@aglyn/tenant-runtime 1.0.0-beta.199 → 1.0.0-beta.201

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/tenant-runtime",
-  "version": "1.0.0-beta.199",
+  "version": "1.0.0-beta.201",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,8 +25,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/aglyn": "1.0.0-beta.199",
-    "@aglyn/tenant-data-admin": "1.0.0-beta.199",
+    "@aglyn/aglyn": "1.0.0-beta.201",
+    "@aglyn/tenant-data-admin": "1.0.0-beta.201",
     "@swc/helpers": "0.5.23"
   },
   "peerDependencies": {

package/src/lib/assign-contact-owner.js

@@ -15,7 +15,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */ import { assignmentRuleMatches, consentGroupForHost, contactFacetPath, CRM_ROUND_ROBIN_LAST_ASSIGNED_PATH, personKey, readContactFacet, readCrmAssignmentSettings, roundRobinOrder } from "@aglyn/aglyn/server";
-import { firebaseAdmin, getOrgForHost, notifyUsers } from "@aglyn/tenant-data-admin";
+import { firebaseAdmin, getOrgForHost, notifyUsers, restampCrmListFieldsAt } from "@aglyn/tenant-data-admin";
 import { FieldValue } from "firebase-admin/firestore";
 /** The words the run history and the log give each refusal. */ export const OWNER_ASSIGNMENT_REFUSALS = {
     'no-org': 'this site has no organization',
@@ -240,6 +240,8 @@ async function assignOwner(policy) {
             });
         });
         if (verdict.outcome !== 'assigned') return verdict;
+        // The owner is what the Contacts list filters by (AGL-3321).
+        await restampCrmListFieldsAt(contactRef, 'contacts');
         if (!verdict.leadMirrored && leadRef && policy.kind === 'capture' && LEAD_FILING_SOURCES.has(policy.input.source)) {
             void mirrorOwnerOntoLeadLater(leadRef, verdict.ownerUid);
         }

package/src/lib/assign-contact-owner.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/tenant/runtime/src/lib/assign-contact-owner.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  assignmentRuleMatches,\n  consentGroupForHost,\n  contactFacetPath,\n  type ContactSource,\n  CRM_ROUND_ROBIN_LAST_ASSIGNED_PATH,\n  type CrmAssignmentTarget,\n  personKey,\n  readContactFacet,\n  readCrmAssignmentSettings,\n  roundRobinOrder,\n} from '@aglyn/aglyn/server'\nimport {\n  firebaseAdmin,\n  getOrgForHost,\n  notifyUsers,\n} from '@aglyn/tenant-data-admin'\nimport { FieldValue } from 'firebase-admin/firestore'\n\n/**\n * WHO A NEW RECORD BELONGS TO — the one place an owner is decided on the\n * server (AGL-2618).\n *\n * Two entry points over one transaction. `assignOwnerForCapture` is the\n * capture door's pass: it runs the org's assignment rules in order, falls\n * back to the capturing site's default owner, and touches only a record\n * that has NO owner — a door that named one (the console's drawer, an\n * import column, a conversion with a picked owner) has expressed a person's\n * choice. `reassignContactOwner` is the automation's: an author who put\n * \"assign an owner\" on a stage change means to reassign, and the step hands\n * this either a member or the rotation.\n *\n * ## One transaction, because the pointer is shared\n *\n * The round-robin pool's pointer lives on the org document, and two\n * captures landing together must take two different members. Firestore\n * transactions serialize on what they read, so the org document, the\n * contact and the roster documents are all read inside the transaction and\n * the pointer is advanced in the same commit that writes the owner: a\n * concurrent capture that read the same pointer retries and reads the moved\n * one. The alternative — read the pointer, decide, then write — is exactly\n * the read-then-write shape that lets two captures pick the same person.\n *\n * ## The roster is checked, once per member per attempt\n *\n * A rule may name a member who has since left, and a pool may hold one. A\n * rule naming nobody on the roster is passed over rather than stopping the\n * pass — the next rule may well assign — and a pool member who is gone is\n * skipped for the next in the order. `orgs/{orgId}/members/{uid}` is keyed\n * by uid, so the check is one document read per candidate, and only the\n * roster is consulted: a project-level Auth lookup would admit people who\n * are not on this organization at all (AGL-1122).\n *\n * ## The lead follows the contact\n *\n * The capture doors that file a lead (`addHostLead`: a form routed to leads,\n * a sign-up, a booking) key it by `personKey(email)`, so the lead's document\n * is addressable from the capture alone. When it exists it is given the same\n * owner in the same transaction; two doors write the lead AFTER the contact\n * they `void`ed, so for those sources the mirror is retried a few times over\n * the next seconds, detached, and the person's Leads list shows the owner\n * as soon as the lead is there.\n *\n * ## The owner is told, unless they chose themselves\n *\n * One console notification per assignment, for the record the recipient\n * will open: the lead when the site holds one for this person, the contact\n * otherwise. Not when the actor IS the new owner — a rep who converts a\n * lead into their own contact has not been handed anything.\n *\n * ## Never rejects\n *\n * The capture has already succeeded and a form submission must not fail\n * because the CRM could not decide who follows up; a failure is logged and\n * answered as `none`, and the record is exactly as assignable by hand as it\n * was before this existed. The automation executor turns a `none` into the\n * step's recorded error.\n */\n\nexport interface OwnerAssignmentInput {\n  hostId: string\n  /** `orgs/{orgId}/contacts/{contactId}` — the record the owner is written on. */\n  contactId: string\n  /** The contact's address, which keys the lead and names the person in the notification. */\n  email: string\n  /**\n   * The signed-in person making the assignment, when there is one. Never\n   * notified about their own choice; absent for a capture and an automation.\n   */\n  actorUid?: string | null\n}\n\nexport interface CaptureAssignmentInput extends OwnerAssignmentInput {\n  source: ContactSource\n  /** The form the capture came through, for a rule conditioned on it. */\n  formId?: string | null\n  /** The tags the capture carried; the contact's own are read from the facet. */\n  tags?: readonly string[]\n}\n\nexport interface ReassignmentInput extends OwnerAssignmentInput {\n  assign: CrmAssignmentTarget\n}\n\n/** Why an assignment assigned nobody — the automation reports these verbatim. */\nexport type OwnerAssignmentRefusal =\n  | 'no-org'\n  | 'no-contact'\n  | 'no-rule'\n  | 'empty-pool'\n  | 'not-a-member'\n  | 'failed'\n\n/** What decided an assignment: a rule, the site default, the step's member, or the rotation. */\nexport type OwnerAssignedBy = 'rule' | 'default' | 'member' | 'roundRobin'\n\nexport type OwnerAssignment =\n  | {\n      outcome: 'assigned'\n      ownerUid: string\n      by: OwnerAssignedBy\n      /** The rule that decided it, when one did. */\n      ruleId?: string\n      /** The lead document existed and now carries the owner too. */\n      leadMirrored: boolean\n      /** A notification was fanned out to the new owner. */\n      notified: boolean\n    }\n  /** The record already had this owner (a capture), or the same one was named again (a reassignment). */\n  | { outcome: 'unchanged'; ownerUid: string }\n  | { outcome: 'none'; reason: OwnerAssignmentRefusal }\n\n/** The words the run history and the log give each refusal. */\nexport const OWNER_ASSIGNMENT_REFUSALS: Record<OwnerAssignmentRefusal, string> = {\n  'no-org': 'this site has no organization',\n  'no-contact': 'the contact no longer exists',\n  'no-rule': 'no assignment rule matched and the site has no default owner',\n  'empty-pool': 'the round-robin pool has nobody on the roster in it',\n  'not-a-member': 'the owner named is not on the team',\n  failed: 'the owner could not be assigned',\n}\n\n/**\n * The doors whose lead lands after the contact they `void`ed — the ones the\n * mirror is worth retrying for. An order, an import, a manual add and an\n * API call file no lead, and a retry for them would be reads for nothing.\n */\nconst LEAD_FILING_SOURCES: ReadonlySet<ContactSource> = new Set([\n  'form',\n  'member',\n  'booking',\n])\n\n/** How long the detached lead mirror waits between its looks, in order. */\nconst LEAD_MIRROR_RETRY_MS: readonly number[] = [1_000, 2_000, 3_000]\n\ntype Policy =\n  | { kind: 'capture'; input: CaptureAssignmentInput }\n  | { kind: 'reassign'; input: ReassignmentInput }\n\ninterface Decision {\n  ownerUid: string\n  by: OwnerAssignedBy\n  ruleId?: string\n  /** The pointer moves only when the rotation chose. */\n  advancePointer: boolean\n}\n\n/**\n * The console path the owner's notification opens, in the `/{hostDocId}/rest`\n * shape every host notification uses — the console rewrites it to\n * `/{orgSlug}/hosts/{subdomain}/rest` when the link is followed, which is\n * why `hostId` and `orgId` travel on the document. The same spelling the\n * CRM's task notification uses; the hub's own route builder lives in the\n * plugin, which this layer cannot import.\n */\nfunction recordLink(hostId: string, record: AssignedRecord): string {\n  const section = record.kind === 'contact' ? 'contacts' : 'leads'\n  return `/${hostId}/crm/${section}/${encodeURIComponent(record.id)}`\n}\n\n/** The record an assignment notification opens. */\nexport type AssignedRecord =\n  | { kind: 'contact'; id: string }\n  | { kind: 'lead'; id: string }\n\n/**\n * Tells a member a record is now theirs — one console notification, typed\n * by the record it opens — unless the member handed it to themselves.\n * Shared by the pass above and by the routes where a person picks the\n * owner outright (a lead conversion naming a colleague), so every server\n * path that writes `ownerUid` says so in the same words. Never throws;\n * the fan-out swallows its own failures.\n */\nexport async function notifyRecordAssigned(input: {\n  hostId: string\n  orgId: string\n  ownerUid: string\n  actorUid?: string | null\n  record: AssignedRecord\n  /** How the person reads in the message: their name, else their address. */\n  who: string\n}): Promise<boolean> {\n  if (!input.ownerUid || input.ownerUid === (input.actorUid ?? '')) return false\n  const lead = input.record.kind === 'lead'\n  await notifyUsers([input.ownerUid], {\n    type: lead ? 'content.leadAssigned' : 'content.contactAssigned',\n    title: lead ? 'Lead assigned to you' : 'Contact assigned to you',\n    body: input.who,\n    link: recordLink(input.hostId, input.record),\n    orgId: input.orgId,\n    hostId: input.hostId,\n  })\n  return true\n}\n\nasync function assignOwner(policy: Policy): Promise<OwnerAssignment> {\n  const { input } = policy\n  try {\n    const resolved = await getOrgForHost(input.hostId)\n    if (!resolved) return { outcome: 'none', reason: 'no-org' }\n    const { orgId } = resolved\n    const firestore = firebaseAdmin.app().firestore()\n    const orgRef = firestore.collection('orgs').doc(orgId)\n    const contactRef = orgRef.collection('contacts').doc(input.contactId)\n    const membersRef = orgRef.collection('members')\n    const leadKey = personKey(input.email)\n    // Beside the contact on the org, keyed by the same address (AGL-3275).\n    const leadRef = leadKey ? orgRef.collection('leads').doc(leadKey) : null\n\n    let contactName = ''\n    const verdict = await firestore.runTransaction(\n      async (tx): Promise<OwnerAssignment> => {\n        /*\n         * ALL READS BEFORE THE WRITE, which Firestore requires. The org\n         * document is read here rather than trusted from `getOrgForHost`,\n         * because the pointer it carries is the one thing a concurrent\n         * capture may have moved, and the rules and the pool are read from\n         * the same snapshot so the decision and the pointer agree.\n         */\n        const [orgSnapshot, contactSnapshot, leadSnapshot] = await Promise.all([\n          tx.get(orgRef),\n          tx.get(contactRef),\n          leadRef ? tx.get(leadRef) : Promise.resolve(null),\n        ])\n        if (!contactSnapshot.exists) {\n          return { outcome: 'none', reason: 'no-contact' }\n        }\n        const org = (orgSnapshot.data() ?? {}) as Record<string, unknown>\n        const contact = (contactSnapshot.data() ?? {}) as Record<string, unknown>\n        contactName = String(contact['name'] ?? '')\n        const group = consentGroupForHost(org, input.hostId)\n        const facet = readContactFacet(contact, group.groupId)\n        const current = typeof facet.ownerUid === 'string' ? facet.ownerUid : ''\n        if (policy.kind === 'capture' && current) {\n          return { outcome: 'unchanged', ownerUid: current }\n        }\n        const settings = readCrmAssignmentSettings(org)\n\n        // One read per candidate per attempt; a retried transaction reads\n        // afresh, as it must.\n        const onRoster = new Map<string, Promise<boolean>>()\n        const isMember = (uid: string): Promise<boolean> => {\n          let known = onRoster.get(uid)\n          if (!known) {\n            known = tx.get(membersRef.doc(uid)).then((snapshot) => snapshot.exists)\n            onRoster.set(uid, known)\n          }\n          return known\n        }\n        const fromPool = async (): Promise<string | null> => {\n          for (const uid of roundRobinOrder(\n            settings.pool.memberUids,\n            settings.pool.lastAssignedUid,\n          )) {\n            if (await isMember(uid)) return uid\n          }\n          return null\n        }\n        const resolveTarget = async (\n          target: CrmAssignmentTarget,\n        ): Promise<{ uid: string; advancePointer: boolean } | null> => {\n          if ('roundRobin' in target) {\n            const uid = await fromPool()\n            return uid ? { uid, advancePointer: true } : null\n          }\n          return (await isMember(target.memberUid))\n            ? { uid: target.memberUid, advancePointer: false }\n            : null\n        }\n\n        let decision: Decision | null = null\n        let refusal: OwnerAssignmentRefusal = 'no-rule'\n        if (policy.kind === 'capture') {\n          const capture = {\n            source: policy.input.source,\n            email: input.email,\n            formId: policy.input.formId ?? null,\n            tags: [...(policy.input.tags ?? []), ...(facet.tags ?? [])],\n          }\n          for (const rule of settings.rules) {\n            if (!assignmentRuleMatches(rule.when, capture)) continue\n            const hit = await resolveTarget(rule.assign)\n            if (hit) {\n              decision = { ...hit, ownerUid: hit.uid, by: 'rule', ruleId: rule.id }\n              break\n            }\n          }\n          const fallback = settings.hostDefaultOwners[input.hostId]\n          if (!decision && fallback && (await isMember(fallback))) {\n            decision = { ownerUid: fallback, by: 'default', advancePointer: false }\n          }\n        } else {\n          const { assign } = policy.input\n          const hit = await resolveTarget(assign)\n          if (hit) {\n            decision = {\n              ...hit,\n              ownerUid: hit.uid,\n              by: 'roundRobin' in assign ? 'roundRobin' : 'member',\n            }\n          } else {\n            refusal = 'roundRobin' in assign ? 'empty-pool' : 'not-a-member'\n          }\n        }\n        if (!decision) return { outcome: 'none', reason: refusal }\n        if (decision.ownerUid === current) {\n          return { outcome: 'unchanged', ownerUid: current }\n        }\n\n        tx.update(contactRef, {\n          [contactFacetPath(group.groupId, 'ownerUid')]: decision.ownerUid,\n          updatedAt: FieldValue.serverTimestamp(),\n        })\n        if (decision.advancePointer) {\n          tx.update(orgRef, {\n            [CRM_ROUND_ROBIN_LAST_ASSIGNED_PATH]: decision.ownerUid,\n          })\n        }\n        /*\n         * A lead somebody already assigned by hand keeps its owner on a\n         * capture — the contact was new, the lead may not have been — and\n         * follows the contact on a deliberate reassignment.\n         */\n        const leadOwner = String(leadSnapshot?.get('ownerUid') ?? '')\n        const leadMirrored = Boolean(\n          leadSnapshot?.exists && (policy.kind === 'reassign' || !leadOwner),\n        )\n        if (leadMirrored && leadRef) {\n          tx.update(leadRef, {\n            ownerUid: decision.ownerUid,\n            updatedAt: FieldValue.serverTimestamp(),\n          })\n        }\n        return {\n          outcome: 'assigned',\n          ownerUid: decision.ownerUid,\n          by: decision.by,\n          ...(decision.ruleId ? { ruleId: decision.ruleId } : {}),\n          leadMirrored,\n          notified: false,\n        }\n      },\n    )\n    if (verdict.outcome !== 'assigned') return verdict\n\n    if (\n      !verdict.leadMirrored &&\n      leadRef &&\n      policy.kind === 'capture' &&\n      LEAD_FILING_SOURCES.has(policy.input.source)\n    ) {\n      void mirrorOwnerOntoLeadLater(leadRef, verdict.ownerUid)\n    }\n\n    const notified = await notifyRecordAssigned({\n      hostId: input.hostId,\n      orgId,\n      ownerUid: verdict.ownerUid,\n      actorUid: input.actorUid,\n      record:\n        verdict.leadMirrored && leadKey\n          ? { kind: 'lead', id: leadKey }\n          : { kind: 'contact', id: input.contactId },\n      who: contactName || input.email,\n    })\n    return { ...verdict, notified }\n  } catch (error) {\n    console.error(\n      'assignContactOwner failed',\n      input.hostId,\n      input.contactId,\n      error,\n    )\n    return { outcome: 'none', reason: 'failed' }\n  }\n}\n\n/**\n * The detached second look for a lead that lands after the contact.\n *\n * Bounded, and only ever ADDS an owner: a lead that arrived with one (a\n * person assigned it in the meantime) is left alone, and a lead that never\n * arrives costs three reads over six seconds and nothing else. Detached\n * because the capture must not hold `contactCreated` back for it — an\n * automation welcoming the contact has nothing to do with the lead's owner\n * column.\n */\nasync function mirrorOwnerOntoLeadLater(\n  leadRef: FirebaseFirestore.DocumentReference,\n  ownerUid: string,\n  delaysMs: readonly number[] = LEAD_MIRROR_RETRY_MS,\n): Promise<boolean> {\n  for (const delay of delaysMs) {\n    await new Promise((resolve) => setTimeout(resolve, delay))\n    try {\n      const lead = await leadRef.get()\n      if (!lead.exists) continue\n      if (String(lead.get('ownerUid') ?? '')) return false\n      await leadRef.update({\n        ownerUid,\n        updatedAt: FieldValue.serverTimestamp(),\n      })\n      return true\n    } catch (error) {\n      console.error('assignContactOwner lead mirror failed', leadRef.path, error)\n      return false\n    }\n  }\n  return false\n}\n\n/**\n * The capture door's pass: the org's rules in order, then the capturing\n * site's default owner, on a record that has no owner yet. See the module\n * comment for the whole of it.\n */\nexport function assignOwnerForCapture(\n  input: CaptureAssignmentInput,\n): Promise<OwnerAssignment> {\n  return assignOwner({ kind: 'capture', input })\n}\n\n/**\n * The deliberate assignment — the `assignContactOwner` step, and a person\n * handing a record to somebody: a member by uid (verified on the roster) or\n * the next in the round-robin pool, overwriting whoever held it. Naming the\n * owner the record already has changes nothing and tells nobody.\n */\nexport function reassignContactOwner(\n  input: ReassignmentInput,\n): Promise<OwnerAssignment> {\n  return assignOwner({ kind: 'reassign', input })\n}\n\nexport default assignOwnerForCapture\n"],"names":["assignmentRuleMatches","consentGroupForHost","contactFacetPath","CRM_ROUND_ROBIN_LAST_ASSIGNED_PATH","personKey","readContactFacet","readCrmAssignmentSettings","roundRobinOrder","firebaseAdmin","getOrgForHost","notifyUsers","FieldValue","OWNER_ASSIGNMENT_REFUSALS","failed","LEAD_FILING_SOURCES","Set","LEAD_MIRROR_RETRY_MS","recordLink","hostId","record","section","kind","encodeURIComponent","id","notifyRecordAssigned","input","ownerUid","actorUid","lead","type","title","body","who","link","orgId","assignOwner","policy","resolved","outcome","reason","firestore","app","orgRef","collection","doc","contactRef","contactId","membersRef","leadKey","email","leadRef","contactName","verdict","runTransaction","tx","orgSnapshot","contactSnapshot","contact","leadSnapshot","Promise","all","get","resolve","exists","org","data","String","group","facet","groupId","current","settings","onRoster","Map","isMember","uid","known","then","snapshot","set","fromPool","pool","memberUids","lastAssignedUid","resolveTarget","target","advancePointer","memberUid","decision","refusal","capture","source","formId","tags","rule","rules","when","hit","assign","by","ruleId","fallback","hostDefaultOwners","update","updatedAt","serverTimestamp","leadOwner","leadMirrored","Boolean","notified","has","mirrorOwnerOntoLeadLater","error","console","delaysMs","delay","setTimeout","path","assignOwnerForCapture","reassignContactOwner"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,qBAAqB,EACrBC,mBAAmB,EACnBC,gBAAgB,EAEhBC,kCAAkC,EAElCC,SAAS,EACTC,gBAAgB,EAChBC,yBAAyB,EACzBC,eAAe,QACV,sBAAqB;AAC5B,SACEC,aAAa,EACbC,aAAa,EACbC,WAAW,QACN,2BAA0B;AACjC,SAASC,UAAU,QAAQ,2BAA0B;AAmHrD,6DAA6D,GAC7D,OAAO,MAAMC,4BAAoE;IAC/E,UAAU;IACV,cAAc;IACd,WAAW;IACX,cAAc;IACd,gBAAgB;IAChBC,QAAQ;AACV,EAAC;AAED;;;;CAIC,GACD,MAAMC,sBAAkD,IAAIC,IAAI;IAC9D;IACA;IACA;CACD;AAED,yEAAyE,GACzE,MAAMC,uBAA0C;IAAC;IAAO;IAAO;CAAM;AAcrE;;;;;;;CAOC,GACD,SAASC,WAAWC,MAAc,EAAEC,MAAsB;IACxD,MAAMC,UAAUD,OAAOE,IAAI,KAAK,YAAY,aAAa;IACzD,OAAO,CAAC,CAAC,EAAEH,OAAO,KAAK,EAAEE,QAAQ,CAAC,EAAEE,mBAAmBH,OAAOI,EAAE,GAAG;AACrE;AAOA;;;;;;;CAOC,GACD,OAAO,eAAeC,qBAAqBC,KAQ1C;QAC4CA;IAA3C,IAAI,CAACA,MAAMC,QAAQ,IAAID,MAAMC,QAAQ,OAAMD,kBAAAA,MAAME,QAAQ,YAAdF,kBAAkB,KAAK,OAAO;IACzE,MAAMG,OAAOH,MAAMN,MAAM,CAACE,IAAI,KAAK;IACnC,MAAMX,YAAY;QAACe,MAAMC,QAAQ;KAAC,EAAE;QAClCG,MAAMD,OAAO,yBAAyB;QACtCE,OAAOF,OAAO,yBAAyB;QACvCG,MAAMN,MAAMO,GAAG;QACfC,MAAMhB,WAAWQ,MAAMP,MAAM,EAAEO,MAAMN,MAAM;QAC3Ce,OAAOT,MAAMS,KAAK;QAClBhB,QAAQO,MAAMP,MAAM;IACtB;IACA,OAAO;AACT;AAEA,eAAeiB,YAAYC,MAAc;IACvC,MAAM,EAAEX,KAAK,EAAE,GAAGW;IAClB,IAAI;QACF,MAAMC,WAAW,MAAM5B,cAAcgB,MAAMP,MAAM;QACjD,IAAI,CAACmB,UAAU,OAAO;YAAEC,SAAS;YAAQC,QAAQ;QAAS;QAC1D,MAAM,EAAEL,KAAK,EAAE,GAAGG;QAClB,MAAMG,YAAYhC,cAAciC,GAAG,GAAGD,SAAS;QAC/C,MAAME,SAASF,UAAUG,UAAU,CAAC,QAAQC,GAAG,CAACV;QAChD,MAAMW,aAAaH,OAAOC,UAAU,CAAC,YAAYC,GAAG,CAACnB,MAAMqB,SAAS;QACpE,MAAMC,aAAaL,OAAOC,UAAU,CAAC;QACrC,MAAMK,UAAU5C,UAAUqB,MAAMwB,KAAK;QACrC,uEAAuE;QACvE,MAAMC,UAAUF,UAAUN,OAAOC,UAAU,CAAC,SAASC,GAAG,CAACI,WAAW;QAEpE,IAAIG,cAAc;QAClB,MAAMC,UAAU,MAAMZ,UAAUa,cAAc,CAC5C,OAAOC;gBAgBQC,mBACIC,uBACIC;YAjBrB;;;;;;SAMC,GACD,MAAM,CAACF,aAAaC,iBAAiBE,aAAa,GAAG,MAAMC,QAAQC,GAAG,CAAC;gBACrEN,GAAGO,GAAG,CAACnB;gBACPY,GAAGO,GAAG,CAAChB;gBACPK,UAAUI,GAAGO,GAAG,CAACX,WAAWS,QAAQG,OAAO,CAAC;aAC7C;YACD,IAAI,CAACN,gBAAgBO,MAAM,EAAE;gBAC3B,OAAO;oBAAEzB,SAAS;oBAAQC,QAAQ;gBAAa;YACjD;YACA,MAAMyB,OAAOT,oBAAAA,YAAYU,IAAI,cAAhBV,oBAAsB,CAAC;YACpC,MAAME,WAAWD,wBAAAA,gBAAgBS,IAAI,cAApBT,wBAA0B,CAAC;YAC5CL,cAAce,QAAOT,gBAAAA,OAAO,CAAC,OAAO,YAAfA,gBAAmB;YACxC,MAAMU,QAAQlE,oBAAoB+D,KAAKvC,MAAMP,MAAM;YACnD,MAAMkD,QAAQ/D,iBAAiBoD,SAASU,MAAME,OAAO;YACrD,MAAMC,UAAU,OAAOF,MAAM1C,QAAQ,KAAK,WAAW0C,MAAM1C,QAAQ,GAAG;YACtE,IAAIU,OAAOf,IAAI,KAAK,aAAaiD,SAAS;gBACxC,OAAO;oBAAEhC,SAAS;oBAAaZ,UAAU4C;gBAAQ;YACnD;YACA,MAAMC,WAAWjE,0BAA0B0D;YAE3C,kEAAkE;YAClE,sBAAsB;YACtB,MAAMQ,WAAW,IAAIC;YACrB,MAAMC,WAAW,CAACC;gBAChB,IAAIC,QAAQJ,SAASX,GAAG,CAACc;gBACzB,IAAI,CAACC,OAAO;oBACVA,QAAQtB,GAAGO,GAAG,CAACd,WAAWH,GAAG,CAAC+B,MAAME,IAAI,CAAC,CAACC,WAAaA,SAASf,MAAM;oBACtES,SAASO,GAAG,CAACJ,KAAKC;gBACpB;gBACA,OAAOA;YACT;YACA,MAAMI,WAAW;gBACf,KAAK,MAAML,OAAOpE,gBAChBgE,SAASU,IAAI,CAACC,UAAU,EACxBX,SAASU,IAAI,CAACE,eAAe,EAC5B;oBACD,IAAI,MAAMT,SAASC,MAAM,OAAOA;gBAClC;gBACA,OAAO;YACT;YACA,MAAMS,gBAAgB,OACpBC;gBAEA,IAAI,gBAAgBA,QAAQ;oBAC1B,MAAMV,MAAM,MAAMK;oBAClB,OAAOL,MAAM;wBAAEA;wBAAKW,gBAAgB;oBAAK,IAAI;gBAC/C;gBACA,OAAO,AAAC,MAAMZ,SAASW,OAAOE,SAAS,IACnC;oBAAEZ,KAAKU,OAAOE,SAAS;oBAAED,gBAAgB;gBAAM,IAC/C;YACN;YAEA,IAAIE,WAA4B;YAChC,IAAIC,UAAkC;YACtC,IAAIrD,OAAOf,IAAI,KAAK,WAAW;oBAInBe,sBACGA,oBAA8BgC;gBAJ3C,MAAMsB,UAAU;oBACdC,QAAQvD,OAAOX,KAAK,CAACkE,MAAM;oBAC3B1C,OAAOxB,MAAMwB,KAAK;oBAClB2C,MAAM,GAAExD,uBAAAA,OAAOX,KAAK,CAACmE,MAAM,YAAnBxD,uBAAuB;oBAC/ByD,MAAM;4BAAKzD,qBAAAA,OAAOX,KAAK,CAACoE,IAAI,YAAjBzD,qBAAqB,EAAE;4BAAOgC,cAAAA,MAAMyB,IAAI,YAAVzB,cAAc,EAAE;qBAAE;gBAC7D;gBACA,KAAK,MAAM0B,QAAQvB,SAASwB,KAAK,CAAE;oBACjC,IAAI,CAAC/F,sBAAsB8F,KAAKE,IAAI,EAAEN,UAAU;oBAChD,MAAMO,MAAM,MAAMb,cAAcU,KAAKI,MAAM;oBAC3C,IAAID,KAAK;wBACPT,WAAW,aAAKS;4BAAKvE,UAAUuE,IAAItB,GAAG;4BAAEwB,IAAI;4BAAQC,QAAQN,KAAKvE,EAAE;;wBACnE;oBACF;gBACF;gBACA,MAAM8E,WAAW9B,SAAS+B,iBAAiB,CAAC7E,MAAMP,MAAM,CAAC;gBACzD,IAAI,CAACsE,YAAYa,YAAa,MAAM3B,SAAS2B,WAAY;oBACvDb,WAAW;wBAAE9D,UAAU2E;wBAAUF,IAAI;wBAAWb,gBAAgB;oBAAM;gBACxE;YACF,OAAO;gBACL,MAAM,EAAEY,MAAM,EAAE,GAAG9D,OAAOX,KAAK;gBAC/B,MAAMwE,MAAM,MAAMb,cAAcc;gBAChC,IAAID,KAAK;oBACPT,WAAW,aACNS;wBACHvE,UAAUuE,IAAItB,GAAG;wBACjBwB,IAAI,gBAAgBD,SAAS,eAAe;;gBAEhD,OAAO;oBACLT,UAAU,gBAAgBS,SAAS,eAAe;gBACpD;YACF;YACA,IAAI,CAACV,UAAU,OAAO;gBAAElD,SAAS;gBAAQC,QAAQkD;YAAQ;YACzD,IAAID,SAAS9D,QAAQ,KAAK4C,SAAS;gBACjC,OAAO;oBAAEhC,SAAS;oBAAaZ,UAAU4C;gBAAQ;YACnD;YAEAhB,GAAGiD,MAAM,CAAC1D,YAAY;gBACpB,CAAC3C,iBAAiBiE,MAAME,OAAO,EAAE,YAAY,EAAEmB,SAAS9D,QAAQ;gBAChE8E,WAAW7F,WAAW8F,eAAe;YACvC;YACA,IAAIjB,SAASF,cAAc,EAAE;gBAC3BhC,GAAGiD,MAAM,CAAC7D,QAAQ;oBAChB,CAACvC,mCAAmC,EAAEqF,SAAS9D,QAAQ;gBACzD;YACF;YACA;;;;SAIC,GACD,MAAMgF,YAAYxC,eAAOR,gCAAAA,aAAcG,GAAG,CAAC,8BAAe;YAC1D,MAAM8C,eAAeC,QACnBlD,CAAAA,gCAAAA,aAAcK,MAAM,KAAK3B,CAAAA,OAAOf,IAAI,KAAK,cAAc,CAACqF,SAAQ;YAElE,IAAIC,gBAAgBzD,SAAS;gBAC3BI,GAAGiD,MAAM,CAACrD,SAAS;oBACjBxB,UAAU8D,SAAS9D,QAAQ;oBAC3B8E,WAAW7F,WAAW8F,eAAe;gBACvC;YACF;YACA,OAAO;gBACLnE,SAAS;gBACTZ,UAAU8D,SAAS9D,QAAQ;gBAC3ByE,IAAIX,SAASW,EAAE;eACXX,SAASY,MAAM,GAAG;gBAAEA,QAAQZ,SAASY,MAAM;YAAC,IAAI,CAAC;gBACrDO;gBACAE,UAAU;;QAEd;QAEF,IAAIzD,QAAQd,OAAO,KAAK,YAAY,OAAOc;QAE3C,IACE,CAACA,QAAQuD,YAAY,IACrBzD,WACAd,OAAOf,IAAI,KAAK,aAChBP,oBAAoBgG,GAAG,CAAC1E,OAAOX,KAAK,CAACkE,MAAM,GAC3C;YACA,KAAKoB,yBAAyB7D,SAASE,QAAQ1B,QAAQ;QACzD;QAEA,MAAMmF,WAAW,MAAMrF,qBAAqB;YAC1CN,QAAQO,MAAMP,MAAM;YACpBgB;YACAR,UAAU0B,QAAQ1B,QAAQ;YAC1BC,UAAUF,MAAME,QAAQ;YACxBR,QACEiC,QAAQuD,YAAY,IAAI3D,UACpB;gBAAE3B,MAAM;gBAAQE,IAAIyB;YAAQ,IAC5B;gBAAE3B,MAAM;gBAAWE,IAAIE,MAAMqB,SAAS;YAAC;YAC7Cd,KAAKmB,eAAe1B,MAAMwB,KAAK;QACjC;QACA,OAAO,aAAKG;YAASyD;;IACvB,EAAE,OAAOG,OAAO;QACdC,QAAQD,KAAK,CACX,6BACAvF,MAAMP,MAAM,EACZO,MAAMqB,SAAS,EACfkE;QAEF,OAAO;YAAE1E,SAAS;YAAQC,QAAQ;QAAS;IAC7C;AACF;AAEA;;;;;;;;;CASC,GACD,eAAewE,yBACb7D,OAA4C,EAC5CxB,QAAgB,EAChBwF,WAA8BlG,oBAAoB;IAElD,KAAK,MAAMmG,SAASD,SAAU;QAC5B,MAAM,IAAIvD,QAAQ,CAACG,UAAYsD,WAAWtD,SAASqD;QACnD,IAAI;gBAGSvF;YAFX,MAAMA,OAAO,MAAMsB,QAAQW,GAAG;YAC9B,IAAI,CAACjC,KAAKmC,MAAM,EAAE;YAClB,IAAIG,QAAOtC,YAAAA,KAAKiC,GAAG,CAAC,uBAATjC,YAAwB,KAAK,OAAO;YAC/C,MAAMsB,QAAQqD,MAAM,CAAC;gBACnB7E;gBACA8E,WAAW7F,WAAW8F,eAAe;YACvC;YACA,OAAO;QACT,EAAE,OAAOO,OAAO;YACdC,QAAQD,KAAK,CAAC,yCAAyC9D,QAAQmE,IAAI,EAAEL;YACrE,OAAO;QACT;IACF;IACA,OAAO;AACT;AAEA;;;;CAIC,GACD,OAAO,SAASM,sBACd7F,KAA6B;IAE7B,OAAOU,YAAY;QAAEd,MAAM;QAAWI;IAAM;AAC9C;AAEA;;;;;CAKC,GACD,OAAO,SAAS8F,qBACd9F,KAAwB;IAExB,OAAOU,YAAY;QAAEd,MAAM;QAAYI;IAAM;AAC/C;AAEA,eAAe6F,sBAAqB"}
+{"version":3,"sources":["../../../../../../libs/tenant/runtime/src/lib/assign-contact-owner.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  assignmentRuleMatches,\n  consentGroupForHost,\n  contactFacetPath,\n  type ContactSource,\n  CRM_ROUND_ROBIN_LAST_ASSIGNED_PATH,\n  type CrmAssignmentTarget,\n  personKey,\n  readContactFacet,\n  readCrmAssignmentSettings,\n  roundRobinOrder,\n} from '@aglyn/aglyn/server'\nimport {\n  firebaseAdmin,\n  getOrgForHost,\n  notifyUsers,\n  restampCrmListFieldsAt,\n} from '@aglyn/tenant-data-admin'\nimport { FieldValue } from 'firebase-admin/firestore'\n\n/**\n * WHO A NEW RECORD BELONGS TO — the one place an owner is decided on the\n * server (AGL-2618).\n *\n * Two entry points over one transaction. `assignOwnerForCapture` is the\n * capture door's pass: it runs the org's assignment rules in order, falls\n * back to the capturing site's default owner, and touches only a record\n * that has NO owner — a door that named one (the console's drawer, an\n * import column, a conversion with a picked owner) has expressed a person's\n * choice. `reassignContactOwner` is the automation's: an author who put\n * \"assign an owner\" on a stage change means to reassign, and the step hands\n * this either a member or the rotation.\n *\n * ## One transaction, because the pointer is shared\n *\n * The round-robin pool's pointer lives on the org document, and two\n * captures landing together must take two different members. Firestore\n * transactions serialize on what they read, so the org document, the\n * contact and the roster documents are all read inside the transaction and\n * the pointer is advanced in the same commit that writes the owner: a\n * concurrent capture that read the same pointer retries and reads the moved\n * one. The alternative — read the pointer, decide, then write — is exactly\n * the read-then-write shape that lets two captures pick the same person.\n *\n * ## The roster is checked, once per member per attempt\n *\n * A rule may name a member who has since left, and a pool may hold one. A\n * rule naming nobody on the roster is passed over rather than stopping the\n * pass — the next rule may well assign — and a pool member who is gone is\n * skipped for the next in the order. `orgs/{orgId}/members/{uid}` is keyed\n * by uid, so the check is one document read per candidate, and only the\n * roster is consulted: a project-level Auth lookup would admit people who\n * are not on this organization at all (AGL-1122).\n *\n * ## The lead follows the contact\n *\n * The capture doors that file a lead (`addHostLead`: a form routed to leads,\n * a sign-up, a booking) key it by `personKey(email)`, so the lead's document\n * is addressable from the capture alone. When it exists it is given the same\n * owner in the same transaction; two doors write the lead AFTER the contact\n * they `void`ed, so for those sources the mirror is retried a few times over\n * the next seconds, detached, and the person's Leads list shows the owner\n * as soon as the lead is there.\n *\n * ## The owner is told, unless they chose themselves\n *\n * One console notification per assignment, for the record the recipient\n * will open: the lead when the site holds one for this person, the contact\n * otherwise. Not when the actor IS the new owner — a rep who converts a\n * lead into their own contact has not been handed anything.\n *\n * ## Never rejects\n *\n * The capture has already succeeded and a form submission must not fail\n * because the CRM could not decide who follows up; a failure is logged and\n * answered as `none`, and the record is exactly as assignable by hand as it\n * was before this existed. The automation executor turns a `none` into the\n * step's recorded error.\n */\n\nexport interface OwnerAssignmentInput {\n  hostId: string\n  /** `orgs/{orgId}/contacts/{contactId}` — the record the owner is written on. */\n  contactId: string\n  /** The contact's address, which keys the lead and names the person in the notification. */\n  email: string\n  /**\n   * The signed-in person making the assignment, when there is one. Never\n   * notified about their own choice; absent for a capture and an automation.\n   */\n  actorUid?: string | null\n}\n\nexport interface CaptureAssignmentInput extends OwnerAssignmentInput {\n  source: ContactSource\n  /** The form the capture came through, for a rule conditioned on it. */\n  formId?: string | null\n  /** The tags the capture carried; the contact's own are read from the facet. */\n  tags?: readonly string[]\n}\n\nexport interface ReassignmentInput extends OwnerAssignmentInput {\n  assign: CrmAssignmentTarget\n}\n\n/** Why an assignment assigned nobody — the automation reports these verbatim. */\nexport type OwnerAssignmentRefusal =\n  | 'no-org'\n  | 'no-contact'\n  | 'no-rule'\n  | 'empty-pool'\n  | 'not-a-member'\n  | 'failed'\n\n/** What decided an assignment: a rule, the site default, the step's member, or the rotation. */\nexport type OwnerAssignedBy = 'rule' | 'default' | 'member' | 'roundRobin'\n\nexport type OwnerAssignment =\n  | {\n      outcome: 'assigned'\n      ownerUid: string\n      by: OwnerAssignedBy\n      /** The rule that decided it, when one did. */\n      ruleId?: string\n      /** The lead document existed and now carries the owner too. */\n      leadMirrored: boolean\n      /** A notification was fanned out to the new owner. */\n      notified: boolean\n    }\n  /** The record already had this owner (a capture), or the same one was named again (a reassignment). */\n  | { outcome: 'unchanged'; ownerUid: string }\n  | { outcome: 'none'; reason: OwnerAssignmentRefusal }\n\n/** The words the run history and the log give each refusal. */\nexport const OWNER_ASSIGNMENT_REFUSALS: Record<OwnerAssignmentRefusal, string> = {\n  'no-org': 'this site has no organization',\n  'no-contact': 'the contact no longer exists',\n  'no-rule': 'no assignment rule matched and the site has no default owner',\n  'empty-pool': 'the round-robin pool has nobody on the roster in it',\n  'not-a-member': 'the owner named is not on the team',\n  failed: 'the owner could not be assigned',\n}\n\n/**\n * The doors whose lead lands after the contact they `void`ed — the ones the\n * mirror is worth retrying for. An order, an import, a manual add and an\n * API call file no lead, and a retry for them would be reads for nothing.\n */\nconst LEAD_FILING_SOURCES: ReadonlySet<ContactSource> = new Set([\n  'form',\n  'member',\n  'booking',\n])\n\n/** How long the detached lead mirror waits between its looks, in order. */\nconst LEAD_MIRROR_RETRY_MS: readonly number[] = [1_000, 2_000, 3_000]\n\ntype Policy =\n  | { kind: 'capture'; input: CaptureAssignmentInput }\n  | { kind: 'reassign'; input: ReassignmentInput }\n\ninterface Decision {\n  ownerUid: string\n  by: OwnerAssignedBy\n  ruleId?: string\n  /** The pointer moves only when the rotation chose. */\n  advancePointer: boolean\n}\n\n/**\n * The console path the owner's notification opens, in the `/{hostDocId}/rest`\n * shape every host notification uses — the console rewrites it to\n * `/{orgSlug}/hosts/{subdomain}/rest` when the link is followed, which is\n * why `hostId` and `orgId` travel on the document. The same spelling the\n * CRM's task notification uses; the hub's own route builder lives in the\n * plugin, which this layer cannot import.\n */\nfunction recordLink(hostId: string, record: AssignedRecord): string {\n  const section = record.kind === 'contact' ? 'contacts' : 'leads'\n  return `/${hostId}/crm/${section}/${encodeURIComponent(record.id)}`\n}\n\n/** The record an assignment notification opens. */\nexport type AssignedRecord =\n  | { kind: 'contact'; id: string }\n  | { kind: 'lead'; id: string }\n\n/**\n * Tells a member a record is now theirs — one console notification, typed\n * by the record it opens — unless the member handed it to themselves.\n * Shared by the pass above and by the routes where a person picks the\n * owner outright (a lead conversion naming a colleague), so every server\n * path that writes `ownerUid` says so in the same words. Never throws;\n * the fan-out swallows its own failures.\n */\nexport async function notifyRecordAssigned(input: {\n  hostId: string\n  orgId: string\n  ownerUid: string\n  actorUid?: string | null\n  record: AssignedRecord\n  /** How the person reads in the message: their name, else their address. */\n  who: string\n}): Promise<boolean> {\n  if (!input.ownerUid || input.ownerUid === (input.actorUid ?? '')) return false\n  const lead = input.record.kind === 'lead'\n  await notifyUsers([input.ownerUid], {\n    type: lead ? 'content.leadAssigned' : 'content.contactAssigned',\n    title: lead ? 'Lead assigned to you' : 'Contact assigned to you',\n    body: input.who,\n    link: recordLink(input.hostId, input.record),\n    orgId: input.orgId,\n    hostId: input.hostId,\n  })\n  return true\n}\n\nasync function assignOwner(policy: Policy): Promise<OwnerAssignment> {\n  const { input } = policy\n  try {\n    const resolved = await getOrgForHost(input.hostId)\n    if (!resolved) return { outcome: 'none', reason: 'no-org' }\n    const { orgId } = resolved\n    const firestore = firebaseAdmin.app().firestore()\n    const orgRef = firestore.collection('orgs').doc(orgId)\n    const contactRef = orgRef.collection('contacts').doc(input.contactId)\n    const membersRef = orgRef.collection('members')\n    const leadKey = personKey(input.email)\n    // Beside the contact on the org, keyed by the same address (AGL-3275).\n    const leadRef = leadKey ? orgRef.collection('leads').doc(leadKey) : null\n\n    let contactName = ''\n    const verdict = await firestore.runTransaction(\n      async (tx): Promise<OwnerAssignment> => {\n        /*\n         * ALL READS BEFORE THE WRITE, which Firestore requires. The org\n         * document is read here rather than trusted from `getOrgForHost`,\n         * because the pointer it carries is the one thing a concurrent\n         * capture may have moved, and the rules and the pool are read from\n         * the same snapshot so the decision and the pointer agree.\n         */\n        const [orgSnapshot, contactSnapshot, leadSnapshot] = await Promise.all([\n          tx.get(orgRef),\n          tx.get(contactRef),\n          leadRef ? tx.get(leadRef) : Promise.resolve(null),\n        ])\n        if (!contactSnapshot.exists) {\n          return { outcome: 'none', reason: 'no-contact' }\n        }\n        const org = (orgSnapshot.data() ?? {}) as Record<string, unknown>\n        const contact = (contactSnapshot.data() ?? {}) as Record<string, unknown>\n        contactName = String(contact['name'] ?? '')\n        const group = consentGroupForHost(org, input.hostId)\n        const facet = readContactFacet(contact, group.groupId)\n        const current = typeof facet.ownerUid === 'string' ? facet.ownerUid : ''\n        if (policy.kind === 'capture' && current) {\n          return { outcome: 'unchanged', ownerUid: current }\n        }\n        const settings = readCrmAssignmentSettings(org)\n\n        // One read per candidate per attempt; a retried transaction reads\n        // afresh, as it must.\n        const onRoster = new Map<string, Promise<boolean>>()\n        const isMember = (uid: string): Promise<boolean> => {\n          let known = onRoster.get(uid)\n          if (!known) {\n            known = tx.get(membersRef.doc(uid)).then((snapshot) => snapshot.exists)\n            onRoster.set(uid, known)\n          }\n          return known\n        }\n        const fromPool = async (): Promise<string | null> => {\n          for (const uid of roundRobinOrder(\n            settings.pool.memberUids,\n            settings.pool.lastAssignedUid,\n          )) {\n            if (await isMember(uid)) return uid\n          }\n          return null\n        }\n        const resolveTarget = async (\n          target: CrmAssignmentTarget,\n        ): Promise<{ uid: string; advancePointer: boolean } | null> => {\n          if ('roundRobin' in target) {\n            const uid = await fromPool()\n            return uid ? { uid, advancePointer: true } : null\n          }\n          return (await isMember(target.memberUid))\n            ? { uid: target.memberUid, advancePointer: false }\n            : null\n        }\n\n        let decision: Decision | null = null\n        let refusal: OwnerAssignmentRefusal = 'no-rule'\n        if (policy.kind === 'capture') {\n          const capture = {\n            source: policy.input.source,\n            email: input.email,\n            formId: policy.input.formId ?? null,\n            tags: [...(policy.input.tags ?? []), ...(facet.tags ?? [])],\n          }\n          for (const rule of settings.rules) {\n            if (!assignmentRuleMatches(rule.when, capture)) continue\n            const hit = await resolveTarget(rule.assign)\n            if (hit) {\n              decision = { ...hit, ownerUid: hit.uid, by: 'rule', ruleId: rule.id }\n              break\n            }\n          }\n          const fallback = settings.hostDefaultOwners[input.hostId]\n          if (!decision && fallback && (await isMember(fallback))) {\n            decision = { ownerUid: fallback, by: 'default', advancePointer: false }\n          }\n        } else {\n          const { assign } = policy.input\n          const hit = await resolveTarget(assign)\n          if (hit) {\n            decision = {\n              ...hit,\n              ownerUid: hit.uid,\n              by: 'roundRobin' in assign ? 'roundRobin' : 'member',\n            }\n          } else {\n            refusal = 'roundRobin' in assign ? 'empty-pool' : 'not-a-member'\n          }\n        }\n        if (!decision) return { outcome: 'none', reason: refusal }\n        if (decision.ownerUid === current) {\n          return { outcome: 'unchanged', ownerUid: current }\n        }\n\n        tx.update(contactRef, {\n          [contactFacetPath(group.groupId, 'ownerUid')]: decision.ownerUid,\n          updatedAt: FieldValue.serverTimestamp(),\n        })\n        if (decision.advancePointer) {\n          tx.update(orgRef, {\n            [CRM_ROUND_ROBIN_LAST_ASSIGNED_PATH]: decision.ownerUid,\n          })\n        }\n        /*\n         * A lead somebody already assigned by hand keeps its owner on a\n         * capture — the contact was new, the lead may not have been — and\n         * follows the contact on a deliberate reassignment.\n         */\n        const leadOwner = String(leadSnapshot?.get('ownerUid') ?? '')\n        const leadMirrored = Boolean(\n          leadSnapshot?.exists && (policy.kind === 'reassign' || !leadOwner),\n        )\n        if (leadMirrored && leadRef) {\n          tx.update(leadRef, {\n            ownerUid: decision.ownerUid,\n            updatedAt: FieldValue.serverTimestamp(),\n          })\n        }\n        return {\n          outcome: 'assigned',\n          ownerUid: decision.ownerUid,\n          by: decision.by,\n          ...(decision.ruleId ? { ruleId: decision.ruleId } : {}),\n          leadMirrored,\n          notified: false,\n        }\n      },\n    )\n    if (verdict.outcome !== 'assigned') return verdict\n    // The owner is what the Contacts list filters by (AGL-3321).\n    await restampCrmListFieldsAt(contactRef, 'contacts')\n\n    if (\n      !verdict.leadMirrored &&\n      leadRef &&\n      policy.kind === 'capture' &&\n      LEAD_FILING_SOURCES.has(policy.input.source)\n    ) {\n      void mirrorOwnerOntoLeadLater(leadRef, verdict.ownerUid)\n    }\n\n    const notified = await notifyRecordAssigned({\n      hostId: input.hostId,\n      orgId,\n      ownerUid: verdict.ownerUid,\n      actorUid: input.actorUid,\n      record:\n        verdict.leadMirrored && leadKey\n          ? { kind: 'lead', id: leadKey }\n          : { kind: 'contact', id: input.contactId },\n      who: contactName || input.email,\n    })\n    return { ...verdict, notified }\n  } catch (error) {\n    console.error(\n      'assignContactOwner failed',\n      input.hostId,\n      input.contactId,\n      error,\n    )\n    return { outcome: 'none', reason: 'failed' }\n  }\n}\n\n/**\n * The detached second look for a lead that lands after the contact.\n *\n * Bounded, and only ever ADDS an owner: a lead that arrived with one (a\n * person assigned it in the meantime) is left alone, and a lead that never\n * arrives costs three reads over six seconds and nothing else. Detached\n * because the capture must not hold `contactCreated` back for it — an\n * automation welcoming the contact has nothing to do with the lead's owner\n * column.\n */\nasync function mirrorOwnerOntoLeadLater(\n  leadRef: FirebaseFirestore.DocumentReference,\n  ownerUid: string,\n  delaysMs: readonly number[] = LEAD_MIRROR_RETRY_MS,\n): Promise<boolean> {\n  for (const delay of delaysMs) {\n    await new Promise((resolve) => setTimeout(resolve, delay))\n    try {\n      const lead = await leadRef.get()\n      if (!lead.exists) continue\n      if (String(lead.get('ownerUid') ?? '')) return false\n      await leadRef.update({\n        ownerUid,\n        updatedAt: FieldValue.serverTimestamp(),\n      })\n      return true\n    } catch (error) {\n      console.error('assignContactOwner lead mirror failed', leadRef.path, error)\n      return false\n    }\n  }\n  return false\n}\n\n/**\n * The capture door's pass: the org's rules in order, then the capturing\n * site's default owner, on a record that has no owner yet. See the module\n * comment for the whole of it.\n */\nexport function assignOwnerForCapture(\n  input: CaptureAssignmentInput,\n): Promise<OwnerAssignment> {\n  return assignOwner({ kind: 'capture', input })\n}\n\n/**\n * The deliberate assignment — the `assignContactOwner` step, and a person\n * handing a record to somebody: a member by uid (verified on the roster) or\n * the next in the round-robin pool, overwriting whoever held it. Naming the\n * owner the record already has changes nothing and tells nobody.\n */\nexport function reassignContactOwner(\n  input: ReassignmentInput,\n): Promise<OwnerAssignment> {\n  return assignOwner({ kind: 'reassign', input })\n}\n\nexport default assignOwnerForCapture\n"],"names":["assignmentRuleMatches","consentGroupForHost","contactFacetPath","CRM_ROUND_ROBIN_LAST_ASSIGNED_PATH","personKey","readContactFacet","readCrmAssignmentSettings","roundRobinOrder","firebaseAdmin","getOrgForHost","notifyUsers","restampCrmListFieldsAt","FieldValue","OWNER_ASSIGNMENT_REFUSALS","failed","LEAD_FILING_SOURCES","Set","LEAD_MIRROR_RETRY_MS","recordLink","hostId","record","section","kind","encodeURIComponent","id","notifyRecordAssigned","input","ownerUid","actorUid","lead","type","title","body","who","link","orgId","assignOwner","policy","resolved","outcome","reason","firestore","app","orgRef","collection","doc","contactRef","contactId","membersRef","leadKey","email","leadRef","contactName","verdict","runTransaction","tx","orgSnapshot","contactSnapshot","contact","leadSnapshot","Promise","all","get","resolve","exists","org","data","String","group","facet","groupId","current","settings","onRoster","Map","isMember","uid","known","then","snapshot","set","fromPool","pool","memberUids","lastAssignedUid","resolveTarget","target","advancePointer","memberUid","decision","refusal","capture","source","formId","tags","rule","rules","when","hit","assign","by","ruleId","fallback","hostDefaultOwners","update","updatedAt","serverTimestamp","leadOwner","leadMirrored","Boolean","notified","has","mirrorOwnerOntoLeadLater","error","console","delaysMs","delay","setTimeout","path","assignOwnerForCapture","reassignContactOwner"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,qBAAqB,EACrBC,mBAAmB,EACnBC,gBAAgB,EAEhBC,kCAAkC,EAElCC,SAAS,EACTC,gBAAgB,EAChBC,yBAAyB,EACzBC,eAAe,QACV,sBAAqB;AAC5B,SACEC,aAAa,EACbC,aAAa,EACbC,WAAW,EACXC,sBAAsB,QACjB,2BAA0B;AACjC,SAASC,UAAU,QAAQ,2BAA0B;AAmHrD,6DAA6D,GAC7D,OAAO,MAAMC,4BAAoE;IAC/E,UAAU;IACV,cAAc;IACd,WAAW;IACX,cAAc;IACd,gBAAgB;IAChBC,QAAQ;AACV,EAAC;AAED;;;;CAIC,GACD,MAAMC,sBAAkD,IAAIC,IAAI;IAC9D;IACA;IACA;CACD;AAED,yEAAyE,GACzE,MAAMC,uBAA0C;IAAC;IAAO;IAAO;CAAM;AAcrE;;;;;;;CAOC,GACD,SAASC,WAAWC,MAAc,EAAEC,MAAsB;IACxD,MAAMC,UAAUD,OAAOE,IAAI,KAAK,YAAY,aAAa;IACzD,OAAO,CAAC,CAAC,EAAEH,OAAO,KAAK,EAAEE,QAAQ,CAAC,EAAEE,mBAAmBH,OAAOI,EAAE,GAAG;AACrE;AAOA;;;;;;;CAOC,GACD,OAAO,eAAeC,qBAAqBC,KAQ1C;QAC4CA;IAA3C,IAAI,CAACA,MAAMC,QAAQ,IAAID,MAAMC,QAAQ,OAAMD,kBAAAA,MAAME,QAAQ,YAAdF,kBAAkB,KAAK,OAAO;IACzE,MAAMG,OAAOH,MAAMN,MAAM,CAACE,IAAI,KAAK;IACnC,MAAMZ,YAAY;QAACgB,MAAMC,QAAQ;KAAC,EAAE;QAClCG,MAAMD,OAAO,yBAAyB;QACtCE,OAAOF,OAAO,yBAAyB;QACvCG,MAAMN,MAAMO,GAAG;QACfC,MAAMhB,WAAWQ,MAAMP,MAAM,EAAEO,MAAMN,MAAM;QAC3Ce,OAAOT,MAAMS,KAAK;QAClBhB,QAAQO,MAAMP,MAAM;IACtB;IACA,OAAO;AACT;AAEA,eAAeiB,YAAYC,MAAc;IACvC,MAAM,EAAEX,KAAK,EAAE,GAAGW;IAClB,IAAI;QACF,MAAMC,WAAW,MAAM7B,cAAciB,MAAMP,MAAM;QACjD,IAAI,CAACmB,UAAU,OAAO;YAAEC,SAAS;YAAQC,QAAQ;QAAS;QAC1D,MAAM,EAAEL,KAAK,EAAE,GAAGG;QAClB,MAAMG,YAAYjC,cAAckC,GAAG,GAAGD,SAAS;QAC/C,MAAME,SAASF,UAAUG,UAAU,CAAC,QAAQC,GAAG,CAACV;QAChD,MAAMW,aAAaH,OAAOC,UAAU,CAAC,YAAYC,GAAG,CAACnB,MAAMqB,SAAS;QACpE,MAAMC,aAAaL,OAAOC,UAAU,CAAC;QACrC,MAAMK,UAAU7C,UAAUsB,MAAMwB,KAAK;QACrC,uEAAuE;QACvE,MAAMC,UAAUF,UAAUN,OAAOC,UAAU,CAAC,SAASC,GAAG,CAACI,WAAW;QAEpE,IAAIG,cAAc;QAClB,MAAMC,UAAU,MAAMZ,UAAUa,cAAc,CAC5C,OAAOC;gBAgBQC,mBACIC,uBACIC;YAjBrB;;;;;;SAMC,GACD,MAAM,CAACF,aAAaC,iBAAiBE,aAAa,GAAG,MAAMC,QAAQC,GAAG,CAAC;gBACrEN,GAAGO,GAAG,CAACnB;gBACPY,GAAGO,GAAG,CAAChB;gBACPK,UAAUI,GAAGO,GAAG,CAACX,WAAWS,QAAQG,OAAO,CAAC;aAC7C;YACD,IAAI,CAACN,gBAAgBO,MAAM,EAAE;gBAC3B,OAAO;oBAAEzB,SAAS;oBAAQC,QAAQ;gBAAa;YACjD;YACA,MAAMyB,OAAOT,oBAAAA,YAAYU,IAAI,cAAhBV,oBAAsB,CAAC;YACpC,MAAME,WAAWD,wBAAAA,gBAAgBS,IAAI,cAApBT,wBAA0B,CAAC;YAC5CL,cAAce,QAAOT,gBAAAA,OAAO,CAAC,OAAO,YAAfA,gBAAmB;YACxC,MAAMU,QAAQnE,oBAAoBgE,KAAKvC,MAAMP,MAAM;YACnD,MAAMkD,QAAQhE,iBAAiBqD,SAASU,MAAME,OAAO;YACrD,MAAMC,UAAU,OAAOF,MAAM1C,QAAQ,KAAK,WAAW0C,MAAM1C,QAAQ,GAAG;YACtE,IAAIU,OAAOf,IAAI,KAAK,aAAaiD,SAAS;gBACxC,OAAO;oBAAEhC,SAAS;oBAAaZ,UAAU4C;gBAAQ;YACnD;YACA,MAAMC,WAAWlE,0BAA0B2D;YAE3C,kEAAkE;YAClE,sBAAsB;YACtB,MAAMQ,WAAW,IAAIC;YACrB,MAAMC,WAAW,CAACC;gBAChB,IAAIC,QAAQJ,SAASX,GAAG,CAACc;gBACzB,IAAI,CAACC,OAAO;oBACVA,QAAQtB,GAAGO,GAAG,CAACd,WAAWH,GAAG,CAAC+B,MAAME,IAAI,CAAC,CAACC,WAAaA,SAASf,MAAM;oBACtES,SAASO,GAAG,CAACJ,KAAKC;gBACpB;gBACA,OAAOA;YACT;YACA,MAAMI,WAAW;gBACf,KAAK,MAAML,OAAOrE,gBAChBiE,SAASU,IAAI,CAACC,UAAU,EACxBX,SAASU,IAAI,CAACE,eAAe,EAC5B;oBACD,IAAI,MAAMT,SAASC,MAAM,OAAOA;gBAClC;gBACA,OAAO;YACT;YACA,MAAMS,gBAAgB,OACpBC;gBAEA,IAAI,gBAAgBA,QAAQ;oBAC1B,MAAMV,MAAM,MAAMK;oBAClB,OAAOL,MAAM;wBAAEA;wBAAKW,gBAAgB;oBAAK,IAAI;gBAC/C;gBACA,OAAO,AAAC,MAAMZ,SAASW,OAAOE,SAAS,IACnC;oBAAEZ,KAAKU,OAAOE,SAAS;oBAAED,gBAAgB;gBAAM,IAC/C;YACN;YAEA,IAAIE,WAA4B;YAChC,IAAIC,UAAkC;YACtC,IAAIrD,OAAOf,IAAI,KAAK,WAAW;oBAInBe,sBACGA,oBAA8BgC;gBAJ3C,MAAMsB,UAAU;oBACdC,QAAQvD,OAAOX,KAAK,CAACkE,MAAM;oBAC3B1C,OAAOxB,MAAMwB,KAAK;oBAClB2C,MAAM,GAAExD,uBAAAA,OAAOX,KAAK,CAACmE,MAAM,YAAnBxD,uBAAuB;oBAC/ByD,MAAM;4BAAKzD,qBAAAA,OAAOX,KAAK,CAACoE,IAAI,YAAjBzD,qBAAqB,EAAE;4BAAOgC,cAAAA,MAAMyB,IAAI,YAAVzB,cAAc,EAAE;qBAAE;gBAC7D;gBACA,KAAK,MAAM0B,QAAQvB,SAASwB,KAAK,CAAE;oBACjC,IAAI,CAAChG,sBAAsB+F,KAAKE,IAAI,EAAEN,UAAU;oBAChD,MAAMO,MAAM,MAAMb,cAAcU,KAAKI,MAAM;oBAC3C,IAAID,KAAK;wBACPT,WAAW,aAAKS;4BAAKvE,UAAUuE,IAAItB,GAAG;4BAAEwB,IAAI;4BAAQC,QAAQN,KAAKvE,EAAE;;wBACnE;oBACF;gBACF;gBACA,MAAM8E,WAAW9B,SAAS+B,iBAAiB,CAAC7E,MAAMP,MAAM,CAAC;gBACzD,IAAI,CAACsE,YAAYa,YAAa,MAAM3B,SAAS2B,WAAY;oBACvDb,WAAW;wBAAE9D,UAAU2E;wBAAUF,IAAI;wBAAWb,gBAAgB;oBAAM;gBACxE;YACF,OAAO;gBACL,MAAM,EAAEY,MAAM,EAAE,GAAG9D,OAAOX,KAAK;gBAC/B,MAAMwE,MAAM,MAAMb,cAAcc;gBAChC,IAAID,KAAK;oBACPT,WAAW,aACNS;wBACHvE,UAAUuE,IAAItB,GAAG;wBACjBwB,IAAI,gBAAgBD,SAAS,eAAe;;gBAEhD,OAAO;oBACLT,UAAU,gBAAgBS,SAAS,eAAe;gBACpD;YACF;YACA,IAAI,CAACV,UAAU,OAAO;gBAAElD,SAAS;gBAAQC,QAAQkD;YAAQ;YACzD,IAAID,SAAS9D,QAAQ,KAAK4C,SAAS;gBACjC,OAAO;oBAAEhC,SAAS;oBAAaZ,UAAU4C;gBAAQ;YACnD;YAEAhB,GAAGiD,MAAM,CAAC1D,YAAY;gBACpB,CAAC5C,iBAAiBkE,MAAME,OAAO,EAAE,YAAY,EAAEmB,SAAS9D,QAAQ;gBAChE8E,WAAW7F,WAAW8F,eAAe;YACvC;YACA,IAAIjB,SAASF,cAAc,EAAE;gBAC3BhC,GAAGiD,MAAM,CAAC7D,QAAQ;oBAChB,CAACxC,mCAAmC,EAAEsF,SAAS9D,QAAQ;gBACzD;YACF;YACA;;;;SAIC,GACD,MAAMgF,YAAYxC,eAAOR,gCAAAA,aAAcG,GAAG,CAAC,8BAAe;YAC1D,MAAM8C,eAAeC,QACnBlD,CAAAA,gCAAAA,aAAcK,MAAM,KAAK3B,CAAAA,OAAOf,IAAI,KAAK,cAAc,CAACqF,SAAQ;YAElE,IAAIC,gBAAgBzD,SAAS;gBAC3BI,GAAGiD,MAAM,CAACrD,SAAS;oBACjBxB,UAAU8D,SAAS9D,QAAQ;oBAC3B8E,WAAW7F,WAAW8F,eAAe;gBACvC;YACF;YACA,OAAO;gBACLnE,SAAS;gBACTZ,UAAU8D,SAAS9D,QAAQ;gBAC3ByE,IAAIX,SAASW,EAAE;eACXX,SAASY,MAAM,GAAG;gBAAEA,QAAQZ,SAASY,MAAM;YAAC,IAAI,CAAC;gBACrDO;gBACAE,UAAU;;QAEd;QAEF,IAAIzD,QAAQd,OAAO,KAAK,YAAY,OAAOc;QAC3C,6DAA6D;QAC7D,MAAM1C,uBAAuBmC,YAAY;QAEzC,IACE,CAACO,QAAQuD,YAAY,IACrBzD,WACAd,OAAOf,IAAI,KAAK,aAChBP,oBAAoBgG,GAAG,CAAC1E,OAAOX,KAAK,CAACkE,MAAM,GAC3C;YACA,KAAKoB,yBAAyB7D,SAASE,QAAQ1B,QAAQ;QACzD;QAEA,MAAMmF,WAAW,MAAMrF,qBAAqB;YAC1CN,QAAQO,MAAMP,MAAM;YACpBgB;YACAR,UAAU0B,QAAQ1B,QAAQ;YAC1BC,UAAUF,MAAME,QAAQ;YACxBR,QACEiC,QAAQuD,YAAY,IAAI3D,UACpB;gBAAE3B,MAAM;gBAAQE,IAAIyB;YAAQ,IAC5B;gBAAE3B,MAAM;gBAAWE,IAAIE,MAAMqB,SAAS;YAAC;YAC7Cd,KAAKmB,eAAe1B,MAAMwB,KAAK;QACjC;QACA,OAAO,aAAKG;YAASyD;;IACvB,EAAE,OAAOG,OAAO;QACdC,QAAQD,KAAK,CACX,6BACAvF,MAAMP,MAAM,EACZO,MAAMqB,SAAS,EACfkE;QAEF,OAAO;YAAE1E,SAAS;YAAQC,QAAQ;QAAS;IAC7C;AACF;AAEA;;;;;;;;;CASC,GACD,eAAewE,yBACb7D,OAA4C,EAC5CxB,QAAgB,EAChBwF,WAA8BlG,oBAAoB;IAElD,KAAK,MAAMmG,SAASD,SAAU;QAC5B,MAAM,IAAIvD,QAAQ,CAACG,UAAYsD,WAAWtD,SAASqD;QACnD,IAAI;gBAGSvF;YAFX,MAAMA,OAAO,MAAMsB,QAAQW,GAAG;YAC9B,IAAI,CAACjC,KAAKmC,MAAM,EAAE;YAClB,IAAIG,QAAOtC,YAAAA,KAAKiC,GAAG,CAAC,uBAATjC,YAAwB,KAAK,OAAO;YAC/C,MAAMsB,QAAQqD,MAAM,CAAC;gBACnB7E;gBACA8E,WAAW7F,WAAW8F,eAAe;YACvC;YACA,OAAO;QACT,EAAE,OAAOO,OAAO;YACdC,QAAQD,KAAK,CAAC,yCAAyC9D,QAAQmE,IAAI,EAAEL;YACrE,OAAO;QACT;IACF;IACA,OAAO;AACT;AAEA;;;;CAIC,GACD,OAAO,SAASM,sBACd7F,KAA6B;IAE7B,OAAOU,YAAY;QAAEd,MAAM;QAAWI;IAAM;AAC9C;AAEA;;;;;CAKC,GACD,OAAO,SAAS8F,qBACd9F,KAAwB;IAExB,OAAOU,YAAY;QAAEd,MAAM;QAAYI;IAAM;AAC/C;AAEA,eAAe6F,sBAAqB"}

package/src/lib/associate-company-by-domain.js

@@ -15,8 +15,8 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */ import { companyDomainForEmail, companyNameForDomain, CRM_COLLECTIONS, crmReadTokens, crmScopeTokens, nameSearchFields, orgAutoCreatesCompanies } from "@aglyn/aglyn/server";
-import { consentGroupForSite, contactCompanyLinkFields, firebaseAdmin, getOrgForHost, writeContactCompanyLink } from "@aglyn/tenant-data-admin";
-import { COMPANY_CONTACTS_COUNT_FIELD, planContactCompanyLink } from "@aglyn/aglyn/server";
+import { consentGroupForSite, contactCompanyLinkFields, firebaseAdmin, getOrgForHost, restampCrmListFieldsAt, writeContactCompanyLink } from "@aglyn/tenant-data-admin";
+import { COMPANY_CONTACTS_COUNT_FIELD, crmNewRecordListFields, planContactCompanyLink } from "@aglyn/aglyn/server";
 import { FieldValue } from "firebase-admin/firestore";
 /**
  * Link a NEW contact to the company its email domain names (AGL-2613).
@@ -121,18 +121,21 @@ import { FieldValue } from "firebase-admin/firestore";
         };
         const companyRef = companiesRef.doc(plan.companyId);
         const batch = firestore.batch();
-        batch.set(companyRef, _extends({}, nameSearchFields(companyNameForDomain(domain)), {
+        const company = _extends({}, nameSearchFields(companyNameForDomain(domain)), {
             domain,
             visibleTo: crmScopeTokens(org, group),
             hostId: created.hostId,
             [COMPANY_CONTACTS_COUNT_FIELD]: 1,
             createdAt: FieldValue.serverTimestamp(),
             updatedAt: FieldValue.serverTimestamp()
-        }));
+        });
+        batch.set(companyRef, _extends({}, company, crmNewRecordListFields('companies', company)));
         batch.update(contactRef, _extends({}, contactCompanyLinkFields(plan, group.groupId), {
             updatedAt: FieldValue.serverTimestamp()
         }));
         await batch.commit();
+        // The company is what the Contacts list filters by (AGL-3321).
+        await restampCrmListFieldsAt(contactRef, 'contacts');
         return {
             outcome: 'created',
             companyId: plan.companyId

package/src/lib/associate-company-by-domain.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/tenant/runtime/src/lib/associate-company-by-domain.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  companyDomainForEmail,\n  companyNameForDomain,\n  CRM_COLLECTIONS,\n  crmReadTokens,\n  crmScopeTokens,\n  nameSearchFields,\n  orgAutoCreatesCompanies,\n} from '@aglyn/aglyn/server'\nimport {\n  consentGroupForSite,\n  contactCompanyLinkFields,\n  firebaseAdmin,\n  getOrgForHost,\n  type HostContactCreated,\n  writeContactCompanyLink,\n} from '@aglyn/tenant-data-admin'\nimport { COMPANY_CONTACTS_COUNT_FIELD, planContactCompanyLink } from '@aglyn/aglyn/server'\nimport { FieldValue } from 'firebase-admin/firestore'\n\n/** What the association did, for the spec and the log. */\nexport type CompanyAssociation =\n  | { outcome: 'linked' | 'created'; companyId: string }\n  | {\n      outcome: 'none'\n      reason: 'no-domain' | 'no-org' | 'ambiguous' | 'no-match' | 'failed'\n    }\n\n/**\n * Link a NEW contact to the company its email domain names (AGL-2613).\n *\n * HubSpot associates a contact with a company on domain the moment the\n * contact exists, and that is the moment this runs: once, from the capture\n * door, for a person the org did not hold before. A repeat visit by somebody\n * already held is not a new person and re-asks nothing; a door that already\n * knew the company — the console's create drawer, an import row naming one\n * — has said so in the facet and this is not called at all.\n *\n * ## Bounded: one query, one commit\n *\n * The query is `companies where domain == d and visibleTo array-contains-any\n * (the capturing scope's read tokens)`, capped at two — the `(visibleTo\n * CONTAINS, domain ASC)` composite serves it. Two rather than one because\n * the answer has to be \"exactly one\": two companies at one domain visible\n * to this site is an ambiguity a capture must not resolve by picking the\n * first, and the contact waits for a person. The scope predicate is the\n * console's own listener predicate, so a company this site could not open\n * is not a match — an agency's client at `acme.com` is not linked to a\n * sibling client's Acme.\n *\n * The write is one batch: the facet and the mirror on the contact, and the\n * count on the company. The contact is fresh, so the plan is the trivial\n * one — no previous link, nothing held elsewhere — and needs no read of the\n * document.\n *\n * ## Creating is a setting, and off by default\n *\n * With `crm.autoCreateCompanies` on the org document, a domain no visible\n * company carries becomes one, named after the domain and scoped exactly as\n * the contact was — `crmScopeTokens`, the stamp every CRM creator uses —\n * with the count starting at one. Public mailbox domains never reach this\n * branch, because `companyDomainForEmail` answers `null` for them: a\n * workspace's consumer list is not a list of accounts.\n *\n * ## The same posture as the capture\n *\n * Never throws. The capture has already succeeded and a form submission\n * must not fail because the CRM could not file its author; a failure is\n * logged and answered as `none`, and the person is exactly as capturable\n * by hand as they were before this existed.\n */\nexport async function associateCompanyByDomain(\n  created: Pick<HostContactCreated, 'hostId' | 'contactId' | 'email'>,\n): Promise<CompanyAssociation> {\n  const domain = companyDomainForEmail(created.email)\n  if (!domain) return { outcome: 'none', reason: 'no-domain' }\n  try {\n    const resolved = await getOrgForHost(created.hostId)\n    if (!resolved) return { outcome: 'none', reason: 'no-org' }\n    const org = resolved.org as Record<string, unknown>\n    const group = await consentGroupForSite(created.hostId, org)\n    const firestore = firebaseAdmin.app().firestore()\n    const orgRef = firestore.collection('orgs').doc(resolved.orgId)\n    const companiesRef = orgRef.collection(CRM_COLLECTIONS.companies)\n    const contactRef = orgRef.collection('contacts').doc(created.contactId)\n\n    const matches = await companiesRef\n      .where('domain', '==', domain)\n      .where('visibleTo', 'array-contains-any', crmReadTokens(group))\n      .limit(2)\n      .get()\n    if (matches.size > 1) return { outcome: 'none', reason: 'ambiguous' }\n    if (matches.size === 1) {\n      const companyId = matches.docs[0].id\n      await writeContactCompanyLink({\n        firestore,\n        contactRef,\n        contact: null,\n        companiesRef,\n        groupId: group.groupId,\n        companyId,\n      })\n      return { outcome: 'linked', companyId }\n    }\n    if (!orgAutoCreatesCompanies(org)) {\n      return { outcome: 'none', reason: 'no-match' }\n    }\n\n    /*\n     * The company and the link in one commit, so a company never exists\n     * with a count of one and no contact naming it — or the reverse. The\n     * count is written as a value rather than an increment because the\n     * document is being created in the same batch, and the plan's `+1` is\n     * exactly what a fresh company with one contact stores.\n     */\n    const plan = planContactCompanyLink(\n      { companyId: null, companyIds: [], heldElsewhere: [] },\n      companiesRef.doc().id,\n    )\n    if (!plan?.companyId) return { outcome: 'none', reason: 'failed' }\n    const companyRef = companiesRef.doc(plan.companyId)\n    const batch = firestore.batch()\n    batch.set(companyRef, {\n      ...nameSearchFields(companyNameForDomain(domain)),\n      domain,\n      visibleTo: crmScopeTokens(org, group),\n      hostId: created.hostId,\n      [COMPANY_CONTACTS_COUNT_FIELD]: 1,\n      createdAt: FieldValue.serverTimestamp(),\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n    batch.update(contactRef, {\n      ...contactCompanyLinkFields(plan, group.groupId),\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n    await batch.commit()\n    return { outcome: 'created', companyId: plan.companyId }\n  } catch (error) {\n    console.error(\n      'associateCompanyByDomain failed',\n      created.hostId,\n      created.contactId,\n      error,\n    )\n    return { outcome: 'none', reason: 'failed' }\n  }\n}\n\nexport default associateCompanyByDomain\n"],"names":["companyDomainForEmail","companyNameForDomain","CRM_COLLECTIONS","crmReadTokens","crmScopeTokens","nameSearchFields","orgAutoCreatesCompanies","consentGroupForSite","contactCompanyLinkFields","firebaseAdmin","getOrgForHost","writeContactCompanyLink","COMPANY_CONTACTS_COUNT_FIELD","planContactCompanyLink","FieldValue","associateCompanyByDomain","created","domain","email","outcome","reason","resolved","hostId","org","group","firestore","app","orgRef","collection","doc","orgId","companiesRef","companies","contactRef","contactId","matches","where","limit","get","size","companyId","docs","id","contact","groupId","plan","companyIds","heldElsewhere","companyRef","batch","set","visibleTo","createdAt","serverTimestamp","updatedAt","update","commit","error","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,qBAAqB,EACrBC,oBAAoB,EACpBC,eAAe,EACfC,aAAa,EACbC,cAAc,EACdC,gBAAgB,EAChBC,uBAAuB,QAClB,sBAAqB;AAC5B,SACEC,mBAAmB,EACnBC,wBAAwB,EACxBC,aAAa,EACbC,aAAa,EAEbC,uBAAuB,QAClB,2BAA0B;AACjC,SAASC,4BAA4B,EAAEC,sBAAsB,QAAQ,sBAAqB;AAC1F,SAASC,UAAU,QAAQ,2BAA0B;AAUrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CC,GACD,OAAO,eAAeC,yBACpBC,OAAmE;IAEnE,MAAMC,SAASjB,sBAAsBgB,QAAQE,KAAK;IAClD,IAAI,CAACD,QAAQ,OAAO;QAAEE,SAAS;QAAQC,QAAQ;IAAY;IAC3D,IAAI;QACF,MAAMC,WAAW,MAAMX,cAAcM,QAAQM,MAAM;QACnD,IAAI,CAACD,UAAU,OAAO;YAAEF,SAAS;YAAQC,QAAQ;QAAS;QAC1D,MAAMG,MAAMF,SAASE,GAAG;QACxB,MAAMC,QAAQ,MAAMjB,oBAAoBS,QAAQM,MAAM,EAAEC;QACxD,MAAME,YAAYhB,cAAciB,GAAG,GAAGD,SAAS;QAC/C,MAAME,SAASF,UAAUG,UAAU,CAAC,QAAQC,GAAG,CAACR,SAASS,KAAK;QAC9D,MAAMC,eAAeJ,OAAOC,UAAU,CAAC1B,gBAAgB8B,SAAS;QAChE,MAAMC,aAAaN,OAAOC,UAAU,CAAC,YAAYC,GAAG,CAACb,QAAQkB,SAAS;QAEtE,MAAMC,UAAU,MAAMJ,aACnBK,KAAK,CAAC,UAAU,MAAMnB,QACtBmB,KAAK,CAAC,aAAa,sBAAsBjC,cAAcqB,QACvDa,KAAK,CAAC,GACNC,GAAG;QACN,IAAIH,QAAQI,IAAI,GAAG,GAAG,OAAO;YAAEpB,SAAS;YAAQC,QAAQ;QAAY;QACpE,IAAIe,QAAQI,IAAI,KAAK,GAAG;YACtB,MAAMC,YAAYL,QAAQM,IAAI,CAAC,EAAE,CAACC,EAAE;YACpC,MAAM/B,wBAAwB;gBAC5Bc;gBACAQ;gBACAU,SAAS;gBACTZ;gBACAa,SAASpB,MAAMoB,OAAO;gBACtBJ;YACF;YACA,OAAO;gBAAErB,SAAS;gBAAUqB;YAAU;QACxC;QACA,IAAI,CAAClC,wBAAwBiB,MAAM;YACjC,OAAO;gBAAEJ,SAAS;gBAAQC,QAAQ;YAAW;QAC/C;QAEA;;;;;;KAMC,GACD,MAAMyB,OAAOhC,uBACX;YAAE2B,WAAW;YAAMM,YAAY,EAAE;YAAEC,eAAe,EAAE;QAAC,GACrDhB,aAAaF,GAAG,GAAGa,EAAE;QAEvB,IAAI,EAACG,wBAAAA,KAAML,SAAS,GAAE,OAAO;YAAErB,SAAS;YAAQC,QAAQ;QAAS;QACjE,MAAM4B,aAAajB,aAAaF,GAAG,CAACgB,KAAKL,SAAS;QAClD,MAAMS,QAAQxB,UAAUwB,KAAK;QAC7BA,MAAMC,GAAG,CAACF,YAAY,aACjB3C,iBAAiBJ,qBAAqBgB;YACzCA;YACAkC,WAAW/C,eAAemB,KAAKC;YAC/BF,QAAQN,QAAQM,MAAM;YACtB,CAACV,6BAA6B,EAAE;YAChCwC,WAAWtC,WAAWuC,eAAe;YACrCC,WAAWxC,WAAWuC,eAAe;;QAEvCJ,MAAMM,MAAM,CAACtB,YAAY,aACpBzB,yBAAyBqC,MAAMrB,MAAMoB,OAAO;YAC/CU,WAAWxC,WAAWuC,eAAe;;QAEvC,MAAMJ,MAAMO,MAAM;QAClB,OAAO;YAAErC,SAAS;YAAWqB,WAAWK,KAAKL,SAAS;QAAC;IACzD,EAAE,OAAOiB,OAAO;QACdC,QAAQD,KAAK,CACX,mCACAzC,QAAQM,MAAM,EACdN,QAAQkB,SAAS,EACjBuB;QAEF,OAAO;YAAEtC,SAAS;YAAQC,QAAQ;QAAS;IAC7C;AACF;AAEA,eAAeL,yBAAwB"}
+{"version":3,"sources":["../../../../../../libs/tenant/runtime/src/lib/associate-company-by-domain.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  companyDomainForEmail,\n  companyNameForDomain,\n  CRM_COLLECTIONS,\n  crmReadTokens,\n  crmScopeTokens,\n  nameSearchFields,\n  orgAutoCreatesCompanies,\n} from '@aglyn/aglyn/server'\nimport {\n  consentGroupForSite,\n  contactCompanyLinkFields,\n  firebaseAdmin,\n  getOrgForHost,\n  type HostContactCreated,\n  restampCrmListFieldsAt,\n  writeContactCompanyLink,\n} from '@aglyn/tenant-data-admin'\nimport {\n  COMPANY_CONTACTS_COUNT_FIELD,\n  crmNewRecordListFields,\n  planContactCompanyLink,\n} from '@aglyn/aglyn/server'\nimport { FieldValue } from 'firebase-admin/firestore'\n\n/** What the association did, for the spec and the log. */\nexport type CompanyAssociation =\n  | { outcome: 'linked' | 'created'; companyId: string }\n  | {\n      outcome: 'none'\n      reason: 'no-domain' | 'no-org' | 'ambiguous' | 'no-match' | 'failed'\n    }\n\n/**\n * Link a NEW contact to the company its email domain names (AGL-2613).\n *\n * HubSpot associates a contact with a company on domain the moment the\n * contact exists, and that is the moment this runs: once, from the capture\n * door, for a person the org did not hold before. A repeat visit by somebody\n * already held is not a new person and re-asks nothing; a door that already\n * knew the company — the console's create drawer, an import row naming one\n * — has said so in the facet and this is not called at all.\n *\n * ## Bounded: one query, one commit\n *\n * The query is `companies where domain == d and visibleTo array-contains-any\n * (the capturing scope's read tokens)`, capped at two — the `(visibleTo\n * CONTAINS, domain ASC)` composite serves it. Two rather than one because\n * the answer has to be \"exactly one\": two companies at one domain visible\n * to this site is an ambiguity a capture must not resolve by picking the\n * first, and the contact waits for a person. The scope predicate is the\n * console's own listener predicate, so a company this site could not open\n * is not a match — an agency's client at `acme.com` is not linked to a\n * sibling client's Acme.\n *\n * The write is one batch: the facet and the mirror on the contact, and the\n * count on the company. The contact is fresh, so the plan is the trivial\n * one — no previous link, nothing held elsewhere — and needs no read of the\n * document.\n *\n * ## Creating is a setting, and off by default\n *\n * With `crm.autoCreateCompanies` on the org document, a domain no visible\n * company carries becomes one, named after the domain and scoped exactly as\n * the contact was — `crmScopeTokens`, the stamp every CRM creator uses —\n * with the count starting at one. Public mailbox domains never reach this\n * branch, because `companyDomainForEmail` answers `null` for them: a\n * workspace's consumer list is not a list of accounts.\n *\n * ## The same posture as the capture\n *\n * Never throws. The capture has already succeeded and a form submission\n * must not fail because the CRM could not file its author; a failure is\n * logged and answered as `none`, and the person is exactly as capturable\n * by hand as they were before this existed.\n */\nexport async function associateCompanyByDomain(\n  created: Pick<HostContactCreated, 'hostId' | 'contactId' | 'email'>,\n): Promise<CompanyAssociation> {\n  const domain = companyDomainForEmail(created.email)\n  if (!domain) return { outcome: 'none', reason: 'no-domain' }\n  try {\n    const resolved = await getOrgForHost(created.hostId)\n    if (!resolved) return { outcome: 'none', reason: 'no-org' }\n    const org = resolved.org as Record<string, unknown>\n    const group = await consentGroupForSite(created.hostId, org)\n    const firestore = firebaseAdmin.app().firestore()\n    const orgRef = firestore.collection('orgs').doc(resolved.orgId)\n    const companiesRef = orgRef.collection(CRM_COLLECTIONS.companies)\n    const contactRef = orgRef.collection('contacts').doc(created.contactId)\n\n    const matches = await companiesRef\n      .where('domain', '==', domain)\n      .where('visibleTo', 'array-contains-any', crmReadTokens(group))\n      .limit(2)\n      .get()\n    if (matches.size > 1) return { outcome: 'none', reason: 'ambiguous' }\n    if (matches.size === 1) {\n      const companyId = matches.docs[0].id\n      await writeContactCompanyLink({\n        firestore,\n        contactRef,\n        contact: null,\n        companiesRef,\n        groupId: group.groupId,\n        companyId,\n      })\n      return { outcome: 'linked', companyId }\n    }\n    if (!orgAutoCreatesCompanies(org)) {\n      return { outcome: 'none', reason: 'no-match' }\n    }\n\n    /*\n     * The company and the link in one commit, so a company never exists\n     * with a count of one and no contact naming it — or the reverse. The\n     * count is written as a value rather than an increment because the\n     * document is being created in the same batch, and the plan's `+1` is\n     * exactly what a fresh company with one contact stores.\n     */\n    const plan = planContactCompanyLink(\n      { companyId: null, companyIds: [], heldElsewhere: [] },\n      companiesRef.doc().id,\n    )\n    if (!plan?.companyId) return { outcome: 'none', reason: 'failed' }\n    const companyRef = companiesRef.doc(plan.companyId)\n    const batch = firestore.batch()\n    const company: Record<string, unknown> = {\n      ...nameSearchFields(companyNameForDomain(domain)),\n      domain,\n      visibleTo: crmScopeTokens(org, group),\n      hostId: created.hostId,\n      [COMPANY_CONTACTS_COUNT_FIELD]: 1,\n      createdAt: FieldValue.serverTimestamp(),\n      updatedAt: FieldValue.serverTimestamp(),\n    }\n    batch.set(companyRef, {\n      ...company,\n      // What the Companies list searches and filters by (AGL-3321).\n      ...crmNewRecordListFields('companies', company),\n    })\n    batch.update(contactRef, {\n      ...contactCompanyLinkFields(plan, group.groupId),\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n    await batch.commit()\n    // The company is what the Contacts list filters by (AGL-3321).\n    await restampCrmListFieldsAt(contactRef, 'contacts')\n    return { outcome: 'created', companyId: plan.companyId }\n  } catch (error) {\n    console.error(\n      'associateCompanyByDomain failed',\n      created.hostId,\n      created.contactId,\n      error,\n    )\n    return { outcome: 'none', reason: 'failed' }\n  }\n}\n\nexport default associateCompanyByDomain\n"],"names":["companyDomainForEmail","companyNameForDomain","CRM_COLLECTIONS","crmReadTokens","crmScopeTokens","nameSearchFields","orgAutoCreatesCompanies","consentGroupForSite","contactCompanyLinkFields","firebaseAdmin","getOrgForHost","restampCrmListFieldsAt","writeContactCompanyLink","COMPANY_CONTACTS_COUNT_FIELD","crmNewRecordListFields","planContactCompanyLink","FieldValue","associateCompanyByDomain","created","domain","email","outcome","reason","resolved","hostId","org","group","firestore","app","orgRef","collection","doc","orgId","companiesRef","companies","contactRef","contactId","matches","where","limit","get","size","companyId","docs","id","contact","groupId","plan","companyIds","heldElsewhere","companyRef","batch","company","visibleTo","createdAt","serverTimestamp","updatedAt","set","update","commit","error","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,qBAAqB,EACrBC,oBAAoB,EACpBC,eAAe,EACfC,aAAa,EACbC,cAAc,EACdC,gBAAgB,EAChBC,uBAAuB,QAClB,sBAAqB;AAC5B,SACEC,mBAAmB,EACnBC,wBAAwB,EACxBC,aAAa,EACbC,aAAa,EAEbC,sBAAsB,EACtBC,uBAAuB,QAClB,2BAA0B;AACjC,SACEC,4BAA4B,EAC5BC,sBAAsB,EACtBC,sBAAsB,QACjB,sBAAqB;AAC5B,SAASC,UAAU,QAAQ,2BAA0B;AAUrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CC,GACD,OAAO,eAAeC,yBACpBC,OAAmE;IAEnE,MAAMC,SAASnB,sBAAsBkB,QAAQE,KAAK;IAClD,IAAI,CAACD,QAAQ,OAAO;QAAEE,SAAS;QAAQC,QAAQ;IAAY;IAC3D,IAAI;QACF,MAAMC,WAAW,MAAMb,cAAcQ,QAAQM,MAAM;QACnD,IAAI,CAACD,UAAU,OAAO;YAAEF,SAAS;YAAQC,QAAQ;QAAS;QAC1D,MAAMG,MAAMF,SAASE,GAAG;QACxB,MAAMC,QAAQ,MAAMnB,oBAAoBW,QAAQM,MAAM,EAAEC;QACxD,MAAME,YAAYlB,cAAcmB,GAAG,GAAGD,SAAS;QAC/C,MAAME,SAASF,UAAUG,UAAU,CAAC,QAAQC,GAAG,CAACR,SAASS,KAAK;QAC9D,MAAMC,eAAeJ,OAAOC,UAAU,CAAC5B,gBAAgBgC,SAAS;QAChE,MAAMC,aAAaN,OAAOC,UAAU,CAAC,YAAYC,GAAG,CAACb,QAAQkB,SAAS;QAEtE,MAAMC,UAAU,MAAMJ,aACnBK,KAAK,CAAC,UAAU,MAAMnB,QACtBmB,KAAK,CAAC,aAAa,sBAAsBnC,cAAcuB,QACvDa,KAAK,CAAC,GACNC,GAAG;QACN,IAAIH,QAAQI,IAAI,GAAG,GAAG,OAAO;YAAEpB,SAAS;YAAQC,QAAQ;QAAY;QACpE,IAAIe,QAAQI,IAAI,KAAK,GAAG;YACtB,MAAMC,YAAYL,QAAQM,IAAI,CAAC,EAAE,CAACC,EAAE;YACpC,MAAMhC,wBAAwB;gBAC5Be;gBACAQ;gBACAU,SAAS;gBACTZ;gBACAa,SAASpB,MAAMoB,OAAO;gBACtBJ;YACF;YACA,OAAO;gBAAErB,SAAS;gBAAUqB;YAAU;QACxC;QACA,IAAI,CAACpC,wBAAwBmB,MAAM;YACjC,OAAO;gBAAEJ,SAAS;gBAAQC,QAAQ;YAAW;QAC/C;QAEA;;;;;;KAMC,GACD,MAAMyB,OAAOhC,uBACX;YAAE2B,WAAW;YAAMM,YAAY,EAAE;YAAEC,eAAe,EAAE;QAAC,GACrDhB,aAAaF,GAAG,GAAGa,EAAE;QAEvB,IAAI,EAACG,wBAAAA,KAAML,SAAS,GAAE,OAAO;YAAErB,SAAS;YAAQC,QAAQ;QAAS;QACjE,MAAM4B,aAAajB,aAAaF,GAAG,CAACgB,KAAKL,SAAS;QAClD,MAAMS,QAAQxB,UAAUwB,KAAK;QAC7B,MAAMC,UAAmC,aACpC/C,iBAAiBJ,qBAAqBkB;YACzCA;YACAkC,WAAWjD,eAAeqB,KAAKC;YAC/BF,QAAQN,QAAQM,MAAM;YACtB,CAACX,6BAA6B,EAAE;YAChCyC,WAAWtC,WAAWuC,eAAe;YACrCC,WAAWxC,WAAWuC,eAAe;;QAEvCJ,MAAMM,GAAG,CAACP,YAAY,aACjBE,SAEAtC,uBAAuB,aAAasC;QAEzCD,MAAMO,MAAM,CAACvB,YAAY,aACpB3B,yBAAyBuC,MAAMrB,MAAMoB,OAAO;YAC/CU,WAAWxC,WAAWuC,eAAe;;QAEvC,MAAMJ,MAAMQ,MAAM;QAClB,+DAA+D;QAC/D,MAAMhD,uBAAuBwB,YAAY;QACzC,OAAO;YAAEd,SAAS;YAAWqB,WAAWK,KAAKL,SAAS;QAAC;IACzD,EAAE,OAAOkB,OAAO;QACdC,QAAQD,KAAK,CACX,mCACA1C,QAAQM,MAAM,EACdN,QAAQkB,SAAS,EACjBwB;QAEF,OAAO;YAAEvC,SAAS;YAAQC,QAAQ;QAAS;IAC7C;AACF;AAEA,eAAeL,yBAAwB"}

package/src/lib/compose-screen-nodes.d.ts

@@ -188,5 +188,11 @@ export declare function composeScreenNodes(options: {
     timeZone?: string;
     /** The social card the head shares this page as (AGL-2850). */
     socialImages?: ComposeSocialImages;
+    /**
+     * Internal: `false` when this compose IS the fallback to a held page's
+     * last clean version, so a fallback that holds too serves nothing rather
+     * than falling back again.
+     */
+    pageReviewFallback?: boolean;
 }): Promise<Record<string, any> | null>;
 export default composeScreenNodes;

package/src/lib/compose-screen-nodes.js

@@ -18,6 +18,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
 // By path: the overlay is server-only, and every `@aglyn/aglyn` barrel
 // re-exports `app-utils/server` into published pages.
 import { applyMediaAssetFacts, mediaAssetRefs } from "@aglyn/aglyn/app-utils/media-asset-facts";
+import { recordServedPageVersion, reviewHostedPage, servedPageVersion } from "@aglyn/tenant-data-admin/server/hosted-page-review";
 import applyDuePublishSchedule from "./apply-publish-schedule.js";
 import getComponents from "./get-components.js";
 import getDatasets from "./get-datasets.js";
@@ -551,7 +552,41 @@ import { stampFormDatasetBindings } from "./stamp-form-dataset-bindings.js";
     void composed.catch(()=>undefined);
     const versionRes = await versionPromise;
     if (versionRes.error || !versionRes.version) return null;
-    return composed;
+    /*
+   * THE PAGE PHISHING REVIEW (AGL-3356).
+   *
+   * Every way a page goes live — a toolbar publish, a versions-panel
+   * publish, a scheduled publish, a component or form promoted under it, an
+   * experiment variant, an edit to the live version in place — meets here,
+   * with the page exactly as a visitor will receive it. So this is where a
+   * page that links to a brand's lookalike, asks for a password or a card
+   * in a field of its own, or (for a new workspace) dresses a brand's
+   * sign-in is held rather than served. See `hosted-page-review.ts`.
+   *
+   * A held version serves the last version this page served clean, screened
+   * again, or nothing.
+   */ const nodes = await composed;
+    const review = await reviewHostedPage({
+        hostId,
+        screenId,
+        versionId,
+        nodes
+    });
+    if (review.outcome === 'serve') {
+        // Only the PUBLISHED version is the page's last clean one; a variant or
+        // a pinned version is not what the page serves.
+        if (nodes && !options.versionId) {
+            await recordServedPageVersion(hostId, screenId, versionId);
+        }
+        return nodes;
+    }
+    if (options.pageReviewFallback === false) return null;
+    const previous = await servedPageVersion(hostId, screenId);
+    if (!previous || previous === versionId) return null;
+    return composeScreenNodes(_extends({}, options, {
+        versionId: previous,
+        pageReviewFallback: false
+    }));
 }
 export default composeScreenNodes;
 

package/src/lib/compose-screen-nodes.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/tenant/runtime/src/lib/compose-screen-nodes.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn/server'\n// By path: the overlay is server-only, and every `@aglyn/aglyn` barrel\n// re-exports `app-utils/server` into published pages.\nimport {\n  applyMediaAssetFacts,\n  mediaAssetRefs,\n} from '@aglyn/aglyn/app-utils/media-asset-facts'\nimport applyDuePublishSchedule from './apply-publish-schedule'\nimport getComponents from './get-components'\nimport getDatasets from './get-datasets'\nimport getForms from './get-forms'\nimport getMediaAssetFacts from './get-media-asset-facts'\nimport {\n  getPublishedCollectionSource,\n  type PublishedCollectionSource,\n} from './get-collection-content'\nimport getPluginInstalls from './get-plugin-installs'\nimport getVariables, { getFunctions, getWorkflows } from './get-variables'\nimport getPublishedLayoutVersion from './get-layout-version'\nimport getScreenVersion from './get-screen-version'\nimport {\n  type ComposeSocialImages,\n  socialImageAssetFacts,\n  socialImageRefs,\n} from './social-image-facts'\nimport { stampFormDatasetBindings } from './stamp-form-dataset-bindings'\n\n/**\n * Content-collection context for a compose (AGL-551): the collection the\n * route resolved (list/entry template screens). `entries` rides along when\n * the route already fetched them (list pages); blocks bound to other\n * collections — or to this one when `entries` is absent — fetch on demand.\n */\nexport interface ComposeCollectionContext {\n  slug: string\n  entries?: Aglyn.CollectionEntryRecord[]\n  /**\n   * The entry being rendered (AGL-582, entry-template screens / entry\n   * fallback) — the Related posts block resolves against it.\n   */\n  entry?: Aglyn.CollectionEntryRecord | null\n  /**\n   * The routed collection's category taxonomy (AGL-582): entry\n   * `categoryId`s resolve to display names against it during expansion.\n   */\n  categories?: Aglyn.CollectionCategory[]\n  /**\n   * The list page the URL asked for (AGL-1321). Fills in an entries block\n   * that declares `perPage` but no `page` — design time cannot know which\n   * page a visitor is on.\n   */\n  page?: number\n  /**\n   * The category segment the URL filtered on (AGL-1321); marks the current\n   * pill in a Category Pills block. `entries` arrives already filtered.\n   */\n  categorySlug?: string\n  /**\n   * Whether the read behind `entries` stopped at its `.limit()` (AGL-1516).\n   * Travels with the entries because the search boxes downstream have to say\n   * what they actually searched, and — with the liveness gate and the route's\n   * category filter both in between — `entries.length` no longer tells them.\n   */\n  entriesReachedBound?: boolean\n  /**\n   * Where `entries` begins in the collection's own order (AGL-3213).\n   *\n   * Zero for every listing served from the cached read. A page past that\n   * read's bound carries only its own ten entries, and the block windows\n   * `[(page - 1) * perPage, …)` — so without this it would slice from an\n   * offset its own array never reaches and render an empty listing.\n   */\n  windowStart?: number\n  /**\n   * Whether {@link slug} is a cache KEY rather than an address (AGL-2524).\n   *\n   * The author page mixes collections, and the compose pipeline keys entry\n   * sources by collection slug — so it hands over a synthetic one\n   * (`AUTHOR_ENTRIES_SOURCE_SLUG`) with its entries already in hand. That is\n   * harmless for the entries block, whose every row carries its OWN\n   * `collectionSlug` and builds `entry.url` from it, and for the search box,\n   * whose index is built the same way.\n   *\n   * It is NOT harmless for anything that builds a URL from the source's slug\n   * itself. Set this and such a block resolves nothing rather than pointing\n   * readers at `/{synthetic}/…`.\n   */\n  routeless?: boolean\n}\n\ninterface CollectionBlockScan {\n  slugs: Set<string>\n  hasRelated: boolean\n  hasCategories: boolean\n  hasSearch: boolean\n}\n\n/**\n * Which collections does this tree ask for (AGL-1152)?\n *\n * Extracted so the PREFETCH below and the expansion that consumes it read the\n * tree through one function rather than two copies of the same predicate. A\n * divergence between them is not a type error — it is a slug prefetched and\n * never awaited, or (worse) a slug the prefetch missed that then pays the full\n * serial read anyway — so there is deliberately no second implementation to\n * drift.\n */\nfunction scanCollectionBlocks(\n  nodes: Record<string, any>,\n  collection?: ComposeCollectionContext,\n): CollectionBlockScan {\n  const slugs = new Set<string>()\n  let hasRelated = false\n  let hasCategories = false\n  let hasSearch = false\n  for (const node of Object.values(nodes)) {\n    if (node?.componentId === Aglyn.COLLECTION_ENTRIES_COMPONENT_ID) {\n      const slug =\n        String(node?.props?.collectionSlug ?? '').trim() || collection?.slug\n      if (slug) slugs.add(slug)\n    }\n    // Category pills (AGL-1321) need only the taxonomy, but it rides on the\n    // same source, so they count as a reason to resolve one.\n    if (node?.componentId === Aglyn.COLLECTION_CATEGORIES_COMPONENT_ID) {\n      const slug =\n        String(node?.props?.collectionSlug ?? '').trim() || collection?.slug\n      if (slug) {\n        hasCategories = true\n        slugs.add(slug)\n      }\n    }\n    // The standalone toolbar search box (AGL-1516, Figma 494:1220) needs the\n    // collection's entries to index, and rides the same source the listing\n    // beside it was built from — one read, one answer.\n    if (node?.componentId === Aglyn.COLLECTION_SEARCH_COMPONENT_ID) {\n      const slug =\n        String(node?.props?.collectionSlug ?? '').trim() || collection?.slug\n      if (slug) {\n        hasSearch = true\n        slugs.add(slug)\n      }\n    }\n    // Related posts (AGL-582) always resolve against the ROUTED collection\n    // — they only mean something with a current entry in context.\n    if (\n      node?.componentId === Aglyn.COLLECTION_RELATED_COMPONENT_ID &&\n      collection?.slug &&\n      collection.entry\n    ) {\n      hasRelated = true\n      slugs.add(collection.slug)\n    }\n  }\n  return { slugs, hasRelated, hasCategories, hasSearch }\n}\n\n/**\n * Issue the collection reads AS SOON AS THE SCREEN NODES EXIST (AGL-1152).\n *\n * `getPublishedCollectionSource` is three SEQUENTIAL round trips —\n * `findContentCollection`, then `listLiveEntries`, then `attachEntryAuthors`\n * — and until this existed it ran after the chrome bundle had already been\n * awaited, so a page carrying a Collection entries block paid the whole thing\n * as a serial tail on the compose phase. Measured on the tenant: a page with\n * no collection block composes in ~20 ms, one with a block in ~572 ms, and the\n * tree work itself accounts for under 2 ms of that at 50 entries. The gap is\n * this read, waiting for reads it shares nothing with.\n *\n * Same shape as `screenDatasetsPromise` directly below, and the same caveat\n * applies: the SCREEN's own nodes are a fast path, NOT the correctness gate. A\n * collection block can arrive from a layout or a grafted reusable component,\n * neither of which exists yet at this point, so the real scan still runs\n * against the composed tree and still fetches anything this missed.\n *\n * The ROUTED collection is deliberately excluded when its entries are already\n * in hand: the expansion below answers that slug from `collection.entries`\n * without reading at all, so prefetching it would buy a read nobody awaits.\n */\nfunction prefetchCollectionSources(\n  hostId: string,\n  screenNodes: Record<string, any>,\n  collection?: ComposeCollectionContext,\n): Record<string, Promise<PublishedCollectionSource>> {\n  const prefetched: Record<\n    string,\n    Promise<PublishedCollectionSource>\n  > = {}\n  for (const slug of scanCollectionBlocks(screenNodes, collection).slugs) {\n    if (slug === collection?.slug && collection.entries) continue\n    const pending = getPublishedCollectionSource({\n      hostId,\n      collectionSlug: slug,\n    })\n    // Marked handled the moment it exists, for the reason `composed` is in\n    // `composeScreenNodes`: a tree that turns out not to need this slug never\n    // awaits it, and an unawaited rejection takes the process down rather than\n    // failing this one read. The real await below still sees the rejection.\n    void pending.catch(() => undefined)\n    prefetched[slug] = pending\n  }\n  return prefetched\n}\n\n/**\n * Expands Collection entries blocks (AGL-551) against their collections'\n * published entries, and Related posts blocks (AGL-582) against the routed\n * entry. Fetches lazily — screens without the blocks cost nothing — and\n * fails open on lookup errors like every other compose stage.\n */\nasync function expandCollectionEntryBlocks(\n  hostId: string,\n  nodes: Record<string, any>,\n  collection?: ComposeCollectionContext,\n  prefetched?: Record<string, Promise<PublishedCollectionSource>>,\n  /** The site's zone (AGL-3237); UTC when a site has not named one. */\n  timeZone?: string,\n): Promise<Record<string, any>> {\n  const { slugs, hasRelated, hasCategories, hasSearch } = scanCollectionBlocks(\n    nodes,\n    collection,\n  )\n  if (!slugs.size) return nodes\n  const sources: Record<string, Aglyn.CollectionEntriesSource> = {}\n  await Promise.all(\n    [...slugs].map(async (slug) => {\n      // The routed collection rides its already-fetched entries +\n      // categories (AGL-582); other collections fetch both on demand.\n      if (slug === collection?.slug && collection.entries) {\n        sources[slug] = {\n          slug,\n          entries: collection.entries,\n          categories: collection.categories,\n          // Only the ROUTED collection carries the URL's page (AGL-1321) — a\n          // block bound to another collection must not inherit it.\n          ...(collection.page ? { page: collection.page } : {}),\n          // ...nor its bound (AGL-1516): this is a fact about the read the\n          // route already performed, and it describes only that collection.\n          ...(collection.entriesReachedBound ? { reachedBound: true } : {}),\n          // ...nor where its window starts (AGL-3213), for the same reason:\n          // it is a fact about the read this route performed.\n          ...(collection.windowStart\n            ? { windowStart: collection.windowStart }\n            : {}),\n        }\n        return\n      }\n      // The prefetch when this slug was visible on the screen's own nodes;\n      // a live read when it only appeared after layout/component grafting.\n      const fetched = await (prefetched?.[slug] ??\n        getPublishedCollectionSource({ hostId, collectionSlug: slug }))\n      sources[slug] = {\n        slug,\n        entries: fetched.entries,\n        categories:\n          slug === collection?.slug && collection.categories\n            ? collection.categories\n            : fetched.categories,\n        ...(fetched.reachedBound ? { reachedBound: true } : {}),\n      }\n    }),\n  )\n  const expanded = Aglyn.expandCollectionEntries(\n    nodes,\n    sources,\n    collection?.slug,\n    timeZone,\n  )\n  const withCategories = hasCategories\n    ? Aglyn.expandCollectionCategories(\n        expanded,\n        sources,\n        /*\n          No DEFAULT collection for the pills on a routeless page (AGL-2524).\n\n          Category pills are the one block that builds its links from the\n          SOURCE's slug — `/{slug}/category/{x}` — because a category is a\n          filter on one collection's own listing. On the author page that slug\n          is synthetic, so an unbound pills block stamped links to a route that\n          does not exist.\n\n          Rendering nothing is the honest answer rather than a fallback. The\n          page spans every collection, and there is no\n          `/author/{slug}/category/{x}` for a pill to lead to; the only real\n          destination would be some collection's listing, which drops the\n          author the reader is looking at. A pills block that NAMES a\n          collection is unaffected and still resolves that collection's own\n          taxonomy — \"browse the blog by category\", which is a sensible thing\n          to put beside an archive.\n        */\n        collection?.routeless ? undefined : collection?.slug,\n        collection?.categorySlug,\n      )\n    : expanded\n  const withSearch = hasSearch\n    ? Aglyn.expandCollectionSearch(\n        withCategories,\n        sources,\n        collection?.slug,\n        timeZone,\n      )\n    : withCategories\n  if (!hasRelated || !collection?.entry) return withSearch\n  return Aglyn.expandCollectionRelated(\n    withSearch,\n    sources[collection.slug],\n    collection.entry,\n    timeZone,\n  )\n}\n\n/**\n * Shared post-version composition (AGL-551, extracted from\n * `composeScreenNodes`): layout chrome, reusable components, repeatables,\n * collection entries, bindings, function definitions, plugin installs,\n * named tokens, denormalize, and last the current facts of each placed image\n * and film, and of the social card the page is shared as. The screen path and\n * the collection-fallback\n * path (which has no screen doc) build identical trees through this one\n * pipeline.\n */\nexport async function composeNodesWithChrome(options: {\n  hostId: string\n  /**\n   * The zone this site's dates read in (AGL-3237) — `resolveSiteTimeZone` of\n   * the org and the host, resolved ONCE by the caller that holds both.\n   *\n   * A string rather than the two documents, because the value has to be\n   * identical on the server render and the client re-render, and the surest\n   * way to guarantee that is for only one place to decide it. Absent is UTC,\n   * which is what every site rendered before this existed.\n   */\n  timeZone?: string\n  /**\n   * The layout binding, or a PROMISE of it.\n   *\n   * The unresolved form exists for the same reason `screenNodes` accepts one\n   * (AGL-1428): the binding may live on the version document (key-present\n   * wins over the screen's), and awaiting the version before this call would\n   * put every host-scoped read back behind it. Only the layout-chain walk\n   * consumes the binding, so it alone waits; the rest of the chrome bundle\n   * still starts immediately.\n   */\n  layoutId?:\n    | string\n    | null\n    | Promise<string | null | undefined>\n  /**\n   * The screen's values for the properties of the layouts it renders inside\n   * (AGL-2893), keyed by layout id — or a PROMISE of them, for the reason\n   * `layoutId` accepts one: they live on the version document beside the\n   * binding. Absent, every layout renders its properties' defaults.\n   */\n  layoutPropValues?:\n    | Aglyn.AglynScreenVersion['layoutPropValues']\n    | null\n    | Promise<Aglyn.AglynScreenVersion['layoutPropValues'] | null | undefined>\n  /**\n   * The screen's per-page restyling of its layouts' elements (AGL-3286),\n   * keyed by layout id then layout node id — or a PROMISE of it, for the same\n   * reason as `layoutPropValues`, beside which it is stored. Absent, every\n   * layout renders with its own styling.\n   */\n  layoutStyleOverrides?:\n    | Aglyn.AglynScreenVersion['layoutStyleOverrides']\n    | null\n    | Promise<\n        Aglyn.AglynScreenVersion['layoutStyleOverrides'] | null | undefined\n      >\n  /**\n   * The screen's own nodes, or a PROMISE of them (AGL-1428).\n   *\n   * Accepting the unresolved form is what lets `composeScreenNodes` hand the\n   * version read over before it has finished, so the host-scoped reads below\n   * — none of which look at these nodes — overlap it instead of queueing\n   * behind it. Passing a resolved value behaves exactly as before, which is\n   * what every other caller does.\n   */\n  screenNodes: Record<string, any> | Promise<Record<string, any>>\n  /** Entry-template tokens (AGL-105) substituted before denormalize. */\n  tokens?: Record<string, string>\n  /** Routed content collection (AGL-551) for Collection entries blocks. */\n  collection?: ComposeCollectionContext\n  /**\n   * The host document, for `host.*` tokens (AGL-1022).\n   *\n   * Passed in rather than read here: every caller already holds it, and\n   * `composeScreenNodes` was the largest single render phase before AGL-1225\n   * cut it to one round trip — adding a read back would spend that win on\n   * data we already have in hand.\n   */\n  host?: Aglyn.HostTokenSource | null\n  /**\n   * The social card the head shares this page as (AGL-2850). The documents of\n   * the assets it names are read in the same batch as the images and films\n   * the tree places.\n   */\n  socialImages?: ComposeSocialImages\n}): Promise<Record<string, any>> {\n  const { hostId, layoutId } = options\n\n  /**\n   * The layout chain, innermost first (AGL-703).\n   *\n   * A layout may itself render inside another layout, so this walks the\n   * `layoutId` pointers rather than reading one. Fetching is sequential\n   * because each step's parent is only known once the previous layout\n   * document is in hand — but the walk is short by construction\n   * (MAX_LAYOUT_CHAIN_DEPTH) and every layout is already a cached read.\n   *\n   * `seen` stops a cycle from looping forever. Stored data can hold one\n   * even though both the console and `canNestLayout` refuse to create it:\n   * the API, a script, or a restored backup can all write a layout\n   * document directly, and a render must degrade rather than hang.\n   */\n  const walkLayoutChain = async () => {\n    const chain: Aglyn.LayoutChainEntry[] = []\n    const seen = new Set<string>()\n    const boundLayoutId = await layoutId\n    let currentLayoutId = boundLayoutId ? String(boundLayoutId) : undefined\n    while (\n      currentLayoutId &&\n      !seen.has(currentLayoutId) &&\n      chain.length < Aglyn.MAX_LAYOUT_CHAIN_DEPTH\n    ) {\n      seen.add(currentLayoutId)\n      const layoutRes = await getPublishedLayoutVersion({\n        hostId,\n        layoutId: currentLayoutId,\n      })\n      // The version's declared properties travel with its nodes (AGL-2893):\n      // they are applied to this layout alone, with the screen's values for\n      // this layout, before the screen is grafted into its slot.\n      chain.push({\n        layoutId: currentLayoutId,\n        nodes: layoutRes?.version?.nodes as any,\n        props: (layoutRes?.version as Aglyn.AglynLayoutVersion | undefined)\n          ?.props,\n      })\n      const parentId = (layoutRes?.layout as any)?.layoutId\n      currentLayoutId = parentId ? String(parentId) : undefined\n    }\n    return chain\n  }\n\n  /**\n   * ONE round-trip stage instead of three (AGL-1225).\n   *\n   * This used to be `await layout walk` → `await getComponents` → `await\n   * Promise.all([five reads])`: three sequential waits, where only the first\n   * has any reason to be sequential. Every one of the other six reads takes\n   * `hostId` and nothing else — none of them consumes the layout chain — so\n   * they were waiting on a walk whose result they never look at.\n   *\n   * The walk stays internally sequential because it genuinely is: each step's\n   * parent id is only known once the previous layout document is in hand. It\n   * just no longer gates anything else. The critical path becomes the walk\n   * alone rather than walk + components + bulk.\n   *\n   * Measured budget that motivated this (production, `/product/besigner`):\n   * `composeScreenNodes` was the largest single phase at 1577 ms cold and\n   * consistently ~1.4-1.6 s warm too, so this is not cold-start cost. The\n   * existing `AGL-1152:render` timing line reports `composeScreenNodes` as a\n   * phase, so the effect of this shows up there directly — no new\n   * instrumentation, and a regression would be visible in the same place.\n   */\n  /**\n   * Does the SCREEN itself repeat over a dataset (AGL-1440)?\n   *\n   * Asked as soon as the nodes are in hand — which since AGL-1428 is after\n   * the fan-out has been ISSUED rather than before — so the overwhelmingly\n   * common case still keeps the AGL-1225 shape: a page that repeats almost\n   * always says so on its own document, and its datasets read goes out\n   * alongside the remaining chrome reads instead of after them.\n   *\n   * It is deliberately NOT the correctness gate — a repeatable can arrive from\n   * a layout or a grafted reusable component, neither of which exists yet. The\n   * gate is re-asked against the composed tree after grafting, which is the\n   * exact input `expandRepeatables` reads.\n   */\n  /*\n   * ISSUE THE HOST-SCOPED READS FIRST, THEN AWAIT THE NODES (AGL-1428).\n   *\n   * Every read in this bundle is keyed by `hostId` (and `layoutId`) alone —\n   * none of them reads `screenNodes` — so starting them before the nodes are\n   * in hand lets `composeScreenNodes`' version read overlap them rather than\n   * run ahead of them. `Promise.all` is created BEFORE the `await` below on\n   * purpose: that is the line that makes the two independent, and moving the\n   * await above it silently gives the whole saving back.\n   *\n   * `getDatasets` is the one read that genuinely depends on the nodes, so it\n   * cannot join the bundle. It does not have to wait for the bundle either —\n   * it is issued the moment the nodes resolve and awaited after, so it still\n   * overlaps whatever is left of the chrome reads instead of costing the\n   * extra serial round trip that dropping it from the batch would imply.\n   */\n  const chromeBundle = Promise.all([\n    walkLayoutChain(),\n    getComponents({ hostId }),\n    // Host variable + function bindings (AGL-91/93): {{name}} and\n    // {{fn:name(args)}} in string props resolve to values; unknown tokens\n    // and failed runs stay literal.\n    Promise.all([\n      getVariables({ hostId }),\n      getFunctions({ hostId }),\n      getWorkflows({ hostId }),\n      getPluginInstalls({ hostId }),\n    ]),\n  ])\n  const screenNodes = await options.screenNodes\n  const screenDatasetKeys = Aglyn.repeatDatasetKeys(screenNodes)\n  const screenDatasetsPromise = screenDatasetKeys.length\n    ? getDatasets({ hostId, keys: screenDatasetKeys })\n    : undefined\n  // Does the SCREEN itself place a form entity? Gated and re-asked exactly\n  // like the datasets read beside it (AGL-1440): most pages carry no form, and\n  // the ones that do usually say so on their own document, so the read goes\n  // out here alongside the chrome reads instead of as a serial tail. It is not\n  // the correctness gate — a placed form can arrive from a layout or a grafted\n  // component — so the composed tree is asked again below.\n  const screenFormsPromise = Aglyn.placesFormEntity(screenNodes)\n    ? getForms({ hostId })\n    : undefined\n  // Issued HERE, beside the datasets read and before the chrome bundle is\n  // awaited, so the collection read overlaps it instead of trailing it.\n  const prefetchedSources = prefetchCollectionSources(\n    hostId,\n    screenNodes,\n    options.collection,\n  )\n  const [layoutChain, componentsRes, bulk] = await chromeBundle\n  const [rawVariables, functions, workflows, pluginInstalls] = bulk\n  const screenDatasets = await screenDatasetsPromise\n  // Settled by now: it is read off the same version document the layout\n  // binding the walk above waited on came from.\n  const layoutPropValues = await options.layoutPropValues\n  const layoutStyleOverrides = await options.layoutStyleOverrides\n\n  const composedNodes = Aglyn.composeLayoutChainWithProps(\n    layoutChain as any,\n    screenNodes as any,\n    layoutPropValues,\n    layoutStyleOverrides,\n  )\n  const graftedComponents = Aglyn.composeReusableComponentNodes(\n    composedNodes as any,\n    componentsRes.definitions as any,\n  )\n  /*\n   * PLACED FORMS RESOLVE AGAINST THEIR ENTITY (`docs/specs/reusable-forms.md`).\n   *\n   * A form node bound to `hosts/{hostId}/forms/{formId}` renders that entity's\n   * published design, so a form is edited once and every page placing it\n   * follows. Without this the entity's tree was written on every publish and\n   * read by nothing: the fields had to be redrawn per page, and the two copies\n   * diverged the moment either was touched.\n   *\n   * The gate is the COMPONENT-grafted tree, not the screen's own nodes, for\n   * the reason the repeatables gate below states: a form placed inside a\n   * layout or a shared component does not exist in `screenNodes`, and a page\n   * that renders one would silently keep its stale inline copy.\n   *\n   * The second graft re-runs the component expansion deliberately. Instances\n   * already expanded are skipped by their own prefix, so the repeat costs a\n   * scan, and passing BOTH placement kinds is what expands a reusable\n   * component nested inside a form's design — which the first pass could not\n   * have seen, because that subtree was not in the tree yet.\n   */\n  const forms =\n    (await screenFormsPromise)?.forms ??\n    (Aglyn.placesFormEntity(graftedComponents as any)\n      ? (await getForms({ hostId })).forms\n      : undefined)\n  const grafted = forms\n    ? Aglyn.composeReusableComponentNodes(\n        graftedComponents as any,\n        componentsRes.definitions as any,\n        [Aglyn.placedFormPlacement(forms as any)],\n      )\n    : graftedComponents\n  // Computed variables (AGL-129): workflow-backed values resolve once per\n  // compose; failures keep each variable's stored fallback.\n  const variables = Aglyn.resolveComputedVariables(\n    rawVariables,\n    functions,\n    workflows,\n  )\n  // Repeatables (AGL-103) expand after grafting (so they work inside\n  // reusable components) and before bindings (so {{name}} tokens inside\n  // cloned items still resolve).\n  //\n  // Only the datasets this tree repeats over are read (AGL-1440), and the tree\n  // asked is the composed one — after grafting — because that is the map the\n  // expansion reads: a repeatable living in a layout or a reusable component\n  // is invisible in `screenNodes`, and reading only the screen's keys would\n  // silently render one template row where the author put a list. The\n  // screen's own keys were issued beside the chrome reads above; a key only a\n  // layout or a component adds is read here, for that key alone.\n  const datasetKeys = Aglyn.repeatDatasetKeys(grafted as any)\n  const unreadDatasetKeys = datasetKeys.filter(\n    (key) => !screenDatasetKeys.includes(key),\n  )\n  const datasets = unreadDatasetKeys.length\n    ? {\n        ...screenDatasets,\n        ...(await getDatasets({ hostId, keys: unreadDatasetKeys })),\n      }\n    : screenDatasets\n  const repeated = Aglyn.expandRepeatables(grafted as any, datasets)\n  // Collection entries blocks (AGL-551) expand alongside repeatables:\n  // per-entry {{entry.*}} tokens substitute inside the clones here, while\n  // page-level tokens wait for resolveNamedTokens below.\n  const withEntries = await expandCollectionEntryBlocks(\n    hostId,\n    repeated,\n    options.collection,\n    prefetchedSources,\n    options.timeZone,\n  )\n  // Entry Meta blocks (AGL-1385): fill in the routed entry's date/category/\n  // tags. Needs no source fetch — the routed entry and its taxonomy are\n  // already in hand — so it sits outside `expandCollectionEntryBlocks`, which\n  // returns early when no block asks for a collection read. AFTER it, so the\n  // per-entry clones it just produced already carry their own resolved values\n  // and are skipped.\n  const withEntryMeta = Aglyn.expandCollectionEntryMeta(\n    withEntries as any,\n    options.collection?.entry,\n    options.collection?.categories,\n    options.timeZone,\n  )\n  // Entry Author cards (AGL-2486): the same fill, one block over. Its values\n  // come off the author RECORD the routed entry resolved to, which the\n  // collection read has already attached, so this costs nothing either.\n  const withEntryAuthor = Aglyn.expandCollectionEntryAuthor(\n    withEntryMeta as any,\n    options.collection?.entry,\n  )\n  const bound = Aglyn.resolveNodesBindings(\n    withEntryAuthor as any,\n    variables,\n    functions,\n  )\n  // Host variables (AGL-1022): `{{host.*}}` resolves from the INSTALLING\n  // site, late — at render, never at install — so a rebrand propagates to\n  // every artifact that names the host instead of hard-coding it. Same\n  // registry the email path uses, so a token means one thing in both.\n  const withHostTokens = Aglyn.resolveNodesHostTokens(\n    bound as any,\n    options.host,\n  )\n  // Function widgets run client-side: embed their definitions (AGL-93), and\n  // beside each the site variables that function reads and no others\n  // (AGL-3202).\n  const withFunctions = Aglyn.attachFunctionDefinitions(\n    withHostTokens,\n    functions,\n    variables,\n  )\n  // Marketplace plugins (AGL-45): stamp each marketplacePlugin node with its\n  // pinned install (version/sha256/capabilities) + kill-switch state.\n  const nodes = Aglyn.attachPluginInstalls(withFunctions, pluginInstalls)\n  // Entry-template tokens (AGL-105): {{entry.*}} from the rendered entry.\n  const finalNodes = Aglyn.resolveNamedTokens(nodes as any, options.tokens)\n  // The document's one `main` landmark (AGL-2486). LAST, so it reads the tree\n  // the page actually ships — a slot grafted from a layout chain, an element\n  // an author chose — rather than the screen as stored.\n  const withLandmark = Aglyn.stampDocumentLandmark(finalNodes as any)\n  // Each form's dataset binding, signed so the submit route can trust it\n  // (AGL-2773). Read off THIS tree, the one the page ships, so a form grafted\n  // from a layout, a component or a form entity is signed as it renders; and\n  // after every stage that rewrites props, so nothing changes what the\n  // signature covers.\n  const withFormBindings = stampFormDatasetBindings(withLandmark, hostId)\n  const denormalized = Aglyn.canvas.processNodesToDenormalized(\n    withFormBindings as any,\n  )\n  /*\n   * WHAT EACH PLACED IMAGE AND FILM IS NOW (AGL-2807, AGL-2833).\n   *\n   * An image's pixel pair and a film's length, shape and poster come from the\n   * asset's DAM document as it is now, not as it was when it was picked. LAST,\n   * on the tree the page ships, because an asset can arrive from any stage\n   * above: a layout, a component, a form, a repeated row, a collection entry,\n   * a binding.\n   *\n   * ONE read for all of them, issued once the tree is final rather than beside\n   * the chrome reads. A read issued there could only cover the screen's own\n   * placements, and nearly every layout places an image the screen does not\n   * (a logo, a footer mark), so it would buy a second read on almost every\n   * page. The late read costs its own round trip after the chrome reads, paid\n   * each time a page is composed, which for a published page is its ISR\n   * regeneration. A tree with no library asset, on a page whose social card\n   * names none, issues none.\n   *\n   * THE SOCIAL CARD'S ASSETS JOIN THE SAME READ (AGL-2850), ahead of the\n   * placements. A placement the cap leaves out keeps its pick-time pair, which\n   * for an image is a reservation the decoded picture corrects. Nothing\n   * corrects a card's pair, because a crawler lays the card out from it before\n   * fetching the image, and a card names at most three documents.\n   */\n  const socialImages = options.socialImages\n  const cardRefs = socialImages ? socialImageRefs(socialImages.images) : []\n  const refs = mediaAssetRefs(denormalized)\n  if (!refs.length && !cardRefs.length) return denormalized\n  const facts = await getMediaAssetFacts({\n    hostId,\n    refs: [...cardRefs, ...refs],\n  })\n  if (socialImages) {\n    const cardFacts = socialImageAssetFacts(socialImages.images, facts)\n    if (cardFacts) socialImages.onFacts(cardFacts)\n  }\n  return applyMediaAssetFacts(denormalized, facts)\n}\n\n/**\n * Full published-render composition for one screen (extracted for AGL-87 so\n * the SSG path and the password-unlock API build identical trees): applies\n * a due publish schedule, loads the version, composes the shared layout\n * chrome, grafts reusable components, and denormalizes.\n */\nexport async function composeScreenNodes(options: {\n  hostId: string\n  screenId: string\n  screen: Aglyn.AglynScreen\n  /** Entry-template tokens (AGL-105) substituted before denormalize. */\n  tokens?: Record<string, string>\n  /** Routed content collection (AGL-551) for Collection entries blocks. */\n  collection?: ComposeCollectionContext\n  /**\n   * Compose a specific version instead of the published one (AGL-253):\n   * experiment variants point at versions; schedules don't apply.\n   */\n  versionId?: string\n  /** The host document, for `host.*` tokens (AGL-1022). */\n  host?: Aglyn.HostTokenSource | null\n  /**\n   * The zone this site's dates read in (AGL-3237) — `resolveSiteTimeZone` of\n   * the org and the host, resolved ONCE by the caller that holds both.\n   *\n   * A string rather than the two documents, because the value has to be\n   * identical on the server render and the client re-render, and the surest\n   * way to guarantee that is for only one place to decide it. Absent is UTC,\n   * which is what every site rendered before this existed.\n   */\n  timeZone?: string\n  /** The social card the head shares this page as (AGL-2850). */\n  socialImages?: ComposeSocialImages\n}): Promise<Record<string, any> | null> {\n  const { hostId, screenId, screen } = options\n\n  const effectiveVersionId = options.versionId\n    ? null\n    : await applyDuePublishSchedule({\n        hostId,\n        collectionName: 'screens',\n        docId: screenId,\n        parent: screen,\n      })\n  const versionId = (options.versionId ??\n    effectiveVersionId ??\n    screen.versionId) as string\n\n  /*\n   * OVERLAP THE VERSION READ WITH THE CHROME BUNDLE (AGL-1428).\n   *\n   * `composeNodesWithChrome`'s reads are keyed by `hostId`/`layoutId`, both\n   * of which are in hand here, so the version read no longer has to finish\n   * before they start. Handing the promise over instead of the resolved\n   * value is the whole change: it is `composeNodesWithChrome` that decides\n   * when it actually needs the nodes.\n   *\n   * The `versionId`-less screen still exits BEFORE anything is issued, so a\n   * screen that has never been published costs no reads. What remains is the\n   * narrow case of a `versionId` that points at a missing or unreadable\n   * version document — a data-integrity fault rather than a routing outcome\n   * — and that one now pays for a chrome bundle it discards. That is the\n   * deliberate trade: one wasted bundle on a broken screen, against the\n   * version read hiding under the chrome reads on every render that works.\n   */\n  if (!versionId) return null\n\n  const versionPromise = getScreenVersion({ hostId, screenId, versionId })\n\n  /*\n   * NEITHER DERIVED PROMISE MAY REJECT ON ITS OWN.\n   *\n   * `composed` is discarded on every failure path below, and a rejected\n   * promise nobody awaited is an unhandled rejection — which in Node takes\n   * the whole render process down instead of letting this 404. So the nodes\n   * handed to the compose absorb the failure (an empty tree it will never be\n   * asked for), and `composed` gets a rejection handler attached the moment\n   * it exists rather than at the point we decide to drop it. The real error\n   * still propagates, from the `await versionPromise` below, exactly where it\n   * did when this function awaited the version directly.\n   */\n  const composed = composeNodesWithChrome({\n    ...(options.timeZone ? { timeZone: options.timeZone } : {}),\n    hostId,\n    // Version-first (key-present wins, null = explicitly no layout), screen\n    // fallback — resolved as a promise so only the layout-chain walk waits on\n    // the version read; the rest of the chrome bundle keeps the AGL-1428\n    // overlap. A failed version read falls back to the screen binding; the\n    // whole compose is discarded on that path anyway.\n    layoutId: versionPromise.then(\n      (res) =>\n        res.version && 'layoutId' in res.version\n          ? ((res.version as Aglyn.AglynScreenVersion).layoutId as\n              | string\n              | null)\n          : (screen.layoutId as string | undefined),\n      () => screen.layoutId as string | undefined,\n    ),\n    // The screen's values for its layouts' properties (AGL-2893), beside the\n    // binding on the same document; a failed read renders the defaults.\n    layoutPropValues: versionPromise.then(\n      (res) =>\n        (res.version as Aglyn.AglynScreenVersion | undefined)?.layoutPropValues,\n      () => undefined,\n    ),\n    // …and its per-page restyling of their elements (AGL-3286), from the same\n    // document; a failed read renders the layouts' own styling.\n    layoutStyleOverrides: versionPromise.then(\n      (res) =>\n        (res.version as Aglyn.AglynScreenVersion | undefined)\n          ?.layoutStyleOverrides,\n      () => undefined,\n    ),\n    screenNodes: versionPromise.then(\n      (res) => (res.version?.nodes ?? {}) as any,\n      () => ({}) as any,\n    ),\n    tokens: options.tokens,\n    collection: options.collection,\n    host: options.host,\n    socialImages: options.socialImages,\n  })\n  void composed.catch(() => undefined)\n\n  const versionRes = await versionPromise\n  if (versionRes.error || !versionRes.version) return null\n\n  return composed\n}\n\nexport default composeScreenNodes\n"],"names":["Aglyn","applyMediaAssetFacts","mediaAssetRefs","applyDuePublishSchedule","getComponents","getDatasets","getForms","getMediaAssetFacts","getPublishedCollectionSource","getPluginInstalls","getVariables","getFunctions","getWorkflows","getPublishedLayoutVersion","getScreenVersion","socialImageAssetFacts","socialImageRefs","stampFormDatasetBindings","scanCollectionBlocks","nodes","collection","slugs","Set","hasRelated","hasCategories","hasSearch","node","Object","values","componentId","COLLECTION_ENTRIES_COMPONENT_ID","slug","String","props","collectionSlug","trim","add","COLLECTION_CATEGORIES_COMPONENT_ID","COLLECTION_SEARCH_COMPONENT_ID","COLLECTION_RELATED_COMPONENT_ID","entry","prefetchCollectionSources","hostId","screenNodes","prefetched","entries","pending","catch","undefined","expandCollectionEntryBlocks","timeZone","size","sources","Promise","all","map","categories","page","entriesReachedBound","reachedBound","windowStart","fetched","expanded","expandCollectionEntries","withCategories","expandCollectionCategories","routeless","categorySlug","withSearch","expandCollectionSearch","expandCollectionRelated","composeNodesWithChrome","options","layoutId","walkLayoutChain","chain","seen","boundLayoutId","currentLayoutId","has","length","MAX_LAYOUT_CHAIN_DEPTH","layoutRes","push","version","parentId","layout","chromeBundle","screenDatasetKeys","repeatDatasetKeys","screenDatasetsPromise","keys","screenFormsPromise","placesFormEntity","prefetchedSources","layoutChain","componentsRes","bulk","rawVariables","functions","workflows","pluginInstalls","screenDatasets","layoutPropValues","layoutStyleOverrides","composedNodes","composeLayoutChainWithProps","graftedComponents","composeReusableComponentNodes","definitions","forms","grafted","placedFormPlacement","variables","resolveComputedVariables","datasetKeys","unreadDatasetKeys","filter","key","includes","datasets","repeated","expandRepeatables","withEntries","withEntryMeta","expandCollectionEntryMeta","withEntryAuthor","expandCollectionEntryAuthor","bound","resolveNodesBindings","withHostTokens","resolveNodesHostTokens","host","withFunctions","attachFunctionDefinitions","attachPluginInstalls","finalNodes","resolveNamedTokens","tokens","withLandmark","stampDocumentLandmark","withFormBindings","denormalized","canvas","processNodesToDenormalized","socialImages","cardRefs","images","refs","facts","cardFacts","onFacts","composeScreenNodes","screenId","screen","effectiveVersionId","versionId","collectionName","docId","parent","versionPromise","composed","then","res","versionRes","error"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,sBAAqB;AAC5C,uEAAuE;AACvE,sDAAsD;AACtD,SACEC,oBAAoB,EACpBC,cAAc,QACT,2CAA0C;AACjD,OAAOC,6BAA6B,8BAA0B;AAC9D,OAAOC,mBAAmB,sBAAkB;AAC5C,OAAOC,iBAAiB,oBAAgB;AACxC,OAAOC,cAAc,iBAAa;AAClC,OAAOC,wBAAwB,6BAAyB;AACxD,SACEC,4BAA4B,QAEvB,8BAA0B;AACjC,OAAOC,uBAAuB,2BAAuB;AACrD,OAAOC,gBAAgBC,YAAY,EAAEC,YAAY,QAAQ,qBAAiB;AAC1E,OAAOC,+BAA+B,0BAAsB;AAC5D,OAAOC,sBAAsB,0BAAsB;AACnD,SAEEC,qBAAqB,EACrBC,eAAe,QACV,0BAAsB;AAC7B,SAASC,wBAAwB,QAAQ,mCAA+B;AAwExE;;;;;;;;;CASC,GACD,SAASC,qBACPC,KAA0B,EAC1BC,UAAqC;IAErC,MAAMC,QAAQ,IAAIC;IAClB,IAAIC,aAAa;IACjB,IAAIC,gBAAgB;IACpB,IAAIC,YAAY;IAChB,KAAK,MAAMC,QAAQC,OAAOC,MAAM,CAACT,OAAQ;QACvC,IAAIO,CAAAA,wBAAAA,KAAMG,WAAW,MAAK7B,MAAM8B,+BAA+B,EAAE;;gBAEtDJ;YADT,MAAMK,OACJC,eAAON,yBAAAA,cAAAA,KAAMO,KAAK,qBAAXP,YAAaQ,cAAc,mBAAI,IAAIC,IAAI,OAAMf,8BAAAA,WAAYW,IAAI;YACtE,IAAIA,MAAMV,MAAMe,GAAG,CAACL;QACtB;QACA,wEAAwE;QACxE,yDAAyD;QACzD,IAAIL,CAAAA,wBAAAA,KAAMG,WAAW,MAAK7B,MAAMqC,kCAAkC,EAAE;;gBAEzDX;YADT,MAAMK,OACJC,gBAAON,yBAAAA,eAAAA,KAAMO,KAAK,qBAAXP,aAAaQ,cAAc,oBAAI,IAAIC,IAAI,OAAMf,8BAAAA,WAAYW,IAAI;YACtE,IAAIA,MAAM;gBACRP,gBAAgB;gBAChBH,MAAMe,GAAG,CAACL;YACZ;QACF;QACA,yEAAyE;QACzE,uEAAuE;QACvE,mDAAmD;QACnD,IAAIL,CAAAA,wBAAAA,KAAMG,WAAW,MAAK7B,MAAMsC,8BAA8B,EAAE;;gBAErDZ;YADT,MAAMK,OACJC,gBAAON,yBAAAA,eAAAA,KAAMO,KAAK,qBAAXP,aAAaQ,cAAc,oBAAI,IAAIC,IAAI,OAAMf,8BAAAA,WAAYW,IAAI;YACtE,IAAIA,MAAM;gBACRN,YAAY;gBACZJ,MAAMe,GAAG,CAACL;YACZ;QACF;QACA,uEAAuE;QACvE,8DAA8D;QAC9D,IACEL,CAAAA,wBAAAA,KAAMG,WAAW,MAAK7B,MAAMuC,+BAA+B,KAC3DnB,8BAAAA,WAAYW,IAAI,KAChBX,WAAWoB,KAAK,EAChB;YACAjB,aAAa;YACbF,MAAMe,GAAG,CAAChB,WAAWW,IAAI;QAC3B;IACF;IACA,OAAO;QAAEV;QAAOE;QAAYC;QAAeC;IAAU;AACvD;AAEA;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,SAASgB,0BACPC,MAAc,EACdC,WAAgC,EAChCvB,UAAqC;IAErC,MAAMwB,aAGF,CAAC;IACL,KAAK,MAAMb,QAAQb,qBAAqByB,aAAavB,YAAYC,KAAK,CAAE;QACtE,IAAIU,UAASX,8BAAAA,WAAYW,IAAI,KAAIX,WAAWyB,OAAO,EAAE;QACrD,MAAMC,UAAUtC,6BAA6B;YAC3CkC;YACAR,gBAAgBH;QAClB;QACA,uEAAuE;QACvE,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,KAAKe,QAAQC,KAAK,CAAC,IAAMC;QACzBJ,UAAU,CAACb,KAAK,GAAGe;IACrB;IACA,OAAOF;AACT;AAEA;;;;;CAKC,GACD,eAAeK,4BACbP,MAAc,EACdvB,KAA0B,EAC1BC,UAAqC,EACrCwB,UAA+D,EAC/D,mEAAmE,GACnEM,QAAiB;IAEjB,MAAM,EAAE7B,KAAK,EAAEE,UAAU,EAAEC,aAAa,EAAEC,SAAS,EAAE,GAAGP,qBACtDC,OACAC;IAEF,IAAI,CAACC,MAAM8B,IAAI,EAAE,OAAOhC;IACxB,MAAMiC,UAAyD,CAAC;IAChE,MAAMC,QAAQC,GAAG,CACf;WAAIjC;KAAM,CAACkC,GAAG,CAAC,OAAOxB;;QACpB,4DAA4D;QAC5D,gEAAgE;QAChE,IAAIA,UAASX,8BAAAA,WAAYW,IAAI,KAAIX,WAAWyB,OAAO,EAAE;YACnDO,OAAO,CAACrB,KAAK,GAAG;gBACdA;gBACAc,SAASzB,WAAWyB,OAAO;gBAC3BW,YAAYpC,WAAWoC,UAAU;eAG7BpC,WAAWqC,IAAI,GAAG;gBAAEA,MAAMrC,WAAWqC,IAAI;YAAC,IAAI,CAAC,GAG/CrC,WAAWsC,mBAAmB,GAAG;gBAAEC,cAAc;YAAK,IAAI,CAAC,GAG3DvC,WAAWwC,WAAW,GACtB;gBAAEA,aAAaxC,WAAWwC,WAAW;YAAC,IACtC,CAAC;YAEP;QACF;QACA,qEAAqE;QACrE,qEAAqE;QACrE,MAAMC,UAAU,eAAOjB,8BAAAA,UAAY,CAACb,KAAK,mBACvCvB,6BAA6B;YAAEkC;YAAQR,gBAAgBH;QAAK;QAC9DqB,OAAO,CAACrB,KAAK,GAAG;YACdA;YACAc,SAASgB,QAAQhB,OAAO;YACxBW,YACEzB,UAASX,8BAAAA,WAAYW,IAAI,KAAIX,WAAWoC,UAAU,GAC9CpC,WAAWoC,UAAU,GACrBK,QAAQL,UAAU;WACpBK,QAAQF,YAAY,GAAG;YAAEA,cAAc;QAAK,IAAI,CAAC;IAEzD;IAEF,MAAMG,WAAW9D,MAAM+D,uBAAuB,CAC5C5C,OACAiC,SACAhC,8BAAAA,WAAYW,IAAI,EAChBmB;IAEF,MAAMc,iBAAiBxC,gBACnBxB,MAAMiE,0BAA0B,CAC9BH,UACAV,SACA;;;;;;;;;;;;;;;;;QAiBA,GACAhC,CAAAA,8BAAAA,WAAY8C,SAAS,IAAGlB,YAAY5B,8BAAAA,WAAYW,IAAI,EACpDX,8BAAAA,WAAY+C,YAAY,IAE1BL;IACJ,MAAMM,aAAa3C,YACfzB,MAAMqE,sBAAsB,CAC1BL,gBACAZ,SACAhC,8BAAAA,WAAYW,IAAI,EAChBmB,YAEFc;IACJ,IAAI,CAACzC,cAAc,EAACH,8BAAAA,WAAYoB,KAAK,GAAE,OAAO4B;IAC9C,OAAOpE,MAAMsE,uBAAuB,CAClCF,YACAhB,OAAO,CAAChC,WAAWW,IAAI,CAAC,EACxBX,WAAWoB,KAAK,EAChBU;AAEJ;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAeqB,uBAAuBC,OA6E5C;;QA2KI,OA0DDA,qBACAA,sBAQAA;IA7OF,MAAM,EAAE9B,MAAM,EAAE+B,QAAQ,EAAE,GAAGD;IAE7B;;;;;;;;;;;;;GAaC,GACD,MAAME,kBAAkB;QACtB,MAAMC,QAAkC,EAAE;QAC1C,MAAMC,OAAO,IAAItD;QACjB,MAAMuD,gBAAgB,MAAMJ;QAC5B,IAAIK,kBAAkBD,gBAAgB7C,OAAO6C,iBAAiB7B;QAC9D,MACE8B,mBACA,CAACF,KAAKG,GAAG,CAACD,oBACVH,MAAMK,MAAM,GAAGhF,MAAMiF,sBAAsB,CAC3C;gBAWSC,oBACCA,qBAGQA;YAdlBN,KAAKxC,GAAG,CAAC0C;YACT,MAAMI,YAAY,MAAMrE,0BAA0B;gBAChD6B;gBACA+B,UAAUK;YACZ;YACA,sEAAsE;YACtE,sEAAsE;YACtE,2DAA2D;YAC3DH,MAAMQ,IAAI,CAAC;gBACTV,UAAUK;gBACV3D,KAAK,EAAE+D,8BAAAA,qBAAAA,UAAWE,OAAO,qBAAlBF,mBAAoB/D,KAAK;gBAChCc,KAAK,EAAGiD,8BAAAA,sBAAAA,UAAWE,OAAO,qBAAnB,AAACF,oBACJjD,KAAK;YACX;YACA,MAAMoD,WAAYH,8BAAAA,oBAAAA,UAAWI,MAAM,qBAAlB,AAACJ,kBAA2BT,QAAQ;YACrDK,kBAAkBO,WAAWrD,OAAOqD,YAAYrC;QAClD;QACA,OAAO2B;IACT;IAEA;;;;;;;;;;;;;;;;;;;;GAoBC,GACD;;;;;;;;;;;;;GAaC,GACD;;;;;;;;;;;;;;;GAeC,GACD,MAAMY,eAAelC,QAAQC,GAAG,CAAC;QAC/BoB;QACAtE,cAAc;YAAEsC;QAAO;QACvB,8DAA8D;QAC9D,sEAAsE;QACtE,gCAAgC;QAChCW,QAAQC,GAAG,CAAC;YACV5C,aAAa;gBAAEgC;YAAO;YACtB/B,aAAa;gBAAE+B;YAAO;YACtB9B,aAAa;gBAAE8B;YAAO;YACtBjC,kBAAkB;gBAAEiC;YAAO;SAC5B;KACF;IACD,MAAMC,cAAc,MAAM6B,QAAQ7B,WAAW;IAC7C,MAAM6C,oBAAoBxF,MAAMyF,iBAAiB,CAAC9C;IAClD,MAAM+C,wBAAwBF,kBAAkBR,MAAM,GAClD3E,YAAY;QAAEqC;QAAQiD,MAAMH;IAAkB,KAC9CxC;IACJ,yEAAyE;IACzE,6EAA6E;IAC7E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,yDAAyD;IACzD,MAAM4C,qBAAqB5F,MAAM6F,gBAAgB,CAAClD,eAC9CrC,SAAS;QAAEoC;IAAO,KAClBM;IACJ,wEAAwE;IACxE,sEAAsE;IACtE,MAAM8C,oBAAoBrD,0BACxBC,QACAC,aACA6B,QAAQpD,UAAU;IAEpB,MAAM,CAAC2E,aAAaC,eAAeC,KAAK,GAAG,MAAMV;IACjD,MAAM,CAACW,cAAcC,WAAWC,WAAWC,eAAe,GAAGJ;IAC7D,MAAMK,iBAAiB,MAAMZ;IAC7B,sEAAsE;IACtE,8CAA8C;IAC9C,MAAMa,mBAAmB,MAAM/B,QAAQ+B,gBAAgB;IACvD,MAAMC,uBAAuB,MAAMhC,QAAQgC,oBAAoB;IAE/D,MAAMC,gBAAgBzG,MAAM0G,2BAA2B,CACrDX,aACApD,aACA4D,kBACAC;IAEF,MAAMG,oBAAoB3G,MAAM4G,6BAA6B,CAC3DH,eACAT,cAAca,WAAW;IAE3B;;;;;;;;;;;;;;;;;;;GAmBC,GACD,MAAMC,iBACH,QAAA,MAAMlB,uCAAP,AAAC,MAA2BkB,KAAK,mBAChC9G,MAAM6F,gBAAgB,CAACc,qBACpB,AAAC,CAAA,MAAMrG,SAAS;QAAEoC;IAAO,EAAC,EAAGoE,KAAK,GAClC9D;IACN,MAAM+D,UAAUD,QACZ9G,MAAM4G,6BAA6B,CACjCD,mBACAX,cAAca,WAAW,EACzB;QAAC7G,MAAMgH,mBAAmB,CAACF;KAAc,IAE3CH;IACJ,wEAAwE;IACxE,0DAA0D;IAC1D,MAAMM,YAAYjH,MAAMkH,wBAAwB,CAC9ChB,cACAC,WACAC;IAEF,mEAAmE;IACnE,sEAAsE;IACtE,+BAA+B;IAC/B,EAAE;IACF,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,oEAAoE;IACpE,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAMe,cAAcnH,MAAMyF,iBAAiB,CAACsB;IAC5C,MAAMK,oBAAoBD,YAAYE,MAAM,CAC1C,CAACC,MAAQ,CAAC9B,kBAAkB+B,QAAQ,CAACD;IAEvC,MAAME,WAAWJ,kBAAkBpC,MAAM,GACrC,aACKsB,gBACC,MAAMjG,YAAY;QAAEqC;QAAQiD,MAAMyB;IAAkB,MAE1Dd;IACJ,MAAMmB,WAAWzH,MAAM0H,iBAAiB,CAACX,SAAgBS;IACzD,oEAAoE;IACpE,wEAAwE;IACxE,uDAAuD;IACvD,MAAMG,cAAc,MAAM1E,4BACxBP,QACA+E,UACAjD,QAAQpD,UAAU,EAClB0E,mBACAtB,QAAQtB,QAAQ;IAElB,0EAA0E;IAC1E,sEAAsE;IACtE,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,mBAAmB;IACnB,MAAM0E,gBAAgB5H,MAAM6H,yBAAyB,CACnDF,cACAnD,sBAAAA,QAAQpD,UAAU,qBAAlBoD,oBAAoBhC,KAAK,GACzBgC,uBAAAA,QAAQpD,UAAU,qBAAlBoD,qBAAoBhB,UAAU,EAC9BgB,QAAQtB,QAAQ;IAElB,2EAA2E;IAC3E,qEAAqE;IACrE,sEAAsE;IACtE,MAAM4E,kBAAkB9H,MAAM+H,2BAA2B,CACvDH,gBACApD,uBAAAA,QAAQpD,UAAU,qBAAlBoD,qBAAoBhC,KAAK;IAE3B,MAAMwF,QAAQhI,MAAMiI,oBAAoB,CACtCH,iBACAb,WACAd;IAEF,uEAAuE;IACvE,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,MAAM+B,iBAAiBlI,MAAMmI,sBAAsB,CACjDH,OACAxD,QAAQ4D,IAAI;IAEd,0EAA0E;IAC1E,mEAAmE;IACnE,cAAc;IACd,MAAMC,gBAAgBrI,MAAMsI,yBAAyB,CACnDJ,gBACA/B,WACAc;IAEF,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM9F,QAAQnB,MAAMuI,oBAAoB,CAACF,eAAehC;IACxD,wEAAwE;IACxE,MAAMmC,aAAaxI,MAAMyI,kBAAkB,CAACtH,OAAcqD,QAAQkE,MAAM;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,sDAAsD;IACtD,MAAMC,eAAe3I,MAAM4I,qBAAqB,CAACJ;IACjD,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,qEAAqE;IACrE,oBAAoB;IACpB,MAAMK,mBAAmB5H,yBAAyB0H,cAAcjG;IAChE,MAAMoG,eAAe9I,MAAM+I,MAAM,CAACC,0BAA0B,CAC1DH;IAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBC,GACD,MAAMI,eAAezE,QAAQyE,YAAY;IACzC,MAAMC,WAAWD,eAAejI,gBAAgBiI,aAAaE,MAAM,IAAI,EAAE;IACzE,MAAMC,OAAOlJ,eAAe4I;IAC5B,IAAI,CAACM,KAAKpE,MAAM,IAAI,CAACkE,SAASlE,MAAM,EAAE,OAAO8D;IAC7C,MAAMO,QAAQ,MAAM9I,mBAAmB;QACrCmC;QACA0G,MAAM;eAAIF;eAAaE;SAAK;IAC9B;IACA,IAAIH,cAAc;QAChB,MAAMK,YAAYvI,sBAAsBkI,aAAaE,MAAM,EAAEE;QAC7D,IAAIC,WAAWL,aAAaM,OAAO,CAACD;IACtC;IACA,OAAOrJ,qBAAqB6I,cAAcO;AAC5C;AAEA;;;;;CAKC,GACD,OAAO,eAAeG,mBAAmBhF,OA2BxC;QAWoBA,MAAAA;IAVnB,MAAM,EAAE9B,MAAM,EAAE+G,QAAQ,EAAEC,MAAM,EAAE,GAAGlF;IAErC,MAAMmF,qBAAqBnF,QAAQoF,SAAS,GACxC,OACA,MAAMzJ,wBAAwB;QAC5BuC;QACAmH,gBAAgB;QAChBC,OAAOL;QACPM,QAAQL;IACV;IACJ,MAAME,aAAapF,QAAAA,qBAAAA,QAAQoF,SAAS,YAAjBpF,qBACjBmF,8BADiBnF,OAEjBkF,OAAOE,SAAS;IAElB;;;;;;;;;;;;;;;;GAgBC,GACD,IAAI,CAACA,WAAW,OAAO;IAEvB,MAAMI,iBAAiBlJ,iBAAiB;QAAE4B;QAAQ+G;QAAUG;IAAU;IAEtE;;;;;;;;;;;GAWC,GACD,MAAMK,WAAW1F,uBAAuB,aAClCC,QAAQtB,QAAQ,GAAG;QAAEA,UAAUsB,QAAQtB,QAAQ;IAAC,IAAI,CAAC;QACzDR;QACA,wEAAwE;QACxE,0EAA0E;QAC1E,qEAAqE;QACrE,uEAAuE;QACvE,kDAAkD;QAClD+B,UAAUuF,eAAeE,IAAI,CAC3B,CAACC,MACCA,IAAI/E,OAAO,IAAI,cAAc+E,IAAI/E,OAAO,GACnC,AAAC+E,IAAI/E,OAAO,CAA8BX,QAAQ,GAGlDiF,OAAOjF,QAAQ,EACtB,IAAMiF,OAAOjF,QAAQ;QAEvB,yEAAyE;QACzE,oEAAoE;QACpE8B,kBAAkByD,eAAeE,IAAI,CACnC,CAACC;gBACEA;oBAAAA,eAAAA,IAAI/E,OAAO,qBAAZ,AAAC+E,aAAsD5D,gBAAgB;WACzE,IAAMvD;QAER,0EAA0E;QAC1E,4DAA4D;QAC5DwD,sBAAsBwD,eAAeE,IAAI,CACvC,CAACC;gBACEA;oBAAAA,eAAAA,IAAI/E,OAAO,qBAAZ,AAAC+E,aACG3D,oBAAoB;WAC1B,IAAMxD;QAERL,aAAaqH,eAAeE,IAAI,CAC9B,CAACC;;gBAASA;4BAAAA,eAAAA,IAAI/E,OAAO,qBAAX+E,aAAahJ,KAAK,mBAAI,CAAC;WACjC,IAAO,CAAA,CAAC,CAAA;QAEVuH,QAAQlE,QAAQkE,MAAM;QACtBtH,YAAYoD,QAAQpD,UAAU;QAC9BgH,MAAM5D,QAAQ4D,IAAI;QAClBa,cAAczE,QAAQyE,YAAY;;IAEpC,KAAKgB,SAASlH,KAAK,CAAC,IAAMC;IAE1B,MAAMoH,aAAa,MAAMJ;IACzB,IAAII,WAAWC,KAAK,IAAI,CAACD,WAAWhF,OAAO,EAAE,OAAO;IAEpD,OAAO6E;AACT;AAEA,eAAeT,mBAAkB"}
+{"version":3,"sources":["../../../../../../libs/tenant/runtime/src/lib/compose-screen-nodes.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn/server'\n// By path: the overlay is server-only, and every `@aglyn/aglyn` barrel\n// re-exports `app-utils/server` into published pages.\nimport {\n  applyMediaAssetFacts,\n  mediaAssetRefs,\n} from '@aglyn/aglyn/app-utils/media-asset-facts'\nimport {\n  recordServedPageVersion,\n  reviewHostedPage,\n  servedPageVersion,\n} from '@aglyn/tenant-data-admin/server/hosted-page-review'\nimport applyDuePublishSchedule from './apply-publish-schedule'\nimport getComponents from './get-components'\nimport getDatasets from './get-datasets'\nimport getForms from './get-forms'\nimport getMediaAssetFacts from './get-media-asset-facts'\nimport {\n  getPublishedCollectionSource,\n  type PublishedCollectionSource,\n} from './get-collection-content'\nimport getPluginInstalls from './get-plugin-installs'\nimport getVariables, { getFunctions, getWorkflows } from './get-variables'\nimport getPublishedLayoutVersion from './get-layout-version'\nimport getScreenVersion from './get-screen-version'\nimport {\n  type ComposeSocialImages,\n  socialImageAssetFacts,\n  socialImageRefs,\n} from './social-image-facts'\nimport { stampFormDatasetBindings } from './stamp-form-dataset-bindings'\n\n/**\n * Content-collection context for a compose (AGL-551): the collection the\n * route resolved (list/entry template screens). `entries` rides along when\n * the route already fetched them (list pages); blocks bound to other\n * collections — or to this one when `entries` is absent — fetch on demand.\n */\nexport interface ComposeCollectionContext {\n  slug: string\n  entries?: Aglyn.CollectionEntryRecord[]\n  /**\n   * The entry being rendered (AGL-582, entry-template screens / entry\n   * fallback) — the Related posts block resolves against it.\n   */\n  entry?: Aglyn.CollectionEntryRecord | null\n  /**\n   * The routed collection's category taxonomy (AGL-582): entry\n   * `categoryId`s resolve to display names against it during expansion.\n   */\n  categories?: Aglyn.CollectionCategory[]\n  /**\n   * The list page the URL asked for (AGL-1321). Fills in an entries block\n   * that declares `perPage` but no `page` — design time cannot know which\n   * page a visitor is on.\n   */\n  page?: number\n  /**\n   * The category segment the URL filtered on (AGL-1321); marks the current\n   * pill in a Category Pills block. `entries` arrives already filtered.\n   */\n  categorySlug?: string\n  /**\n   * Whether the read behind `entries` stopped at its `.limit()` (AGL-1516).\n   * Travels with the entries because the search boxes downstream have to say\n   * what they actually searched, and — with the liveness gate and the route's\n   * category filter both in between — `entries.length` no longer tells them.\n   */\n  entriesReachedBound?: boolean\n  /**\n   * Where `entries` begins in the collection's own order (AGL-3213).\n   *\n   * Zero for every listing served from the cached read. A page past that\n   * read's bound carries only its own ten entries, and the block windows\n   * `[(page - 1) * perPage, …)` — so without this it would slice from an\n   * offset its own array never reaches and render an empty listing.\n   */\n  windowStart?: number\n  /**\n   * Whether {@link slug} is a cache KEY rather than an address (AGL-2524).\n   *\n   * The author page mixes collections, and the compose pipeline keys entry\n   * sources by collection slug — so it hands over a synthetic one\n   * (`AUTHOR_ENTRIES_SOURCE_SLUG`) with its entries already in hand. That is\n   * harmless for the entries block, whose every row carries its OWN\n   * `collectionSlug` and builds `entry.url` from it, and for the search box,\n   * whose index is built the same way.\n   *\n   * It is NOT harmless for anything that builds a URL from the source's slug\n   * itself. Set this and such a block resolves nothing rather than pointing\n   * readers at `/{synthetic}/…`.\n   */\n  routeless?: boolean\n}\n\ninterface CollectionBlockScan {\n  slugs: Set<string>\n  hasRelated: boolean\n  hasCategories: boolean\n  hasSearch: boolean\n}\n\n/**\n * Which collections does this tree ask for (AGL-1152)?\n *\n * Extracted so the PREFETCH below and the expansion that consumes it read the\n * tree through one function rather than two copies of the same predicate. A\n * divergence between them is not a type error — it is a slug prefetched and\n * never awaited, or (worse) a slug the prefetch missed that then pays the full\n * serial read anyway — so there is deliberately no second implementation to\n * drift.\n */\nfunction scanCollectionBlocks(\n  nodes: Record<string, any>,\n  collection?: ComposeCollectionContext,\n): CollectionBlockScan {\n  const slugs = new Set<string>()\n  let hasRelated = false\n  let hasCategories = false\n  let hasSearch = false\n  for (const node of Object.values(nodes)) {\n    if (node?.componentId === Aglyn.COLLECTION_ENTRIES_COMPONENT_ID) {\n      const slug =\n        String(node?.props?.collectionSlug ?? '').trim() || collection?.slug\n      if (slug) slugs.add(slug)\n    }\n    // Category pills (AGL-1321) need only the taxonomy, but it rides on the\n    // same source, so they count as a reason to resolve one.\n    if (node?.componentId === Aglyn.COLLECTION_CATEGORIES_COMPONENT_ID) {\n      const slug =\n        String(node?.props?.collectionSlug ?? '').trim() || collection?.slug\n      if (slug) {\n        hasCategories = true\n        slugs.add(slug)\n      }\n    }\n    // The standalone toolbar search box (AGL-1516, Figma 494:1220) needs the\n    // collection's entries to index, and rides the same source the listing\n    // beside it was built from — one read, one answer.\n    if (node?.componentId === Aglyn.COLLECTION_SEARCH_COMPONENT_ID) {\n      const slug =\n        String(node?.props?.collectionSlug ?? '').trim() || collection?.slug\n      if (slug) {\n        hasSearch = true\n        slugs.add(slug)\n      }\n    }\n    // Related posts (AGL-582) always resolve against the ROUTED collection\n    // — they only mean something with a current entry in context.\n    if (\n      node?.componentId === Aglyn.COLLECTION_RELATED_COMPONENT_ID &&\n      collection?.slug &&\n      collection.entry\n    ) {\n      hasRelated = true\n      slugs.add(collection.slug)\n    }\n  }\n  return { slugs, hasRelated, hasCategories, hasSearch }\n}\n\n/**\n * Issue the collection reads AS SOON AS THE SCREEN NODES EXIST (AGL-1152).\n *\n * `getPublishedCollectionSource` is three SEQUENTIAL round trips —\n * `findContentCollection`, then `listLiveEntries`, then `attachEntryAuthors`\n * — and until this existed it ran after the chrome bundle had already been\n * awaited, so a page carrying a Collection entries block paid the whole thing\n * as a serial tail on the compose phase. Measured on the tenant: a page with\n * no collection block composes in ~20 ms, one with a block in ~572 ms, and the\n * tree work itself accounts for under 2 ms of that at 50 entries. The gap is\n * this read, waiting for reads it shares nothing with.\n *\n * Same shape as `screenDatasetsPromise` directly below, and the same caveat\n * applies: the SCREEN's own nodes are a fast path, NOT the correctness gate. A\n * collection block can arrive from a layout or a grafted reusable component,\n * neither of which exists yet at this point, so the real scan still runs\n * against the composed tree and still fetches anything this missed.\n *\n * The ROUTED collection is deliberately excluded when its entries are already\n * in hand: the expansion below answers that slug from `collection.entries`\n * without reading at all, so prefetching it would buy a read nobody awaits.\n */\nfunction prefetchCollectionSources(\n  hostId: string,\n  screenNodes: Record<string, any>,\n  collection?: ComposeCollectionContext,\n): Record<string, Promise<PublishedCollectionSource>> {\n  const prefetched: Record<\n    string,\n    Promise<PublishedCollectionSource>\n  > = {}\n  for (const slug of scanCollectionBlocks(screenNodes, collection).slugs) {\n    if (slug === collection?.slug && collection.entries) continue\n    const pending = getPublishedCollectionSource({\n      hostId,\n      collectionSlug: slug,\n    })\n    // Marked handled the moment it exists, for the reason `composed` is in\n    // `composeScreenNodes`: a tree that turns out not to need this slug never\n    // awaits it, and an unawaited rejection takes the process down rather than\n    // failing this one read. The real await below still sees the rejection.\n    void pending.catch(() => undefined)\n    prefetched[slug] = pending\n  }\n  return prefetched\n}\n\n/**\n * Expands Collection entries blocks (AGL-551) against their collections'\n * published entries, and Related posts blocks (AGL-582) against the routed\n * entry. Fetches lazily — screens without the blocks cost nothing — and\n * fails open on lookup errors like every other compose stage.\n */\nasync function expandCollectionEntryBlocks(\n  hostId: string,\n  nodes: Record<string, any>,\n  collection?: ComposeCollectionContext,\n  prefetched?: Record<string, Promise<PublishedCollectionSource>>,\n  /** The site's zone (AGL-3237); UTC when a site has not named one. */\n  timeZone?: string,\n): Promise<Record<string, any>> {\n  const { slugs, hasRelated, hasCategories, hasSearch } = scanCollectionBlocks(\n    nodes,\n    collection,\n  )\n  if (!slugs.size) return nodes\n  const sources: Record<string, Aglyn.CollectionEntriesSource> = {}\n  await Promise.all(\n    [...slugs].map(async (slug) => {\n      // The routed collection rides its already-fetched entries +\n      // categories (AGL-582); other collections fetch both on demand.\n      if (slug === collection?.slug && collection.entries) {\n        sources[slug] = {\n          slug,\n          entries: collection.entries,\n          categories: collection.categories,\n          // Only the ROUTED collection carries the URL's page (AGL-1321) — a\n          // block bound to another collection must not inherit it.\n          ...(collection.page ? { page: collection.page } : {}),\n          // ...nor its bound (AGL-1516): this is a fact about the read the\n          // route already performed, and it describes only that collection.\n          ...(collection.entriesReachedBound ? { reachedBound: true } : {}),\n          // ...nor where its window starts (AGL-3213), for the same reason:\n          // it is a fact about the read this route performed.\n          ...(collection.windowStart\n            ? { windowStart: collection.windowStart }\n            : {}),\n        }\n        return\n      }\n      // The prefetch when this slug was visible on the screen's own nodes;\n      // a live read when it only appeared after layout/component grafting.\n      const fetched = await (prefetched?.[slug] ??\n        getPublishedCollectionSource({ hostId, collectionSlug: slug }))\n      sources[slug] = {\n        slug,\n        entries: fetched.entries,\n        categories:\n          slug === collection?.slug && collection.categories\n            ? collection.categories\n            : fetched.categories,\n        ...(fetched.reachedBound ? { reachedBound: true } : {}),\n      }\n    }),\n  )\n  const expanded = Aglyn.expandCollectionEntries(\n    nodes,\n    sources,\n    collection?.slug,\n    timeZone,\n  )\n  const withCategories = hasCategories\n    ? Aglyn.expandCollectionCategories(\n        expanded,\n        sources,\n        /*\n          No DEFAULT collection for the pills on a routeless page (AGL-2524).\n\n          Category pills are the one block that builds its links from the\n          SOURCE's slug — `/{slug}/category/{x}` — because a category is a\n          filter on one collection's own listing. On the author page that slug\n          is synthetic, so an unbound pills block stamped links to a route that\n          does not exist.\n\n          Rendering nothing is the honest answer rather than a fallback. The\n          page spans every collection, and there is no\n          `/author/{slug}/category/{x}` for a pill to lead to; the only real\n          destination would be some collection's listing, which drops the\n          author the reader is looking at. A pills block that NAMES a\n          collection is unaffected and still resolves that collection's own\n          taxonomy — \"browse the blog by category\", which is a sensible thing\n          to put beside an archive.\n        */\n        collection?.routeless ? undefined : collection?.slug,\n        collection?.categorySlug,\n      )\n    : expanded\n  const withSearch = hasSearch\n    ? Aglyn.expandCollectionSearch(\n        withCategories,\n        sources,\n        collection?.slug,\n        timeZone,\n      )\n    : withCategories\n  if (!hasRelated || !collection?.entry) return withSearch\n  return Aglyn.expandCollectionRelated(\n    withSearch,\n    sources[collection.slug],\n    collection.entry,\n    timeZone,\n  )\n}\n\n/**\n * Shared post-version composition (AGL-551, extracted from\n * `composeScreenNodes`): layout chrome, reusable components, repeatables,\n * collection entries, bindings, function definitions, plugin installs,\n * named tokens, denormalize, and last the current facts of each placed image\n * and film, and of the social card the page is shared as. The screen path and\n * the collection-fallback\n * path (which has no screen doc) build identical trees through this one\n * pipeline.\n */\nexport async function composeNodesWithChrome(options: {\n  hostId: string\n  /**\n   * The zone this site's dates read in (AGL-3237) — `resolveSiteTimeZone` of\n   * the org and the host, resolved ONCE by the caller that holds both.\n   *\n   * A string rather than the two documents, because the value has to be\n   * identical on the server render and the client re-render, and the surest\n   * way to guarantee that is for only one place to decide it. Absent is UTC,\n   * which is what every site rendered before this existed.\n   */\n  timeZone?: string\n  /**\n   * The layout binding, or a PROMISE of it.\n   *\n   * The unresolved form exists for the same reason `screenNodes` accepts one\n   * (AGL-1428): the binding may live on the version document (key-present\n   * wins over the screen's), and awaiting the version before this call would\n   * put every host-scoped read back behind it. Only the layout-chain walk\n   * consumes the binding, so it alone waits; the rest of the chrome bundle\n   * still starts immediately.\n   */\n  layoutId?:\n    | string\n    | null\n    | Promise<string | null | undefined>\n  /**\n   * The screen's values for the properties of the layouts it renders inside\n   * (AGL-2893), keyed by layout id — or a PROMISE of them, for the reason\n   * `layoutId` accepts one: they live on the version document beside the\n   * binding. Absent, every layout renders its properties' defaults.\n   */\n  layoutPropValues?:\n    | Aglyn.AglynScreenVersion['layoutPropValues']\n    | null\n    | Promise<Aglyn.AglynScreenVersion['layoutPropValues'] | null | undefined>\n  /**\n   * The screen's per-page restyling of its layouts' elements (AGL-3286),\n   * keyed by layout id then layout node id — or a PROMISE of it, for the same\n   * reason as `layoutPropValues`, beside which it is stored. Absent, every\n   * layout renders with its own styling.\n   */\n  layoutStyleOverrides?:\n    | Aglyn.AglynScreenVersion['layoutStyleOverrides']\n    | null\n    | Promise<\n        Aglyn.AglynScreenVersion['layoutStyleOverrides'] | null | undefined\n      >\n  /**\n   * The screen's own nodes, or a PROMISE of them (AGL-1428).\n   *\n   * Accepting the unresolved form is what lets `composeScreenNodes` hand the\n   * version read over before it has finished, so the host-scoped reads below\n   * — none of which look at these nodes — overlap it instead of queueing\n   * behind it. Passing a resolved value behaves exactly as before, which is\n   * what every other caller does.\n   */\n  screenNodes: Record<string, any> | Promise<Record<string, any>>\n  /** Entry-template tokens (AGL-105) substituted before denormalize. */\n  tokens?: Record<string, string>\n  /** Routed content collection (AGL-551) for Collection entries blocks. */\n  collection?: ComposeCollectionContext\n  /**\n   * The host document, for `host.*` tokens (AGL-1022).\n   *\n   * Passed in rather than read here: every caller already holds it, and\n   * `composeScreenNodes` was the largest single render phase before AGL-1225\n   * cut it to one round trip — adding a read back would spend that win on\n   * data we already have in hand.\n   */\n  host?: Aglyn.HostTokenSource | null\n  /**\n   * The social card the head shares this page as (AGL-2850). The documents of\n   * the assets it names are read in the same batch as the images and films\n   * the tree places.\n   */\n  socialImages?: ComposeSocialImages\n}): Promise<Record<string, any>> {\n  const { hostId, layoutId } = options\n\n  /**\n   * The layout chain, innermost first (AGL-703).\n   *\n   * A layout may itself render inside another layout, so this walks the\n   * `layoutId` pointers rather than reading one. Fetching is sequential\n   * because each step's parent is only known once the previous layout\n   * document is in hand — but the walk is short by construction\n   * (MAX_LAYOUT_CHAIN_DEPTH) and every layout is already a cached read.\n   *\n   * `seen` stops a cycle from looping forever. Stored data can hold one\n   * even though both the console and `canNestLayout` refuse to create it:\n   * the API, a script, or a restored backup can all write a layout\n   * document directly, and a render must degrade rather than hang.\n   */\n  const walkLayoutChain = async () => {\n    const chain: Aglyn.LayoutChainEntry[] = []\n    const seen = new Set<string>()\n    const boundLayoutId = await layoutId\n    let currentLayoutId = boundLayoutId ? String(boundLayoutId) : undefined\n    while (\n      currentLayoutId &&\n      !seen.has(currentLayoutId) &&\n      chain.length < Aglyn.MAX_LAYOUT_CHAIN_DEPTH\n    ) {\n      seen.add(currentLayoutId)\n      const layoutRes = await getPublishedLayoutVersion({\n        hostId,\n        layoutId: currentLayoutId,\n      })\n      // The version's declared properties travel with its nodes (AGL-2893):\n      // they are applied to this layout alone, with the screen's values for\n      // this layout, before the screen is grafted into its slot.\n      chain.push({\n        layoutId: currentLayoutId,\n        nodes: layoutRes?.version?.nodes as any,\n        props: (layoutRes?.version as Aglyn.AglynLayoutVersion | undefined)\n          ?.props,\n      })\n      const parentId = (layoutRes?.layout as any)?.layoutId\n      currentLayoutId = parentId ? String(parentId) : undefined\n    }\n    return chain\n  }\n\n  /**\n   * ONE round-trip stage instead of three (AGL-1225).\n   *\n   * This used to be `await layout walk` → `await getComponents` → `await\n   * Promise.all([five reads])`: three sequential waits, where only the first\n   * has any reason to be sequential. Every one of the other six reads takes\n   * `hostId` and nothing else — none of them consumes the layout chain — so\n   * they were waiting on a walk whose result they never look at.\n   *\n   * The walk stays internally sequential because it genuinely is: each step's\n   * parent id is only known once the previous layout document is in hand. It\n   * just no longer gates anything else. The critical path becomes the walk\n   * alone rather than walk + components + bulk.\n   *\n   * Measured budget that motivated this (production, `/product/besigner`):\n   * `composeScreenNodes` was the largest single phase at 1577 ms cold and\n   * consistently ~1.4-1.6 s warm too, so this is not cold-start cost. The\n   * existing `AGL-1152:render` timing line reports `composeScreenNodes` as a\n   * phase, so the effect of this shows up there directly — no new\n   * instrumentation, and a regression would be visible in the same place.\n   */\n  /**\n   * Does the SCREEN itself repeat over a dataset (AGL-1440)?\n   *\n   * Asked as soon as the nodes are in hand — which since AGL-1428 is after\n   * the fan-out has been ISSUED rather than before — so the overwhelmingly\n   * common case still keeps the AGL-1225 shape: a page that repeats almost\n   * always says so on its own document, and its datasets read goes out\n   * alongside the remaining chrome reads instead of after them.\n   *\n   * It is deliberately NOT the correctness gate — a repeatable can arrive from\n   * a layout or a grafted reusable component, neither of which exists yet. The\n   * gate is re-asked against the composed tree after grafting, which is the\n   * exact input `expandRepeatables` reads.\n   */\n  /*\n   * ISSUE THE HOST-SCOPED READS FIRST, THEN AWAIT THE NODES (AGL-1428).\n   *\n   * Every read in this bundle is keyed by `hostId` (and `layoutId`) alone —\n   * none of them reads `screenNodes` — so starting them before the nodes are\n   * in hand lets `composeScreenNodes`' version read overlap them rather than\n   * run ahead of them. `Promise.all` is created BEFORE the `await` below on\n   * purpose: that is the line that makes the two independent, and moving the\n   * await above it silently gives the whole saving back.\n   *\n   * `getDatasets` is the one read that genuinely depends on the nodes, so it\n   * cannot join the bundle. It does not have to wait for the bundle either —\n   * it is issued the moment the nodes resolve and awaited after, so it still\n   * overlaps whatever is left of the chrome reads instead of costing the\n   * extra serial round trip that dropping it from the batch would imply.\n   */\n  const chromeBundle = Promise.all([\n    walkLayoutChain(),\n    getComponents({ hostId }),\n    // Host variable + function bindings (AGL-91/93): {{name}} and\n    // {{fn:name(args)}} in string props resolve to values; unknown tokens\n    // and failed runs stay literal.\n    Promise.all([\n      getVariables({ hostId }),\n      getFunctions({ hostId }),\n      getWorkflows({ hostId }),\n      getPluginInstalls({ hostId }),\n    ]),\n  ])\n  const screenNodes = await options.screenNodes\n  const screenDatasetKeys = Aglyn.repeatDatasetKeys(screenNodes)\n  const screenDatasetsPromise = screenDatasetKeys.length\n    ? getDatasets({ hostId, keys: screenDatasetKeys })\n    : undefined\n  // Does the SCREEN itself place a form entity? Gated and re-asked exactly\n  // like the datasets read beside it (AGL-1440): most pages carry no form, and\n  // the ones that do usually say so on their own document, so the read goes\n  // out here alongside the chrome reads instead of as a serial tail. It is not\n  // the correctness gate — a placed form can arrive from a layout or a grafted\n  // component — so the composed tree is asked again below.\n  const screenFormsPromise = Aglyn.placesFormEntity(screenNodes)\n    ? getForms({ hostId })\n    : undefined\n  // Issued HERE, beside the datasets read and before the chrome bundle is\n  // awaited, so the collection read overlaps it instead of trailing it.\n  const prefetchedSources = prefetchCollectionSources(\n    hostId,\n    screenNodes,\n    options.collection,\n  )\n  const [layoutChain, componentsRes, bulk] = await chromeBundle\n  const [rawVariables, functions, workflows, pluginInstalls] = bulk\n  const screenDatasets = await screenDatasetsPromise\n  // Settled by now: it is read off the same version document the layout\n  // binding the walk above waited on came from.\n  const layoutPropValues = await options.layoutPropValues\n  const layoutStyleOverrides = await options.layoutStyleOverrides\n\n  const composedNodes = Aglyn.composeLayoutChainWithProps(\n    layoutChain as any,\n    screenNodes as any,\n    layoutPropValues,\n    layoutStyleOverrides,\n  )\n  const graftedComponents = Aglyn.composeReusableComponentNodes(\n    composedNodes as any,\n    componentsRes.definitions as any,\n  )\n  /*\n   * PLACED FORMS RESOLVE AGAINST THEIR ENTITY (`docs/specs/reusable-forms.md`).\n   *\n   * A form node bound to `hosts/{hostId}/forms/{formId}` renders that entity's\n   * published design, so a form is edited once and every page placing it\n   * follows. Without this the entity's tree was written on every publish and\n   * read by nothing: the fields had to be redrawn per page, and the two copies\n   * diverged the moment either was touched.\n   *\n   * The gate is the COMPONENT-grafted tree, not the screen's own nodes, for\n   * the reason the repeatables gate below states: a form placed inside a\n   * layout or a shared component does not exist in `screenNodes`, and a page\n   * that renders one would silently keep its stale inline copy.\n   *\n   * The second graft re-runs the component expansion deliberately. Instances\n   * already expanded are skipped by their own prefix, so the repeat costs a\n   * scan, and passing BOTH placement kinds is what expands a reusable\n   * component nested inside a form's design — which the first pass could not\n   * have seen, because that subtree was not in the tree yet.\n   */\n  const forms =\n    (await screenFormsPromise)?.forms ??\n    (Aglyn.placesFormEntity(graftedComponents as any)\n      ? (await getForms({ hostId })).forms\n      : undefined)\n  const grafted = forms\n    ? Aglyn.composeReusableComponentNodes(\n        graftedComponents as any,\n        componentsRes.definitions as any,\n        [Aglyn.placedFormPlacement(forms as any)],\n      )\n    : graftedComponents\n  // Computed variables (AGL-129): workflow-backed values resolve once per\n  // compose; failures keep each variable's stored fallback.\n  const variables = Aglyn.resolveComputedVariables(\n    rawVariables,\n    functions,\n    workflows,\n  )\n  // Repeatables (AGL-103) expand after grafting (so they work inside\n  // reusable components) and before bindings (so {{name}} tokens inside\n  // cloned items still resolve).\n  //\n  // Only the datasets this tree repeats over are read (AGL-1440), and the tree\n  // asked is the composed one — after grafting — because that is the map the\n  // expansion reads: a repeatable living in a layout or a reusable component\n  // is invisible in `screenNodes`, and reading only the screen's keys would\n  // silently render one template row where the author put a list. The\n  // screen's own keys were issued beside the chrome reads above; a key only a\n  // layout or a component adds is read here, for that key alone.\n  const datasetKeys = Aglyn.repeatDatasetKeys(grafted as any)\n  const unreadDatasetKeys = datasetKeys.filter(\n    (key) => !screenDatasetKeys.includes(key),\n  )\n  const datasets = unreadDatasetKeys.length\n    ? {\n        ...screenDatasets,\n        ...(await getDatasets({ hostId, keys: unreadDatasetKeys })),\n      }\n    : screenDatasets\n  const repeated = Aglyn.expandRepeatables(grafted as any, datasets)\n  // Collection entries blocks (AGL-551) expand alongside repeatables:\n  // per-entry {{entry.*}} tokens substitute inside the clones here, while\n  // page-level tokens wait for resolveNamedTokens below.\n  const withEntries = await expandCollectionEntryBlocks(\n    hostId,\n    repeated,\n    options.collection,\n    prefetchedSources,\n    options.timeZone,\n  )\n  // Entry Meta blocks (AGL-1385): fill in the routed entry's date/category/\n  // tags. Needs no source fetch — the routed entry and its taxonomy are\n  // already in hand — so it sits outside `expandCollectionEntryBlocks`, which\n  // returns early when no block asks for a collection read. AFTER it, so the\n  // per-entry clones it just produced already carry their own resolved values\n  // and are skipped.\n  const withEntryMeta = Aglyn.expandCollectionEntryMeta(\n    withEntries as any,\n    options.collection?.entry,\n    options.collection?.categories,\n    options.timeZone,\n  )\n  // Entry Author cards (AGL-2486): the same fill, one block over. Its values\n  // come off the author RECORD the routed entry resolved to, which the\n  // collection read has already attached, so this costs nothing either.\n  const withEntryAuthor = Aglyn.expandCollectionEntryAuthor(\n    withEntryMeta as any,\n    options.collection?.entry,\n  )\n  const bound = Aglyn.resolveNodesBindings(\n    withEntryAuthor as any,\n    variables,\n    functions,\n  )\n  // Host variables (AGL-1022): `{{host.*}}` resolves from the INSTALLING\n  // site, late — at render, never at install — so a rebrand propagates to\n  // every artifact that names the host instead of hard-coding it. Same\n  // registry the email path uses, so a token means one thing in both.\n  const withHostTokens = Aglyn.resolveNodesHostTokens(\n    bound as any,\n    options.host,\n  )\n  // Function widgets run client-side: embed their definitions (AGL-93), and\n  // beside each the site variables that function reads and no others\n  // (AGL-3202).\n  const withFunctions = Aglyn.attachFunctionDefinitions(\n    withHostTokens,\n    functions,\n    variables,\n  )\n  // Marketplace plugins (AGL-45): stamp each marketplacePlugin node with its\n  // pinned install (version/sha256/capabilities) + kill-switch state.\n  const nodes = Aglyn.attachPluginInstalls(withFunctions, pluginInstalls)\n  // Entry-template tokens (AGL-105): {{entry.*}} from the rendered entry.\n  const finalNodes = Aglyn.resolveNamedTokens(nodes as any, options.tokens)\n  // The document's one `main` landmark (AGL-2486). LAST, so it reads the tree\n  // the page actually ships — a slot grafted from a layout chain, an element\n  // an author chose — rather than the screen as stored.\n  const withLandmark = Aglyn.stampDocumentLandmark(finalNodes as any)\n  // Each form's dataset binding, signed so the submit route can trust it\n  // (AGL-2773). Read off THIS tree, the one the page ships, so a form grafted\n  // from a layout, a component or a form entity is signed as it renders; and\n  // after every stage that rewrites props, so nothing changes what the\n  // signature covers.\n  const withFormBindings = stampFormDatasetBindings(withLandmark, hostId)\n  const denormalized = Aglyn.canvas.processNodesToDenormalized(\n    withFormBindings as any,\n  )\n  /*\n   * WHAT EACH PLACED IMAGE AND FILM IS NOW (AGL-2807, AGL-2833).\n   *\n   * An image's pixel pair and a film's length, shape and poster come from the\n   * asset's DAM document as it is now, not as it was when it was picked. LAST,\n   * on the tree the page ships, because an asset can arrive from any stage\n   * above: a layout, a component, a form, a repeated row, a collection entry,\n   * a binding.\n   *\n   * ONE read for all of them, issued once the tree is final rather than beside\n   * the chrome reads. A read issued there could only cover the screen's own\n   * placements, and nearly every layout places an image the screen does not\n   * (a logo, a footer mark), so it would buy a second read on almost every\n   * page. The late read costs its own round trip after the chrome reads, paid\n   * each time a page is composed, which for a published page is its ISR\n   * regeneration. A tree with no library asset, on a page whose social card\n   * names none, issues none.\n   *\n   * THE SOCIAL CARD'S ASSETS JOIN THE SAME READ (AGL-2850), ahead of the\n   * placements. A placement the cap leaves out keeps its pick-time pair, which\n   * for an image is a reservation the decoded picture corrects. Nothing\n   * corrects a card's pair, because a crawler lays the card out from it before\n   * fetching the image, and a card names at most three documents.\n   */\n  const socialImages = options.socialImages\n  const cardRefs = socialImages ? socialImageRefs(socialImages.images) : []\n  const refs = mediaAssetRefs(denormalized)\n  if (!refs.length && !cardRefs.length) return denormalized\n  const facts = await getMediaAssetFacts({\n    hostId,\n    refs: [...cardRefs, ...refs],\n  })\n  if (socialImages) {\n    const cardFacts = socialImageAssetFacts(socialImages.images, facts)\n    if (cardFacts) socialImages.onFacts(cardFacts)\n  }\n  return applyMediaAssetFacts(denormalized, facts)\n}\n\n/**\n * Full published-render composition for one screen (extracted for AGL-87 so\n * the SSG path and the password-unlock API build identical trees): applies\n * a due publish schedule, loads the version, composes the shared layout\n * chrome, grafts reusable components, and denormalizes.\n */\nexport async function composeScreenNodes(options: {\n  hostId: string\n  screenId: string\n  screen: Aglyn.AglynScreen\n  /** Entry-template tokens (AGL-105) substituted before denormalize. */\n  tokens?: Record<string, string>\n  /** Routed content collection (AGL-551) for Collection entries blocks. */\n  collection?: ComposeCollectionContext\n  /**\n   * Compose a specific version instead of the published one (AGL-253):\n   * experiment variants point at versions; schedules don't apply.\n   */\n  versionId?: string\n  /** The host document, for `host.*` tokens (AGL-1022). */\n  host?: Aglyn.HostTokenSource | null\n  /**\n   * The zone this site's dates read in (AGL-3237) — `resolveSiteTimeZone` of\n   * the org and the host, resolved ONCE by the caller that holds both.\n   *\n   * A string rather than the two documents, because the value has to be\n   * identical on the server render and the client re-render, and the surest\n   * way to guarantee that is for only one place to decide it. Absent is UTC,\n   * which is what every site rendered before this existed.\n   */\n  timeZone?: string\n  /** The social card the head shares this page as (AGL-2850). */\n  socialImages?: ComposeSocialImages\n  /**\n   * Internal: `false` when this compose IS the fallback to a held page's\n   * last clean version, so a fallback that holds too serves nothing rather\n   * than falling back again.\n   */\n  pageReviewFallback?: boolean\n}): Promise<Record<string, any> | null> {\n  const { hostId, screenId, screen } = options\n\n  const effectiveVersionId = options.versionId\n    ? null\n    : await applyDuePublishSchedule({\n        hostId,\n        collectionName: 'screens',\n        docId: screenId,\n        parent: screen,\n      })\n  const versionId = (options.versionId ??\n    effectiveVersionId ??\n    screen.versionId) as string\n\n  /*\n   * OVERLAP THE VERSION READ WITH THE CHROME BUNDLE (AGL-1428).\n   *\n   * `composeNodesWithChrome`'s reads are keyed by `hostId`/`layoutId`, both\n   * of which are in hand here, so the version read no longer has to finish\n   * before they start. Handing the promise over instead of the resolved\n   * value is the whole change: it is `composeNodesWithChrome` that decides\n   * when it actually needs the nodes.\n   *\n   * The `versionId`-less screen still exits BEFORE anything is issued, so a\n   * screen that has never been published costs no reads. What remains is the\n   * narrow case of a `versionId` that points at a missing or unreadable\n   * version document — a data-integrity fault rather than a routing outcome\n   * — and that one now pays for a chrome bundle it discards. That is the\n   * deliberate trade: one wasted bundle on a broken screen, against the\n   * version read hiding under the chrome reads on every render that works.\n   */\n  if (!versionId) return null\n\n  const versionPromise = getScreenVersion({ hostId, screenId, versionId })\n\n  /*\n   * NEITHER DERIVED PROMISE MAY REJECT ON ITS OWN.\n   *\n   * `composed` is discarded on every failure path below, and a rejected\n   * promise nobody awaited is an unhandled rejection — which in Node takes\n   * the whole render process down instead of letting this 404. So the nodes\n   * handed to the compose absorb the failure (an empty tree it will never be\n   * asked for), and `composed` gets a rejection handler attached the moment\n   * it exists rather than at the point we decide to drop it. The real error\n   * still propagates, from the `await versionPromise` below, exactly where it\n   * did when this function awaited the version directly.\n   */\n  const composed = composeNodesWithChrome({\n    ...(options.timeZone ? { timeZone: options.timeZone } : {}),\n    hostId,\n    // Version-first (key-present wins, null = explicitly no layout), screen\n    // fallback — resolved as a promise so only the layout-chain walk waits on\n    // the version read; the rest of the chrome bundle keeps the AGL-1428\n    // overlap. A failed version read falls back to the screen binding; the\n    // whole compose is discarded on that path anyway.\n    layoutId: versionPromise.then(\n      (res) =>\n        res.version && 'layoutId' in res.version\n          ? ((res.version as Aglyn.AglynScreenVersion).layoutId as\n              | string\n              | null)\n          : (screen.layoutId as string | undefined),\n      () => screen.layoutId as string | undefined,\n    ),\n    // The screen's values for its layouts' properties (AGL-2893), beside the\n    // binding on the same document; a failed read renders the defaults.\n    layoutPropValues: versionPromise.then(\n      (res) =>\n        (res.version as Aglyn.AglynScreenVersion | undefined)?.layoutPropValues,\n      () => undefined,\n    ),\n    // …and its per-page restyling of their elements (AGL-3286), from the same\n    // document; a failed read renders the layouts' own styling.\n    layoutStyleOverrides: versionPromise.then(\n      (res) =>\n        (res.version as Aglyn.AglynScreenVersion | undefined)\n          ?.layoutStyleOverrides,\n      () => undefined,\n    ),\n    screenNodes: versionPromise.then(\n      (res) => (res.version?.nodes ?? {}) as any,\n      () => ({}) as any,\n    ),\n    tokens: options.tokens,\n    collection: options.collection,\n    host: options.host,\n    socialImages: options.socialImages,\n  })\n  void composed.catch(() => undefined)\n\n  const versionRes = await versionPromise\n  if (versionRes.error || !versionRes.version) return null\n\n  /*\n   * THE PAGE PHISHING REVIEW (AGL-3356).\n   *\n   * Every way a page goes live — a toolbar publish, a versions-panel\n   * publish, a scheduled publish, a component or form promoted under it, an\n   * experiment variant, an edit to the live version in place — meets here,\n   * with the page exactly as a visitor will receive it. So this is where a\n   * page that links to a brand's lookalike, asks for a password or a card\n   * in a field of its own, or (for a new workspace) dresses a brand's\n   * sign-in is held rather than served. See `hosted-page-review.ts`.\n   *\n   * A held version serves the last version this page served clean, screened\n   * again, or nothing.\n   */\n  const nodes = await composed\n  const review = await reviewHostedPage({\n    hostId,\n    screenId,\n    versionId,\n    nodes,\n  })\n  if (review.outcome === 'serve') {\n    // Only the PUBLISHED version is the page's last clean one; a variant or\n    // a pinned version is not what the page serves.\n    if (nodes && !options.versionId) {\n      await recordServedPageVersion(hostId, screenId, versionId)\n    }\n    return nodes\n  }\n  if (options.pageReviewFallback === false) return null\n  const previous = await servedPageVersion(hostId, screenId)\n  if (!previous || previous === versionId) return null\n  return composeScreenNodes({\n    ...options,\n    versionId: previous,\n    pageReviewFallback: false,\n  })\n}\n\nexport default composeScreenNodes\n"],"names":["Aglyn","applyMediaAssetFacts","mediaAssetRefs","recordServedPageVersion","reviewHostedPage","servedPageVersion","applyDuePublishSchedule","getComponents","getDatasets","getForms","getMediaAssetFacts","getPublishedCollectionSource","getPluginInstalls","getVariables","getFunctions","getWorkflows","getPublishedLayoutVersion","getScreenVersion","socialImageAssetFacts","socialImageRefs","stampFormDatasetBindings","scanCollectionBlocks","nodes","collection","slugs","Set","hasRelated","hasCategories","hasSearch","node","Object","values","componentId","COLLECTION_ENTRIES_COMPONENT_ID","slug","String","props","collectionSlug","trim","add","COLLECTION_CATEGORIES_COMPONENT_ID","COLLECTION_SEARCH_COMPONENT_ID","COLLECTION_RELATED_COMPONENT_ID","entry","prefetchCollectionSources","hostId","screenNodes","prefetched","entries","pending","catch","undefined","expandCollectionEntryBlocks","timeZone","size","sources","Promise","all","map","categories","page","entriesReachedBound","reachedBound","windowStart","fetched","expanded","expandCollectionEntries","withCategories","expandCollectionCategories","routeless","categorySlug","withSearch","expandCollectionSearch","expandCollectionRelated","composeNodesWithChrome","options","layoutId","walkLayoutChain","chain","seen","boundLayoutId","currentLayoutId","has","length","MAX_LAYOUT_CHAIN_DEPTH","layoutRes","push","version","parentId","layout","chromeBundle","screenDatasetKeys","repeatDatasetKeys","screenDatasetsPromise","keys","screenFormsPromise","placesFormEntity","prefetchedSources","layoutChain","componentsRes","bulk","rawVariables","functions","workflows","pluginInstalls","screenDatasets","layoutPropValues","layoutStyleOverrides","composedNodes","composeLayoutChainWithProps","graftedComponents","composeReusableComponentNodes","definitions","forms","grafted","placedFormPlacement","variables","resolveComputedVariables","datasetKeys","unreadDatasetKeys","filter","key","includes","datasets","repeated","expandRepeatables","withEntries","withEntryMeta","expandCollectionEntryMeta","withEntryAuthor","expandCollectionEntryAuthor","bound","resolveNodesBindings","withHostTokens","resolveNodesHostTokens","host","withFunctions","attachFunctionDefinitions","attachPluginInstalls","finalNodes","resolveNamedTokens","tokens","withLandmark","stampDocumentLandmark","withFormBindings","denormalized","canvas","processNodesToDenormalized","socialImages","cardRefs","images","refs","facts","cardFacts","onFacts","composeScreenNodes","screenId","screen","effectiveVersionId","versionId","collectionName","docId","parent","versionPromise","composed","then","res","versionRes","error","review","outcome","pageReviewFallback","previous"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,sBAAqB;AAC5C,uEAAuE;AACvE,sDAAsD;AACtD,SACEC,oBAAoB,EACpBC,cAAc,QACT,2CAA0C;AACjD,SACEC,uBAAuB,EACvBC,gBAAgB,EAChBC,iBAAiB,QACZ,qDAAoD;AAC3D,OAAOC,6BAA6B,8BAA0B;AAC9D,OAAOC,mBAAmB,sBAAkB;AAC5C,OAAOC,iBAAiB,oBAAgB;AACxC,OAAOC,cAAc,iBAAa;AAClC,OAAOC,wBAAwB,6BAAyB;AACxD,SACEC,4BAA4B,QAEvB,8BAA0B;AACjC,OAAOC,uBAAuB,2BAAuB;AACrD,OAAOC,gBAAgBC,YAAY,EAAEC,YAAY,QAAQ,qBAAiB;AAC1E,OAAOC,+BAA+B,0BAAsB;AAC5D,OAAOC,sBAAsB,0BAAsB;AACnD,SAEEC,qBAAqB,EACrBC,eAAe,QACV,0BAAsB;AAC7B,SAASC,wBAAwB,QAAQ,mCAA+B;AAwExE;;;;;;;;;CASC,GACD,SAASC,qBACPC,KAA0B,EAC1BC,UAAqC;IAErC,MAAMC,QAAQ,IAAIC;IAClB,IAAIC,aAAa;IACjB,IAAIC,gBAAgB;IACpB,IAAIC,YAAY;IAChB,KAAK,MAAMC,QAAQC,OAAOC,MAAM,CAACT,OAAQ;QACvC,IAAIO,CAAAA,wBAAAA,KAAMG,WAAW,MAAKhC,MAAMiC,+BAA+B,EAAE;;gBAEtDJ;YADT,MAAMK,OACJC,eAAON,yBAAAA,cAAAA,KAAMO,KAAK,qBAAXP,YAAaQ,cAAc,mBAAI,IAAIC,IAAI,OAAMf,8BAAAA,WAAYW,IAAI;YACtE,IAAIA,MAAMV,MAAMe,GAAG,CAACL;QACtB;QACA,wEAAwE;QACxE,yDAAyD;QACzD,IAAIL,CAAAA,wBAAAA,KAAMG,WAAW,MAAKhC,MAAMwC,kCAAkC,EAAE;;gBAEzDX;YADT,MAAMK,OACJC,gBAAON,yBAAAA,eAAAA,KAAMO,KAAK,qBAAXP,aAAaQ,cAAc,oBAAI,IAAIC,IAAI,OAAMf,8BAAAA,WAAYW,IAAI;YACtE,IAAIA,MAAM;gBACRP,gBAAgB;gBAChBH,MAAMe,GAAG,CAACL;YACZ;QACF;QACA,yEAAyE;QACzE,uEAAuE;QACvE,mDAAmD;QACnD,IAAIL,CAAAA,wBAAAA,KAAMG,WAAW,MAAKhC,MAAMyC,8BAA8B,EAAE;;gBAErDZ;YADT,MAAMK,OACJC,gBAAON,yBAAAA,eAAAA,KAAMO,KAAK,qBAAXP,aAAaQ,cAAc,oBAAI,IAAIC,IAAI,OAAMf,8BAAAA,WAAYW,IAAI;YACtE,IAAIA,MAAM;gBACRN,YAAY;gBACZJ,MAAMe,GAAG,CAACL;YACZ;QACF;QACA,uEAAuE;QACvE,8DAA8D;QAC9D,IACEL,CAAAA,wBAAAA,KAAMG,WAAW,MAAKhC,MAAM0C,+BAA+B,KAC3DnB,8BAAAA,WAAYW,IAAI,KAChBX,WAAWoB,KAAK,EAChB;YACAjB,aAAa;YACbF,MAAMe,GAAG,CAAChB,WAAWW,IAAI;QAC3B;IACF;IACA,OAAO;QAAEV;QAAOE;QAAYC;QAAeC;IAAU;AACvD;AAEA;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,SAASgB,0BACPC,MAAc,EACdC,WAAgC,EAChCvB,UAAqC;IAErC,MAAMwB,aAGF,CAAC;IACL,KAAK,MAAMb,QAAQb,qBAAqByB,aAAavB,YAAYC,KAAK,CAAE;QACtE,IAAIU,UAASX,8BAAAA,WAAYW,IAAI,KAAIX,WAAWyB,OAAO,EAAE;QACrD,MAAMC,UAAUtC,6BAA6B;YAC3CkC;YACAR,gBAAgBH;QAClB;QACA,uEAAuE;QACvE,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,KAAKe,QAAQC,KAAK,CAAC,IAAMC;QACzBJ,UAAU,CAACb,KAAK,GAAGe;IACrB;IACA,OAAOF;AACT;AAEA;;;;;CAKC,GACD,eAAeK,4BACbP,MAAc,EACdvB,KAA0B,EAC1BC,UAAqC,EACrCwB,UAA+D,EAC/D,mEAAmE,GACnEM,QAAiB;IAEjB,MAAM,EAAE7B,KAAK,EAAEE,UAAU,EAAEC,aAAa,EAAEC,SAAS,EAAE,GAAGP,qBACtDC,OACAC;IAEF,IAAI,CAACC,MAAM8B,IAAI,EAAE,OAAOhC;IACxB,MAAMiC,UAAyD,CAAC;IAChE,MAAMC,QAAQC,GAAG,CACf;WAAIjC;KAAM,CAACkC,GAAG,CAAC,OAAOxB;;QACpB,4DAA4D;QAC5D,gEAAgE;QAChE,IAAIA,UAASX,8BAAAA,WAAYW,IAAI,KAAIX,WAAWyB,OAAO,EAAE;YACnDO,OAAO,CAACrB,KAAK,GAAG;gBACdA;gBACAc,SAASzB,WAAWyB,OAAO;gBAC3BW,YAAYpC,WAAWoC,UAAU;eAG7BpC,WAAWqC,IAAI,GAAG;gBAAEA,MAAMrC,WAAWqC,IAAI;YAAC,IAAI,CAAC,GAG/CrC,WAAWsC,mBAAmB,GAAG;gBAAEC,cAAc;YAAK,IAAI,CAAC,GAG3DvC,WAAWwC,WAAW,GACtB;gBAAEA,aAAaxC,WAAWwC,WAAW;YAAC,IACtC,CAAC;YAEP;QACF;QACA,qEAAqE;QACrE,qEAAqE;QACrE,MAAMC,UAAU,eAAOjB,8BAAAA,UAAY,CAACb,KAAK,mBACvCvB,6BAA6B;YAAEkC;YAAQR,gBAAgBH;QAAK;QAC9DqB,OAAO,CAACrB,KAAK,GAAG;YACdA;YACAc,SAASgB,QAAQhB,OAAO;YACxBW,YACEzB,UAASX,8BAAAA,WAAYW,IAAI,KAAIX,WAAWoC,UAAU,GAC9CpC,WAAWoC,UAAU,GACrBK,QAAQL,UAAU;WACpBK,QAAQF,YAAY,GAAG;YAAEA,cAAc;QAAK,IAAI,CAAC;IAEzD;IAEF,MAAMG,WAAWjE,MAAMkE,uBAAuB,CAC5C5C,OACAiC,SACAhC,8BAAAA,WAAYW,IAAI,EAChBmB;IAEF,MAAMc,iBAAiBxC,gBACnB3B,MAAMoE,0BAA0B,CAC9BH,UACAV,SACA;;;;;;;;;;;;;;;;;QAiBA,GACAhC,CAAAA,8BAAAA,WAAY8C,SAAS,IAAGlB,YAAY5B,8BAAAA,WAAYW,IAAI,EACpDX,8BAAAA,WAAY+C,YAAY,IAE1BL;IACJ,MAAMM,aAAa3C,YACf5B,MAAMwE,sBAAsB,CAC1BL,gBACAZ,SACAhC,8BAAAA,WAAYW,IAAI,EAChBmB,YAEFc;IACJ,IAAI,CAACzC,cAAc,EAACH,8BAAAA,WAAYoB,KAAK,GAAE,OAAO4B;IAC9C,OAAOvE,MAAMyE,uBAAuB,CAClCF,YACAhB,OAAO,CAAChC,WAAWW,IAAI,CAAC,EACxBX,WAAWoB,KAAK,EAChBU;AAEJ;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAeqB,uBAAuBC,OA6E5C;;QA2KI,OA0DDA,qBACAA,sBAQAA;IA7OF,MAAM,EAAE9B,MAAM,EAAE+B,QAAQ,EAAE,GAAGD;IAE7B;;;;;;;;;;;;;GAaC,GACD,MAAME,kBAAkB;QACtB,MAAMC,QAAkC,EAAE;QAC1C,MAAMC,OAAO,IAAItD;QACjB,MAAMuD,gBAAgB,MAAMJ;QAC5B,IAAIK,kBAAkBD,gBAAgB7C,OAAO6C,iBAAiB7B;QAC9D,MACE8B,mBACA,CAACF,KAAKG,GAAG,CAACD,oBACVH,MAAMK,MAAM,GAAGnF,MAAMoF,sBAAsB,CAC3C;gBAWSC,oBACCA,qBAGQA;YAdlBN,KAAKxC,GAAG,CAAC0C;YACT,MAAMI,YAAY,MAAMrE,0BAA0B;gBAChD6B;gBACA+B,UAAUK;YACZ;YACA,sEAAsE;YACtE,sEAAsE;YACtE,2DAA2D;YAC3DH,MAAMQ,IAAI,CAAC;gBACTV,UAAUK;gBACV3D,KAAK,EAAE+D,8BAAAA,qBAAAA,UAAWE,OAAO,qBAAlBF,mBAAoB/D,KAAK;gBAChCc,KAAK,EAAGiD,8BAAAA,sBAAAA,UAAWE,OAAO,qBAAnB,AAACF,oBACJjD,KAAK;YACX;YACA,MAAMoD,WAAYH,8BAAAA,oBAAAA,UAAWI,MAAM,qBAAlB,AAACJ,kBAA2BT,QAAQ;YACrDK,kBAAkBO,WAAWrD,OAAOqD,YAAYrC;QAClD;QACA,OAAO2B;IACT;IAEA;;;;;;;;;;;;;;;;;;;;GAoBC,GACD;;;;;;;;;;;;;GAaC,GACD;;;;;;;;;;;;;;;GAeC,GACD,MAAMY,eAAelC,QAAQC,GAAG,CAAC;QAC/BoB;QACAtE,cAAc;YAAEsC;QAAO;QACvB,8DAA8D;QAC9D,sEAAsE;QACtE,gCAAgC;QAChCW,QAAQC,GAAG,CAAC;YACV5C,aAAa;gBAAEgC;YAAO;YACtB/B,aAAa;gBAAE+B;YAAO;YACtB9B,aAAa;gBAAE8B;YAAO;YACtBjC,kBAAkB;gBAAEiC;YAAO;SAC5B;KACF;IACD,MAAMC,cAAc,MAAM6B,QAAQ7B,WAAW;IAC7C,MAAM6C,oBAAoB3F,MAAM4F,iBAAiB,CAAC9C;IAClD,MAAM+C,wBAAwBF,kBAAkBR,MAAM,GAClD3E,YAAY;QAAEqC;QAAQiD,MAAMH;IAAkB,KAC9CxC;IACJ,yEAAyE;IACzE,6EAA6E;IAC7E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,yDAAyD;IACzD,MAAM4C,qBAAqB/F,MAAMgG,gBAAgB,CAAClD,eAC9CrC,SAAS;QAAEoC;IAAO,KAClBM;IACJ,wEAAwE;IACxE,sEAAsE;IACtE,MAAM8C,oBAAoBrD,0BACxBC,QACAC,aACA6B,QAAQpD,UAAU;IAEpB,MAAM,CAAC2E,aAAaC,eAAeC,KAAK,GAAG,MAAMV;IACjD,MAAM,CAACW,cAAcC,WAAWC,WAAWC,eAAe,GAAGJ;IAC7D,MAAMK,iBAAiB,MAAMZ;IAC7B,sEAAsE;IACtE,8CAA8C;IAC9C,MAAMa,mBAAmB,MAAM/B,QAAQ+B,gBAAgB;IACvD,MAAMC,uBAAuB,MAAMhC,QAAQgC,oBAAoB;IAE/D,MAAMC,gBAAgB5G,MAAM6G,2BAA2B,CACrDX,aACApD,aACA4D,kBACAC;IAEF,MAAMG,oBAAoB9G,MAAM+G,6BAA6B,CAC3DH,eACAT,cAAca,WAAW;IAE3B;;;;;;;;;;;;;;;;;;;GAmBC,GACD,MAAMC,iBACH,QAAA,MAAMlB,uCAAP,AAAC,MAA2BkB,KAAK,mBAChCjH,MAAMgG,gBAAgB,CAACc,qBACpB,AAAC,CAAA,MAAMrG,SAAS;QAAEoC;IAAO,EAAC,EAAGoE,KAAK,GAClC9D;IACN,MAAM+D,UAAUD,QACZjH,MAAM+G,6BAA6B,CACjCD,mBACAX,cAAca,WAAW,EACzB;QAAChH,MAAMmH,mBAAmB,CAACF;KAAc,IAE3CH;IACJ,wEAAwE;IACxE,0DAA0D;IAC1D,MAAMM,YAAYpH,MAAMqH,wBAAwB,CAC9ChB,cACAC,WACAC;IAEF,mEAAmE;IACnE,sEAAsE;IACtE,+BAA+B;IAC/B,EAAE;IACF,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,oEAAoE;IACpE,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAMe,cAActH,MAAM4F,iBAAiB,CAACsB;IAC5C,MAAMK,oBAAoBD,YAAYE,MAAM,CAC1C,CAACC,MAAQ,CAAC9B,kBAAkB+B,QAAQ,CAACD;IAEvC,MAAME,WAAWJ,kBAAkBpC,MAAM,GACrC,aACKsB,gBACC,MAAMjG,YAAY;QAAEqC;QAAQiD,MAAMyB;IAAkB,MAE1Dd;IACJ,MAAMmB,WAAW5H,MAAM6H,iBAAiB,CAACX,SAAgBS;IACzD,oEAAoE;IACpE,wEAAwE;IACxE,uDAAuD;IACvD,MAAMG,cAAc,MAAM1E,4BACxBP,QACA+E,UACAjD,QAAQpD,UAAU,EAClB0E,mBACAtB,QAAQtB,QAAQ;IAElB,0EAA0E;IAC1E,sEAAsE;IACtE,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,mBAAmB;IACnB,MAAM0E,gBAAgB/H,MAAMgI,yBAAyB,CACnDF,cACAnD,sBAAAA,QAAQpD,UAAU,qBAAlBoD,oBAAoBhC,KAAK,GACzBgC,uBAAAA,QAAQpD,UAAU,qBAAlBoD,qBAAoBhB,UAAU,EAC9BgB,QAAQtB,QAAQ;IAElB,2EAA2E;IAC3E,qEAAqE;IACrE,sEAAsE;IACtE,MAAM4E,kBAAkBjI,MAAMkI,2BAA2B,CACvDH,gBACApD,uBAAAA,QAAQpD,UAAU,qBAAlBoD,qBAAoBhC,KAAK;IAE3B,MAAMwF,QAAQnI,MAAMoI,oBAAoB,CACtCH,iBACAb,WACAd;IAEF,uEAAuE;IACvE,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,MAAM+B,iBAAiBrI,MAAMsI,sBAAsB,CACjDH,OACAxD,QAAQ4D,IAAI;IAEd,0EAA0E;IAC1E,mEAAmE;IACnE,cAAc;IACd,MAAMC,gBAAgBxI,MAAMyI,yBAAyB,CACnDJ,gBACA/B,WACAc;IAEF,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM9F,QAAQtB,MAAM0I,oBAAoB,CAACF,eAAehC;IACxD,wEAAwE;IACxE,MAAMmC,aAAa3I,MAAM4I,kBAAkB,CAACtH,OAAcqD,QAAQkE,MAAM;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,sDAAsD;IACtD,MAAMC,eAAe9I,MAAM+I,qBAAqB,CAACJ;IACjD,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,qEAAqE;IACrE,oBAAoB;IACpB,MAAMK,mBAAmB5H,yBAAyB0H,cAAcjG;IAChE,MAAMoG,eAAejJ,MAAMkJ,MAAM,CAACC,0BAA0B,CAC1DH;IAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBC,GACD,MAAMI,eAAezE,QAAQyE,YAAY;IACzC,MAAMC,WAAWD,eAAejI,gBAAgBiI,aAAaE,MAAM,IAAI,EAAE;IACzE,MAAMC,OAAOrJ,eAAe+I;IAC5B,IAAI,CAACM,KAAKpE,MAAM,IAAI,CAACkE,SAASlE,MAAM,EAAE,OAAO8D;IAC7C,MAAMO,QAAQ,MAAM9I,mBAAmB;QACrCmC;QACA0G,MAAM;eAAIF;eAAaE;SAAK;IAC9B;IACA,IAAIH,cAAc;QAChB,MAAMK,YAAYvI,sBAAsBkI,aAAaE,MAAM,EAAEE;QAC7D,IAAIC,WAAWL,aAAaM,OAAO,CAACD;IACtC;IACA,OAAOxJ,qBAAqBgJ,cAAcO;AAC5C;AAEA;;;;;CAKC,GACD,OAAO,eAAeG,mBAAmBhF,OAiCxC;QAWoBA,MAAAA;IAVnB,MAAM,EAAE9B,MAAM,EAAE+G,QAAQ,EAAEC,MAAM,EAAE,GAAGlF;IAErC,MAAMmF,qBAAqBnF,QAAQoF,SAAS,GACxC,OACA,MAAMzJ,wBAAwB;QAC5BuC;QACAmH,gBAAgB;QAChBC,OAAOL;QACPM,QAAQL;IACV;IACJ,MAAME,aAAapF,QAAAA,qBAAAA,QAAQoF,SAAS,YAAjBpF,qBACjBmF,8BADiBnF,OAEjBkF,OAAOE,SAAS;IAElB;;;;;;;;;;;;;;;;GAgBC,GACD,IAAI,CAACA,WAAW,OAAO;IAEvB,MAAMI,iBAAiBlJ,iBAAiB;QAAE4B;QAAQ+G;QAAUG;IAAU;IAEtE;;;;;;;;;;;GAWC,GACD,MAAMK,WAAW1F,uBAAuB,aAClCC,QAAQtB,QAAQ,GAAG;QAAEA,UAAUsB,QAAQtB,QAAQ;IAAC,IAAI,CAAC;QACzDR;QACA,wEAAwE;QACxE,0EAA0E;QAC1E,qEAAqE;QACrE,uEAAuE;QACvE,kDAAkD;QAClD+B,UAAUuF,eAAeE,IAAI,CAC3B,CAACC,MACCA,IAAI/E,OAAO,IAAI,cAAc+E,IAAI/E,OAAO,GACnC,AAAC+E,IAAI/E,OAAO,CAA8BX,QAAQ,GAGlDiF,OAAOjF,QAAQ,EACtB,IAAMiF,OAAOjF,QAAQ;QAEvB,yEAAyE;QACzE,oEAAoE;QACpE8B,kBAAkByD,eAAeE,IAAI,CACnC,CAACC;gBACEA;oBAAAA,eAAAA,IAAI/E,OAAO,qBAAZ,AAAC+E,aAAsD5D,gBAAgB;WACzE,IAAMvD;QAER,0EAA0E;QAC1E,4DAA4D;QAC5DwD,sBAAsBwD,eAAeE,IAAI,CACvC,CAACC;gBACEA;oBAAAA,eAAAA,IAAI/E,OAAO,qBAAZ,AAAC+E,aACG3D,oBAAoB;WAC1B,IAAMxD;QAERL,aAAaqH,eAAeE,IAAI,CAC9B,CAACC;;gBAASA;4BAAAA,eAAAA,IAAI/E,OAAO,qBAAX+E,aAAahJ,KAAK,mBAAI,CAAC;WACjC,IAAO,CAAA,CAAC,CAAA;QAEVuH,QAAQlE,QAAQkE,MAAM;QACtBtH,YAAYoD,QAAQpD,UAAU;QAC9BgH,MAAM5D,QAAQ4D,IAAI;QAClBa,cAAczE,QAAQyE,YAAY;;IAEpC,KAAKgB,SAASlH,KAAK,CAAC,IAAMC;IAE1B,MAAMoH,aAAa,MAAMJ;IACzB,IAAII,WAAWC,KAAK,IAAI,CAACD,WAAWhF,OAAO,EAAE,OAAO;IAEpD;;;;;;;;;;;;;GAaC,GACD,MAAMjE,QAAQ,MAAM8I;IACpB,MAAMK,SAAS,MAAMrK,iBAAiB;QACpCyC;QACA+G;QACAG;QACAzI;IACF;IACA,IAAImJ,OAAOC,OAAO,KAAK,SAAS;QAC9B,wEAAwE;QACxE,gDAAgD;QAChD,IAAIpJ,SAAS,CAACqD,QAAQoF,SAAS,EAAE;YAC/B,MAAM5J,wBAAwB0C,QAAQ+G,UAAUG;QAClD;QACA,OAAOzI;IACT;IACA,IAAIqD,QAAQgG,kBAAkB,KAAK,OAAO,OAAO;IACjD,MAAMC,WAAW,MAAMvK,kBAAkBwC,QAAQ+G;IACjD,IAAI,CAACgB,YAAYA,aAAab,WAAW,OAAO;IAChD,OAAOJ,mBAAmB,aACrBhF;QACHoF,WAAWa;QACXD,oBAAoB;;AAExB;AAEA,eAAehB,mBAAkB"}

package/src/lib/convert-host-lead.js

@@ -73,8 +73,8 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * nobody chose an owner for — and no rule assigned — stays unowned, which
  * the console renders honestly as unassigned. Either way the caller has
  * already been authorized by its door; nothing here asks again.
- */ import { consentGroupDisclosureKey, consentGroupScope, CRM_COLLECTIONS, crmScopeTokens, DEFAULT_DEAL_STAGES, grantedUnderConsentGroup, nameSearchFields, contactFacetPath, normalizeContactEmail, ORG_SCOPE_TOKEN, readContactFacet, readMarketingBasis, soloConsentGroup } from "@aglyn/aglyn/server";
-import { consentGroupForSite, crmRecordsQuotaForOrg, findContactByEmail, logHostActivity, orgDataCollectionForHost, writeContactCompanyLink } from "@aglyn/tenant-data-admin";
+ */ import { consentGroupDisclosureKey, consentGroupScope, CRM_COLLECTIONS, crmScopeTokens, DEFAULT_DEAL_STAGES, grantedUnderConsentGroup, nameSearchFields, contactFacetPath, normalizeContactEmail, ORG_SCOPE_TOKEN, readContactFacet, crmNewRecordListFields, readMarketingBasis, soloConsentGroup } from "@aglyn/aglyn/server";
+import { consentGroupForSite, crmRecordsQuotaForOrg, findContactByEmail, logHostActivity, orgDataCollectionForHost, restampCrmListFieldsAt, writeContactCompanyLink } from "@aglyn/tenant-data-admin";
 import { FieldPath, FieldValue } from "firebase-admin/firestore";
 import { assignOwnerForCapture, notifyRecordAssigned } from "./assign-contact-owner.js";
 import { captureHostContact } from "./capture-host-contact.js";
@@ -285,6 +285,8 @@ import { handOffLeadRecords } from "./hand-off-lead.js";
             [contactFacetPath(group.groupId, 'ownerUid')]: ownerUid,
             updatedAt: FieldValue.serverTimestamp()
         });
+        // The owner is what the Contacts list filters by (AGL-3321).
+        await restampCrmListFieldsAt(contactRef, 'contacts');
     } else if (ownerUid && pickedOwner && pickedOwner === ownerUid) {
         await notifyRecordAssigned({
             hostId,
@@ -335,7 +337,7 @@ import { handOffLeadRecords } from "./hand-off-lead.js";
                 ok: false,
                 reason: 'band-full'
             };
-            const created = await orgRef.collection(CRM_COLLECTIONS.companies).add(_extends({}, nameSearchFields(createCompany.name), createCompany.domain ? {
+            const company = _extends({}, nameSearchFields(createCompany.name), createCompany.domain ? {
                 domain: createCompany.domain
             } : {}, ownerUid ? {
                 ownerUid
@@ -345,7 +347,8 @@ import { handOffLeadRecords } from "./hand-off-lead.js";
                 createdByUid: actor.uid,
                 createdAt: FieldValue.serverTimestamp(),
                 updatedAt: FieldValue.serverTimestamp()
-            }));
+            });
+            const created = await orgRef.collection(CRM_COLLECTIONS.companies).add(_extends({}, company, crmNewRecordListFields('companies', company)));
             companyId = created.id;
         }
     }
@@ -417,7 +420,7 @@ import { handOffLeadRecords } from "./hand-off-lead.js";
             ok: false,
             reason: 'band-full'
         };
-        const created = await orgRef.collection(CRM_COLLECTIONS.deals).add(_extends({
+        const dealRecord = _extends({
             title: deal.title,
             titleLower: deal.title.toLowerCase(),
             pipelineId,
@@ -440,7 +443,8 @@ import { handOffLeadRecords } from "./hand-off-lead.js";
             createdByUid: actor.uid,
             createdAt: FieldValue.serverTimestamp(),
             updatedAt: FieldValue.serverTimestamp()
-        }));
+        });
+        const created = await orgRef.collection(CRM_COLLECTIONS.deals).add(_extends({}, dealRecord, crmNewRecordListFields('deals', dealRecord)));
         dealId = created.id;
     }
     /*==========================================

package/src/lib/convert-host-lead.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/tenant/runtime/src/lib/convert-host-lead.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * A lead becomes a contact, and optionally a company and a deal (AGL-2608,\n * AGL-2627).\n *\n * ## Why one function under two doors\n *\n * The console's convert dialog posts to the CRM plugin's `crm/lead-convert`\n * route, and an integration posts to `POST /v1/leads/{id}/convert`. The two\n * doors authenticate differently — an ID token against the site's role, an\n * API key against its scopes — and answer in different envelopes, but what\n * they DO has to be one thing: a conversion that opened a second deal for\n * one person because two callers reached the same lead through two\n * implementations is the bug this file exists to make impossible. The doors\n * own their transport; this owns the writes.\n *\n * It lives here, in the tenancy runtime, rather than beside the plugin\n * route it came from, because the console's REST layer may not import a\n * feature plugin (the app→addons boundary), while both the plugin and the\n * console may import the runtime — which already holds the capture door\n * and the owner assignment this conversion goes through.\n *\n * ## Why a server function and not four client writes\n *\n * The lead is a host document the browser may edit, and a company or a deal\n * is a client-creatable org document. What the browser cannot do is CREATE A\n * CONTACT: the contacts collection is written only by `captureHostContact`\n * (the runtime's wrapper over `upsertHostContact`, so `contactCreated`\n * fires), because that function is the dedupe — one human, one row, found by\n * normalized address across every site in the org — and the audience-band\n * gate. A client that wrote a contact document of its own would mint a\n * second row for a person the org already holds, and would do it past the\n * band.\n *\n * Once the contact has to come from the server, the rest follows it: the\n * conversion is one act with four writes, and a caller that made three of\n * them and lost the connection before the fourth leaves a lead marked\n * qualified with no contact, or a deal pointing at a contact that was never\n * stamped on the lead. Here the order is fixed — contact, then company, then\n * deal, then the lead — and the lead is stamped LAST, so a lead that carries\n * `convertedContactId` names a contact that exists.\n *\n * ## Idempotent on the lead\n *\n * A lead already carrying `convertedContactId` answers with the ids it has\n * and creates nothing more. A double-click on the dialog's button, a retry\n * after a slow response, or a Zapier zap replaying a step must not open a\n * second deal for one person.\n *\n * ## The actor\n *\n * A signed-in member converting from the console owns what nobody else\n * claimed: their uid is the owner of last resort, written directly rather\n * than through the deliberate reassignment, because they may be staff\n * converting on a workspace's behalf and a roster check would refuse the one\n * person who is actually here. An API key is not a person and is on no\n * roster, so for an `api` actor that last step is skipped and a contact\n * nobody chose an owner for — and no rule assigned — stays unowned, which\n * the console renders honestly as unassigned. Either way the caller has\n * already been authorized by its door; nothing here asks again.\n */\n\nimport {\n  consentGroupDisclosureKey,\n  consentGroupScope,\n  CRM_COLLECTIONS,\n  type CrmDealStage,\n  type CrmDealStatus,\n  type CrmLeadFields,\n  type CrmPipeline,\n  crmScopeTokens,\n  DEFAULT_DEAL_STAGES,\n  grantedUnderConsentGroup,\n  nameSearchFields,\n  contactFacetPath,\n  normalizeContactEmail,\n  ORG_SCOPE_TOKEN,\n  readContactFacet,\n  readMarketingBasis,\n  soloConsentGroup,\n} from '@aglyn/aglyn/server'\nimport {\n  consentGroupForSite,\n  crmRecordsQuotaForOrg,\n  findContactByEmail,\n  logHostActivity,\n  orgDataCollectionForHost,\n  writeContactCompanyLink,\n} from '@aglyn/tenant-data-admin'\nimport { FieldPath, FieldValue } from 'firebase-admin/firestore'\nimport { assignOwnerForCapture, notifyRecordAssigned } from './assign-contact-owner'\nimport { captureHostContact } from './capture-host-contact'\nimport { handOffLeadRecords } from './hand-off-lead'\n\n/** Who is converting, as far as the writes need to know. */\nexport interface LeadConvertActor {\n  /**\n   * What `createdByUid` records on every record the conversion opens, and\n   * who the audit line names. A member's uid, or the literal `'api'` for a\n   * key — the same attribution the REST creates stamp.\n   */\n  uid: string\n  email?: string | null\n  /**\n   * `member`: a signed-in person, who becomes the owner when nobody else\n   * does. `api`: a key, which cannot own a record — see the header.\n   */\n  kind: 'member' | 'api'\n  /**\n   * For an `api` actor, the key's name — what the audit line attributes the\n   * conversion to, since a key has no address to be named by.\n   */\n  apiKeyName?: string | null\n}\n\n/** What a conversion is asked to do. Validated by the door before it gets here. */\nexport interface ConvertHostLeadInput {\n  firestore: FirebaseFirestore.Firestore\n  hostId: string\n  orgId: string\n  /** The org document, as the door resolved it. */\n  org: Record<string, unknown>\n  /** `hosts/{hostId}/leads/{leadId}` — the document id, which is the person key. */\n  leadId: string\n  actor: LeadConvertActor\n  /**\n   * Who owns the resulting contact (and deal). Defaults to the lead's own\n   * owner; failing that the org's assignment rules and the site's default\n   * owner decide (AGL-2618), and failing those a member actor — somebody\n   * converted this person, and a record with no owner is one nobody follows\n   * up.\n   */\n  ownerUid?: string\n  /** Link an existing `orgs/{orgId}/companies/{companyId}`. */\n  companyId?: string\n  /** Or create one. Ignored when `companyId` is given. Already normalized. */\n  createCompany?: { name: string; domain: string | null } | null\n  /** Open a deal in the org's default pipeline. Already normalized. */\n  deal?: {\n    title: string\n    amountCents: number | null\n    /** Lowercase ISO 4217. */\n    currency: string\n    /** A stage of the default pipeline; its first open stage when absent. */\n    stageId?: string\n  } | null\n}\n\n/**\n * Why a conversion did not happen. Each is a state of the data, not a fault\n * of the request — the door has already refused a malformed body — and each\n * leaves the lead unconverted so a retry after the remedy finds it where it\n * was.\n */\nexport type ConvertHostLeadRefusal =\n  /** No document at `hosts/{hostId}/leads/{leadId}`. */\n  | 'unknown-lead'\n  /** The lead's address cannot become a contact. */\n  | 'no-email'\n  /**\n   * The capture door produced no contact — it swallows its own failures and\n   * drops a creation past a Free org's audience band. Nothing was written.\n   */\n  | 'contact-not-created'\n  /**\n   * The site holds an erasure for the lead's address (AGL-2623): the person\n   * asked to be forgotten, and the capture door refuses to rebuild a record\n   * for them — by a conversion as by a form. Nothing was written, and the\n   * lead stays as it was; the erasure removes it when it runs.\n   */\n  | 'erased'\n  /** The CRM records band is full (AGL-2611); the contact stands, nothing more was opened. */\n  | 'band-full'\n  /** `companyId` names no company in this organization. The contact stands. */\n  | 'unknown-company'\n  /** The default pipeline has no stages to open a deal in. The contact stands. */\n  | 'no-stages'\n\nexport type ConvertHostLeadResult =\n  | {\n      ok: true\n      contactId: string\n      companyId?: string\n      dealId?: string\n      /** The lead was converted before this call; nothing was created now. */\n      alreadyConverted: boolean\n    }\n  | { ok: false; reason: ConvertHostLeadRefusal }\n\n/** The stamp the conversion leaves on the lead — see `CrmLeadFields`. */\ntype LeadConversionStamp = Required<\n  Pick<CrmLeadFields, 'status' | 'convertedContactId' | 'convertedAtMs'>\n> &\n  Pick<CrmLeadFields, 'dealId' | 'companyId' | 'ownerUid'>\n\n/**\n * The stage a new deal opens in.\n *\n * The caller's choice when the pipeline has it, otherwise the first OPEN\n * stage by order — a deal created by converting a lead is by definition not\n * yet won or lost, so defaulting to a closed stage would record an outcome\n * nobody reached. A pipeline with no open stage at all falls back to its\n * first stage rather than refusing: the merchant edited their pipeline into\n * that shape, and a conversion that failed because of it would read as a bug\n * in the lead.\n */\nexport function stageForNewDeal(\n  pipeline: Pick<CrmPipeline, 'stages'>,\n  requestedStageId: string | undefined,\n): CrmDealStage | null {\n  const stages = [...(pipeline.stages ?? [])].sort((a, b) => a.order - b.order)\n  if (!stages.length) return null\n  const requested = requestedStageId\n    ? stages.find((stage) => stage.id === requestedStageId)\n    : undefined\n  return requested ?? stages.find((stage) => stage.kind === 'open') ?? stages[0]\n}\n\n/** A stage's kind as the deal's denormalized status. */\nfunction dealStatusForStage(stage: CrmDealStage): CrmDealStatus {\n  return stage.kind === 'won' ? 'won' : stage.kind === 'lost' ? 'lost' : 'open'\n}\n\n/**\n * Convert one lead. Throws only on infrastructure failure; every refusal\n * the data can produce is a `ConvertHostLeadResult`.\n */\nexport async function convertHostLead(\n  input: ConvertHostLeadInput,\n): Promise<ConvertHostLeadResult> {\n  const { firestore, hostId, orgId, org, leadId, actor, createCompany, deal } = input\n  const requestedCompanyId = String(input.companyId ?? '').trim()\n  // The lead's one home, on the org (AGL-3275). `orgId` is already resolved\n  // by the caller, so this needs no second lookup to find it.\n  const leadRef = firestore\n    .collection('orgs')\n    .doc(orgId)\n    .collection('leads')\n    .doc(leadId)\n  const leadSnapshot = await leadRef.get()\n  if (!leadSnapshot.exists) return { ok: false, reason: 'unknown-lead' }\n  const lead = (leadSnapshot.data() ?? {}) as Record<string, unknown> & CrmLeadFields\n  if (lead.convertedContactId) {\n    return {\n      ok: true,\n      contactId: lead.convertedContactId,\n      ...(lead.companyId ? { companyId: lead.companyId } : {}),\n      ...(lead.dealId ? { dealId: lead.dealId } : {}),\n      alreadyConverted: true,\n    }\n  }\n  const email = normalizeContactEmail(lead['email'])\n  if (!email) return { ok: false, reason: 'no-email' }\n\n  const group = await consentGroupForSite(hostId, org)\n  const visibleTo = crmScopeTokens(org, group)\n  /*\n   * What the CALLER may read, for the company-by-domain reuse below: their\n   * group's own tokens plus `org`, exactly the set the console's listeners\n   * filter on. A company outside it is one they could not open, so linking\n   * a contact to it would point at a record the page then 404s on.\n   */\n  const readableTokens = new Set<string>([\n    ORG_SCOPE_TOKEN,\n    ...consentGroupScope(group),\n  ])\n  /*\n   * THE OWNER A PERSON CHOSE, when one did: the converter's pick, else\n   * whoever was already working the lead. Handed to the capture as the\n   * facet's owner, which is what tells the capture's own assignment pass\n   * to stand down — a person's choice outranks a rule. When nobody chose,\n   * the facet names no owner and the pass runs the org's rules and the\n   * site's default for a contact it creates (AGL-2618).\n   */\n  const pickedOwner = String(input.ownerUid ?? '').trim()\n  const chosenOwner =\n    pickedOwner || (typeof lead.ownerUid === 'string' ? lead.ownerUid : '')\n  const now = Date.now()\n  const leadName = typeof lead['name'] === 'string' ? lead['name'] : undefined\n\n  /*==========================================\n   * 1. THE CONTACT — through the one door that dedupes and meters.\n   *\n   * `source: 'manual'` because a person converted this lead by hand, and\n   * the source filter should say so; the interaction names the lead so the\n   * contact's timeline can be walked back to what was captured. The facet\n   * carries the stage and the owner, which is what makes this a sales\n   * record rather than another form capture.\n   *\n   * THE LEAD'S OWN PROFILE TRAVELS WITH IT (AGL-3233), the way Salesforce\n   * hands a lead's fields to the contact: phone, title, lead source, address, the\n   * company as text (until step 2 links a record, whose own name then\n   * replaces it), tags, and the marketing basis the lead recorded — the\n   * person ticked the box on the lead, and a conversion must not be the\n   * moment they lose it. Only what the lead holds is handed over; a value\n   * the contact already carries is the contact's, because the capture door\n   * writes a profile field only where the facet has none.\n   *=========================================*/\n  const leadTags = Array.isArray(lead.tags) ? lead.tags.map(String) : []\n  const leadConsent = readMarketingBasis(lead, soloConsentGroup(hostId))\n  /*\n   * WHICH SITES THE CONTACT'S GRANT COVERS (AGL-3320): the lead's, never\n   * more. The capture door records a fresh grant, so it is handed the group's\n   * disclosure key only when the lead ALREADY holds a grant given under the\n   * group as it stands, at every site it names — a lead captured by one site\n   * before the group existed, or before a site joined, converts to a contact\n   * that site alone may mail, exactly as the lead was.\n   */\n  const leadDisclosure = grantedUnderConsentGroup(lead, group)\n    ? consentGroupDisclosureKey(group)\n    : null\n  const captured = await captureHostContact({\n    hostId,\n    email,\n    ...(leadName ? { name: leadName } : {}),\n    source: 'manual',\n    interaction: { summary: 'Converted from a lead', refId: leadId },\n    ...(leadConsent.basis === 'granted' ? { marketingConsent: true } : {}),\n    ...(leadConsent.basis === 'granted' && leadDisclosure\n      ? { disclosedConsentGroup: leadDisclosure }\n      : {}),\n    ...(leadTags.length ? { tags: leadTags } : {}),\n    facet: {\n      lifecycleStage: 'sales-qualified',\n      ...(chosenOwner ? { ownerUid: chosenOwner } : {}),\n      ...(typeof lead.phone === 'string' && lead.phone ? { phone: lead.phone } : {}),\n      ...(typeof lead.jobTitle === 'string' && lead.jobTitle ? { jobTitle: lead.jobTitle } : {}),\n      // Salesforce's Lead Source travels to the contact (AGL-3298).\n      ...(typeof lead.leadSource === 'string' && lead.leadSource\n        ? { leadSource: lead.leadSource }\n        : {}),\n      ...(lead.address && typeof lead.address === 'object' ? { address: lead.address } : {}),\n      ...(typeof lead.company === 'string' && lead.company\n        ? { companyName: lead.company }\n        : {}),\n    },\n  })\n  /*\n   * The one verdict of the door's that is named here. Its other refusals —\n   * the band, an address it will not take, its own swallowed error — all\n   * read the same from this side: no row to find below, answered as\n   * `contact-not-created`. An erasure is different in kind: not a limit the\n   * org can lift or a fault in the request but a decision the workspace made\n   * about this person, and a caller told \"the band may be full\" would retry\n   * against it forever.\n   */\n  if (captured && 'refused' in captured && captured.refused === 'erased') {\n    return { ok: false, reason: 'erased' }\n  }\n  const contactsRef = await orgDataCollectionForHost(hostId, 'contacts')\n  /*\n   * The same resolution the capture door just made (AGL-2625): the\n   * address index first, so a lead whose address is an ALTERNATE on a\n   * merged contact converts into the survivor the capture landed on\n   * rather than reading as a contact the band dropped.\n   */\n  const contactSnapshot = await findContactByEmail(contactsRef, email)\n  if (!contactSnapshot) return { ok: false, reason: 'contact-not-created' }\n  const contactRef = contactSnapshot.ref\n  const contactId = contactSnapshot.id\n  const contactData = (contactSnapshot.data() ?? {}) as Record<string, unknown>\n  const orgRef = firestore.collection('orgs').doc(orgId)\n  /*\n   * THE RECORDS BAND (AGL-2611), asked before each record this conversion\n   * CREATES. The contact went through the capture door, which refuses at\n   * the band on its own; a company and a deal are records of the same\n   * band, and on a Free org at its hundred the honest answer is the one\n   * the drawers give — refuse, write nothing more, and leave the lead\n   * unconverted so a retry after the upgrade finds it where it was. The\n   * contact step 1 captured stays: it is one person's record, and a second\n   * conversion merges onto it rather than making another. Measured fresh\n   * each time because the company created in step 2 is itself a record.\n   */\n  const bandFull = async () => {\n    const room = await crmRecordsQuotaForOrg(org as never, orgRef)\n    return !room.allowed\n  }\n\n  /*\n   * WHOSE THE CONTACT IS, now that it exists. The capture wrote the chosen\n   * owner, or its pass assigned one to a contact it created; a contact\n   * the org already held with no owner has had neither, so the same pass\n   * is asked once more — it touches only a record with no owner and\n   * answers `unchanged` for one that has — and a member actor is the last\n   * resort. A colleague the converter picked is told; the lead's existing\n   * owner and the caller are not, having chosen for themselves.\n   */\n  let ownerUid = readContactFacet(contactData, group.groupId).ownerUid ?? ''\n  if (!ownerUid) {\n    const assigned = await assignOwnerForCapture({\n      hostId,\n      contactId,\n      email,\n      source: 'manual',\n      actorUid: actor.kind === 'member' ? actor.uid : null,\n    })\n    if (assigned.outcome !== 'none') ownerUid = assigned.ownerUid\n  }\n  if (!ownerUid && actor.kind === 'member') {\n    ownerUid = actor.uid\n    await contactRef.update({\n      [contactFacetPath(group.groupId, 'ownerUid')]: ownerUid,\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n  } else if (ownerUid && pickedOwner && pickedOwner === ownerUid) {\n    await notifyRecordAssigned({\n      hostId,\n      orgId,\n      ownerUid,\n      actorUid: actor.kind === 'member' ? actor.uid : null,\n      record: { kind: 'contact', id: contactId },\n      who: leadName || email,\n    })\n  }\n\n  /*==========================================\n   * 2. THE COMPANY — linked, found by domain, or created.\n   *=========================================*/\n  let companyId: string | undefined\n  if (requestedCompanyId) {\n    const companySnapshot = await orgRef\n      .collection(CRM_COLLECTIONS.companies)\n      .doc(requestedCompanyId)\n      .get()\n    if (!companySnapshot.exists) return { ok: false, reason: 'unknown-company' }\n    companyId = requestedCompanyId\n  } else if (createCompany) {\n    /*\n     * FIND BEFORE CREATE. The NAME first (AGL-3233): a lead names its\n     * company as text, and a company the org already files under that\n     * name is the account, whatever domain it carries. Then the domain,\n     * the key two contacts at one business share — a second company\n     * document for `acme.com` would split the account the key exists to\n     * join. Only a company the caller can see counts as found — see\n     * `readableTokens`.\n     */\n    const visibleAmong = (\n      snapshots: readonly FirebaseFirestore.QueryDocumentSnapshot[],\n    ): string | undefined =>\n      snapshots.find((snapshot) => {\n        const tokens = snapshot.get('visibleTo')\n        return (\n          Array.isArray(tokens) &&\n          tokens.some((token) => readableTokens.has(String(token)))\n        )\n      })?.id\n    const byName = await orgRef\n      .collection(CRM_COLLECTIONS.companies)\n      .where('nameLower', '==', createCompany.name.toLowerCase())\n      .limit(5)\n      .get()\n    companyId = visibleAmong(byName.docs)\n    if (!companyId && createCompany.domain) {\n      const byDomain = await orgRef\n        .collection(CRM_COLLECTIONS.companies)\n        .where('domain', '==', createCompany.domain)\n        .limit(5)\n        .get()\n      companyId = visibleAmong(byDomain.docs)\n    }\n    if (!companyId) {\n      if (await bandFull()) return { ok: false, reason: 'band-full' }\n      const created = await orgRef.collection(CRM_COLLECTIONS.companies).add({\n        ...nameSearchFields(createCompany.name),\n        ...(createCompany.domain ? { domain: createCompany.domain } : {}),\n        ...(ownerUid ? { ownerUid } : {}),\n        visibleTo,\n        hostId,\n        createdByUid: actor.uid,\n        createdAt: FieldValue.serverTimestamp(),\n        updatedAt: FieldValue.serverTimestamp(),\n      })\n      companyId = created.id\n    }\n  }\n  if (companyId) {\n    /*\n     * The one link writer (AGL-2613): the holder's facet field the contact\n     * record reads, the queryable top-level mirror the company's contacts\n     * card filters on, and the company's contacts count — planned from\n     * the row as the capture left it, so a person the org already held\n     * under another company is MOVED rather than counted twice.\n     */\n    await writeContactCompanyLink({\n      firestore,\n      contactRef,\n      contact: contactData,\n      companiesRef: orgRef.collection(CRM_COLLECTIONS.companies),\n      groupId: group.groupId,\n      companyId,\n    })\n  }\n\n  /*==========================================\n   * 3. THE DEAL — in the default pipeline, seeded if the org has none.\n   *=========================================*/\n  let dealId: string | undefined\n  if (deal) {\n    const pipelinesRef = orgRef.collection(CRM_COLLECTIONS.pipelines)\n    let pipelineId: string\n    let pipeline: Pick<CrmPipeline, 'stages'>\n    const defaults = await pipelinesRef\n      .where('isDefault', '==', true)\n      .limit(1)\n      .get()\n    if (!defaults.empty) {\n      pipelineId = defaults.docs[0].id\n      pipeline = defaults.docs[0].data() as CrmPipeline\n    } else {\n      /*\n       * The deals section's own read shape, so the two agree on which\n       * pipeline \"the org's pipeline\" is when none is flagged default: the\n       * first by document id of a bounded window. Seeding a SECOND pipeline\n       * here while one exists unflagged would leave the merchant with two\n       * boards and their deals split between them.\n       */\n      const any = await pipelinesRef\n        .orderBy(FieldPath.documentId())\n        .limit(20)\n        .get()\n      if (!any.empty) {\n        pipelineId = any.docs[0].id\n        pipeline = any.docs[0].data() as CrmPipeline\n      } else {\n        // Exactly what the Deals section seeds: one `Sales` pipeline\n        // carrying a COPY of the default stages, flagged default.\n        const seeded: Omit<CrmPipeline, 'createdAt' | 'updatedAt'> = {\n          name: 'Sales',\n          stages: [...DEFAULT_DEAL_STAGES],\n          isDefault: true,\n          visibleTo,\n          hostId,\n        }\n        const created = await pipelinesRef.add({\n          ...seeded,\n          createdByUid: actor.uid,\n          createdAt: FieldValue.serverTimestamp(),\n          updatedAt: FieldValue.serverTimestamp(),\n        })\n        pipelineId = created.id\n        pipeline = seeded\n      }\n    }\n    const stage = stageForNewDeal(pipeline, deal.stageId)\n    if (!stage) return { ok: false, reason: 'no-stages' }\n    if (await bandFull()) return { ok: false, reason: 'band-full' }\n    const created = await orgRef.collection(CRM_COLLECTIONS.deals).add({\n      title: deal.title,\n      titleLower: deal.title.toLowerCase(),\n      pipelineId,\n      stageId: stage.id,\n      status: dealStatusForStage(stage),\n      ...(deal.amountCents !== null ? { amountCents: deal.amountCents } : {}),\n      currency: deal.currency,\n      stageChangedAtMs: now,\n      ...(ownerUid ? { ownerUid } : {}),\n      contactId,\n      ...(companyId ? { companyId } : {}),\n      visibleTo,\n      hostId,\n      createdByUid: actor.uid,\n      createdAt: FieldValue.serverTimestamp(),\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n    dealId = created.id\n  }\n\n  /*==========================================\n   * 4. THE LEAD — stamped last, once everything it names exists.\n   *=========================================*/\n  const stamp: LeadConversionStamp = {\n    status: 'qualified',\n    convertedContactId: contactId,\n    convertedAtMs: now,\n    ...(ownerUid ? { ownerUid } : {}),\n    ...(companyId ? { companyId } : {}),\n    ...(dealId ? { dealId } : {}),\n  }\n  await leadRef.update({ ...stamp, updatedAt: FieldValue.serverTimestamp() })\n\n  /*\n   * WHAT THE LEAD HANDS OVER (AGL-3233): its activities and tasks gain the\n   * contact, and every plugin with a listener — Sequences, for an\n   * enrollment naming the lead — re-points its own records. After the\n   * stamp, so a listener reading the lead finds the conversion on it; it\n   * never throws.\n   */\n  await handOffLeadRecords({\n    firestore,\n    orgId,\n    hostId,\n    leadId,\n    contactId,\n    email,\n    by: actor.kind === 'member' ? 'member' : 'api',\n  })\n\n  /*\n   * The audit line, from the function that did the work (AGL-2622): the\n   * conversion is one act however many records it opened, so it is one\n   * entry, on the lead, in the feed of the site that holds the lead. A\n   * repeat call answered above with the ids it already had wrote nothing\n   * and logs nothing.\n   */\n  await logHostActivity(\n    hostId,\n    {\n      uid: actor.uid,\n      email: actor.email ?? null,\n      ...(actor.apiKeyName ? { apiKeyName: actor.apiKeyName } : {}),\n    },\n    'Converted lead',\n    { type: 'lead', id: leadId, name: String(lead['name'] ?? '') || email },\n  )\n\n  return {\n    ok: true,\n    contactId,\n    ...(companyId ? { companyId } : {}),\n    ...(dealId ? { dealId } : {}),\n    alreadyConverted: false,\n  }\n}\n"],"names":["consentGroupDisclosureKey","consentGroupScope","CRM_COLLECTIONS","crmScopeTokens","DEFAULT_DEAL_STAGES","grantedUnderConsentGroup","nameSearchFields","contactFacetPath","normalizeContactEmail","ORG_SCOPE_TOKEN","readContactFacet","readMarketingBasis","soloConsentGroup","consentGroupForSite","crmRecordsQuotaForOrg","findContactByEmail","logHostActivity","orgDataCollectionForHost","writeContactCompanyLink","FieldPath","FieldValue","assignOwnerForCapture","notifyRecordAssigned","captureHostContact","handOffLeadRecords","stageForNewDeal","pipeline","requestedStageId","requested","stages","sort","a","b","order","length","find","stage","id","undefined","kind","dealStatusForStage","convertHostLead","input","leadSnapshot","contactSnapshot","actor","lead","firestore","hostId","orgId","org","leadId","createCompany","deal","requestedCompanyId","String","companyId","trim","leadRef","collection","doc","get","exists","ok","reason","data","convertedContactId","contactId","dealId","alreadyConverted","email","group","visibleTo","readableTokens","Set","pickedOwner","ownerUid","chosenOwner","now","Date","leadName","leadTags","Array","isArray","tags","map","leadConsent","leadDisclosure","captured","name","source","interaction","summary","refId","basis","marketingConsent","disclosedConsentGroup","facet","lifecycleStage","phone","jobTitle","leadSource","address","company","companyName","refused","contactsRef","contactRef","ref","contactData","orgRef","bandFull","room","allowed","groupId","assigned","actorUid","uid","outcome","update","updatedAt","serverTimestamp","record","who","companySnapshot","companies","visibleAmong","snapshots","snapshot","tokens","some","token","has","byName","where","toLowerCase","limit","docs","domain","byDomain","created","add","createdByUid","createdAt","contact","companiesRef","pipelinesRef","pipelines","pipelineId","defaults","empty","any","orderBy","documentId","seeded","isDefault","stageId","deals","title","titleLower","status","amountCents","currency","stageChangedAtMs","stamp","convertedAtMs","by","apiKeyName","type"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2DC,GAED,SACEA,yBAAyB,EACzBC,iBAAiB,EACjBC,eAAe,EAKfC,cAAc,EACdC,mBAAmB,EACnBC,wBAAwB,EACxBC,gBAAgB,EAChBC,gBAAgB,EAChBC,qBAAqB,EACrBC,eAAe,EACfC,gBAAgB,EAChBC,kBAAkB,EAClBC,gBAAgB,QACX,sBAAqB;AAC5B,SACEC,mBAAmB,EACnBC,qBAAqB,EACrBC,kBAAkB,EAClBC,eAAe,EACfC,wBAAwB,EACxBC,uBAAuB,QAClB,2BAA0B;AACjC,SAASC,SAAS,EAAEC,UAAU,QAAQ,2BAA0B;AAChE,SAASC,qBAAqB,EAAEC,oBAAoB,QAAQ,4BAAwB;AACpF,SAASC,kBAAkB,QAAQ,4BAAwB;AAC3D,SAASC,kBAAkB,QAAQ,qBAAiB;AAuGpD;;;;;;;;;;CAUC,GACD,OAAO,SAASC,gBACdC,QAAqC,EACrCC,gBAAoC;QAEhBD,kBAKbE;IALP,MAAMC,SAAS;YAAKH,mBAAAA,SAASG,MAAM,YAAfH,mBAAmB,EAAE;KAAE,CAACI,IAAI,CAAC,CAACC,GAAGC,IAAMD,EAAEE,KAAK,GAAGD,EAAEC,KAAK;IAC5E,IAAI,CAACJ,OAAOK,MAAM,EAAE,OAAO;IAC3B,MAAMN,YAAYD,mBACdE,OAAOM,IAAI,CAAC,CAACC,QAAUA,MAAMC,EAAE,KAAKV,oBACpCW;IACJ,QAAOV,OAAAA,oBAAAA,YAAaC,OAAOM,IAAI,CAAC,CAACC,QAAUA,MAAMG,IAAI,KAAK,mBAAnDX,OAA8DC,MAAM,CAAC,EAAE;AAChF;AAEA,sDAAsD,GACtD,SAASW,mBAAmBJ,KAAmB;IAC7C,OAAOA,MAAMG,IAAI,KAAK,QAAQ,QAAQH,MAAMG,IAAI,KAAK,SAAS,SAAS;AACzE;AAEA;;;CAGC,GACD,OAAO,eAAeE,gBACpBC,KAA2B;QAGOA,kBAUpBC,oBAiCaD,iBAsFNE,uBA2BNlC,4BA6NJmC,cAIgCC;IA9X3C,MAAM,EAAEC,SAAS,EAAEC,MAAM,EAAEC,KAAK,EAAEC,GAAG,EAAEC,MAAM,EAAEN,KAAK,EAAEO,aAAa,EAAEC,IAAI,EAAE,GAAGX;IAC9E,MAAMY,qBAAqBC,QAAOb,mBAAAA,MAAMc,SAAS,YAAfd,mBAAmB,IAAIe,IAAI;IAC7D,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAMC,UAAUX,UACbY,UAAU,CAAC,QACXC,GAAG,CAACX,OACJU,UAAU,CAAC,SACXC,GAAG,CAACT;IACP,MAAMR,eAAe,MAAMe,QAAQG,GAAG;IACtC,IAAI,CAAClB,aAAamB,MAAM,EAAE,OAAO;QAAEC,IAAI;QAAOC,QAAQ;IAAe;IACrE,MAAMlB,QAAQH,qBAAAA,aAAasB,IAAI,cAAjBtB,qBAAuB,CAAC;IACtC,IAAIG,KAAKoB,kBAAkB,EAAE;QAC3B,OAAO;YACLH,IAAI;YACJI,WAAWrB,KAAKoB,kBAAkB;WAC9BpB,KAAKU,SAAS,GAAG;YAAEA,WAAWV,KAAKU,SAAS;QAAC,IAAI,CAAC,GAClDV,KAAKsB,MAAM,GAAG;YAAEA,QAAQtB,KAAKsB,MAAM;QAAC,IAAI,CAAC;YAC7CC,kBAAkB;;IAEtB;IACA,MAAMC,QAAQ9D,sBAAsBsC,IAAI,CAAC,QAAQ;IACjD,IAAI,CAACwB,OAAO,OAAO;QAAEP,IAAI;QAAOC,QAAQ;IAAW;IAEnD,MAAMO,QAAQ,MAAM1D,oBAAoBmC,QAAQE;IAChD,MAAMsB,YAAYrE,eAAe+C,KAAKqB;IACtC;;;;;GAKC,GACD,MAAME,iBAAiB,IAAIC,IAAY;QACrCjE;WACGR,kBAAkBsE;KACtB;IACD;;;;;;;GAOC,GACD,MAAMI,cAAcpB,QAAOb,kBAAAA,MAAMkC,QAAQ,YAAdlC,kBAAkB,IAAIe,IAAI;IACrD,MAAMoB,cACJF,eAAgB,CAAA,OAAO7B,KAAK8B,QAAQ,KAAK,WAAW9B,KAAK8B,QAAQ,GAAG,EAAC;IACvE,MAAME,MAAMC,KAAKD,GAAG;IACpB,MAAME,WAAW,OAAOlC,IAAI,CAAC,OAAO,KAAK,WAAWA,IAAI,CAAC,OAAO,GAAGR;IAEnE;;;;;;;;;;;;;;;;;6CAiB2C,GAC3C,MAAM2C,WAAWC,MAAMC,OAAO,CAACrC,KAAKsC,IAAI,IAAItC,KAAKsC,IAAI,CAACC,GAAG,CAAC9B,UAAU,EAAE;IACtE,MAAM+B,cAAc3E,mBAAmBmC,MAAMlC,iBAAiBoC;IAC9D;;;;;;;GAOC,GACD,MAAMuC,iBAAiBlF,yBAAyByC,MAAMyB,SAClDvE,0BAA0BuE,SAC1B;IACJ,MAAMiB,WAAW,MAAMjE,mBAAmB;QACxCyB;QACAsB;OACIU,WAAW;QAAES,MAAMT;IAAS,IAAI,CAAC;QACrCU,QAAQ;QACRC,aAAa;YAAEC,SAAS;YAAyBC,OAAO1C;QAAO;OAC3DmC,YAAYQ,KAAK,KAAK,YAAY;QAAEC,kBAAkB;IAAK,IAAI,CAAC,GAChET,YAAYQ,KAAK,KAAK,aAAaP,iBACnC;QAAES,uBAAuBT;IAAe,IACxC,CAAC,GACDN,SAAS/C,MAAM,GAAG;QAAEkD,MAAMH;IAAS,IAAI,CAAC;QAC5CgB,OAAO;YACLC,gBAAgB;WACZrB,cAAc;YAAED,UAAUC;QAAY,IAAI,CAAC,GAC3C,OAAO/B,KAAKqD,KAAK,KAAK,YAAYrD,KAAKqD,KAAK,GAAG;YAAEA,OAAOrD,KAAKqD,KAAK;QAAC,IAAI,CAAC,GACxE,OAAOrD,KAAKsD,QAAQ,KAAK,YAAYtD,KAAKsD,QAAQ,GAAG;YAAEA,UAAUtD,KAAKsD,QAAQ;QAAC,IAAI,CAAC,GAEpF,OAAOtD,KAAKuD,UAAU,KAAK,YAAYvD,KAAKuD,UAAU,GACtD;YAAEA,YAAYvD,KAAKuD,UAAU;QAAC,IAC9B,CAAC,GACDvD,KAAKwD,OAAO,IAAI,OAAOxD,KAAKwD,OAAO,KAAK,WAAW;YAAEA,SAASxD,KAAKwD,OAAO;QAAC,IAAI,CAAC,GAChF,OAAOxD,KAAKyD,OAAO,KAAK,YAAYzD,KAAKyD,OAAO,GAChD;YAAEC,aAAa1D,KAAKyD,OAAO;QAAC,IAC5B,CAAC;;IAGT;;;;;;;;GAQC,GACD,IAAIf,YAAY,aAAaA,YAAYA,SAASiB,OAAO,KAAK,UAAU;QACtE,OAAO;YAAE1C,IAAI;YAAOC,QAAQ;QAAS;IACvC;IACA,MAAM0C,cAAc,MAAMzF,yBAAyB+B,QAAQ;IAC3D;;;;;GAKC,GACD,MAAMJ,kBAAkB,MAAM7B,mBAAmB2F,aAAapC;IAC9D,IAAI,CAAC1B,iBAAiB,OAAO;QAAEmB,IAAI;QAAOC,QAAQ;IAAsB;IACxE,MAAM2C,aAAa/D,gBAAgBgE,GAAG;IACtC,MAAMzC,YAAYvB,gBAAgBP,EAAE;IACpC,MAAMwE,eAAejE,wBAAAA,gBAAgBqB,IAAI,cAApBrB,wBAA0B,CAAC;IAChD,MAAMkE,SAAS/D,UAAUY,UAAU,CAAC,QAAQC,GAAG,CAACX;IAChD;;;;;;;;;;GAUC,GACD,MAAM8D,WAAW;QACf,MAAMC,OAAO,MAAMlG,sBAAsBoC,KAAc4D;QACvD,OAAO,CAACE,KAAKC,OAAO;IACtB;IAEA;;;;;;;;GAQC,GACD,IAAIrC,YAAWlE,6BAAAA,iBAAiBmG,aAAatC,MAAM2C,OAAO,EAAEtC,QAAQ,YAArDlE,6BAAyD;IACxE,IAAI,CAACkE,UAAU;QACb,MAAMuC,WAAW,MAAM9F,sBAAsB;YAC3C2B;YACAmB;YACAG;YACAoB,QAAQ;YACR0B,UAAUvE,MAAMN,IAAI,KAAK,WAAWM,MAAMwE,GAAG,GAAG;QAClD;QACA,IAAIF,SAASG,OAAO,KAAK,QAAQ1C,WAAWuC,SAASvC,QAAQ;IAC/D;IACA,IAAI,CAACA,YAAY/B,MAAMN,IAAI,KAAK,UAAU;QACxCqC,WAAW/B,MAAMwE,GAAG;QACpB,MAAMV,WAAWY,MAAM,CAAC;YACtB,CAAChH,iBAAiBgE,MAAM2C,OAAO,EAAE,YAAY,EAAEtC;YAC/C4C,WAAWpG,WAAWqG,eAAe;QACvC;IACF,OAAO,IAAI7C,YAAYD,eAAeA,gBAAgBC,UAAU;QAC9D,MAAMtD,qBAAqB;YACzB0B;YACAC;YACA2B;YACAwC,UAAUvE,MAAMN,IAAI,KAAK,WAAWM,MAAMwE,GAAG,GAAG;YAChDK,QAAQ;gBAAEnF,MAAM;gBAAWF,IAAI8B;YAAU;YACzCwD,KAAK3C,YAAYV;QACnB;IACF;IAEA;;6CAE2C,GAC3C,IAAId;IACJ,IAAIF,oBAAoB;QACtB,MAAMsE,kBAAkB,MAAMd,OAC3BnD,UAAU,CAACzD,gBAAgB2H,SAAS,EACpCjE,GAAG,CAACN,oBACJO,GAAG;QACN,IAAI,CAAC+D,gBAAgB9D,MAAM,EAAE,OAAO;YAAEC,IAAI;YAAOC,QAAQ;QAAkB;QAC3ER,YAAYF;IACd,OAAO,IAAIF,eAAe;QACxB;;;;;;;;KAQC,GACD,MAAM0E,eAAe,CACnBC;gBAEAA;oBAAAA,kBAAAA,UAAU5F,IAAI,CAAC,CAAC6F;gBACd,MAAMC,SAASD,SAASnE,GAAG,CAAC;gBAC5B,OACEqB,MAAMC,OAAO,CAAC8C,WACdA,OAAOC,IAAI,CAAC,CAACC,QAAU1D,eAAe2D,GAAG,CAAC7E,OAAO4E;YAErD,uBANAJ,gBAMI1F,EAAE;;QACR,MAAMgG,SAAS,MAAMvB,OAClBnD,UAAU,CAACzD,gBAAgB2H,SAAS,EACpCS,KAAK,CAAC,aAAa,MAAMlF,cAAcqC,IAAI,CAAC8C,WAAW,IACvDC,KAAK,CAAC,GACN3E,GAAG;QACNL,YAAYsE,aAAaO,OAAOI,IAAI;QACpC,IAAI,CAACjF,aAAaJ,cAAcsF,MAAM,EAAE;YACtC,MAAMC,WAAW,MAAM7B,OACpBnD,UAAU,CAACzD,gBAAgB2H,SAAS,EACpCS,KAAK,CAAC,UAAU,MAAMlF,cAAcsF,MAAM,EAC1CF,KAAK,CAAC,GACN3E,GAAG;YACNL,YAAYsE,aAAaa,SAASF,IAAI;QACxC;QACA,IAAI,CAACjF,WAAW;YACd,IAAI,MAAMuD,YAAY,OAAO;gBAAEhD,IAAI;gBAAOC,QAAQ;YAAY;YAC9D,MAAM4E,UAAU,MAAM9B,OAAOnD,UAAU,CAACzD,gBAAgB2H,SAAS,EAAEgB,GAAG,CAAC,aAClEvI,iBAAiB8C,cAAcqC,IAAI,GAClCrC,cAAcsF,MAAM,GAAG;gBAAEA,QAAQtF,cAAcsF,MAAM;YAAC,IAAI,CAAC,GAC3D9D,WAAW;gBAAEA;YAAS,IAAI,CAAC;gBAC/BJ;gBACAxB;gBACA8F,cAAcjG,MAAMwE,GAAG;gBACvB0B,WAAW3H,WAAWqG,eAAe;gBACrCD,WAAWpG,WAAWqG,eAAe;;YAEvCjE,YAAYoF,QAAQvG,EAAE;QACxB;IACF;IACA,IAAImB,WAAW;QACb;;;;;;KAMC,GACD,MAAMtC,wBAAwB;YAC5B6B;YACA4D;YACAqC,SAASnC;YACToC,cAAcnC,OAAOnD,UAAU,CAACzD,gBAAgB2H,SAAS;YACzDX,SAAS3C,MAAM2C,OAAO;YACtB1D;QACF;IACF;IAEA;;6CAE2C,GAC3C,IAAIY;IACJ,IAAIf,MAAM;QACR,MAAM6F,eAAepC,OAAOnD,UAAU,CAACzD,gBAAgBiJ,SAAS;QAChE,IAAIC;QACJ,IAAI1H;QACJ,MAAM2H,WAAW,MAAMH,aACpBZ,KAAK,CAAC,aAAa,MAAM,MACzBE,KAAK,CAAC,GACN3E,GAAG;QACN,IAAI,CAACwF,SAASC,KAAK,EAAE;YACnBF,aAAaC,SAASZ,IAAI,CAAC,EAAE,CAACpG,EAAE;YAChCX,WAAW2H,SAASZ,IAAI,CAAC,EAAE,CAACxE,IAAI;QAClC,OAAO;YACL;;;;;;OAMC,GACD,MAAMsF,MAAM,MAAML,aACfM,OAAO,CAACrI,UAAUsI,UAAU,IAC5BjB,KAAK,CAAC,IACN3E,GAAG;YACN,IAAI,CAAC0F,IAAID,KAAK,EAAE;gBACdF,aAAaG,IAAId,IAAI,CAAC,EAAE,CAACpG,EAAE;gBAC3BX,WAAW6H,IAAId,IAAI,CAAC,EAAE,CAACxE,IAAI;YAC7B,OAAO;gBACL,6DAA6D;gBAC7D,0DAA0D;gBAC1D,MAAMyF,SAAuD;oBAC3DjE,MAAM;oBACN5D,QAAQ;2BAAIzB;qBAAoB;oBAChCuJ,WAAW;oBACXnF;oBACAxB;gBACF;gBACA,MAAM4F,UAAU,MAAMM,aAAaL,GAAG,CAAC,aAClCa;oBACHZ,cAAcjG,MAAMwE,GAAG;oBACvB0B,WAAW3H,WAAWqG,eAAe;oBACrCD,WAAWpG,WAAWqG,eAAe;;gBAEvC2B,aAAaR,QAAQvG,EAAE;gBACvBX,WAAWgI;YACb;QACF;QACA,MAAMtH,QAAQX,gBAAgBC,UAAU2B,KAAKuG,OAAO;QACpD,IAAI,CAACxH,OAAO,OAAO;YAAE2B,IAAI;YAAOC,QAAQ;QAAY;QACpD,IAAI,MAAM+C,YAAY,OAAO;YAAEhD,IAAI;YAAOC,QAAQ;QAAY;QAC9D,MAAM4E,UAAU,MAAM9B,OAAOnD,UAAU,CAACzD,gBAAgB2J,KAAK,EAAEhB,GAAG,CAAC;YACjEiB,OAAOzG,KAAKyG,KAAK;YACjBC,YAAY1G,KAAKyG,KAAK,CAACvB,WAAW;YAClCa;YACAQ,SAASxH,MAAMC,EAAE;YACjB2H,QAAQxH,mBAAmBJ;WACvBiB,KAAK4G,WAAW,KAAK,OAAO;YAAEA,aAAa5G,KAAK4G,WAAW;QAAC,IAAI,CAAC;YACrEC,UAAU7G,KAAK6G,QAAQ;YACvBC,kBAAkBrF;WACdF,WAAW;YAAEA;QAAS,IAAI,CAAC;YAC/BT;WACIX,YAAY;YAAEA;QAAU,IAAI,CAAC;YACjCgB;YACAxB;YACA8F,cAAcjG,MAAMwE,GAAG;YACvB0B,WAAW3H,WAAWqG,eAAe;YACrCD,WAAWpG,WAAWqG,eAAe;;QAEvCrD,SAASwE,QAAQvG,EAAE;IACrB;IAEA;;6CAE2C,GAC3C,MAAM+H,QAA6B;QACjCJ,QAAQ;QACR9F,oBAAoBC;QACpBkG,eAAevF;OACXF,WAAW;QAAEA;IAAS,IAAI,CAAC,GAC3BpB,YAAY;QAAEA;IAAU,IAAI,CAAC,GAC7BY,SAAS;QAAEA;IAAO,IAAI,CAAC;IAE7B,MAAMV,QAAQ6D,MAAM,CAAC,aAAK6C;QAAO5C,WAAWpG,WAAWqG,eAAe;;IAEtE;;;;;;GAMC,GACD,MAAMjG,mBAAmB;QACvBuB;QACAE;QACAD;QACAG;QACAgB;QACAG;QACAgG,IAAIzH,MAAMN,IAAI,KAAK,WAAW,WAAW;IAC3C;IAEA;;;;;;GAMC,GACD,MAAMvB,gBACJgC,QACA;QACEqE,KAAKxE,MAAMwE,GAAG;QACd/C,KAAK,GAAEzB,eAAAA,MAAMyB,KAAK,YAAXzB,eAAe;OAClBA,MAAM0H,UAAU,GAAG;QAAEA,YAAY1H,MAAM0H,UAAU;IAAC,IAAI,CAAC,IAE7D,kBACA;QAAEC,MAAM;QAAQnI,IAAIc;QAAQsC,MAAMlC,QAAOT,aAAAA,IAAI,CAAC,OAAO,YAAZA,aAAgB,OAAOwB;IAAM;IAGxE,OAAO;QACLP,IAAI;QACJI;OACIX,YAAY;QAAEA;IAAU,IAAI,CAAC,GAC7BY,SAAS;QAAEA;IAAO,IAAI,CAAC;QAC3BC,kBAAkB;;AAEtB"}
+{"version":3,"sources":["../../../../../../libs/tenant/runtime/src/lib/convert-host-lead.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * A lead becomes a contact, and optionally a company and a deal (AGL-2608,\n * AGL-2627).\n *\n * ## Why one function under two doors\n *\n * The console's convert dialog posts to the CRM plugin's `crm/lead-convert`\n * route, and an integration posts to `POST /v1/leads/{id}/convert`. The two\n * doors authenticate differently — an ID token against the site's role, an\n * API key against its scopes — and answer in different envelopes, but what\n * they DO has to be one thing: a conversion that opened a second deal for\n * one person because two callers reached the same lead through two\n * implementations is the bug this file exists to make impossible. The doors\n * own their transport; this owns the writes.\n *\n * It lives here, in the tenancy runtime, rather than beside the plugin\n * route it came from, because the console's REST layer may not import a\n * feature plugin (the app→addons boundary), while both the plugin and the\n * console may import the runtime — which already holds the capture door\n * and the owner assignment this conversion goes through.\n *\n * ## Why a server function and not four client writes\n *\n * The lead is a host document the browser may edit, and a company or a deal\n * is a client-creatable org document. What the browser cannot do is CREATE A\n * CONTACT: the contacts collection is written only by `captureHostContact`\n * (the runtime's wrapper over `upsertHostContact`, so `contactCreated`\n * fires), because that function is the dedupe — one human, one row, found by\n * normalized address across every site in the org — and the audience-band\n * gate. A client that wrote a contact document of its own would mint a\n * second row for a person the org already holds, and would do it past the\n * band.\n *\n * Once the contact has to come from the server, the rest follows it: the\n * conversion is one act with four writes, and a caller that made three of\n * them and lost the connection before the fourth leaves a lead marked\n * qualified with no contact, or a deal pointing at a contact that was never\n * stamped on the lead. Here the order is fixed — contact, then company, then\n * deal, then the lead — and the lead is stamped LAST, so a lead that carries\n * `convertedContactId` names a contact that exists.\n *\n * ## Idempotent on the lead\n *\n * A lead already carrying `convertedContactId` answers with the ids it has\n * and creates nothing more. A double-click on the dialog's button, a retry\n * after a slow response, or a Zapier zap replaying a step must not open a\n * second deal for one person.\n *\n * ## The actor\n *\n * A signed-in member converting from the console owns what nobody else\n * claimed: their uid is the owner of last resort, written directly rather\n * than through the deliberate reassignment, because they may be staff\n * converting on a workspace's behalf and a roster check would refuse the one\n * person who is actually here. An API key is not a person and is on no\n * roster, so for an `api` actor that last step is skipped and a contact\n * nobody chose an owner for — and no rule assigned — stays unowned, which\n * the console renders honestly as unassigned. Either way the caller has\n * already been authorized by its door; nothing here asks again.\n */\n\nimport {\n  consentGroupDisclosureKey,\n  consentGroupScope,\n  CRM_COLLECTIONS,\n  type CrmDealStage,\n  type CrmDealStatus,\n  type CrmLeadFields,\n  type CrmPipeline,\n  crmScopeTokens,\n  DEFAULT_DEAL_STAGES,\n  grantedUnderConsentGroup,\n  nameSearchFields,\n  contactFacetPath,\n  normalizeContactEmail,\n  ORG_SCOPE_TOKEN,\n  readContactFacet,\n  crmNewRecordListFields,\n  readMarketingBasis,\n  soloConsentGroup,\n} from '@aglyn/aglyn/server'\nimport {\n  consentGroupForSite,\n  crmRecordsQuotaForOrg,\n  findContactByEmail,\n  logHostActivity,\n  orgDataCollectionForHost,\n  restampCrmListFieldsAt,\n  writeContactCompanyLink,\n} from '@aglyn/tenant-data-admin'\nimport { FieldPath, FieldValue } from 'firebase-admin/firestore'\nimport { assignOwnerForCapture, notifyRecordAssigned } from './assign-contact-owner'\nimport { captureHostContact } from './capture-host-contact'\nimport { handOffLeadRecords } from './hand-off-lead'\n\n/** Who is converting, as far as the writes need to know. */\nexport interface LeadConvertActor {\n  /**\n   * What `createdByUid` records on every record the conversion opens, and\n   * who the audit line names. A member's uid, or the literal `'api'` for a\n   * key — the same attribution the REST creates stamp.\n   */\n  uid: string\n  email?: string | null\n  /**\n   * `member`: a signed-in person, who becomes the owner when nobody else\n   * does. `api`: a key, which cannot own a record — see the header.\n   */\n  kind: 'member' | 'api'\n  /**\n   * For an `api` actor, the key's name — what the audit line attributes the\n   * conversion to, since a key has no address to be named by.\n   */\n  apiKeyName?: string | null\n}\n\n/** What a conversion is asked to do. Validated by the door before it gets here. */\nexport interface ConvertHostLeadInput {\n  firestore: FirebaseFirestore.Firestore\n  hostId: string\n  orgId: string\n  /** The org document, as the door resolved it. */\n  org: Record<string, unknown>\n  /** `hosts/{hostId}/leads/{leadId}` — the document id, which is the person key. */\n  leadId: string\n  actor: LeadConvertActor\n  /**\n   * Who owns the resulting contact (and deal). Defaults to the lead's own\n   * owner; failing that the org's assignment rules and the site's default\n   * owner decide (AGL-2618), and failing those a member actor — somebody\n   * converted this person, and a record with no owner is one nobody follows\n   * up.\n   */\n  ownerUid?: string\n  /** Link an existing `orgs/{orgId}/companies/{companyId}`. */\n  companyId?: string\n  /** Or create one. Ignored when `companyId` is given. Already normalized. */\n  createCompany?: { name: string; domain: string | null } | null\n  /** Open a deal in the org's default pipeline. Already normalized. */\n  deal?: {\n    title: string\n    amountCents: number | null\n    /** Lowercase ISO 4217. */\n    currency: string\n    /** A stage of the default pipeline; its first open stage when absent. */\n    stageId?: string\n  } | null\n}\n\n/**\n * Why a conversion did not happen. Each is a state of the data, not a fault\n * of the request — the door has already refused a malformed body — and each\n * leaves the lead unconverted so a retry after the remedy finds it where it\n * was.\n */\nexport type ConvertHostLeadRefusal =\n  /** No document at `hosts/{hostId}/leads/{leadId}`. */\n  | 'unknown-lead'\n  /** The lead's address cannot become a contact. */\n  | 'no-email'\n  /**\n   * The capture door produced no contact — it swallows its own failures and\n   * drops a creation past a Free org's audience band. Nothing was written.\n   */\n  | 'contact-not-created'\n  /**\n   * The site holds an erasure for the lead's address (AGL-2623): the person\n   * asked to be forgotten, and the capture door refuses to rebuild a record\n   * for them — by a conversion as by a form. Nothing was written, and the\n   * lead stays as it was; the erasure removes it when it runs.\n   */\n  | 'erased'\n  /** The CRM records band is full (AGL-2611); the contact stands, nothing more was opened. */\n  | 'band-full'\n  /** `companyId` names no company in this organization. The contact stands. */\n  | 'unknown-company'\n  /** The default pipeline has no stages to open a deal in. The contact stands. */\n  | 'no-stages'\n\nexport type ConvertHostLeadResult =\n  | {\n      ok: true\n      contactId: string\n      companyId?: string\n      dealId?: string\n      /** The lead was converted before this call; nothing was created now. */\n      alreadyConverted: boolean\n    }\n  | { ok: false; reason: ConvertHostLeadRefusal }\n\n/** The stamp the conversion leaves on the lead — see `CrmLeadFields`. */\ntype LeadConversionStamp = Required<\n  Pick<CrmLeadFields, 'status' | 'convertedContactId' | 'convertedAtMs'>\n> &\n  Pick<CrmLeadFields, 'dealId' | 'companyId' | 'ownerUid'>\n\n/**\n * The stage a new deal opens in.\n *\n * The caller's choice when the pipeline has it, otherwise the first OPEN\n * stage by order — a deal created by converting a lead is by definition not\n * yet won or lost, so defaulting to a closed stage would record an outcome\n * nobody reached. A pipeline with no open stage at all falls back to its\n * first stage rather than refusing: the merchant edited their pipeline into\n * that shape, and a conversion that failed because of it would read as a bug\n * in the lead.\n */\nexport function stageForNewDeal(\n  pipeline: Pick<CrmPipeline, 'stages'>,\n  requestedStageId: string | undefined,\n): CrmDealStage | null {\n  const stages = [...(pipeline.stages ?? [])].sort((a, b) => a.order - b.order)\n  if (!stages.length) return null\n  const requested = requestedStageId\n    ? stages.find((stage) => stage.id === requestedStageId)\n    : undefined\n  return requested ?? stages.find((stage) => stage.kind === 'open') ?? stages[0]\n}\n\n/** A stage's kind as the deal's denormalized status. */\nfunction dealStatusForStage(stage: CrmDealStage): CrmDealStatus {\n  return stage.kind === 'won' ? 'won' : stage.kind === 'lost' ? 'lost' : 'open'\n}\n\n/**\n * Convert one lead. Throws only on infrastructure failure; every refusal\n * the data can produce is a `ConvertHostLeadResult`.\n */\nexport async function convertHostLead(\n  input: ConvertHostLeadInput,\n): Promise<ConvertHostLeadResult> {\n  const { firestore, hostId, orgId, org, leadId, actor, createCompany, deal } = input\n  const requestedCompanyId = String(input.companyId ?? '').trim()\n  // The lead's one home, on the org (AGL-3275). `orgId` is already resolved\n  // by the caller, so this needs no second lookup to find it.\n  const leadRef = firestore\n    .collection('orgs')\n    .doc(orgId)\n    .collection('leads')\n    .doc(leadId)\n  const leadSnapshot = await leadRef.get()\n  if (!leadSnapshot.exists) return { ok: false, reason: 'unknown-lead' }\n  const lead = (leadSnapshot.data() ?? {}) as Record<string, unknown> & CrmLeadFields\n  if (lead.convertedContactId) {\n    return {\n      ok: true,\n      contactId: lead.convertedContactId,\n      ...(lead.companyId ? { companyId: lead.companyId } : {}),\n      ...(lead.dealId ? { dealId: lead.dealId } : {}),\n      alreadyConverted: true,\n    }\n  }\n  const email = normalizeContactEmail(lead['email'])\n  if (!email) return { ok: false, reason: 'no-email' }\n\n  const group = await consentGroupForSite(hostId, org)\n  const visibleTo = crmScopeTokens(org, group)\n  /*\n   * What the CALLER may read, for the company-by-domain reuse below: their\n   * group's own tokens plus `org`, exactly the set the console's listeners\n   * filter on. A company outside it is one they could not open, so linking\n   * a contact to it would point at a record the page then 404s on.\n   */\n  const readableTokens = new Set<string>([\n    ORG_SCOPE_TOKEN,\n    ...consentGroupScope(group),\n  ])\n  /*\n   * THE OWNER A PERSON CHOSE, when one did: the converter's pick, else\n   * whoever was already working the lead. Handed to the capture as the\n   * facet's owner, which is what tells the capture's own assignment pass\n   * to stand down — a person's choice outranks a rule. When nobody chose,\n   * the facet names no owner and the pass runs the org's rules and the\n   * site's default for a contact it creates (AGL-2618).\n   */\n  const pickedOwner = String(input.ownerUid ?? '').trim()\n  const chosenOwner =\n    pickedOwner || (typeof lead.ownerUid === 'string' ? lead.ownerUid : '')\n  const now = Date.now()\n  const leadName = typeof lead['name'] === 'string' ? lead['name'] : undefined\n\n  /*==========================================\n   * 1. THE CONTACT — through the one door that dedupes and meters.\n   *\n   * `source: 'manual'` because a person converted this lead by hand, and\n   * the source filter should say so; the interaction names the lead so the\n   * contact's timeline can be walked back to what was captured. The facet\n   * carries the stage and the owner, which is what makes this a sales\n   * record rather than another form capture.\n   *\n   * THE LEAD'S OWN PROFILE TRAVELS WITH IT (AGL-3233), the way Salesforce\n   * hands a lead's fields to the contact: phone, title, lead source, address, the\n   * company as text (until step 2 links a record, whose own name then\n   * replaces it), tags, and the marketing basis the lead recorded — the\n   * person ticked the box on the lead, and a conversion must not be the\n   * moment they lose it. Only what the lead holds is handed over; a value\n   * the contact already carries is the contact's, because the capture door\n   * writes a profile field only where the facet has none.\n   *=========================================*/\n  const leadTags = Array.isArray(lead.tags) ? lead.tags.map(String) : []\n  const leadConsent = readMarketingBasis(lead, soloConsentGroup(hostId))\n  /*\n   * WHICH SITES THE CONTACT'S GRANT COVERS (AGL-3320): the lead's, never\n   * more. The capture door records a fresh grant, so it is handed the group's\n   * disclosure key only when the lead ALREADY holds a grant given under the\n   * group as it stands, at every site it names — a lead captured by one site\n   * before the group existed, or before a site joined, converts to a contact\n   * that site alone may mail, exactly as the lead was.\n   */\n  const leadDisclosure = grantedUnderConsentGroup(lead, group)\n    ? consentGroupDisclosureKey(group)\n    : null\n  const captured = await captureHostContact({\n    hostId,\n    email,\n    ...(leadName ? { name: leadName } : {}),\n    source: 'manual',\n    interaction: { summary: 'Converted from a lead', refId: leadId },\n    ...(leadConsent.basis === 'granted' ? { marketingConsent: true } : {}),\n    ...(leadConsent.basis === 'granted' && leadDisclosure\n      ? { disclosedConsentGroup: leadDisclosure }\n      : {}),\n    ...(leadTags.length ? { tags: leadTags } : {}),\n    facet: {\n      lifecycleStage: 'sales-qualified',\n      ...(chosenOwner ? { ownerUid: chosenOwner } : {}),\n      ...(typeof lead.phone === 'string' && lead.phone ? { phone: lead.phone } : {}),\n      ...(typeof lead.jobTitle === 'string' && lead.jobTitle ? { jobTitle: lead.jobTitle } : {}),\n      // Salesforce's Lead Source travels to the contact (AGL-3298).\n      ...(typeof lead.leadSource === 'string' && lead.leadSource\n        ? { leadSource: lead.leadSource }\n        : {}),\n      ...(lead.address && typeof lead.address === 'object' ? { address: lead.address } : {}),\n      ...(typeof lead.company === 'string' && lead.company\n        ? { companyName: lead.company }\n        : {}),\n    },\n  })\n  /*\n   * The one verdict of the door's that is named here. Its other refusals —\n   * the band, an address it will not take, its own swallowed error — all\n   * read the same from this side: no row to find below, answered as\n   * `contact-not-created`. An erasure is different in kind: not a limit the\n   * org can lift or a fault in the request but a decision the workspace made\n   * about this person, and a caller told \"the band may be full\" would retry\n   * against it forever.\n   */\n  if (captured && 'refused' in captured && captured.refused === 'erased') {\n    return { ok: false, reason: 'erased' }\n  }\n  const contactsRef = await orgDataCollectionForHost(hostId, 'contacts')\n  /*\n   * The same resolution the capture door just made (AGL-2625): the\n   * address index first, so a lead whose address is an ALTERNATE on a\n   * merged contact converts into the survivor the capture landed on\n   * rather than reading as a contact the band dropped.\n   */\n  const contactSnapshot = await findContactByEmail(contactsRef, email)\n  if (!contactSnapshot) return { ok: false, reason: 'contact-not-created' }\n  const contactRef = contactSnapshot.ref\n  const contactId = contactSnapshot.id\n  const contactData = (contactSnapshot.data() ?? {}) as Record<string, unknown>\n  const orgRef = firestore.collection('orgs').doc(orgId)\n  /*\n   * THE RECORDS BAND (AGL-2611), asked before each record this conversion\n   * CREATES. The contact went through the capture door, which refuses at\n   * the band on its own; a company and a deal are records of the same\n   * band, and on a Free org at its hundred the honest answer is the one\n   * the drawers give — refuse, write nothing more, and leave the lead\n   * unconverted so a retry after the upgrade finds it where it was. The\n   * contact step 1 captured stays: it is one person's record, and a second\n   * conversion merges onto it rather than making another. Measured fresh\n   * each time because the company created in step 2 is itself a record.\n   */\n  const bandFull = async () => {\n    const room = await crmRecordsQuotaForOrg(org as never, orgRef)\n    return !room.allowed\n  }\n\n  /*\n   * WHOSE THE CONTACT IS, now that it exists. The capture wrote the chosen\n   * owner, or its pass assigned one to a contact it created; a contact\n   * the org already held with no owner has had neither, so the same pass\n   * is asked once more — it touches only a record with no owner and\n   * answers `unchanged` for one that has — and a member actor is the last\n   * resort. A colleague the converter picked is told; the lead's existing\n   * owner and the caller are not, having chosen for themselves.\n   */\n  let ownerUid = readContactFacet(contactData, group.groupId).ownerUid ?? ''\n  if (!ownerUid) {\n    const assigned = await assignOwnerForCapture({\n      hostId,\n      contactId,\n      email,\n      source: 'manual',\n      actorUid: actor.kind === 'member' ? actor.uid : null,\n    })\n    if (assigned.outcome !== 'none') ownerUid = assigned.ownerUid\n  }\n  if (!ownerUid && actor.kind === 'member') {\n    ownerUid = actor.uid\n    await contactRef.update({\n      [contactFacetPath(group.groupId, 'ownerUid')]: ownerUid,\n      updatedAt: FieldValue.serverTimestamp(),\n    })\n    // The owner is what the Contacts list filters by (AGL-3321).\n    await restampCrmListFieldsAt(contactRef, 'contacts')\n  } else if (ownerUid && pickedOwner && pickedOwner === ownerUid) {\n    await notifyRecordAssigned({\n      hostId,\n      orgId,\n      ownerUid,\n      actorUid: actor.kind === 'member' ? actor.uid : null,\n      record: { kind: 'contact', id: contactId },\n      who: leadName || email,\n    })\n  }\n\n  /*==========================================\n   * 2. THE COMPANY — linked, found by domain, or created.\n   *=========================================*/\n  let companyId: string | undefined\n  if (requestedCompanyId) {\n    const companySnapshot = await orgRef\n      .collection(CRM_COLLECTIONS.companies)\n      .doc(requestedCompanyId)\n      .get()\n    if (!companySnapshot.exists) return { ok: false, reason: 'unknown-company' }\n    companyId = requestedCompanyId\n  } else if (createCompany) {\n    /*\n     * FIND BEFORE CREATE. The NAME first (AGL-3233): a lead names its\n     * company as text, and a company the org already files under that\n     * name is the account, whatever domain it carries. Then the domain,\n     * the key two contacts at one business share — a second company\n     * document for `acme.com` would split the account the key exists to\n     * join. Only a company the caller can see counts as found — see\n     * `readableTokens`.\n     */\n    const visibleAmong = (\n      snapshots: readonly FirebaseFirestore.QueryDocumentSnapshot[],\n    ): string | undefined =>\n      snapshots.find((snapshot) => {\n        const tokens = snapshot.get('visibleTo')\n        return (\n          Array.isArray(tokens) &&\n          tokens.some((token) => readableTokens.has(String(token)))\n        )\n      })?.id\n    const byName = await orgRef\n      .collection(CRM_COLLECTIONS.companies)\n      .where('nameLower', '==', createCompany.name.toLowerCase())\n      .limit(5)\n      .get()\n    companyId = visibleAmong(byName.docs)\n    if (!companyId && createCompany.domain) {\n      const byDomain = await orgRef\n        .collection(CRM_COLLECTIONS.companies)\n        .where('domain', '==', createCompany.domain)\n        .limit(5)\n        .get()\n      companyId = visibleAmong(byDomain.docs)\n    }\n    if (!companyId) {\n      if (await bandFull()) return { ok: false, reason: 'band-full' }\n      const company: Record<string, unknown> = {\n        ...nameSearchFields(createCompany.name),\n        ...(createCompany.domain ? { domain: createCompany.domain } : {}),\n        ...(ownerUid ? { ownerUid } : {}),\n        visibleTo,\n        hostId,\n        createdByUid: actor.uid,\n        createdAt: FieldValue.serverTimestamp(),\n        updatedAt: FieldValue.serverTimestamp(),\n      }\n      const created = await orgRef.collection(CRM_COLLECTIONS.companies).add({\n        ...company,\n        // What the Companies list searches and filters by (AGL-3321).\n        ...crmNewRecordListFields('companies', company),\n      })\n      companyId = created.id\n    }\n  }\n  if (companyId) {\n    /*\n     * The one link writer (AGL-2613): the holder's facet field the contact\n     * record reads, the queryable top-level mirror the company's contacts\n     * card filters on, and the company's contacts count — planned from\n     * the row as the capture left it, so a person the org already held\n     * under another company is MOVED rather than counted twice.\n     */\n    await writeContactCompanyLink({\n      firestore,\n      contactRef,\n      contact: contactData,\n      companiesRef: orgRef.collection(CRM_COLLECTIONS.companies),\n      groupId: group.groupId,\n      companyId,\n    })\n  }\n\n  /*==========================================\n   * 3. THE DEAL — in the default pipeline, seeded if the org has none.\n   *=========================================*/\n  let dealId: string | undefined\n  if (deal) {\n    const pipelinesRef = orgRef.collection(CRM_COLLECTIONS.pipelines)\n    let pipelineId: string\n    let pipeline: Pick<CrmPipeline, 'stages'>\n    const defaults = await pipelinesRef\n      .where('isDefault', '==', true)\n      .limit(1)\n      .get()\n    if (!defaults.empty) {\n      pipelineId = defaults.docs[0].id\n      pipeline = defaults.docs[0].data() as CrmPipeline\n    } else {\n      /*\n       * The deals section's own read shape, so the two agree on which\n       * pipeline \"the org's pipeline\" is when none is flagged default: the\n       * first by document id of a bounded window. Seeding a SECOND pipeline\n       * here while one exists unflagged would leave the merchant with two\n       * boards and their deals split between them.\n       */\n      const any = await pipelinesRef\n        .orderBy(FieldPath.documentId())\n        .limit(20)\n        .get()\n      if (!any.empty) {\n        pipelineId = any.docs[0].id\n        pipeline = any.docs[0].data() as CrmPipeline\n      } else {\n        // Exactly what the Deals section seeds: one `Sales` pipeline\n        // carrying a COPY of the default stages, flagged default.\n        const seeded: Omit<CrmPipeline, 'createdAt' | 'updatedAt'> = {\n          name: 'Sales',\n          stages: [...DEFAULT_DEAL_STAGES],\n          isDefault: true,\n          visibleTo,\n          hostId,\n        }\n        const created = await pipelinesRef.add({\n          ...seeded,\n          createdByUid: actor.uid,\n          createdAt: FieldValue.serverTimestamp(),\n          updatedAt: FieldValue.serverTimestamp(),\n        })\n        pipelineId = created.id\n        pipeline = seeded\n      }\n    }\n    const stage = stageForNewDeal(pipeline, deal.stageId)\n    if (!stage) return { ok: false, reason: 'no-stages' }\n    if (await bandFull()) return { ok: false, reason: 'band-full' }\n    const dealRecord: Record<string, unknown> = {\n      title: deal.title,\n      titleLower: deal.title.toLowerCase(),\n      pipelineId,\n      stageId: stage.id,\n      status: dealStatusForStage(stage),\n      ...(deal.amountCents !== null ? { amountCents: deal.amountCents } : {}),\n      currency: deal.currency,\n      stageChangedAtMs: now,\n      ...(ownerUid ? { ownerUid } : {}),\n      contactId,\n      ...(companyId ? { companyId } : {}),\n      visibleTo,\n      hostId,\n      createdByUid: actor.uid,\n      createdAt: FieldValue.serverTimestamp(),\n      updatedAt: FieldValue.serverTimestamp(),\n    }\n    const created = await orgRef.collection(CRM_COLLECTIONS.deals).add({\n      ...dealRecord,\n      // What the Deals list searches and filters by (AGL-3321).\n      ...crmNewRecordListFields('deals', dealRecord),\n    })\n    dealId = created.id\n  }\n\n  /*==========================================\n   * 4. THE LEAD — stamped last, once everything it names exists.\n   *=========================================*/\n  const stamp: LeadConversionStamp = {\n    status: 'qualified',\n    convertedContactId: contactId,\n    convertedAtMs: now,\n    ...(ownerUid ? { ownerUid } : {}),\n    ...(companyId ? { companyId } : {}),\n    ...(dealId ? { dealId } : {}),\n  }\n  await leadRef.update({ ...stamp, updatedAt: FieldValue.serverTimestamp() })\n\n  /*\n   * WHAT THE LEAD HANDS OVER (AGL-3233): its activities and tasks gain the\n   * contact, and every plugin with a listener — Sequences, for an\n   * enrollment naming the lead — re-points its own records. After the\n   * stamp, so a listener reading the lead finds the conversion on it; it\n   * never throws.\n   */\n  await handOffLeadRecords({\n    firestore,\n    orgId,\n    hostId,\n    leadId,\n    contactId,\n    email,\n    by: actor.kind === 'member' ? 'member' : 'api',\n  })\n\n  /*\n   * The audit line, from the function that did the work (AGL-2622): the\n   * conversion is one act however many records it opened, so it is one\n   * entry, on the lead, in the feed of the site that holds the lead. A\n   * repeat call answered above with the ids it already had wrote nothing\n   * and logs nothing.\n   */\n  await logHostActivity(\n    hostId,\n    {\n      uid: actor.uid,\n      email: actor.email ?? null,\n      ...(actor.apiKeyName ? { apiKeyName: actor.apiKeyName } : {}),\n    },\n    'Converted lead',\n    { type: 'lead', id: leadId, name: String(lead['name'] ?? '') || email },\n  )\n\n  return {\n    ok: true,\n    contactId,\n    ...(companyId ? { companyId } : {}),\n    ...(dealId ? { dealId } : {}),\n    alreadyConverted: false,\n  }\n}\n"],"names":["consentGroupDisclosureKey","consentGroupScope","CRM_COLLECTIONS","crmScopeTokens","DEFAULT_DEAL_STAGES","grantedUnderConsentGroup","nameSearchFields","contactFacetPath","normalizeContactEmail","ORG_SCOPE_TOKEN","readContactFacet","crmNewRecordListFields","readMarketingBasis","soloConsentGroup","consentGroupForSite","crmRecordsQuotaForOrg","findContactByEmail","logHostActivity","orgDataCollectionForHost","restampCrmListFieldsAt","writeContactCompanyLink","FieldPath","FieldValue","assignOwnerForCapture","notifyRecordAssigned","captureHostContact","handOffLeadRecords","stageForNewDeal","pipeline","requestedStageId","requested","stages","sort","a","b","order","length","find","stage","id","undefined","kind","dealStatusForStage","convertHostLead","input","leadSnapshot","contactSnapshot","actor","lead","firestore","hostId","orgId","org","leadId","createCompany","deal","requestedCompanyId","String","companyId","trim","leadRef","collection","doc","get","exists","ok","reason","data","convertedContactId","contactId","dealId","alreadyConverted","email","group","visibleTo","readableTokens","Set","pickedOwner","ownerUid","chosenOwner","now","Date","leadName","leadTags","Array","isArray","tags","map","leadConsent","leadDisclosure","captured","name","source","interaction","summary","refId","basis","marketingConsent","disclosedConsentGroup","facet","lifecycleStage","phone","jobTitle","leadSource","address","company","companyName","refused","contactsRef","contactRef","ref","contactData","orgRef","bandFull","room","allowed","groupId","assigned","actorUid","uid","outcome","update","updatedAt","serverTimestamp","record","who","companySnapshot","companies","visibleAmong","snapshots","snapshot","tokens","some","token","has","byName","where","toLowerCase","limit","docs","domain","byDomain","createdByUid","createdAt","created","add","contact","companiesRef","pipelinesRef","pipelines","pipelineId","defaults","empty","any","orderBy","documentId","seeded","isDefault","stageId","dealRecord","title","titleLower","status","amountCents","currency","stageChangedAtMs","deals","stamp","convertedAtMs","by","apiKeyName","type"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2DC,GAED,SACEA,yBAAyB,EACzBC,iBAAiB,EACjBC,eAAe,EAKfC,cAAc,EACdC,mBAAmB,EACnBC,wBAAwB,EACxBC,gBAAgB,EAChBC,gBAAgB,EAChBC,qBAAqB,EACrBC,eAAe,EACfC,gBAAgB,EAChBC,sBAAsB,EACtBC,kBAAkB,EAClBC,gBAAgB,QACX,sBAAqB;AAC5B,SACEC,mBAAmB,EACnBC,qBAAqB,EACrBC,kBAAkB,EAClBC,eAAe,EACfC,wBAAwB,EACxBC,sBAAsB,EACtBC,uBAAuB,QAClB,2BAA0B;AACjC,SAASC,SAAS,EAAEC,UAAU,QAAQ,2BAA0B;AAChE,SAASC,qBAAqB,EAAEC,oBAAoB,QAAQ,4BAAwB;AACpF,SAASC,kBAAkB,QAAQ,4BAAwB;AAC3D,SAASC,kBAAkB,QAAQ,qBAAiB;AAuGpD;;;;;;;;;;CAUC,GACD,OAAO,SAASC,gBACdC,QAAqC,EACrCC,gBAAoC;QAEhBD,kBAKbE;IALP,MAAMC,SAAS;YAAKH,mBAAAA,SAASG,MAAM,YAAfH,mBAAmB,EAAE;KAAE,CAACI,IAAI,CAAC,CAACC,GAAGC,IAAMD,EAAEE,KAAK,GAAGD,EAAEC,KAAK;IAC5E,IAAI,CAACJ,OAAOK,MAAM,EAAE,OAAO;IAC3B,MAAMN,YAAYD,mBACdE,OAAOM,IAAI,CAAC,CAACC,QAAUA,MAAMC,EAAE,KAAKV,oBACpCW;IACJ,QAAOV,OAAAA,oBAAAA,YAAaC,OAAOM,IAAI,CAAC,CAACC,QAAUA,MAAMG,IAAI,KAAK,mBAAnDX,OAA8DC,MAAM,CAAC,EAAE;AAChF;AAEA,sDAAsD,GACtD,SAASW,mBAAmBJ,KAAmB;IAC7C,OAAOA,MAAMG,IAAI,KAAK,QAAQ,QAAQH,MAAMG,IAAI,KAAK,SAAS,SAAS;AACzE;AAEA;;;CAGC,GACD,OAAO,eAAeE,gBACpBC,KAA2B;QAGOA,kBAUpBC,oBAiCaD,iBAsFNE,uBA2BNpC,4BAyOJqC,cAIgCC;IA1Y3C,MAAM,EAAEC,SAAS,EAAEC,MAAM,EAAEC,KAAK,EAAEC,GAAG,EAAEC,MAAM,EAAEN,KAAK,EAAEO,aAAa,EAAEC,IAAI,EAAE,GAAGX;IAC9E,MAAMY,qBAAqBC,QAAOb,mBAAAA,MAAMc,SAAS,YAAfd,mBAAmB,IAAIe,IAAI;IAC7D,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAMC,UAAUX,UACbY,UAAU,CAAC,QACXC,GAAG,CAACX,OACJU,UAAU,CAAC,SACXC,GAAG,CAACT;IACP,MAAMR,eAAe,MAAMe,QAAQG,GAAG;IACtC,IAAI,CAAClB,aAAamB,MAAM,EAAE,OAAO;QAAEC,IAAI;QAAOC,QAAQ;IAAe;IACrE,MAAMlB,QAAQH,qBAAAA,aAAasB,IAAI,cAAjBtB,qBAAuB,CAAC;IACtC,IAAIG,KAAKoB,kBAAkB,EAAE;QAC3B,OAAO;YACLH,IAAI;YACJI,WAAWrB,KAAKoB,kBAAkB;WAC9BpB,KAAKU,SAAS,GAAG;YAAEA,WAAWV,KAAKU,SAAS;QAAC,IAAI,CAAC,GAClDV,KAAKsB,MAAM,GAAG;YAAEA,QAAQtB,KAAKsB,MAAM;QAAC,IAAI,CAAC;YAC7CC,kBAAkB;;IAEtB;IACA,MAAMC,QAAQhE,sBAAsBwC,IAAI,CAAC,QAAQ;IACjD,IAAI,CAACwB,OAAO,OAAO;QAAEP,IAAI;QAAOC,QAAQ;IAAW;IAEnD,MAAMO,QAAQ,MAAM3D,oBAAoBoC,QAAQE;IAChD,MAAMsB,YAAYvE,eAAeiD,KAAKqB;IACtC;;;;;GAKC,GACD,MAAME,iBAAiB,IAAIC,IAAY;QACrCnE;WACGR,kBAAkBwE;KACtB;IACD;;;;;;;GAOC,GACD,MAAMI,cAAcpB,QAAOb,kBAAAA,MAAMkC,QAAQ,YAAdlC,kBAAkB,IAAIe,IAAI;IACrD,MAAMoB,cACJF,eAAgB,CAAA,OAAO7B,KAAK8B,QAAQ,KAAK,WAAW9B,KAAK8B,QAAQ,GAAG,EAAC;IACvE,MAAME,MAAMC,KAAKD,GAAG;IACpB,MAAME,WAAW,OAAOlC,IAAI,CAAC,OAAO,KAAK,WAAWA,IAAI,CAAC,OAAO,GAAGR;IAEnE;;;;;;;;;;;;;;;;;6CAiB2C,GAC3C,MAAM2C,WAAWC,MAAMC,OAAO,CAACrC,KAAKsC,IAAI,IAAItC,KAAKsC,IAAI,CAACC,GAAG,CAAC9B,UAAU,EAAE;IACtE,MAAM+B,cAAc5E,mBAAmBoC,MAAMnC,iBAAiBqC;IAC9D;;;;;;;GAOC,GACD,MAAMuC,iBAAiBpF,yBAAyB2C,MAAMyB,SAClDzE,0BAA0ByE,SAC1B;IACJ,MAAMiB,WAAW,MAAMjE,mBAAmB;QACxCyB;QACAsB;OACIU,WAAW;QAAES,MAAMT;IAAS,IAAI,CAAC;QACrCU,QAAQ;QACRC,aAAa;YAAEC,SAAS;YAAyBC,OAAO1C;QAAO;OAC3DmC,YAAYQ,KAAK,KAAK,YAAY;QAAEC,kBAAkB;IAAK,IAAI,CAAC,GAChET,YAAYQ,KAAK,KAAK,aAAaP,iBACnC;QAAES,uBAAuBT;IAAe,IACxC,CAAC,GACDN,SAAS/C,MAAM,GAAG;QAAEkD,MAAMH;IAAS,IAAI,CAAC;QAC5CgB,OAAO;YACLC,gBAAgB;WACZrB,cAAc;YAAED,UAAUC;QAAY,IAAI,CAAC,GAC3C,OAAO/B,KAAKqD,KAAK,KAAK,YAAYrD,KAAKqD,KAAK,GAAG;YAAEA,OAAOrD,KAAKqD,KAAK;QAAC,IAAI,CAAC,GACxE,OAAOrD,KAAKsD,QAAQ,KAAK,YAAYtD,KAAKsD,QAAQ,GAAG;YAAEA,UAAUtD,KAAKsD,QAAQ;QAAC,IAAI,CAAC,GAEpF,OAAOtD,KAAKuD,UAAU,KAAK,YAAYvD,KAAKuD,UAAU,GACtD;YAAEA,YAAYvD,KAAKuD,UAAU;QAAC,IAC9B,CAAC,GACDvD,KAAKwD,OAAO,IAAI,OAAOxD,KAAKwD,OAAO,KAAK,WAAW;YAAEA,SAASxD,KAAKwD,OAAO;QAAC,IAAI,CAAC,GAChF,OAAOxD,KAAKyD,OAAO,KAAK,YAAYzD,KAAKyD,OAAO,GAChD;YAAEC,aAAa1D,KAAKyD,OAAO;QAAC,IAC5B,CAAC;;IAGT;;;;;;;;GAQC,GACD,IAAIf,YAAY,aAAaA,YAAYA,SAASiB,OAAO,KAAK,UAAU;QACtE,OAAO;YAAE1C,IAAI;YAAOC,QAAQ;QAAS;IACvC;IACA,MAAM0C,cAAc,MAAM1F,yBAAyBgC,QAAQ;IAC3D;;;;;GAKC,GACD,MAAMJ,kBAAkB,MAAM9B,mBAAmB4F,aAAapC;IAC9D,IAAI,CAAC1B,iBAAiB,OAAO;QAAEmB,IAAI;QAAOC,QAAQ;IAAsB;IACxE,MAAM2C,aAAa/D,gBAAgBgE,GAAG;IACtC,MAAMzC,YAAYvB,gBAAgBP,EAAE;IACpC,MAAMwE,eAAejE,wBAAAA,gBAAgBqB,IAAI,cAApBrB,wBAA0B,CAAC;IAChD,MAAMkE,SAAS/D,UAAUY,UAAU,CAAC,QAAQC,GAAG,CAACX;IAChD;;;;;;;;;;GAUC,GACD,MAAM8D,WAAW;QACf,MAAMC,OAAO,MAAMnG,sBAAsBqC,KAAc4D;QACvD,OAAO,CAACE,KAAKC,OAAO;IACtB;IAEA;;;;;;;;GAQC,GACD,IAAIrC,YAAWpE,6BAAAA,iBAAiBqG,aAAatC,MAAM2C,OAAO,EAAEtC,QAAQ,YAArDpE,6BAAyD;IACxE,IAAI,CAACoE,UAAU;QACb,MAAMuC,WAAW,MAAM9F,sBAAsB;YAC3C2B;YACAmB;YACAG;YACAoB,QAAQ;YACR0B,UAAUvE,MAAMN,IAAI,KAAK,WAAWM,MAAMwE,GAAG,GAAG;QAClD;QACA,IAAIF,SAASG,OAAO,KAAK,QAAQ1C,WAAWuC,SAASvC,QAAQ;IAC/D;IACA,IAAI,CAACA,YAAY/B,MAAMN,IAAI,KAAK,UAAU;QACxCqC,WAAW/B,MAAMwE,GAAG;QACpB,MAAMV,WAAWY,MAAM,CAAC;YACtB,CAAClH,iBAAiBkE,MAAM2C,OAAO,EAAE,YAAY,EAAEtC;YAC/C4C,WAAWpG,WAAWqG,eAAe;QACvC;QACA,6DAA6D;QAC7D,MAAMxG,uBAAuB0F,YAAY;IAC3C,OAAO,IAAI/B,YAAYD,eAAeA,gBAAgBC,UAAU;QAC9D,MAAMtD,qBAAqB;YACzB0B;YACAC;YACA2B;YACAwC,UAAUvE,MAAMN,IAAI,KAAK,WAAWM,MAAMwE,GAAG,GAAG;YAChDK,QAAQ;gBAAEnF,MAAM;gBAAWF,IAAI8B;YAAU;YACzCwD,KAAK3C,YAAYV;QACnB;IACF;IAEA;;6CAE2C,GAC3C,IAAId;IACJ,IAAIF,oBAAoB;QACtB,MAAMsE,kBAAkB,MAAMd,OAC3BnD,UAAU,CAAC3D,gBAAgB6H,SAAS,EACpCjE,GAAG,CAACN,oBACJO,GAAG;QACN,IAAI,CAAC+D,gBAAgB9D,MAAM,EAAE,OAAO;YAAEC,IAAI;YAAOC,QAAQ;QAAkB;QAC3ER,YAAYF;IACd,OAAO,IAAIF,eAAe;QACxB;;;;;;;;KAQC,GACD,MAAM0E,eAAe,CACnBC;gBAEAA;oBAAAA,kBAAAA,UAAU5F,IAAI,CAAC,CAAC6F;gBACd,MAAMC,SAASD,SAASnE,GAAG,CAAC;gBAC5B,OACEqB,MAAMC,OAAO,CAAC8C,WACdA,OAAOC,IAAI,CAAC,CAACC,QAAU1D,eAAe2D,GAAG,CAAC7E,OAAO4E;YAErD,uBANAJ,gBAMI1F,EAAE;;QACR,MAAMgG,SAAS,MAAMvB,OAClBnD,UAAU,CAAC3D,gBAAgB6H,SAAS,EACpCS,KAAK,CAAC,aAAa,MAAMlF,cAAcqC,IAAI,CAAC8C,WAAW,IACvDC,KAAK,CAAC,GACN3E,GAAG;QACNL,YAAYsE,aAAaO,OAAOI,IAAI;QACpC,IAAI,CAACjF,aAAaJ,cAAcsF,MAAM,EAAE;YACtC,MAAMC,WAAW,MAAM7B,OACpBnD,UAAU,CAAC3D,gBAAgB6H,SAAS,EACpCS,KAAK,CAAC,UAAU,MAAMlF,cAAcsF,MAAM,EAC1CF,KAAK,CAAC,GACN3E,GAAG;YACNL,YAAYsE,aAAaa,SAASF,IAAI;QACxC;QACA,IAAI,CAACjF,WAAW;YACd,IAAI,MAAMuD,YAAY,OAAO;gBAAEhD,IAAI;gBAAOC,QAAQ;YAAY;YAC9D,MAAMuC,UAAmC,aACpCnG,iBAAiBgD,cAAcqC,IAAI,GAClCrC,cAAcsF,MAAM,GAAG;gBAAEA,QAAQtF,cAAcsF,MAAM;YAAC,IAAI,CAAC,GAC3D9D,WAAW;gBAAEA;YAAS,IAAI,CAAC;gBAC/BJ;gBACAxB;gBACA4F,cAAc/F,MAAMwE,GAAG;gBACvBwB,WAAWzH,WAAWqG,eAAe;gBACrCD,WAAWpG,WAAWqG,eAAe;;YAEvC,MAAMqB,UAAU,MAAMhC,OAAOnD,UAAU,CAAC3D,gBAAgB6H,SAAS,EAAEkB,GAAG,CAAC,aAClExC,SAEA9F,uBAAuB,aAAa8F;YAEzC/C,YAAYsF,QAAQzG,EAAE;QACxB;IACF;IACA,IAAImB,WAAW;QACb;;;;;;KAMC,GACD,MAAMtC,wBAAwB;YAC5B6B;YACA4D;YACAqC,SAASnC;YACToC,cAAcnC,OAAOnD,UAAU,CAAC3D,gBAAgB6H,SAAS;YACzDX,SAAS3C,MAAM2C,OAAO;YACtB1D;QACF;IACF;IAEA;;6CAE2C,GAC3C,IAAIY;IACJ,IAAIf,MAAM;QACR,MAAM6F,eAAepC,OAAOnD,UAAU,CAAC3D,gBAAgBmJ,SAAS;QAChE,IAAIC;QACJ,IAAI1H;QACJ,MAAM2H,WAAW,MAAMH,aACpBZ,KAAK,CAAC,aAAa,MAAM,MACzBE,KAAK,CAAC,GACN3E,GAAG;QACN,IAAI,CAACwF,SAASC,KAAK,EAAE;YACnBF,aAAaC,SAASZ,IAAI,CAAC,EAAE,CAACpG,EAAE;YAChCX,WAAW2H,SAASZ,IAAI,CAAC,EAAE,CAACxE,IAAI;QAClC,OAAO;YACL;;;;;;OAMC,GACD,MAAMsF,MAAM,MAAML,aACfM,OAAO,CAACrI,UAAUsI,UAAU,IAC5BjB,KAAK,CAAC,IACN3E,GAAG;YACN,IAAI,CAAC0F,IAAID,KAAK,EAAE;gBACdF,aAAaG,IAAId,IAAI,CAAC,EAAE,CAACpG,EAAE;gBAC3BX,WAAW6H,IAAId,IAAI,CAAC,EAAE,CAACxE,IAAI;YAC7B,OAAO;gBACL,6DAA6D;gBAC7D,0DAA0D;gBAC1D,MAAMyF,SAAuD;oBAC3DjE,MAAM;oBACN5D,QAAQ;2BAAI3B;qBAAoB;oBAChCyJ,WAAW;oBACXnF;oBACAxB;gBACF;gBACA,MAAM8F,UAAU,MAAMI,aAAaH,GAAG,CAAC,aAClCW;oBACHd,cAAc/F,MAAMwE,GAAG;oBACvBwB,WAAWzH,WAAWqG,eAAe;oBACrCD,WAAWpG,WAAWqG,eAAe;;gBAEvC2B,aAAaN,QAAQzG,EAAE;gBACvBX,WAAWgI;YACb;QACF;QACA,MAAMtH,QAAQX,gBAAgBC,UAAU2B,KAAKuG,OAAO;QACpD,IAAI,CAACxH,OAAO,OAAO;YAAE2B,IAAI;YAAOC,QAAQ;QAAY;QACpD,IAAI,MAAM+C,YAAY,OAAO;YAAEhD,IAAI;YAAOC,QAAQ;QAAY;QAC9D,MAAM6F,aAAsC;YAC1CC,OAAOzG,KAAKyG,KAAK;YACjBC,YAAY1G,KAAKyG,KAAK,CAACvB,WAAW;YAClCa;YACAQ,SAASxH,MAAMC,EAAE;YACjB2H,QAAQxH,mBAAmBJ;WACvBiB,KAAK4G,WAAW,KAAK,OAAO;YAAEA,aAAa5G,KAAK4G,WAAW;QAAC,IAAI,CAAC;YACrEC,UAAU7G,KAAK6G,QAAQ;YACvBC,kBAAkBrF;WACdF,WAAW;YAAEA;QAAS,IAAI,CAAC;YAC/BT;WACIX,YAAY;YAAEA;QAAU,IAAI,CAAC;YACjCgB;YACAxB;YACA4F,cAAc/F,MAAMwE,GAAG;YACvBwB,WAAWzH,WAAWqG,eAAe;YACrCD,WAAWpG,WAAWqG,eAAe;;QAEvC,MAAMqB,UAAU,MAAMhC,OAAOnD,UAAU,CAAC3D,gBAAgBoK,KAAK,EAAErB,GAAG,CAAC,aAC9Dc,YAEApJ,uBAAuB,SAASoJ;QAErCzF,SAAS0E,QAAQzG,EAAE;IACrB;IAEA;;6CAE2C,GAC3C,MAAMgI,QAA6B;QACjCL,QAAQ;QACR9F,oBAAoBC;QACpBmG,eAAexF;OACXF,WAAW;QAAEA;IAAS,IAAI,CAAC,GAC3BpB,YAAY;QAAEA;IAAU,IAAI,CAAC,GAC7BY,SAAS;QAAEA;IAAO,IAAI,CAAC;IAE7B,MAAMV,QAAQ6D,MAAM,CAAC,aAAK8C;QAAO7C,WAAWpG,WAAWqG,eAAe;;IAEtE;;;;;;GAMC,GACD,MAAMjG,mBAAmB;QACvBuB;QACAE;QACAD;QACAG;QACAgB;QACAG;QACAiG,IAAI1H,MAAMN,IAAI,KAAK,WAAW,WAAW;IAC3C;IAEA;;;;;;GAMC,GACD,MAAMxB,gBACJiC,QACA;QACEqE,KAAKxE,MAAMwE,GAAG;QACd/C,KAAK,GAAEzB,eAAAA,MAAMyB,KAAK,YAAXzB,eAAe;OAClBA,MAAM2H,UAAU,GAAG;QAAEA,YAAY3H,MAAM2H,UAAU;IAAC,IAAI,CAAC,IAE7D,kBACA;QAAEC,MAAM;QAAQpI,IAAIc;QAAQsC,MAAMlC,QAAOT,aAAAA,IAAI,CAAC,OAAO,YAAZA,aAAgB,OAAOwB;IAAM;IAGxE,OAAO;QACLP,IAAI;QACJI;OACIX,YAAY;QAAEA;IAAU,IAAI,CAAC,GAC7BY,SAAS;QAAEA;IAAO,IAAI,CAAC;QAC3BC,kBAAkB;;AAEtB"}