactByEmail","readLeadForHost","countCrmActivitiesForRecord","CRM_PLUGIN_ID","resolveBookingRecord","firestore","input","groupId","hit","hostId","orgId","orgRef","collection","doc","contactsRef","ref","booking","crmRef","kind","contact","id","get","exists","facet","data","link","contactId","companyId","matchedBy","ownerUid","deal","deals","String","dealId","lead","leadId","email","recordCrmBooking","service","filed","reason","wantsMeeting","crmMeetingActivity","wantsTask","crmFollowUpTask","host","undefined","org","activities","already","where","limit","empty","group","record","visibleTo","serviceName","name","trim","timezone","activityId","logged","activity","body","startsAtMs","atMs","byUid","bookingId","createdAt","serverTimestamp","updatedAt","written","add","taskId","task","title","priority","status","dueAtMs","endsAtMs","assigneeUid","createdByUid","tasks","error","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,gBAAgB,EAChBC,mBAAmB,EACnBC,eAAe,EAIfC,qBAAqB,EACrBC,uBAAuB,EACvBC,uBAAuB,EACvBC,qBAAqB,EACrBC,cAAc,EACdC,mBAAmB,EACnBC,kBAAkB,EAClBC,gBAAgB,EAChBC,aAAa,QACR,sBAAqB;AAC5B,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,kBAAkB,QAAQ,2BAAuB;AAC1D,SAASC,eAAe,QAAQ,4BAAwB;AACxD,SAASC,2BAA2B,QAAQ,mBAAe;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCC,GAED,4EAA4E,GAC5E,MAAMC,gBAAgB;AA6EtB;;CAEC,GACD,eAAeC,qBACbC,SAAsC,EACtCC,KAA4B,EAC5BC,OAAe;QAwDgBC;IAtD/B,MAAM,EAAEC,MAAM,EAAEC,KAAK,EAAE,GAAGJ;IAC1B,MAAMK,SAASN,UAAUO,UAAU,CAAC,QAAQC,GAAG,CAACH;IAChD,MAAMI,cAAcH,OAAOC,UAAU,CAAC;IACtC,MAAMG,MAAMnB,mBAAmBU,MAAMU,OAAO,CAACC,MAAM;IACnD,IAAIF,CAAAA,uBAAAA,IAAKG,IAAI,MAAK,WAAW;QAC3B,MAAMC,UAAU,MAAML,YAAYD,GAAG,CAACE,IAAIK,EAAE,EAAEC,GAAG;QACjD,IAAIF,QAAQG,MAAM,IAAIxB,cAAcqB,QAAQE,GAAG,CAAC,cAAcZ,SAAS;gBACtCU;YAA/B,MAAMI,QAAQ1B,kBAAiBsB,gBAAAA,QAAQK,IAAI,cAAZL,gBAAkB,CAAC,GAAGZ;YACrD,OAAO;gBACLkB,MAAM;oBACJC,WAAWP,QAAQC,EAAE;mBACjBG,MAAMI,SAAS,GAAG;oBAAEA,WAAWJ,MAAMI,SAAS;gBAAC,IAAI,CAAC;gBAE1DC,WAAW;eACPL,MAAMM,QAAQ,GAAG;gBAAEA,UAAUN,MAAMM,QAAQ;YAAC,IAAI,CAAC;QAEzD;IACF;IACA,IAAId,CAAAA,uBAAAA,IAAKG,IAAI,MAAK,QAAQ;QACxB,MAAMY,OAAO,MAAMnB,OAAOC,UAAU,CAACvB,gBAAgB0C,KAAK,EAAElB,GAAG,CAACE,IAAIK,EAAE,EAAEC,GAAG;QAC3E,IAAIS,KAAKR,MAAM,IAAIxB,cAAcgC,KAAKT,GAAG,CAAC,cAAcZ,SAAS;gBACtCqB,WACAA,YACDA;YAFxB,MAAMJ,YAAYM,QAAOF,YAAAA,KAAKT,GAAG,CAAC,wBAATS,YAAyB;YAClD,MAAMH,YAAYK,QAAOF,aAAAA,KAAKT,GAAG,CAAC,wBAATS,aAAyB;YAClD,MAAMD,WAAWG,QAAOF,aAAAA,KAAKT,GAAG,CAAC,uBAATS,aAAwB;YAChD,OAAO;gBACLL,MAAM;oBACJQ,QAAQH,KAAKV,EAAE;mBACXM,YAAY;oBAAEA;gBAAU,IAAI,CAAC,GAC7BC,YAAY;oBAAEA;gBAAU,IAAI,CAAC;gBAEnCC,WAAW;eACPC,WAAW;gBAAEA;YAAS,IAAI,CAAC;QAEnC;IACF;IACA,IAAId,CAAAA,uBAAAA,IAAKG,IAAI,MAAK,QAAQ;QACxB;;;;;KAKC,GACD,MAAMgB,OAAO,MAAMjC,gBAAgBQ,QAAQM,IAAIK,EAAE;QACjD,IAAIc,QAAQpC,cAAcoC,KAAKb,GAAG,CAAC,cAAcZ,SAAS;gBAChCyB;YAAxB,MAAML,WAAWG,QAAOE,YAAAA,KAAKb,GAAG,CAAC,uBAATa,YAAwB;YAChD,OAAO;gBACLT,MAAM;oBAAEU,QAAQD,KAAKd,EAAE;gBAAC;gBACxBQ,WAAW;eACPC,WAAW;gBAAEA;YAAS,IAAI,CAAC;QAEnC;IACF;IACA,MAAMrB,MAAM,MAAMR,mBAAmBc,aAAaR,MAAMU,OAAO,CAACoB,KAAK,EAAE;QAAE3B;IAAO;IAChF,IAAI,CAACD,KAAK,OAAO;IACjB,MAAMe,QAAQ1B,kBAAiBW,YAAAA,IAAIgB,IAAI,cAARhB,YAAc,CAAC,GAAGD;IACjD,OAAO;QACLkB,MAAM;YACJC,WAAWlB,IAAIY,EAAE;WACbG,MAAMI,SAAS,GAAG;YAAEA,WAAWJ,MAAMI,SAAS;QAAC,IAAI,CAAC;QAE1DC,WAAW;OACPL,MAAMM,QAAQ,GAAG;QAAEA,UAAUN,MAAMM,QAAQ;IAAC,IAAI,CAAC;AAEzD;AAEA;;;CAGC,GACD,OAAO,eAAeQ,iBACpBhC,SAAsC,EACtCC,KAA4B;IAE5B,MAAM,EAAEG,MAAM,EAAEC,KAAK,EAAEM,OAAO,EAAEsB,OAAO,EAAE,GAAGhC;IAC5C,IAAI;YAQK,OAIkBA,YAeSA,aAIDA,aACNgC;QA/B3B,IAAI,CAAC7B,UAAU,CAACC,SAAS,EAACM,2BAAAA,QAASI,EAAE,GAAE,OAAO;YAAEmB,OAAO;YAAOC,QAAQ;QAAS;QAC/E,MAAMC,eAAeH,CAAAA,2BAAAA,QAASI,kBAAkB,MAAK;QACrD,MAAMC,YAAYL,CAAAA,2BAAAA,QAASM,eAAe,MAAK;QAC/C,IAAI,CAACH,gBAAgB,CAACE,WAAW,OAAO;YAAEJ,OAAO;YAAOC,QAAQ;QAAkB;QAElF,MAAMK,OACJvC,MAAMuC,IAAI,KAAKC,aACV,QAAA,AAAC,CAAA,MAAMzC,UAAUO,UAAU,CAAC,SAASC,GAAG,CAACJ,QAAQY,GAAG,EAAC,EAAGG,IAAI,cAA5D,QAEiB,OAClBlB,MAAMuC,IAAI;QAChB,IAAI,CAAClD,qBAAoBW,aAAAA,MAAMyC,GAAG,YAATzC,aAAa,MAAMuC,MAAM1C,gBAAgB;YAChE,OAAO;gBAAEoC,OAAO;gBAAOC,QAAQ;YAAU;QAC3C;QACA,IAAI,CAACrD,iBAAiBmB,MAAMyC,GAAG,EAA4C,QAAQ;YACjF,OAAO;gBAAER,OAAO;gBAAOC,QAAQ;YAAe;QAChD;QAEA,MAAM7B,SAASN,UAAUO,UAAU,CAAC,QAAQC,GAAG,CAACH;QAChD,MAAMsC,aAAarC,OAAOC,UAAU,CAACvB,gBAAgB2D,UAAU;QAC/D,wEAAwE;QACxE,uEAAuE;QACvE,iCAAiC;QACjC,MAAMC,UAAU,MAAMD,WAAWE,KAAK,CAAC,aAAa,MAAMlC,QAAQI,EAAE,EAAE+B,KAAK,CAAC,GAAG9B,GAAG;QAClF,IAAI,CAAC4B,QAAQG,KAAK,EAAE,OAAO;YAAEb,OAAO;YAAOC,QAAQ;QAAgB;QAEnE,MAAMa,QAAQjE,qBAAoBkB,cAAAA,MAAMyC,GAAG,YAATzC,cAAa,MAAMG;QACrD,MAAM6C,SAAS,MAAMlD,qBAAqBC,WAAWC,OAAO+C,MAAM9C,OAAO;QACzE,IAAI,CAAC+C,QAAQ,OAAO;YAAEf,OAAO;YAAOC,QAAQ;QAAY;QAExD,MAAMe,YAAY7D,gBAAeY,cAAAA,MAAMyC,GAAG,YAATzC,cAAa,MAAM+C;QACpD,MAAMG,cAAcxB,QAAOM,gBAAAA,2BAAAA,QAASmB,IAAI,oBAAIzC,QAAQwC,WAAW,YAApClB,OAAwC,IAAIoB,IAAI;QAC3E,MAAMC,WAAWrB,CAAAA,2BAAAA,QAASqB,QAAQ,KAAIb;QAEtC,IAAIc,aAA4B;QAChC,IAAInB,cAAc;YAChB,oEAAoE;YACpE,qDAAqD;YACrD,MAAMoB,SAAS,MAAM3D,4BAA4BS,QAAQ2C,OAAO7B,IAAI;YACpE,IAAInC,sBAAsBuE,SAAS;gBACjC,MAAMC,WAAwB;oBAC5B5C,MAAM;oBACN6C,MAAMtE,sBAAsB;wBAC1B+D;wBACAQ,YAAYhD,QAAQgD,UAAU;wBAC9BL;oBACF;oBACA,+DAA+D;oBAC/DM,MAAMjD,QAAQgD,UAAU;oBACxBE,OAAO;mBACJZ,OAAO7B,IAAI;oBACd0C,WAAWnD,QAAQI,EAAE;oBACrBX;oBACA8C;oBACAa,WAAWrE,WAAWsE,eAAe;oBACrCC,WAAWvE,WAAWsE,eAAe;;gBAEvC,MAAME,UAAU,MAAMvB,WAAWwB,GAAG,CAACV;gBACrCF,aAAaW,QAAQnD,EAAE;YACzB;QACF;QAEA,IAAIqD,SAAwB;QAC5B,IAAI9B,WAAW;YACb,MAAM+B,OAAgB;gBACpBC,OAAOnF,wBAAwBgE;gBAC/BtC,MAAM;gBACN0D,UAAU;gBACVC,QAAQ;gBACRC,SAASvF,wBAAwByB,QAAQ+D,QAAQ,EAAEpB;eAC/CL,OAAOzB,QAAQ,GAAG;gBAAEmD,aAAa1B,OAAOzB,QAAQ;YAAC,IAAI,CAAC;gBAC1DoD,cAAc;eACX3B,OAAO7B,IAAI;gBACdhB;gBACA8C;gBACAa,WAAWrE,WAAWsE,eAAe;gBACrCC,WAAWvE,WAAWsE,eAAe;;YAEvC,MAAME,UAAU,MAAM5D,OAAOC,UAAU,CAACvB,gBAAgB6F,KAAK,EAAEV,GAAG,CAACE;YACnED,SAASF,QAAQnD,EAAE;QACrB;QAEA,OAAO;YAAEmB,OAAO;YAAMX,WAAW0B,OAAO1B,SAAS;YAAEH,MAAM6B,OAAO7B,IAAI;YAAEmC;YAAYa;QAAO;IAC3F,EAAE,OAAOU,OAAO;QACdC,QAAQD,KAAK,CAAC,oCAAoC1E,QAAQO,2BAAAA,QAASI,EAAE,EAAE+D;QACvE,OAAO;YAAE5C,OAAO;YAAOC,QAAQ;QAAS;IAC1C;AACF"}

package/src/lib/server/crm-inbound-email.js

@@ -16,6 +16,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * limitations under the License.
  */ import { buildCrmCapturedEmailActivity, consentGroupForHost, contactCaptureHostIds, crmActivityLogHasRoom, crmCapturedEmailKey, crmInboundCandidates, crmInboundExcerpt, crmInboundRoster, crmScopeTokens, emailAddressOf, emailDomainOf, findMemberByEmailAddress, forwardedSection, htmlToPlainText, isCrmInboundAddress, isCrmInboundToken, mintCrmInboundToken, personKey, readContactFacet } from "@aglyn/aglyn/server";
 import { MEMBER_EMAIL_ALIASES_COLLECTION } from "@aglyn/aglyn/app-utils/member-email-aliases";
+import { visibleToHost } from "@aglyn/aglyn/app-utils/scope-tokens";
 import { findContactByEmail } from "./contact-email-index.js";
 import { createCrmEmailActivity, crmCapturedEmailActivityRef, newCrmActivityRef } from "./crm-email-activity.js";
 import { countCrmActivitiesForRecord } from "./crm-records.js";
@@ -144,10 +145,19 @@ import { countCrmActivitiesForRecord } from "./crm-records.js";
         }
         const key = personKey(candidate.email);
         if (!key) continue;
+        /*
+     * ONE ROW, then which of the named sites may see it (AGL-3275).
+     *
+     * This used to read a lead per site because there was one per site. There
+     * is one now, so the read is single and the LOOP is what it always really
+     * was: deciding whose mailbox this reply belongs to. A site that cannot
+     * see the row is not that site, which is what `visibleToHost` answers —
+     * and skipping it is what keeps an agency's clients apart on a shared row.
+     */ const lead = await orgRef.collection('leads').doc(key).get();
         for (const hostId of input.hostIds.slice(0, CRM_INBOUND_LEAD_HOST_MAX)){
             var _lead_get;
-            const lead = await firestore.collection('hosts').doc(hostId).collection('leads').doc(key).get();
-            if (!lead.exists) continue;
+            if (!lead.exists) break;
+            if (!visibleToHost(lead.get('visibleTo'), hostId)) continue;
             const link = {
                 leadId: lead.id
             };

package/src/lib/server/crm-inbound-email.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/crm-inbound-email.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  buildCrmCapturedEmailActivity,\n  consentGroupForHost,\n  contactCaptureHostIds,\n  crmActivityLogHasRoom,\n  crmCapturedEmailKey,\n  crmInboundCandidates,\n  crmInboundExcerpt,\n  crmInboundRoster,\n  type CrmActivityLink,\n  type CrmEmailDirection,\n  type CrmInboundCandidate,\n  type CrmInboundMember,\n  type CrmInboundRosterRow,\n  crmScopeTokens,\n  emailAddressOf,\n  emailDomainOf,\n  findMemberByEmailAddress,\n  forwardedSection,\n  htmlToPlainText,\n  isCrmInboundAddress,\n  isCrmInboundToken,\n  mintCrmInboundToken,\n  personKey,\n  readContactFacet,\n} from '@aglyn/aglyn/server'\nimport { MEMBER_EMAIL_ALIASES_COLLECTION } from '@aglyn/aglyn/app-utils/member-email-aliases'\nimport type { OrgCrmInbound } from '@aglyn/aglyn/foundation'\nimport type { ReceivedEmail } from '@aglyn/shared-util-email'\nimport { findContactByEmail } from './contact-email-index'\nimport {\n  createCrmEmailActivity,\n  crmCapturedEmailActivityRef,\n  newCrmActivityRef,\n} from './crm-email-activity'\nimport { countCrmActivitiesForRecord } from './crm-records'\n\n/**\n * EMAIL CAPTURE (AGL-2657): the half with Firestore.\n *\n * The org's capture token — minted once, replaced on a rotation, found\n * again from a message's recipient — and the filing of one received\n * message: which record it was with, whether it has been filed before, and\n * the row it becomes. The pure rules are `@aglyn/aglyn`'s\n * `crm-inbound.ts`; this module is the reads and the one write.\n *\n * Firestore is a parameter throughout, as in `crm-records.ts` and\n * `crm-email-activity.ts`: the routes hold one, and a module that reached\n * for the Admin app itself would drag it into every spec that only wants\n * the matching. The roster is read through that same store by\n * `loadCrmInboundRoster`, and the caller writes the org's feed line, so a\n * spec of this module needs a store and nothing else.\n */\n\n/** The most candidate addresses one message is matched by. */\nexport const CRM_INBOUND_CANDIDATE_MAX = 6\n\n/** The most sites whose leads are consulted for one message. */\nexport const CRM_INBOUND_LEAD_HOST_MAX = 50\n\nexport interface CrmInboundTokenResult {\n  token: string\n  createdAtMs: number\n  rotatedAtMs?: number\n  /** True when this call replaced a token that existed. */\n  rotated: boolean\n}\n\n/**\n * The org's capture token, minted the first time anybody asks and kept\n * thereafter; with `rotate`, replaced. A transaction, so two members\n * opening the settings page at once mint one token and not two, and a\n * rotation lands on the token the reader saw.\n */\nexport async function ensureCrmInboundToken(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n  options: { rotate?: boolean; nowMs?: number } = {},\n): Promise<CrmInboundTokenResult> {\n  const rotate = options.rotate === true\n  const nowMs = options.nowMs ?? Date.now()\n  const orgRef = firestore.collection('orgs').doc(orgId)\n  return firestore.runTransaction(async (tx) => {\n    const snapshot = await tx.get(orgRef)\n    if (!snapshot.exists) throw new Error(`[crm-inbound] unknown org ${orgId}`)\n    const current = (snapshot.get('crmInbound') ?? null) as Partial<OrgCrmInbound> | null\n    const held = isCrmInboundToken(current?.token)\n    if (held && !rotate) {\n      const createdAtMs = Number(current?.createdAtMs)\n      return {\n        token: String(current?.token),\n        createdAtMs: Number.isFinite(createdAtMs) && createdAtMs > 0 ? createdAtMs : nowMs,\n        ...(typeof current?.rotatedAtMs === 'number' ? { rotatedAtMs: current.rotatedAtMs } : {}),\n        rotated: false,\n      }\n    }\n    const createdAtMs =\n      held && Number.isFinite(Number(current?.createdAtMs)) && Number(current?.createdAtMs) > 0\n        ? Number(current?.createdAtMs)\n        : nowMs\n    const next: OrgCrmInbound = {\n      token: mintCrmInboundToken(),\n      createdAtMs,\n      ...(held ? { rotatedAtMs: nowMs } : {}),\n    }\n    tx.update(orgRef, { crmInbound: next })\n    return { ...next, rotated: held }\n  })\n}\n\n/**\n * The org a capture token names, or `null`. One equality on\n * `crmInbound.token`, which Firestore indexes on its own; a token that is\n * not one by shape is refused before the query, so a malformed local part\n * costs no read.\n */\nexport async function findOrgByCrmInboundToken(\n  firestore: FirebaseFirestore.Firestore,\n  token: unknown,\n): Promise<{ orgId: string; org: Record<string, unknown> } | null> {\n  if (!isCrmInboundToken(token)) return null\n  const page = await firestore\n    .collection('orgs')\n    .where('crmInbound.token', '==', token)\n    .limit(1)\n    .get()\n  const doc = page.docs[0]\n  if (!doc) return null\n  return { orgId: doc.id, org: { $id: doc.id, ...(doc.data() ?? {}) } }\n}\n\n/**\n * Every site of the organization, by id, up to the ceiling — the set a\n * message's lead lookup sweeps. One equality on `hosts.orgId`.\n */\nexport async function crmInboundHostIds(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n): Promise<string[]> {\n  const page = await firestore\n    .collection('hosts')\n    .where('orgId', '==', orgId)\n    .limit(CRM_INBOUND_LEAD_HOST_MAX)\n    .get()\n  return page.docs.map((doc) => String(doc.id))\n}\n\n/** The record one of a message's addresses resolved to. */\nexport interface CrmInboundMatch {\n  email: string\n  direction: CrmEmailDirection\n  kind: 'contact' | 'lead'\n  /** Where the row is filed. */\n  link: CrmActivityLink\n  /** The site the row is stamped with — the record's own. */\n  hostId: string\n  /** Who may list the row — the record's own tokens. */\n  visibleTo: string[]\n}\n\n/**\n * The first candidate that is a contact of the org — through the address\n * index, so a merged record's alternate address answers — or a lead on any\n * of its sites. Candidates are tried in the order the rule gave them and\n * the first hit wins; a contact is looked for before a lead at each\n * address, because a converted lead's address is its contact's.\n */\nexport async function matchCrmInboundCorrespondent(\n  firestore: FirebaseFirestore.Firestore,\n  input: {\n    orgId: string\n    org: Record<string, unknown>\n    candidates: readonly CrmInboundCandidate[]\n    hostIds: readonly string[]\n  },\n): Promise<CrmInboundMatch | null> {\n  const { orgId, org } = input\n  const orgRef = firestore.collection('orgs').doc(orgId)\n  const contacts = orgRef.collection('contacts')\n  const tokensOf = (record: Record<string, unknown>): string[] => {\n    const raw = record['visibleTo']\n    return Array.isArray(raw) ? raw.map((token) => String(token)) : []\n  }\n  for (const candidate of input.candidates.slice(0, CRM_INBOUND_CANDIDATE_MAX)) {\n    const contact = await findContactByEmail(contacts, candidate.email)\n    if (contact) {\n      const record = (contact.data() ?? {}) as Record<string, unknown>\n      const hostId =\n        String(record['hostId'] ?? '').trim() || contactCaptureHostIds(record)[0] || ''\n      const link: CrmActivityLink = { contactId: contact.id }\n      if (hostId) {\n        // The company the capturing site files this person under, so the\n        // row shows on the company's log as a sent email's does.\n        const group = consentGroupForHost(org, hostId)\n        const facet = readContactFacet(record, group.groupId)\n        if (facet.companyId) link.companyId = facet.companyId\n      }\n      return {\n        email: candidate.email,\n        direction: candidate.direction,\n        kind: 'contact',\n        link,\n        hostId,\n        visibleTo: tokensOf(record),\n      }\n    }\n    const key = personKey(candidate.email)\n    if (!key) continue\n    for (const hostId of input.hostIds.slice(0, CRM_INBOUND_LEAD_HOST_MAX)) {\n      const lead = await firestore\n        .collection('hosts')\n        .doc(hostId)\n        .collection('leads')\n        .doc(key)\n        .get()\n      if (!lead.exists) continue\n      const link: CrmActivityLink = { leadId: lead.id }\n      // A converted lead's mail belongs on the contact it became as well.\n      const converted = String(lead.get('convertedContactId') ?? '').trim()\n      if (converted) link.contactId = converted\n      return {\n        email: candidate.email,\n        direction: candidate.direction,\n        kind: 'lead',\n        link,\n        hostId,\n        // A lead carries no tokens of its own: the site's scope, as every\n        // record created from that site is stamped.\n        visibleTo: crmScopeTokens(org, consentGroupForHost(org, hostId)),\n      }\n    }\n  }\n  return null\n}\n\n/**\n * The workspace's roster as the filer matches against it: the member\n * documents and every member's stored alias document, two reads under the\n * org, reduced by `crmInboundRoster` to each member's sign-in address and\n * the aliases they have confirmed (AGL-2975).\n */\nexport async function loadCrmInboundRoster(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n): Promise<CrmInboundMember[]> {\n  const orgRef = firestore.collection('orgs').doc(orgId)\n  const [members, aliases] = await Promise.all([\n    orgRef.collection('members').get(),\n    orgRef.collection(MEMBER_EMAIL_ALIASES_COLLECTION).get(),\n  ])\n  const rows: CrmInboundRosterRow[] = members.docs.map((doc) => ({\n    ...((doc.data() ?? {}) as Omit<CrmInboundRosterRow, '$id'>),\n    $id: doc.id,\n  }))\n  const aliasDocuments = new Map<string, unknown>(\n    aliases.docs.map((doc) => [String(doc.id), doc.data()]),\n  )\n  return crmInboundRoster(rows, aliasDocuments)\n}\n\nexport type CrmInboundFileOutcome =\n  /** A row was written. */\n  | { outcome: 'filed'; activityId: string; match: CrmInboundMatch }\n  /** The message had been filed before; nothing written. */\n  | { outcome: 'duplicate'; activityId: string }\n  /** No address on the message is a record of the org; nothing written. */\n  | { outcome: 'unmatched'; senderDomain: string | null }\n  /** The record's activity log is at its ceiling; nothing written. */\n  | { outcome: 'ceiling'; match: CrmInboundMatch }\n\n/**\n * Files one received message on the record it was with (AGL-2657).\n *\n * The order is the cost: the candidate rule is arithmetic; the match is\n * the reads that decide everything after it; a message filed before is\n * answered off one read of the row it would write, before the ceiling's\n * aggregate; the ceiling comes last and refuses rather than dropping a row\n * on a full log. The write is a `create`, so two deliveries racing past\n * the read still yield one row. The BODY never leaves this function except\n * as the bounded excerpt in the row.\n */\nexport async function fileCrmInboundEmail(\n  firestore: FirebaseFirestore.Firestore,\n  input: {\n    orgId: string\n    org: Record<string, unknown>\n    message: ReceivedEmail\n    /** The capture domain, so the capture address is never the correspondent. */\n    domain: string\n    /** The roster, from `loadCrmInboundRoster`: sign-in addresses and confirmed aliases. */\n    members: readonly CrmInboundMember[]\n    hostIds: readonly string[]\n  },\n): Promise<CrmInboundFileOutcome> {\n  const { orgId, org, message, domain } = input\n  const plain = (message.text.trim() ? message.text : htmlToPlainText(message.html)).replace(\n    /\\r\\n?/g,\n    '\\n',\n  )\n  const forwarded = forwardedSection(plain)\n  const { sender, senderIsMember, candidates } = crmInboundCandidates({\n    from: message.from,\n    to: [...message.to, ...message.receivedFor],\n    cc: [...message.cc, ...message.bcc],\n    forwardedFrom: forwarded?.from ?? undefined,\n    domain,\n    members: input.members,\n  })\n  const senderDomain = emailDomainOf(message.from)\n  if (!candidates.length) return { outcome: 'unmatched', senderDomain }\n\n  const match = await matchCrmInboundCorrespondent(firestore, {\n    orgId,\n    org,\n    candidates,\n    hostIds: input.hostIds,\n  })\n  if (!match) return { outcome: 'unmatched', senderDomain }\n\n  const key = crmCapturedEmailKey(message.messageId, message.id)\n  const ref = key\n    ? crmCapturedEmailActivityRef(firestore, orgId, key)\n    : newCrmActivityRef(firestore, orgId)\n  if (key) {\n    const existing = await ref.get()\n    if (existing.exists) return { outcome: 'duplicate', activityId: ref.id }\n  }\n\n  const orgRef = firestore.collection('orgs').doc(orgId)\n  if (!crmActivityLogHasRoom(await countCrmActivitiesForRecord(orgRef, match.link))) {\n    return { outcome: 'ceiling', match }\n  }\n\n  // The member the From is — by sign-in address, or by an alias exactly one\n  // member confirmed. A shared alias names the team and no one person.\n  const author = senderIsMember ? findMemberByEmailAddress(input.members, sender) : null\n  // The address the message was written to, when it is worth showing: the\n  // correspondent for a copied send, else the first recipient that is not\n  // the capture address.\n  const to =\n    match.direction === 'outbound'\n      ? match.email\n      : (message.to\n          .map((value) => emailAddressOf(value))\n          .find((value) => value && !isCrmInboundAddress(value, domain)) ?? null)\n  const activity = buildCrmCapturedEmailActivity({\n    direction: match.direction,\n    subject: message.subject,\n    excerpt: crmInboundExcerpt(message.text, message.html),\n    from: sender ?? message.from,\n    to,\n    messageId: message.messageId || message.id,\n    inReplyTo: message.inReplyTo,\n    atMs: message.receivedAtMs,\n    byUid: author?.uid ?? '',\n    byName: author?.name ?? null,\n    link: match.link,\n    hostId: match.hostId,\n    visibleTo: match.visibleTo,\n  })\n  const created = await createCrmEmailActivity(ref, activity)\n  return created === 'created'\n    ? { outcome: 'filed', activityId: ref.id, match }\n    : { outcome: 'duplicate', activityId: ref.id }\n}\n"],"names":["buildCrmCapturedEmailActivity","consentGroupForHost","contactCaptureHostIds","crmActivityLogHasRoom","crmCapturedEmailKey","crmInboundCandidates","crmInboundExcerpt","crmInboundRoster","crmScopeTokens","emailAddressOf","emailDomainOf","findMemberByEmailAddress","forwardedSection","htmlToPlainText","isCrmInboundAddress","isCrmInboundToken","mintCrmInboundToken","personKey","readContactFacet","MEMBER_EMAIL_ALIASES_COLLECTION","findContactByEmail","createCrmEmailActivity","crmCapturedEmailActivityRef","newCrmActivityRef","countCrmActivitiesForRecord","CRM_INBOUND_CANDIDATE_MAX","CRM_INBOUND_LEAD_HOST_MAX","ensureCrmInboundToken","firestore","orgId","options","rotate","nowMs","Date","now","orgRef","collection","doc","runTransaction","tx","snapshot","get","exists","Error","current","held","token","createdAtMs","Number","String","isFinite","rotatedAtMs","rotated","next","update","crmInbound","findOrgByCrmInboundToken","page","where","limit","docs","id","org","$id","data","crmInboundHostIds","map","matchCrmInboundCorrespondent","input","contacts","tokensOf","record","raw","Array","isArray","candidate","candidates","slice","contact","email","hostId","trim","link","contactId","group","facet","groupId","companyId","direction","kind","visibleTo","key","hostIds","lead","leadId","converted","loadCrmInboundRoster","members","aliases","Promise","all","rows","aliasDocuments","Map","fileCrmInboundEmail","message","domain","plain","text","html","replace","forwarded","sender","senderIsMember","from","to","receivedFor","cc","bcc","forwardedFrom","undefined","senderDomain","length","outcome","match","messageId","ref","existing","activityId","author","value","find","activity","subject","excerpt","inReplyTo","atMs","receivedAtMs","byUid","uid","byName","name","created"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,6BAA6B,EAC7BC,mBAAmB,EACnBC,qBAAqB,EACrBC,qBAAqB,EACrBC,mBAAmB,EACnBC,oBAAoB,EACpBC,iBAAiB,EACjBC,gBAAgB,EAMhBC,cAAc,EACdC,cAAc,EACdC,aAAa,EACbC,wBAAwB,EACxBC,gBAAgB,EAChBC,eAAe,EACfC,mBAAmB,EACnBC,iBAAiB,EACjBC,mBAAmB,EACnBC,SAAS,EACTC,gBAAgB,QACX,sBAAqB;AAC5B,SAASC,+BAA+B,QAAQ,8CAA6C;AAG7F,SAASC,kBAAkB,QAAQ,2BAAuB;AAC1D,SACEC,sBAAsB,EACtBC,2BAA2B,EAC3BC,iBAAiB,QACZ,0BAAsB;AAC7B,SAASC,2BAA2B,QAAQ,mBAAe;AAE3D;;;;;;;;;;;;;;;CAeC,GAED,4DAA4D,GAC5D,OAAO,MAAMC,4BAA4B,EAAC;AAE1C,8DAA8D,GAC9D,OAAO,MAAMC,4BAA4B,GAAE;AAU3C;;;;;CAKC,GACD,OAAO,eAAeC,sBACpBC,SAAsC,EACtCC,KAAa,EACbC,UAAgD,CAAC,CAAC;QAGpCA;IADd,MAAMC,SAASD,QAAQC,MAAM,KAAK;IAClC,MAAMC,SAAQF,iBAAAA,QAAQE,KAAK,YAAbF,iBAAiBG,KAAKC,GAAG;IACvC,MAAMC,SAASP,UAAUQ,UAAU,CAAC,QAAQC,GAAG,CAACR;IAChD,OAAOD,UAAUU,cAAc,CAAC,OAAOC;YAGpBC;QAFjB,MAAMA,WAAW,MAAMD,GAAGE,GAAG,CAACN;QAC9B,IAAI,CAACK,SAASE,MAAM,EAAE,MAAM,IAAIC,MAAM,CAAC,0BAA0B,EAAEd,OAAO;QAC1E,MAAMe,WAAWJ,gBAAAA,SAASC,GAAG,CAAC,yBAAbD,gBAA8B;QAC/C,MAAMK,OAAO9B,kBAAkB6B,2BAAAA,QAASE,KAAK;QAC7C,IAAID,QAAQ,CAACd,QAAQ;YACnB,MAAMgB,cAAcC,OAAOJ,2BAAAA,QAASG,WAAW;YAC/C,OAAO;gBACLD,OAAOG,OAAOL,2BAAAA,QAASE,KAAK;gBAC5BC,aAAaC,OAAOE,QAAQ,CAACH,gBAAgBA,cAAc,IAAIA,cAAcf;eACzE,QAAOY,2BAAAA,QAASO,WAAW,MAAK,WAAW;gBAAEA,aAAaP,QAAQO,WAAW;YAAC,IAAI,CAAC;gBACvFC,SAAS;;QAEb;QACA,MAAML,cACJF,QAAQG,OAAOE,QAAQ,CAACF,OAAOJ,2BAAAA,QAASG,WAAW,MAAMC,OAAOJ,2BAAAA,QAASG,WAAW,IAAI,IACpFC,OAAOJ,2BAAAA,QAASG,WAAW,IAC3Bf;QACN,MAAMqB,OAAsB;YAC1BP,OAAO9B;YACP+B;WACIF,OAAO;YAAEM,aAAanB;QAAM,IAAI,CAAC;QAEvCO,GAAGe,MAAM,CAACnB,QAAQ;YAAEoB,YAAYF;QAAK;QACrC,OAAO,aAAKA;YAAMD,SAASP;;IAC7B;AACF;AAEA;;;;;CAKC,GACD,OAAO,eAAeW,yBACpB5B,SAAsC,EACtCkB,KAAc;QAUkCT;IARhD,IAAI,CAACtB,kBAAkB+B,QAAQ,OAAO;IACtC,MAAMW,OAAO,MAAM7B,UAChBQ,UAAU,CAAC,QACXsB,KAAK,CAAC,oBAAoB,MAAMZ,OAChCa,KAAK,CAAC,GACNlB,GAAG;IACN,MAAMJ,MAAMoB,KAAKG,IAAI,CAAC,EAAE;IACxB,IAAI,CAACvB,KAAK,OAAO;IACjB,OAAO;QAAER,OAAOQ,IAAIwB,EAAE;QAAEC,KAAK;YAAEC,KAAK1B,IAAIwB,EAAE;YAAMxB,YAAAA,IAAI2B,IAAI,cAAR3B,YAAc,CAAC;IAAK;AACtE;AAEA;;;CAGC,GACD,OAAO,eAAe4B,kBACpBrC,SAAsC,EACtCC,KAAa;IAEb,MAAM4B,OAAO,MAAM7B,UAChBQ,UAAU,CAAC,SACXsB,KAAK,CAAC,SAAS,MAAM7B,OACrB8B,KAAK,CAACjC,2BACNe,GAAG;IACN,OAAOgB,KAAKG,IAAI,CAACM,GAAG,CAAC,CAAC7B,MAAQY,OAAOZ,IAAIwB,EAAE;AAC7C;AAeA;;;;;;CAMC,GACD,OAAO,eAAeM,6BACpBvC,SAAsC,EACtCwC,KAKC;IAED,MAAM,EAAEvC,KAAK,EAAEiC,GAAG,EAAE,GAAGM;IACvB,MAAMjC,SAASP,UAAUQ,UAAU,CAAC,QAAQC,GAAG,CAACR;IAChD,MAAMwC,WAAWlC,OAAOC,UAAU,CAAC;IACnC,MAAMkC,WAAW,CAACC;QAChB,MAAMC,MAAMD,MAAM,CAAC,YAAY;QAC/B,OAAOE,MAAMC,OAAO,CAACF,OAAOA,IAAIN,GAAG,CAAC,CAACpB,QAAUG,OAAOH,UAAU,EAAE;IACpE;IACA,KAAK,MAAM6B,aAAaP,MAAMQ,UAAU,CAACC,KAAK,CAAC,GAAGpD,2BAA4B;QAC5E,MAAMqD,UAAU,MAAM1D,mBAAmBiD,UAAUM,UAAUI,KAAK;QAClE,IAAID,SAAS;gBACKA,eAEPP;YAFT,MAAMA,UAAUO,gBAAAA,QAAQd,IAAI,cAAZc,gBAAkB,CAAC;YACnC,MAAME,SACJ/B,QAAOsB,iBAAAA,MAAM,CAAC,SAAS,YAAhBA,iBAAoB,IAAIU,IAAI,MAAM/E,sBAAsBqE,OAAO,CAAC,EAAE,IAAI;YAC/E,MAAMW,OAAwB;gBAAEC,WAAWL,QAAQjB,EAAE;YAAC;YACtD,IAAImB,QAAQ;gBACV,iEAAiE;gBACjE,yDAAyD;gBACzD,MAAMI,QAAQnF,oBAAoB6D,KAAKkB;gBACvC,MAAMK,QAAQnE,iBAAiBqD,QAAQa,MAAME,OAAO;gBACpD,IAAID,MAAME,SAAS,EAAEL,KAAKK,SAAS,GAAGF,MAAME,SAAS;YACvD;YACA,OAAO;gBACLR,OAAOJ,UAAUI,KAAK;gBACtBS,WAAWb,UAAUa,SAAS;gBAC9BC,MAAM;gBACNP;gBACAF;gBACAU,WAAWpB,SAASC;YACtB;QACF;QACA,MAAMoB,MAAM1E,UAAU0D,UAAUI,KAAK;QACrC,IAAI,CAACY,KAAK;QACV,KAAK,MAAMX,UAAUZ,MAAMwB,OAAO,CAACf,KAAK,CAAC,GAAGnD,2BAA4B;gBAU7CmE;YATzB,MAAMA,OAAO,MAAMjE,UAChBQ,UAAU,CAAC,SACXC,GAAG,CAAC2C,QACJ5C,UAAU,CAAC,SACXC,GAAG,CAACsD,KACJlD,GAAG;YACN,IAAI,CAACoD,KAAKnD,MAAM,EAAE;YAClB,MAAMwC,OAAwB;gBAAEY,QAAQD,KAAKhC,EAAE;YAAC;YAChD,oEAAoE;YACpE,MAAMkC,YAAY9C,QAAO4C,YAAAA,KAAKpD,GAAG,CAAC,iCAAToD,YAAkC,IAAIZ,IAAI;YACnE,IAAIc,WAAWb,KAAKC,SAAS,GAAGY;YAChC,OAAO;gBACLhB,OAAOJ,UAAUI,KAAK;gBACtBS,WAAWb,UAAUa,SAAS;gBAC9BC,MAAM;gBACNP;gBACAF;gBACA,kEAAkE;gBAClE,4CAA4C;gBAC5CU,WAAWlF,eAAesD,KAAK7D,oBAAoB6D,KAAKkB;YAC1D;QACF;IACF;IACA,OAAO;AACT;AAEA;;;;;CAKC,GACD,OAAO,eAAegB,qBACpBpE,SAAsC,EACtCC,KAAa;IAEb,MAAMM,SAASP,UAAUQ,UAAU,CAAC,QAAQC,GAAG,CAACR;IAChD,MAAM,CAACoE,SAASC,QAAQ,GAAG,MAAMC,QAAQC,GAAG,CAAC;QAC3CjE,OAAOC,UAAU,CAAC,WAAWK,GAAG;QAChCN,OAAOC,UAAU,CAACjB,iCAAiCsB,GAAG;KACvD;IACD,MAAM4D,OAA8BJ,QAAQrC,IAAI,CAACM,GAAG,CAAC,CAAC7B;YAC/CA;eADwD,cACxDA,YAAAA,IAAI2B,IAAI,cAAR3B,YAAc,CAAC;YACpB0B,KAAK1B,IAAIwB,EAAE;;;IAEb,MAAMyC,iBAAiB,IAAIC,IACzBL,QAAQtC,IAAI,CAACM,GAAG,CAAC,CAAC7B,MAAQ;YAACY,OAAOZ,IAAIwB,EAAE;YAAGxB,IAAI2B,IAAI;SAAG;IAExD,OAAOzD,iBAAiB8F,MAAMC;AAChC;AAYA;;;;;;;;;;CAUC,GACD,OAAO,eAAeE,oBACpB5E,SAAsC,EACtCwC,KASC;cAkDMqC;IAhDP,MAAM,EAAE5E,KAAK,EAAEiC,GAAG,EAAE2C,OAAO,EAAEC,MAAM,EAAE,GAAGtC;IACxC,MAAMuC,QAAQ,AAACF,CAAAA,QAAQG,IAAI,CAAC3B,IAAI,KAAKwB,QAAQG,IAAI,GAAG/F,gBAAgB4F,QAAQI,IAAI,CAAA,EAAGC,OAAO,CACxF,UACA;IAEF,MAAMC,YAAYnG,iBAAiB+F;IACnC,MAAM,EAAEK,MAAM,EAAEC,cAAc,EAAErC,UAAU,EAAE,GAAGvE,qBAAqB;QAClE6G,MAAMT,QAAQS,IAAI;QAClBC,IAAI;eAAIV,QAAQU,EAAE;eAAKV,QAAQW,WAAW;SAAC;QAC3CC,IAAI;eAAIZ,QAAQY,EAAE;eAAKZ,QAAQa,GAAG;SAAC;QACnCC,aAAa,UAAER,6BAAAA,UAAWG,IAAI,mBAAIM;QAClCd;QACAT,SAAS7B,MAAM6B,OAAO;IACxB;IACA,MAAMwB,eAAe/G,cAAc+F,QAAQS,IAAI;IAC/C,IAAI,CAACtC,WAAW8C,MAAM,EAAE,OAAO;QAAEC,SAAS;QAAaF;IAAa;IAEpE,MAAMG,QAAQ,MAAMzD,6BAA6BvC,WAAW;QAC1DC;QACAiC;QACAc;QACAgB,SAASxB,MAAMwB,OAAO;IACxB;IACA,IAAI,CAACgC,OAAO,OAAO;QAAED,SAAS;QAAaF;IAAa;IAExD,MAAM9B,MAAMvF,oBAAoBqG,QAAQoB,SAAS,EAAEpB,QAAQ5C,EAAE;IAC7D,MAAMiE,MAAMnC,MACRrE,4BAA4BM,WAAWC,OAAO8D,OAC9CpE,kBAAkBK,WAAWC;IACjC,IAAI8D,KAAK;QACP,MAAMoC,WAAW,MAAMD,IAAIrF,GAAG;QAC9B,IAAIsF,SAASrF,MAAM,EAAE,OAAO;YAAEiF,SAAS;YAAaK,YAAYF,IAAIjE,EAAE;QAAC;IACzE;IAEA,MAAM1B,SAASP,UAAUQ,UAAU,CAAC,QAAQC,GAAG,CAACR;IAChD,IAAI,CAAC1B,sBAAsB,MAAMqB,4BAA4BW,QAAQyF,MAAM1C,IAAI,IAAI;QACjF,OAAO;YAAEyC,SAAS;YAAWC;QAAM;IACrC;IAEA,0EAA0E;IAC1E,qEAAqE;IACrE,MAAMK,SAAShB,iBAAiBtG,yBAAyByD,MAAM6B,OAAO,EAAEe,UAAU;IAClF,wEAAwE;IACxE,wEAAwE;IACxE,uBAAuB;IACvB,MAAMG,KACJS,MAAMpC,SAAS,KAAK,aAChBoC,MAAM7C,KAAK,IACV0B,uBAAAA,QAAQU,EAAE,CACRjD,GAAG,CAAC,CAACgE,QAAUzH,eAAeyH,QAC9BC,IAAI,CAAC,CAACD,QAAUA,SAAS,CAACpH,oBAAoBoH,OAAOxB,oBAFvDD,uBAEmE;IAC1E,MAAM2B,WAAWpI,8BAA8B;QAC7CwF,WAAWoC,MAAMpC,SAAS;QAC1B6C,SAAS5B,QAAQ4B,OAAO;QACxBC,SAAShI,kBAAkBmG,QAAQG,IAAI,EAAEH,QAAQI,IAAI;QACrDK,IAAI,EAAEF,iBAAAA,SAAUP,QAAQS,IAAI;QAC5BC;QACAU,WAAWpB,QAAQoB,SAAS,IAAIpB,QAAQ5C,EAAE;QAC1C0E,WAAW9B,QAAQ8B,SAAS;QAC5BC,MAAM/B,QAAQgC,YAAY;QAC1BC,KAAK,WAAET,0BAAAA,OAAQU,GAAG,oBAAI;QACtBC,MAAM,WAAEX,0BAAAA,OAAQY,IAAI,oBAAI;QACxB3D,MAAM0C,MAAM1C,IAAI;QAChBF,QAAQ4C,MAAM5C,MAAM;QACpBU,WAAWkC,MAAMlC,SAAS;IAC5B;IACA,MAAMoD,UAAU,MAAMzH,uBAAuByG,KAAKM;IAClD,OAAOU,YAAY,YACf;QAAEnB,SAAS;QAASK,YAAYF,IAAIjE,EAAE;QAAE+D;IAAM,IAC9C;QAAED,SAAS;QAAaK,YAAYF,IAAIjE,EAAE;IAAC;AACjD"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/crm-inbound-email.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  buildCrmCapturedEmailActivity,\n  consentGroupForHost,\n  contactCaptureHostIds,\n  crmActivityLogHasRoom,\n  crmCapturedEmailKey,\n  crmInboundCandidates,\n  crmInboundExcerpt,\n  crmInboundRoster,\n  type CrmActivityLink,\n  type CrmEmailDirection,\n  type CrmInboundCandidate,\n  type CrmInboundMember,\n  type CrmInboundRosterRow,\n  crmScopeTokens,\n  emailAddressOf,\n  emailDomainOf,\n  findMemberByEmailAddress,\n  forwardedSection,\n  htmlToPlainText,\n  isCrmInboundAddress,\n  isCrmInboundToken,\n  mintCrmInboundToken,\n  personKey,\n  readContactFacet,\n} from '@aglyn/aglyn/server'\nimport { MEMBER_EMAIL_ALIASES_COLLECTION } from '@aglyn/aglyn/app-utils/member-email-aliases'\nimport type { OrgCrmInbound } from '@aglyn/aglyn/foundation'\nimport type { ReceivedEmail } from '@aglyn/shared-util-email'\nimport { visibleToHost } from '@aglyn/aglyn/app-utils/scope-tokens'\nimport { findContactByEmail } from './contact-email-index'\nimport {\n  createCrmEmailActivity,\n  crmCapturedEmailActivityRef,\n  newCrmActivityRef,\n} from './crm-email-activity'\nimport { countCrmActivitiesForRecord } from './crm-records'\n\n/**\n * EMAIL CAPTURE (AGL-2657): the half with Firestore.\n *\n * The org's capture token — minted once, replaced on a rotation, found\n * again from a message's recipient — and the filing of one received\n * message: which record it was with, whether it has been filed before, and\n * the row it becomes. The pure rules are `@aglyn/aglyn`'s\n * `crm-inbound.ts`; this module is the reads and the one write.\n *\n * Firestore is a parameter throughout, as in `crm-records.ts` and\n * `crm-email-activity.ts`: the routes hold one, and a module that reached\n * for the Admin app itself would drag it into every spec that only wants\n * the matching. The roster is read through that same store by\n * `loadCrmInboundRoster`, and the caller writes the org's feed line, so a\n * spec of this module needs a store and nothing else.\n */\n\n/** The most candidate addresses one message is matched by. */\nexport const CRM_INBOUND_CANDIDATE_MAX = 6\n\n/** The most sites whose leads are consulted for one message. */\nexport const CRM_INBOUND_LEAD_HOST_MAX = 50\n\nexport interface CrmInboundTokenResult {\n  token: string\n  createdAtMs: number\n  rotatedAtMs?: number\n  /** True when this call replaced a token that existed. */\n  rotated: boolean\n}\n\n/**\n * The org's capture token, minted the first time anybody asks and kept\n * thereafter; with `rotate`, replaced. A transaction, so two members\n * opening the settings page at once mint one token and not two, and a\n * rotation lands on the token the reader saw.\n */\nexport async function ensureCrmInboundToken(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n  options: { rotate?: boolean; nowMs?: number } = {},\n): Promise<CrmInboundTokenResult> {\n  const rotate = options.rotate === true\n  const nowMs = options.nowMs ?? Date.now()\n  const orgRef = firestore.collection('orgs').doc(orgId)\n  return firestore.runTransaction(async (tx) => {\n    const snapshot = await tx.get(orgRef)\n    if (!snapshot.exists) throw new Error(`[crm-inbound] unknown org ${orgId}`)\n    const current = (snapshot.get('crmInbound') ?? null) as Partial<OrgCrmInbound> | null\n    const held = isCrmInboundToken(current?.token)\n    if (held && !rotate) {\n      const createdAtMs = Number(current?.createdAtMs)\n      return {\n        token: String(current?.token),\n        createdAtMs: Number.isFinite(createdAtMs) && createdAtMs > 0 ? createdAtMs : nowMs,\n        ...(typeof current?.rotatedAtMs === 'number' ? { rotatedAtMs: current.rotatedAtMs } : {}),\n        rotated: false,\n      }\n    }\n    const createdAtMs =\n      held && Number.isFinite(Number(current?.createdAtMs)) && Number(current?.createdAtMs) > 0\n        ? Number(current?.createdAtMs)\n        : nowMs\n    const next: OrgCrmInbound = {\n      token: mintCrmInboundToken(),\n      createdAtMs,\n      ...(held ? { rotatedAtMs: nowMs } : {}),\n    }\n    tx.update(orgRef, { crmInbound: next })\n    return { ...next, rotated: held }\n  })\n}\n\n/**\n * The org a capture token names, or `null`. One equality on\n * `crmInbound.token`, which Firestore indexes on its own; a token that is\n * not one by shape is refused before the query, so a malformed local part\n * costs no read.\n */\nexport async function findOrgByCrmInboundToken(\n  firestore: FirebaseFirestore.Firestore,\n  token: unknown,\n): Promise<{ orgId: string; org: Record<string, unknown> } | null> {\n  if (!isCrmInboundToken(token)) return null\n  const page = await firestore\n    .collection('orgs')\n    .where('crmInbound.token', '==', token)\n    .limit(1)\n    .get()\n  const doc = page.docs[0]\n  if (!doc) return null\n  return { orgId: doc.id, org: { $id: doc.id, ...(doc.data() ?? {}) } }\n}\n\n/**\n * Every site of the organization, by id, up to the ceiling — the set a\n * message's lead lookup sweeps. One equality on `hosts.orgId`.\n */\nexport async function crmInboundHostIds(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n): Promise<string[]> {\n  const page = await firestore\n    .collection('hosts')\n    .where('orgId', '==', orgId)\n    .limit(CRM_INBOUND_LEAD_HOST_MAX)\n    .get()\n  return page.docs.map((doc) => String(doc.id))\n}\n\n/** The record one of a message's addresses resolved to. */\nexport interface CrmInboundMatch {\n  email: string\n  direction: CrmEmailDirection\n  kind: 'contact' | 'lead'\n  /** Where the row is filed. */\n  link: CrmActivityLink\n  /** The site the row is stamped with — the record's own. */\n  hostId: string\n  /** Who may list the row — the record's own tokens. */\n  visibleTo: string[]\n}\n\n/**\n * The first candidate that is a contact of the org — through the address\n * index, so a merged record's alternate address answers — or a lead on any\n * of its sites. Candidates are tried in the order the rule gave them and\n * the first hit wins; a contact is looked for before a lead at each\n * address, because a converted lead's address is its contact's.\n */\nexport async function matchCrmInboundCorrespondent(\n  firestore: FirebaseFirestore.Firestore,\n  input: {\n    orgId: string\n    org: Record<string, unknown>\n    candidates: readonly CrmInboundCandidate[]\n    hostIds: readonly string[]\n  },\n): Promise<CrmInboundMatch | null> {\n  const { orgId, org } = input\n  const orgRef = firestore.collection('orgs').doc(orgId)\n  const contacts = orgRef.collection('contacts')\n  const tokensOf = (record: Record<string, unknown>): string[] => {\n    const raw = record['visibleTo']\n    return Array.isArray(raw) ? raw.map((token) => String(token)) : []\n  }\n  for (const candidate of input.candidates.slice(0, CRM_INBOUND_CANDIDATE_MAX)) {\n    const contact = await findContactByEmail(contacts, candidate.email)\n    if (contact) {\n      const record = (contact.data() ?? {}) as Record<string, unknown>\n      const hostId =\n        String(record['hostId'] ?? '').trim() || contactCaptureHostIds(record)[0] || ''\n      const link: CrmActivityLink = { contactId: contact.id }\n      if (hostId) {\n        // The company the capturing site files this person under, so the\n        // row shows on the company's log as a sent email's does.\n        const group = consentGroupForHost(org, hostId)\n        const facet = readContactFacet(record, group.groupId)\n        if (facet.companyId) link.companyId = facet.companyId\n      }\n      return {\n        email: candidate.email,\n        direction: candidate.direction,\n        kind: 'contact',\n        link,\n        hostId,\n        visibleTo: tokensOf(record),\n      }\n    }\n    const key = personKey(candidate.email)\n    if (!key) continue\n    /*\n     * ONE ROW, then which of the named sites may see it (AGL-3275).\n     *\n     * This used to read a lead per site because there was one per site. There\n     * is one now, so the read is single and the LOOP is what it always really\n     * was: deciding whose mailbox this reply belongs to. A site that cannot\n     * see the row is not that site, which is what `visibleToHost` answers —\n     * and skipping it is what keeps an agency's clients apart on a shared row.\n     */\n    const lead = await orgRef.collection('leads').doc(key).get()\n    for (const hostId of input.hostIds.slice(0, CRM_INBOUND_LEAD_HOST_MAX)) {\n      if (!lead.exists) break\n      if (!visibleToHost(lead.get('visibleTo') as string[] | undefined, hostId)) continue\n      const link: CrmActivityLink = { leadId: lead.id }\n      // A converted lead's mail belongs on the contact it became as well.\n      const converted = String(lead.get('convertedContactId') ?? '').trim()\n      if (converted) link.contactId = converted\n      return {\n        email: candidate.email,\n        direction: candidate.direction,\n        kind: 'lead',\n        link,\n        hostId,\n        // A lead carries no tokens of its own: the site's scope, as every\n        // record created from that site is stamped.\n        visibleTo: crmScopeTokens(org, consentGroupForHost(org, hostId)),\n      }\n    }\n  }\n  return null\n}\n\n/**\n * The workspace's roster as the filer matches against it: the member\n * documents and every member's stored alias document, two reads under the\n * org, reduced by `crmInboundRoster` to each member's sign-in address and\n * the aliases they have confirmed (AGL-2975).\n */\nexport async function loadCrmInboundRoster(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n): Promise<CrmInboundMember[]> {\n  const orgRef = firestore.collection('orgs').doc(orgId)\n  const [members, aliases] = await Promise.all([\n    orgRef.collection('members').get(),\n    orgRef.collection(MEMBER_EMAIL_ALIASES_COLLECTION).get(),\n  ])\n  const rows: CrmInboundRosterRow[] = members.docs.map((doc) => ({\n    ...((doc.data() ?? {}) as Omit<CrmInboundRosterRow, '$id'>),\n    $id: doc.id,\n  }))\n  const aliasDocuments = new Map<string, unknown>(\n    aliases.docs.map((doc) => [String(doc.id), doc.data()]),\n  )\n  return crmInboundRoster(rows, aliasDocuments)\n}\n\nexport type CrmInboundFileOutcome =\n  /** A row was written. */\n  | { outcome: 'filed'; activityId: string; match: CrmInboundMatch }\n  /** The message had been filed before; nothing written. */\n  | { outcome: 'duplicate'; activityId: string }\n  /** No address on the message is a record of the org; nothing written. */\n  | { outcome: 'unmatched'; senderDomain: string | null }\n  /** The record's activity log is at its ceiling; nothing written. */\n  | { outcome: 'ceiling'; match: CrmInboundMatch }\n\n/**\n * Files one received message on the record it was with (AGL-2657).\n *\n * The order is the cost: the candidate rule is arithmetic; the match is\n * the reads that decide everything after it; a message filed before is\n * answered off one read of the row it would write, before the ceiling's\n * aggregate; the ceiling comes last and refuses rather than dropping a row\n * on a full log. The write is a `create`, so two deliveries racing past\n * the read still yield one row. The BODY never leaves this function except\n * as the bounded excerpt in the row.\n */\nexport async function fileCrmInboundEmail(\n  firestore: FirebaseFirestore.Firestore,\n  input: {\n    orgId: string\n    org: Record<string, unknown>\n    message: ReceivedEmail\n    /** The capture domain, so the capture address is never the correspondent. */\n    domain: string\n    /** The roster, from `loadCrmInboundRoster`: sign-in addresses and confirmed aliases. */\n    members: readonly CrmInboundMember[]\n    hostIds: readonly string[]\n  },\n): Promise<CrmInboundFileOutcome> {\n  const { orgId, org, message, domain } = input\n  const plain = (message.text.trim() ? message.text : htmlToPlainText(message.html)).replace(\n    /\\r\\n?/g,\n    '\\n',\n  )\n  const forwarded = forwardedSection(plain)\n  const { sender, senderIsMember, candidates } = crmInboundCandidates({\n    from: message.from,\n    to: [...message.to, ...message.receivedFor],\n    cc: [...message.cc, ...message.bcc],\n    forwardedFrom: forwarded?.from ?? undefined,\n    domain,\n    members: input.members,\n  })\n  const senderDomain = emailDomainOf(message.from)\n  if (!candidates.length) return { outcome: 'unmatched', senderDomain }\n\n  const match = await matchCrmInboundCorrespondent(firestore, {\n    orgId,\n    org,\n    candidates,\n    hostIds: input.hostIds,\n  })\n  if (!match) return { outcome: 'unmatched', senderDomain }\n\n  const key = crmCapturedEmailKey(message.messageId, message.id)\n  const ref = key\n    ? crmCapturedEmailActivityRef(firestore, orgId, key)\n    : newCrmActivityRef(firestore, orgId)\n  if (key) {\n    const existing = await ref.get()\n    if (existing.exists) return { outcome: 'duplicate', activityId: ref.id }\n  }\n\n  const orgRef = firestore.collection('orgs').doc(orgId)\n  if (!crmActivityLogHasRoom(await countCrmActivitiesForRecord(orgRef, match.link))) {\n    return { outcome: 'ceiling', match }\n  }\n\n  // The member the From is — by sign-in address, or by an alias exactly one\n  // member confirmed. A shared alias names the team and no one person.\n  const author = senderIsMember ? findMemberByEmailAddress(input.members, sender) : null\n  // The address the message was written to, when it is worth showing: the\n  // correspondent for a copied send, else the first recipient that is not\n  // the capture address.\n  const to =\n    match.direction === 'outbound'\n      ? match.email\n      : (message.to\n          .map((value) => emailAddressOf(value))\n          .find((value) => value && !isCrmInboundAddress(value, domain)) ?? null)\n  const activity = buildCrmCapturedEmailActivity({\n    direction: match.direction,\n    subject: message.subject,\n    excerpt: crmInboundExcerpt(message.text, message.html),\n    from: sender ?? message.from,\n    to,\n    messageId: message.messageId || message.id,\n    inReplyTo: message.inReplyTo,\n    atMs: message.receivedAtMs,\n    byUid: author?.uid ?? '',\n    byName: author?.name ?? null,\n    link: match.link,\n    hostId: match.hostId,\n    visibleTo: match.visibleTo,\n  })\n  const created = await createCrmEmailActivity(ref, activity)\n  return created === 'created'\n    ? { outcome: 'filed', activityId: ref.id, match }\n    : { outcome: 'duplicate', activityId: ref.id }\n}\n"],"names":["buildCrmCapturedEmailActivity","consentGroupForHost","contactCaptureHostIds","crmActivityLogHasRoom","crmCapturedEmailKey","crmInboundCandidates","crmInboundExcerpt","crmInboundRoster","crmScopeTokens","emailAddressOf","emailDomainOf","findMemberByEmailAddress","forwardedSection","htmlToPlainText","isCrmInboundAddress","isCrmInboundToken","mintCrmInboundToken","personKey","readContactFacet","MEMBER_EMAIL_ALIASES_COLLECTION","visibleToHost","findContactByEmail","createCrmEmailActivity","crmCapturedEmailActivityRef","newCrmActivityRef","countCrmActivitiesForRecord","CRM_INBOUND_CANDIDATE_MAX","CRM_INBOUND_LEAD_HOST_MAX","ensureCrmInboundToken","firestore","orgId","options","rotate","nowMs","Date","now","orgRef","collection","doc","runTransaction","tx","snapshot","get","exists","Error","current","held","token","createdAtMs","Number","String","isFinite","rotatedAtMs","rotated","next","update","crmInbound","findOrgByCrmInboundToken","page","where","limit","docs","id","org","$id","data","crmInboundHostIds","map","matchCrmInboundCorrespondent","input","contacts","tokensOf","record","raw","Array","isArray","candidate","candidates","slice","contact","email","hostId","trim","link","contactId","group","facet","groupId","companyId","direction","kind","visibleTo","key","lead","hostIds","leadId","converted","loadCrmInboundRoster","members","aliases","Promise","all","rows","aliasDocuments","Map","fileCrmInboundEmail","message","domain","plain","text","html","replace","forwarded","sender","senderIsMember","from","to","receivedFor","cc","bcc","forwardedFrom","undefined","senderDomain","length","outcome","match","messageId","ref","existing","activityId","author","value","find","activity","subject","excerpt","inReplyTo","atMs","receivedAtMs","byUid","uid","byName","name","created"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,6BAA6B,EAC7BC,mBAAmB,EACnBC,qBAAqB,EACrBC,qBAAqB,EACrBC,mBAAmB,EACnBC,oBAAoB,EACpBC,iBAAiB,EACjBC,gBAAgB,EAMhBC,cAAc,EACdC,cAAc,EACdC,aAAa,EACbC,wBAAwB,EACxBC,gBAAgB,EAChBC,eAAe,EACfC,mBAAmB,EACnBC,iBAAiB,EACjBC,mBAAmB,EACnBC,SAAS,EACTC,gBAAgB,QACX,sBAAqB;AAC5B,SAASC,+BAA+B,QAAQ,8CAA6C;AAG7F,SAASC,aAAa,QAAQ,sCAAqC;AACnE,SAASC,kBAAkB,QAAQ,2BAAuB;AAC1D,SACEC,sBAAsB,EACtBC,2BAA2B,EAC3BC,iBAAiB,QACZ,0BAAsB;AAC7B,SAASC,2BAA2B,QAAQ,mBAAe;AAE3D;;;;;;;;;;;;;;;CAeC,GAED,4DAA4D,GAC5D,OAAO,MAAMC,4BAA4B,EAAC;AAE1C,8DAA8D,GAC9D,OAAO,MAAMC,4BAA4B,GAAE;AAU3C;;;;;CAKC,GACD,OAAO,eAAeC,sBACpBC,SAAsC,EACtCC,KAAa,EACbC,UAAgD,CAAC,CAAC;QAGpCA;IADd,MAAMC,SAASD,QAAQC,MAAM,KAAK;IAClC,MAAMC,SAAQF,iBAAAA,QAAQE,KAAK,YAAbF,iBAAiBG,KAAKC,GAAG;IACvC,MAAMC,SAASP,UAAUQ,UAAU,CAAC,QAAQC,GAAG,CAACR;IAChD,OAAOD,UAAUU,cAAc,CAAC,OAAOC;YAGpBC;QAFjB,MAAMA,WAAW,MAAMD,GAAGE,GAAG,CAACN;QAC9B,IAAI,CAACK,SAASE,MAAM,EAAE,MAAM,IAAIC,MAAM,CAAC,0BAA0B,EAAEd,OAAO;QAC1E,MAAMe,WAAWJ,gBAAAA,SAASC,GAAG,CAAC,yBAAbD,gBAA8B;QAC/C,MAAMK,OAAO/B,kBAAkB8B,2BAAAA,QAASE,KAAK;QAC7C,IAAID,QAAQ,CAACd,QAAQ;YACnB,MAAMgB,cAAcC,OAAOJ,2BAAAA,QAASG,WAAW;YAC/C,OAAO;gBACLD,OAAOG,OAAOL,2BAAAA,QAASE,KAAK;gBAC5BC,aAAaC,OAAOE,QAAQ,CAACH,gBAAgBA,cAAc,IAAIA,cAAcf;eACzE,QAAOY,2BAAAA,QAASO,WAAW,MAAK,WAAW;gBAAEA,aAAaP,QAAQO,WAAW;YAAC,IAAI,CAAC;gBACvFC,SAAS;;QAEb;QACA,MAAML,cACJF,QAAQG,OAAOE,QAAQ,CAACF,OAAOJ,2BAAAA,QAASG,WAAW,MAAMC,OAAOJ,2BAAAA,QAASG,WAAW,IAAI,IACpFC,OAAOJ,2BAAAA,QAASG,WAAW,IAC3Bf;QACN,MAAMqB,OAAsB;YAC1BP,OAAO/B;YACPgC;WACIF,OAAO;YAAEM,aAAanB;QAAM,IAAI,CAAC;QAEvCO,GAAGe,MAAM,CAACnB,QAAQ;YAAEoB,YAAYF;QAAK;QACrC,OAAO,aAAKA;YAAMD,SAASP;;IAC7B;AACF;AAEA;;;;;CAKC,GACD,OAAO,eAAeW,yBACpB5B,SAAsC,EACtCkB,KAAc;QAUkCT;IARhD,IAAI,CAACvB,kBAAkBgC,QAAQ,OAAO;IACtC,MAAMW,OAAO,MAAM7B,UAChBQ,UAAU,CAAC,QACXsB,KAAK,CAAC,oBAAoB,MAAMZ,OAChCa,KAAK,CAAC,GACNlB,GAAG;IACN,MAAMJ,MAAMoB,KAAKG,IAAI,CAAC,EAAE;IACxB,IAAI,CAACvB,KAAK,OAAO;IACjB,OAAO;QAAER,OAAOQ,IAAIwB,EAAE;QAAEC,KAAK;YAAEC,KAAK1B,IAAIwB,EAAE;YAAMxB,YAAAA,IAAI2B,IAAI,cAAR3B,YAAc,CAAC;IAAK;AACtE;AAEA;;;CAGC,GACD,OAAO,eAAe4B,kBACpBrC,SAAsC,EACtCC,KAAa;IAEb,MAAM4B,OAAO,MAAM7B,UAChBQ,UAAU,CAAC,SACXsB,KAAK,CAAC,SAAS,MAAM7B,OACrB8B,KAAK,CAACjC,2BACNe,GAAG;IACN,OAAOgB,KAAKG,IAAI,CAACM,GAAG,CAAC,CAAC7B,MAAQY,OAAOZ,IAAIwB,EAAE;AAC7C;AAeA;;;;;;CAMC,GACD,OAAO,eAAeM,6BACpBvC,SAAsC,EACtCwC,KAKC;IAED,MAAM,EAAEvC,KAAK,EAAEiC,GAAG,EAAE,GAAGM;IACvB,MAAMjC,SAASP,UAAUQ,UAAU,CAAC,QAAQC,GAAG,CAACR;IAChD,MAAMwC,WAAWlC,OAAOC,UAAU,CAAC;IACnC,MAAMkC,WAAW,CAACC;QAChB,MAAMC,MAAMD,MAAM,CAAC,YAAY;QAC/B,OAAOE,MAAMC,OAAO,CAACF,OAAOA,IAAIN,GAAG,CAAC,CAACpB,QAAUG,OAAOH,UAAU,EAAE;IACpE;IACA,KAAK,MAAM6B,aAAaP,MAAMQ,UAAU,CAACC,KAAK,CAAC,GAAGpD,2BAA4B;QAC5E,MAAMqD,UAAU,MAAM1D,mBAAmBiD,UAAUM,UAAUI,KAAK;QAClE,IAAID,SAAS;gBACKA,eAEPP;YAFT,MAAMA,UAAUO,gBAAAA,QAAQd,IAAI,cAAZc,gBAAkB,CAAC;YACnC,MAAME,SACJ/B,QAAOsB,iBAAAA,MAAM,CAAC,SAAS,YAAhBA,iBAAoB,IAAIU,IAAI,MAAMhF,sBAAsBsE,OAAO,CAAC,EAAE,IAAI;YAC/E,MAAMW,OAAwB;gBAAEC,WAAWL,QAAQjB,EAAE;YAAC;YACtD,IAAImB,QAAQ;gBACV,iEAAiE;gBACjE,yDAAyD;gBACzD,MAAMI,QAAQpF,oBAAoB8D,KAAKkB;gBACvC,MAAMK,QAAQpE,iBAAiBsD,QAAQa,MAAME,OAAO;gBACpD,IAAID,MAAME,SAAS,EAAEL,KAAKK,SAAS,GAAGF,MAAME,SAAS;YACvD;YACA,OAAO;gBACLR,OAAOJ,UAAUI,KAAK;gBACtBS,WAAWb,UAAUa,SAAS;gBAC9BC,MAAM;gBACNP;gBACAF;gBACAU,WAAWpB,SAASC;YACtB;QACF;QACA,MAAMoB,MAAM3E,UAAU2D,UAAUI,KAAK;QACrC,IAAI,CAACY,KAAK;QACV;;;;;;;;KAQC,GACD,MAAMC,OAAO,MAAMzD,OAAOC,UAAU,CAAC,SAASC,GAAG,CAACsD,KAAKlD,GAAG;QAC1D,KAAK,MAAMuC,UAAUZ,MAAMyB,OAAO,CAAChB,KAAK,CAAC,GAAGnD,2BAA4B;gBAK7CkE;YAJzB,IAAI,CAACA,KAAKlD,MAAM,EAAE;YAClB,IAAI,CAACvB,cAAcyE,KAAKnD,GAAG,CAAC,cAAsCuC,SAAS;YAC3E,MAAME,OAAwB;gBAAEY,QAAQF,KAAK/B,EAAE;YAAC;YAChD,oEAAoE;YACpE,MAAMkC,YAAY9C,QAAO2C,YAAAA,KAAKnD,GAAG,CAAC,iCAATmD,YAAkC,IAAIX,IAAI;YACnE,IAAIc,WAAWb,KAAKC,SAAS,GAAGY;YAChC,OAAO;gBACLhB,OAAOJ,UAAUI,KAAK;gBACtBS,WAAWb,UAAUa,SAAS;gBAC9BC,MAAM;gBACNP;gBACAF;gBACA,kEAAkE;gBAClE,4CAA4C;gBAC5CU,WAAWnF,eAAeuD,KAAK9D,oBAAoB8D,KAAKkB;YAC1D;QACF;IACF;IACA,OAAO;AACT;AAEA;;;;;CAKC,GACD,OAAO,eAAegB,qBACpBpE,SAAsC,EACtCC,KAAa;IAEb,MAAMM,SAASP,UAAUQ,UAAU,CAAC,QAAQC,GAAG,CAACR;IAChD,MAAM,CAACoE,SAASC,QAAQ,GAAG,MAAMC,QAAQC,GAAG,CAAC;QAC3CjE,OAAOC,UAAU,CAAC,WAAWK,GAAG;QAChCN,OAAOC,UAAU,CAAClB,iCAAiCuB,GAAG;KACvD;IACD,MAAM4D,OAA8BJ,QAAQrC,IAAI,CAACM,GAAG,CAAC,CAAC7B;YAC/CA;eADwD,cACxDA,YAAAA,IAAI2B,IAAI,cAAR3B,YAAc,CAAC;YACpB0B,KAAK1B,IAAIwB,EAAE;;;IAEb,MAAMyC,iBAAiB,IAAIC,IACzBL,QAAQtC,IAAI,CAACM,GAAG,CAAC,CAAC7B,MAAQ;YAACY,OAAOZ,IAAIwB,EAAE;YAAGxB,IAAI2B,IAAI;SAAG;IAExD,OAAO1D,iBAAiB+F,MAAMC;AAChC;AAYA;;;;;;;;;;CAUC,GACD,OAAO,eAAeE,oBACpB5E,SAAsC,EACtCwC,KASC;cAkDMqC;IAhDP,MAAM,EAAE5E,KAAK,EAAEiC,GAAG,EAAE2C,OAAO,EAAEC,MAAM,EAAE,GAAGtC;IACxC,MAAMuC,QAAQ,AAACF,CAAAA,QAAQG,IAAI,CAAC3B,IAAI,KAAKwB,QAAQG,IAAI,GAAGhG,gBAAgB6F,QAAQI,IAAI,CAAA,EAAGC,OAAO,CACxF,UACA;IAEF,MAAMC,YAAYpG,iBAAiBgG;IACnC,MAAM,EAAEK,MAAM,EAAEC,cAAc,EAAErC,UAAU,EAAE,GAAGxE,qBAAqB;QAClE8G,MAAMT,QAAQS,IAAI;QAClBC,IAAI;eAAIV,QAAQU,EAAE;eAAKV,QAAQW,WAAW;SAAC;QAC3CC,IAAI;eAAIZ,QAAQY,EAAE;eAAKZ,QAAQa,GAAG;SAAC;QACnCC,aAAa,UAAER,6BAAAA,UAAWG,IAAI,mBAAIM;QAClCd;QACAT,SAAS7B,MAAM6B,OAAO;IACxB;IACA,MAAMwB,eAAehH,cAAcgG,QAAQS,IAAI;IAC/C,IAAI,CAACtC,WAAW8C,MAAM,EAAE,OAAO;QAAEC,SAAS;QAAaF;IAAa;IAEpE,MAAMG,QAAQ,MAAMzD,6BAA6BvC,WAAW;QAC1DC;QACAiC;QACAc;QACAiB,SAASzB,MAAMyB,OAAO;IACxB;IACA,IAAI,CAAC+B,OAAO,OAAO;QAAED,SAAS;QAAaF;IAAa;IAExD,MAAM9B,MAAMxF,oBAAoBsG,QAAQoB,SAAS,EAAEpB,QAAQ5C,EAAE;IAC7D,MAAMiE,MAAMnC,MACRrE,4BAA4BM,WAAWC,OAAO8D,OAC9CpE,kBAAkBK,WAAWC;IACjC,IAAI8D,KAAK;QACP,MAAMoC,WAAW,MAAMD,IAAIrF,GAAG;QAC9B,IAAIsF,SAASrF,MAAM,EAAE,OAAO;YAAEiF,SAAS;YAAaK,YAAYF,IAAIjE,EAAE;QAAC;IACzE;IAEA,MAAM1B,SAASP,UAAUQ,UAAU,CAAC,QAAQC,GAAG,CAACR;IAChD,IAAI,CAAC3B,sBAAsB,MAAMsB,4BAA4BW,QAAQyF,MAAM1C,IAAI,IAAI;QACjF,OAAO;YAAEyC,SAAS;YAAWC;QAAM;IACrC;IAEA,0EAA0E;IAC1E,qEAAqE;IACrE,MAAMK,SAAShB,iBAAiBvG,yBAAyB0D,MAAM6B,OAAO,EAAEe,UAAU;IAClF,wEAAwE;IACxE,wEAAwE;IACxE,uBAAuB;IACvB,MAAMG,KACJS,MAAMpC,SAAS,KAAK,aAChBoC,MAAM7C,KAAK,IACV0B,uBAAAA,QAAQU,EAAE,CACRjD,GAAG,CAAC,CAACgE,QAAU1H,eAAe0H,QAC9BC,IAAI,CAAC,CAACD,QAAUA,SAAS,CAACrH,oBAAoBqH,OAAOxB,oBAFvDD,uBAEmE;IAC1E,MAAM2B,WAAWrI,8BAA8B;QAC7CyF,WAAWoC,MAAMpC,SAAS;QAC1B6C,SAAS5B,QAAQ4B,OAAO;QACxBC,SAASjI,kBAAkBoG,QAAQG,IAAI,EAAEH,QAAQI,IAAI;QACrDK,IAAI,EAAEF,iBAAAA,SAAUP,QAAQS,IAAI;QAC5BC;QACAU,WAAWpB,QAAQoB,SAAS,IAAIpB,QAAQ5C,EAAE;QAC1C0E,WAAW9B,QAAQ8B,SAAS;QAC5BC,MAAM/B,QAAQgC,YAAY;QAC1BC,KAAK,WAAET,0BAAAA,OAAQU,GAAG,oBAAI;QACtBC,MAAM,WAAEX,0BAAAA,OAAQY,IAAI,oBAAI;QACxB3D,MAAM0C,MAAM1C,IAAI;QAChBF,QAAQ4C,MAAM5C,MAAM;QACpBU,WAAWkC,MAAMlC,SAAS;IAC5B;IACA,MAAMoD,UAAU,MAAMzH,uBAAuByG,KAAKM;IAClD,OAAOU,YAAY,YACf;QAAEnB,SAAS;QAASK,YAAYF,IAAIjE,EAAE;QAAE+D;IAAM,IAC9C;QAAED,SAAS;QAAaK,YAAYF,IAAIjE,EAAE;IAAC;AACjD"}

package/src/lib/server/email-flow-gate.js

@@ -99,7 +99,14 @@ import { orgDataQueryForHost } from "./organizations.js";
         console.error('[flow-email] contact lookup failed', hostId, error);
     }
     try {
-        const lead = (await db.collection('hosts').doc(hostId).collection('leads').where('email', '==', email).limit(1).get()).docs[0];
+        /*
+     * SCOPED (AGL-3275). The collection is org-wide now, so an unnarrowed
+     * `where('email', ...)` would answer this site with a sibling brand's
+     * lead — and this function decides whether to MAIL the person it finds.
+     * `orgDataQueryForHost` applies the same `visibleTo` clause the contact
+     * lookup above already goes through.
+     */ const { query } = await orgDataQueryForHost(hostId, 'leads');
+        const lead = (await query.where('email', '==', email).limit(1).get()).docs[0];
         if (lead) return lead.data();
     } catch (error) {
         console.error('[flow-email] lead lookup failed', hostId, error);

package/src/lib/server/email-flow-gate.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/email-flow-gate.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * THE TWO GATES A FLOW EMAIL OWES THAT A REPLY DOES NOT.\n *\n * `sendEmail`'s marketing seam already asks the three questions every\n * merchant-triggered message owes — both suppression lists, the per-person\n * frequency ceiling, and an unsubscribe mechanism — at one chokepoint, for\n * any caller that declares `marketing: { hostId, siteBase }`. Two more belong\n * to a message a CAMPAIGN would owe and an immediate reply would not:\n *\n *  1. **The consent split.** Does this person have a basis to be mailed\n *     marketing by this site, under the org's own policy?\n *  2. **The topic filter.** Have they left this particular stream?\n *\n * ## Why a flow email is on the campaign's side of that line\n *\n * `marketing-send.ts` draws it precisely: a message is marketing when the\n * merchant decided to mail them, rather than because the recipient just did\n * something. An action's immediate `sendEmail` is the second — the visitor\n * submitted the form a moment ago and the reply is the response to it, which\n * is why that path stays priority `transactional`.\n *\n * A step that runs three days later is the first. The person did one thing\n * once; everything after the wait is the merchant's schedule, not the\n * recipient's act. So a flow email is checked here, and the answer is the\n * same one a campaign would get for the same person.\n *\n * ## The middle ground, which used to be nothing at all\n *\n * An immediate reply used to ask NEITHER question, and that was too little.\n * The recipient comes out of the event payload — an anonymous visitor's write\n * on the collect route — so \"the recipient just did something\" is an\n * assumption about who typed the address, not a fact the path establishes.\n * Somebody with a recorded refusal on this site received merchant-authored\n * content whenever a third party entered their address in a form.\n *\n * It cannot ask the full question either: the default policy is `strict`, and\n * under it an address with no record is withheld — which is every first-time\n * visitor. {@link FlowEmailScope} is where that line is drawn.\n *\n * ## What this deliberately does NOT do\n *\n * It compares no count against any limit. A flow send is metered on the cost\n * meter like every other automated message and is refused by no plan quota —\n * `emailSendsPerMonth` governs campaigns, which are the discretionary send a\n * customer can see, delay and argue with. Making a sequence stop mid-way\n * through somebody's welcome series because a monthly figure moved would be a\n * capacity limit enforced at the person, which is the shape this codebase\n * refuses everywhere else.\n */\n\nimport {\n  consentGroupForHost,\n  flowEmailTopicId,\n  readMarketingBasis,\n  marketingConsentDecision,\n  resolveMarketingConsentPolicy,\n} from '@aglyn/aglyn/server'\nimport firebaseAdmin from './firebase-admin'\nimport { findContactByEmail } from './contact-email-index'\nimport { filterTopicSendable } from './email-suppression'\nimport { orgDataQueryForHost } from './organizations'\n\n/** Why a flow's email was not sent. Null when it may go. */\nexport type FlowEmailRefusal =\n  /** No basis to mail this person marketing, under the org's policy. */\n  | 'consent-withheld'\n  /** They have left the stream this message belongs to. */\n  | 'topic-unsubscribed'\n\n/**\n * WHICH OF THE TWO QUESTIONS THIS MESSAGE HAS TO ANSWER.\n *\n * The distinction the module header draws, made into a parameter, because the\n * middle ground it leaves out is where a real defect lived: an immediate step\n * asked NEITHER question, so an address with a recorded refusal on this site\n * received merchant-authored content whenever somebody typed it into a form.\n *\n * `'scheduled'` — a step after a `wait`, or anything else that goes out on\n * the merchant's schedule. The org's full consent policy applies, and an\n * unnamed stream resolves to the default one, exactly as a campaign's does.\n *\n * `'immediate'` — a reply to an act the recipient just performed. Only a\n * STATED refusal stops it, and only a stream the step actually named.\n *\n * ## Why an immediate reply cannot take the full policy\n *\n * {@link DEFAULT_MARKETING_CONSENT_POLICY} is `strict`, which is what an org\n * that has never opened the setting has. Under it an address with no record\n * is withheld — and a first-time visitor filling in a form is exactly an\n * address with no record. Applying the split there would refuse the\n * auto-response to almost every new visitor on almost every site, which is a\n * far larger failure than the one being fixed.\n *\n * A stated refusal is different in kind and needs no policy to read it: the\n * person ticked the box that says do not market to me. `declined` is withheld\n * under every mode, so this narrows to the one answer that is the person's\n * own words rather than the org's configuration.\n *\n * The topic half narrows the same way. Defaulting an unnamed stream to\n * \"Promotions and offers\" would let a promotions opt-out silence a reply to a\n * contact form, and a form reply is not a promotion. A step that NAMES a\n * stream has said what it is, and is filtered on it.\n */\nexport type FlowEmailScope = 'scheduled' | 'immediate'\n\n/**\n * The person's own record, from the two silos that hold a consent basis for\n * somebody an automation can reach.\n *\n * `contacts` first because it is the canonical person store and the one the\n * consent capture surfaces write; `leads` second because a welcome series\n * fires on a sign-up that may not have produced a contact yet. Two keyed\n * reads at most, and only on a message that is about to be sent — the\n * expensive shape would be reading these on a beat, for people no step is\n * mailing.\n *\n * The contact is found through the org's address index narrowed to this\n * site (AGL-2633): a basis recorded on a record that was later merged into\n * another is the survivor's basis now, and the address the message goes to\n * may be the one that became an alternate.\n *\n * An address in NEITHER silo reads as record-less, which is what\n * `readMarketingBasis(null)` describes: `unrecorded`, with no capture date.\n * Under a `forward` policy that grandfathers and under `strict` it is\n * withheld — the same answer a campaign gives the same address, which is the\n * property that matters.\n */\nasync function readPersonRecord(\n  hostId: string,\n  email: string,\n  firestore?: any,\n): Promise<Record<string, unknown> | null> {\n  const db = firestore ?? firebaseAdmin.app().firestore()\n  try {\n    const { ref } = await orgDataQueryForHost(hostId, 'contacts')\n    const contact = await findContactByEmail(ref, email, { hostId })\n    if (contact) return contact.data() as Record<string, unknown>\n  } catch (error) {\n    console.error('[flow-email] contact lookup failed', hostId, error)\n  }\n  try {\n    const lead = (\n      await db\n        .collection('hosts')\n        .doc(hostId)\n        .collection('leads')\n        .where('email', '==', email)\n        .limit(1)\n        .get()\n    ).docs[0]\n    if (lead) return lead.data() as Record<string, unknown>\n  } catch (error) {\n    console.error('[flow-email] lead lookup failed', hostId, error)\n  }\n  return null\n}\n\n/**\n * May this site mail this person this flow's message?\n *\n * FAILS CLOSED on consent and OPEN on topic, which is the asymmetry\n * `filterTopicSendable` already argues one layer down: a missing consent\n * basis is the whole question, where a topic preference is a narrower fact\n * whose lookup failing is no reason to withhold a message the person has a\n * basis to receive.\n *\n * @param org the owning org's document data, already read by the caller's\n *            entitlement gate. Passed rather than re-read: the executor holds\n *            it for the whole run, and the policy is the only thing needed\n *            from it.\n */\nexport async function flowEmailRefusal(options: {\n  hostId: string\n  email: string\n  topicId?: string | null\n  org?: unknown\n  firestore?: any\n  /** See {@link FlowEmailScope}. Defaults to the stricter `'scheduled'`. */\n  scope?: FlowEmailScope\n}): Promise<FlowEmailRefusal | null> {\n  const immediate = options.scope === 'immediate'\n  const email = String(options.email ?? '')\n    .trim()\n    .toLowerCase()\n  if (!email) return 'consent-withheld'\n\n  const policy = resolveMarketingConsentPolicy(\n    (options.org as Record<string, unknown> | undefined)?.[\n      'marketingConsentPolicy'\n    ],\n  )\n  const record = await readPersonRecord(\n    options.hostId,\n    email,\n    options.firestore,\n  )\n  /*\n   * The group the SEND belongs to, not the site alone. Three sites declared\n   * as one sender share a basis, and an automation running on any of them is\n   * that sender — resolved from the org the caller already read.\n   */\n  const group = consentGroupForHost(\n    (options.org as Record<string, unknown> | undefined) ?? null,\n    options.hostId,\n  )\n  const decision = marketingConsentDecision(\n    readMarketingBasis(record, group),\n    policy,\n  )\n  /*\n   * An immediate reply is stopped by the person's own `declined` and by\n   * nothing else the policy decides. Every other `withheld` reason —\n   * `no-basis`, `not-grandfathered`, `other-host` — is a statement about\n   * configuration and capture history, and under the default `strict` mode\n   * the first of them describes every new visitor.\n   */\n  if (\n    decision.verdict === 'withheld' &&\n    (!immediate || decision.reason === 'declined')\n  ) {\n    return 'consent-withheld'\n  }\n\n  const topicId = flowEmailTopicId(options.topicId, options.scope)\n  if (!topicId) return null\n  const sendable = await filterTopicSendable(\n    options.hostId,\n    topicId,\n    [email],\n    options.firestore,\n  )\n  return sendable.length ? null : 'topic-unsubscribed'\n}\n"],"names":["consentGroupForHost","flowEmailTopicId","readMarketingBasis","marketingConsentDecision","resolveMarketingConsentPolicy","firebaseAdmin","findContactByEmail","filterTopicSendable","orgDataQueryForHost","readPersonRecord","hostId","email","firestore","db","app","ref","contact","data","error","console","lead","collection","doc","where","limit","get","docs","flowEmailRefusal","options","immediate","scope","String","trim","toLowerCase","policy","org","record","group","decision","verdict","reason","topicId","sendable","length"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDC,GAED,SACEA,mBAAmB,EACnBC,gBAAgB,EAChBC,kBAAkB,EAClBC,wBAAwB,EACxBC,6BAA6B,QACxB,sBAAqB;AAC5B,OAAOC,mBAAmB,sBAAkB;AAC5C,SAASC,kBAAkB,QAAQ,2BAAuB;AAC1D,SAASC,mBAAmB,QAAQ,yBAAqB;AACzD,SAASC,mBAAmB,QAAQ,qBAAiB;AA6CrD;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,eAAeC,iBACbC,MAAc,EACdC,KAAa,EACbC,SAAe;IAEf,MAAMC,KAAKD,oBAAAA,YAAaP,cAAcS,GAAG,GAAGF,SAAS;IACrD,IAAI;QACF,MAAM,EAAEG,GAAG,EAAE,GAAG,MAAMP,oBAAoBE,QAAQ;QAClD,MAAMM,UAAU,MAAMV,mBAAmBS,KAAKJ,OAAO;YAAED;QAAO;QAC9D,IAAIM,SAAS,OAAOA,QAAQC,IAAI;IAClC,EAAE,OAAOC,OAAO;QACdC,QAAQD,KAAK,CAAC,sCAAsCR,QAAQQ;IAC9D;IACA,IAAI;QACF,MAAME,OAAO,AACX,CAAA,MAAMP,GACHQ,UAAU,CAAC,SACXC,GAAG,CAACZ,QACJW,UAAU,CAAC,SACXE,KAAK,CAAC,SAAS,MAAMZ,OACrBa,KAAK,CAAC,GACNC,GAAG,EAAC,EACPC,IAAI,CAAC,EAAE;QACT,IAAIN,MAAM,OAAOA,KAAKH,IAAI;IAC5B,EAAE,OAAOC,OAAO;QACdC,QAAQD,KAAK,CAAC,mCAAmCR,QAAQQ;IAC3D;IACA,OAAO;AACT;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,eAAeS,iBAAiBC,OAQtC;QAEsBA,gBAqBlBA;QAfAA;IAPH,MAAMC,YAAYD,QAAQE,KAAK,KAAK;IACpC,MAAMnB,QAAQoB,QAAOH,iBAAAA,QAAQjB,KAAK,YAAbiB,iBAAiB,IACnCI,IAAI,GACJC,WAAW;IACd,IAAI,CAACtB,OAAO,OAAO;IAEnB,MAAMuB,SAAS9B,+BACZwB,gBAAAA,QAAQO,GAAG,qBAAZ,AAACP,aAAqD,CACpD,yBACD;IAEH,MAAMQ,SAAS,MAAM3B,iBACnBmB,QAAQlB,MAAM,EACdC,OACAiB,QAAQhB,SAAS;IAEnB;;;;GAIC,GACD,MAAMyB,QAAQrC,qBACX4B,eAAAA,QAAQO,GAAG,YAAXP,eAAuD,MACxDA,QAAQlB,MAAM;IAEhB,MAAM4B,WAAWnC,yBACfD,mBAAmBkC,QAAQC,QAC3BH;IAEF;;;;;;GAMC,GACD,IACEI,SAASC,OAAO,KAAK,cACpB,CAAA,CAACV,aAAaS,SAASE,MAAM,KAAK,UAAS,GAC5C;QACA,OAAO;IACT;IAEA,MAAMC,UAAUxC,iBAAiB2B,QAAQa,OAAO,EAAEb,QAAQE,KAAK;IAC/D,IAAI,CAACW,SAAS,OAAO;IACrB,MAAMC,WAAW,MAAMnC,oBACrBqB,QAAQlB,MAAM,EACd+B,SACA;QAAC9B;KAAM,EACPiB,QAAQhB,SAAS;IAEnB,OAAO8B,SAASC,MAAM,GAAG,OAAO;AAClC"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/email-flow-gate.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * THE TWO GATES A FLOW EMAIL OWES THAT A REPLY DOES NOT.\n *\n * `sendEmail`'s marketing seam already asks the three questions every\n * merchant-triggered message owes — both suppression lists, the per-person\n * frequency ceiling, and an unsubscribe mechanism — at one chokepoint, for\n * any caller that declares `marketing: { hostId, siteBase }`. Two more belong\n * to a message a CAMPAIGN would owe and an immediate reply would not:\n *\n *  1. **The consent split.** Does this person have a basis to be mailed\n *     marketing by this site, under the org's own policy?\n *  2. **The topic filter.** Have they left this particular stream?\n *\n * ## Why a flow email is on the campaign's side of that line\n *\n * `marketing-send.ts` draws it precisely: a message is marketing when the\n * merchant decided to mail them, rather than because the recipient just did\n * something. An action's immediate `sendEmail` is the second — the visitor\n * submitted the form a moment ago and the reply is the response to it, which\n * is why that path stays priority `transactional`.\n *\n * A step that runs three days later is the first. The person did one thing\n * once; everything after the wait is the merchant's schedule, not the\n * recipient's act. So a flow email is checked here, and the answer is the\n * same one a campaign would get for the same person.\n *\n * ## The middle ground, which used to be nothing at all\n *\n * An immediate reply used to ask NEITHER question, and that was too little.\n * The recipient comes out of the event payload — an anonymous visitor's write\n * on the collect route — so \"the recipient just did something\" is an\n * assumption about who typed the address, not a fact the path establishes.\n * Somebody with a recorded refusal on this site received merchant-authored\n * content whenever a third party entered their address in a form.\n *\n * It cannot ask the full question either: the default policy is `strict`, and\n * under it an address with no record is withheld — which is every first-time\n * visitor. {@link FlowEmailScope} is where that line is drawn.\n *\n * ## What this deliberately does NOT do\n *\n * It compares no count against any limit. A flow send is metered on the cost\n * meter like every other automated message and is refused by no plan quota —\n * `emailSendsPerMonth` governs campaigns, which are the discretionary send a\n * customer can see, delay and argue with. Making a sequence stop mid-way\n * through somebody's welcome series because a monthly figure moved would be a\n * capacity limit enforced at the person, which is the shape this codebase\n * refuses everywhere else.\n */\n\nimport {\n  consentGroupForHost,\n  flowEmailTopicId,\n  readMarketingBasis,\n  marketingConsentDecision,\n  resolveMarketingConsentPolicy,\n} from '@aglyn/aglyn/server'\nimport firebaseAdmin from './firebase-admin'\nimport { findContactByEmail } from './contact-email-index'\nimport { filterTopicSendable } from './email-suppression'\nimport { orgDataQueryForHost } from './organizations'\n\n/** Why a flow's email was not sent. Null when it may go. */\nexport type FlowEmailRefusal =\n  /** No basis to mail this person marketing, under the org's policy. */\n  | 'consent-withheld'\n  /** They have left the stream this message belongs to. */\n  | 'topic-unsubscribed'\n\n/**\n * WHICH OF THE TWO QUESTIONS THIS MESSAGE HAS TO ANSWER.\n *\n * The distinction the module header draws, made into a parameter, because the\n * middle ground it leaves out is where a real defect lived: an immediate step\n * asked NEITHER question, so an address with a recorded refusal on this site\n * received merchant-authored content whenever somebody typed it into a form.\n *\n * `'scheduled'` — a step after a `wait`, or anything else that goes out on\n * the merchant's schedule. The org's full consent policy applies, and an\n * unnamed stream resolves to the default one, exactly as a campaign's does.\n *\n * `'immediate'` — a reply to an act the recipient just performed. Only a\n * STATED refusal stops it, and only a stream the step actually named.\n *\n * ## Why an immediate reply cannot take the full policy\n *\n * {@link DEFAULT_MARKETING_CONSENT_POLICY} is `strict`, which is what an org\n * that has never opened the setting has. Under it an address with no record\n * is withheld — and a first-time visitor filling in a form is exactly an\n * address with no record. Applying the split there would refuse the\n * auto-response to almost every new visitor on almost every site, which is a\n * far larger failure than the one being fixed.\n *\n * A stated refusal is different in kind and needs no policy to read it: the\n * person ticked the box that says do not market to me. `declined` is withheld\n * under every mode, so this narrows to the one answer that is the person's\n * own words rather than the org's configuration.\n *\n * The topic half narrows the same way. Defaulting an unnamed stream to\n * \"Promotions and offers\" would let a promotions opt-out silence a reply to a\n * contact form, and a form reply is not a promotion. A step that NAMES a\n * stream has said what it is, and is filtered on it.\n */\nexport type FlowEmailScope = 'scheduled' | 'immediate'\n\n/**\n * The person's own record, from the two silos that hold a consent basis for\n * somebody an automation can reach.\n *\n * `contacts` first because it is the canonical person store and the one the\n * consent capture surfaces write; `leads` second because a welcome series\n * fires on a sign-up that may not have produced a contact yet. Two keyed\n * reads at most, and only on a message that is about to be sent — the\n * expensive shape would be reading these on a beat, for people no step is\n * mailing.\n *\n * The contact is found through the org's address index narrowed to this\n * site (AGL-2633): a basis recorded on a record that was later merged into\n * another is the survivor's basis now, and the address the message goes to\n * may be the one that became an alternate.\n *\n * An address in NEITHER silo reads as record-less, which is what\n * `readMarketingBasis(null)` describes: `unrecorded`, with no capture date.\n * Under a `forward` policy that grandfathers and under `strict` it is\n * withheld — the same answer a campaign gives the same address, which is the\n * property that matters.\n */\nasync function readPersonRecord(\n  hostId: string,\n  email: string,\n  firestore?: any,\n): Promise<Record<string, unknown> | null> {\n  const db = firestore ?? firebaseAdmin.app().firestore()\n  try {\n    const { ref } = await orgDataQueryForHost(hostId, 'contacts')\n    const contact = await findContactByEmail(ref, email, { hostId })\n    if (contact) return contact.data() as Record<string, unknown>\n  } catch (error) {\n    console.error('[flow-email] contact lookup failed', hostId, error)\n  }\n  try {\n    /*\n     * SCOPED (AGL-3275). The collection is org-wide now, so an unnarrowed\n     * `where('email', ...)` would answer this site with a sibling brand's\n     * lead — and this function decides whether to MAIL the person it finds.\n     * `orgDataQueryForHost` applies the same `visibleTo` clause the contact\n     * lookup above already goes through.\n     */\n    const { query } = await orgDataQueryForHost(hostId, 'leads')\n    const lead = (await query.where('email', '==', email).limit(1).get()).docs[0]\n    if (lead) return lead.data() as Record<string, unknown>\n  } catch (error) {\n    console.error('[flow-email] lead lookup failed', hostId, error)\n  }\n  return null\n}\n\n/**\n * May this site mail this person this flow's message?\n *\n * FAILS CLOSED on consent and OPEN on topic, which is the asymmetry\n * `filterTopicSendable` already argues one layer down: a missing consent\n * basis is the whole question, where a topic preference is a narrower fact\n * whose lookup failing is no reason to withhold a message the person has a\n * basis to receive.\n *\n * @param org the owning org's document data, already read by the caller's\n *            entitlement gate. Passed rather than re-read: the executor holds\n *            it for the whole run, and the policy is the only thing needed\n *            from it.\n */\nexport async function flowEmailRefusal(options: {\n  hostId: string\n  email: string\n  topicId?: string | null\n  org?: unknown\n  firestore?: any\n  /** See {@link FlowEmailScope}. Defaults to the stricter `'scheduled'`. */\n  scope?: FlowEmailScope\n}): Promise<FlowEmailRefusal | null> {\n  const immediate = options.scope === 'immediate'\n  const email = String(options.email ?? '')\n    .trim()\n    .toLowerCase()\n  if (!email) return 'consent-withheld'\n\n  const policy = resolveMarketingConsentPolicy(\n    (options.org as Record<string, unknown> | undefined)?.[\n      'marketingConsentPolicy'\n    ],\n  )\n  const record = await readPersonRecord(\n    options.hostId,\n    email,\n    options.firestore,\n  )\n  /*\n   * The group the SEND belongs to, not the site alone. Three sites declared\n   * as one sender share a basis, and an automation running on any of them is\n   * that sender — resolved from the org the caller already read.\n   */\n  const group = consentGroupForHost(\n    (options.org as Record<string, unknown> | undefined) ?? null,\n    options.hostId,\n  )\n  const decision = marketingConsentDecision(\n    readMarketingBasis(record, group),\n    policy,\n  )\n  /*\n   * An immediate reply is stopped by the person's own `declined` and by\n   * nothing else the policy decides. Every other `withheld` reason —\n   * `no-basis`, `not-grandfathered`, `other-host` — is a statement about\n   * configuration and capture history, and under the default `strict` mode\n   * the first of them describes every new visitor.\n   */\n  if (\n    decision.verdict === 'withheld' &&\n    (!immediate || decision.reason === 'declined')\n  ) {\n    return 'consent-withheld'\n  }\n\n  const topicId = flowEmailTopicId(options.topicId, options.scope)\n  if (!topicId) return null\n  const sendable = await filterTopicSendable(\n    options.hostId,\n    topicId,\n    [email],\n    options.firestore,\n  )\n  return sendable.length ? null : 'topic-unsubscribed'\n}\n"],"names":["consentGroupForHost","flowEmailTopicId","readMarketingBasis","marketingConsentDecision","resolveMarketingConsentPolicy","firebaseAdmin","findContactByEmail","filterTopicSendable","orgDataQueryForHost","readPersonRecord","hostId","email","firestore","db","app","ref","contact","data","error","console","query","lead","where","limit","get","docs","flowEmailRefusal","options","immediate","scope","String","trim","toLowerCase","policy","org","record","group","decision","verdict","reason","topicId","sendable","length"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDC,GAED,SACEA,mBAAmB,EACnBC,gBAAgB,EAChBC,kBAAkB,EAClBC,wBAAwB,EACxBC,6BAA6B,QACxB,sBAAqB;AAC5B,OAAOC,mBAAmB,sBAAkB;AAC5C,SAASC,kBAAkB,QAAQ,2BAAuB;AAC1D,SAASC,mBAAmB,QAAQ,yBAAqB;AACzD,SAASC,mBAAmB,QAAQ,qBAAiB;AA6CrD;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,eAAeC,iBACbC,MAAc,EACdC,KAAa,EACbC,SAAe;IAEf,MAAMC,KAAKD,oBAAAA,YAAaP,cAAcS,GAAG,GAAGF,SAAS;IACrD,IAAI;QACF,MAAM,EAAEG,GAAG,EAAE,GAAG,MAAMP,oBAAoBE,QAAQ;QAClD,MAAMM,UAAU,MAAMV,mBAAmBS,KAAKJ,OAAO;YAAED;QAAO;QAC9D,IAAIM,SAAS,OAAOA,QAAQC,IAAI;IAClC,EAAE,OAAOC,OAAO;QACdC,QAAQD,KAAK,CAAC,sCAAsCR,QAAQQ;IAC9D;IACA,IAAI;QACF;;;;;;KAMC,GACD,MAAM,EAAEE,KAAK,EAAE,GAAG,MAAMZ,oBAAoBE,QAAQ;QACpD,MAAMW,OAAO,AAAC,CAAA,MAAMD,MAAME,KAAK,CAAC,SAAS,MAAMX,OAAOY,KAAK,CAAC,GAAGC,GAAG,EAAC,EAAGC,IAAI,CAAC,EAAE;QAC7E,IAAIJ,MAAM,OAAOA,KAAKJ,IAAI;IAC5B,EAAE,OAAOC,OAAO;QACdC,QAAQD,KAAK,CAAC,mCAAmCR,QAAQQ;IAC3D;IACA,OAAO;AACT;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,eAAeQ,iBAAiBC,OAQtC;QAEsBA,gBAqBlBA;QAfAA;IAPH,MAAMC,YAAYD,QAAQE,KAAK,KAAK;IACpC,MAAMlB,QAAQmB,QAAOH,iBAAAA,QAAQhB,KAAK,YAAbgB,iBAAiB,IACnCI,IAAI,GACJC,WAAW;IACd,IAAI,CAACrB,OAAO,OAAO;IAEnB,MAAMsB,SAAS7B,+BACZuB,gBAAAA,QAAQO,GAAG,qBAAZ,AAACP,aAAqD,CACpD,yBACD;IAEH,MAAMQ,SAAS,MAAM1B,iBACnBkB,QAAQjB,MAAM,EACdC,OACAgB,QAAQf,SAAS;IAEnB;;;;GAIC,GACD,MAAMwB,QAAQpC,qBACX2B,eAAAA,QAAQO,GAAG,YAAXP,eAAuD,MACxDA,QAAQjB,MAAM;IAEhB,MAAM2B,WAAWlC,yBACfD,mBAAmBiC,QAAQC,QAC3BH;IAEF;;;;;;GAMC,GACD,IACEI,SAASC,OAAO,KAAK,cACpB,CAAA,CAACV,aAAaS,SAASE,MAAM,KAAK,UAAS,GAC5C;QACA,OAAO;IACT;IAEA,MAAMC,UAAUvC,iBAAiB0B,QAAQa,OAAO,EAAEb,QAAQE,KAAK;IAC/D,IAAI,CAACW,SAAS,OAAO;IACrB,MAAMC,WAAW,MAAMlC,oBACrBoB,QAAQjB,MAAM,EACd8B,SACA;QAAC7B;KAAM,EACPgB,QAAQf,SAAS;IAEnB,OAAO6B,SAASC,MAAM,GAAG,OAAO;AAClC"}

package/src/lib/server/erase-person.js

@@ -174,6 +174,25 @@ const defaultFirestore = ()=>firebaseAdmin.app().firestore();
         phone: FieldValue.delete(),
         customerErasedAtMs: now
     };
+    /*
+   * THE ORG ROW, ONCE (AGL-3275) — and then every legacy row still standing.
+   *
+   * A lead is one document for the whole org now, so the delete leaves the
+   * per-site loop. It is not the caller that may assume the migration is
+   * finished, though: until AGL-3276 has folded every site and AGL-3277 has
+   * removed the fallback, a person can still be held at
+   * `hosts/{hostId}/leads`, and an erasure that deleted only the org row would
+   * leave that copy behind. So both are swept, and `counts.leads` is what was
+   * actually destroyed rather than how many places were looked at.
+   */ try {
+        const orgLead = orgRef.collection('leads').doc(key);
+        if ((await orgLead.get()).exists) {
+            await orgLead.delete();
+            counts.leads += 1;
+        }
+    } catch (error) {
+        console.error('erasePerson: org lead delete failed', error);
+    }
     for (const hostId of hostIds){
         const hostRef = db.collection('hosts').doc(hostId);
         try {
@@ -183,7 +202,7 @@ const defaultFirestore = ()=>firebaseAdmin.app().firestore();
                 counts.leads += 1;
             }
         } catch (error) {
-            console.error(`erasePerson: lead delete failed for ${hostId}`, error);
+            console.error(`erasePerson: legacy lead delete failed for ${hostId}`, error);
         }
         counts.orders += await updateWhere(db, hostRef.collection('orders'), 'customerEmail', email, erasedOrder);
         counts.bookings += await updateWhere(db, hostRef.collection('bookings'), 'email', email, erasedBooking);