@aglyn/tenant-data-admin 1.0.0-beta.199 → 1.0.0-beta.200

package/src/lib/server/host-memberships.d.ts

@@ -19,7 +19,38 @@ interface HostMeta {
     displayName?: string;
     subdomain?: string;
     favicon?: string;
+    /** The custom domain, which the Sites list's search finds a site by. */
+    cname?: string;
+    /** When the site was created: set once, by `claimHostForOrg`, and never moved. */
+    createdAt?: unknown;
 }
+/**
+ * The words a site is FOUND by in the Sites list's quick search (AGL-3321):
+ * its name, its platform subdomain and its custom domain, as the word-prefix
+ * tokens `nameSearchTokens` writes, which the list's query asks for with one
+ * `array-contains` on the first typed word (`nameSearchNormalizers.token`).
+ *
+ * A subdomain or a domain is one "word" to `nameSearchTokens`, so the prefixes
+ * of `harbor-bakery` alone would find it by `harbor` and never by `bakery`.
+ * Every tail that begins after a separator is tokenized too, which is what
+ * lets `bakery`, `bakery.com` and `shop.harbor` all find
+ * `shop.harbor-bakery.com` — the words a reader remembers of an address.
+ *
+ * The platform apex is not a word here: it is the same on every site, so it
+ * narrows nothing, and the subdomain in front of it is.
+ *
+ * Its script-side twin, for the backfill and the seeds that write these rows,
+ * is `tools/scripts/lib/host-membership-search-tokens.mjs`; both answer
+ * `tools/scripts/lib/host-membership-search-tokens.fixtures.json`, which this
+ * library's spec asserts too.
+ */
+export declare function hostMembershipSearchTokens(meta: Pick<HostMeta, 'displayName' | 'subdomain' | 'cname'> | undefined): string[];
+/**
+ * Whether a site has a custom domain connected, as the Sites card lists it:
+ * a non-blank `cname`, which only the domain attach route writes and only the
+ * detach route removes.
+ */
+export declare const hasCustomDomain: (meta: Pick<HostMeta, "cname"> | undefined) => boolean;
 /**
  * Shape one projection row. Exported for tests: the favicon rule below is a
  * delete-vs-omit decision that is invisible in review and silent in
@@ -28,6 +59,9 @@ interface HostMeta {
 export declare const membershipRow: (orgId: string, meta: HostMeta | undefined, role: string) => {
     displayName: string;
     nameLower: string;
+    searchTokens: string[];
+    hasCustomDomain: boolean;
+    createdAt: unknown;
     favicon: string | FieldValue;
     role: string;
     updatedAt: FieldValue;

package/src/lib/server/host-memberships.js

@@ -34,7 +34,29 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * change re-syncs THAT member across the org's hosts; a host change re-syncs
  * THAT host across members. Kept in sync at the same points as `memberRoles`
  * (see `syncHostMemberRoles` callers) plus the erase/displayName gaps (AGL-855).
+ *
+ * ## The Sites list is a query over these rows (AGL-3321)
+ *
+ * The organization's Sites list pages, filters and searches THIS collection —
+ * `where(orgId ==)`, plus the reader's clauses, ordered by `nameLower` or
+ * `createdAt` — and joins each row to the host document by id for display.
+ * It cannot query `hosts` itself: the rules serve a non-staff LIST of `hosts`
+ * only under a `memberRoles.{uid}` clause, a composite on that per-user map
+ * path can exist for no order but the document id, and a predicated listen
+ * over the mutable `memberRoles`/`orgId` is what tombstoned host documents
+ * for every other reader (AGL-1190, `useOrgHosts`).
+ *
+ * So a row carries what that list asks of a site: `searchTokens` (the quick
+ * search, over the name, the platform subdomain and the custom domain),
+ * `hasCustomDomain` (the Custom domain filter) and the host's `createdAt`
+ * (immutable, set once at create). Every field is derived from the host
+ * document in `membershipRow`, so a re-sync from any writer re-derives all of
+ * them; the writers of their source fields — create, the owner and staff
+ * renames, the Setup name save, and the domain attach and detach routes (the
+ * only writers of `cname`) — each re-sync. Rows written before AGL-3321 are
+ * stamped by `tools/scripts/backfill-host-memberships-list-fields.mjs`.
  */ import { hostRoleFor, isOrgWideMember, nameSearchKey } from "@aglyn/aglyn/server";
+import { nameSearchTokens } from "@aglyn/aglyn/app-utils/name-search";
 import { FieldValue } from "firebase-admin/firestore";
 import firebaseAdmin from "./firebase-admin.js";
 const firestore = ()=>firebaseAdmin.app().firestore();
@@ -56,7 +78,9 @@ const readHostMeta = async (db, hostIds)=>{
                 subdomain: snap.get('subdomain'),
                 // The switcher renders from the projection, not the host doc, so the
                 // favicon has to travel with it (AGL-1071).
-                favicon: (_snap_get = snap.get('seo')) == null ? void 0 : _snap_get.favicon
+                favicon: (_snap_get = snap.get('seo')) == null ? void 0 : _snap_get.favicon,
+                cname: snap.get('cname'),
+                createdAt: snap.get('createdAt')
             }
         ];
     }));
@@ -68,6 +92,58 @@ const listMembers = async (db, orgId)=>{
         }, d.data()));
 };
 const membershipRef = (db, uid, hostId)=>db.collection('users').doc(uid).collection('hostMemberships').doc(hostId);
+/** A tail of a word begins after any character that is not a letter or a digit. */ const WORD_SEPARATOR = RegExp("[^\\u0041-\\u005A\\u0061-\\u007A\\u00AA\\u00B5\\u00BA\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u02C1\\u02C6-\\u02D1\\u02E0-\\u02E4\\u02EC\\u02EE\\u0370-\\u0374\\u0376-\\u0377\\u037A-\\u037D\\u037F\\u0386\\u0388-\\u038A\\u038C\\u038E-\\u03A1\\u03A3-\\u03F5\\u03F7-\\u0481\\u048A-\\u052F\\u0531-\\u0556\\u0559\\u0560-\\u0588\\u05D0-\\u05EA\\u05EF-\\u05F2\\u0620-\\u064A\\u066E-\\u066F\\u0671-\\u06D3\\u06D5\\u06E5-\\u06E6\\u06EE-\\u06EF\\u06FA-\\u06FC\\u06FF\\u0710\\u0712-\\u072F\\u074D-\\u07A5\\u07B1\\u07CA-\\u07EA\\u07F4-\\u07F5\\u07FA\\u0800-\\u0815\\u081A\\u0824\\u0828\\u0840-\\u0858\\u0860-\\u086A\\u0870-\\u0887\\u0889-\\u088F\\u08A0-\\u08C9\\u0904-\\u0939\\u093D\\u0950\\u0958-\\u0961\\u0971-\\u0980\\u0985-\\u098C\\u098F-\\u0990\\u0993-\\u09A8\\u09AA-\\u09B0\\u09B2\\u09B6-\\u09B9\\u09BD\\u09CE\\u09DC-\\u09DD\\u09DF-\\u09E1\\u09F0-\\u09F1\\u09FC\\u0A05-\\u0A0A\\u0A0F-\\u0A10\\u0A13-\\u0A28\\u0A2A-\\u0A30\\u0A32-\\u0A33\\u0A35-\\u0A36\\u0A38-\\u0A39\\u0A59-\\u0A5C\\u0A5E\\u0A72-\\u0A74\\u0A85-\\u0A8D\\u0A8F-\\u0A91\\u0A93-\\u0AA8\\u0AAA-\\u0AB0\\u0AB2-\\u0AB3\\u0AB5-\\u0AB9\\u0ABD\\u0AD0\\u0AE0-\\u0AE1\\u0AF9\\u0B05-\\u0B0C\\u0B0F-\\u0B10\\u0B13-\\u0B28\\u0B2A-\\u0B30\\u0B32-\\u0B33\\u0B35-\\u0B39\\u0B3D\\u0B5C-\\u0B5D\\u0B5F-\\u0B61\\u0B71\\u0B83\\u0B85-\\u0B8A\\u0B8E-\\u0B90\\u0B92-\\u0B95\\u0B99-\\u0B9A\\u0B9C\\u0B9E-\\u0B9F\\u0BA3-\\u0BA4\\u0BA8-\\u0BAA\\u0BAE-\\u0BB9\\u0BD0\\u0C05-\\u0C0C\\u0C0E-\\u0C10\\u0C12-\\u0C28\\u0C2A-\\u0C39\\u0C3D\\u0C58-\\u0C5A\\u0C5C-\\u0C5D\\u0C60-\\u0C61\\u0C80\\u0C85-\\u0C8C\\u0C8E-\\u0C90\\u0C92-\\u0CA8\\u0CAA-\\u0CB3\\u0CB5-\\u0CB9\\u0CBD\\u0CDC-\\u0CDE\\u0CE0-\\u0CE1\\u0CF1-\\u0CF2\\u0D04-\\u0D0C\\u0D0E-\\u0D10\\u0D12-\\u0D3A\\u0D3D\\u0D4E\\u0D54-\\u0D56\\u0D5F-\\u0D61\\u0D7A-\\u0D7F\\u0D85-\\u0D96\\u0D9A-\\u0DB1\\u0DB3-\\u0DBB\\u0DBD\\u0DC0-\\u0DC6\\u0E01-\\u0E30\\u0E32-\\u0E33\\u0E40-\\u0E46\\u0E81-\\u0E82\\u0E84\\u0E86-\\u0E8A\\u0E8C-\\u0EA3\\u0EA5\\u0EA7-\\u0EB0\\u0EB2-\\u0EB3\\u0EBD\\u0EC0-\\u0EC4\\u0EC6\\u0EDC-\\u0EDF\\u0F00\\u0F40-\\u0F47\\u0F49-\\u0F6C\\u0F88-\\u0F8C\\u1000-\\u102A\\u103F\\u1050-\\u1055\\u105A-\\u105D\\u1061\\u1065-\\u1066\\u106E-\\u1070\\u1075-\\u1081\\u108E\\u10A0-\\u10C5\\u10C7\\u10CD\\u10D0-\\u10FA\\u10FC-\\u1248\\u124A-\\u124D\\u1250-\\u1256\\u1258\\u125A-\\u125D\\u1260-\\u1288\\u128A-\\u128D\\u1290-\\u12B0\\u12B2-\\u12B5\\u12B8-\\u12BE\\u12C0\\u12C2-\\u12C5\\u12C8-\\u12D6\\u12D8-\\u1310\\u1312-\\u1315\\u1318-\\u135A\\u1380-\\u138F\\u13A0-\\u13F5\\u13F8-\\u13FD\\u1401-\\u166C\\u166F-\\u167F\\u1681-\\u169A\\u16A0-\\u16EA\\u16F1-\\u16F8\\u1700-\\u1711\\u171F-\\u1731\\u1740-\\u1751\\u1760-\\u176C\\u176E-\\u1770\\u1780-\\u17B3\\u17D7\\u17DC\\u1820-\\u1878\\u1880-\\u1884\\u1887-\\u18A8\\u18AA\\u18B0-\\u18F5\\u1900-\\u191E\\u1950-\\u196D\\u1970-\\u1974\\u1980-\\u19AB\\u19B0-\\u19C9\\u1A00-\\u1A16\\u1A20-\\u1A54\\u1AA7\\u1B05-\\u1B33\\u1B45-\\u1B4C\\u1B83-\\u1BA0\\u1BAE-\\u1BAF\\u1BBA-\\u1BE5\\u1C00-\\u1C23\\u1C4D-\\u1C4F\\u1C5A-\\u1C7D\\u1C80-\\u1C8A\\u1C90-\\u1CBA\\u1CBD-\\u1CBF\\u1CE9-\\u1CEC\\u1CEE-\\u1CF3\\u1CF5-\\u1CF6\\u1CFA\\u1D00-\\u1DBF\\u1E00-\\u1F15\\u1F18-\\u1F1D\\u1F20-\\u1F45\\u1F48-\\u1F4D\\u1F50-\\u1F57\\u1F59\\u1F5B\\u1F5D\\u1F5F-\\u1F7D\\u1F80-\\u1FB4\\u1FB6-\\u1FBC\\u1FBE\\u1FC2-\\u1FC4\\u1FC6-\\u1FCC\\u1FD0-\\u1FD3\\u1FD6-\\u1FDB\\u1FE0-\\u1FEC\\u1FF2-\\u1FF4\\u1FF6-\\u1FFC\\u2071\\u207F\\u2090-\\u209C\\u2102\\u2107\\u210A-\\u2113\\u2115\\u2119-\\u211D\\u2124\\u2126\\u2128\\u212A-\\u212D\\u212F-\\u2139\\u213C-\\u213F\\u2145-\\u2149\\u214E\\u2183-\\u2184\\u2C00-\\u2CE4\\u2CEB-\\u2CEE\\u2CF2-\\u2CF3\\u2D00-\\u2D25\\u2D27\\u2D2D\\u2D30-\\u2D67\\u2D6F\\u2D80-\\u2D96\\u2DA0-\\u2DA6\\u2DA8-\\u2DAE\\u2DB0-\\u2DB6\\u2DB8-\\u2DBE\\u2DC0-\\u2DC6\\u2DC8-\\u2DCE\\u2DD0-\\u2DD6\\u2DD8-\\u2DDE\\u2E2F\\u3005-\\u3006\\u3031-\\u3035\\u303B-\\u303C\\u3041-\\u3096\\u309D-\\u309F\\u30A1-\\u30FA\\u30FC-\\u30FF\\u3105-\\u312F\\u3131-\\u318E\\u31A0-\\u31BF\\u31F0-\\u31FF\\u3400-\\u4DBF\\u4E00-\\uA48C\\uA4D0-\\uA4FD\\uA500-\\uA60C\\uA610-\\uA61F\\uA62A-\\uA62B\\uA640-\\uA66E\\uA67F-\\uA69D\\uA6A0-\\uA6E5\\uA717-\\uA71F\\uA722-\\uA788\\uA78B-\\uA7DC\\uA7F1-\\uA801\\uA803-\\uA805\\uA807-\\uA80A\\uA80C-\\uA822\\uA840-\\uA873\\uA882-\\uA8B3\\uA8F2-\\uA8F7\\uA8FB\\uA8FD-\\uA8FE\\uA90A-\\uA925\\uA930-\\uA946\\uA960-\\uA97C\\uA984-\\uA9B2\\uA9CF\\uA9E0-\\uA9E4\\uA9E6-\\uA9EF\\uA9FA-\\uA9FE\\uAA00-\\uAA28\\uAA40-\\uAA42\\uAA44-\\uAA4B\\uAA60-\\uAA76\\uAA7A\\uAA7E-\\uAAAF\\uAAB1\\uAAB5-\\uAAB6\\uAAB9-\\uAABD\\uAAC0\\uAAC2\\uAADB-\\uAADD\\uAAE0-\\uAAEA\\uAAF2-\\uAAF4\\uAB01-\\uAB06\\uAB09-\\uAB0E\\uAB11-\\uAB16\\uAB20-\\uAB26\\uAB28-\\uAB2E\\uAB30-\\uAB5A\\uAB5C-\\uAB69\\uAB70-\\uABE2\\uAC00-\\uD7A3\\uD7B0-\\uD7C6\\uD7CB-\\uD7FB\\uF900-\\uFA6D\\uFA70-\\uFAD9\\uFB00-\\uFB06\\uFB13-\\uFB17\\uFB1D\\uFB1F-\\uFB28\\uFB2A-\\uFB36\\uFB38-\\uFB3C\\uFB3E\\uFB40-\\uFB41\\uFB43-\\uFB44\\uFB46-\\uFBB1\\uFBD3-\\uFD3D\\uFD50-\\uFD8F\\uFD92-\\uFDC7\\uFDF0-\\uFDFB\\uFE70-\\uFE74\\uFE76-\\uFEFC\\uFF21-\\uFF3A\\uFF41-\\uFF5A\\uFF66-\\uFFBE\\uFFC2-\\uFFC7\\uFFCA-\\uFFCF\\uFFD2-\\uFFD7\\uFFDA-\\uFFDC\\u{10000}-\\u{1000B}\\u{1000D}-\\u{10026}\\u{10028}-\\u{1003A}\\u{1003C}-\\u{1003D}\\u{1003F}-\\u{1004D}\\u{10050}-\\u{1005D}\\u{10080}-\\u{100FA}\\u{10280}-\\u{1029C}\\u{102A0}-\\u{102D0}\\u{10300}-\\u{1031F}\\u{1032D}-\\u{10340}\\u{10342}-\\u{10349}\\u{10350}-\\u{10375}\\u{10380}-\\u{1039D}\\u{103A0}-\\u{103C3}\\u{103C8}-\\u{103CF}\\u{10400}-\\u{1049D}\\u{104B0}-\\u{104D3}\\u{104D8}-\\u{104FB}\\u{10500}-\\u{10527}\\u{10530}-\\u{10563}\\u{10570}-\\u{1057A}\\u{1057C}-\\u{1058A}\\u{1058C}-\\u{10592}\\u{10594}-\\u{10595}\\u{10597}-\\u{105A1}\\u{105A3}-\\u{105B1}\\u{105B3}-\\u{105B9}\\u{105BB}-\\u{105BC}\\u{105C0}-\\u{105F3}\\u{10600}-\\u{10736}\\u{10740}-\\u{10755}\\u{10760}-\\u{10767}\\u{10780}-\\u{10785}\\u{10787}-\\u{107B0}\\u{107B2}-\\u{107BA}\\u{10800}-\\u{10805}\\u{10808}\\u{1080A}-\\u{10835}\\u{10837}-\\u{10838}\\u{1083C}\\u{1083F}-\\u{10855}\\u{10860}-\\u{10876}\\u{10880}-\\u{1089E}\\u{108E0}-\\u{108F2}\\u{108F4}-\\u{108F5}\\u{10900}-\\u{10915}\\u{10920}-\\u{10939}\\u{10940}-\\u{10959}\\u{10980}-\\u{109B7}\\u{109BE}-\\u{109BF}\\u{10A00}\\u{10A10}-\\u{10A13}\\u{10A15}-\\u{10A17}\\u{10A19}-\\u{10A35}\\u{10A60}-\\u{10A7C}\\u{10A80}-\\u{10A9C}\\u{10AC0}-\\u{10AC7}\\u{10AC9}-\\u{10AE4}\\u{10B00}-\\u{10B35}\\u{10B40}-\\u{10B55}\\u{10B60}-\\u{10B72}\\u{10B80}-\\u{10B91}\\u{10C00}-\\u{10C48}\\u{10C80}-\\u{10CB2}\\u{10CC0}-\\u{10CF2}\\u{10D00}-\\u{10D23}\\u{10D4A}-\\u{10D65}\\u{10D6F}-\\u{10D85}\\u{10E80}-\\u{10EA9}\\u{10EB0}-\\u{10EB1}\\u{10EC2}-\\u{10EC7}\\u{10F00}-\\u{10F1C}\\u{10F27}\\u{10F30}-\\u{10F45}\\u{10F70}-\\u{10F81}\\u{10FB0}-\\u{10FC4}\\u{10FE0}-\\u{10FF6}\\u{11003}-\\u{11037}\\u{11071}-\\u{11072}\\u{11075}\\u{11083}-\\u{110AF}\\u{110D0}-\\u{110E8}\\u{11103}-\\u{11126}\\u{11144}\\u{11147}\\u{11150}-\\u{11172}\\u{11176}\\u{11183}-\\u{111B2}\\u{111C1}-\\u{111C4}\\u{111DA}\\u{111DC}\\u{11200}-\\u{11211}\\u{11213}-\\u{1122B}\\u{1123F}-\\u{11240}\\u{11280}-\\u{11286}\\u{11288}\\u{1128A}-\\u{1128D}\\u{1128F}-\\u{1129D}\\u{1129F}-\\u{112A8}\\u{112B0}-\\u{112DE}\\u{11305}-\\u{1130C}\\u{1130F}-\\u{11310}\\u{11313}-\\u{11328}\\u{1132A}-\\u{11330}\\u{11332}-\\u{11333}\\u{11335}-\\u{11339}\\u{1133D}\\u{11350}\\u{1135D}-\\u{11361}\\u{11380}-\\u{11389}\\u{1138B}\\u{1138E}\\u{11390}-\\u{113B5}\\u{113B7}\\u{113D1}\\u{113D3}\\u{11400}-\\u{11434}\\u{11447}-\\u{1144A}\\u{1145F}-\\u{11461}\\u{11480}-\\u{114AF}\\u{114C4}-\\u{114C5}\\u{114C7}\\u{11580}-\\u{115AE}\\u{115D8}-\\u{115DB}\\u{11600}-\\u{1162F}\\u{11644}\\u{11680}-\\u{116AA}\\u{116B8}\\u{11700}-\\u{1171A}\\u{11740}-\\u{11746}\\u{11800}-\\u{1182B}\\u{118A0}-\\u{118DF}\\u{118FF}-\\u{11906}\\u{11909}\\u{1190C}-\\u{11913}\\u{11915}-\\u{11916}\\u{11918}-\\u{1192F}\\u{1193F}\\u{11941}\\u{119A0}-\\u{119A7}\\u{119AA}-\\u{119D0}\\u{119E1}\\u{119E3}\\u{11A00}\\u{11A0B}-\\u{11A32}\\u{11A3A}\\u{11A50}\\u{11A5C}-\\u{11A89}\\u{11A9D}\\u{11AB0}-\\u{11AF8}\\u{11BC0}-\\u{11BE0}\\u{11C00}-\\u{11C08}\\u{11C0A}-\\u{11C2E}\\u{11C40}\\u{11C72}-\\u{11C8F}\\u{11D00}-\\u{11D06}\\u{11D08}-\\u{11D09}\\u{11D0B}-\\u{11D30}\\u{11D46}\\u{11D60}-\\u{11D65}\\u{11D67}-\\u{11D68}\\u{11D6A}-\\u{11D89}\\u{11D98}\\u{11DB0}-\\u{11DDB}\\u{11EE0}-\\u{11EF2}\\u{11F02}\\u{11F04}-\\u{11F10}\\u{11F12}-\\u{11F33}\\u{11FB0}\\u{12000}-\\u{12399}\\u{12480}-\\u{12543}\\u{12F90}-\\u{12FF0}\\u{13000}-\\u{1342F}\\u{13441}-\\u{13446}\\u{13460}-\\u{143FA}\\u{14400}-\\u{14646}\\u{16100}-\\u{1611D}\\u{16800}-\\u{16A38}\\u{16A40}-\\u{16A5E}\\u{16A70}-\\u{16ABE}\\u{16AD0}-\\u{16AED}\\u{16B00}-\\u{16B2F}\\u{16B40}-\\u{16B43}\\u{16B63}-\\u{16B77}\\u{16B7D}-\\u{16B8F}\\u{16D40}-\\u{16D6C}\\u{16E40}-\\u{16E7F}\\u{16EA0}-\\u{16EB8}\\u{16EBB}-\\u{16ED3}\\u{16F00}-\\u{16F4A}\\u{16F50}\\u{16F93}-\\u{16F9F}\\u{16FE0}-\\u{16FE1}\\u{16FE3}\\u{16FF2}-\\u{16FF3}\\u{17000}-\\u{18CD5}\\u{18CFF}-\\u{18D1E}\\u{18D80}-\\u{18DF2}\\u{1AFF0}-\\u{1AFF3}\\u{1AFF5}-\\u{1AFFB}\\u{1AFFD}-\\u{1AFFE}\\u{1B000}-\\u{1B122}\\u{1B132}\\u{1B150}-\\u{1B152}\\u{1B155}\\u{1B164}-\\u{1B167}\\u{1B170}-\\u{1B2FB}\\u{1BC00}-\\u{1BC6A}\\u{1BC70}-\\u{1BC7C}\\u{1BC80}-\\u{1BC88}\\u{1BC90}-\\u{1BC99}\\u{1D400}-\\u{1D454}\\u{1D456}-\\u{1D49C}\\u{1D49E}-\\u{1D49F}\\u{1D4A2}\\u{1D4A5}-\\u{1D4A6}\\u{1D4A9}-\\u{1D4AC}\\u{1D4AE}-\\u{1D4B9}\\u{1D4BB}\\u{1D4BD}-\\u{1D4C3}\\u{1D4C5}-\\u{1D505}\\u{1D507}-\\u{1D50A}\\u{1D50D}-\\u{1D514}\\u{1D516}-\\u{1D51C}\\u{1D51E}-\\u{1D539}\\u{1D53B}-\\u{1D53E}\\u{1D540}-\\u{1D544}\\u{1D546}\\u{1D54A}-\\u{1D550}\\u{1D552}-\\u{1D6A5}\\u{1D6A8}-\\u{1D6C0}\\u{1D6C2}-\\u{1D6DA}\\u{1D6DC}-\\u{1D6FA}\\u{1D6FC}-\\u{1D714}\\u{1D716}-\\u{1D734}\\u{1D736}-\\u{1D74E}\\u{1D750}-\\u{1D76E}\\u{1D770}-\\u{1D788}\\u{1D78A}-\\u{1D7A8}\\u{1D7AA}-\\u{1D7C2}\\u{1D7C4}-\\u{1D7CB}\\u{1DF00}-\\u{1DF1E}\\u{1DF25}-\\u{1DF2A}\\u{1E030}-\\u{1E06D}\\u{1E100}-\\u{1E12C}\\u{1E137}-\\u{1E13D}\\u{1E14E}\\u{1E290}-\\u{1E2AD}\\u{1E2C0}-\\u{1E2EB}\\u{1E4D0}-\\u{1E4EB}\\u{1E5D0}-\\u{1E5ED}\\u{1E5F0}\\u{1E6C0}-\\u{1E6DE}\\u{1E6E0}-\\u{1E6E2}\\u{1E6E4}-\\u{1E6E5}\\u{1E6E7}-\\u{1E6ED}\\u{1E6F0}-\\u{1E6F4}\\u{1E6FE}-\\u{1E6FF}\\u{1E7E0}-\\u{1E7E6}\\u{1E7E8}-\\u{1E7EB}\\u{1E7ED}-\\u{1E7EE}\\u{1E7F0}-\\u{1E7FE}\\u{1E800}-\\u{1E8C4}\\u{1E900}-\\u{1E943}\\u{1E94B}\\u{1EE00}-\\u{1EE03}\\u{1EE05}-\\u{1EE1F}\\u{1EE21}-\\u{1EE22}\\u{1EE24}\\u{1EE27}\\u{1EE29}-\\u{1EE32}\\u{1EE34}-\\u{1EE37}\\u{1EE39}\\u{1EE3B}\\u{1EE42}\\u{1EE47}\\u{1EE49}\\u{1EE4B}\\u{1EE4D}-\\u{1EE4F}\\u{1EE51}-\\u{1EE52}\\u{1EE54}\\u{1EE57}\\u{1EE59}\\u{1EE5B}\\u{1EE5D}\\u{1EE5F}\\u{1EE61}-\\u{1EE62}\\u{1EE64}\\u{1EE67}-\\u{1EE6A}\\u{1EE6C}-\\u{1EE72}\\u{1EE74}-\\u{1EE77}\\u{1EE79}-\\u{1EE7C}\\u{1EE7E}\\u{1EE80}-\\u{1EE89}\\u{1EE8B}-\\u{1EE9B}\\u{1EEA1}-\\u{1EEA3}\\u{1EEA5}-\\u{1EEA9}\\u{1EEAB}-\\u{1EEBB}\\u{20000}-\\u{2A6DF}\\u{2A700}-\\u{2B81D}\\u{2B820}-\\u{2CEAD}\\u{2CEB0}-\\u{2EBE0}\\u{2EBF0}-\\u{2EE5D}\\u{2F800}-\\u{2FA1D}\\u{30000}-\\u{3134A}\\u{31350}-\\u{33479}\\u0030-\\u0039\\u00B2-\\u00B3\\u00B9\\u00BC-\\u00BE\\u0660-\\u0669\\u06F0-\\u06F9\\u07C0-\\u07C9\\u0966-\\u096F\\u09E6-\\u09EF\\u09F4-\\u09F9\\u0A66-\\u0A6F\\u0AE6-\\u0AEF\\u0B66-\\u0B6F\\u0B72-\\u0B77\\u0BE6-\\u0BF2\\u0C66-\\u0C6F\\u0C78-\\u0C7E\\u0CE6-\\u0CEF\\u0D58-\\u0D5E\\u0D66-\\u0D78\\u0DE6-\\u0DEF\\u0E50-\\u0E59\\u0ED0-\\u0ED9\\u0F20-\\u0F33\\u1040-\\u1049\\u1090-\\u1099\\u1369-\\u137C\\u16EE-\\u16F0\\u17E0-\\u17E9\\u17F0-\\u17F9\\u1810-\\u1819\\u1946-\\u194F\\u19D0-\\u19DA\\u1A80-\\u1A89\\u1A90-\\u1A99\\u1B50-\\u1B59\\u1BB0-\\u1BB9\\u1C40-\\u1C49\\u1C50-\\u1C59\\u2070\\u2074-\\u2079\\u2080-\\u2089\\u2150-\\u2182\\u2185-\\u2189\\u2460-\\u249B\\u24EA-\\u24FF\\u2776-\\u2793\\u2CFD\\u3007\\u3021-\\u3029\\u3038-\\u303A\\u3192-\\u3195\\u3220-\\u3229\\u3248-\\u324F\\u3251-\\u325F\\u3280-\\u3289\\u32B1-\\u32BF\\uA620-\\uA629\\uA6E6-\\uA6EF\\uA830-\\uA835\\uA8D0-\\uA8D9\\uA900-\\uA909\\uA9D0-\\uA9D9\\uA9F0-\\uA9F9\\uAA50-\\uAA59\\uABF0-\\uABF9\\uFF10-\\uFF19\\u{10107}-\\u{10133}\\u{10140}-\\u{10178}\\u{1018A}-\\u{1018B}\\u{102E1}-\\u{102FB}\\u{10320}-\\u{10323}\\u{10341}\\u{1034A}\\u{103D1}-\\u{103D5}\\u{104A0}-\\u{104A9}\\u{10858}-\\u{1085F}\\u{10879}-\\u{1087F}\\u{108A7}-\\u{108AF}\\u{108FB}-\\u{108FF}\\u{10916}-\\u{1091B}\\u{109BC}-\\u{109BD}\\u{109C0}-\\u{109CF}\\u{109D2}-\\u{109FF}\\u{10A40}-\\u{10A48}\\u{10A7D}-\\u{10A7E}\\u{10A9D}-\\u{10A9F}\\u{10AEB}-\\u{10AEF}\\u{10B58}-\\u{10B5F}\\u{10B78}-\\u{10B7F}\\u{10BA9}-\\u{10BAF}\\u{10CFA}-\\u{10CFF}\\u{10D30}-\\u{10D39}\\u{10D40}-\\u{10D49}\\u{10E60}-\\u{10E7E}\\u{10F1D}-\\u{10F26}\\u{10F51}-\\u{10F54}\\u{10FC5}-\\u{10FCB}\\u{11052}-\\u{1106F}\\u{110F0}-\\u{110F9}\\u{11136}-\\u{1113F}\\u{111D0}-\\u{111D9}\\u{111E1}-\\u{111F4}\\u{112F0}-\\u{112F9}\\u{11450}-\\u{11459}\\u{114D0}-\\u{114D9}\\u{11650}-\\u{11659}\\u{116C0}-\\u{116C9}\\u{116D0}-\\u{116E3}\\u{11730}-\\u{1173B}\\u{118E0}-\\u{118F2}\\u{11950}-\\u{11959}\\u{11BF0}-\\u{11BF9}\\u{11C50}-\\u{11C6C}\\u{11D50}-\\u{11D59}\\u{11DA0}-\\u{11DA9}\\u{11DE0}-\\u{11DE9}\\u{11F50}-\\u{11F59}\\u{11FC0}-\\u{11FD4}\\u{12400}-\\u{1246E}\\u{16130}-\\u{16139}\\u{16A60}-\\u{16A69}\\u{16AC0}-\\u{16AC9}\\u{16B50}-\\u{16B59}\\u{16B5B}-\\u{16B61}\\u{16D70}-\\u{16D79}\\u{16E80}-\\u{16E96}\\u{16FF4}-\\u{16FF6}\\u{1CCF0}-\\u{1CCF9}\\u{1D2C0}-\\u{1D2D3}\\u{1D2E0}-\\u{1D2F3}\\u{1D360}-\\u{1D378}\\u{1D7CE}-\\u{1D7FF}\\u{1E140}-\\u{1E149}\\u{1E2F0}-\\u{1E2F9}\\u{1E4F0}-\\u{1E4F9}\\u{1E5F1}-\\u{1E5FA}\\u{1E8C7}-\\u{1E8CF}\\u{1E950}-\\u{1E959}\\u{1EC71}-\\u{1ECAB}\\u{1ECAD}-\\u{1ECAF}\\u{1ECB1}-\\u{1ECB4}\\u{1ED01}-\\u{1ED2D}\\u{1ED2F}-\\u{1ED3D}\\u{1F100}-\\u{1F10C}\\u{1FBF0}-\\u{1FBF9}]", "u");
+/**
+ * A word, and every tail of it that begins after a separator:
+ * `shop.harbor-bakery.com` is itself, `harbor-bakery.com`, `bakery.com` and
+ * `com`. Walked by codepoint, so a tail never starts inside a surrogate pair.
+ */ const wordTails = (word)=>{
+    const chars = [
+        ...word
+    ];
+    const tails = [
+        word
+    ];
+    for(let at = 1; at < chars.length; at += 1){
+        if (WORD_SEPARATOR.test(chars[at - 1]) && !WORD_SEPARATOR.test(chars[at])) {
+            tails.push(chars.slice(at).join(''));
+        }
+    }
+    return tails;
+};
+/**
+ * The words a site is FOUND by in the Sites list's quick search (AGL-3321):
+ * its name, its platform subdomain and its custom domain, as the word-prefix
+ * tokens `nameSearchTokens` writes, which the list's query asks for with one
+ * `array-contains` on the first typed word (`nameSearchNormalizers.token`).
+ *
+ * A subdomain or a domain is one "word" to `nameSearchTokens`, so the prefixes
+ * of `harbor-bakery` alone would find it by `harbor` and never by `bakery`.
+ * Every tail that begins after a separator is tokenized too, which is what
+ * lets `bakery`, `bakery.com` and `shop.harbor` all find
+ * `shop.harbor-bakery.com` — the words a reader remembers of an address.
+ *
+ * The platform apex is not a word here: it is the same on every site, so it
+ * narrows nothing, and the subdomain in front of it is.
+ *
+ * Its script-side twin, for the backfill and the seeds that write these rows,
+ * is `tools/scripts/lib/host-membership-search-tokens.mjs`; both answer
+ * `tools/scripts/lib/host-membership-search-tokens.fixtures.json`, which this
+ * library's spec asserts too.
+ */ export function hostMembershipSearchTokens(meta) {
+    const words = [
+        meta == null ? void 0 : meta.displayName,
+        meta == null ? void 0 : meta.subdomain,
+        meta == null ? void 0 : meta.cname
+    ].map((value)=>nameSearchKey(typeof value === 'string' ? value : '')).flatMap((key)=>key ? key.split(' ') : []).flatMap(wordTails);
+    return nameSearchTokens(words.join(' '));
+}
+/**
+ * Whether a site has a custom domain connected, as the Sites card lists it:
+ * a non-blank `cname`, which only the domain attach route writes and only the
+ * detach route removes.
+ */ export const hasCustomDomain = (meta)=>typeof (meta == null ? void 0 : meta.cname) === 'string' && meta.cname.trim() !== '';
+/** A Firestore timestamp, as opposed to a legacy number or string. */ const isTimestamp = (value)=>typeof (value == null ? void 0 : value.toMillis) === 'function';
 /**
  * Shape one projection row. Exported for tests: the favicon rule below is a
  * delete-vs-omit decision that is invisible in review and silent in
@@ -82,6 +158,18 @@ const membershipRef = (db, uid, hostId)=>db.collection('users').doc(uid).collect
     } : {}, {
         displayName,
         nameLower: nameSearchKey(displayName),
+        // What the Sites list searches (AGL-3321). Re-derived on every sync, so a
+        // rename, a domain attach or a domain release moves it with the host.
+        searchTokens: hostMembershipSearchTokens(meta),
+        // The Custom domain filter (AGL-3321): an equality, which every order the
+        // list takes can carry. Stored as `false`, never left out, because a query
+        // cannot find a document by a field it lacks.
+        hasCustomDomain: hasCustomDomain(meta),
+        // What the Sites list's Created filter and order read. NULL rather than
+        // absent for a site that never recorded one: `orderBy('createdAt')` drops
+        // a document MISSING the field, and a site must not vanish from the list
+        // because it is sorted by a date it does not have.
+        createdAt: isTimestamp(meta == null ? void 0 : meta.createdAt) ? meta == null ? void 0 : meta.createdAt : null,
         // DELETE rather than omit when the site has no favicon (AGL-1071). These
         // rows are written with `{ merge: true }`, so omitting the key leaves
         // whatever was there — clearing a favicon would keep showing the old one

package/src/lib/server/host-memberships.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/host-memberships.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Per-user host membership projection (AGL-844): a reverse index at\n * `users/{uid}/hostMemberships/{hostId}` mirroring `hosts/{hostId}.memberRoles`\n * — the hosts a user can reach in an org, denormalized with the name so the\n * site switcher and subdomain→id routing can query + order + name-prefix-search\n * a user's own sites without loading the whole `hosts` collection (which the\n * rules can only serve unordered under a per-user `memberRoles.{uid}` filter).\n *\n * Because it lives under the user's own doc it is owner-readable and already\n * membership-filtered, so `where(orgId==…) orderBy(nameLower|updatedAt)` is a\n * plain composite index (no dynamic map path). Admin-SDK-written only.\n *\n * It is a best-effort convenience index, NOT an authorization source: real\n * access stays gated by `hosts/{hostId}.memberRoles` in the rules, so a stale\n * row at worst shows a site that then 404s on read — never grants access.\n *\n * Writers are scoped, mirroring the `users/{uid}/orgs` reverse index: a member\n * change re-syncs THAT member across the org's hosts; a host change re-syncs\n * THAT host across members. Kept in sync at the same points as `memberRoles`\n * (see `syncHostMemberRoles` callers) plus the erase/displayName gaps (AGL-855).\n */\n\nimport {\n  hostRoleFor,\n  isOrgWideMember,\n  nameSearchKey,\n  type AglynOrganization,\n  type AglynOrgMember,\n} from '@aglyn/aglyn/server'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport firebaseAdmin from './firebase-admin'\n\nconst firestore = () => firebaseAdmin.app().firestore()\n\n/** Firestore caps a batch at 500 writes; commit in chunks below that. */\nconst CHUNK = 400\n\ninterface HostMeta {\n  displayName?: string\n  subdomain?: string\n  favicon?: string\n}\n\nconst orgHostIds = async (\n  db: FirebaseFirestore.Firestore,\n  orgId: string,\n): Promise<string[]> => {\n  const org = (await db.collection('orgs').doc(orgId).get()).data() as\n    | AglynOrganization\n    | undefined\n  return Object.keys(org?.hosts ?? {})\n}\n\nconst readHostMeta = async (\n  db: FirebaseFirestore.Firestore,\n  hostIds: string[],\n): Promise<Map<string, HostMeta>> => {\n  if (hostIds.length === 0) return new Map()\n  const snaps = await db.getAll(\n    ...hostIds.map((id) => db.collection('hosts').doc(id)),\n  )\n  return new Map(\n    snaps.map((snap) => [\n      snap.id,\n      {\n        displayName: snap.get('displayName'),\n        subdomain: snap.get('subdomain'),\n        // The switcher renders from the projection, not the host doc, so the\n        // favicon has to travel with it (AGL-1071).\n        favicon: snap.get('seo')?.favicon,\n      },\n    ]),\n  )\n}\n\nconst listMembers = async (\n  db: FirebaseFirestore.Firestore,\n  orgId: string,\n): Promise<AglynOrgMember[]> => {\n  const snap = await db\n    .collection('orgs')\n    .doc(orgId)\n    .collection('members')\n    .get()\n  return snap.docs.map((d) => ({ $id: d.id, ...d.data() }) as AglynOrgMember)\n}\n\nconst membershipRef = (\n  db: FirebaseFirestore.Firestore,\n  uid: string,\n  hostId: string,\n) => db.collection('users').doc(uid).collection('hostMemberships').doc(hostId)\n\n/**\n * Shape one projection row. Exported for tests: the favicon rule below is a\n * delete-vs-omit decision that is invisible in review and silent in\n * production when wrong (AGL-1071).\n */\nexport const membershipRow = (\n  orgId: string,\n  meta: HostMeta | undefined,\n  role: string,\n) => {\n  const displayName = meta?.displayName ?? ''\n  return {\n    orgId,\n    ...(meta?.subdomain ? { subdomain: meta.subdomain } : {}),\n    displayName,\n    nameLower: nameSearchKey(displayName),\n    // DELETE rather than omit when the site has no favicon (AGL-1071). These\n    // rows are written with `{ merge: true }`, so omitting the key leaves\n    // whatever was there — clearing a favicon would keep showing the old one\n    // in the switcher until something unrelated rewrote the row. The clear\n    // path writes `seo.favicon: ''`, so test truthiness, not nullishness.\n    favicon: meta?.favicon ? meta.favicon : FieldValue.delete(),\n    role,\n    updatedAt: FieldValue.serverTimestamp(),\n  }\n}\n\n/** Runs a set of write operations in ≤CHUNK-sized batches. */\nconst commitChunked = async (\n  db: FirebaseFirestore.Firestore,\n  ops: Array<(batch: FirebaseFirestore.WriteBatch) => void>,\n): Promise<void> => {\n  for (let i = 0; i < ops.length; i += CHUNK) {\n    const batch = db.batch()\n    for (const op of ops.slice(i, i + CHUNK)) op(batch)\n    await batch.commit()\n  }\n}\n\n/**\n * Mirror the member's org-wide reach onto their `users/{uid}/orgs/{orgId}`\n * row (AGL-1032), so the console can tell a site collaborator from an\n * org-wide viewer without a second read on every org route.\n *\n * Rides the projection pass rather than being a call the membership APIs\n * each have to remember: every path that changes a member's reach — add,\n * role change, grant, revoke, ownership transfer — already re-syncs their\n * host rows, so one funnel keeps the mirror true and self-heals a row an\n * earlier failure left stale.\n *\n * Only ever UPDATES an existing row. The reverse index is created with the\n * membership and deleted with it; a `set`/merge here on a removed member\n * would resurrect a half-row with no `orgName` or `slug`, and the console\n * renders that as a nameless workspace nobody can open.\n */\nasync function syncMemberOrgReach(\n  db: FirebaseFirestore.Firestore,\n  orgId: string,\n  uid: string,\n  member: AglynOrgMember | null,\n): Promise<void> {\n  if (!member) return\n  const ref = db.collection('users').doc(uid).collection('orgs').doc(orgId)\n  const snap = await ref.get()\n  if (!snap.exists) return\n  const orgWide = isOrgWideMember(member)\n  if (snap.get('orgWide') === orgWide) return\n  await ref.set({ orgWide }, { merge: true })\n}\n\n/**\n * Re-sync ONE member's projection rows across all the org's hosts: set a row\n * for every host the member can reach, delete the row for every host they\n * cannot (a role downgrade silently drops hosts). Call after any change to a\n * single member (add / role change / grant / revoke / ownership step).\n */\nexport async function syncMemberHostProjections(\n  orgId: string,\n  uid: string,\n): Promise<void> {\n  const db = firestore()\n  const [memberSnap, hostIds] = await Promise.all([\n    db.collection('orgs').doc(orgId).collection('members').doc(uid).get(),\n    orgHostIds(db, orgId),\n  ])\n  const member = memberSnap.exists\n    ? ({ $id: uid, ...memberSnap.data() } as AglynOrgMember)\n    : null\n  await syncMemberOrgReach(db, orgId, uid, member)\n  const meta = await readHostMeta(db, hostIds)\n  const ops = hostIds.map((hostId) => (batch: FirebaseFirestore.WriteBatch) => {\n    const role = hostRoleFor(member, hostId)\n    const ref = membershipRef(db, uid, hostId)\n    if (role) batch.set(ref, membershipRow(orgId, meta.get(hostId), role), { merge: true })\n    else batch.delete(ref)\n  })\n  await commitChunked(db, ops)\n}\n\n/**\n * Re-sync ONE host's projection rows across all org members: set a row for\n * every member who can reach it, delete for those who cannot. Call after a\n * host is created, renamed, or its displayName changes.\n */\nexport async function syncHostProjectionForMembers(\n  orgId: string,\n  hostId: string,\n): Promise<void> {\n  const db = firestore()\n  const [members, meta] = await Promise.all([\n    listMembers(db, orgId),\n    readHostMeta(db, [hostId]),\n  ])\n  const hostMeta = meta.get(hostId)\n  const ops = members.map((member) => (batch: FirebaseFirestore.WriteBatch) => {\n    const role = hostRoleFor(member, hostId)\n    const ref = membershipRef(db, member.$id, hostId)\n    if (role) batch.set(ref, membershipRow(orgId, hostMeta, role), { merge: true })\n    else batch.delete(ref)\n  })\n  await commitChunked(db, ops)\n}\n\n/** Delete every projection row for a member across the org's hosts (member removed). */\nexport async function deleteMemberHostProjections(\n  orgId: string,\n  uid: string,\n): Promise<void> {\n  const db = firestore()\n  const hostIds = await orgHostIds(db, orgId)\n  await commitChunked(\n    db,\n    hostIds.map((hostId) => (batch: FirebaseFirestore.WriteBatch) => {\n      batch.delete(membershipRef(db, uid, hostId))\n    }),\n  )\n}\n\n/** Delete every member's projection row for one host (host erased). */\nexport async function deleteHostProjectionForAllMembers(\n  orgId: string,\n  hostId: string,\n): Promise<void> {\n  const db = firestore()\n  const members = await listMembers(db, orgId)\n  await commitChunked(\n    db,\n    members.map((member) => (batch: FirebaseFirestore.WriteBatch) => {\n      batch.delete(membershipRef(db, member.$id, hostId))\n    }),\n  )\n}\n"],"names":["hostRoleFor","isOrgWideMember","nameSearchKey","FieldValue","firebaseAdmin","firestore","app","CHUNK","orgHostIds","db","orgId","org","collection","doc","get","data","Object","keys","hosts","readHostMeta","hostIds","length","Map","snaps","getAll","map","id","snap","displayName","subdomain","favicon","listMembers","docs","d","$id","membershipRef","uid","hostId","membershipRow","meta","role","nameLower","delete","updatedAt","serverTimestamp","commitChunked","ops","i","batch","op","slice","commit","syncMemberOrgReach","member","ref","exists","orgWide","set","merge","syncMemberHostProjections","memberSnap","Promise","all","syncHostProjectionForMembers","members","hostMeta","deleteMemberHostProjections","deleteHostProjectionForAllMembers"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;CAoBC,GAED,SACEA,WAAW,EACXC,eAAe,EACfC,aAAa,QAGR,sBAAqB;AAC5B,SAASC,UAAU,QAAQ,2BAA0B;AACrD,OAAOC,mBAAmB,sBAAkB;AAE5C,MAAMC,YAAY,IAAMD,cAAcE,GAAG,GAAGD,SAAS;AAErD,uEAAuE,GACvE,MAAME,QAAQ;AAQd,MAAMC,aAAa,OACjBC,IACAC;;IAEA,MAAMC,MAAM,AAAC,CAAA,MAAMF,GAAGG,UAAU,CAAC,QAAQC,GAAG,CAACH,OAAOI,GAAG,EAAC,EAAGC,IAAI;IAG/D,OAAOC,OAAOC,IAAI,SAACN,uBAAAA,IAAKO,KAAK,mBAAI,CAAC;AACpC;AAEA,MAAMC,eAAe,OACnBV,IACAW;IAEA,IAAIA,QAAQC,MAAM,KAAK,GAAG,OAAO,IAAIC;IACrC,MAAMC,QAAQ,MAAMd,GAAGe,MAAM,IACxBJ,QAAQK,GAAG,CAAC,CAACC,KAAOjB,GAAGG,UAAU,CAAC,SAASC,GAAG,CAACa;IAEpD,OAAO,IAAIJ,IACTC,MAAME,GAAG,CAAC,CAACE;YAOEA;eAPO;YAClBA,KAAKD,EAAE;YACP;gBACEE,aAAaD,KAAKb,GAAG,CAAC;gBACtBe,WAAWF,KAAKb,GAAG,CAAC;gBACpB,qEAAqE;gBACrE,4CAA4C;gBAC5CgB,OAAO,GAAEH,YAAAA,KAAKb,GAAG,CAAC,2BAATa,UAAiBG,OAAO;YACnC;SACD;;AAEL;AAEA,MAAMC,cAAc,OAClBtB,IACAC;IAEA,MAAMiB,OAAO,MAAMlB,GAChBG,UAAU,CAAC,QACXC,GAAG,CAACH,OACJE,UAAU,CAAC,WACXE,GAAG;IACN,OAAOa,KAAKK,IAAI,CAACP,GAAG,CAAC,CAACQ,IAAO;YAAEC,KAAKD,EAAEP,EAAE;WAAKO,EAAElB,IAAI;AACrD;AAEA,MAAMoB,gBAAgB,CACpB1B,IACA2B,KACAC,SACG5B,GAAGG,UAAU,CAAC,SAASC,GAAG,CAACuB,KAAKxB,UAAU,CAAC,mBAAmBC,GAAG,CAACwB;AAEvE;;;;CAIC,GACD,OAAO,MAAMC,gBAAgB,CAC3B5B,OACA6B,MACAC;;IAEA,MAAMZ,sBAAcW,wBAAAA,KAAMX,WAAW,mBAAI;IACzC,OAAO;QACLlB;OACI6B,CAAAA,wBAAAA,KAAMV,SAAS,IAAG;QAAEA,WAAWU,KAAKV,SAAS;IAAC,IAAI,CAAC;QACvDD;QACAa,WAAWvC,cAAc0B;QACzB,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtEE,SAASS,CAAAA,wBAAAA,KAAMT,OAAO,IAAGS,KAAKT,OAAO,GAAG3B,WAAWuC,MAAM;QACzDF;QACAG,WAAWxC,WAAWyC,eAAe;;AAEzC,EAAC;AAED,4DAA4D,GAC5D,MAAMC,gBAAgB,OACpBpC,IACAqC;IAEA,IAAK,IAAIC,IAAI,GAAGA,IAAID,IAAIzB,MAAM,EAAE0B,KAAKxC,MAAO;QAC1C,MAAMyC,QAAQvC,GAAGuC,KAAK;QACtB,KAAK,MAAMC,MAAMH,IAAII,KAAK,CAACH,GAAGA,IAAIxC,OAAQ0C,GAAGD;QAC7C,MAAMA,MAAMG,MAAM;IACpB;AACF;AAEA;;;;;;;;;;;;;;;CAeC,GACD,eAAeC,mBACb3C,EAA+B,EAC/BC,KAAa,EACb0B,GAAW,EACXiB,MAA6B;IAE7B,IAAI,CAACA,QAAQ;IACb,MAAMC,MAAM7C,GAAGG,UAAU,CAAC,SAASC,GAAG,CAACuB,KAAKxB,UAAU,CAAC,QAAQC,GAAG,CAACH;IACnE,MAAMiB,OAAO,MAAM2B,IAAIxC,GAAG;IAC1B,IAAI,CAACa,KAAK4B,MAAM,EAAE;IAClB,MAAMC,UAAUvD,gBAAgBoD;IAChC,IAAI1B,KAAKb,GAAG,CAAC,eAAe0C,SAAS;IACrC,MAAMF,IAAIG,GAAG,CAAC;QAAED;IAAQ,GAAG;QAAEE,OAAO;IAAK;AAC3C;AAEA;;;;;CAKC,GACD,OAAO,eAAeC,0BACpBjD,KAAa,EACb0B,GAAW;IAEX,MAAM3B,KAAKJ;IACX,MAAM,CAACuD,YAAYxC,QAAQ,GAAG,MAAMyC,QAAQC,GAAG,CAAC;QAC9CrD,GAAGG,UAAU,CAAC,QAAQC,GAAG,CAACH,OAAOE,UAAU,CAAC,WAAWC,GAAG,CAACuB,KAAKtB,GAAG;QACnEN,WAAWC,IAAIC;KAChB;IACD,MAAM2C,SAASO,WAAWL,MAAM,GAC3B;QAAErB,KAAKE;OAAQwB,WAAW7C,IAAI,MAC/B;IACJ,MAAMqC,mBAAmB3C,IAAIC,OAAO0B,KAAKiB;IACzC,MAAMd,OAAO,MAAMpB,aAAaV,IAAIW;IACpC,MAAM0B,MAAM1B,QAAQK,GAAG,CAAC,CAACY,SAAW,CAACW;YACnC,MAAMR,OAAOxC,YAAYqD,QAAQhB;YACjC,MAAMiB,MAAMnB,cAAc1B,IAAI2B,KAAKC;YACnC,IAAIG,MAAMQ,MAAMS,GAAG,CAACH,KAAKhB,cAAc5B,OAAO6B,KAAKzB,GAAG,CAACuB,SAASG,OAAO;gBAAEkB,OAAO;YAAK;iBAChFV,MAAMN,MAAM,CAACY;QACpB;IACA,MAAMT,cAAcpC,IAAIqC;AAC1B;AAEA;;;;CAIC,GACD,OAAO,eAAeiB,6BACpBrD,KAAa,EACb2B,MAAc;IAEd,MAAM5B,KAAKJ;IACX,MAAM,CAAC2D,SAASzB,KAAK,GAAG,MAAMsB,QAAQC,GAAG,CAAC;QACxC/B,YAAYtB,IAAIC;QAChBS,aAAaV,IAAI;YAAC4B;SAAO;KAC1B;IACD,MAAM4B,WAAW1B,KAAKzB,GAAG,CAACuB;IAC1B,MAAMS,MAAMkB,QAAQvC,GAAG,CAAC,CAAC4B,SAAW,CAACL;YACnC,MAAMR,OAAOxC,YAAYqD,QAAQhB;YACjC,MAAMiB,MAAMnB,cAAc1B,IAAI4C,OAAOnB,GAAG,EAAEG;YAC1C,IAAIG,MAAMQ,MAAMS,GAAG,CAACH,KAAKhB,cAAc5B,OAAOuD,UAAUzB,OAAO;gBAAEkB,OAAO;YAAK;iBACxEV,MAAMN,MAAM,CAACY;QACpB;IACA,MAAMT,cAAcpC,IAAIqC;AAC1B;AAEA,sFAAsF,GACtF,OAAO,eAAeoB,4BACpBxD,KAAa,EACb0B,GAAW;IAEX,MAAM3B,KAAKJ;IACX,MAAMe,UAAU,MAAMZ,WAAWC,IAAIC;IACrC,MAAMmC,cACJpC,IACAW,QAAQK,GAAG,CAAC,CAACY,SAAW,CAACW;YACvBA,MAAMN,MAAM,CAACP,cAAc1B,IAAI2B,KAAKC;QACtC;AAEJ;AAEA,qEAAqE,GACrE,OAAO,eAAe8B,kCACpBzD,KAAa,EACb2B,MAAc;IAEd,MAAM5B,KAAKJ;IACX,MAAM2D,UAAU,MAAMjC,YAAYtB,IAAIC;IACtC,MAAMmC,cACJpC,IACAuD,QAAQvC,GAAG,CAAC,CAAC4B,SAAW,CAACL;YACvBA,MAAMN,MAAM,CAACP,cAAc1B,IAAI4C,OAAOnB,GAAG,EAAEG;QAC7C;AAEJ"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/host-memberships.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Per-user host membership projection (AGL-844): a reverse index at\n * `users/{uid}/hostMemberships/{hostId}` mirroring `hosts/{hostId}.memberRoles`\n * — the hosts a user can reach in an org, denormalized with the name so the\n * site switcher and subdomain→id routing can query + order + name-prefix-search\n * a user's own sites without loading the whole `hosts` collection (which the\n * rules can only serve unordered under a per-user `memberRoles.{uid}` filter).\n *\n * Because it lives under the user's own doc it is owner-readable and already\n * membership-filtered, so `where(orgId==…) orderBy(nameLower|updatedAt)` is a\n * plain composite index (no dynamic map path). Admin-SDK-written only.\n *\n * It is a best-effort convenience index, NOT an authorization source: real\n * access stays gated by `hosts/{hostId}.memberRoles` in the rules, so a stale\n * row at worst shows a site that then 404s on read — never grants access.\n *\n * Writers are scoped, mirroring the `users/{uid}/orgs` reverse index: a member\n * change re-syncs THAT member across the org's hosts; a host change re-syncs\n * THAT host across members. Kept in sync at the same points as `memberRoles`\n * (see `syncHostMemberRoles` callers) plus the erase/displayName gaps (AGL-855).\n *\n * ## The Sites list is a query over these rows (AGL-3321)\n *\n * The organization's Sites list pages, filters and searches THIS collection —\n * `where(orgId ==)`, plus the reader's clauses, ordered by `nameLower` or\n * `createdAt` — and joins each row to the host document by id for display.\n * It cannot query `hosts` itself: the rules serve a non-staff LIST of `hosts`\n * only under a `memberRoles.{uid}` clause, a composite on that per-user map\n * path can exist for no order but the document id, and a predicated listen\n * over the mutable `memberRoles`/`orgId` is what tombstoned host documents\n * for every other reader (AGL-1190, `useOrgHosts`).\n *\n * So a row carries what that list asks of a site: `searchTokens` (the quick\n * search, over the name, the platform subdomain and the custom domain),\n * `hasCustomDomain` (the Custom domain filter) and the host's `createdAt`\n * (immutable, set once at create). Every field is derived from the host\n * document in `membershipRow`, so a re-sync from any writer re-derives all of\n * them; the writers of their source fields — create, the owner and staff\n * renames, the Setup name save, and the domain attach and detach routes (the\n * only writers of `cname`) — each re-sync. Rows written before AGL-3321 are\n * stamped by `tools/scripts/backfill-host-memberships-list-fields.mjs`.\n */\n\nimport {\n  hostRoleFor,\n  isOrgWideMember,\n  nameSearchKey,\n  type AglynOrganization,\n  type AglynOrgMember,\n} from '@aglyn/aglyn/server'\nimport { nameSearchTokens } from '@aglyn/aglyn/app-utils/name-search'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport firebaseAdmin from './firebase-admin'\n\nconst firestore = () => firebaseAdmin.app().firestore()\n\n/** Firestore caps a batch at 500 writes; commit in chunks below that. */\nconst CHUNK = 400\n\ninterface HostMeta {\n  displayName?: string\n  subdomain?: string\n  favicon?: string\n  /** The custom domain, which the Sites list's search finds a site by. */\n  cname?: string\n  /** When the site was created: set once, by `claimHostForOrg`, and never moved. */\n  createdAt?: unknown\n}\n\nconst orgHostIds = async (\n  db: FirebaseFirestore.Firestore,\n  orgId: string,\n): Promise<string[]> => {\n  const org = (await db.collection('orgs').doc(orgId).get()).data() as\n    | AglynOrganization\n    | undefined\n  return Object.keys(org?.hosts ?? {})\n}\n\nconst readHostMeta = async (\n  db: FirebaseFirestore.Firestore,\n  hostIds: string[],\n): Promise<Map<string, HostMeta>> => {\n  if (hostIds.length === 0) return new Map()\n  const snaps = await db.getAll(\n    ...hostIds.map((id) => db.collection('hosts').doc(id)),\n  )\n  return new Map(\n    snaps.map((snap) => [\n      snap.id,\n      {\n        displayName: snap.get('displayName'),\n        subdomain: snap.get('subdomain'),\n        // The switcher renders from the projection, not the host doc, so the\n        // favicon has to travel with it (AGL-1071).\n        favicon: snap.get('seo')?.favicon,\n        cname: snap.get('cname'),\n        createdAt: snap.get('createdAt'),\n      },\n    ]),\n  )\n}\n\nconst listMembers = async (\n  db: FirebaseFirestore.Firestore,\n  orgId: string,\n): Promise<AglynOrgMember[]> => {\n  const snap = await db\n    .collection('orgs')\n    .doc(orgId)\n    .collection('members')\n    .get()\n  return snap.docs.map((d) => ({ $id: d.id, ...d.data() }) as AglynOrgMember)\n}\n\nconst membershipRef = (\n  db: FirebaseFirestore.Firestore,\n  uid: string,\n  hostId: string,\n) => db.collection('users').doc(uid).collection('hostMemberships').doc(hostId)\n\n/** A tail of a word begins after any character that is not a letter or a digit. */\nconst WORD_SEPARATOR = /[^\\p{L}\\p{N}]/u\n\n/**\n * A word, and every tail of it that begins after a separator:\n * `shop.harbor-bakery.com` is itself, `harbor-bakery.com`, `bakery.com` and\n * `com`. Walked by codepoint, so a tail never starts inside a surrogate pair.\n */\nconst wordTails = (word: string): string[] => {\n  const chars = [...word]\n  const tails = [word]\n  for (let at = 1; at < chars.length; at += 1) {\n    if (WORD_SEPARATOR.test(chars[at - 1]) && !WORD_SEPARATOR.test(chars[at])) {\n      tails.push(chars.slice(at).join(''))\n    }\n  }\n  return tails\n}\n\n/**\n * The words a site is FOUND by in the Sites list's quick search (AGL-3321):\n * its name, its platform subdomain and its custom domain, as the word-prefix\n * tokens `nameSearchTokens` writes, which the list's query asks for with one\n * `array-contains` on the first typed word (`nameSearchNormalizers.token`).\n *\n * A subdomain or a domain is one \"word\" to `nameSearchTokens`, so the prefixes\n * of `harbor-bakery` alone would find it by `harbor` and never by `bakery`.\n * Every tail that begins after a separator is tokenized too, which is what\n * lets `bakery`, `bakery.com` and `shop.harbor` all find\n * `shop.harbor-bakery.com` — the words a reader remembers of an address.\n *\n * The platform apex is not a word here: it is the same on every site, so it\n * narrows nothing, and the subdomain in front of it is.\n *\n * Its script-side twin, for the backfill and the seeds that write these rows,\n * is `tools/scripts/lib/host-membership-search-tokens.mjs`; both answer\n * `tools/scripts/lib/host-membership-search-tokens.fixtures.json`, which this\n * library's spec asserts too.\n */\nexport function hostMembershipSearchTokens(\n  meta: Pick<HostMeta, 'displayName' | 'subdomain' | 'cname'> | undefined,\n): string[] {\n  const words = [meta?.displayName, meta?.subdomain, meta?.cname]\n    .map((value) => nameSearchKey(typeof value === 'string' ? value : ''))\n    .flatMap((key) => (key ? key.split(' ') : []))\n    .flatMap(wordTails)\n  return nameSearchTokens(words.join(' '))\n}\n\n/**\n * Whether a site has a custom domain connected, as the Sites card lists it:\n * a non-blank `cname`, which only the domain attach route writes and only the\n * detach route removes.\n */\nexport const hasCustomDomain = (meta: Pick<HostMeta, 'cname'> | undefined): boolean =>\n  typeof meta?.cname === 'string' && meta.cname.trim() !== ''\n\n/** A Firestore timestamp, as opposed to a legacy number or string. */\nconst isTimestamp = (value: unknown): boolean =>\n  typeof (value as { toMillis?: unknown } | null | undefined)?.toMillis === 'function'\n\n/**\n * Shape one projection row. Exported for tests: the favicon rule below is a\n * delete-vs-omit decision that is invisible in review and silent in\n * production when wrong (AGL-1071).\n */\nexport const membershipRow = (\n  orgId: string,\n  meta: HostMeta | undefined,\n  role: string,\n) => {\n  const displayName = meta?.displayName ?? ''\n  return {\n    orgId,\n    ...(meta?.subdomain ? { subdomain: meta.subdomain } : {}),\n    displayName,\n    nameLower: nameSearchKey(displayName),\n    // What the Sites list searches (AGL-3321). Re-derived on every sync, so a\n    // rename, a domain attach or a domain release moves it with the host.\n    searchTokens: hostMembershipSearchTokens(meta),\n    // The Custom domain filter (AGL-3321): an equality, which every order the\n    // list takes can carry. Stored as `false`, never left out, because a query\n    // cannot find a document by a field it lacks.\n    hasCustomDomain: hasCustomDomain(meta),\n    // What the Sites list's Created filter and order read. NULL rather than\n    // absent for a site that never recorded one: `orderBy('createdAt')` drops\n    // a document MISSING the field, and a site must not vanish from the list\n    // because it is sorted by a date it does not have.\n    createdAt: isTimestamp(meta?.createdAt) ? meta?.createdAt : null,\n    // DELETE rather than omit when the site has no favicon (AGL-1071). These\n    // rows are written with `{ merge: true }`, so omitting the key leaves\n    // whatever was there — clearing a favicon would keep showing the old one\n    // in the switcher until something unrelated rewrote the row. The clear\n    // path writes `seo.favicon: ''`, so test truthiness, not nullishness.\n    favicon: meta?.favicon ? meta.favicon : FieldValue.delete(),\n    role,\n    updatedAt: FieldValue.serverTimestamp(),\n  }\n}\n\n/** Runs a set of write operations in ≤CHUNK-sized batches. */\nconst commitChunked = async (\n  db: FirebaseFirestore.Firestore,\n  ops: Array<(batch: FirebaseFirestore.WriteBatch) => void>,\n): Promise<void> => {\n  for (let i = 0; i < ops.length; i += CHUNK) {\n    const batch = db.batch()\n    for (const op of ops.slice(i, i + CHUNK)) op(batch)\n    await batch.commit()\n  }\n}\n\n/**\n * Mirror the member's org-wide reach onto their `users/{uid}/orgs/{orgId}`\n * row (AGL-1032), so the console can tell a site collaborator from an\n * org-wide viewer without a second read on every org route.\n *\n * Rides the projection pass rather than being a call the membership APIs\n * each have to remember: every path that changes a member's reach — add,\n * role change, grant, revoke, ownership transfer — already re-syncs their\n * host rows, so one funnel keeps the mirror true and self-heals a row an\n * earlier failure left stale.\n *\n * Only ever UPDATES an existing row. The reverse index is created with the\n * membership and deleted with it; a `set`/merge here on a removed member\n * would resurrect a half-row with no `orgName` or `slug`, and the console\n * renders that as a nameless workspace nobody can open.\n */\nasync function syncMemberOrgReach(\n  db: FirebaseFirestore.Firestore,\n  orgId: string,\n  uid: string,\n  member: AglynOrgMember | null,\n): Promise<void> {\n  if (!member) return\n  const ref = db.collection('users').doc(uid).collection('orgs').doc(orgId)\n  const snap = await ref.get()\n  if (!snap.exists) return\n  const orgWide = isOrgWideMember(member)\n  if (snap.get('orgWide') === orgWide) return\n  await ref.set({ orgWide }, { merge: true })\n}\n\n/**\n * Re-sync ONE member's projection rows across all the org's hosts: set a row\n * for every host the member can reach, delete the row for every host they\n * cannot (a role downgrade silently drops hosts). Call after any change to a\n * single member (add / role change / grant / revoke / ownership step).\n */\nexport async function syncMemberHostProjections(\n  orgId: string,\n  uid: string,\n): Promise<void> {\n  const db = firestore()\n  const [memberSnap, hostIds] = await Promise.all([\n    db.collection('orgs').doc(orgId).collection('members').doc(uid).get(),\n    orgHostIds(db, orgId),\n  ])\n  const member = memberSnap.exists\n    ? ({ $id: uid, ...memberSnap.data() } as AglynOrgMember)\n    : null\n  await syncMemberOrgReach(db, orgId, uid, member)\n  const meta = await readHostMeta(db, hostIds)\n  const ops = hostIds.map((hostId) => (batch: FirebaseFirestore.WriteBatch) => {\n    const role = hostRoleFor(member, hostId)\n    const ref = membershipRef(db, uid, hostId)\n    if (role) batch.set(ref, membershipRow(orgId, meta.get(hostId), role), { merge: true })\n    else batch.delete(ref)\n  })\n  await commitChunked(db, ops)\n}\n\n/**\n * Re-sync ONE host's projection rows across all org members: set a row for\n * every member who can reach it, delete for those who cannot. Call after a\n * host is created, renamed, or its displayName changes.\n */\nexport async function syncHostProjectionForMembers(\n  orgId: string,\n  hostId: string,\n): Promise<void> {\n  const db = firestore()\n  const [members, meta] = await Promise.all([\n    listMembers(db, orgId),\n    readHostMeta(db, [hostId]),\n  ])\n  const hostMeta = meta.get(hostId)\n  const ops = members.map((member) => (batch: FirebaseFirestore.WriteBatch) => {\n    const role = hostRoleFor(member, hostId)\n    const ref = membershipRef(db, member.$id, hostId)\n    if (role) batch.set(ref, membershipRow(orgId, hostMeta, role), { merge: true })\n    else batch.delete(ref)\n  })\n  await commitChunked(db, ops)\n}\n\n/** Delete every projection row for a member across the org's hosts (member removed). */\nexport async function deleteMemberHostProjections(\n  orgId: string,\n  uid: string,\n): Promise<void> {\n  const db = firestore()\n  const hostIds = await orgHostIds(db, orgId)\n  await commitChunked(\n    db,\n    hostIds.map((hostId) => (batch: FirebaseFirestore.WriteBatch) => {\n      batch.delete(membershipRef(db, uid, hostId))\n    }),\n  )\n}\n\n/** Delete every member's projection row for one host (host erased). */\nexport async function deleteHostProjectionForAllMembers(\n  orgId: string,\n  hostId: string,\n): Promise<void> {\n  const db = firestore()\n  const members = await listMembers(db, orgId)\n  await commitChunked(\n    db,\n    members.map((member) => (batch: FirebaseFirestore.WriteBatch) => {\n      batch.delete(membershipRef(db, member.$id, hostId))\n    }),\n  )\n}\n"],"names":["hostRoleFor","isOrgWideMember","nameSearchKey","nameSearchTokens","FieldValue","firebaseAdmin","firestore","app","CHUNK","orgHostIds","db","orgId","org","collection","doc","get","data","Object","keys","hosts","readHostMeta","hostIds","length","Map","snaps","getAll","map","id","snap","displayName","subdomain","favicon","cname","createdAt","listMembers","docs","d","$id","membershipRef","uid","hostId","WORD_SEPARATOR","wordTails","word","chars","tails","at","test","push","slice","join","hostMembershipSearchTokens","meta","words","value","flatMap","key","split","hasCustomDomain","trim","isTimestamp","toMillis","membershipRow","role","nameLower","searchTokens","delete","updatedAt","serverTimestamp","commitChunked","ops","i","batch","op","commit","syncMemberOrgReach","member","ref","exists","orgWide","set","merge","syncMemberHostProjections","memberSnap","Promise","all","syncHostProjectionForMembers","members","hostMeta","deleteMemberHostProjections","deleteHostProjectionForAllMembers"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCC,GAED,SACEA,WAAW,EACXC,eAAe,EACfC,aAAa,QAGR,sBAAqB;AAC5B,SAASC,gBAAgB,QAAQ,qCAAoC;AACrE,SAASC,UAAU,QAAQ,2BAA0B;AACrD,OAAOC,mBAAmB,sBAAkB;AAE5C,MAAMC,YAAY,IAAMD,cAAcE,GAAG,GAAGD,SAAS;AAErD,uEAAuE,GACvE,MAAME,QAAQ;AAYd,MAAMC,aAAa,OACjBC,IACAC;;IAEA,MAAMC,MAAM,AAAC,CAAA,MAAMF,GAAGG,UAAU,CAAC,QAAQC,GAAG,CAACH,OAAOI,GAAG,EAAC,EAAGC,IAAI;IAG/D,OAAOC,OAAOC,IAAI,SAACN,uBAAAA,IAAKO,KAAK,mBAAI,CAAC;AACpC;AAEA,MAAMC,eAAe,OACnBV,IACAW;IAEA,IAAIA,QAAQC,MAAM,KAAK,GAAG,OAAO,IAAIC;IACrC,MAAMC,QAAQ,MAAMd,GAAGe,MAAM,IACxBJ,QAAQK,GAAG,CAAC,CAACC,KAAOjB,GAAGG,UAAU,CAAC,SAASC,GAAG,CAACa;IAEpD,OAAO,IAAIJ,IACTC,MAAME,GAAG,CAAC,CAACE;YAOEA;eAPO;YAClBA,KAAKD,EAAE;YACP;gBACEE,aAAaD,KAAKb,GAAG,CAAC;gBACtBe,WAAWF,KAAKb,GAAG,CAAC;gBACpB,qEAAqE;gBACrE,4CAA4C;gBAC5CgB,OAAO,GAAEH,YAAAA,KAAKb,GAAG,CAAC,2BAATa,UAAiBG,OAAO;gBACjCC,OAAOJ,KAAKb,GAAG,CAAC;gBAChBkB,WAAWL,KAAKb,GAAG,CAAC;YACtB;SACD;;AAEL;AAEA,MAAMmB,cAAc,OAClBxB,IACAC;IAEA,MAAMiB,OAAO,MAAMlB,GAChBG,UAAU,CAAC,QACXC,GAAG,CAACH,OACJE,UAAU,CAAC,WACXE,GAAG;IACN,OAAOa,KAAKO,IAAI,CAACT,GAAG,CAAC,CAACU,IAAO;YAAEC,KAAKD,EAAET,EAAE;WAAKS,EAAEpB,IAAI;AACrD;AAEA,MAAMsB,gBAAgB,CACpB5B,IACA6B,KACAC,SACG9B,GAAGG,UAAU,CAAC,SAASC,GAAG,CAACyB,KAAK1B,UAAU,CAAC,mBAAmBC,GAAG,CAAC0B;AAEvE,iFAAiF,GACjF,MAAMC,iBAAiB;AAEvB;;;;CAIC,GACD,MAAMC,YAAY,CAACC;IACjB,MAAMC,QAAQ;WAAID;KAAK;IACvB,MAAME,QAAQ;QAACF;KAAK;IACpB,IAAK,IAAIG,KAAK,GAAGA,KAAKF,MAAMtB,MAAM,EAAEwB,MAAM,EAAG;QAC3C,IAAIL,eAAeM,IAAI,CAACH,KAAK,CAACE,KAAK,EAAE,KAAK,CAACL,eAAeM,IAAI,CAACH,KAAK,CAACE,GAAG,GAAG;YACzED,MAAMG,IAAI,CAACJ,MAAMK,KAAK,CAACH,IAAII,IAAI,CAAC;QAClC;IACF;IACA,OAAOL;AACT;AAEA;;;;;;;;;;;;;;;;;;;CAmBC,GACD,OAAO,SAASM,2BACdC,IAAuE;IAEvE,MAAMC,QAAQ;QAACD,wBAAAA,KAAMvB,WAAW;QAAEuB,wBAAAA,KAAMtB,SAAS;QAAEsB,wBAAAA,KAAMpB,KAAK;KAAC,CAC5DN,GAAG,CAAC,CAAC4B,QAAUpD,cAAc,OAAOoD,UAAU,WAAWA,QAAQ,KACjEC,OAAO,CAAC,CAACC,MAASA,MAAMA,IAAIC,KAAK,CAAC,OAAO,EAAE,EAC3CF,OAAO,CAACb;IACX,OAAOvC,iBAAiBkD,MAAMH,IAAI,CAAC;AACrC;AAEA;;;;CAIC,GACD,OAAO,MAAMQ,kBAAkB,CAACN,OAC9B,QAAOA,wBAAAA,KAAMpB,KAAK,MAAK,YAAYoB,KAAKpB,KAAK,CAAC2B,IAAI,OAAO,GAAE;AAE7D,oEAAoE,GACpE,MAAMC,cAAc,CAACN,QACnB,QAAQA,yBAAD,AAACA,MAAqDO,QAAQ,MAAK;AAE5E;;;;CAIC,GACD,OAAO,MAAMC,gBAAgB,CAC3BnD,OACAyC,MACAW;;IAEA,MAAMlC,sBAAcuB,wBAAAA,KAAMvB,WAAW,mBAAI;IACzC,OAAO;QACLlB;OACIyC,CAAAA,wBAAAA,KAAMtB,SAAS,IAAG;QAAEA,WAAWsB,KAAKtB,SAAS;IAAC,IAAI,CAAC;QACvDD;QACAmC,WAAW9D,cAAc2B;QACzB,0EAA0E;QAC1E,sEAAsE;QACtEoC,cAAcd,2BAA2BC;QACzC,0EAA0E;QAC1E,2EAA2E;QAC3E,8CAA8C;QAC9CM,iBAAiBA,gBAAgBN;QACjC,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,mDAAmD;QACnDnB,WAAW2B,YAAYR,wBAAAA,KAAMnB,SAAS,IAAImB,wBAAAA,KAAMnB,SAAS,GAAG;QAC5D,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtEF,SAASqB,CAAAA,wBAAAA,KAAMrB,OAAO,IAAGqB,KAAKrB,OAAO,GAAG3B,WAAW8D,MAAM;QACzDH;QACAI,WAAW/D,WAAWgE,eAAe;;AAEzC,EAAC;AAED,4DAA4D,GAC5D,MAAMC,gBAAgB,OACpB3D,IACA4D;IAEA,IAAK,IAAIC,IAAI,GAAGA,IAAID,IAAIhD,MAAM,EAAEiD,KAAK/D,MAAO;QAC1C,MAAMgE,QAAQ9D,GAAG8D,KAAK;QACtB,KAAK,MAAMC,MAAMH,IAAIrB,KAAK,CAACsB,GAAGA,IAAI/D,OAAQiE,GAAGD;QAC7C,MAAMA,MAAME,MAAM;IACpB;AACF;AAEA;;;;;;;;;;;;;;;CAeC,GACD,eAAeC,mBACbjE,EAA+B,EAC/BC,KAAa,EACb4B,GAAW,EACXqC,MAA6B;IAE7B,IAAI,CAACA,QAAQ;IACb,MAAMC,MAAMnE,GAAGG,UAAU,CAAC,SAASC,GAAG,CAACyB,KAAK1B,UAAU,CAAC,QAAQC,GAAG,CAACH;IACnE,MAAMiB,OAAO,MAAMiD,IAAI9D,GAAG;IAC1B,IAAI,CAACa,KAAKkD,MAAM,EAAE;IAClB,MAAMC,UAAU9E,gBAAgB2E;IAChC,IAAIhD,KAAKb,GAAG,CAAC,eAAegE,SAAS;IACrC,MAAMF,IAAIG,GAAG,CAAC;QAAED;IAAQ,GAAG;QAAEE,OAAO;IAAK;AAC3C;AAEA;;;;;CAKC,GACD,OAAO,eAAeC,0BACpBvE,KAAa,EACb4B,GAAW;IAEX,MAAM7B,KAAKJ;IACX,MAAM,CAAC6E,YAAY9D,QAAQ,GAAG,MAAM+D,QAAQC,GAAG,CAAC;QAC9C3E,GAAGG,UAAU,CAAC,QAAQC,GAAG,CAACH,OAAOE,UAAU,CAAC,WAAWC,GAAG,CAACyB,KAAKxB,GAAG;QACnEN,WAAWC,IAAIC;KAChB;IACD,MAAMiE,SAASO,WAAWL,MAAM,GAC3B;QAAEzC,KAAKE;OAAQ4C,WAAWnE,IAAI,MAC/B;IACJ,MAAM2D,mBAAmBjE,IAAIC,OAAO4B,KAAKqC;IACzC,MAAMxB,OAAO,MAAMhC,aAAaV,IAAIW;IACpC,MAAMiD,MAAMjD,QAAQK,GAAG,CAAC,CAACc,SAAW,CAACgC;YACnC,MAAMT,OAAO/D,YAAY4E,QAAQpC;YACjC,MAAMqC,MAAMvC,cAAc5B,IAAI6B,KAAKC;YACnC,IAAIuB,MAAMS,MAAMQ,GAAG,CAACH,KAAKf,cAAcnD,OAAOyC,KAAKrC,GAAG,CAACyB,SAASuB,OAAO;gBAAEkB,OAAO;YAAK;iBAChFT,MAAMN,MAAM,CAACW;QACpB;IACA,MAAMR,cAAc3D,IAAI4D;AAC1B;AAEA;;;;CAIC,GACD,OAAO,eAAegB,6BACpB3E,KAAa,EACb6B,MAAc;IAEd,MAAM9B,KAAKJ;IACX,MAAM,CAACiF,SAASnC,KAAK,GAAG,MAAMgC,QAAQC,GAAG,CAAC;QACxCnD,YAAYxB,IAAIC;QAChBS,aAAaV,IAAI;YAAC8B;SAAO;KAC1B;IACD,MAAMgD,WAAWpC,KAAKrC,GAAG,CAACyB;IAC1B,MAAM8B,MAAMiB,QAAQ7D,GAAG,CAAC,CAACkD,SAAW,CAACJ;YACnC,MAAMT,OAAO/D,YAAY4E,QAAQpC;YACjC,MAAMqC,MAAMvC,cAAc5B,IAAIkE,OAAOvC,GAAG,EAAEG;YAC1C,IAAIuB,MAAMS,MAAMQ,GAAG,CAACH,KAAKf,cAAcnD,OAAO6E,UAAUzB,OAAO;gBAAEkB,OAAO;YAAK;iBACxET,MAAMN,MAAM,CAACW;QACpB;IACA,MAAMR,cAAc3D,IAAI4D;AAC1B;AAEA,sFAAsF,GACtF,OAAO,eAAemB,4BACpB9E,KAAa,EACb4B,GAAW;IAEX,MAAM7B,KAAKJ;IACX,MAAMe,UAAU,MAAMZ,WAAWC,IAAIC;IACrC,MAAM0D,cACJ3D,IACAW,QAAQK,GAAG,CAAC,CAACc,SAAW,CAACgC;YACvBA,MAAMN,MAAM,CAAC5B,cAAc5B,IAAI6B,KAAKC;QACtC;AAEJ;AAEA,qEAAqE,GACrE,OAAO,eAAekD,kCACpB/E,KAAa,EACb6B,MAAc;IAEd,MAAM9B,KAAKJ;IACX,MAAMiF,UAAU,MAAMrD,YAAYxB,IAAIC;IACtC,MAAM0D,cACJ3D,IACA6E,QAAQ7D,GAAG,CAAC,CAACkD,SAAW,CAACJ;YACvBA,MAAMN,MAAM,CAAC5B,cAAc5B,IAAIkE,OAAOvC,GAAG,EAAEG;QAC7C;AAEJ"}

package/src/lib/server/host-visitor-records.js

@@ -28,7 +28,7 @@ import { attributeCampaignConversion } from "./campaign-conversion-attribution.j
 import { notifyHostManagers } from "./notifications.js";
 import firebaseAdmin from "./firebase-admin.js";
 import { consentGroupForSite, orgDataCollectionForHost, scopedToHost } from "./organizations.js";
-import { crmReadTokens, crmScopeTokens } from "@aglyn/aglyn/server";
+import { crmLeadListFields, crmReadTokens, crmScopeTokens } from "@aglyn/aglyn/server";
 // The module path rather than the barrel, as `upsert-contact.ts` does: a spec
 // that substitutes the barrel keeps the real rule for which group a grant is.
 import { consentGroupForGrant } from "@aglyn/aglyn/app-utils/consent-groups";
@@ -298,7 +298,7 @@ const firestore = ()=>firebaseAdmin.app().firestore();
         } : {});
         let created = false;
         const refused = await firestore.runTransaction(async (tx)=>{
-            var _existing_data;
+            var _existing_data, _existing_data1;
             // Reset per attempt: a contended transaction re-runs its body, and a
             // flag left standing from an aborted attempt would credit a campaign
             // with a person who turned out to exist already.
@@ -373,9 +373,29 @@ const firestore = ()=>firebaseAdmin.app().firestore();
        */ const prior = readMarketingBasis((_existing_data = existing.data()) != null ? _existing_data : null, group);
             const consentAtMs = prior.basis === 'granted' && prior.basisAtMs !== null ? prior.basisAtMs : now;
             created = !existing.exists;
+            /*
+       * THE FIELDS THE LEADS LIST QUERIES (AGL-3321), from the lead as it
+       * will stand: what the transaction read, the address and name this
+       * capture brings and the scope it widens. A new lead is written
+       * `status: 'new'`, so the Open view's `status in [new, working]`
+       * finds a lead nobody has touched — an absent field matches no query.
+       */ const stored = (_existing_data1 = existing.data()) != null ? _existing_data1 : {};
+            const storedScope = Array.isArray(stored['visibleTo']) ? stored['visibleTo'] : [];
+            const listFields = crmLeadListFields(_extends({}, stored, {
+                email: lead.email
+            }, lead.name ? {
+                name: lead.name
+            } : {}, {
+                visibleTo: [
+                    ...new Set([
+                        ...storedScope,
+                        ...scope
+                    ])
+                ]
+            }));
             tx.set(leadRef, _extends({
                 email: lead.email
-            }, seen, {
+            }, seen, listFields, {
                 /*
            * WIDENED BY THE CAPTURE, NEVER BY THE LOOKUP (AGL-3275).
            *

package/src/lib/server/host-visitor-records.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/host-visitor-records.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The durable half of the visitor-record ceilings (AGL-1529) — the lead\n * writer that enforces `LEADS_MAX_PER_HOST`, and the bookkeeping that makes a\n * trip of EITHER ceiling something a site's owner can see.\n *\n * The policy is pure and lives in `@aglyn/aglyn/server`\n * (`visitor-record-ceiling.ts`); this is the part that needs Firestore. Same\n * split as `visitorWriteRateLimitRefusal`, and for the same reason.\n */\n\nimport {\n  CAPTURED_BY_HOST_FIELD,\n  checkVisitorRecordCeiling,\n  LEADS_MAX_PER_HOST,\n  marketingConsentFieldsForGroup,\n  personKey,\n  readMarketingBasis,\n  submissionMonthKey,\n  visitorRecordRefusedCounterId,\n  type VisitorRecordKind,\n} from '@aglyn/aglyn/server'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport {\n  attributeCampaignConversion,\n  type ResolvedCampaignTouch,\n} from './campaign-conversion-attribution'\nimport { notifyHostManagers } from './notifications'\nimport firebaseAdmin from './firebase-admin'\nimport {\n  consentGroupForSite,\n  orgDataCollectionForHost,\n  resolveOrgIdForHost,\n  scopedToHost,\n} from './organizations'\nimport { crmReadTokens, crmScopeTokens } from '@aglyn/aglyn/server'\nimport type { ConsentGroup, ScopeToken } from '@aglyn/aglyn/server'\n// The module path rather than the barrel, as `upsert-contact.ts` does: a spec\n// that substitutes the barrel keeps the real rule for which group a grant is.\nimport { consentGroupForGrant } from '@aglyn/aglyn/app-utils/consent-groups'\n\nconst firestore = () => firebaseAdmin.app().firestore()\n\n/**\n * A lead's one home: `orgs/{orgId}/leads/{personKey}` (AGL-3275).\n *\n * ## Why leads moved\n *\n * A lead used to live at `hosts/{hostId}/leads/{personKey}` while the\n * contact for the same human lived on the org with a `visibleTo` array. The\n * path was doing the job `visibleTo` does, and doing it worse:\n *\n * - An AGENCY was isolated by the path. It is isolated by `visibleTo` too,\n *   with no configuration — `consentGroupScope` on a group of one is\n *   `['host:{id}']`.\n * - A MULTI-BRAND org could not be served at all. `personKey` is derived\n *   from the address, so the same person captured on two sibling brands\n *   produced two documents with byte-identical ids under different parents.\n *   One person was two records by construction, which is the thing AGL-3232\n *   had just finished eliminating for contacts.\n * - The two answers could disagree. A person's contact was visible to every\n *   brand in the consent group they actually consented to — the disclosure\n *   names those brands — while their lead was visible to whichever brand's\n *   form they happened to land on. The lead was scoped more narrowly than\n *   what the person was told, which is the safe direction to be wrong in and\n *   still the wrong answer.\n *\n * So a lead is stamped with `crmScopeTokens` and read with `crmReadTokens`,\n * the same pair the contacts surface uses. Nothing here is a new mechanism;\n * this is leads arriving at the one the rest of the CRM already had.\n *\n * ## The fallback is READ-ONLY, and temporary\n *\n * This repo has run this migration once already — AGL-237 moved datasets,\n * contacts and media to the org, AGL-1040 backfilled, AGL-1050 deleted the\n * fallback — and `orgDataCollectionForHost` carries what it learned:\n *\n *   \"a second storage path that can still be WRITTEN is a second boundary to\n *   enforce forever, which undoes the premise of scoped sharing: one home\n *   per resource plus an explicit scope.\"\n *\n * So the host path is never written here. It is read, once, to carry a\n * not-yet-migrated lead onto the org as a side effect of the next write that\n * touches it ({@link leadForWrite}) — which shrinks what AGL-3276's backfill\n * has left to fold, and means no read can be answered by a stale host row\n * after a write has moved on. AGL-3277 deletes the fallback and the rules\n * block behind it once that backfill reports nothing left to plan.\n */\n\n\n/**\n * The org collection a lead is written to. Always the org — see the\n * read-only note above.\n */\nexport async function orgLeadsForHost(\n  hostId: string,\n): Promise<FirebaseFirestore.CollectionReference> {\n  return orgDataCollectionForHost(hostId, 'leads')\n}\n\n/**\n * The leads one site may LIST, narrowed by `visibleTo`.\n *\n * The Admin SDK does not evaluate rules, so an unnarrowed read here would\n * serve one agency client's leads on another's site — the same reason\n * `scopedToHost` exists for every other org-owned collection.\n */\nexport async function orgLeadsQueryForHost(hostId: string): Promise<{\n  ref: FirebaseFirestore.CollectionReference\n  query: FirebaseFirestore.Query\n}> {\n  const ref = await orgLeadsForHost(hostId)\n  return { ref, query: scopedToHost(ref, hostId) }\n}\n\n/**\n * The tokens a reader holding this group may ask `array-contains-any` for.\n * Capped at 30 by `crmReadTokens`, as the contacts list is.\n */\nexport async function leadReadTokensForHost(\n  hostId: string,\n  group?: ConsentGroup,\n): Promise<ScopeToken[]> {\n  return crmReadTokens(group ?? (await consentGroupForSite(hostId)))\n}\n\n/**\n * The `visibleTo` a capture on this site stamps: the consent group's sites,\n * or `['org']` where the org set `defaultResourceScope`.\n *\n * Widened by the capture, never by the lookup — a site that has never\n * captured this person gains nothing by finding them, which is what keeps an\n * agency's clients apart on a record they share. Callers UPDATING an\n * existing lead union these in rather than replacing, exactly as\n * `upsert-contact` does.\n */\nexport async function leadScopeForHost(\n  hostId: string,\n  org?: Record<string, unknown> | null,\n): Promise<ScopeToken[]> {\n  const group = await consentGroupForSite(hostId, org)\n  return crmScopeTokens(org ?? null, group)\n}\n\n/**\n * The lead for an address, wherever it currently lives.\n *\n * ## The lookup is UNSCOPED, and has to be\n *\n * One human who touched two sibling brands is one person. Narrowing this to\n * what the capturing site may already see would let a second submission on a\n * sibling brand mint a SECOND record for the same address — the duplication\n * this migration exists to end, reintroduced one layer up. Recognizing\n * somebody and being allowed to read their row are different acts:\n * this finds the person, {@link leadScopeForHost} decides who may see them.\n *\n * `upsert-contact` states the same rule at its own dedupe lookup, and for the\n * same reason. A caller that wants only what a site may SEE wants\n * {@link orgLeadsQueryForHost}.\n *\n * @returns the org row; else the not-yet-migrated host row; else `null`.\n */\nexport async function readLeadForHost(\n  hostId: string,\n  key: string,\n): Promise<FirebaseFirestore.DocumentSnapshot | null> {\n  const orgRow = await (await orgLeadsForHost(hostId)).doc(key).get()\n  return orgRow.exists ? orgRow : null\n}\n\n/**\n * The ref a write should target.\n *\n * This carried a not-yet-backfilled host row onto the org first, and reported\n * whether it had (`carried`). AGL-3276 emptied the host path and AGL-3277\n * removed it, so there is nothing left to carry: the org row is the only row.\n * `carried` stays on the shape, always `false`, because several callers\n * destructure it and a lie is cheaper to read than a signature change that\n * says nothing.\n */\nexport async function leadForWrite(\n  hostId: string,\n  key: string,\n): Promise<{\n  ref: FirebaseFirestore.DocumentReference\n  existed: boolean\n  carried: boolean\n}> {\n  const ref = (await orgLeadsForHost(hostId)).doc(key)\n  return { ref, existed: (await ref.get()).exists, carried: false }\n}\n\n\n/**\n * Make a tripped ceiling OBSERVABLE rather than a silent drop — the * standing rule that a control which is not visible in the console does not\n * count as shipped.\n *\n * Two audiences, one call, in exactly `recordAbuseCeilingTrip`'s shape\n * (`apps/tenant/app/api/forms/submit/route.ts`, AGL-1655):\n *\n *  - A durable per-month refusal count at\n *    `hosts/{id}/counters/{siteMembers|leads}Refused`. Counters are excluded\n *    from every client write in `cloud/firebase-firestore.rules` (AGL-1367),\n *    so the record cannot be edited away by the site it describes, and host\n *    admins can already READ it — which is what lets the inbox console page\n *    render it with no rules change.\n *  - One in-app notification to the site's managers, on the FIRST refusal of\n *    the month only. A notification per refused bot request would be the\n *    flood again, delivered.\n *\n * The counter is month-keyed even though the CEILING is a total, because the\n * two facts are different: the ceiling is \"how many records exist\" and this is\n * \"how many were turned away recently\". Only the second is worth a notice.\n *\n * Best-effort throughout: bookkeeping that failed must never turn a contained\n * refusal into a 500, because a 500 is an invitation to retry.\n */\nexport async function recordVisitorRecordCeilingTrip(options: {\n  hostRef: FirebaseFirestore.DocumentReference\n  hostId: string\n  kind: VisitorRecordKind\n  ceiling: number\n  monthKey?: string\n}): Promise<void> {\n  const { hostRef, hostId, kind, ceiling } = options\n  const monthKey = options.monthKey ?? submissionMonthKey()\n  try {\n    const refusedRef = hostRef\n      .collection('counters')\n      .doc(visitorRecordRefusedCounterId(kind))\n    const refusedSnapshot = await refusedRef.get()\n    const alreadyRefused = Number(refusedSnapshot.get(monthKey) ?? 0)\n    await refusedRef.set(\n      {\n        [monthKey]: FieldValue.increment(1),\n        // Explicit values only — Firestore rejects `undefined`.\n        ceiling,\n        lastRefusedAtMs: Date.now(),\n      },\n      { merge: true },\n    )\n    if (alreadyRefused === 0) {\n      const leads = kind === 'leads'\n      await notifyHostManagers(hostId, {\n        type: 'system.visitorRecordsPaused',\n        title: leads\n          ? 'Lead capture paused — this site is at the platform limit'\n          : 'Sign-ups paused — this site is at the platform limit',\n        body:\n          `This site holds ${ceiling.toLocaleString()} ` +\n          `${leads ? 'leads' : 'member accounts'}, which is the platform ` +\n          `safety limit, so further ${leads ? 'leads' : 'sign-ups'} are ` +\n          'being refused. This is not part of your plan — every plan ' +\n          `includes unlimited ${leads ? 'leads' : 'member accounts'}. ` +\n          `Remove some ${leads ? 'leads' : 'members'}, or contact support ` +\n          'if this is real traffic.',\n        link: `/${hostId}/inbox`,\n      })\n    }\n  } catch (error) {\n    console.error('visitor record ceiling bookkeeping failed', error)\n  }\n}\n\n/** What a caller wants stored on the lead. `createdAt` is stamped here. */\nexport interface HostLeadInput {\n  email: string\n  /** The name the person typed, when they typed one (AGL-2303). */\n  name?: string\n  /** `signup`, `booking`, `form:{formId}` — the surface that produced it. */\n  source: string\n  /**\n   * Explicit marketing opt-in, with a consent timestamp — the same shape\n   * `upsertHostContact` already carries (AGL-301). Omitted or `false` writes\n   * nothing: a lead is a side effect of an action the visitor DID take\n   * (sign up, book), which is not by itself consent to be emailed\n   * marketing, so this is only set when the caller captured an explicit\n   * checkbox.\n   */\n  marketingConsent?: boolean\n  /**\n   * The `consentGroupDisclosureKey` the capture surface rendered beside that\n   * checkbox (AGL-3320). The grant pools across the site's consent group only\n   * when it is the group's current key, and is this site's alone otherwise —\n   * the same rule `upsertHostContact` applies.\n   */\n  disclosedConsentGroup?: string | null\n}\n\n/**\n * Record one lead at `hosts/{hostId}/leads/{personKey}`, bounded by\n * `LEADS_MAX_PER_HOST` (AGL-1529).\n *\n * ## One person is one document\n *\n * `docs/specs/reusable-forms.md` §4b. This used to be `tx.create(ref.doc())`\n * — an auto-id per capture event — so one returning customer who signed up\n * and booked twice was three \"leads\". The Members & leads tab presented a\n * list of events as a list of people, and the only thing holding two rows for\n * one person together was string equality on the address at render time.\n *\n * The events are not lost, they are just no longer the record: `sources`\n * carries every surface that produced a capture, `submissionCount` counts\n * them, and `firstSeenAtMs`/`lastSeenAtMs` bracket them. The submissions, the\n * bookings and the member document are still there and still one row each.\n *\n * The id is {@link personKey} — `sha256(normalizeContactEmail(email))`, the\n * SAME derivation a list membership's `memberKey` uses, imported rather than\n * restated. Two specs named this function and the rule both stated is that\n * whichever ships second imports the first's helper: a second copy is how\n * `emailSuppressionKey` and `suppressionId` came to disagree.\n *\n * ## Why every lead writer goes through here\n *\n * There are three lead writes in the repo — the sign-up handler and the two\n * bookings paths — and all three were `hostRef.collection('leads').add(…)`\n * with a `.catch()` on the end. A cap enforced at two of three call sites is\n * not a cap, and the fourth writer somebody adds next month would not have\n * one either. One function is the only shape that survives that.\n *\n * ## The count is evaluated INSIDE the transaction that writes\n *\n * A create-time quota can be laundered by WHEN it is evaluated, not by the\n * counting rule (AGL-2231/2265/2266). Read-then-decide-then-`add()` lets N\n * concurrent visitors each read the same pre-count, each find room, and each\n * land — and nothing re-counts afterwards, so the extra rows are permanent.\n * `Transaction.get(AggregateQuery)` serialises the count against a concurrent\n * create into the same collection: the loser retries, re-reads the higher\n * count, and is refused. The count is of LIVE documents, so triaging leads in\n * the inbox frees the slots.\n *\n * ## Refusing a lead never fails the visitor's action\n *\n * A lead is a SIDE EFFECT — of a sign-up, or of a booking. The visitor did\n * not ask for it and cannot see it, so refusing one must not refuse the thing\n * they did ask for. This returns a boolean and never throws; the trip is\n * recorded and the caller carries on. That is the honest split, and it is why\n * `SITE_MEMBERS_MAX_PER_HOST` (which governs an action a visitor DID take) is\n * enforced with a 429 in the sign-up handler and this is not.\n */\nexport async function addHostLead(options: {\n  hostRef: FirebaseFirestore.DocumentReference\n  hostId: string\n  lead: HostLeadInput\n  /**\n   * The ceiling to compare against. Defaults to `LEADS_MAX_PER_HOST` and is\n   * passed by NOTHING in production — it exists so the suite can re-drive the\n   * same count against a ceiling one higher and require the write to succeed.\n   * A refusal that survives its own ceiling being raised was never that\n   * ceiling's refusal, and there is exactly ONE comparison below, so knifing\n   * it cannot be absorbed by a fallback branch.\n   */\n  ceiling?: number\n  /**\n   * The campaign this person came from, already resolved by the door.\n   *\n   * Resolved rather than raw, and passed rather than looked up, because one\n   * visitor action reaches several writers: a form submission that creates a\n   * submission, a contact AND a lead must pay for the touch lookup once. A\n   * door that hands none — every order path, every import — attributes\n   * nothing, which is how a lead that no campaign caused stays uncredited.\n   */\n  touch?: ResolvedCampaignTouch | null\n}): Promise<boolean> {\n  const { hostRef, hostId, lead } = options\n  const maxPerHost = options.ceiling ?? LEADS_MAX_PER_HOST\n  try {\n    const leadsRef = await orgLeadsForHost(hostId)\n    const firestore = hostRef.firestore\n    /*\n     * `null` for anything that is not a usable address — a lead captured\n     * against a malformed one keeps an auto-id and stays its own row. Keying\n     * several unusable addresses under one guessed id would merge two\n     * different people, which is worse than two rows for one.\n     */\n    const key = personKey(lead.email)\n    /*\n     * A lead the org has not taken over yet is carried across BEFORE the\n     * transaction opens (AGL-3275). It has to happen outside: the carry is\n     * itself a read-then-write, and a transaction that also counted the\n     * collection would be reading a row it was about to create. Two doors\n     * carrying the same person in the same second both write the legacy\n     * fields under `merge`, so the race is a no-op rather than a conflict.\n     */\n    const leadRef = key\n      ? (await leadForWrite(hostId, key)).ref\n      : leadsRef.doc()\n    /*\n     * The scope this capture stamps, and the group whose terms its consent is\n     * recorded under. Both resolved HERE rather than in the transaction body:\n     * a contended transaction re-runs that body, and neither of these can\n     * change between attempts, so resolving them inside would pay for the org\n     * read again on every retry.\n     */\n    const scope = await leadScopeForHost(hostId)\n    const group = await consentGroupForSite(hostId)\n    const now = Date.now()\n    const seen = {\n      // `arrayUnion`, so a person who books twice has `['booking']` and one\n      // who signed up and then submitted a form has both. Bounded by the\n      // number of surfaces, not by the number of captures.\n      sources: FieldValue.arrayUnion(lead.source),\n      lastSeenAtMs: now,\n      submissionCount: FieldValue.increment(1),\n      ...(lead.name ? { name: lead.name } : {}),\n    }\n    let created = false\n    const refused = await firestore.runTransaction(async (tx) => {\n      // Reset per attempt: a contended transaction re-runs its body, and a\n      // flag left standing from an aborted attempt would credit a campaign\n      // with a person who turned out to exist already.\n      created = false\n      // ALL READS BEFORE THE WRITE, which Firestore requires.\n      const existing = await tx.get(leadRef)\n      /*\n       * ⛔ THE CEILING GATES A NEW PERSON, NEVER AN EXISTING ONE.\n       *\n       * A returning visitor's capture is an UPDATE — it does not grow the\n       * collection, so refusing it buys no capacity and costs the customer\n       * the source and the timestamp they would have learned. That is the\n       * enforcement-at-use shape the capacity rule exists to forbid: a limit\n       * must refuse the addition, never a person already recorded or the\n       * data attached to them.\n       *\n       * It also means the count is only paid on a genuinely new person,\n       * which is the case that can move it.\n       */\n      if (!existing.exists) {\n        /*\n         * COUNTED OVER WHAT THIS SITE MAY SEE, not over the org (AGL-3275).\n         *\n         * The collection is org-wide now, and `LEADS_MAX_PER_HOST` is a\n         * per-SITE ceiling. An unfiltered count would charge every brand in\n         * an agency's account for every other brand's leads, and the first\n         * client to fill its allowance would refuse captures on sites that\n         * had taken none. `scopedToHost` is the same narrowing every other\n         * org-owned read uses, so a single-site org counts exactly what it\n         * counted before this moved.\n         *\n         * A lead shared by two brands in one consent group is counted by\n         * both, which is the honest answer: each of them holds it.\n         */\n        const used = (\n          await tx.get(scopedToHost(leadsRef, hostId).count())\n        ).data().count\n        if (checkVisitorRecordCeiling(used, maxPerHost).exceeded) return true\n      }\n      /*\n       * Consent is carried forward and never cleared.\n       *\n       * A basis is written only when this capture carried an explicit\n       * opt-in, so a later booking by someone who did not tick the box\n       * leaves an earlier grant standing — absent-or-granted, the shape\n       * every other writer uses. The TIMESTAMP is carried over rather than\n       * restamped, for the reason given at the read below.\n       */\n      /*\n       * The EARLIEST grant is the one that happened, so a later capture\n       * carrying the same checkbox keeps the original date rather than\n       * restamping when this person opted in. Read back through the shared\n       * reader so \"already consented\" means the same thing here as it does\n       * at send time.\n       */\n      /*\n       * THE SITE'S REAL GROUP, because the silo that justified a group of one\n       * is gone (AGL-3275).\n       *\n       * This read `soloConsentGroup(hostId)` for as long as a lead lived at\n       * `hosts/{hostId}/leads`, and the reason was the path: private by\n       * construction, so pooling a lead's basis would have recorded a\n       * disclosure that reached nothing, while the contact written by the\n       * same capture door was org-shared and pooled.\n       *\n       * A lead is now org-shared on exactly the terms the contact is, so the\n       * premise is false and keeping the group of one would leave a\n       * multi-brand org holding a lead its sibling brand can SEE but may not\n       * MAIL — a narrower basis than the one `consentGroupDisclosure` named\n       * beside the checkbox this person ticked. Pooling here records what\n       * they were actually told, and only that: the grant reaches the group\n       * when the capture surface sent back the group's current disclosure\n       * key (AGL-3320), and this site alone otherwise. An undeclared group is\n       * still a group of one, so an agency is unchanged and configures\n       * nothing.\n       *\n       * Resolved above the transaction — see `group`'s declaration.\n       */\n      const prior = readMarketingBasis(existing.data() ?? null, group)\n      const consentAtMs =\n        prior.basis === 'granted' && prior.basisAtMs !== null\n          ? prior.basisAtMs\n          : now\n      created = !existing.exists\n      tx.set(\n        leadRef,\n        {\n          email: lead.email,\n          ...seen,\n          /*\n           * WIDENED BY THE CAPTURE, NEVER BY THE LOOKUP (AGL-3275).\n           *\n           * `arrayUnion` rather than a replace, exactly as `upsert-contact`\n           * stamps a contact: this site just collected this person, so it may\n           * see the row. A site that merely FOUND them — the unscoped dedupe\n           * lookup in `readLeadForHost` — gains nothing, which is what keeps\n           * an agency's clients apart on a record they share.\n           */\n          visibleTo: FieldValue.arrayUnion(...scope),\n          /*\n           * EVERY SITE THAT CAPTURED THIS PERSON, not just the first\n           * (AGL-3275).\n           *\n           * This was written once, on create, and that was sound while the\n           * collection sat under one host and could hold only that host's\n           * name. On the org the row is shared, so a sibling brand capturing\n           * a person the first brand already holds has to be recorded here or\n           * the \"Known by\" answer silently omits it — the same `arrayUnion`\n           * the contact door has always used for this field, now that a lead\n           * has the same question to answer.\n           */\n          [CAPTURED_BY_HOST_FIELD]: FieldValue.arrayUnion(hostId),\n          ...(existing.exists\n            ? {}\n            : {\n                firstSeenAtMs: now,\n                createdAt: FieldValue.serverTimestamp(),\n              }),\n          /*\n           * The basis is recorded under the GROUP, keyed by its host, because\n           * {@link readMarketingBasis} is one function over four silos and a\n           * silo whose basis lived somewhere else would need the reader to\n           * know which collection it was handed. A reader that has to be told\n           * the shape is a reader that can be told the wrong one.\n           */\n          ...(lead.marketingConsent\n            ? marketingConsentFieldsForGroup(\n                consentGroupForGrant(group, lead.disclosedConsentGroup),\n                consentAtMs,\n              )\n            : {}),\n        },\n        { merge: true },\n      )\n      return false\n    })\n    if (refused) {\n      await recordVisitorRecordCeilingTrip({\n        hostRef,\n        hostId,\n        kind: 'leads',\n        ceiling: maxPerHost,\n      })\n      return false\n    }\n    /*\n     * ATTRIBUTED ON CREATION ONLY.\n     *\n     * A returning visitor's capture is an update — the campaign did not\n     * produce a lead, it produced another visit by a person the site already\n     * held — and crediting it would let whichever campaign ran most recently\n     * re-earn every lead on the list. `created` is set inside the transaction\n     * that decides it, so the attribution and the write agree about whether\n     * this person is new.\n     *\n     * Awaited rather than fired off: `addHostLead` already returns only after\n     * its own write, and a caller that `void`s it (every one of them) is\n     * unaffected. Never throws, so a failure here cannot cost the lead.\n     */\n    if (created && options.touch) {\n      await attributeCampaignConversion({\n        hostId,\n        kind: 'lead',\n        refId: leadRef.id,\n        touch: options.touch,\n        convertedAtMs: now,\n      })\n    }\n    return true\n  } catch (error) {\n    // Same posture the three original call sites had (`.catch(() => undefined)`\n    // / `.catch(console.error)`): a lead that failed to store must not fail\n    // the sign-up or the booking that produced it.\n    console.error('lead write failed', error)\n    return false\n  }\n}\n"],"names":["CAPTURED_BY_HOST_FIELD","checkVisitorRecordCeiling","LEADS_MAX_PER_HOST","marketingConsentFieldsForGroup","personKey","readMarketingBasis","submissionMonthKey","visitorRecordRefusedCounterId","FieldValue","attributeCampaignConversion","notifyHostManagers","firebaseAdmin","consentGroupForSite","orgDataCollectionForHost","scopedToHost","crmReadTokens","crmScopeTokens","consentGroupForGrant","firestore","app","orgLeadsForHost","hostId","orgLeadsQueryForHost","ref","query","leadReadTokensForHost","group","leadScopeForHost","org","readLeadForHost","key","orgRow","doc","get","exists","leadForWrite","existed","carried","recordVisitorRecordCeilingTrip","options","hostRef","kind","ceiling","monthKey","refusedSnapshot","refusedRef","collection","alreadyRefused","Number","set","increment","lastRefusedAtMs","Date","now","merge","leads","type","title","body","toLocaleString","link","error","console","addHostLead","lead","maxPerHost","leadsRef","email","leadRef","scope","seen","sources","arrayUnion","source","lastSeenAtMs","submissionCount","name","created","refused","runTransaction","tx","existing","used","count","data","exceeded","prior","consentAtMs","basis","basisAtMs","visibleTo","firstSeenAtMs","createdAt","serverTimestamp","marketingConsent","disclosedConsentGroup","touch","refId","id","convertedAtMs"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;CAQC,GAED,SACEA,sBAAsB,EACtBC,yBAAyB,EACzBC,kBAAkB,EAClBC,8BAA8B,EAC9BC,SAAS,EACTC,kBAAkB,EAClBC,kBAAkB,EAClBC,6BAA6B,QAExB,sBAAqB;AAC5B,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SACEC,2BAA2B,QAEtB,uCAAmC;AAC1C,SAASC,kBAAkB,QAAQ,qBAAiB;AACpD,OAAOC,mBAAmB,sBAAkB;AAC5C,SACEC,mBAAmB,EACnBC,wBAAwB,EAExBC,YAAY,QACP,qBAAiB;AACxB,SAASC,aAAa,EAAEC,cAAc,QAAQ,sBAAqB;AAEnE,8EAA8E;AAC9E,8EAA8E;AAC9E,SAASC,oBAAoB,QAAQ,wCAAuC;AAE5E,MAAMC,YAAY,IAAMP,cAAcQ,GAAG,GAAGD,SAAS;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CC,GAGD;;;CAGC,GACD,OAAO,eAAeE,gBACpBC,MAAc;IAEd,OAAOR,yBAAyBQ,QAAQ;AAC1C;AAEA;;;;;;CAMC,GACD,OAAO,eAAeC,qBAAqBD,MAAc;IAIvD,MAAME,MAAM,MAAMH,gBAAgBC;IAClC,OAAO;QAAEE;QAAKC,OAAOV,aAAaS,KAAKF;IAAQ;AACjD;AAEA;;;CAGC,GACD,OAAO,eAAeI,sBACpBJ,MAAc,EACdK,KAAoB;IAEpB,OAAOX,cAAcW,gBAAAA,QAAU,MAAMd,oBAAoBS;AAC3D;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAeM,iBACpBN,MAAc,EACdO,GAAoC;IAEpC,MAAMF,QAAQ,MAAMd,oBAAoBS,QAAQO;IAChD,OAAOZ,eAAeY,cAAAA,MAAO,MAAMF;AACrC;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,eAAeG,gBACpBR,MAAc,EACdS,GAAW;IAEX,MAAMC,SAAS,MAAM,AAAC,CAAA,MAAMX,gBAAgBC,OAAM,EAAGW,GAAG,CAACF,KAAKG,GAAG;IACjE,OAAOF,OAAOG,MAAM,GAAGH,SAAS;AAClC;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAeI,aACpBd,MAAc,EACdS,GAAW;IAMX,MAAMP,MAAM,AAAC,CAAA,MAAMH,gBAAgBC,OAAM,EAAGW,GAAG,CAACF;IAChD,OAAO;QAAEP;QAAKa,SAAS,AAAC,CAAA,MAAMb,IAAIU,GAAG,EAAC,EAAGC,MAAM;QAAEG,SAAS;IAAM;AAClE;AAGA;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,OAAO,eAAeC,+BAA+BC,OAMpD;QAEkBA;IADjB,MAAM,EAAEC,OAAO,EAAEnB,MAAM,EAAEoB,IAAI,EAAEC,OAAO,EAAE,GAAGH;IAC3C,MAAMI,YAAWJ,oBAAAA,QAAQI,QAAQ,YAAhBJ,oBAAoBjC;IACrC,IAAI;YAK4BsC;QAJ9B,MAAMC,aAAaL,QAChBM,UAAU,CAAC,YACXd,GAAG,CAACzB,8BAA8BkC;QACrC,MAAMG,kBAAkB,MAAMC,WAAWZ,GAAG;QAC5C,MAAMc,iBAAiBC,QAAOJ,uBAAAA,gBAAgBX,GAAG,CAACU,qBAApBC,uBAAiC;QAC/D,MAAMC,WAAWI,GAAG,CAClB;YACE,CAACN,SAAS,EAAEnC,WAAW0C,SAAS,CAAC;YACjC,wDAAwD;YACxDR;YACAS,iBAAiBC,KAAKC,GAAG;QAC3B,GACA;YAAEC,OAAO;QAAK;QAEhB,IAAIP,mBAAmB,GAAG;YACxB,MAAMQ,QAAQd,SAAS;YACvB,MAAM/B,mBAAmBW,QAAQ;gBAC/BmC,MAAM;gBACNC,OAAOF,QACH,6DACA;gBACJG,MACE,CAAC,gBAAgB,EAAEhB,QAAQiB,cAAc,GAAG,CAAC,CAAC,GAC9C,GAAGJ,QAAQ,UAAU,kBAAkB,wBAAwB,CAAC,GAChE,CAAC,yBAAyB,EAAEA,QAAQ,UAAU,WAAW,KAAK,CAAC,GAC/D,+DACA,CAAC,mBAAmB,EAAEA,QAAQ,UAAU,kBAAkB,EAAE,CAAC,GAC7D,CAAC,YAAY,EAAEA,QAAQ,UAAU,UAAU,qBAAqB,CAAC,GACjE;gBACFK,MAAM,CAAC,CAAC,EAAEvC,OAAO,MAAM,CAAC;YAC1B;QACF;IACF,EAAE,OAAOwC,OAAO;QACdC,QAAQD,KAAK,CAAC,6CAA6CA;IAC7D;AACF;AA2BA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkDC,GACD,OAAO,eAAeE,YAAYxB,OAuBjC;QAEoBA;IADnB,MAAM,EAAEC,OAAO,EAAEnB,MAAM,EAAE2C,IAAI,EAAE,GAAGzB;IAClC,MAAM0B,cAAa1B,mBAAAA,QAAQG,OAAO,YAAfH,mBAAmBrC;IACtC,IAAI;QACF,MAAMgE,WAAW,MAAM9C,gBAAgBC;QACvC,MAAMH,YAAYsB,QAAQtB,SAAS;QACnC;;;;;KAKC,GACD,MAAMY,MAAM1B,UAAU4D,KAAKG,KAAK;QAChC;;;;;;;KAOC,GACD,MAAMC,UAAUtC,MACZ,AAAC,CAAA,MAAMK,aAAad,QAAQS,IAAG,EAAGP,GAAG,GACrC2C,SAASlC,GAAG;QAChB;;;;;;KAMC,GACD,MAAMqC,QAAQ,MAAM1C,iBAAiBN;QACrC,MAAMK,QAAQ,MAAMd,oBAAoBS;QACxC,MAAMgC,MAAMD,KAAKC,GAAG;QACpB,MAAMiB,OAAO;YACX,sEAAsE;YACtE,mEAAmE;YACnE,qDAAqD;YACrDC,SAAS/D,WAAWgE,UAAU,CAACR,KAAKS,MAAM;YAC1CC,cAAcrB;YACdsB,iBAAiBnE,WAAW0C,SAAS,CAAC;WAClCc,KAAKY,IAAI,GAAG;YAAEA,MAAMZ,KAAKY,IAAI;QAAC,IAAI,CAAC;QAEzC,IAAIC,UAAU;QACd,MAAMC,UAAU,MAAM5D,UAAU6D,cAAc,CAAC,OAAOC;gBA+EnBC;YA9EjC,qEAAqE;YACrE,qEAAqE;YACrE,iDAAiD;YACjDJ,UAAU;YACV,wDAAwD;YACxD,MAAMI,WAAW,MAAMD,GAAG/C,GAAG,CAACmC;YAC9B;;;;;;;;;;;;OAYC,GACD,IAAI,CAACa,SAAS/C,MAAM,EAAE;gBACpB;;;;;;;;;;;;;SAaC,GACD,MAAMgD,OAAO,AACX,CAAA,MAAMF,GAAG/C,GAAG,CAACnB,aAAaoD,UAAU7C,QAAQ8D,KAAK,GAAE,EACnDC,IAAI,GAAGD,KAAK;gBACd,IAAIlF,0BAA0BiF,MAAMjB,YAAYoB,QAAQ,EAAE,OAAO;YACnE;YACA;;;;;;;;OAQC,GACD;;;;;;OAMC,GACD;;;;;;;;;;;;;;;;;;;;;;OAsBC,GACD,MAAMC,QAAQjF,oBAAmB4E,iBAAAA,SAASG,IAAI,cAAbH,iBAAmB,MAAMvD;YAC1D,MAAM6D,cACJD,MAAME,KAAK,KAAK,aAAaF,MAAMG,SAAS,KAAK,OAC7CH,MAAMG,SAAS,GACfpC;YACNwB,UAAU,CAACI,SAAS/C,MAAM;YAC1B8C,GAAG/B,GAAG,CACJmB,SACA;gBACED,OAAOH,KAAKG,KAAK;eACdG;gBACH;;;;;;;;WAQC,GACDoB,WAAWlF,WAAWgE,UAAU,IAAIH;gBACpC;;;;;;;;;;;WAWC,GACD,CAACrE,uBAAuB,EAAEQ,WAAWgE,UAAU,CAACnD;eAC5C4D,SAAS/C,MAAM,GACf,CAAC,IACD;gBACEyD,eAAetC;gBACfuC,WAAWpF,WAAWqF,eAAe;YACvC,GAQA7B,KAAK8B,gBAAgB,GACrB3F,+BACEc,qBAAqBS,OAAOsC,KAAK+B,qBAAqB,GACtDR,eAEF,CAAC,IAEP;gBAAEjC,OAAO;YAAK;YAEhB,OAAO;QACT;QACA,IAAIwB,SAAS;YACX,MAAMxC,+BAA+B;gBACnCE;gBACAnB;gBACAoB,MAAM;gBACNC,SAASuB;YACX;YACA,OAAO;QACT;QACA;;;;;;;;;;;;;KAaC,GACD,IAAIY,WAAWtC,QAAQyD,KAAK,EAAE;YAC5B,MAAMvF,4BAA4B;gBAChCY;gBACAoB,MAAM;gBACNwD,OAAO7B,QAAQ8B,EAAE;gBACjBF,OAAOzD,QAAQyD,KAAK;gBACpBG,eAAe9C;YACjB;QACF;QACA,OAAO;IACT,EAAE,OAAOQ,OAAO;QACd,4EAA4E;QAC5E,wEAAwE;QACxE,+CAA+C;QAC/CC,QAAQD,KAAK,CAAC,qBAAqBA;QACnC,OAAO;IACT;AACF"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/host-visitor-records.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The durable half of the visitor-record ceilings (AGL-1529) — the lead\n * writer that enforces `LEADS_MAX_PER_HOST`, and the bookkeeping that makes a\n * trip of EITHER ceiling something a site's owner can see.\n *\n * The policy is pure and lives in `@aglyn/aglyn/server`\n * (`visitor-record-ceiling.ts`); this is the part that needs Firestore. Same\n * split as `visitorWriteRateLimitRefusal`, and for the same reason.\n */\n\nimport {\n  CAPTURED_BY_HOST_FIELD,\n  checkVisitorRecordCeiling,\n  LEADS_MAX_PER_HOST,\n  marketingConsentFieldsForGroup,\n  personKey,\n  readMarketingBasis,\n  submissionMonthKey,\n  visitorRecordRefusedCounterId,\n  type VisitorRecordKind,\n} from '@aglyn/aglyn/server'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport {\n  attributeCampaignConversion,\n  type ResolvedCampaignTouch,\n} from './campaign-conversion-attribution'\nimport { notifyHostManagers } from './notifications'\nimport firebaseAdmin from './firebase-admin'\nimport {\n  consentGroupForSite,\n  orgDataCollectionForHost,\n  resolveOrgIdForHost,\n  scopedToHost,\n} from './organizations'\nimport { crmLeadListFields, crmReadTokens, crmScopeTokens } from '@aglyn/aglyn/server'\nimport type { ConsentGroup, ScopeToken } from '@aglyn/aglyn/server'\n// The module path rather than the barrel, as `upsert-contact.ts` does: a spec\n// that substitutes the barrel keeps the real rule for which group a grant is.\nimport { consentGroupForGrant } from '@aglyn/aglyn/app-utils/consent-groups'\n\nconst firestore = () => firebaseAdmin.app().firestore()\n\n/**\n * A lead's one home: `orgs/{orgId}/leads/{personKey}` (AGL-3275).\n *\n * ## Why leads moved\n *\n * A lead used to live at `hosts/{hostId}/leads/{personKey}` while the\n * contact for the same human lived on the org with a `visibleTo` array. The\n * path was doing the job `visibleTo` does, and doing it worse:\n *\n * - An AGENCY was isolated by the path. It is isolated by `visibleTo` too,\n *   with no configuration — `consentGroupScope` on a group of one is\n *   `['host:{id}']`.\n * - A MULTI-BRAND org could not be served at all. `personKey` is derived\n *   from the address, so the same person captured on two sibling brands\n *   produced two documents with byte-identical ids under different parents.\n *   One person was two records by construction, which is the thing AGL-3232\n *   had just finished eliminating for contacts.\n * - The two answers could disagree. A person's contact was visible to every\n *   brand in the consent group they actually consented to — the disclosure\n *   names those brands — while their lead was visible to whichever brand's\n *   form they happened to land on. The lead was scoped more narrowly than\n *   what the person was told, which is the safe direction to be wrong in and\n *   still the wrong answer.\n *\n * So a lead is stamped with `crmScopeTokens` and read with `crmReadTokens`,\n * the same pair the contacts surface uses. Nothing here is a new mechanism;\n * this is leads arriving at the one the rest of the CRM already had.\n *\n * ## The fallback is READ-ONLY, and temporary\n *\n * This repo has run this migration once already — AGL-237 moved datasets,\n * contacts and media to the org, AGL-1040 backfilled, AGL-1050 deleted the\n * fallback — and `orgDataCollectionForHost` carries what it learned:\n *\n *   \"a second storage path that can still be WRITTEN is a second boundary to\n *   enforce forever, which undoes the premise of scoped sharing: one home\n *   per resource plus an explicit scope.\"\n *\n * So the host path is never written here. It is read, once, to carry a\n * not-yet-migrated lead onto the org as a side effect of the next write that\n * touches it ({@link leadForWrite}) — which shrinks what AGL-3276's backfill\n * has left to fold, and means no read can be answered by a stale host row\n * after a write has moved on. AGL-3277 deletes the fallback and the rules\n * block behind it once that backfill reports nothing left to plan.\n */\n\n\n/**\n * The org collection a lead is written to. Always the org — see the\n * read-only note above.\n */\nexport async function orgLeadsForHost(\n  hostId: string,\n): Promise<FirebaseFirestore.CollectionReference> {\n  return orgDataCollectionForHost(hostId, 'leads')\n}\n\n/**\n * The leads one site may LIST, narrowed by `visibleTo`.\n *\n * The Admin SDK does not evaluate rules, so an unnarrowed read here would\n * serve one agency client's leads on another's site — the same reason\n * `scopedToHost` exists for every other org-owned collection.\n */\nexport async function orgLeadsQueryForHost(hostId: string): Promise<{\n  ref: FirebaseFirestore.CollectionReference\n  query: FirebaseFirestore.Query\n}> {\n  const ref = await orgLeadsForHost(hostId)\n  return { ref, query: scopedToHost(ref, hostId) }\n}\n\n/**\n * The tokens a reader holding this group may ask `array-contains-any` for.\n * Capped at 30 by `crmReadTokens`, as the contacts list is.\n */\nexport async function leadReadTokensForHost(\n  hostId: string,\n  group?: ConsentGroup,\n): Promise<ScopeToken[]> {\n  return crmReadTokens(group ?? (await consentGroupForSite(hostId)))\n}\n\n/**\n * The `visibleTo` a capture on this site stamps: the consent group's sites,\n * or `['org']` where the org set `defaultResourceScope`.\n *\n * Widened by the capture, never by the lookup — a site that has never\n * captured this person gains nothing by finding them, which is what keeps an\n * agency's clients apart on a record they share. Callers UPDATING an\n * existing lead union these in rather than replacing, exactly as\n * `upsert-contact` does.\n */\nexport async function leadScopeForHost(\n  hostId: string,\n  org?: Record<string, unknown> | null,\n): Promise<ScopeToken[]> {\n  const group = await consentGroupForSite(hostId, org)\n  return crmScopeTokens(org ?? null, group)\n}\n\n/**\n * The lead for an address, wherever it currently lives.\n *\n * ## The lookup is UNSCOPED, and has to be\n *\n * One human who touched two sibling brands is one person. Narrowing this to\n * what the capturing site may already see would let a second submission on a\n * sibling brand mint a SECOND record for the same address — the duplication\n * this migration exists to end, reintroduced one layer up. Recognizing\n * somebody and being allowed to read their row are different acts:\n * this finds the person, {@link leadScopeForHost} decides who may see them.\n *\n * `upsert-contact` states the same rule at its own dedupe lookup, and for the\n * same reason. A caller that wants only what a site may SEE wants\n * {@link orgLeadsQueryForHost}.\n *\n * @returns the org row; else the not-yet-migrated host row; else `null`.\n */\nexport async function readLeadForHost(\n  hostId: string,\n  key: string,\n): Promise<FirebaseFirestore.DocumentSnapshot | null> {\n  const orgRow = await (await orgLeadsForHost(hostId)).doc(key).get()\n  return orgRow.exists ? orgRow : null\n}\n\n/**\n * The ref a write should target.\n *\n * This carried a not-yet-backfilled host row onto the org first, and reported\n * whether it had (`carried`). AGL-3276 emptied the host path and AGL-3277\n * removed it, so there is nothing left to carry: the org row is the only row.\n * `carried` stays on the shape, always `false`, because several callers\n * destructure it and a lie is cheaper to read than a signature change that\n * says nothing.\n */\nexport async function leadForWrite(\n  hostId: string,\n  key: string,\n): Promise<{\n  ref: FirebaseFirestore.DocumentReference\n  existed: boolean\n  carried: boolean\n}> {\n  const ref = (await orgLeadsForHost(hostId)).doc(key)\n  return { ref, existed: (await ref.get()).exists, carried: false }\n}\n\n\n/**\n * Make a tripped ceiling OBSERVABLE rather than a silent drop — the * standing rule that a control which is not visible in the console does not\n * count as shipped.\n *\n * Two audiences, one call, in exactly `recordAbuseCeilingTrip`'s shape\n * (`apps/tenant/app/api/forms/submit/route.ts`, AGL-1655):\n *\n *  - A durable per-month refusal count at\n *    `hosts/{id}/counters/{siteMembers|leads}Refused`. Counters are excluded\n *    from every client write in `cloud/firebase-firestore.rules` (AGL-1367),\n *    so the record cannot be edited away by the site it describes, and host\n *    admins can already READ it — which is what lets the inbox console page\n *    render it with no rules change.\n *  - One in-app notification to the site's managers, on the FIRST refusal of\n *    the month only. A notification per refused bot request would be the\n *    flood again, delivered.\n *\n * The counter is month-keyed even though the CEILING is a total, because the\n * two facts are different: the ceiling is \"how many records exist\" and this is\n * \"how many were turned away recently\". Only the second is worth a notice.\n *\n * Best-effort throughout: bookkeeping that failed must never turn a contained\n * refusal into a 500, because a 500 is an invitation to retry.\n */\nexport async function recordVisitorRecordCeilingTrip(options: {\n  hostRef: FirebaseFirestore.DocumentReference\n  hostId: string\n  kind: VisitorRecordKind\n  ceiling: number\n  monthKey?: string\n}): Promise<void> {\n  const { hostRef, hostId, kind, ceiling } = options\n  const monthKey = options.monthKey ?? submissionMonthKey()\n  try {\n    const refusedRef = hostRef\n      .collection('counters')\n      .doc(visitorRecordRefusedCounterId(kind))\n    const refusedSnapshot = await refusedRef.get()\n    const alreadyRefused = Number(refusedSnapshot.get(monthKey) ?? 0)\n    await refusedRef.set(\n      {\n        [monthKey]: FieldValue.increment(1),\n        // Explicit values only — Firestore rejects `undefined`.\n        ceiling,\n        lastRefusedAtMs: Date.now(),\n      },\n      { merge: true },\n    )\n    if (alreadyRefused === 0) {\n      const leads = kind === 'leads'\n      await notifyHostManagers(hostId, {\n        type: 'system.visitorRecordsPaused',\n        title: leads\n          ? 'Lead capture paused — this site is at the platform limit'\n          : 'Sign-ups paused — this site is at the platform limit',\n        body:\n          `This site holds ${ceiling.toLocaleString()} ` +\n          `${leads ? 'leads' : 'member accounts'}, which is the platform ` +\n          `safety limit, so further ${leads ? 'leads' : 'sign-ups'} are ` +\n          'being refused. This is not part of your plan — every plan ' +\n          `includes unlimited ${leads ? 'leads' : 'member accounts'}. ` +\n          `Remove some ${leads ? 'leads' : 'members'}, or contact support ` +\n          'if this is real traffic.',\n        link: `/${hostId}/inbox`,\n      })\n    }\n  } catch (error) {\n    console.error('visitor record ceiling bookkeeping failed', error)\n  }\n}\n\n/** What a caller wants stored on the lead. `createdAt` is stamped here. */\nexport interface HostLeadInput {\n  email: string\n  /** The name the person typed, when they typed one (AGL-2303). */\n  name?: string\n  /** `signup`, `booking`, `form:{formId}` — the surface that produced it. */\n  source: string\n  /**\n   * Explicit marketing opt-in, with a consent timestamp — the same shape\n   * `upsertHostContact` already carries (AGL-301). Omitted or `false` writes\n   * nothing: a lead is a side effect of an action the visitor DID take\n   * (sign up, book), which is not by itself consent to be emailed\n   * marketing, so this is only set when the caller captured an explicit\n   * checkbox.\n   */\n  marketingConsent?: boolean\n  /**\n   * The `consentGroupDisclosureKey` the capture surface rendered beside that\n   * checkbox (AGL-3320). The grant pools across the site's consent group only\n   * when it is the group's current key, and is this site's alone otherwise —\n   * the same rule `upsertHostContact` applies.\n   */\n  disclosedConsentGroup?: string | null\n}\n\n/**\n * Record one lead at `hosts/{hostId}/leads/{personKey}`, bounded by\n * `LEADS_MAX_PER_HOST` (AGL-1529).\n *\n * ## One person is one document\n *\n * `docs/specs/reusable-forms.md` §4b. This used to be `tx.create(ref.doc())`\n * — an auto-id per capture event — so one returning customer who signed up\n * and booked twice was three \"leads\". The Members & leads tab presented a\n * list of events as a list of people, and the only thing holding two rows for\n * one person together was string equality on the address at render time.\n *\n * The events are not lost, they are just no longer the record: `sources`\n * carries every surface that produced a capture, `submissionCount` counts\n * them, and `firstSeenAtMs`/`lastSeenAtMs` bracket them. The submissions, the\n * bookings and the member document are still there and still one row each.\n *\n * The id is {@link personKey} — `sha256(normalizeContactEmail(email))`, the\n * SAME derivation a list membership's `memberKey` uses, imported rather than\n * restated. Two specs named this function and the rule both stated is that\n * whichever ships second imports the first's helper: a second copy is how\n * `emailSuppressionKey` and `suppressionId` came to disagree.\n *\n * ## Why every lead writer goes through here\n *\n * There are three lead writes in the repo — the sign-up handler and the two\n * bookings paths — and all three were `hostRef.collection('leads').add(…)`\n * with a `.catch()` on the end. A cap enforced at two of three call sites is\n * not a cap, and the fourth writer somebody adds next month would not have\n * one either. One function is the only shape that survives that.\n *\n * ## The count is evaluated INSIDE the transaction that writes\n *\n * A create-time quota can be laundered by WHEN it is evaluated, not by the\n * counting rule (AGL-2231/2265/2266). Read-then-decide-then-`add()` lets N\n * concurrent visitors each read the same pre-count, each find room, and each\n * land — and nothing re-counts afterwards, so the extra rows are permanent.\n * `Transaction.get(AggregateQuery)` serialises the count against a concurrent\n * create into the same collection: the loser retries, re-reads the higher\n * count, and is refused. The count is of LIVE documents, so triaging leads in\n * the inbox frees the slots.\n *\n * ## Refusing a lead never fails the visitor's action\n *\n * A lead is a SIDE EFFECT — of a sign-up, or of a booking. The visitor did\n * not ask for it and cannot see it, so refusing one must not refuse the thing\n * they did ask for. This returns a boolean and never throws; the trip is\n * recorded and the caller carries on. That is the honest split, and it is why\n * `SITE_MEMBERS_MAX_PER_HOST` (which governs an action a visitor DID take) is\n * enforced with a 429 in the sign-up handler and this is not.\n */\nexport async function addHostLead(options: {\n  hostRef: FirebaseFirestore.DocumentReference\n  hostId: string\n  lead: HostLeadInput\n  /**\n   * The ceiling to compare against. Defaults to `LEADS_MAX_PER_HOST` and is\n   * passed by NOTHING in production — it exists so the suite can re-drive the\n   * same count against a ceiling one higher and require the write to succeed.\n   * A refusal that survives its own ceiling being raised was never that\n   * ceiling's refusal, and there is exactly ONE comparison below, so knifing\n   * it cannot be absorbed by a fallback branch.\n   */\n  ceiling?: number\n  /**\n   * The campaign this person came from, already resolved by the door.\n   *\n   * Resolved rather than raw, and passed rather than looked up, because one\n   * visitor action reaches several writers: a form submission that creates a\n   * submission, a contact AND a lead must pay for the touch lookup once. A\n   * door that hands none — every order path, every import — attributes\n   * nothing, which is how a lead that no campaign caused stays uncredited.\n   */\n  touch?: ResolvedCampaignTouch | null\n}): Promise<boolean> {\n  const { hostRef, hostId, lead } = options\n  const maxPerHost = options.ceiling ?? LEADS_MAX_PER_HOST\n  try {\n    const leadsRef = await orgLeadsForHost(hostId)\n    const firestore = hostRef.firestore\n    /*\n     * `null` for anything that is not a usable address — a lead captured\n     * against a malformed one keeps an auto-id and stays its own row. Keying\n     * several unusable addresses under one guessed id would merge two\n     * different people, which is worse than two rows for one.\n     */\n    const key = personKey(lead.email)\n    /*\n     * A lead the org has not taken over yet is carried across BEFORE the\n     * transaction opens (AGL-3275). It has to happen outside: the carry is\n     * itself a read-then-write, and a transaction that also counted the\n     * collection would be reading a row it was about to create. Two doors\n     * carrying the same person in the same second both write the legacy\n     * fields under `merge`, so the race is a no-op rather than a conflict.\n     */\n    const leadRef = key\n      ? (await leadForWrite(hostId, key)).ref\n      : leadsRef.doc()\n    /*\n     * The scope this capture stamps, and the group whose terms its consent is\n     * recorded under. Both resolved HERE rather than in the transaction body:\n     * a contended transaction re-runs that body, and neither of these can\n     * change between attempts, so resolving them inside would pay for the org\n     * read again on every retry.\n     */\n    const scope = await leadScopeForHost(hostId)\n    const group = await consentGroupForSite(hostId)\n    const now = Date.now()\n    const seen = {\n      // `arrayUnion`, so a person who books twice has `['booking']` and one\n      // who signed up and then submitted a form has both. Bounded by the\n      // number of surfaces, not by the number of captures.\n      sources: FieldValue.arrayUnion(lead.source),\n      lastSeenAtMs: now,\n      submissionCount: FieldValue.increment(1),\n      ...(lead.name ? { name: lead.name } : {}),\n    }\n    let created = false\n    const refused = await firestore.runTransaction(async (tx) => {\n      // Reset per attempt: a contended transaction re-runs its body, and a\n      // flag left standing from an aborted attempt would credit a campaign\n      // with a person who turned out to exist already.\n      created = false\n      // ALL READS BEFORE THE WRITE, which Firestore requires.\n      const existing = await tx.get(leadRef)\n      /*\n       * ⛔ THE CEILING GATES A NEW PERSON, NEVER AN EXISTING ONE.\n       *\n       * A returning visitor's capture is an UPDATE — it does not grow the\n       * collection, so refusing it buys no capacity and costs the customer\n       * the source and the timestamp they would have learned. That is the\n       * enforcement-at-use shape the capacity rule exists to forbid: a limit\n       * must refuse the addition, never a person already recorded or the\n       * data attached to them.\n       *\n       * It also means the count is only paid on a genuinely new person,\n       * which is the case that can move it.\n       */\n      if (!existing.exists) {\n        /*\n         * COUNTED OVER WHAT THIS SITE MAY SEE, not over the org (AGL-3275).\n         *\n         * The collection is org-wide now, and `LEADS_MAX_PER_HOST` is a\n         * per-SITE ceiling. An unfiltered count would charge every brand in\n         * an agency's account for every other brand's leads, and the first\n         * client to fill its allowance would refuse captures on sites that\n         * had taken none. `scopedToHost` is the same narrowing every other\n         * org-owned read uses, so a single-site org counts exactly what it\n         * counted before this moved.\n         *\n         * A lead shared by two brands in one consent group is counted by\n         * both, which is the honest answer: each of them holds it.\n         */\n        const used = (\n          await tx.get(scopedToHost(leadsRef, hostId).count())\n        ).data().count\n        if (checkVisitorRecordCeiling(used, maxPerHost).exceeded) return true\n      }\n      /*\n       * Consent is carried forward and never cleared.\n       *\n       * A basis is written only when this capture carried an explicit\n       * opt-in, so a later booking by someone who did not tick the box\n       * leaves an earlier grant standing — absent-or-granted, the shape\n       * every other writer uses. The TIMESTAMP is carried over rather than\n       * restamped, for the reason given at the read below.\n       */\n      /*\n       * The EARLIEST grant is the one that happened, so a later capture\n       * carrying the same checkbox keeps the original date rather than\n       * restamping when this person opted in. Read back through the shared\n       * reader so \"already consented\" means the same thing here as it does\n       * at send time.\n       */\n      /*\n       * THE SITE'S REAL GROUP, because the silo that justified a group of one\n       * is gone (AGL-3275).\n       *\n       * This read `soloConsentGroup(hostId)` for as long as a lead lived at\n       * `hosts/{hostId}/leads`, and the reason was the path: private by\n       * construction, so pooling a lead's basis would have recorded a\n       * disclosure that reached nothing, while the contact written by the\n       * same capture door was org-shared and pooled.\n       *\n       * A lead is now org-shared on exactly the terms the contact is, so the\n       * premise is false and keeping the group of one would leave a\n       * multi-brand org holding a lead its sibling brand can SEE but may not\n       * MAIL — a narrower basis than the one `consentGroupDisclosure` named\n       * beside the checkbox this person ticked. Pooling here records what\n       * they were actually told, and only that: the grant reaches the group\n       * when the capture surface sent back the group's current disclosure\n       * key (AGL-3320), and this site alone otherwise. An undeclared group is\n       * still a group of one, so an agency is unchanged and configures\n       * nothing.\n       *\n       * Resolved above the transaction — see `group`'s declaration.\n       */\n      const prior = readMarketingBasis(existing.data() ?? null, group)\n      const consentAtMs =\n        prior.basis === 'granted' && prior.basisAtMs !== null\n          ? prior.basisAtMs\n          : now\n      created = !existing.exists\n      /*\n       * THE FIELDS THE LEADS LIST QUERIES (AGL-3321), from the lead as it\n       * will stand: what the transaction read, the address and name this\n       * capture brings and the scope it widens. A new lead is written\n       * `status: 'new'`, so the Open view's `status in [new, working]`\n       * finds a lead nobody has touched — an absent field matches no query.\n       */\n      const stored = existing.data() ?? {}\n      const storedScope = Array.isArray(stored['visibleTo']) ? (stored['visibleTo'] as unknown[]) : []\n      const listFields = crmLeadListFields({\n        ...stored,\n        email: lead.email,\n        ...(lead.name ? { name: lead.name } : {}),\n        visibleTo: [...new Set([...storedScope, ...scope])],\n      })\n      tx.set(\n        leadRef,\n        {\n          email: lead.email,\n          ...seen,\n          ...listFields,\n          /*\n           * WIDENED BY THE CAPTURE, NEVER BY THE LOOKUP (AGL-3275).\n           *\n           * `arrayUnion` rather than a replace, exactly as `upsert-contact`\n           * stamps a contact: this site just collected this person, so it may\n           * see the row. A site that merely FOUND them — the unscoped dedupe\n           * lookup in `readLeadForHost` — gains nothing, which is what keeps\n           * an agency's clients apart on a record they share.\n           */\n          visibleTo: FieldValue.arrayUnion(...scope),\n          /*\n           * EVERY SITE THAT CAPTURED THIS PERSON, not just the first\n           * (AGL-3275).\n           *\n           * This was written once, on create, and that was sound while the\n           * collection sat under one host and could hold only that host's\n           * name. On the org the row is shared, so a sibling brand capturing\n           * a person the first brand already holds has to be recorded here or\n           * the \"Known by\" answer silently omits it — the same `arrayUnion`\n           * the contact door has always used for this field, now that a lead\n           * has the same question to answer.\n           */\n          [CAPTURED_BY_HOST_FIELD]: FieldValue.arrayUnion(hostId),\n          ...(existing.exists\n            ? {}\n            : {\n                firstSeenAtMs: now,\n                createdAt: FieldValue.serverTimestamp(),\n              }),\n          /*\n           * The basis is recorded under the GROUP, keyed by its host, because\n           * {@link readMarketingBasis} is one function over four silos and a\n           * silo whose basis lived somewhere else would need the reader to\n           * know which collection it was handed. A reader that has to be told\n           * the shape is a reader that can be told the wrong one.\n           */\n          ...(lead.marketingConsent\n            ? marketingConsentFieldsForGroup(\n                consentGroupForGrant(group, lead.disclosedConsentGroup),\n                consentAtMs,\n              )\n            : {}),\n        },\n        { merge: true },\n      )\n      return false\n    })\n    if (refused) {\n      await recordVisitorRecordCeilingTrip({\n        hostRef,\n        hostId,\n        kind: 'leads',\n        ceiling: maxPerHost,\n      })\n      return false\n    }\n    /*\n     * ATTRIBUTED ON CREATION ONLY.\n     *\n     * A returning visitor's capture is an update — the campaign did not\n     * produce a lead, it produced another visit by a person the site already\n     * held — and crediting it would let whichever campaign ran most recently\n     * re-earn every lead on the list. `created` is set inside the transaction\n     * that decides it, so the attribution and the write agree about whether\n     * this person is new.\n     *\n     * Awaited rather than fired off: `addHostLead` already returns only after\n     * its own write, and a caller that `void`s it (every one of them) is\n     * unaffected. Never throws, so a failure here cannot cost the lead.\n     */\n    if (created && options.touch) {\n      await attributeCampaignConversion({\n        hostId,\n        kind: 'lead',\n        refId: leadRef.id,\n        touch: options.touch,\n        convertedAtMs: now,\n      })\n    }\n    return true\n  } catch (error) {\n    // Same posture the three original call sites had (`.catch(() => undefined)`\n    // / `.catch(console.error)`): a lead that failed to store must not fail\n    // the sign-up or the booking that produced it.\n    console.error('lead write failed', error)\n    return false\n  }\n}\n"],"names":["CAPTURED_BY_HOST_FIELD","checkVisitorRecordCeiling","LEADS_MAX_PER_HOST","marketingConsentFieldsForGroup","personKey","readMarketingBasis","submissionMonthKey","visitorRecordRefusedCounterId","FieldValue","attributeCampaignConversion","notifyHostManagers","firebaseAdmin","consentGroupForSite","orgDataCollectionForHost","scopedToHost","crmLeadListFields","crmReadTokens","crmScopeTokens","consentGroupForGrant","firestore","app","orgLeadsForHost","hostId","orgLeadsQueryForHost","ref","query","leadReadTokensForHost","group","leadScopeForHost","org","readLeadForHost","key","orgRow","doc","get","exists","leadForWrite","existed","carried","recordVisitorRecordCeilingTrip","options","hostRef","kind","ceiling","monthKey","refusedSnapshot","refusedRef","collection","alreadyRefused","Number","set","increment","lastRefusedAtMs","Date","now","merge","leads","type","title","body","toLocaleString","link","error","console","addHostLead","lead","maxPerHost","leadsRef","email","leadRef","scope","seen","sources","arrayUnion","source","lastSeenAtMs","submissionCount","name","created","refused","runTransaction","tx","existing","used","count","data","exceeded","prior","consentAtMs","basis","basisAtMs","stored","storedScope","Array","isArray","listFields","visibleTo","Set","firstSeenAtMs","createdAt","serverTimestamp","marketingConsent","disclosedConsentGroup","touch","refId","id","convertedAtMs"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;CAQC,GAED,SACEA,sBAAsB,EACtBC,yBAAyB,EACzBC,kBAAkB,EAClBC,8BAA8B,EAC9BC,SAAS,EACTC,kBAAkB,EAClBC,kBAAkB,EAClBC,6BAA6B,QAExB,sBAAqB;AAC5B,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SACEC,2BAA2B,QAEtB,uCAAmC;AAC1C,SAASC,kBAAkB,QAAQ,qBAAiB;AACpD,OAAOC,mBAAmB,sBAAkB;AAC5C,SACEC,mBAAmB,EACnBC,wBAAwB,EAExBC,YAAY,QACP,qBAAiB;AACxB,SAASC,iBAAiB,EAAEC,aAAa,EAAEC,cAAc,QAAQ,sBAAqB;AAEtF,8EAA8E;AAC9E,8EAA8E;AAC9E,SAASC,oBAAoB,QAAQ,wCAAuC;AAE5E,MAAMC,YAAY,IAAMR,cAAcS,GAAG,GAAGD,SAAS;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CC,GAGD;;;CAGC,GACD,OAAO,eAAeE,gBACpBC,MAAc;IAEd,OAAOT,yBAAyBS,QAAQ;AAC1C;AAEA;;;;;;CAMC,GACD,OAAO,eAAeC,qBAAqBD,MAAc;IAIvD,MAAME,MAAM,MAAMH,gBAAgBC;IAClC,OAAO;QAAEE;QAAKC,OAAOX,aAAaU,KAAKF;IAAQ;AACjD;AAEA;;;CAGC,GACD,OAAO,eAAeI,sBACpBJ,MAAc,EACdK,KAAoB;IAEpB,OAAOX,cAAcW,gBAAAA,QAAU,MAAMf,oBAAoBU;AAC3D;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAeM,iBACpBN,MAAc,EACdO,GAAoC;IAEpC,MAAMF,QAAQ,MAAMf,oBAAoBU,QAAQO;IAChD,OAAOZ,eAAeY,cAAAA,MAAO,MAAMF;AACrC;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,eAAeG,gBACpBR,MAAc,EACdS,GAAW;IAEX,MAAMC,SAAS,MAAM,AAAC,CAAA,MAAMX,gBAAgBC,OAAM,EAAGW,GAAG,CAACF,KAAKG,GAAG;IACjE,OAAOF,OAAOG,MAAM,GAAGH,SAAS;AAClC;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAeI,aACpBd,MAAc,EACdS,GAAW;IAMX,MAAMP,MAAM,AAAC,CAAA,MAAMH,gBAAgBC,OAAM,EAAGW,GAAG,CAACF;IAChD,OAAO;QAAEP;QAAKa,SAAS,AAAC,CAAA,MAAMb,IAAIU,GAAG,EAAC,EAAGC,MAAM;QAAEG,SAAS;IAAM;AAClE;AAGA;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,OAAO,eAAeC,+BAA+BC,OAMpD;QAEkBA;IADjB,MAAM,EAAEC,OAAO,EAAEnB,MAAM,EAAEoB,IAAI,EAAEC,OAAO,EAAE,GAAGH;IAC3C,MAAMI,YAAWJ,oBAAAA,QAAQI,QAAQ,YAAhBJ,oBAAoBlC;IACrC,IAAI;YAK4BuC;QAJ9B,MAAMC,aAAaL,QAChBM,UAAU,CAAC,YACXd,GAAG,CAAC1B,8BAA8BmC;QACrC,MAAMG,kBAAkB,MAAMC,WAAWZ,GAAG;QAC5C,MAAMc,iBAAiBC,QAAOJ,uBAAAA,gBAAgBX,GAAG,CAACU,qBAApBC,uBAAiC;QAC/D,MAAMC,WAAWI,GAAG,CAClB;YACE,CAACN,SAAS,EAAEpC,WAAW2C,SAAS,CAAC;YACjC,wDAAwD;YACxDR;YACAS,iBAAiBC,KAAKC,GAAG;QAC3B,GACA;YAAEC,OAAO;QAAK;QAEhB,IAAIP,mBAAmB,GAAG;YACxB,MAAMQ,QAAQd,SAAS;YACvB,MAAMhC,mBAAmBY,QAAQ;gBAC/BmC,MAAM;gBACNC,OAAOF,QACH,6DACA;gBACJG,MACE,CAAC,gBAAgB,EAAEhB,QAAQiB,cAAc,GAAG,CAAC,CAAC,GAC9C,GAAGJ,QAAQ,UAAU,kBAAkB,wBAAwB,CAAC,GAChE,CAAC,yBAAyB,EAAEA,QAAQ,UAAU,WAAW,KAAK,CAAC,GAC/D,+DACA,CAAC,mBAAmB,EAAEA,QAAQ,UAAU,kBAAkB,EAAE,CAAC,GAC7D,CAAC,YAAY,EAAEA,QAAQ,UAAU,UAAU,qBAAqB,CAAC,GACjE;gBACFK,MAAM,CAAC,CAAC,EAAEvC,OAAO,MAAM,CAAC;YAC1B;QACF;IACF,EAAE,OAAOwC,OAAO;QACdC,QAAQD,KAAK,CAAC,6CAA6CA;IAC7D;AACF;AA2BA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkDC,GACD,OAAO,eAAeE,YAAYxB,OAuBjC;QAEoBA;IADnB,MAAM,EAAEC,OAAO,EAAEnB,MAAM,EAAE2C,IAAI,EAAE,GAAGzB;IAClC,MAAM0B,cAAa1B,mBAAAA,QAAQG,OAAO,YAAfH,mBAAmBtC;IACtC,IAAI;QACF,MAAMiE,WAAW,MAAM9C,gBAAgBC;QACvC,MAAMH,YAAYsB,QAAQtB,SAAS;QACnC;;;;;KAKC,GACD,MAAMY,MAAM3B,UAAU6D,KAAKG,KAAK;QAChC;;;;;;;KAOC,GACD,MAAMC,UAAUtC,MACZ,AAAC,CAAA,MAAMK,aAAad,QAAQS,IAAG,EAAGP,GAAG,GACrC2C,SAASlC,GAAG;QAChB;;;;;;KAMC,GACD,MAAMqC,QAAQ,MAAM1C,iBAAiBN;QACrC,MAAMK,QAAQ,MAAMf,oBAAoBU;QACxC,MAAMgC,MAAMD,KAAKC,GAAG;QACpB,MAAMiB,OAAO;YACX,sEAAsE;YACtE,mEAAmE;YACnE,qDAAqD;YACrDC,SAAShE,WAAWiE,UAAU,CAACR,KAAKS,MAAM;YAC1CC,cAAcrB;YACdsB,iBAAiBpE,WAAW2C,SAAS,CAAC;WAClCc,KAAKY,IAAI,GAAG;YAAEA,MAAMZ,KAAKY,IAAI;QAAC,IAAI,CAAC;QAEzC,IAAIC,UAAU;QACd,MAAMC,UAAU,MAAM5D,UAAU6D,cAAc,CAAC,OAAOC;gBA+EnBC,gBAalBA;YA3Ff,qEAAqE;YACrE,qEAAqE;YACrE,iDAAiD;YACjDJ,UAAU;YACV,wDAAwD;YACxD,MAAMI,WAAW,MAAMD,GAAG/C,GAAG,CAACmC;YAC9B;;;;;;;;;;;;OAYC,GACD,IAAI,CAACa,SAAS/C,MAAM,EAAE;gBACpB;;;;;;;;;;;;;SAaC,GACD,MAAMgD,OAAO,AACX,CAAA,MAAMF,GAAG/C,GAAG,CAACpB,aAAaqD,UAAU7C,QAAQ8D,KAAK,GAAE,EACnDC,IAAI,GAAGD,KAAK;gBACd,IAAInF,0BAA0BkF,MAAMjB,YAAYoB,QAAQ,EAAE,OAAO;YACnE;YACA;;;;;;;;OAQC,GACD;;;;;;OAMC,GACD;;;;;;;;;;;;;;;;;;;;;;OAsBC,GACD,MAAMC,QAAQlF,oBAAmB6E,iBAAAA,SAASG,IAAI,cAAbH,iBAAmB,MAAMvD;YAC1D,MAAM6D,cACJD,MAAME,KAAK,KAAK,aAAaF,MAAMG,SAAS,KAAK,OAC7CH,MAAMG,SAAS,GACfpC;YACNwB,UAAU,CAACI,SAAS/C,MAAM;YAC1B;;;;;;OAMC,GACD,MAAMwD,UAAST,kBAAAA,SAASG,IAAI,cAAbH,kBAAmB,CAAC;YACnC,MAAMU,cAAcC,MAAMC,OAAO,CAACH,MAAM,CAAC,YAAY,IAAKA,MAAM,CAAC,YAAY,GAAiB,EAAE;YAChG,MAAMI,aAAahF,kBAAkB,aAChC4E;gBACHvB,OAAOH,KAAKG,KAAK;eACbH,KAAKY,IAAI,GAAG;gBAAEA,MAAMZ,KAAKY,IAAI;YAAC,IAAI,CAAC;gBACvCmB,WAAW;uBAAI,IAAIC,IAAI;2BAAIL;2BAAgBtB;qBAAM;iBAAE;;YAErDW,GAAG/B,GAAG,CACJmB,SACA;gBACED,OAAOH,KAAKG,KAAK;eACdG,MACAwB;gBACH;;;;;;;;WAQC,GACDC,WAAWxF,WAAWiE,UAAU,IAAIH;gBACpC;;;;;;;;;;;WAWC,GACD,CAACtE,uBAAuB,EAAEQ,WAAWiE,UAAU,CAACnD;eAC5C4D,SAAS/C,MAAM,GACf,CAAC,IACD;gBACE+D,eAAe5C;gBACf6C,WAAW3F,WAAW4F,eAAe;YACvC,GAQAnC,KAAKoC,gBAAgB,GACrBlG,+BACEe,qBAAqBS,OAAOsC,KAAKqC,qBAAqB,GACtDd,eAEF,CAAC,IAEP;gBAAEjC,OAAO;YAAK;YAEhB,OAAO;QACT;QACA,IAAIwB,SAAS;YACX,MAAMxC,+BAA+B;gBACnCE;gBACAnB;gBACAoB,MAAM;gBACNC,SAASuB;YACX;YACA,OAAO;QACT;QACA;;;;;;;;;;;;;KAaC,GACD,IAAIY,WAAWtC,QAAQ+D,KAAK,EAAE;YAC5B,MAAM9F,4BAA4B;gBAChCa;gBACAoB,MAAM;gBACN8D,OAAOnC,QAAQoC,EAAE;gBACjBF,OAAO/D,QAAQ+D,KAAK;gBACpBG,eAAepD;YACjB;QACF;QACA,OAAO;IACT,EAAE,OAAOQ,OAAO;QACd,4EAA4E;QAC5E,wEAAwE;QACxE,+CAA+C;QAC/CC,QAAQD,KAAK,CAAC,qBAAqBA;QACnC,OAAO;IACT;AACF"}

package/src/lib/server/list-members.d.ts

@@ -37,6 +37,17 @@
  */
 import type { DocumentReference } from 'firebase-admin/firestore';
 import { type ConsentGroup } from '@aglyn/aglyn/server';
+/**
+ * What a list's membership table searches a member by (AGL-3321): the word
+ * prefixes of their name and of their address (`emailSearchTokens`), one
+ * array, so one `array-contains` finds "dana" in either.
+ *
+ * Mirrored by `tools/scripts/backfill-email-list-filters.mjs`, which stamps
+ * the rows written before the field; the two are held to the same fixtures
+ * (`tools/scripts/lib/email-search-tokens.fixtures.json`, which the
+ * script-side twin in `tools/scripts/lib/email-search-tokens.mjs` answers too).
+ */
+export declare function listMemberSearchTokens(email: string | null | undefined, name: string | null | undefined): string[];
 /**
  * Every document id one address may be filed under on a list's `members`:
  * the canonical key first, then the two ids earlier writers minted. A

package/src/lib/server/list-members.js

@@ -37,7 +37,26 @@
 import { FieldValue } from "firebase-admin/firestore";
 import { normalizeContactEmail, personKey, CAPTURED_BY_HOST_FIELD, MARKETING_CONSENT_BASIS_FIELD, MARKETING_CONSENT_BY_HOST_FIELD, MARKETING_CONSENT_FIELD, marketingConsentFieldsForGroup, readMarketingBasis } from "@aglyn/aglyn/server";
 import { consentGroupForGrant } from "@aglyn/aglyn/app-utils/consent-groups";
+import { nameSearchTokens } from "@aglyn/aglyn/app-utils/name-search";
 import { createHash, createHmac } from "node:crypto";
+import { emailSearchTokens } from "./email-suppression.js";
+/**
+ * What a list's membership table searches a member by (AGL-3321): the word
+ * prefixes of their name and of their address (`emailSearchTokens`), one
+ * array, so one `array-contains` finds "dana" in either.
+ *
+ * Mirrored by `tools/scripts/backfill-email-list-filters.mjs`, which stamps
+ * the rows written before the field; the two are held to the same fixtures
+ * (`tools/scripts/lib/email-search-tokens.fixtures.json`, which the
+ * script-side twin in `tools/scripts/lib/email-search-tokens.mjs` answers too).
+ */ export function listMemberSearchTokens(email, name) {
+    return [
+        ...new Set([
+            ...emailSearchTokens(email),
+            ...nameSearchTokens(name)
+        ])
+    ];
+}
 /**
  * The two ids this collection was written under before `personKey`.
  *
@@ -146,15 +165,23 @@ import { createHash, createHmac } from "node:crypto";
         basis: 'contact-opt-in',
         atMs: Date.now()
     } : null;
+    /*
+   * The name the row will hold after this write — the caller's, else the one
+   * it already carries — because the search tokens are the address's and
+   * that name's, and a re-enrollment without a name keeps the stored one.
+   */ const name = input.name || (existing == null ? void 0 : existing.get('name')) || null;
     await target.set(_extends({
         email
     }, input.name ? {
         name: input.name
     } : {}, {
+        searchTokens: listMemberSearchTokens(email, name),
         source: input.source
     }, input.via ? {
         via: input.via
-    } : {}, consent ? membershipConsentFields(input, consent) : {}, existing ? {} : {
+    } : (existing == null ? void 0 : existing.get('via')) ? {} : {
+        via: 'manual'
+    }, consent ? membershipConsentFields(input, consent) : {}, existing ? {} : {
         addedAt: FieldValue.serverTimestamp(),
         [CAPTURED_BY_HOST_FIELD]: [
             input.group.hostId