@aglyn/tenant-data-admin 1.0.0-beta.217 → 1.0.0-beta.219

package/src/lib/server/contact-merge.js

@@ -1,288 +0,0 @@
-import { _ as _extends } from "@swc/helpers/_/_extends";
-/**
- * @license
- * Copyright 2026 Aglyn LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */ /**
- * MERGING TWO CONTACTS — the write (AGL-2625).
- *
- * `planContactMerge` says what the survivor becomes; this performs it, and
- * moves everything that pointed at the merged record. One function behind
- * two doors — the console's `crm/contacts-merge` route and
- * `POST /v1/contacts/{id}/merge` — so the REST caller and the record page
- * cannot merge two different ways.
- *
- * ## The order is the crash-safety argument
- *
- *  1. Every deal, task and activity naming the merged contact is repointed
- *     at the survivor, and every lead converted into it. Batched, bounded,
- *     idempotent: a re-run finds nothing left to move.
- *  2. Then, in ONE transaction: the survivor takes the plan, every address
- *     it now answers to is indexed at it, and the merged document is
- *     deleted — with both records re-read inside the transaction, so two
- *     merges racing on one pair cannot both succeed and a plan is never
- *     computed on a document that changed under it.
- *
- * Children first because a process that dies between the two steps leaves
- * children pointing at a record that EXISTS — the survivor — while the merged
- * document is still there for a retry to fold in. The other order would
- * leave deals pointing at a deleted contact, which is a record nobody can
- * open from anywhere.
- *
- * ## What it does not move
- *
- * List memberships, suppression entries and the delivery log are keyed by
- * ADDRESS, not by contact id, and stay under the merged address; a capture
- * on that address resolves to the survivor through the index, which is the
- * fact those keys need. A company's contacts count drops only for a company
- * both records named — the survivor still names the rest.
- */ import { CONTACT_EMAIL_INDEX_COLLECTION, contactEmails } from "@aglyn/aglyn/app-utils/contacts";
-import { planContactMerge } from "@aglyn/aglyn/app-utils/contact-merge";
-import { CRM_COLLECTIONS } from "@aglyn/aglyn/app-utils/crm";
-import { personKey } from "@aglyn/aglyn/app-utils/person-key";
-import { FieldValue } from "firebase-admin/firestore";
-import { settleCompanyContactsCounts } from "./contact-company-link.js";
-import { recomputeCrmNextTaskAt } from "./crm-next-activity.js";
-import { restampCrmListFieldsAt } from "./crm-records.js";
-import { logHostActivity } from "./organizations.js";
-/** How many pointing rows one repoint pass reads — and one batch writes. */ const REPOINT_PAGE = 400;
-/** A ceiling on passes, so a query that keeps answering cannot loop forever. */ const REPOINT_PASSES = 25;
-/**
- * Point every row of `collection` whose `contactId` is `from` at `to`.
- *
- * Page, batch, repeat: each pass reads the rows still pointing at the
- * merged record — the ones a previous pass moved no longer match — so the
- * loop ends when a pass finds nothing. `updatedAt` moves with the pointer
- * because an integration syncing by `updatedAfter` has to see the change.
- */ async function repointContactId(firestore, collection, from, to) {
-    let moved = 0;
-    for(let pass = 0; pass < REPOINT_PASSES; pass += 1){
-        const page = await collection.where('contactId', '==', from).limit(REPOINT_PAGE).get();
-        if (page.empty) break;
-        const batch = firestore.batch();
-        for (const row of page.docs){
-            batch.update(row.ref, {
-                contactId: to,
-                updatedAt: FieldValue.serverTimestamp()
-            });
-        }
-        await batch.commit();
-        moved += page.size;
-        if (page.size < REPOINT_PAGE) break;
-    }
-    return moved;
-}
-/**
- * The leads converted into the merged contact, restamped at the survivor.
- *
- * A lead lives at `orgs/{orgId}/leads/{personKey(email)}` (AGL-3275), so there
- * is still no query — one document per address, asked for directly. This used
- * to be bounded by sites TIMES addresses because a lead lived under each site;
- * it is bounded by addresses now, and the sites drop out of the signature
- * because the collection no longer has one per site to walk.
- */ async function repointLeads(orgRef, emails, from, to) {
-    let moved = 0;
-    /*
-   * ONE ROW PER ADDRESS, on the org (AGL-3275). This walked the sites because
-   * there was a lead under each of them; re-pointing the same document once
-   * per site would now be the same write repeated, and the second would find
-   * `convertedContactId` already moved and skip — a silent undercount rather
-   * than a wrong answer, but an undercount the caller reports to the operator.
-   */ for (const email of emails){
-        const key = personKey(email);
-        if (!key) continue;
-        const leadRef = orgRef.collection('leads').doc(key);
-        const lead = await leadRef.get();
-        if (!lead.exists || lead.get('convertedContactId') !== from) continue;
-        await leadRef.update({
-            convertedContactId: to,
-            updatedAt: FieldValue.serverTimestamp()
-        });
-        moved += 1;
-    }
-    return moved;
-}
-function strings(value) {
-    return Array.isArray(value) ? value.filter((item)=>typeof item === 'string' && item !== '') : [];
-}
-export async function mergeContacts(options) {
-    var _mergedBefore_data, _survivorBefore_data, _contactEmails_, _plan_emails_;
-    const { firestore, orgRef, survivorId, mergedId, actor, hostId } = options;
-    if (!survivorId || !mergedId || survivorId === mergedId) {
-        return {
-            ok: false,
-            reason: 'same-record'
-        };
-    }
-    const contactsRef = orgRef.collection('contacts');
-    const survivorRef = contactsRef.doc(survivorId);
-    const mergedRef = contactsRef.doc(mergedId);
-    const [survivorBefore, mergedBefore] = await Promise.all([
-        survivorRef.get(),
-        mergedRef.get()
-    ]);
-    if (!survivorBefore.exists) return {
-        ok: false,
-        reason: 'survivor-missing'
-    };
-    if (!mergedBefore.exists) return {
-        ok: false,
-        reason: 'merged-missing'
-    };
-    const mergedData = (_mergedBefore_data = mergedBefore.data()) != null ? _mergedBefore_data : {};
-    const survivorData = (_survivorBefore_data = survivorBefore.data()) != null ? _survivorBefore_data : {};
-    /*==========================================
-   * 1. THE CHILDREN — before the parent, for the reason the header gives.
-   *=========================================*/ const [deals, tasks, activities] = await Promise.all([
-        repointContactId(firestore, orgRef.collection(CRM_COLLECTIONS.deals), mergedId, survivorId),
-        repointContactId(firestore, orgRef.collection(CRM_COLLECTIONS.tasks), mergedId, survivorId),
-        repointContactId(firestore, orgRef.collection(CRM_COLLECTIONS.activities), mergedId, survivorId)
-    ]);
-    const leadHosts = [
-        ...new Set([
-            ...strings(mergedData['capturedByHostIds']),
-            ...strings(survivorData['capturedByHostIds']),
-            ...strings([
-                mergedData['hostId'],
-                survivorData['hostId'],
-                hostId
-            ])
-        ])
-    ];
-    const leads = await repointLeads(orgRef, contactEmails(mergedData), mergedId, survivorId);
-    /*==========================================
-   * 2. THE SWAP — one transaction over both documents and the index.
-   *=========================================*/ const index = orgRef.collection(CONTACT_EMAIL_INDEX_COLLECTION);
-    const swapped = await firestore.runTransaction(async (transaction)=>{
-        var _survivor_data, _merged_data, _survivor_data1;
-        const [survivor, merged] = await Promise.all([
-            transaction.get(survivorRef),
-            transaction.get(mergedRef)
-        ]);
-        if (!survivor.exists) return {
-            reason: 'survivor-missing'
-        };
-        if (!merged.exists) return {
-            reason: 'merged-missing'
-        };
-        const plan = planContactMerge((_survivor_data = survivor.data()) != null ? _survivor_data : {}, (_merged_data = merged.data()) != null ? _merged_data : {});
-        transaction.set(survivorRef, _extends({}, plan.survivor, {
-            updatedAt: FieldValue.serverTimestamp()
-        }), {
-            merge: true
-        });
-        for (const email of plan.emails){
-            const key = personKey(email);
-            if (!key) continue;
-            transaction.set(index.doc(key), {
-                email,
-                contactId: survivorId,
-                updatedAt: FieldValue.serverTimestamp()
-            }, {
-                merge: true
-            });
-        }
-        transaction.delete(mergedRef);
-        return {
-            plan,
-            survivor: (_survivor_data1 = survivor.data()) != null ? _survivor_data1 : {}
-        };
-    });
-    if ('reason' in swapped) return {
-        ok: false,
-        reason: swapped.reason
-    };
-    const { plan } = swapped;
-    // The survivor now carries both records' addresses, holders and facets —
-    // what the Contacts list searches and filters by (AGL-3321).
-    await restampCrmListFieldsAt(survivorRef, 'contacts');
-    /*
-   * The companies both records named counted two people and now count one
-   * (AGL-2613). Settled after the swap the way the capture settles its
-   * counts: a figure that could not move is logged, and the company page's
-   * live aggregate corrects it.
-   */ await settleCompanyContactsCounts(orgRef.collection(CRM_COLLECTIONS.companies), {
-        companyId: null,
-        mirror: null,
-        counts: plan.companyCounts
-    });
-    /*
-   * The survivor now owns the merged record's open tasks too, so its next
-   * activity is the earliest of both (AGL-2661). Settled the same way: a
-   * figure that could not move is logged, and the Fields section's
-   * recompute corrects it.
-   */ await recomputeCrmNextTaskAt(firestore, orgRef.id, [
-        {
-            contactId: survivorId
-        }
-    ]).catch((error)=>{
-        console.error('contact merge next activity could not be recomputed', survivorId, error);
-    });
-    const mergedEmail = (_contactEmails_ = contactEmails(mergedData)[0]) != null ? _contactEmails_ : '';
-    const survivorEmail = (_plan_emails_ = plan.emails[0]) != null ? _plan_emails_ : '';
-    // The canonical name — the one identity every holder shares — for the
-    // feed; the address stands in for a person nobody has named.
-    const survivorName = typeof swapped.survivor['name'] === 'string' ? swapped.survivor['name'] : '';
-    /*
-   * THE TIMELINE NOTE, on the survivor: the merge is an event in this
-   * person's history, and the record page is where a reader looks for one.
-   * Filed under the calling site, or the survivor's first site for a door
-   * with none; its own catch, because a note that could not be written must
-   * not read as a merge that did not happen.
-   */ try {
-        var _survivorData_hostId;
-        await orgRef.collection(CRM_COLLECTIONS.activities).add(_extends({
-            kind: 'note',
-            body: `Merged with ${mergedEmail}`,
-            atMs: Date.now(),
-            byUid: actor.uid
-        }, options.actorName || actor.email ? {
-            byName: options.actorName || actor.email
-        } : {}, {
-            contactId: survivorId,
-            visibleTo: plan.visibleTo,
-            hostId: hostId != null ? hostId : String((_survivorData_hostId = survivorData['hostId']) != null ? _survivorData_hostId : ''),
-            createdByUid: actor.uid,
-            createdAt: FieldValue.serverTimestamp(),
-            updatedAt: FieldValue.serverTimestamp()
-        }));
-    } catch (error) {
-        console.error('[contact-merge] timeline note failed', survivorId, error);
-    }
-    // The audit line (AGL-2622), in the feed of the site whose console did
-    // the work. A door with no site — the API — has no host feed to write.
-    if (hostId) {
-        await logHostActivity(hostId, actor, `Merged with ${mergedEmail}`, {
-            type: 'contact',
-            id: survivorId,
-            name: survivorName || survivorEmail
-        });
-    }
-    return {
-        ok: true,
-        survivorId,
-        survivorEmail,
-        mergedId,
-        mergedEmail,
-        emails: plan.emails,
-        repointed: {
-            deals,
-            tasks,
-            activities,
-            leads
-        }
-    };
-}
-
-//# sourceMappingURL=contact-merge.js.map

package/src/lib/server/contact-merge.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/contact-merge.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * MERGING TWO CONTACTS — the write (AGL-2625).\n *\n * `planContactMerge` says what the survivor becomes; this performs it, and\n * moves everything that pointed at the merged record. One function behind\n * two doors — the console's `crm/contacts-merge` route and\n * `POST /v1/contacts/{id}/merge` — so the REST caller and the record page\n * cannot merge two different ways.\n *\n * ## The order is the crash-safety argument\n *\n *  1. Every deal, task and activity naming the merged contact is repointed\n *     at the survivor, and every lead converted into it. Batched, bounded,\n *     idempotent: a re-run finds nothing left to move.\n *  2. Then, in ONE transaction: the survivor takes the plan, every address\n *     it now answers to is indexed at it, and the merged document is\n *     deleted — with both records re-read inside the transaction, so two\n *     merges racing on one pair cannot both succeed and a plan is never\n *     computed on a document that changed under it.\n *\n * Children first because a process that dies between the two steps leaves\n * children pointing at a record that EXISTS — the survivor — while the merged\n * document is still there for a retry to fold in. The other order would\n * leave deals pointing at a deleted contact, which is a record nobody can\n * open from anywhere.\n *\n * ## What it does not move\n *\n * List memberships, suppression entries and the delivery log are keyed by\n * ADDRESS, not by contact id, and stay under the merged address; a capture\n * on that address resolves to the survivor through the index, which is the\n * fact those keys need. A company's contacts count drops only for a company\n * both records named — the survivor still names the rest.\n */\n\nimport {\n  CONTACT_EMAIL_INDEX_COLLECTION,\n  contactEmails,\n} from '@aglyn/aglyn/app-utils/contacts'\nimport type { HostActivityActor } from '@aglyn/aglyn/app-utils/activity-presenter'\nimport { planContactMerge } from '@aglyn/aglyn/app-utils/contact-merge'\nimport { CRM_COLLECTIONS } from '@aglyn/aglyn/app-utils/crm'\nimport { personKey } from '@aglyn/aglyn/app-utils/person-key'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { settleCompanyContactsCounts } from './contact-company-link'\nimport { recomputeCrmNextTaskAt } from './crm-next-activity'\nimport { restampCrmListFieldsAt } from './crm-records'\nimport { logHostActivity } from './organizations'\n\n/** How many pointing rows one repoint pass reads — and one batch writes. */\nconst REPOINT_PAGE = 400\n/** A ceiling on passes, so a query that keeps answering cannot loop forever. */\nconst REPOINT_PASSES = 25\n\nexport interface MergeContactsOptions {\n  firestore: FirebaseFirestore.Firestore\n  /** `orgs/{orgId}` — the org whose contacts both records are. */\n  orgRef: FirebaseFirestore.DocumentReference\n  /** The record that stays, and keeps its address as the identity. */\n  survivorId: string\n  /** The record folded in and deleted. */\n  mergedId: string\n  actor: HostActivityActor\n  /**\n   * The site whose console did the work: where the activity feed entry\n   * lands, and the site a timeline note is filed under. `null` for a door\n   * with no site — the REST API — which logs no host entry.\n   */\n  hostId: string | null\n  /** The actor's display name for the timeline note, when the door knows it. */\n  actorName?: string | null\n}\n\nexport interface MergeContactsRepointed {\n  deals: number\n  tasks: number\n  activities: number\n  leads: number\n}\n\nexport type MergeContactsResult =\n  | {\n      ok: true\n      survivorId: string\n      survivorEmail: string\n      mergedId: string\n      mergedEmail: string\n      /** Every address the survivor answers to now, primary first. */\n      emails: string[]\n      repointed: MergeContactsRepointed\n    }\n  | { ok: false; reason: 'same-record' | 'survivor-missing' | 'merged-missing' }\n\n/**\n * Point every row of `collection` whose `contactId` is `from` at `to`.\n *\n * Page, batch, repeat: each pass reads the rows still pointing at the\n * merged record — the ones a previous pass moved no longer match — so the\n * loop ends when a pass finds nothing. `updatedAt` moves with the pointer\n * because an integration syncing by `updatedAfter` has to see the change.\n */\nasync function repointContactId(\n  firestore: FirebaseFirestore.Firestore,\n  collection: FirebaseFirestore.CollectionReference,\n  from: string,\n  to: string,\n): Promise<number> {\n  let moved = 0\n  for (let pass = 0; pass < REPOINT_PASSES; pass += 1) {\n    const page = await collection\n      .where('contactId', '==', from)\n      .limit(REPOINT_PAGE)\n      .get()\n    if (page.empty) break\n    const batch = firestore.batch()\n    for (const row of page.docs) {\n      batch.update(row.ref, {\n        contactId: to,\n        updatedAt: FieldValue.serverTimestamp(),\n      })\n    }\n    await batch.commit()\n    moved += page.size\n    if (page.size < REPOINT_PAGE) break\n  }\n  return moved\n}\n\n/**\n * The leads converted into the merged contact, restamped at the survivor.\n *\n * A lead lives at `orgs/{orgId}/leads/{personKey(email)}` (AGL-3275), so there\n * is still no query — one document per address, asked for directly. This used\n * to be bounded by sites TIMES addresses because a lead lived under each site;\n * it is bounded by addresses now, and the sites drop out of the signature\n * because the collection no longer has one per site to walk.\n */\nasync function repointLeads(\n  orgRef: FirebaseFirestore.DocumentReference,\n  emails: readonly string[],\n  from: string,\n  to: string,\n): Promise<number> {\n  let moved = 0\n  /*\n   * ONE ROW PER ADDRESS, on the org (AGL-3275). This walked the sites because\n   * there was a lead under each of them; re-pointing the same document once\n   * per site would now be the same write repeated, and the second would find\n   * `convertedContactId` already moved and skip — a silent undercount rather\n   * than a wrong answer, but an undercount the caller reports to the operator.\n   */\n  for (const email of emails) {\n    const key = personKey(email)\n    if (!key) continue\n    const leadRef = orgRef.collection('leads').doc(key)\n    const lead = await leadRef.get()\n    if (!lead.exists || lead.get('convertedContactId') !== from) continue\n    await leadRef.update({\n      convertedContactId: to,\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n    moved += 1\n  }\n  return moved\n}\n\nfunction strings(value: unknown): string[] {\n  return Array.isArray(value)\n    ? value.filter((item): item is string => typeof item === 'string' && item !== '')\n    : []\n}\n\nexport async function mergeContacts(\n  options: MergeContactsOptions,\n): Promise<MergeContactsResult> {\n  const { firestore, orgRef, survivorId, mergedId, actor, hostId } = options\n  if (!survivorId || !mergedId || survivorId === mergedId) {\n    return { ok: false, reason: 'same-record' }\n  }\n  const contactsRef = orgRef.collection('contacts')\n  const survivorRef = contactsRef.doc(survivorId)\n  const mergedRef = contactsRef.doc(mergedId)\n  const [survivorBefore, mergedBefore] = await Promise.all([\n    survivorRef.get(),\n    mergedRef.get(),\n  ])\n  if (!survivorBefore.exists) return { ok: false, reason: 'survivor-missing' }\n  if (!mergedBefore.exists) return { ok: false, reason: 'merged-missing' }\n  const mergedData = (mergedBefore.data() ?? {}) as Record<string, unknown>\n  const survivorData = (survivorBefore.data() ?? {}) as Record<string, unknown>\n\n  /*==========================================\n   * 1. THE CHILDREN — before the parent, for the reason the header gives.\n   *=========================================*/\n  const [deals, tasks, activities] = await Promise.all([\n    repointContactId(firestore, orgRef.collection(CRM_COLLECTIONS.deals), mergedId, survivorId),\n    repointContactId(firestore, orgRef.collection(CRM_COLLECTIONS.tasks), mergedId, survivorId),\n    repointContactId(\n      firestore,\n      orgRef.collection(CRM_COLLECTIONS.activities),\n      mergedId,\n      survivorId,\n    ),\n  ])\n  const leadHosts = [\n    ...new Set([\n      ...strings(mergedData['capturedByHostIds']),\n      ...strings(survivorData['capturedByHostIds']),\n      ...strings([mergedData['hostId'], survivorData['hostId'], hostId]),\n    ]),\n  ]\n  const leads = await repointLeads(\n    orgRef,\n    contactEmails(mergedData),\n    mergedId,\n    survivorId,\n  )\n\n  /*==========================================\n   * 2. THE SWAP — one transaction over both documents and the index.\n   *=========================================*/\n  const index = orgRef.collection(CONTACT_EMAIL_INDEX_COLLECTION)\n  const swapped = await firestore.runTransaction(async (transaction) => {\n    const [survivor, merged] = await Promise.all([\n      transaction.get(survivorRef),\n      transaction.get(mergedRef),\n    ])\n    if (!survivor.exists) return { reason: 'survivor-missing' as const }\n    if (!merged.exists) return { reason: 'merged-missing' as const }\n    const plan = planContactMerge(\n      (survivor.data() ?? {}) as Record<string, unknown>,\n      (merged.data() ?? {}) as Record<string, unknown>,\n    )\n    transaction.set(\n      survivorRef,\n      { ...plan.survivor, updatedAt: FieldValue.serverTimestamp() },\n      { merge: true },\n    )\n    for (const email of plan.emails) {\n      const key = personKey(email)\n      if (!key) continue\n      transaction.set(\n        index.doc(key),\n        { email, contactId: survivorId, updatedAt: FieldValue.serverTimestamp() },\n        { merge: true },\n      )\n    }\n    transaction.delete(mergedRef)\n    return { plan, survivor: (survivor.data() ?? {}) as Record<string, unknown> }\n  })\n  if ('reason' in swapped) return { ok: false, reason: swapped.reason }\n  const { plan } = swapped\n  // The survivor now carries both records' addresses, holders and facets —\n  // what the Contacts list searches and filters by (AGL-3321).\n  await restampCrmListFieldsAt(survivorRef, 'contacts')\n\n  /*\n   * The companies both records named counted two people and now count one\n   * (AGL-2613). Settled after the swap the way the capture settles its\n   * counts: a figure that could not move is logged, and the company page's\n   * live aggregate corrects it.\n   */\n  await settleCompanyContactsCounts(orgRef.collection(CRM_COLLECTIONS.companies), {\n    companyId: null,\n    mirror: null,\n    counts: plan.companyCounts,\n  })\n  /*\n   * The survivor now owns the merged record's open tasks too, so its next\n   * activity is the earliest of both (AGL-2661). Settled the same way: a\n   * figure that could not move is logged, and the Fields section's\n   * recompute corrects it.\n   */\n  await recomputeCrmNextTaskAt(firestore, orgRef.id, [{ contactId: survivorId }]).catch(\n    (error: unknown) => {\n      console.error('contact merge next activity could not be recomputed', survivorId, error)\n    },\n  )\n\n  const mergedEmail = contactEmails(mergedData)[0] ?? ''\n  const survivorEmail = plan.emails[0] ?? ''\n  // The canonical name — the one identity every holder shares — for the\n  // feed; the address stands in for a person nobody has named.\n  const survivorName =\n    typeof swapped.survivor['name'] === 'string' ? swapped.survivor['name'] : ''\n\n  /*\n   * THE TIMELINE NOTE, on the survivor: the merge is an event in this\n   * person's history, and the record page is where a reader looks for one.\n   * Filed under the calling site, or the survivor's first site for a door\n   * with none; its own catch, because a note that could not be written must\n   * not read as a merge that did not happen.\n   */\n  try {\n    await orgRef.collection(CRM_COLLECTIONS.activities).add({\n      kind: 'note',\n      body: `Merged with ${mergedEmail}`,\n      atMs: Date.now(),\n      byUid: actor.uid,\n      ...(options.actorName || actor.email\n        ? { byName: options.actorName || actor.email }\n        : {}),\n      contactId: survivorId,\n      visibleTo: plan.visibleTo,\n      hostId: hostId ?? String(survivorData['hostId'] ?? ''),\n      createdByUid: actor.uid,\n      createdAt: FieldValue.serverTimestamp(),\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n  } catch (error) {\n    console.error('[contact-merge] timeline note failed', survivorId, error)\n  }\n\n  // The audit line (AGL-2622), in the feed of the site whose console did\n  // the work. A door with no site — the API — has no host feed to write.\n  if (hostId) {\n    await logHostActivity(hostId, actor, `Merged with ${mergedEmail}`, {\n      type: 'contact',\n      id: survivorId,\n      name: survivorName || survivorEmail,\n    })\n  }\n\n  return {\n    ok: true,\n    survivorId,\n    survivorEmail,\n    mergedId,\n    mergedEmail,\n    emails: plan.emails,\n    repointed: { deals, tasks, activities, leads },\n  }\n}\n"],"names":["CONTACT_EMAIL_INDEX_COLLECTION","contactEmails","planContactMerge","CRM_COLLECTIONS","personKey","FieldValue","settleCompanyContactsCounts","recomputeCrmNextTaskAt","restampCrmListFieldsAt","logHostActivity","REPOINT_PAGE","REPOINT_PASSES","repointContactId","firestore","collection","from","to","moved","pass","page","where","limit","get","empty","batch","row","docs","update","ref","contactId","updatedAt","serverTimestamp","commit","size","repointLeads","orgRef","emails","email","key","leadRef","doc","lead","exists","convertedContactId","strings","value","Array","isArray","filter","item","mergeContacts","options","mergedBefore","survivorBefore","plan","survivorId","mergedId","actor","hostId","ok","reason","contactsRef","survivorRef","mergedRef","Promise","all","mergedData","data","survivorData","deals","tasks","activities","leadHosts","Set","leads","index","swapped","runTransaction","transaction","survivor","merged","set","merge","delete","companies","companyId","mirror","counts","companyCounts","id","catch","error","console","mergedEmail","survivorEmail","survivorName","add","kind","body","atMs","Date","now","byUid","uid","actorName","byName","visibleTo","String","createdByUid","createdAt","type","name","repointed"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCC,GAED,SACEA,8BAA8B,EAC9BC,aAAa,QACR,kCAAiC;AAExC,SAASC,gBAAgB,QAAQ,uCAAsC;AACvE,SAASC,eAAe,QAAQ,6BAA4B;AAC5D,SAASC,SAAS,QAAQ,oCAAmC;AAC7D,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,2BAA2B,QAAQ,4BAAwB;AACpE,SAASC,sBAAsB,QAAQ,yBAAqB;AAC5D,SAASC,sBAAsB,QAAQ,mBAAe;AACtD,SAASC,eAAe,QAAQ,qBAAiB;AAEjD,0EAA0E,GAC1E,MAAMC,eAAe;AACrB,8EAA8E,GAC9E,MAAMC,iBAAiB;AAyCvB;;;;;;;CAOC,GACD,eAAeC,iBACbC,SAAsC,EACtCC,UAAiD,EACjDC,IAAY,EACZC,EAAU;IAEV,IAAIC,QAAQ;IACZ,IAAK,IAAIC,OAAO,GAAGA,OAAOP,gBAAgBO,QAAQ,EAAG;QACnD,MAAMC,OAAO,MAAML,WAChBM,KAAK,CAAC,aAAa,MAAML,MACzBM,KAAK,CAACX,cACNY,GAAG;QACN,IAAIH,KAAKI,KAAK,EAAE;QAChB,MAAMC,QAAQX,UAAUW,KAAK;QAC7B,KAAK,MAAMC,OAAON,KAAKO,IAAI,CAAE;YAC3BF,MAAMG,MAAM,CAACF,IAAIG,GAAG,EAAE;gBACpBC,WAAWb;gBACXc,WAAWzB,WAAW0B,eAAe;YACvC;QACF;QACA,MAAMP,MAAMQ,MAAM;QAClBf,SAASE,KAAKc,IAAI;QAClB,IAAId,KAAKc,IAAI,GAAGvB,cAAc;IAChC;IACA,OAAOO;AACT;AAEA;;;;;;;;CAQC,GACD,eAAeiB,aACbC,MAA2C,EAC3CC,MAAyB,EACzBrB,IAAY,EACZC,EAAU;IAEV,IAAIC,QAAQ;IACZ;;;;;;GAMC,GACD,KAAK,MAAMoB,SAASD,OAAQ;QAC1B,MAAME,MAAMlC,UAAUiC;QACtB,IAAI,CAACC,KAAK;QACV,MAAMC,UAAUJ,OAAOrB,UAAU,CAAC,SAAS0B,GAAG,CAACF;QAC/C,MAAMG,OAAO,MAAMF,QAAQjB,GAAG;QAC9B,IAAI,CAACmB,KAAKC,MAAM,IAAID,KAAKnB,GAAG,CAAC,0BAA0BP,MAAM;QAC7D,MAAMwB,QAAQZ,MAAM,CAAC;YACnBgB,oBAAoB3B;YACpBc,WAAWzB,WAAW0B,eAAe;QACvC;QACAd,SAAS;IACX;IACA,OAAOA;AACT;AAEA,SAAS2B,QAAQC,KAAc;IAC7B,OAAOC,MAAMC,OAAO,CAACF,SACjBA,MAAMG,MAAM,CAAC,CAACC,OAAyB,OAAOA,SAAS,YAAYA,SAAS,MAC5E,EAAE;AACR;AAEA,OAAO,eAAeC,cACpBC,OAA6B;QAeTC,oBACEC,sBA0FFpD,iBACEqD;IAzGtB,MAAM,EAAEzC,SAAS,EAAEsB,MAAM,EAAEoB,UAAU,EAAEC,QAAQ,EAAEC,KAAK,EAAEC,MAAM,EAAE,GAAGP;IACnE,IAAI,CAACI,cAAc,CAACC,YAAYD,eAAeC,UAAU;QACvD,OAAO;YAAEG,IAAI;YAAOC,QAAQ;QAAc;IAC5C;IACA,MAAMC,cAAc1B,OAAOrB,UAAU,CAAC;IACtC,MAAMgD,cAAcD,YAAYrB,GAAG,CAACe;IACpC,MAAMQ,YAAYF,YAAYrB,GAAG,CAACgB;IAClC,MAAM,CAACH,gBAAgBD,aAAa,GAAG,MAAMY,QAAQC,GAAG,CAAC;QACvDH,YAAYxC,GAAG;QACfyC,UAAUzC,GAAG;KACd;IACD,IAAI,CAAC+B,eAAeX,MAAM,EAAE,OAAO;QAAEiB,IAAI;QAAOC,QAAQ;IAAmB;IAC3E,IAAI,CAACR,aAAaV,MAAM,EAAE,OAAO;QAAEiB,IAAI;QAAOC,QAAQ;IAAiB;IACvE,MAAMM,cAAcd,qBAAAA,aAAae,IAAI,cAAjBf,qBAAuB,CAAC;IAC5C,MAAMgB,gBAAgBf,uBAAAA,eAAec,IAAI,cAAnBd,uBAAyB,CAAC;IAEhD;;6CAE2C,GAC3C,MAAM,CAACgB,OAAOC,OAAOC,WAAW,GAAG,MAAMP,QAAQC,GAAG,CAAC;QACnDrD,iBAAiBC,WAAWsB,OAAOrB,UAAU,CAACX,gBAAgBkE,KAAK,GAAGb,UAAUD;QAChF3C,iBAAiBC,WAAWsB,OAAOrB,UAAU,CAACX,gBAAgBmE,KAAK,GAAGd,UAAUD;QAChF3C,iBACEC,WACAsB,OAAOrB,UAAU,CAACX,gBAAgBoE,UAAU,GAC5Cf,UACAD;KAEH;IACD,MAAMiB,YAAY;WACb,IAAIC,IAAI;eACN7B,QAAQsB,UAAU,CAAC,oBAAoB;eACvCtB,QAAQwB,YAAY,CAAC,oBAAoB;eACzCxB,QAAQ;gBAACsB,UAAU,CAAC,SAAS;gBAAEE,YAAY,CAAC,SAAS;gBAAEV;aAAO;SAClE;KACF;IACD,MAAMgB,QAAQ,MAAMxC,aAClBC,QACAlC,cAAciE,aACdV,UACAD;IAGF;;6CAE2C,GAC3C,MAAMoB,QAAQxC,OAAOrB,UAAU,CAACd;IAChC,MAAM4E,UAAU,MAAM/D,UAAUgE,cAAc,CAAC,OAAOC;YAQjDC,gBACAC,cAiBuBD;QAzB1B,MAAM,CAACA,UAAUC,OAAO,GAAG,MAAMhB,QAAQC,GAAG,CAAC;YAC3Ca,YAAYxD,GAAG,CAACwC;YAChBgB,YAAYxD,GAAG,CAACyC;SACjB;QACD,IAAI,CAACgB,SAASrC,MAAM,EAAE,OAAO;YAAEkB,QAAQ;QAA4B;QACnE,IAAI,CAACoB,OAAOtC,MAAM,EAAE,OAAO;YAAEkB,QAAQ;QAA0B;QAC/D,MAAMN,OAAOpD,kBACV6E,iBAAAA,SAASZ,IAAI,cAAbY,iBAAmB,CAAC,IACpBC,eAAAA,OAAOb,IAAI,cAAXa,eAAiB,CAAC;QAErBF,YAAYG,GAAG,CACbnB,aACA,aAAKR,KAAKyB,QAAQ;YAAEjD,WAAWzB,WAAW0B,eAAe;YACzD;YAAEmD,OAAO;QAAK;QAEhB,KAAK,MAAM7C,SAASiB,KAAKlB,MAAM,CAAE;YAC/B,MAAME,MAAMlC,UAAUiC;YACtB,IAAI,CAACC,KAAK;YACVwC,YAAYG,GAAG,CACbN,MAAMnC,GAAG,CAACF,MACV;gBAAED;gBAAOR,WAAW0B;gBAAYzB,WAAWzB,WAAW0B,eAAe;YAAG,GACxE;gBAAEmD,OAAO;YAAK;QAElB;QACAJ,YAAYK,MAAM,CAACpB;QACnB,OAAO;YAAET;YAAMyB,QAAQ,GAAGA,kBAAAA,SAASZ,IAAI,cAAbY,kBAAmB,CAAC;QAA8B;IAC9E;IACA,IAAI,YAAYH,SAAS,OAAO;QAAEjB,IAAI;QAAOC,QAAQgB,QAAQhB,MAAM;IAAC;IACpE,MAAM,EAAEN,IAAI,EAAE,GAAGsB;IACjB,yEAAyE;IACzE,6DAA6D;IAC7D,MAAMpE,uBAAuBsD,aAAa;IAE1C;;;;;GAKC,GACD,MAAMxD,4BAA4B6B,OAAOrB,UAAU,CAACX,gBAAgBiF,SAAS,GAAG;QAC9EC,WAAW;QACXC,QAAQ;QACRC,QAAQjC,KAAKkC,aAAa;IAC5B;IACA;;;;;GAKC,GACD,MAAMjF,uBAAuBM,WAAWsB,OAAOsD,EAAE,EAAE;QAAC;YAAE5D,WAAW0B;QAAW;KAAE,EAAEmC,KAAK,CACnF,CAACC;QACCC,QAAQD,KAAK,CAAC,uDAAuDpC,YAAYoC;IACnF;IAGF,MAAME,eAAc5F,kBAAAA,cAAciE,WAAW,CAAC,EAAE,YAA5BjE,kBAAgC;IACpD,MAAM6F,iBAAgBxC,gBAAAA,KAAKlB,MAAM,CAAC,EAAE,YAAdkB,gBAAkB;IACxC,sEAAsE;IACtE,6DAA6D;IAC7D,MAAMyC,eACJ,OAAOnB,QAAQG,QAAQ,CAAC,OAAO,KAAK,WAAWH,QAAQG,QAAQ,CAAC,OAAO,GAAG;IAE5E;;;;;;GAMC,GACD,IAAI;YAWyBX;QAV3B,MAAMjC,OAAOrB,UAAU,CAACX,gBAAgBoE,UAAU,EAAEyB,GAAG,CAAC;YACtDC,MAAM;YACNC,MAAM,CAAC,YAAY,EAAEL,aAAa;YAClCM,MAAMC,KAAKC,GAAG;YACdC,OAAO7C,MAAM8C,GAAG;WACZpD,QAAQqD,SAAS,IAAI/C,MAAMpB,KAAK,GAChC;YAAEoE,QAAQtD,QAAQqD,SAAS,IAAI/C,MAAMpB,KAAK;QAAC,IAC3C,CAAC;YACLR,WAAW0B;YACXmD,WAAWpD,KAAKoD,SAAS;YACzBhD,MAAM,EAAEA,iBAAAA,SAAUiD,QAAOvC,uBAAAA,YAAY,CAAC,SAAS,YAAtBA,uBAA0B;YACnDwC,cAAcnD,MAAM8C,GAAG;YACvBM,WAAWxG,WAAW0B,eAAe;YACrCD,WAAWzB,WAAW0B,eAAe;;IAEzC,EAAE,OAAO4D,OAAO;QACdC,QAAQD,KAAK,CAAC,wCAAwCpC,YAAYoC;IACpE;IAEA,uEAAuE;IACvE,uEAAuE;IACvE,IAAIjC,QAAQ;QACV,MAAMjD,gBAAgBiD,QAAQD,OAAO,CAAC,YAAY,EAAEoC,aAAa,EAAE;YACjEiB,MAAM;YACNrB,IAAIlC;YACJwD,MAAMhB,gBAAgBD;QACxB;IACF;IAEA,OAAO;QACLnC,IAAI;QACJJ;QACAuC;QACAtC;QACAqC;QACAzD,QAAQkB,KAAKlB,MAAM;QACnB4E,WAAW;YAAE3C;YAAOC;YAAOC;YAAYG;QAAM;IAC/C;AACF"}

package/src/lib/server/form-dataset-binding-token.d.ts

@@ -1,35 +0,0 @@
-/**
- * @license
- * Copyright 2026 Aglyn LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-import type { FormDatasetBinding } from '@aglyn/aglyn/app-utils/form-dataset-binding';
-/**
- * The token a page carries for one form's binding on one site.
- *
- * Throws when `TOKEN_SIGNING_SECRET` is not configured, like every token this
- * secret signs; a caller that renders a page decides what an unsigned form
- * does.
- */
-export declare function signFormDatasetBinding(hostId: string, binding: FormDatasetBinding): string;
-/**
- * The binding a token carries, or null when it is not a valid token for
- * `hostId`.
- *
- * Null for anything else at all — not a string, oversized, another version, a
- * signature that does not match, a site other than this one, or no signing
- * secret — because the only safe reading of a binding that cannot be verified
- * is that there is none.
- */
-export declare function verifyFormDatasetBinding(hostId: string, token: unknown): FormDatasetBinding | null;

package/src/lib/server/form-dataset-binding-token.js

@@ -1,107 +0,0 @@
-/**
- * @license
- * Copyright 2026 Aglyn LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */ import { _ as _extends } from "@swc/helpers/_/_extends";
-import { createHmac } from "crypto";
-import { tokenSigningSecret } from "./media-signing.js";
-import { safeEqual } from "./safe-equal.js";
-/**
- * A form's dataset binding, signed into the page that renders the form.
- *
- * `/api/forms/submit` is public and unauthenticated, so nothing in its body
- * may choose which dataset a record lands in: a dataset id taken from the body
- * let anyone add rows to any dataset the site can see. The binding is instead
- * read off the form by the compose that renders the page, signed here, and
- * carried by the form; the route writes only where a valid signature says.
- *
- * What a token grants is what the published form already does. Anyone can read
- * one out of the page, and replaying it writes to that form's dataset with
- * that form's field map, for the site it was minted on — nothing a visitor
- * submitting the form could not already do.
- *
- * Signed with the shared, fail-closed `TOKEN_SIGNING_SECRET`, the secret the
- * other tenant tokens use, under its own `form-dataset-binding:` prefix so it
- * can never be replayed as any other kind of token. No expiry: a published
- * page can be served long after it rendered, and an expired token would drop
- * a live form's records. Rotating the secret, or the version, retires every
- * token at once.
- */ const VERSION = 'v1';
-const PREFIX = 'form-dataset-binding';
-/** Far above any real binding, so an oversized body is refused unparsed. */ const MAX_TOKEN_CHARS = 8192;
-const signature = (payload)=>createHmac('sha256', tokenSigningSecret()).update(`${PREFIX}:${VERSION}:${payload}`).digest('hex');
-/**
- * The token a page carries for one form's binding on one site.
- *
- * Throws when `TOKEN_SIGNING_SECRET` is not configured, like every token this
- * secret signs; a caller that renders a page decides what an unsigned form
- * does.
- */ export function signFormDatasetBinding(hostId, binding) {
-    const body = _extends({
-        h: hostId
-    }, binding.datasetId ? {
-        d: binding.datasetId
-    } : {}, binding.datasetName ? {
-        n: binding.datasetName
-    } : {}, {
-        m: binding.fieldMap
-    });
-    const payload = Buffer.from(JSON.stringify(body)).toString('base64url');
-    return `${VERSION}.${payload}.${signature(payload)}`;
-}
-const text = (value, max)=>typeof value === 'string' ? value.trim().slice(0, max) : '';
-/**
- * The binding a token carries, or null when it is not a valid token for
- * `hostId`.
- *
- * Null for anything else at all — not a string, oversized, another version, a
- * signature that does not match, a site other than this one, or no signing
- * secret — because the only safe reading of a binding that cannot be verified
- * is that there is none.
- */ export function verifyFormDatasetBinding(hostId, token) {
-    try {
-        if (typeof token !== 'string' || token.length > MAX_TOKEN_CHARS) return null;
-        const [version, payload, signed, extra] = token.split('.');
-        if (version !== VERSION || !payload || !signed || extra !== undefined) {
-            return null;
-        }
-        if (!safeEqual(signed, signature(payload))) return null;
-        const body = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
-        if (!hostId || (body == null ? void 0 : body.h) !== hostId) return null;
-        const datasetId = text(body.d, 128);
-        const datasetName = text(body.n, 60);
-        if (!datasetId && !datasetName) return null;
-        const fieldMap = {};
-        if (body.m && typeof body.m === 'object' && !Array.isArray(body.m)) {
-            for (const [key, value] of Object.entries(body.m)){
-                const submittedKey = text(key, 64);
-                const datasetFieldId = text(value, 64);
-                if (submittedKey && datasetFieldId) {
-                    fieldMap[submittedKey] = datasetFieldId;
-                }
-            }
-        }
-        return _extends({}, datasetId ? {
-            datasetId
-        } : {}, datasetName ? {
-            datasetName
-        } : {}, {
-            fieldMap
-        });
-    } catch (unused) {
-        return null;
-    }
-}
-
-//# sourceMappingURL=form-dataset-binding-token.js.map

package/src/lib/server/form-dataset-binding-token.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/form-dataset-binding-token.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { FormDatasetBinding } from '@aglyn/aglyn/app-utils/form-dataset-binding'\nimport { createHmac } from 'crypto'\nimport { tokenSigningSecret } from './media-signing'\nimport { safeEqual } from './safe-equal'\n\n/**\n * A form's dataset binding, signed into the page that renders the form.\n *\n * `/api/forms/submit` is public and unauthenticated, so nothing in its body\n * may choose which dataset a record lands in: a dataset id taken from the body\n * let anyone add rows to any dataset the site can see. The binding is instead\n * read off the form by the compose that renders the page, signed here, and\n * carried by the form; the route writes only where a valid signature says.\n *\n * What a token grants is what the published form already does. Anyone can read\n * one out of the page, and replaying it writes to that form's dataset with\n * that form's field map, for the site it was minted on — nothing a visitor\n * submitting the form could not already do.\n *\n * Signed with the shared, fail-closed `TOKEN_SIGNING_SECRET`, the secret the\n * other tenant tokens use, under its own `form-dataset-binding:` prefix so it\n * can never be replayed as any other kind of token. No expiry: a published\n * page can be served long after it rendered, and an expired token would drop\n * a live form's records. Rotating the secret, or the version, retires every\n * token at once.\n */\n\nconst VERSION = 'v1'\nconst PREFIX = 'form-dataset-binding'\n/** Far above any real binding, so an oversized body is refused unparsed. */\nconst MAX_TOKEN_CHARS = 8192\n\ninterface SignedBinding {\n  h: string\n  d?: string\n  n?: string\n  m: Record<string, string>\n}\n\nconst signature = (payload: string): string =>\n  createHmac('sha256', tokenSigningSecret())\n    .update(`${PREFIX}:${VERSION}:${payload}`)\n    .digest('hex')\n\n/**\n * The token a page carries for one form's binding on one site.\n *\n * Throws when `TOKEN_SIGNING_SECRET` is not configured, like every token this\n * secret signs; a caller that renders a page decides what an unsigned form\n * does.\n */\nexport function signFormDatasetBinding(\n  hostId: string,\n  binding: FormDatasetBinding,\n): string {\n  const body: SignedBinding = {\n    h: hostId,\n    ...(binding.datasetId ? { d: binding.datasetId } : {}),\n    ...(binding.datasetName ? { n: binding.datasetName } : {}),\n    m: binding.fieldMap,\n  }\n  const payload = Buffer.from(JSON.stringify(body)).toString('base64url')\n  return `${VERSION}.${payload}.${signature(payload)}`\n}\n\nconst text = (value: unknown, max: number): string =>\n  typeof value === 'string' ? value.trim().slice(0, max) : ''\n\n/**\n * The binding a token carries, or null when it is not a valid token for\n * `hostId`.\n *\n * Null for anything else at all — not a string, oversized, another version, a\n * signature that does not match, a site other than this one, or no signing\n * secret — because the only safe reading of a binding that cannot be verified\n * is that there is none.\n */\nexport function verifyFormDatasetBinding(\n  hostId: string,\n  token: unknown,\n): FormDatasetBinding | null {\n  try {\n    if (typeof token !== 'string' || token.length > MAX_TOKEN_CHARS) return null\n    const [version, payload, signed, extra] = token.split('.')\n    if (version !== VERSION || !payload || !signed || extra !== undefined) {\n      return null\n    }\n    if (!safeEqual(signed, signature(payload))) return null\n    const body = JSON.parse(\n      Buffer.from(payload, 'base64url').toString('utf8'),\n    ) as Partial<SignedBinding>\n    if (!hostId || body?.h !== hostId) return null\n    const datasetId = text(body.d, 128)\n    const datasetName = text(body.n, 60)\n    if (!datasetId && !datasetName) return null\n    const fieldMap: Record<string, string> = {}\n    if (body.m && typeof body.m === 'object' && !Array.isArray(body.m)) {\n      for (const [key, value] of Object.entries(body.m)) {\n        const submittedKey = text(key, 64)\n        const datasetFieldId = text(value, 64)\n        if (submittedKey && datasetFieldId) {\n          fieldMap[submittedKey] = datasetFieldId\n        }\n      }\n    }\n    return {\n      ...(datasetId ? { datasetId } : {}),\n      ...(datasetName ? { datasetName } : {}),\n      fieldMap,\n    }\n  } catch {\n    return null\n  }\n}\n"],"names":["createHmac","tokenSigningSecret","safeEqual","VERSION","PREFIX","MAX_TOKEN_CHARS","signature","payload","update","digest","signFormDatasetBinding","hostId","binding","body","h","datasetId","d","datasetName","n","m","fieldMap","Buffer","from","JSON","stringify","toString","text","value","max","trim","slice","verifyFormDatasetBinding","token","length","version","signed","extra","split","undefined","parse","Array","isArray","key","Object","entries","submittedKey","datasetFieldId"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SAASA,UAAU,QAAQ,SAAQ;AACnC,SAASC,kBAAkB,QAAQ,qBAAiB;AACpD,SAASC,SAAS,QAAQ,kBAAc;AAExC;;;;;;;;;;;;;;;;;;;;CAoBC,GAED,MAAMC,UAAU;AAChB,MAAMC,SAAS;AACf,0EAA0E,GAC1E,MAAMC,kBAAkB;AASxB,MAAMC,YAAY,CAACC,UACjBP,WAAW,UAAUC,sBAClBO,MAAM,CAAC,GAAGJ,OAAO,CAAC,EAAED,QAAQ,CAAC,EAAEI,SAAS,EACxCE,MAAM,CAAC;AAEZ;;;;;;CAMC,GACD,OAAO,SAASC,uBACdC,MAAc,EACdC,OAA2B;IAE3B,MAAMC,OAAsB;QAC1BC,GAAGH;OACCC,QAAQG,SAAS,GAAG;QAAEC,GAAGJ,QAAQG,SAAS;IAAC,IAAI,CAAC,GAChDH,QAAQK,WAAW,GAAG;QAAEC,GAAGN,QAAQK,WAAW;IAAC,IAAI,CAAC;QACxDE,GAAGP,QAAQQ,QAAQ;;IAErB,MAAMb,UAAUc,OAAOC,IAAI,CAACC,KAAKC,SAAS,CAACX,OAAOY,QAAQ,CAAC;IAC3D,OAAO,GAAGtB,QAAQ,CAAC,EAAEI,QAAQ,CAAC,EAAED,UAAUC,UAAU;AACtD;AAEA,MAAMmB,OAAO,CAACC,OAAgBC,MAC5B,OAAOD,UAAU,WAAWA,MAAME,IAAI,GAAGC,KAAK,CAAC,GAAGF,OAAO;AAE3D;;;;;;;;CAQC,GACD,OAAO,SAASG,yBACdpB,MAAc,EACdqB,KAAc;IAEd,IAAI;QACF,IAAI,OAAOA,UAAU,YAAYA,MAAMC,MAAM,GAAG5B,iBAAiB,OAAO;QACxE,MAAM,CAAC6B,SAAS3B,SAAS4B,QAAQC,MAAM,GAAGJ,MAAMK,KAAK,CAAC;QACtD,IAAIH,YAAY/B,WAAW,CAACI,WAAW,CAAC4B,UAAUC,UAAUE,WAAW;YACrE,OAAO;QACT;QACA,IAAI,CAACpC,UAAUiC,QAAQ7B,UAAUC,WAAW,OAAO;QACnD,MAAMM,OAAOU,KAAKgB,KAAK,CACrBlB,OAAOC,IAAI,CAACf,SAAS,aAAakB,QAAQ,CAAC;QAE7C,IAAI,CAACd,UAAUE,CAAAA,wBAAAA,KAAMC,CAAC,MAAKH,QAAQ,OAAO;QAC1C,MAAMI,YAAYW,KAAKb,KAAKG,CAAC,EAAE;QAC/B,MAAMC,cAAcS,KAAKb,KAAKK,CAAC,EAAE;QACjC,IAAI,CAACH,aAAa,CAACE,aAAa,OAAO;QACvC,MAAMG,WAAmC,CAAC;QAC1C,IAAIP,KAAKM,CAAC,IAAI,OAAON,KAAKM,CAAC,KAAK,YAAY,CAACqB,MAAMC,OAAO,CAAC5B,KAAKM,CAAC,GAAG;YAClE,KAAK,MAAM,CAACuB,KAAKf,MAAM,IAAIgB,OAAOC,OAAO,CAAC/B,KAAKM,CAAC,EAAG;gBACjD,MAAM0B,eAAenB,KAAKgB,KAAK;gBAC/B,MAAMI,iBAAiBpB,KAAKC,OAAO;gBACnC,IAAIkB,gBAAgBC,gBAAgB;oBAClC1B,QAAQ,CAACyB,aAAa,GAAGC;gBAC3B;YACF;QACF;QACA,OAAO,aACD/B,YAAY;YAAEA;QAAU,IAAI,CAAC,GAC7BE,cAAc;YAAEA;QAAY,IAAI,CAAC;YACrCG;;IAEJ,EAAE,eAAM;QACN,OAAO;IACT;AACF"}

package/src/lib/server/stripe-account-mode.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/stripe-account-mode.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Whether a stored Connect linkage can actually take money HERE (AGL-2471).\n *\n * THE DEFECT. Production Firestore held three Connect linkages and all three\n * named TEST-mode accounts. One — `profiles/7AVEMtDa…`, `stripeAccountId:\n * acct_1TulDeRbL3B9Ioqz` — also carried `stripeChargesEnabled: true`, which\n * was the entire payments-readiness test every money door made:\n *\n *     if (!accountId || !ownerProfile.get('stripeChargesEnabled')) …\n *\n * So three storefronts presented as payments-ready, minted a LIVE Checkout\n * session with a TEST-mode `payment_intent_data[transfer_data][destination]`,\n * and were refused by Stripe as a generic 502 at the shopper's checkout. A\n * merchant told they are ready to take money, who silently cannot.\n *\n * WHY THE ACCOUNT ID IS NOT THE EVIDENCE. `acct_1TulDeRbL3B9Ioqz` is a real\n * production value naming a TEST account. Stripe's account ids carry no mode\n * marker — live and test ids are the same shape — so no amount of reading the\n * string can tell them apart. What DOES tell them apart is Stripe itself:\n * retrieving that id with the live key answers\n *\n *     400 The account acct_1TulDeRbL3B9Ioqz was a test account created with a\n *         testmode key, and therefore can only be used with testmode keys.\n *\n * The Account object, notably, has NO `livemode` field of its own (verified\n * against the live API: the payload carries `charges_enabled`,\n * `payouts_enabled`, `capabilities` and no `livemode`). So the mode is\n * recorded at the two moments Stripe does state it:\n *\n *   1. `account.updated` — the EVENT carries `livemode`, and it is Stripe's\n *      own statement about the account the event is describing;\n *   2. onboarding — the account was just created or retrieved successfully\n *      with the platform key, and Stripe hard-refuses cross-mode retrieval\n *      (above), so the account's mode IS the key's mode; the key's mode is\n *      then confirmed against the API via `resolvePlatformStripeMode`.\n *\n * WHY THE RULE IS ASYMMETRIC, AND NOT \"REFUSE ANYTHING UNPROVEN\". An absent\n * `stripeAccountLivemode` refuses only on a LIVE deployment. That is where\n * real money moves and where the defect was found, and a live deployment can\n * always re-establish the field: the merchant reconnects, or Stripe sends one\n * `account.updated`. Everywhere else — a test-key deployment, a developer\n * machine, a self-hosted install still in sandbox, the whole test suite — an\n * unverified linkage keeps the behaviour it had before, because no real money\n * can move there and Stripe enforces the mode boundary itself. Refusing\n * everywhere would have bought production nothing extra and broken every\n * non-production deployment.\n *\n * A PROVEN mismatch (`stripeAccountLivemode` recorded and disagreeing) is\n * refused in BOTH directions, because that costs nothing to detect and is\n * never right.\n *\n * WHAT IS SNIFFED, AND WHY THAT ONE IS FAIR. The SECRET KEY states its own\n * mode — `sk_live_`, `sk_test_`, `rk_live_`, `rk_test_` — and that is a\n * documented, stable Stripe invariant, unlike the account id. It is used only\n * to answer \"which mode is this deployment\", never \"which mode is this\n * account\", and even there `resolvePlatformStripeMode` prefers the API.\n *\n * HOW IT GOT THERE. A developer machine runs against PRODUCTION Firestore\n * (`FIREBASE_PROJECT_ID=aglyn-main` in every dev env file) while\n * `apps/console/.env.development.local` sets `STRIPE_SECRET_KEY` to the\n * `sk_test_` key by deliberate policy (AGL-1137: localhost must never touch\n * live Stripe). The connect route then creates a test-mode Express account\n * and writes it into the production database. Nothing about that is going to\n * change — the split key is the right call — so the gate has to be the thing\n * that notices.\n */\n\n/** Which Stripe world a key or an account belongs to. */\nexport type StripeMode = 'live' | 'test'\n\n/**\n * Why a stored linkage may not be charged against. Every value other than\n * `'ready'` is a refusal, and the mode ones are refusals the old two-field\n * test could not make.\n */\nexport type ConnectReadiness =\n  /** Charge away. */\n  | 'ready'\n  /** No Connect account is stored at all — the onboarding call to action. */\n  | 'not-connected'\n  /** Stripe will not let this account take charges. */\n  | 'charges-disabled'\n  /**\n   * The linkage predates AGL-2471 (or was written by something that did not\n   * record mode), so its mode was never established — AND this deployment is\n   * LIVE. This is the shape all three poisoned production records have.\n   * The connect route and the `account.updated` sync both write the field, so\n   * a genuine merchant self-heals on the next of either.\n   */\n  | 'mode-unverified'\n  /** The account belongs to the OTHER Stripe world. The AGL-2471 defect. */\n  | 'mode-mismatch'\n\nexport interface ConnectReadinessInput {\n  /** `stripeAccountId` off the profile, whatever shape the document has. */\n  accountId?: unknown\n  /** `stripeChargesEnabled` off the profile. */\n  chargesEnabled?: unknown\n  /** `stripeAccountLivemode` off the profile — absent before AGL-2471. */\n  accountLivemode?: unknown\n  /** Defaults to the mode of `STRIPE_SECRET_KEY`. */\n  platformMode?: StripeMode | undefined\n}\n\n/**\n * The mode a Stripe secret key states about itself, or `undefined` when the\n * string is not a Stripe secret key.\n *\n * Deliberately narrow: it matches `sk_`/`rk_` followed by `live`/`test`, and\n * refuses everything else rather than guessing. Handing it an `acct_…` id\n * returns `undefined` — the whole point is that account ids say nothing.\n */\nexport function platformStripeMode(\n  key: string | undefined = process.env.STRIPE_SECRET_KEY,\n): StripeMode | undefined {\n  const match = /^[sr]k_(live|test)_/.exec(String(key ?? '').trim())\n  return match ? (match[1] as StripeMode) : undefined\n}\n\n/**\n * The platform's mode, asked of Stripe and only then of the key.\n *\n * `GET /v1/balance` is a singleton that carries `livemode`, so it states the\n * mode of whatever key made the call — no object has to be created to find\n * out. The key prefix is the fallback for a restricted key that cannot read\n * balance; without it, a self-hosted install with a scoped key could not\n * finish onboarding at all.\n */\nexport async function resolvePlatformStripeMode(\n  key: string | undefined = process.env.STRIPE_SECRET_KEY,\n  fetchImpl: typeof fetch = fetch,\n): Promise<StripeMode | undefined> {\n  const fromKey = platformStripeMode(key)\n  if (!key) return fromKey\n  try {\n    const response = await fetchImpl('https://api.stripe.com/v1/balance', {\n      method: 'GET',\n      headers: { Authorization: `Bearer ${key}` },\n    })\n    if (response.ok) {\n      const payload = await response.json()\n      if (typeof payload?.livemode === 'boolean') {\n        return payload.livemode ? 'live' : 'test'\n      }\n    }\n  } catch {\n    // Network or transport failure — fall through to the key, which is the\n    // same answer we would have recorded before this existed.\n  }\n  return fromKey\n}\n\n/**\n * Decides whether a stored Connect linkage may be charged against.\n *\n * Order matters: the two refusals that existed before AGL-2471 are asked\n * first, so an unconnected or restricted merchant still gets the answer they\n * always got, and only a linkage that WOULD have passed reaches the mode\n * question.\n */\nexport function connectReadiness(\n  input: ConnectReadinessInput,\n): ConnectReadiness {\n  const accountId =\n    typeof input.accountId === 'string' ? input.accountId.trim() : ''\n  if (!accountId) return 'not-connected'\n  if (input.chargesEnabled !== true) return 'charges-disabled'\n  const platformMode =\n    'platformMode' in input ? input.platformMode : platformStripeMode()\n  // Three-valued on purpose, exactly as AGL-1997 reads `payoutsEnabled`: only\n  // a literal boolean is a recorded answer. A string `'true'` or a `1` is a\n  // field somebody else wrote, and inventing `true` from it would re-open the\n  // hole this closes.\n  if (typeof input.accountLivemode === 'boolean') {\n    // A PROVEN mismatch is refused in either direction. It costs nothing to\n    // detect and it is always wrong.\n    if (!platformMode) return 'ready'\n    return input.accountLivemode === (platformMode === 'live')\n      ? 'ready'\n      : 'mode-mismatch'\n  }\n  return platformMode === 'live' ? 'mode-unverified' : 'ready'\n}\n\n/**\n * The form every money door calls: `true` only when the linkage may be\n * charged, with the two mode refusals reported to the server log.\n *\n * The log line is the part the shopper's generic 409 cannot carry. Before\n * this, a mode mismatch surfaced as a 502 from Stripe with nothing anywhere\n * naming the cause; the sale is still refused the same way, but now somebody\n * can find out why.\n */\nexport function connectLinkageIsReady(\n  input: ConnectReadinessInput,\n  context?: { subject?: string },\n): boolean {\n  const readiness = connectReadiness(input)\n  if (readiness === 'mode-mismatch' || readiness === 'mode-unverified') {\n    console.error(\n      `[AGL-2471] Refusing a charge against Connect account ` +\n        `${String(input.accountId)}${\n          context?.subject ? ` (${context.subject})` : ''\n        }: ${readiness}. The stored linkage is not verified for this ` +\n        `deployment's Stripe mode; the merchant must re-onboard.`,\n    )\n  }\n  return readiness === 'ready'\n}\n"],"names":["platformStripeMode","key","process","env","STRIPE_SECRET_KEY","match","exec","String","trim","undefined","resolvePlatformStripeMode","fetchImpl","fetch","fromKey","response","method","headers","Authorization","ok","payload","json","livemode","connectReadiness","input","accountId","chargesEnabled","platformMode","accountLivemode","connectLinkageIsReady","context","readiness","console","error","subject"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiEC,GAED,uDAAuD,GAqCvD;;;;;;;CAOC,GACD,OAAO,SAASA,mBACdC,MAA0BC,QAAQC,GAAG,CAACC,iBAAiB;IAEvD,MAAMC,QAAQ,sBAAsBC,IAAI,CAACC,OAAON,cAAAA,MAAO,IAAIO,IAAI;IAC/D,OAAOH,QAASA,KAAK,CAAC,EAAE,GAAkBI;AAC5C;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeC,0BACpBT,MAA0BC,QAAQC,GAAG,CAACC,iBAAiB,EACvDO,YAA0BC,KAAK;IAE/B,MAAMC,UAAUb,mBAAmBC;IACnC,IAAI,CAACA,KAAK,OAAOY;IACjB,IAAI;QACF,MAAMC,WAAW,MAAMH,UAAU,qCAAqC;YACpEI,QAAQ;YACRC,SAAS;gBAAEC,eAAe,CAAC,OAAO,EAAEhB,KAAK;YAAC;QAC5C;QACA,IAAIa,SAASI,EAAE,EAAE;YACf,MAAMC,UAAU,MAAML,SAASM,IAAI;YACnC,IAAI,QAAOD,2BAAAA,QAASE,QAAQ,MAAK,WAAW;gBAC1C,OAAOF,QAAQE,QAAQ,GAAG,SAAS;YACrC;QACF;IACF,EAAE,eAAM;IACN,uEAAuE;IACvE,0DAA0D;IAC5D;IACA,OAAOR;AACT;AAEA;;;;;;;CAOC,GACD,OAAO,SAASS,iBACdC,KAA4B;IAE5B,MAAMC,YACJ,OAAOD,MAAMC,SAAS,KAAK,WAAWD,MAAMC,SAAS,CAAChB,IAAI,KAAK;IACjE,IAAI,CAACgB,WAAW,OAAO;IACvB,IAAID,MAAME,cAAc,KAAK,MAAM,OAAO;IAC1C,MAAMC,eACJ,kBAAkBH,QAAQA,MAAMG,YAAY,GAAG1B;IACjD,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,oBAAoB;IACpB,IAAI,OAAOuB,MAAMI,eAAe,KAAK,WAAW;QAC9C,wEAAwE;QACxE,iCAAiC;QACjC,IAAI,CAACD,cAAc,OAAO;QAC1B,OAAOH,MAAMI,eAAe,KAAMD,CAAAA,iBAAiB,MAAK,IACpD,UACA;IACN;IACA,OAAOA,iBAAiB,SAAS,oBAAoB;AACvD;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASE,sBACdL,KAA4B,EAC5BM,OAA8B;IAE9B,MAAMC,YAAYR,iBAAiBC;IACnC,IAAIO,cAAc,mBAAmBA,cAAc,mBAAmB;QACpEC,QAAQC,KAAK,CACX,CAAC,qDAAqD,CAAC,GACrD,GAAGzB,OAAOgB,MAAMC,SAAS,IACvBK,CAAAA,2BAAAA,QAASI,OAAO,IAAG,CAAC,EAAE,EAAEJ,QAAQI,OAAO,CAAC,CAAC,CAAC,GAAG,GAC9C,EAAE,EAAEH,UAAU,8CAA8C,CAAC,GAC9D,CAAC,uDAAuD,CAAC;IAE/D;IACA,OAAOA,cAAc;AACvB"}