npm - @aglyn/tenant-data-admin - Versions diffs - 1.0.0-beta.168 → 1.0.0-beta.169 - Mend

@aglyn/tenant-data-admin 1.0.0-beta.168 → 1.0.0-beta.169

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/package.json +6 -6
package/src/lib/server/host-visitor-records.d.ts +53 -19
package/src/lib/server/host-visitor-records.js +14 -54
package/src/lib/server/host-visitor-records.js.map +1 -1

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/tenant-data-admin",
-  "version": "1.0.0-beta.168",
+  "version": "1.0.0-beta.169",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,11 +25,11 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/aglyn": "1.0.0-beta.168",
-    "@aglyn/shared-util-email": "1.0.0-beta.168",
-    "@aglyn/shared-util-fbserver": "1.0.0-beta.168",
-    "@aglyn/shared-util-http": "1.0.0-beta.168",
-    "@aglyn/shared-util-tools": "1.0.0-beta.168",
+    "@aglyn/aglyn": "1.0.0-beta.169",
+    "@aglyn/shared-util-email": "1.0.0-beta.169",
+    "@aglyn/shared-util-fbserver": "1.0.0-beta.169",
+    "@aglyn/shared-util-http": "1.0.0-beta.169",
+    "@aglyn/shared-util-tools": "1.0.0-beta.169",
     "@msgpack/msgpack": "^3.1.3",
     "@swc/helpers": "0.5.23",
     "sharp": "^0.35.3",

package/src/lib/server/host-visitor-records.d.ts CHANGED Viewed

@@ -26,6 +26,51 @@
 import { type VisitorRecordKind } from '@aglyn/aglyn/server';
 import { type ResolvedCampaignTouch } from './campaign-conversion-attribution';
 import type { ConsentGroup, ScopeToken } from '@aglyn/aglyn/server';
+/**
+ * A lead's one home: `orgs/{orgId}/leads/{personKey}` (AGL-3275).
+ *
+ * ## Why leads moved
+ *
+ * A lead used to live at `hosts/{hostId}/leads/{personKey}` while the
+ * contact for the same human lived on the org with a `visibleTo` array. The
+ * path was doing the job `visibleTo` does, and doing it worse:
+ *
+ * - An AGENCY was isolated by the path. It is isolated by `visibleTo` too,
+ *   with no configuration — `consentGroupScope` on a group of one is
+ *   `['host:{id}']`.
+ * - A MULTI-BRAND org could not be served at all. `personKey` is derived
+ *   from the address, so the same person captured on two sibling brands
+ *   produced two documents with byte-identical ids under different parents.
+ *   One person was two records by construction, which is the thing AGL-3232
+ *   had just finished eliminating for contacts.
+ * - The two answers could disagree. A person's contact was visible to every
+ *   brand in the consent group they actually consented to — the disclosure
+ *   names those brands — while their lead was visible to whichever brand's
+ *   form they happened to land on. The lead was scoped more narrowly than
+ *   what the person was told, which is the safe direction to be wrong in and
+ *   still the wrong answer.
+ *
+ * So a lead is stamped with `crmScopeTokens` and read with `crmReadTokens`,
+ * the same pair the contacts surface uses. Nothing here is a new mechanism;
+ * this is leads arriving at the one the rest of the CRM already had.
+ *
+ * ## The fallback is READ-ONLY, and temporary
+ *
+ * This repo has run this migration once already — AGL-237 moved datasets,
+ * contacts and media to the org, AGL-1040 backfilled, AGL-1050 deleted the
+ * fallback — and `orgDataCollectionForHost` carries what it learned:
+ *
+ *   "a second storage path that can still be WRITTEN is a second boundary to
+ *   enforce forever, which undoes the premise of scoped sharing: one home
+ *   per resource plus an explicit scope."
+ *
+ * So the host path is never written here. It is read, once, to carry a
+ * not-yet-migrated lead onto the org as a side effect of the next write that
+ * touches it ({@link leadForWrite}) — which shrinks what AGL-3276's backfill
+ * has left to fold, and means no read can be answered by a stale host row
+ * after a write has moved on. AGL-3277 deletes the fallback and the rules
+ * block behind it once that backfill reports nothing left to plan.
+ */
 /**
  * The org collection a lead is written to. Always the org — see the
  * read-only note above.
@@ -78,31 +123,20 @@ export declare function leadScopeForHost(hostId: string, org?: Record<string, un
  */
 export declare function readLeadForHost(hostId: string, key: string): Promise<FirebaseFirestore.DocumentSnapshot | null>;
 /**
- * The ref a write should target, with any host-path predecessor already
- * carried onto it.
+ * The ref a write should target.
  *
- * A lead that has not been backfilled yet is copied to the org on the next
- * write that touches it, under the capturing site's scope, and the host row
- * is left where it is for AGL-3276 to archive. Two things follow: a write
- * never has to decide which of two rows it is amending, and no later read
- * can be answered by a host row that a write has since moved past.
- *
- * `carried` says whether this call did that copy, so a caller can log it and
- * the backfill's count can be reconciled against it.
+ * This carried a not-yet-backfilled host row onto the org first, and reported
+ * whether it had (`carried`). AGL-3276 emptied the host path and AGL-3277
+ * removed it, so there is nothing left to carry: the org row is the only row.
+ * `carried` stays on the shape, always `false`, because several callers
+ * destructure it and a lie is cheaper to read than a signature change that
+ * says nothing.
  */
-export declare function leadForWrite(hostId: string, key: string, org?: Record<string, unknown> | null): Promise<{
+export declare function leadForWrite(hostId: string, key: string): Promise<{
     ref: FirebaseFirestore.DocumentReference;
     existed: boolean;
     carried: boolean;
 }>;
-/**
- * Whether a host-path lead survives for this address — AGL-3276 reconciling
- * itself, and AGL-3277's deletion check. Not a read path for product code,
- * which wants {@link readLeadForHost}.
- */
-export declare function legacyLeadExists(hostId: string, key: string): Promise<boolean>;
-/** Every org id this process has resolved a lead for — the backfill's entry point. */
-export declare function orgIdForLeadHost(hostId: string): Promise<string | null>;
 /**
  * Make a tripped ceiling OBSERVABLE rather than a silent drop — the * standing rule that a control which is not visible in the console does not
  * count as shipped.

package/src/lib/server/host-visitor-records.js CHANGED Viewed

@@ -27,7 +27,7 @@ import { FieldValue } from "firebase-admin/firestore";
 import { attributeCampaignConversion } from "./campaign-conversion-attribution.js";
 import { notifyHostManagers } from "./notifications.js";
 import firebaseAdmin from "./firebase-admin.js";
-import { consentGroupForSite, orgDataCollectionForHost, resolveOrgIdForHost, scopedToHost } from "./organizations.js";
+import { consentGroupForSite, orgDataCollectionForHost, scopedToHost } from "./organizations.js";
 import { crmReadTokens, crmScopeTokens } from "@aglyn/aglyn/server";
 const firestore = ()=>firebaseAdmin.app().firestore();
 /**
@@ -74,10 +74,7 @@ const firestore = ()=>firebaseAdmin.app().firestore();
  * has left to fold, and means no read can be answered by a stale host row
  * after a write has moved on. AGL-3277 deletes the fallback and the rules
  * block behind it once that backfill reports nothing left to plan.
- */ /** The legacy home, for the read half of the migration window only. */ function hostLeads(hostId) {
-    return firestore().collection('hosts').doc(hostId).collection('leads');
-}
-/**
+ */ /**
  * The org collection a lead is written to. Always the org — see the
  * read-only note above.
  */ export async function orgLeadsForHost(hostId) {
@@ -134,62 +131,25 @@ const firestore = ()=>firebaseAdmin.app().firestore();
  * @returns the org row; else the not-yet-migrated host row; else `null`.
  */ export async function readLeadForHost(hostId, key) {
     const orgRow = await (await orgLeadsForHost(hostId)).doc(key).get();
-    if (orgRow.exists) return orgRow;
-    const hostRow = await hostLeads(hostId).doc(key).get();
-    return hostRow.exists ? hostRow : null;
+    return orgRow.exists ? orgRow : null;
 }
 /**
- * The ref a write should target, with any host-path predecessor already
- * carried onto it.
- *
- * A lead that has not been backfilled yet is copied to the org on the next
- * write that touches it, under the capturing site's scope, and the host row
- * is left where it is for AGL-3276 to archive. Two things follow: a write
- * never has to decide which of two rows it is amending, and no later read
- * can be answered by a host row that a write has since moved past.
- *
- * `carried` says whether this call did that copy, so a caller can log it and
- * the backfill's count can be reconciled against it.
- */ export async function leadForWrite(hostId, key, org) {
-    var _legacy_data;
+ * The ref a write should target.
+ *
+ * This carried a not-yet-backfilled host row onto the org first, and reported
+ * whether it had (`carried`). AGL-3276 emptied the host path and AGL-3277
+ * removed it, so there is nothing left to carry: the org row is the only row.
+ * `carried` stays on the shape, always `false`, because several callers
+ * destructure it and a lie is cheaper to read than a signature change that
+ * says nothing.
+ */ export async function leadForWrite(hostId, key) {
     const ref = (await orgLeadsForHost(hostId)).doc(key);
-    if ((await ref.get()).exists) return {
-        ref,
-        existed: true,
-        carried: false
-    };
-    const legacy = await hostLeads(hostId).doc(key).get();
-    if (!legacy.exists) return {
-        ref,
-        existed: false,
-        carried: false
-    };
-    // The legacy row carries no `visibleTo` — it was scoped by its parent — so
-    // the capturing site's group supplies one. `set` rather than `create`: a
-    // peer carrying the same row in the same second must not fail the write
-    // that provoked it, and both writes carry identical field values.
-    await ref.set(_extends({}, (_legacy_data = legacy.data()) != null ? _legacy_data : {}, {
-        visibleTo: await leadScopeForHost(hostId, org),
-        migratedFromHostId: hostId
-    }), {
-        merge: true
-    });
     return {
         ref,
-        existed: true,
-        carried: true
+        existed: (await ref.get()).exists,
+        carried: false
     };
 }
-/**
- * Whether a host-path lead survives for this address — AGL-3276 reconciling
- * itself, and AGL-3277's deletion check. Not a read path for product code,
- * which wants {@link readLeadForHost}.
- */ export async function legacyLeadExists(hostId, key) {
-    return (await hostLeads(hostId).doc(key).get()).exists;
-}
-/** Every org id this process has resolved a lead for — the backfill's entry point. */ export async function orgIdForLeadHost(hostId) {
-    return resolveOrgIdForHost(hostId);
-}
 /**
  * Make a tripped ceiling OBSERVABLE rather than a silent drop — the * standing rule that a control which is not visible in the console does not
  * count as shipped.

package/src/lib/server/host-visitor-records.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/host-visitor-records.ts"],"sourcesContent":["/*\n @license\n * Copyright 2026 Aglyn LLC\n \n Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n \n http://www.apache.org/licenses/LICENSE-2.0\n \n Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n /\n\n/\n The durable half of the visitor-record ceilings (AGL-1529) — the lead\n * writer that enforces `LEADS_MAX_PER_HOST`, and the bookkeeping that makes a\n * trip of EITHER ceiling something a site's owner can see.\n \n The policy is pure and lives in `@aglyn/aglyn/server`\n * (`visitor-record-ceiling.ts`); this is the part that needs Firestore. Same\n * split as `visitorWriteRateLimitRefusal`, and for the same reason.\n /\n\nimport {\n CAPTURED_BY_HOST_FIELD,\n checkVisitorRecordCeiling,\n LEADS_MAX_PER_HOST,\n marketingConsentFieldsForGroup,\n personKey,\n readMarketingBasis,\n submissionMonthKey,\n visitorRecordRefusedCounterId,\n type VisitorRecordKind,\n} from '@aglyn/aglyn/server'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport {\n attributeCampaignConversion,\n type ResolvedCampaignTouch,\n} from './campaign-conversion-attribution'\nimport { notifyHostManagers } from './notifications'\nimport firebaseAdmin from './firebase-admin'\nimport {\n consentGroupForSite,\n orgDataCollectionForHost,\n resolveOrgIdForHost,\n scopedToHost,\n} from './organizations'\nimport { crmReadTokens, crmScopeTokens } from '@aglyn/aglyn/server'\nimport type { ConsentGroup, ScopeToken } from '@aglyn/aglyn/server'\n\nconst firestore = () => firebaseAdmin.app().firestore()\n\n/\n A lead's one home: `orgs/{orgId}/leads/{personKey}` (AGL-3275).\n \n ## Why leads moved\n \n A lead used to live at `hosts/{hostId}/leads/{personKey}` while the\n * contact for the same human lived on the org with a `visibleTo` array. The\n * path was doing the job `visibleTo` does, and doing it worse:\n \n - An AGENCY was isolated by the path. It is isolated by `visibleTo` too,\n * with no configuration — `consentGroupScope` on a group of one is\n * `['host:{id}']`.\n * - A MULTI-BRAND org could not be served at all. `personKey` is derived\n * from the address, so the same person captured on two sibling brands\n * produced two documents with byte-identical ids under different parents.\n * One person was two records by construction, which is the thing AGL-3232\n * had just finished eliminating for contacts.\n * - The two answers could disagree. A person's contact was visible to every\n * brand in the consent group they actually consented to — the disclosure\n * names those brands — while their lead was visible to whichever brand's\n * form they happened to land on. The lead was scoped more narrowly than\n * what the person was told, which is the safe direction to be wrong in and\n * still the wrong answer.\n \n So a lead is stamped with `crmScopeTokens` and read with `crmReadTokens`,\n * the same pair the contacts surface uses. Nothing here is a new mechanism;\n * this is leads arriving at the one the rest of the CRM already had.\n \n ## The fallback is READ-ONLY, and temporary\n \n This repo has run this migration once already — AGL-237 moved datasets,\n * contacts and media to the org, AGL-1040 backfilled, AGL-1050 deleted the\n * fallback — and `orgDataCollectionForHost` carries what it learned:\n \n \"a second storage path that can still be WRITTEN is a second boundary to\n * enforce forever, which undoes the premise of scoped sharing: one home\n * per resource plus an explicit scope.\"\n \n So the host path is never written here. It is read, once, to carry a\n * not-yet-migrated lead onto the org as a side effect of the next write that\n * touches it ({@link leadForWrite}) — which shrinks what AGL-3276's backfill\n * has left to fold, and means no read can be answered by a stale host row\n * after a write has moved on. AGL-3277 deletes the fallback and the rules\n * block behind it once that backfill reports nothing left to plan.\n /\n\n\n/* The legacy home, for the read half of the migration window only. /\nfunction hostLeads(hostId: string): FirebaseFirestore.CollectionReference {\n return firestore().collection('hosts').doc(hostId).collection('leads')\n}\n\n/\n The org collection a lead is written to. Always the org — see the\n * read-only note above.\n /\nexport async function orgLeadsForHost(\n hostId: string,\n): Promise<FirebaseFirestore.CollectionReference> {\n return orgDataCollectionForHost(hostId, 'leads')\n}\n\n/\n The leads one site may LIST, narrowed by `visibleTo`.\n \n The Admin SDK does not evaluate rules, so an unnarrowed read here would\n * serve one agency client's leads on another's site — the same reason\n * `scopedToHost` exists for every other org-owned collection.\n /\nexport async function orgLeadsQueryForHost(hostId: string): Promise<{\n ref: FirebaseFirestore.CollectionReference\n query: FirebaseFirestore.Query\n}> {\n const ref = await orgLeadsForHost(hostId)\n return { ref, query: scopedToHost(ref, hostId) }\n}\n\n/\n The tokens a reader holding this group may ask `array-contains-any` for.\n * Capped at 30 by `crmReadTokens`, as the contacts list is.\n /\nexport async function leadReadTokensForHost(\n hostId: string,\n group?: ConsentGroup,\n): Promise<ScopeToken[]> {\n return crmReadTokens(group ?? (await consentGroupForSite(hostId)))\n}\n\n/\n The `visibleTo` a capture on this site stamps: the consent group's sites,\n * or `['org']` where the org set `defaultResourceScope`.\n \n Widened by the capture, never by the lookup — a site that has never\n * captured this person gains nothing by finding them, which is what keeps an\n * agency's clients apart on a record they share. Callers UPDATING an\n * existing lead union these in rather than replacing, exactly as\n * `upsert-contact` does.\n /\nexport async function leadScopeForHost(\n hostId: string,\n org?: Record<string, unknown> \| null,\n): Promise<ScopeToken[]> {\n const group = await consentGroupForSite(hostId, org)\n return crmScopeTokens(org ?? null, group)\n}\n\n/\n The lead for an address, wherever it currently lives.\n \n ## The lookup is UNSCOPED, and has to be\n \n One human who touched two sibling brands is one person. Narrowing this to\n * what the capturing site may already see would let a second submission on a\n * sibling brand mint a SECOND record for the same address — the duplication\n * this migration exists to end, reintroduced one layer up. Recognizing\n * somebody and being allowed to read their row are different acts:\n * this finds the person, {@link leadScopeForHost} decides who may see them.\n \n `upsert-contact` states the same rule at its own dedupe lookup, and for the\n * same reason. A caller that wants only what a site may SEE wants\n * {@link orgLeadsQueryForHost}.\n \n @returns the org row; else the not-yet-migrated host row; else `null`.\n /\nexport async function readLeadForHost(\n hostId: string,\n key: string,\n): Promise<FirebaseFirestore.DocumentSnapshot \| null> {\n const orgRow = await (await orgLeadsForHost(hostId)).doc(key).get()\n if (orgRow.exists) return orgRow\n const hostRow = await hostLeads(hostId).doc(key).get()\n return hostRow.exists ? hostRow : null\n}\n\n/\n The ref a write should target, with any host-path predecessor already\n * carried onto it.\n \n A lead that has not been backfilled yet is copied to the org on the next\n * write that touches it, under the capturing site's scope, and the host row\n * is left where it is for AGL-3276 to archive. Two things follow: a write\n * never has to decide which of two rows it is amending, and no later read\n * can be answered by a host row that a write has since moved past.\n \n `carried` says whether this call did that copy, so a caller can log it and\n * the backfill's count can be reconciled against it.\n /\nexport async function leadForWrite(\n hostId: string,\n key: string,\n org?: Record<string, unknown> \| null,\n): Promise<{\n ref: FirebaseFirestore.DocumentReference\n existed: boolean\n carried: boolean\n}> {\n const ref = (await orgLeadsForHost(hostId)).doc(key)\n if ((await ref.get()).exists) return { ref, existed: true, carried: false }\n\n const legacy = await hostLeads(hostId).doc(key).get()\n if (!legacy.exists) return { ref, existed: false, carried: false }\n\n // The legacy row carries no `visibleTo` — it was scoped by its parent — so\n // the capturing site's group supplies one. `set` rather than `create`: a\n // peer carrying the same row in the same second must not fail the write\n // that provoked it, and both writes carry identical field values.\n await ref.set(\n {\n ...(legacy.data() ?? {}),\n visibleTo: await leadScopeForHost(hostId, org),\n migratedFromHostId: hostId,\n },\n { merge: true },\n )\n return { ref, existed: true, carried: true }\n}\n\n/\n Whether a host-path lead survives for this address — AGL-3276 reconciling\n * itself, and AGL-3277's deletion check. Not a read path for product code,\n * which wants {@link readLeadForHost}.\n /\nexport async function legacyLeadExists(\n hostId: string,\n key: string,\n): Promise<boolean> {\n return (await hostLeads(hostId).doc(key).get()).exists\n}\n\n/* Every org id this process has resolved a lead for — the backfill's entry point. /\nexport async function orgIdForLeadHost(hostId: string): Promise<string \| null> {\n return resolveOrgIdForHost(hostId)\n}\n\n\n/\n Make a tripped ceiling OBSERVABLE rather than a silent drop — the * standing rule that a control which is not visible in the console does not\n * count as shipped.\n \n Two audiences, one call, in exactly `recordAbuseCeilingTrip`'s shape\n * (`apps/tenant/app/api/forms/submit/route.ts`, AGL-1655):\n \n - A durable per-month refusal count at\n * `hosts/{id}/counters/{siteMembers\|leads}Refused`. Counters are excluded\n * from every client write in `cloud/firebase-firestore.rules` (AGL-1367),\n * so the record cannot be edited away by the site it describes, and host\n * admins can already READ it — which is what lets the inbox console page\n * render it with no rules change.\n * - One in-app notification to the site's managers, on the FIRST refusal of\n * the month only. A notification per refused bot request would be the\n * flood again, delivered.\n \n The counter is month-keyed even though the CEILING is a total, because the\n * two facts are different: the ceiling is \"how many records exist\" and this is\n * \"how many were turned away recently\". Only the second is worth a notice.\n \n Best-effort throughout: bookkeeping that failed must never turn a contained\n * refusal into a 500, because a 500 is an invitation to retry.\n /\nexport async function recordVisitorRecordCeilingTrip(options: {\n hostRef: FirebaseFirestore.DocumentReference\n hostId: string\n kind: VisitorRecordKind\n ceiling: number\n monthKey?: string\n}): Promise<void> {\n const { hostRef, hostId, kind, ceiling } = options\n const monthKey = options.monthKey ?? submissionMonthKey()\n try {\n const refusedRef = hostRef\n .collection('counters')\n .doc(visitorRecordRefusedCounterId(kind))\n const refusedSnapshot = await refusedRef.get()\n const alreadyRefused = Number(refusedSnapshot.get(monthKey) ?? 0)\n await refusedRef.set(\n {\n [monthKey]: FieldValue.increment(1),\n // Explicit values only — Firestore rejects `undefined`.\n ceiling,\n lastRefusedAtMs: Date.now(),\n },\n { merge: true },\n )\n if (alreadyRefused === 0) {\n const leads = kind === 'leads'\n await notifyHostManagers(hostId, {\n type: 'system.visitorRecordsPaused',\n title: leads\n ? 'Lead capture paused — this site is at the platform limit'\n : 'Sign-ups paused — this site is at the platform limit',\n body:\n `This site holds ${ceiling.toLocaleString()} ` +\n `${leads ? 'leads' : 'member accounts'}, which is the platform ` +\n `safety limit, so further ${leads ? 'leads' : 'sign-ups'} are ` +\n 'being refused. This is not part of your plan — every plan ' +\n `includes unlimited ${leads ? 'leads' : 'member accounts'}. ` +\n `Remove some ${leads ? 'leads' : 'members'}, or contact support ` +\n 'if this is real traffic.',\n link: `/${hostId}/inbox`,\n })\n }\n } catch (error) {\n console.error('visitor record ceiling bookkeeping failed', error)\n }\n}\n\n/* What a caller wants stored on the lead. `createdAt` is stamped here. /\nexport interface HostLeadInput {\n email: string\n /* The name the person typed, when they typed one (AGL-2303). /\n name?: string\n /* `signup`, `booking`, `form:{formId}` — the surface that produced it. /\n source: string\n /\n Explicit marketing opt-in, with a consent timestamp — the same shape\n * `upsertHostContact` already carries (AGL-301). Omitted or `false` writes\n * nothing: a lead is a side effect of an action the visitor DID take\n * (sign up, book), which is not by itself consent to be emailed\n * marketing, so this is only set when the caller captured an explicit\n * checkbox.\n /\n marketingConsent?: boolean\n}\n\n/\n Record one lead at `hosts/{hostId}/leads/{personKey}`, bounded by\n * `LEADS_MAX_PER_HOST` (AGL-1529).\n \n ## One person is one document\n \n `docs/specs/reusable-forms.md` §4b. This used to be `tx.create(ref.doc())`\n * — an auto-id per capture event — so one returning customer who signed up\n * and booked twice was three \"leads\". The Members & leads tab presented a\n * list of events as a list of people, and the only thing holding two rows for\n * one person together was string equality on the address at render time.\n \n The events are not lost, they are just no longer the record: `sources`\n * carries every surface that produced a capture, `submissionCount` counts\n * them, and `firstSeenAtMs`/`lastSeenAtMs` bracket them. The submissions, the\n * bookings and the member document are still there and still one row each.\n \n The id is {@link personKey} — `sha256(normalizeContactEmail(email))`, the\n * SAME derivation a list membership's `memberKey` uses, imported rather than\n * restated. Two specs named this function and the rule both stated is that\n * whichever ships second imports the first's helper: a second copy is how\n * `emailSuppressionKey` and `suppressionId` came to disagree.\n \n ## Why every lead writer goes through here\n \n There are three lead writes in the repo — the sign-up handler and the two\n * bookings paths — and all three were `hostRef.collection('leads').add(…)`\n * with a `.catch()` on the end. A cap enforced at two of three call sites is\n * not a cap, and the fourth writer somebody adds next month would not have\n * one either. One function is the only shape that survives that.\n \n ## The count is evaluated INSIDE the transaction that writes\n \n A create-time quota can be laundered by WHEN it is evaluated, not by the\n * counting rule (AGL-2231/2265/2266). Read-then-decide-then-`add()` lets N\n * concurrent visitors each read the same pre-count, each find room, and each\n * land — and nothing re-counts afterwards, so the extra rows are permanent.\n * `Transaction.get(AggregateQuery)` serialises the count against a concurrent\n * create into the same collection: the loser retries, re-reads the higher\n * count, and is refused. The count is of LIVE documents, so triaging leads in\n * the inbox frees the slots.\n \n ## Refusing a lead never fails the visitor's action\n \n A lead is a SIDE EFFECT — of a sign-up, or of a booking. The visitor did\n * not ask for it and cannot see it, so refusing one must not refuse the thing\n * they did ask for. This returns a boolean and never throws; the trip is\n * recorded and the caller carries on. That is the honest split, and it is why\n * `SITE_MEMBERS_MAX_PER_HOST` (which governs an action a visitor DID take) is\n * enforced with a 429 in the sign-up handler and this is not.\n /\nexport async function addHostLead(options: {\n hostRef: FirebaseFirestore.DocumentReference\n hostId: string\n lead: HostLeadInput\n /\n The ceiling to compare against. Defaults to `LEADS_MAX_PER_HOST` and is\n * passed by NOTHING in production — it exists so the suite can re-drive the\n * same count against a ceiling one higher and require the write to succeed.\n * A refusal that survives its own ceiling being raised was never that\n * ceiling's refusal, and there is exactly ONE comparison below, so knifing\n * it cannot be absorbed by a fallback branch.\n /\n ceiling?: number\n /\n The campaign this person came from, already resolved by the door.\n \n Resolved rather than raw, and passed rather than looked up, because one\n * visitor action reaches several writers: a form submission that creates a\n * submission, a contact AND a lead must pay for the touch lookup once. A\n * door that hands none — every order path, every import — attributes\n * nothing, which is how a lead that no campaign caused stays uncredited.\n /\n touch?: ResolvedCampaignTouch \| null\n}): Promise<boolean> {\n const { hostRef, hostId, lead } = options\n const maxPerHost = options.ceiling ?? LEADS_MAX_PER_HOST\n try {\n const leadsRef = await orgLeadsForHost(hostId)\n const firestore = hostRef.firestore\n /\n * `null` for anything that is not a usable address — a lead captured\n * against a malformed one keeps an auto-id and stays its own row. Keying\n * several unusable addresses under one guessed id would merge two\n * different people, which is worse than two rows for one.\n /\n const key = personKey(lead.email)\n /\n * A lead the org has not taken over yet is carried across BEFORE the\n * transaction opens (AGL-3275). It has to happen outside: the carry is\n * itself a read-then-write, and a transaction that also counted the\n * collection would be reading a row it was about to create. Two doors\n * carrying the same person in the same second both write the legacy\n * fields under `merge`, so the race is a no-op rather than a conflict.\n /\n const leadRef = key\n ? (await leadForWrite(hostId, key)).ref\n : leadsRef.doc()\n /\n * The scope this capture stamps, and the group whose terms its consent is\n * recorded under. Both resolved HERE rather than in the transaction body:\n * a contended transaction re-runs that body, and neither of these can\n * change between attempts, so resolving them inside would pay for the org\n * read again on every retry.\n /\n const scope = await leadScopeForHost(hostId)\n const group = await consentGroupForSite(hostId)\n const now = Date.now()\n const seen = {\n // `arrayUnion`, so a person who books twice has `['booking']` and one\n // who signed up and then submitted a form has both. Bounded by the\n // number of surfaces, not by the number of captures.\n sources: FieldValue.arrayUnion(lead.source),\n lastSeenAtMs: now,\n submissionCount: FieldValue.increment(1),\n ...(lead.name ? { name: lead.name } : {}),\n }\n let created = false\n const refused = await firestore.runTransaction(async (tx) => {\n // Reset per attempt: a contended transaction re-runs its body, and a\n // flag left standing from an aborted attempt would credit a campaign\n // with a person who turned out to exist already.\n created = false\n // ALL READS BEFORE THE WRITE, which Firestore requires.\n const existing = await tx.get(leadRef)\n /\n * ⛔ THE CEILING GATES A NEW PERSON, NEVER AN EXISTING ONE.\n \n A returning visitor's capture is an UPDATE — it does not grow the\n * collection, so refusing it buys no capacity and costs the customer\n * the source and the timestamp they would have learned. That is the\n * enforcement-at-use shape the capacity rule exists to forbid: a limit\n * must refuse the addition, never a person already recorded or the\n * data attached to them.\n \n It also means the count is only paid on a genuinely new person,\n * which is the case that can move it.\n /\n if (!existing.exists) {\n /\n * COUNTED OVER WHAT THIS SITE MAY SEE, not over the org (AGL-3275).\n \n The collection is org-wide now, and `LEADS_MAX_PER_HOST` is a\n * per-SITE ceiling. An unfiltered count would charge every brand in\n * an agency's account for every other brand's leads, and the first\n * client to fill its allowance would refuse captures on sites that\n * had taken none. `scopedToHost` is the same narrowing every other\n * org-owned read uses, so a single-site org counts exactly what it\n * counted before this moved.\n \n A lead shared by two brands in one consent group is counted by\n * both, which is the honest answer: each of them holds it.\n /\n const used = (\n await tx.get(scopedToHost(leadsRef, hostId).count())\n ).data().count\n if (checkVisitorRecordCeiling(used, maxPerHost).exceeded) return true\n }\n /\n * Consent is carried forward and never cleared.\n \n A basis is written only when this capture carried an explicit\n * opt-in, so a later booking by someone who did not tick the box\n * leaves an earlier grant standing — absent-or-granted, the shape\n * every other writer uses. The TIMESTAMP is carried over rather than\n * restamped, for the reason given at the read below.\n /\n /\n * The EARLIEST grant is the one that happened, so a later capture\n * carrying the same checkbox keeps the original date rather than\n * restamping when this person opted in. Read back through the shared\n * reader so \"already consented\" means the same thing here as it does\n * at send time.\n /\n /\n * THE SITE'S REAL GROUP, because the silo that justified a group of one\n * is gone (AGL-3275).\n \n This read `soloConsentGroup(hostId)` for as long as a lead lived at\n * `hosts/{hostId}/leads`, and the reason was the path: private by\n * construction, so pooling a lead's basis would have recorded a\n * disclosure that reached nothing, while the contact written by the\n * same capture door was org-shared and pooled.\n \n A lead is now org-shared on exactly the terms the contact is, so the\n * premise is false and keeping the group of one would leave a\n * multi-brand org holding a lead its sibling brand can SEE but may not\n * MAIL — a narrower basis than the one `consentGroupDisclosure` named\n * beside the checkbox this person ticked. Pooling here records what\n * they were actually told; an undeclared group is still a group of one,\n * so an agency is unchanged and configures nothing.\n \n Resolved above the transaction — see `group`'s declaration.\n /\n const prior = readMarketingBasis(existing.data() ?? null, group)\n const consentAtMs =\n prior.basis === 'granted' && prior.basisAtMs !== null\n ? prior.basisAtMs\n : now\n created = !existing.exists\n tx.set(\n leadRef,\n {\n email: lead.email,\n ...seen,\n /\n * WIDENED BY THE CAPTURE, NEVER BY THE LOOKUP (AGL-3275).\n \n `arrayUnion` rather than a replace, exactly as `upsert-contact`\n * stamps a contact: this site just collected this person, so it may\n * see the row. A site that merely FOUND them — the unscoped dedupe\n * lookup in `readLeadForHost` — gains nothing, which is what keeps\n * an agency's clients apart on a record they share.\n /\n visibleTo: FieldValue.arrayUnion(...scope),\n /\n * EVERY SITE THAT CAPTURED THIS PERSON, not just the first\n * (AGL-3275).\n \n This was written once, on create, and that was sound while the\n * collection sat under one host and could hold only that host's\n * name. On the org the row is shared, so a sibling brand capturing\n * a person the first brand already holds has to be recorded here or\n * the \"Known by\" answer silently omits it — the same `arrayUnion`\n * the contact door has always used for this field, now that a lead\n * has the same question to answer.\n /\n [CAPTURED_BY_HOST_FIELD]: FieldValue.arrayUnion(hostId),\n ...(existing.exists\n ? {}\n : {\n firstSeenAtMs: now,\n createdAt: FieldValue.serverTimestamp(),\n }),\n /\n * The basis is recorded under the GROUP, keyed by its host, because\n * {@link readMarketingBasis} is one function over four silos and a\n * silo whose basis lived somewhere else would need the reader to\n * know which collection it was handed. A reader that has to be told\n * the shape is a reader that can be told the wrong one.\n /\n ...(lead.marketingConsent\n ? marketingConsentFieldsForGroup(group, consentAtMs)\n : {}),\n },\n { merge: true },\n )\n return false\n })\n if (refused) {\n await recordVisitorRecordCeilingTrip({\n hostRef,\n hostId,\n kind: 'leads',\n ceiling: maxPerHost,\n })\n return false\n }\n /\n * ATTRIBUTED ON CREATION ONLY.\n \n A returning visitor's capture is an update — the campaign did not\n * produce a lead, it produced another visit by a person the site already\n * held — and crediting it would let whichever campaign ran most recently\n * re-earn every lead on the list. `created` is set inside the transaction\n * that decides it, so the attribution and the write agree about whether\n * this person is new.\n \n Awaited rather than fired off: `addHostLead` already returns only after\n * its own write, and a caller that `void`s it (every one of them) is\n * unaffected. Never throws, so a failure here cannot cost the lead.\n */\n if (created && options.touch) {\n await attributeCampaignConversion({\n hostId,\n kind: 'lead',\n refId: leadRef.id,\n touch: options.touch,\n convertedAtMs: now,\n })\n }\n return true\n } catch (error) {\n // Same posture the three original call sites had (`.catch(() => undefined)`\n // / `.catch(console.error)`): a lead that failed to store must not fail\n // the sign-up or the booking that produced it.\n console.error('lead write failed', error)\n return false\n }\n}\n"],"names":["CAPTURED_BY_HOST_FIELD","checkVisitorRecordCeiling","LEADS_MAX_PER_HOST","marketingConsentFieldsForGroup","personKey","readMarketingBasis","submissionMonthKey","visitorRecordRefusedCounterId","FieldValue","attributeCampaignConversion","notifyHostManagers","firebaseAdmin","consentGroupForSite","orgDataCollectionForHost","resolveOrgIdForHost","scopedToHost","crmReadTokens","crmScopeTokens","firestore","app","hostLeads","hostId","collection","doc","orgLeadsForHost","orgLeadsQueryForHost","ref","query","leadReadTokensForHost","group","leadScopeForHost","org","readLeadForHost","key","orgRow","get","exists","hostRow","leadForWrite","legacy","existed","carried","set","data","visibleTo","migratedFromHostId","merge","legacyLeadExists","orgIdForLeadHost","recordVisitorRecordCeilingTrip","options","hostRef","kind","ceiling","monthKey","refusedSnapshot","refusedRef","alreadyRefused","Number","increment","lastRefusedAtMs","Date","now","leads","type","title","body","toLocaleString","link","error","console","addHostLead","lead","maxPerHost","leadsRef","email","leadRef","scope","seen","sources","arrayUnion","source","lastSeenAtMs","submissionCount","name","created","refused","runTransaction","tx","existing","used","count","exceeded","prior","consentAtMs","basis","basisAtMs","firstSeenAtMs","createdAt","serverTimestamp","marketingConsent","touch","refId","id","convertedAtMs"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;CAQC,GAED,SACEA,sBAAsB,EACtBC,yBAAyB,EACzBC,kBAAkB,EAClBC,8BAA8B,EAC9BC,SAAS,EACTC,kBAAkB,EAClBC,kBAAkB,EAClBC,6BAA6B,QAExB,sBAAqB;AAC5B,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SACEC,2BAA2B,QAEtB,uCAAmC;AAC1C,SAASC,kBAAkB,QAAQ,qBAAiB;AACpD,OAAOC,mBAAmB,sBAAkB;AAC5C,SACEC,mBAAmB,EACnBC,wBAAwB,EACxBC,mBAAmB,EACnBC,YAAY,QACP,qBAAiB;AACxB,SAASC,aAAa,EAAEC,cAAc,QAAQ,sBAAqB;AAGnE,MAAMC,YAAY,IAAMP,cAAcQ,GAAG,GAAGD,SAAS;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CC,GAGD,qEAAqE,GACrE,SAASE,UAAUC,MAAc;IAC/B,OAAOH,YAAYI,UAAU,CAAC,SAASC,GAAG,CAACF,QAAQC,UAAU,CAAC;AAChE;AAEA;;;CAGC,GACD,OAAO,eAAeE,gBACpBH,MAAc;IAEd,OAAOR,yBAAyBQ,QAAQ;AAC1C;AAEA;;;;;;CAMC,GACD,OAAO,eAAeI,qBAAqBJ,MAAc;IAIvD,MAAMK,MAAM,MAAMF,gBAAgBH;IAClC,OAAO;QAAEK;QAAKC,OAAOZ,aAAaW,KAAKL;IAAQ;AACjD;AAEA;;;CAGC,GACD,OAAO,eAAeO,sBACpBP,MAAc,EACdQ,KAAoB;IAEpB,OAAOb,cAAca,gBAAAA,QAAU,MAAMjB,oBAAoBS;AAC3D;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAeS,iBACpBT,MAAc,EACdU,GAAoC;IAEpC,MAAMF,QAAQ,MAAMjB,oBAAoBS,QAAQU;IAChD,OAAOd,eAAec,cAAAA,MAAO,MAAMF;AACrC;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,eAAeG,gBACpBX,MAAc,EACdY,GAAW;IAEX,MAAMC,SAAS,MAAM,AAAC,CAAA,MAAMV,gBAAgBH,OAAM,EAAGE,GAAG,CAACU,KAAKE,GAAG;IACjE,IAAID,OAAOE,MAAM,EAAE,OAAOF;IAC1B,MAAMG,UAAU,MAAMjB,UAAUC,QAAQE,GAAG,CAACU,KAAKE,GAAG;IACpD,OAAOE,QAAQD,MAAM,GAAGC,UAAU;AACpC;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,eAAeC,aACpBjB,MAAc,EACdY,GAAW,EACXF,GAAoC;QAkB5BQ;IAZR,MAAMb,MAAM,AAAC,CAAA,MAAMF,gBAAgBH,OAAM,EAAGE,GAAG,CAACU;IAChD,IAAI,AAAC,CAAA,MAAMP,IAAIS,GAAG,EAAC,EAAGC,MAAM,EAAE,OAAO;QAAEV;QAAKc,SAAS;QAAMC,SAAS;IAAM;IAE1E,MAAMF,SAAS,MAAMnB,UAAUC,QAAQE,GAAG,CAACU,KAAKE,GAAG;IACnD,IAAI,CAACI,OAAOH,MAAM,EAAE,OAAO;QAAEV;QAAKc,SAAS;QAAOC,SAAS;IAAM;IAEjE,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,kEAAkE;IAClE,MAAMf,IAAIgB,GAAG,CACX,cACMH,eAAAA,OAAOI,IAAI,cAAXJ,eAAiB,CAAC;QACtBK,WAAW,MAAMd,iBAAiBT,QAAQU;QAC1Cc,oBAAoBxB;QAEtB;QAAEyB,OAAO;IAAK;IAEhB,OAAO;QAAEpB;QAAKc,SAAS;QAAMC,SAAS;IAAK;AAC7C;AAEA;;;;CAIC,GACD,OAAO,eAAeM,iBACpB1B,MAAc,EACdY,GAAW;IAEX,OAAO,AAAC,CAAA,MAAMb,UAAUC,QAAQE,GAAG,CAACU,KAAKE,GAAG,EAAC,EAAGC,MAAM;AACxD;AAEA,oFAAoF,GACpF,OAAO,eAAeY,iBAAiB3B,MAAc;IACnD,OAAOP,oBAAoBO;AAC7B;AAGA;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,OAAO,eAAe4B,+BAA+BC,OAMpD;QAEkBA;IADjB,MAAM,EAAEC,OAAO,EAAE9B,MAAM,EAAE+B,IAAI,EAAEC,OAAO,EAAE,GAAGH;IAC3C,MAAMI,YAAWJ,oBAAAA,QAAQI,QAAQ,YAAhBJ,oBAAoB5C;IACrC,IAAI;YAK4BiD;QAJ9B,MAAMC,aAAaL,QAChB7B,UAAU,CAAC,YACXC,GAAG,CAAChB,8BAA8B6C;QACrC,MAAMG,kBAAkB,MAAMC,WAAWrB,GAAG;QAC5C,MAAMsB,iBAAiBC,QAAOH,uBAAAA,gBAAgBpB,GAAG,CAACmB,qBAApBC,uBAAiC;QAC/D,MAAMC,WAAWd,GAAG,CAClB;YACE,CAACY,SAAS,EAAE9C,WAAWmD,SAAS,CAAC;YACjC,wDAAwD;YACxDN;YACAO,iBAAiBC,KAAKC,GAAG;QAC3B,GACA;YAAEhB,OAAO;QAAK;QAEhB,IAAIW,mBAAmB,GAAG;YACxB,MAAMM,QAAQX,SAAS;YACvB,MAAM1C,mBAAmBW,QAAQ;gBAC/B2C,MAAM;gBACNC,OAAOF,QACH,6DACA;gBACJG,MACE,CAAC,gBAAgB,EAAEb,QAAQc,cAAc,GAAG,CAAC,CAAC,GAC9C,GAAGJ,QAAQ,UAAU,kBAAkB,wBAAwB,CAAC,GAChE,CAAC,yBAAyB,EAAEA,QAAQ,UAAU,WAAW,KAAK,CAAC,GAC/D,+DACA,CAAC,mBAAmB,EAAEA,QAAQ,UAAU,kBAAkB,EAAE,CAAC,GAC7D,CAAC,YAAY,EAAEA,QAAQ,UAAU,UAAU,qBAAqB,CAAC,GACjE;gBACFK,MAAM,CAAC,CAAC,EAAE/C,OAAO,MAAM,CAAC;YAC1B;QACF;IACF,EAAE,OAAOgD,OAAO;QACdC,QAAQD,KAAK,CAAC,6CAA6CA;IAC7D;AACF;AAoBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkDC,GACD,OAAO,eAAeE,YAAYrB,OAuBjC;QAEoBA;IADnB,MAAM,EAAEC,OAAO,EAAE9B,MAAM,EAAEmD,IAAI,EAAE,GAAGtB;IAClC,MAAMuB,cAAavB,mBAAAA,QAAQG,OAAO,YAAfH,mBAAmBhD;IACtC,IAAI;QACF,MAAMwE,WAAW,MAAMlD,gBAAgBH;QACvC,MAAMH,YAAYiC,QAAQjC,SAAS;QACnC;;;;;KAKC,GACD,MAAMe,MAAM7B,UAAUoE,KAAKG,KAAK;QAChC;;;;;;;KAOC,GACD,MAAMC,UAAU3C,MACZ,AAAC,CAAA,MAAMK,aAAajB,QAAQY,IAAG,EAAGP,GAAG,GACrCgD,SAASnD,GAAG;QAChB;;;;;;KAMC,GACD,MAAMsD,QAAQ,MAAM/C,iBAAiBT;QACrC,MAAMQ,QAAQ,MAAMjB,oBAAoBS;QACxC,MAAMyC,MAAMD,KAAKC,GAAG;QACpB,MAAMgB,OAAO;YACX,sEAAsE;YACtE,mEAAmE;YACnE,qDAAqD;YACrDC,SAASvE,WAAWwE,UAAU,CAACR,KAAKS,MAAM;YAC1CC,cAAcpB;YACdqB,iBAAiB3E,WAAWmD,SAAS,CAAC;WAClCa,KAAKY,IAAI,GAAG;YAAEA,MAAMZ,KAAKY,IAAI;QAAC,IAAI,CAAC;QAEzC,IAAIC,UAAU;QACd,MAAMC,UAAU,MAAMpE,UAAUqE,cAAc,CAAC,OAAOC;gBA4EnBC;YA3EjC,qEAAqE;YACrE,qEAAqE;YACrE,iDAAiD;YACjDJ,UAAU;YACV,wDAAwD;YACxD,MAAMI,WAAW,MAAMD,GAAGrD,GAAG,CAACyC;YAC9B;;;;;;;;;;;;OAYC,GACD,IAAI,CAACa,SAASrD,MAAM,EAAE;gBACpB;;;;;;;;;;;;;SAaC,GACD,MAAMsD,OAAO,AACX,CAAA,MAAMF,GAAGrD,GAAG,CAACpB,aAAa2D,UAAUrD,QAAQsE,KAAK,GAAE,EACnDhD,IAAI,GAAGgD,KAAK;gBACd,IAAI1F,0BAA0ByF,MAAMjB,YAAYmB,QAAQ,EAAE,OAAO;YACnE;YACA;;;;;;;;OAQC,GACD;;;;;;OAMC,GACD;;;;;;;;;;;;;;;;;;;OAmBC,GACD,MAAMC,QAAQxF,oBAAmBoF,iBAAAA,SAAS9C,IAAI,cAAb8C,iBAAmB,MAAM5D;YAC1D,MAAMiE,cACJD,MAAME,KAAK,KAAK,aAAaF,MAAMG,SAAS,KAAK,OAC7CH,MAAMG,SAAS,GACflC;YACNuB,UAAU,CAACI,SAASrD,MAAM;YAC1BoD,GAAG9C,GAAG,CACJkC,SACA;gBACED,OAAOH,KAAKG,KAAK;eACdG;gBACH;;;;;;;;WAQC,GACDlC,WAAWpC,WAAWwE,UAAU,IAAIH;gBACpC;;;;;;;;;;;WAWC,GACD,CAAC7E,uBAAuB,EAAEQ,WAAWwE,UAAU,CAAC3D;eAC5CoE,SAASrD,MAAM,GACf,CAAC,IACD;gBACE6D,eAAenC;gBACfoC,WAAW1F,WAAW2F,eAAe;YACvC,GAQA3B,KAAK4B,gBAAgB,GACrBjG,+BAA+B0B,OAAOiE,eACtC,CAAC,IAEP;gBAAEhD,OAAO;YAAK;YAEhB,OAAO;QACT;QACA,IAAIwC,SAAS;YACX,MAAMrC,+BAA+B;gBACnCE;gBACA9B;gBACA+B,MAAM;gBACNC,SAASoB;YACX;YACA,OAAO;QACT;QACA;;;;;;;;;;;;;KAaC,GACD,IAAIY,WAAWnC,QAAQmD,KAAK,EAAE;YAC5B,MAAM5F,4BAA4B;gBAChCY;gBACA+B,MAAM;gBACNkD,OAAO1B,QAAQ2B,EAAE;gBACjBF,OAAOnD,QAAQmD,KAAK;gBACpBG,eAAe1C;YACjB;QACF;QACA,OAAO;IACT,EAAE,OAAOO,OAAO;QACd,4EAA4E;QAC5E,wEAAwE;QACxE,+CAA+C;QAC/CC,QAAQD,KAAK,CAAC,qBAAqBA;QACnC,OAAO;IACT;AACF"}
1	+ {"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/host-visitor-records.ts"],"sourcesContent":["/*\n @license\n * Copyright 2026 Aglyn LLC\n \n Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n \n http://www.apache.org/licenses/LICENSE-2.0\n \n Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n /\n\n/\n The durable half of the visitor-record ceilings (AGL-1529) — the lead\n * writer that enforces `LEADS_MAX_PER_HOST`, and the bookkeeping that makes a\n * trip of EITHER ceiling something a site's owner can see.\n \n The policy is pure and lives in `@aglyn/aglyn/server`\n * (`visitor-record-ceiling.ts`); this is the part that needs Firestore. Same\n * split as `visitorWriteRateLimitRefusal`, and for the same reason.\n /\n\nimport {\n CAPTURED_BY_HOST_FIELD,\n checkVisitorRecordCeiling,\n LEADS_MAX_PER_HOST,\n marketingConsentFieldsForGroup,\n personKey,\n readMarketingBasis,\n submissionMonthKey,\n visitorRecordRefusedCounterId,\n type VisitorRecordKind,\n} from '@aglyn/aglyn/server'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport {\n attributeCampaignConversion,\n type ResolvedCampaignTouch,\n} from './campaign-conversion-attribution'\nimport { notifyHostManagers } from './notifications'\nimport firebaseAdmin from './firebase-admin'\nimport {\n consentGroupForSite,\n orgDataCollectionForHost,\n resolveOrgIdForHost,\n scopedToHost,\n} from './organizations'\nimport { crmReadTokens, crmScopeTokens } from '@aglyn/aglyn/server'\nimport type { ConsentGroup, ScopeToken } from '@aglyn/aglyn/server'\n\nconst firestore = () => firebaseAdmin.app().firestore()\n\n/\n A lead's one home: `orgs/{orgId}/leads/{personKey}` (AGL-3275).\n \n ## Why leads moved\n \n A lead used to live at `hosts/{hostId}/leads/{personKey}` while the\n * contact for the same human lived on the org with a `visibleTo` array. The\n * path was doing the job `visibleTo` does, and doing it worse:\n \n - An AGENCY was isolated by the path. It is isolated by `visibleTo` too,\n * with no configuration — `consentGroupScope` on a group of one is\n * `['host:{id}']`.\n * - A MULTI-BRAND org could not be served at all. `personKey` is derived\n * from the address, so the same person captured on two sibling brands\n * produced two documents with byte-identical ids under different parents.\n * One person was two records by construction, which is the thing AGL-3232\n * had just finished eliminating for contacts.\n * - The two answers could disagree. A person's contact was visible to every\n * brand in the consent group they actually consented to — the disclosure\n * names those brands — while their lead was visible to whichever brand's\n * form they happened to land on. The lead was scoped more narrowly than\n * what the person was told, which is the safe direction to be wrong in and\n * still the wrong answer.\n \n So a lead is stamped with `crmScopeTokens` and read with `crmReadTokens`,\n * the same pair the contacts surface uses. Nothing here is a new mechanism;\n * this is leads arriving at the one the rest of the CRM already had.\n \n ## The fallback is READ-ONLY, and temporary\n \n This repo has run this migration once already — AGL-237 moved datasets,\n * contacts and media to the org, AGL-1040 backfilled, AGL-1050 deleted the\n * fallback — and `orgDataCollectionForHost` carries what it learned:\n \n \"a second storage path that can still be WRITTEN is a second boundary to\n * enforce forever, which undoes the premise of scoped sharing: one home\n * per resource plus an explicit scope.\"\n \n So the host path is never written here. It is read, once, to carry a\n * not-yet-migrated lead onto the org as a side effect of the next write that\n * touches it ({@link leadForWrite}) — which shrinks what AGL-3276's backfill\n * has left to fold, and means no read can be answered by a stale host row\n * after a write has moved on. AGL-3277 deletes the fallback and the rules\n * block behind it once that backfill reports nothing left to plan.\n /\n\n\n/\n The org collection a lead is written to. Always the org — see the\n * read-only note above.\n /\nexport async function orgLeadsForHost(\n hostId: string,\n): Promise<FirebaseFirestore.CollectionReference> {\n return orgDataCollectionForHost(hostId, 'leads')\n}\n\n/\n The leads one site may LIST, narrowed by `visibleTo`.\n \n The Admin SDK does not evaluate rules, so an unnarrowed read here would\n * serve one agency client's leads on another's site — the same reason\n * `scopedToHost` exists for every other org-owned collection.\n /\nexport async function orgLeadsQueryForHost(hostId: string): Promise<{\n ref: FirebaseFirestore.CollectionReference\n query: FirebaseFirestore.Query\n}> {\n const ref = await orgLeadsForHost(hostId)\n return { ref, query: scopedToHost(ref, hostId) }\n}\n\n/\n The tokens a reader holding this group may ask `array-contains-any` for.\n * Capped at 30 by `crmReadTokens`, as the contacts list is.\n /\nexport async function leadReadTokensForHost(\n hostId: string,\n group?: ConsentGroup,\n): Promise<ScopeToken[]> {\n return crmReadTokens(group ?? (await consentGroupForSite(hostId)))\n}\n\n/\n The `visibleTo` a capture on this site stamps: the consent group's sites,\n * or `['org']` where the org set `defaultResourceScope`.\n \n Widened by the capture, never by the lookup — a site that has never\n * captured this person gains nothing by finding them, which is what keeps an\n * agency's clients apart on a record they share. Callers UPDATING an\n * existing lead union these in rather than replacing, exactly as\n * `upsert-contact` does.\n /\nexport async function leadScopeForHost(\n hostId: string,\n org?: Record<string, unknown> \| null,\n): Promise<ScopeToken[]> {\n const group = await consentGroupForSite(hostId, org)\n return crmScopeTokens(org ?? null, group)\n}\n\n/\n The lead for an address, wherever it currently lives.\n \n ## The lookup is UNSCOPED, and has to be\n \n One human who touched two sibling brands is one person. Narrowing this to\n * what the capturing site may already see would let a second submission on a\n * sibling brand mint a SECOND record for the same address — the duplication\n * this migration exists to end, reintroduced one layer up. Recognizing\n * somebody and being allowed to read their row are different acts:\n * this finds the person, {@link leadScopeForHost} decides who may see them.\n \n `upsert-contact` states the same rule at its own dedupe lookup, and for the\n * same reason. A caller that wants only what a site may SEE wants\n * {@link orgLeadsQueryForHost}.\n \n @returns the org row; else the not-yet-migrated host row; else `null`.\n /\nexport async function readLeadForHost(\n hostId: string,\n key: string,\n): Promise<FirebaseFirestore.DocumentSnapshot \| null> {\n const orgRow = await (await orgLeadsForHost(hostId)).doc(key).get()\n return orgRow.exists ? orgRow : null\n}\n\n/\n The ref a write should target.\n \n This carried a not-yet-backfilled host row onto the org first, and reported\n * whether it had (`carried`). AGL-3276 emptied the host path and AGL-3277\n * removed it, so there is nothing left to carry: the org row is the only row.\n * `carried` stays on the shape, always `false`, because several callers\n * destructure it and a lie is cheaper to read than a signature change that\n * says nothing.\n /\nexport async function leadForWrite(\n hostId: string,\n key: string,\n): Promise<{\n ref: FirebaseFirestore.DocumentReference\n existed: boolean\n carried: boolean\n}> {\n const ref = (await orgLeadsForHost(hostId)).doc(key)\n return { ref, existed: (await ref.get()).exists, carried: false }\n}\n\n\n/\n Make a tripped ceiling OBSERVABLE rather than a silent drop — the * standing rule that a control which is not visible in the console does not\n * count as shipped.\n \n Two audiences, one call, in exactly `recordAbuseCeilingTrip`'s shape\n * (`apps/tenant/app/api/forms/submit/route.ts`, AGL-1655):\n \n - A durable per-month refusal count at\n * `hosts/{id}/counters/{siteMembers\|leads}Refused`. Counters are excluded\n * from every client write in `cloud/firebase-firestore.rules` (AGL-1367),\n * so the record cannot be edited away by the site it describes, and host\n * admins can already READ it — which is what lets the inbox console page\n * render it with no rules change.\n * - One in-app notification to the site's managers, on the FIRST refusal of\n * the month only. A notification per refused bot request would be the\n * flood again, delivered.\n \n The counter is month-keyed even though the CEILING is a total, because the\n * two facts are different: the ceiling is \"how many records exist\" and this is\n * \"how many were turned away recently\". Only the second is worth a notice.\n \n Best-effort throughout: bookkeeping that failed must never turn a contained\n * refusal into a 500, because a 500 is an invitation to retry.\n /\nexport async function recordVisitorRecordCeilingTrip(options: {\n hostRef: FirebaseFirestore.DocumentReference\n hostId: string\n kind: VisitorRecordKind\n ceiling: number\n monthKey?: string\n}): Promise<void> {\n const { hostRef, hostId, kind, ceiling } = options\n const monthKey = options.monthKey ?? submissionMonthKey()\n try {\n const refusedRef = hostRef\n .collection('counters')\n .doc(visitorRecordRefusedCounterId(kind))\n const refusedSnapshot = await refusedRef.get()\n const alreadyRefused = Number(refusedSnapshot.get(monthKey) ?? 0)\n await refusedRef.set(\n {\n [monthKey]: FieldValue.increment(1),\n // Explicit values only — Firestore rejects `undefined`.\n ceiling,\n lastRefusedAtMs: Date.now(),\n },\n { merge: true },\n )\n if (alreadyRefused === 0) {\n const leads = kind === 'leads'\n await notifyHostManagers(hostId, {\n type: 'system.visitorRecordsPaused',\n title: leads\n ? 'Lead capture paused — this site is at the platform limit'\n : 'Sign-ups paused — this site is at the platform limit',\n body:\n `This site holds ${ceiling.toLocaleString()} ` +\n `${leads ? 'leads' : 'member accounts'}, which is the platform ` +\n `safety limit, so further ${leads ? 'leads' : 'sign-ups'} are ` +\n 'being refused. This is not part of your plan — every plan ' +\n `includes unlimited ${leads ? 'leads' : 'member accounts'}. ` +\n `Remove some ${leads ? 'leads' : 'members'}, or contact support ` +\n 'if this is real traffic.',\n link: `/${hostId}/inbox`,\n })\n }\n } catch (error) {\n console.error('visitor record ceiling bookkeeping failed', error)\n }\n}\n\n/* What a caller wants stored on the lead. `createdAt` is stamped here. /\nexport interface HostLeadInput {\n email: string\n /* The name the person typed, when they typed one (AGL-2303). /\n name?: string\n /* `signup`, `booking`, `form:{formId}` — the surface that produced it. /\n source: string\n /\n Explicit marketing opt-in, with a consent timestamp — the same shape\n * `upsertHostContact` already carries (AGL-301). Omitted or `false` writes\n * nothing: a lead is a side effect of an action the visitor DID take\n * (sign up, book), which is not by itself consent to be emailed\n * marketing, so this is only set when the caller captured an explicit\n * checkbox.\n /\n marketingConsent?: boolean\n}\n\n/\n Record one lead at `hosts/{hostId}/leads/{personKey}`, bounded by\n * `LEADS_MAX_PER_HOST` (AGL-1529).\n \n ## One person is one document\n \n `docs/specs/reusable-forms.md` §4b. This used to be `tx.create(ref.doc())`\n * — an auto-id per capture event — so one returning customer who signed up\n * and booked twice was three \"leads\". The Members & leads tab presented a\n * list of events as a list of people, and the only thing holding two rows for\n * one person together was string equality on the address at render time.\n \n The events are not lost, they are just no longer the record: `sources`\n * carries every surface that produced a capture, `submissionCount` counts\n * them, and `firstSeenAtMs`/`lastSeenAtMs` bracket them. The submissions, the\n * bookings and the member document are still there and still one row each.\n \n The id is {@link personKey} — `sha256(normalizeContactEmail(email))`, the\n * SAME derivation a list membership's `memberKey` uses, imported rather than\n * restated. Two specs named this function and the rule both stated is that\n * whichever ships second imports the first's helper: a second copy is how\n * `emailSuppressionKey` and `suppressionId` came to disagree.\n \n ## Why every lead writer goes through here\n \n There are three lead writes in the repo — the sign-up handler and the two\n * bookings paths — and all three were `hostRef.collection('leads').add(…)`\n * with a `.catch()` on the end. A cap enforced at two of three call sites is\n * not a cap, and the fourth writer somebody adds next month would not have\n * one either. One function is the only shape that survives that.\n \n ## The count is evaluated INSIDE the transaction that writes\n \n A create-time quota can be laundered by WHEN it is evaluated, not by the\n * counting rule (AGL-2231/2265/2266). Read-then-decide-then-`add()` lets N\n * concurrent visitors each read the same pre-count, each find room, and each\n * land — and nothing re-counts afterwards, so the extra rows are permanent.\n * `Transaction.get(AggregateQuery)` serialises the count against a concurrent\n * create into the same collection: the loser retries, re-reads the higher\n * count, and is refused. The count is of LIVE documents, so triaging leads in\n * the inbox frees the slots.\n \n ## Refusing a lead never fails the visitor's action\n \n A lead is a SIDE EFFECT — of a sign-up, or of a booking. The visitor did\n * not ask for it and cannot see it, so refusing one must not refuse the thing\n * they did ask for. This returns a boolean and never throws; the trip is\n * recorded and the caller carries on. That is the honest split, and it is why\n * `SITE_MEMBERS_MAX_PER_HOST` (which governs an action a visitor DID take) is\n * enforced with a 429 in the sign-up handler and this is not.\n /\nexport async function addHostLead(options: {\n hostRef: FirebaseFirestore.DocumentReference\n hostId: string\n lead: HostLeadInput\n /\n The ceiling to compare against. Defaults to `LEADS_MAX_PER_HOST` and is\n * passed by NOTHING in production — it exists so the suite can re-drive the\n * same count against a ceiling one higher and require the write to succeed.\n * A refusal that survives its own ceiling being raised was never that\n * ceiling's refusal, and there is exactly ONE comparison below, so knifing\n * it cannot be absorbed by a fallback branch.\n /\n ceiling?: number\n /\n The campaign this person came from, already resolved by the door.\n \n Resolved rather than raw, and passed rather than looked up, because one\n * visitor action reaches several writers: a form submission that creates a\n * submission, a contact AND a lead must pay for the touch lookup once. A\n * door that hands none — every order path, every import — attributes\n * nothing, which is how a lead that no campaign caused stays uncredited.\n /\n touch?: ResolvedCampaignTouch \| null\n}): Promise<boolean> {\n const { hostRef, hostId, lead } = options\n const maxPerHost = options.ceiling ?? LEADS_MAX_PER_HOST\n try {\n const leadsRef = await orgLeadsForHost(hostId)\n const firestore = hostRef.firestore\n /\n * `null` for anything that is not a usable address — a lead captured\n * against a malformed one keeps an auto-id and stays its own row. Keying\n * several unusable addresses under one guessed id would merge two\n * different people, which is worse than two rows for one.\n /\n const key = personKey(lead.email)\n /\n * A lead the org has not taken over yet is carried across BEFORE the\n * transaction opens (AGL-3275). It has to happen outside: the carry is\n * itself a read-then-write, and a transaction that also counted the\n * collection would be reading a row it was about to create. Two doors\n * carrying the same person in the same second both write the legacy\n * fields under `merge`, so the race is a no-op rather than a conflict.\n /\n const leadRef = key\n ? (await leadForWrite(hostId, key)).ref\n : leadsRef.doc()\n /\n * The scope this capture stamps, and the group whose terms its consent is\n * recorded under. Both resolved HERE rather than in the transaction body:\n * a contended transaction re-runs that body, and neither of these can\n * change between attempts, so resolving them inside would pay for the org\n * read again on every retry.\n /\n const scope = await leadScopeForHost(hostId)\n const group = await consentGroupForSite(hostId)\n const now = Date.now()\n const seen = {\n // `arrayUnion`, so a person who books twice has `['booking']` and one\n // who signed up and then submitted a form has both. Bounded by the\n // number of surfaces, not by the number of captures.\n sources: FieldValue.arrayUnion(lead.source),\n lastSeenAtMs: now,\n submissionCount: FieldValue.increment(1),\n ...(lead.name ? { name: lead.name } : {}),\n }\n let created = false\n const refused = await firestore.runTransaction(async (tx) => {\n // Reset per attempt: a contended transaction re-runs its body, and a\n // flag left standing from an aborted attempt would credit a campaign\n // with a person who turned out to exist already.\n created = false\n // ALL READS BEFORE THE WRITE, which Firestore requires.\n const existing = await tx.get(leadRef)\n /\n * ⛔ THE CEILING GATES A NEW PERSON, NEVER AN EXISTING ONE.\n \n A returning visitor's capture is an UPDATE — it does not grow the\n * collection, so refusing it buys no capacity and costs the customer\n * the source and the timestamp they would have learned. That is the\n * enforcement-at-use shape the capacity rule exists to forbid: a limit\n * must refuse the addition, never a person already recorded or the\n * data attached to them.\n \n It also means the count is only paid on a genuinely new person,\n * which is the case that can move it.\n /\n if (!existing.exists) {\n /\n * COUNTED OVER WHAT THIS SITE MAY SEE, not over the org (AGL-3275).\n \n The collection is org-wide now, and `LEADS_MAX_PER_HOST` is a\n * per-SITE ceiling. An unfiltered count would charge every brand in\n * an agency's account for every other brand's leads, and the first\n * client to fill its allowance would refuse captures on sites that\n * had taken none. `scopedToHost` is the same narrowing every other\n * org-owned read uses, so a single-site org counts exactly what it\n * counted before this moved.\n \n A lead shared by two brands in one consent group is counted by\n * both, which is the honest answer: each of them holds it.\n /\n const used = (\n await tx.get(scopedToHost(leadsRef, hostId).count())\n ).data().count\n if (checkVisitorRecordCeiling(used, maxPerHost).exceeded) return true\n }\n /\n * Consent is carried forward and never cleared.\n \n A basis is written only when this capture carried an explicit\n * opt-in, so a later booking by someone who did not tick the box\n * leaves an earlier grant standing — absent-or-granted, the shape\n * every other writer uses. The TIMESTAMP is carried over rather than\n * restamped, for the reason given at the read below.\n /\n /\n * The EARLIEST grant is the one that happened, so a later capture\n * carrying the same checkbox keeps the original date rather than\n * restamping when this person opted in. Read back through the shared\n * reader so \"already consented\" means the same thing here as it does\n * at send time.\n /\n /\n * THE SITE'S REAL GROUP, because the silo that justified a group of one\n * is gone (AGL-3275).\n \n This read `soloConsentGroup(hostId)` for as long as a lead lived at\n * `hosts/{hostId}/leads`, and the reason was the path: private by\n * construction, so pooling a lead's basis would have recorded a\n * disclosure that reached nothing, while the contact written by the\n * same capture door was org-shared and pooled.\n \n A lead is now org-shared on exactly the terms the contact is, so the\n * premise is false and keeping the group of one would leave a\n * multi-brand org holding a lead its sibling brand can SEE but may not\n * MAIL — a narrower basis than the one `consentGroupDisclosure` named\n * beside the checkbox this person ticked. Pooling here records what\n * they were actually told; an undeclared group is still a group of one,\n * so an agency is unchanged and configures nothing.\n \n Resolved above the transaction — see `group`'s declaration.\n /\n const prior = readMarketingBasis(existing.data() ?? null, group)\n const consentAtMs =\n prior.basis === 'granted' && prior.basisAtMs !== null\n ? prior.basisAtMs\n : now\n created = !existing.exists\n tx.set(\n leadRef,\n {\n email: lead.email,\n ...seen,\n /\n * WIDENED BY THE CAPTURE, NEVER BY THE LOOKUP (AGL-3275).\n \n `arrayUnion` rather than a replace, exactly as `upsert-contact`\n * stamps a contact: this site just collected this person, so it may\n * see the row. A site that merely FOUND them — the unscoped dedupe\n * lookup in `readLeadForHost` — gains nothing, which is what keeps\n * an agency's clients apart on a record they share.\n /\n visibleTo: FieldValue.arrayUnion(...scope),\n /\n * EVERY SITE THAT CAPTURED THIS PERSON, not just the first\n * (AGL-3275).\n \n This was written once, on create, and that was sound while the\n * collection sat under one host and could hold only that host's\n * name. On the org the row is shared, so a sibling brand capturing\n * a person the first brand already holds has to be recorded here or\n * the \"Known by\" answer silently omits it — the same `arrayUnion`\n * the contact door has always used for this field, now that a lead\n * has the same question to answer.\n /\n [CAPTURED_BY_HOST_FIELD]: FieldValue.arrayUnion(hostId),\n ...(existing.exists\n ? {}\n : {\n firstSeenAtMs: now,\n createdAt: FieldValue.serverTimestamp(),\n }),\n /\n * The basis is recorded under the GROUP, keyed by its host, because\n * {@link readMarketingBasis} is one function over four silos and a\n * silo whose basis lived somewhere else would need the reader to\n * know which collection it was handed. A reader that has to be told\n * the shape is a reader that can be told the wrong one.\n /\n ...(lead.marketingConsent\n ? marketingConsentFieldsForGroup(group, consentAtMs)\n : {}),\n },\n { merge: true },\n )\n return false\n })\n if (refused) {\n await recordVisitorRecordCeilingTrip({\n hostRef,\n hostId,\n kind: 'leads',\n ceiling: maxPerHost,\n })\n return false\n }\n /\n * ATTRIBUTED ON CREATION ONLY.\n \n A returning visitor's capture is an update — the campaign did not\n * produce a lead, it produced another visit by a person the site already\n * held — and crediting it would let whichever campaign ran most recently\n * re-earn every lead on the list. `created` is set inside the transaction\n * that decides it, so the attribution and the write agree about whether\n * this person is new.\n \n Awaited rather than fired off: `addHostLead` already returns only after\n * its own write, and a caller that `void`s it (every one of them) is\n * unaffected. Never throws, so a failure here cannot cost the lead.\n */\n if (created && options.touch) {\n await attributeCampaignConversion({\n hostId,\n kind: 'lead',\n refId: leadRef.id,\n touch: options.touch,\n convertedAtMs: now,\n })\n }\n return true\n } catch (error) {\n // Same posture the three original call sites had (`.catch(() => undefined)`\n // / `.catch(console.error)`): a lead that failed to store must not fail\n // the sign-up or the booking that produced it.\n console.error('lead write failed', error)\n return false\n }\n}\n"],"names":["CAPTURED_BY_HOST_FIELD","checkVisitorRecordCeiling","LEADS_MAX_PER_HOST","marketingConsentFieldsForGroup","personKey","readMarketingBasis","submissionMonthKey","visitorRecordRefusedCounterId","FieldValue","attributeCampaignConversion","notifyHostManagers","firebaseAdmin","consentGroupForSite","orgDataCollectionForHost","scopedToHost","crmReadTokens","crmScopeTokens","firestore","app","orgLeadsForHost","hostId","orgLeadsQueryForHost","ref","query","leadReadTokensForHost","group","leadScopeForHost","org","readLeadForHost","key","orgRow","doc","get","exists","leadForWrite","existed","carried","recordVisitorRecordCeilingTrip","options","hostRef","kind","ceiling","monthKey","refusedSnapshot","refusedRef","collection","alreadyRefused","Number","set","increment","lastRefusedAtMs","Date","now","merge","leads","type","title","body","toLocaleString","link","error","console","addHostLead","lead","maxPerHost","leadsRef","email","leadRef","scope","seen","sources","arrayUnion","source","lastSeenAtMs","submissionCount","name","created","refused","runTransaction","tx","existing","used","count","data","exceeded","prior","consentAtMs","basis","basisAtMs","visibleTo","firstSeenAtMs","createdAt","serverTimestamp","marketingConsent","touch","refId","id","convertedAtMs"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;CAQC,GAED,SACEA,sBAAsB,EACtBC,yBAAyB,EACzBC,kBAAkB,EAClBC,8BAA8B,EAC9BC,SAAS,EACTC,kBAAkB,EAClBC,kBAAkB,EAClBC,6BAA6B,QAExB,sBAAqB;AAC5B,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SACEC,2BAA2B,QAEtB,uCAAmC;AAC1C,SAASC,kBAAkB,QAAQ,qBAAiB;AACpD,OAAOC,mBAAmB,sBAAkB;AAC5C,SACEC,mBAAmB,EACnBC,wBAAwB,EAExBC,YAAY,QACP,qBAAiB;AACxB,SAASC,aAAa,EAAEC,cAAc,QAAQ,sBAAqB;AAGnE,MAAMC,YAAY,IAAMN,cAAcO,GAAG,GAAGD,SAAS;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CC,GAGD;;;CAGC,GACD,OAAO,eAAeE,gBACpBC,MAAc;IAEd,OAAOP,yBAAyBO,QAAQ;AAC1C;AAEA;;;;;;CAMC,GACD,OAAO,eAAeC,qBAAqBD,MAAc;IAIvD,MAAME,MAAM,MAAMH,gBAAgBC;IAClC,OAAO;QAAEE;QAAKC,OAAOT,aAAaQ,KAAKF;IAAQ;AACjD;AAEA;;;CAGC,GACD,OAAO,eAAeI,sBACpBJ,MAAc,EACdK,KAAoB;IAEpB,OAAOV,cAAcU,gBAAAA,QAAU,MAAMb,oBAAoBQ;AAC3D;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAeM,iBACpBN,MAAc,EACdO,GAAoC;IAEpC,MAAMF,QAAQ,MAAMb,oBAAoBQ,QAAQO;IAChD,OAAOX,eAAeW,cAAAA,MAAO,MAAMF;AACrC;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,eAAeG,gBACpBR,MAAc,EACdS,GAAW;IAEX,MAAMC,SAAS,MAAM,AAAC,CAAA,MAAMX,gBAAgBC,OAAM,EAAGW,GAAG,CAACF,KAAKG,GAAG;IACjE,OAAOF,OAAOG,MAAM,GAAGH,SAAS;AAClC;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAeI,aACpBd,MAAc,EACdS,GAAW;IAMX,MAAMP,MAAM,AAAC,CAAA,MAAMH,gBAAgBC,OAAM,EAAGW,GAAG,CAACF;IAChD,OAAO;QAAEP;QAAKa,SAAS,AAAC,CAAA,MAAMb,IAAIU,GAAG,EAAC,EAAGC,MAAM;QAAEG,SAAS;IAAM;AAClE;AAGA;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,OAAO,eAAeC,+BAA+BC,OAMpD;QAEkBA;IADjB,MAAM,EAAEC,OAAO,EAAEnB,MAAM,EAAEoB,IAAI,EAAEC,OAAO,EAAE,GAAGH;IAC3C,MAAMI,YAAWJ,oBAAAA,QAAQI,QAAQ,YAAhBJ,oBAAoBhC;IACrC,IAAI;YAK4BqC;QAJ9B,MAAMC,aAAaL,QAChBM,UAAU,CAAC,YACXd,GAAG,CAACxB,8BAA8BiC;QACrC,MAAMG,kBAAkB,MAAMC,WAAWZ,GAAG;QAC5C,MAAMc,iBAAiBC,QAAOJ,uBAAAA,gBAAgBX,GAAG,CAACU,qBAApBC,uBAAiC;QAC/D,MAAMC,WAAWI,GAAG,CAClB;YACE,CAACN,SAAS,EAAElC,WAAWyC,SAAS,CAAC;YACjC,wDAAwD;YACxDR;YACAS,iBAAiBC,KAAKC,GAAG;QAC3B,GACA;YAAEC,OAAO;QAAK;QAEhB,IAAIP,mBAAmB,GAAG;YACxB,MAAMQ,QAAQd,SAAS;YACvB,MAAM9B,mBAAmBU,QAAQ;gBAC/BmC,MAAM;gBACNC,OAAOF,QACH,6DACA;gBACJG,MACE,CAAC,gBAAgB,EAAEhB,QAAQiB,cAAc,GAAG,CAAC,CAAC,GAC9C,GAAGJ,QAAQ,UAAU,kBAAkB,wBAAwB,CAAC,GAChE,CAAC,yBAAyB,EAAEA,QAAQ,UAAU,WAAW,KAAK,CAAC,GAC/D,+DACA,CAAC,mBAAmB,EAAEA,QAAQ,UAAU,kBAAkB,EAAE,CAAC,GAC7D,CAAC,YAAY,EAAEA,QAAQ,UAAU,UAAU,qBAAqB,CAAC,GACjE;gBACFK,MAAM,CAAC,CAAC,EAAEvC,OAAO,MAAM,CAAC;YAC1B;QACF;IACF,EAAE,OAAOwC,OAAO;QACdC,QAAQD,KAAK,CAAC,6CAA6CA;IAC7D;AACF;AAoBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkDC,GACD,OAAO,eAAeE,YAAYxB,OAuBjC;QAEoBA;IADnB,MAAM,EAAEC,OAAO,EAAEnB,MAAM,EAAE2C,IAAI,EAAE,GAAGzB;IAClC,MAAM0B,cAAa1B,mBAAAA,QAAQG,OAAO,YAAfH,mBAAmBpC;IACtC,IAAI;QACF,MAAM+D,WAAW,MAAM9C,gBAAgBC;QACvC,MAAMH,YAAYsB,QAAQtB,SAAS;QACnC;;;;;KAKC,GACD,MAAMY,MAAMzB,UAAU2D,KAAKG,KAAK;QAChC;;;;;;;KAOC,GACD,MAAMC,UAAUtC,MACZ,AAAC,CAAA,MAAMK,aAAad,QAAQS,IAAG,EAAGP,GAAG,GACrC2C,SAASlC,GAAG;QAChB;;;;;;KAMC,GACD,MAAMqC,QAAQ,MAAM1C,iBAAiBN;QACrC,MAAMK,QAAQ,MAAMb,oBAAoBQ;QACxC,MAAMgC,MAAMD,KAAKC,GAAG;QACpB,MAAMiB,OAAO;YACX,sEAAsE;YACtE,mEAAmE;YACnE,qDAAqD;YACrDC,SAAS9D,WAAW+D,UAAU,CAACR,KAAKS,MAAM;YAC1CC,cAAcrB;YACdsB,iBAAiBlE,WAAWyC,SAAS,CAAC;WAClCc,KAAKY,IAAI,GAAG;YAAEA,MAAMZ,KAAKY,IAAI;QAAC,IAAI,CAAC;QAEzC,IAAIC,UAAU;QACd,MAAMC,UAAU,MAAM5D,UAAU6D,cAAc,CAAC,OAAOC;gBA4EnBC;YA3EjC,qEAAqE;YACrE,qEAAqE;YACrE,iDAAiD;YACjDJ,UAAU;YACV,wDAAwD;YACxD,MAAMI,WAAW,MAAMD,GAAG/C,GAAG,CAACmC;YAC9B;;;;;;;;;;;;OAYC,GACD,IAAI,CAACa,SAAS/C,MAAM,EAAE;gBACpB;;;;;;;;;;;;;SAaC,GACD,MAAMgD,OAAO,AACX,CAAA,MAAMF,GAAG/C,GAAG,CAAClB,aAAamD,UAAU7C,QAAQ8D,KAAK,GAAE,EACnDC,IAAI,GAAGD,KAAK;gBACd,IAAIjF,0BAA0BgF,MAAMjB,YAAYoB,QAAQ,EAAE,OAAO;YACnE;YACA;;;;;;;;OAQC,GACD;;;;;;OAMC,GACD;;;;;;;;;;;;;;;;;;;OAmBC,GACD,MAAMC,QAAQhF,oBAAmB2E,iBAAAA,SAASG,IAAI,cAAbH,iBAAmB,MAAMvD;YAC1D,MAAM6D,cACJD,MAAME,KAAK,KAAK,aAAaF,MAAMG,SAAS,KAAK,OAC7CH,MAAMG,SAAS,GACfpC;YACNwB,UAAU,CAACI,SAAS/C,MAAM;YAC1B8C,GAAG/B,GAAG,CACJmB,SACA;gBACED,OAAOH,KAAKG,KAAK;eACdG;gBACH;;;;;;;;WAQC,GACDoB,WAAWjF,WAAW+D,UAAU,IAAIH;gBACpC;;;;;;;;;;;WAWC,GACD,CAACpE,uBAAuB,EAAEQ,WAAW+D,UAAU,CAACnD;eAC5C4D,SAAS/C,MAAM,GACf,CAAC,IACD;gBACEyD,eAAetC;gBACfuC,WAAWnF,WAAWoF,eAAe;YACvC,GAQA7B,KAAK8B,gBAAgB,GACrB1F,+BAA+BsB,OAAO6D,eACtC,CAAC,IAEP;gBAAEjC,OAAO;YAAK;YAEhB,OAAO;QACT;QACA,IAAIwB,SAAS;YACX,MAAMxC,+BAA+B;gBACnCE;gBACAnB;gBACAoB,MAAM;gBACNC,SAASuB;YACX;YACA,OAAO;QACT;QACA;;;;;;;;;;;;;KAaC,GACD,IAAIY,WAAWtC,QAAQwD,KAAK,EAAE;YAC5B,MAAMrF,4BAA4B;gBAChCW;gBACAoB,MAAM;gBACNuD,OAAO5B,QAAQ6B,EAAE;gBACjBF,OAAOxD,QAAQwD,KAAK;gBACpBG,eAAe7C;YACjB;QACF;QACA,OAAO;IACT,EAAE,OAAOQ,OAAO;QACd,4EAA4E;QAC5E,wEAAwE;QACxE,+CAA+C;QAC/CC,QAAQD,KAAK,CAAC,qBAAqBA;QACnC,OAAO;IACT;AACF"}