@aglyn/tenant-runtime 1.0.0-beta.221 → 1.0.0-beta.223

package/src/lib/self-hosted-fonts.js

@@ -0,0 +1,148 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { boundedAwait, createSettledValueCache } from "@aglyn/shared-util-http/bounded-await";
+// By path: the theme lib's barrel carries React providers a server module
+// has no use for (AGL-405).
+import { getGoogleFontsUrl } from "@aglyn/shared-ui-theme/util/host-theme";
+import { googleFontFileUrl, isSelfHostedFontPath, parseGoogleFontFaces, selfHostedFontFaceCss, selfHostedFontPreloads } from "@aglyn/shared-ui-theme/util/self-hosted-fonts";
+/**
+ * The tenant's half of self-hosted theme fonts (AGL-3485): fetching Google's
+ * stylesheet for a theme, and serving the files it names from the site's own
+ * origin. What is done with the stylesheet, and why, is the note on
+ * `@aglyn/shared-ui-theme/util/self-hosted-fonts`.
+ */ /**
+ * A current desktop Chrome. Google's CSS2 API picks the font FORMAT from the
+ * user agent, and a server's default agent is answered with TrueType; this
+ * one is answered with WOFF2, the format every browser a site supports reads.
+ */ const WOFF2_USER_AGENT = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 ' + '(KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36';
+/** How long one process trusts a stylesheet it fetched. */ const STYLESHEET_TTL_MS = 24 * 60 * 60 * 1000;
+/** How long a failed fetch is remembered before it is tried again. */ const FAILURE_TTL_MS = 5 * 60 * 1000;
+/** How long a page render waits for Google before falling back. */ const STYLESHEET_TIMEOUT_MS = 2500;
+/** The largest font file the route will pass on. */ const MAX_FONT_BYTES = 2 * 1024 * 1024;
+/** A font file's URL never changes its bytes: the version is in the path. */ export const SELF_HOSTED_FONT_CACHE_CONTROL = 'public, max-age=31536000, s-maxage=31536000, immutable';
+/**
+ * What this process learned about each stylesheet: the faces, or null for a
+ * failure. VALUES, never an in-flight promise — the settled-value cache
+ * refuses one. A promise held across requests is awaited by renders that did
+ * not create it, and one that never settles stalled every page of every site
+ * on the instance until the function timed out (AGL-3565).
+ */ const stylesheets = createSettledValueCache();
+/** Test seam: the process cache would otherwise leak between cases. */ export function resetSelfHostedFontsForTests() {
+    stylesheets.clear();
+}
+/**
+ * Google's faces for a stylesheet URL, or null; never waits past `ms`. The
+ * deadline is a real timer (`boundedAwait`): an abort signal alone did not
+ * bound Next's patched fetch on Vercel, whose promise could never settle.
+ */ function fetchFaces(url, ms) {
+    return boundedAwait((signal)=>fetch(url, {
+            headers: {
+                'User-Agent': WOFF2_USER_AGENT
+            },
+            signal,
+            next: {
+                revalidate: STYLESHEET_TTL_MS / 1000
+            }
+        }).then(async (response)=>{
+            if (!response.ok) return null;
+            const parsed = parseGoogleFontFaces(await response.text());
+            return parsed.length ? parsed : null;
+        }).catch(()=>null), ms, null, 'self-hosted-fonts.stylesheet');
+}
+/**
+ * Google's faces for a stylesheet URL, from this process's cache when it has
+ * them. Null when the fetch failed, timed out or answered with nothing usable;
+ * the page then links the stylesheet as it always did, rather than losing its
+ * font. Asked through `fetch` with a day's revalidation, which on the server is
+ * Next's data cache: a cold process reads the stored stylesheet rather than
+ * asking Google again.
+ */ function facesFor(url) {
+    return stylesheets.readThrough(url, ()=>fetchFaces(url, STYLESHEET_TIMEOUT_MS), (faces)=>faces ? STYLESHEET_TTL_MS : FAILURE_TTL_MS);
+}
+/**
+ * The theme's Google fonts as rules to inline and files to preload, or null
+ * when the theme loads none or Google could not be read — in which case the
+ * caller links the stylesheet as before.
+ */ export async function selfHostedThemeFonts(theme) {
+    const url = getGoogleFontsUrl(theme == null ? void 0 : theme.fonts);
+    if (!url) return null;
+    const faces = await facesFor(url);
+    if (!faces) return null;
+    return {
+        css: selfHostedFontFaceCss(faces),
+        preloads: selfHostedFontPreloads(theme, faces)
+    };
+}
+/**
+ * One font file, fetched from Google and answered from the site's origin with
+ * a year-long `immutable` policy. `path` is the part below `/s/` on Google's
+ * origin (`inter/v18/….woff2`); anything else is a 404, so this route cannot
+ * be pointed at any other URL.
+ *
+ * The edge keeps the answer for the year too (`s-maxage`), so Google is asked
+ * once per file per edge region rather than once per visitor.
+ */ export async function serveSelfHostedFont(path) {
+    var _upstream_headers_get;
+    const notFound = ()=>new Response('Not found', {
+            status: 404,
+            headers: {
+                'Cache-Control': 'public, max-age=300'
+            }
+        });
+    if (!isSelfHostedFontPath(path)) return notFound();
+    let upstream;
+    try {
+        upstream = await fetch(googleFontFileUrl(path), {
+            headers: {
+                'User-Agent': WOFF2_USER_AGENT
+            },
+            cache: 'force-cache'
+        });
+    } catch (unused) {
+        return new Response('Font unavailable', {
+            status: 502,
+            headers: {
+                'Cache-Control': 'no-store'
+            }
+        });
+    }
+    if (upstream.status === 404) return notFound();
+    const length = Number((_upstream_headers_get = upstream.headers.get('content-length')) != null ? _upstream_headers_get : 0);
+    if (!upstream.ok || !upstream.body || length > MAX_FONT_BYTES) {
+        return new Response('Font unavailable', {
+            status: 502,
+            headers: {
+                'Cache-Control': 'no-store'
+            }
+        });
+    }
+    return new Response(upstream.body, {
+        status: 200,
+        headers: _extends({
+            'Content-Type': 'font/woff2',
+            'Cache-Control': SELF_HOSTED_FONT_CACHE_CONTROL,
+            'X-Content-Type-Options': 'nosniff',
+            // Fonts are fetched in CORS mode; a site reached on two hostnames (its
+            // own domain and its platform subdomain) shares one cached answer.
+            'Access-Control-Allow-Origin': '*'
+        }, length ? {
+            'Content-Length': String(length)
+        } : {})
+    });
+}
+
+//# sourceMappingURL=self-hosted-fonts.js.map

package/src/lib/self-hosted-fonts.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/tenant/runtime/src/lib/self-hosted-fonts.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { HostTheme } from '@aglyn/shared-data-types'\nimport {\n  boundedAwait,\n  createSettledValueCache,\n} from '@aglyn/shared-util-http/bounded-await'\n// By path: the theme lib's barrel carries React providers a server module\n// has no use for (AGL-405).\nimport { getGoogleFontsUrl } from '@aglyn/shared-ui-theme/util/host-theme'\nimport {\n  type GoogleFontFace,\n  googleFontFileUrl,\n  isSelfHostedFontPath,\n  parseGoogleFontFaces,\n  selfHostedFontFaceCss,\n  selfHostedFontPreloads,\n} from '@aglyn/shared-ui-theme/util/self-hosted-fonts'\n\n/**\n * The tenant's half of self-hosted theme fonts (AGL-3485): fetching Google's\n * stylesheet for a theme, and serving the files it names from the site's own\n * origin. What is done with the stylesheet, and why, is the note on\n * `@aglyn/shared-ui-theme/util/self-hosted-fonts`.\n */\n\n/**\n * A current desktop Chrome. Google's CSS2 API picks the font FORMAT from the\n * user agent, and a server's default agent is answered with TrueType; this\n * one is answered with WOFF2, the format every browser a site supports reads.\n */\nconst WOFF2_USER_AGENT =\n  'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 ' +\n  '(KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36'\n\n/** How long one process trusts a stylesheet it fetched. */\nconst STYLESHEET_TTL_MS = 24 * 60 * 60 * 1000\n\n/** How long a failed fetch is remembered before it is tried again. */\nconst FAILURE_TTL_MS = 5 * 60 * 1000\n\n/** How long a page render waits for Google before falling back. */\nconst STYLESHEET_TIMEOUT_MS = 2_500\n\n/** The largest font file the route will pass on. */\nconst MAX_FONT_BYTES = 2 * 1024 * 1024\n\n/** A font file's URL never changes its bytes: the version is in the path. */\nexport const SELF_HOSTED_FONT_CACHE_CONTROL =\n  'public, max-age=31536000, s-maxage=31536000, immutable'\n\n/**\n * What this process learned about each stylesheet: the faces, or null for a\n * failure. VALUES, never an in-flight promise — the settled-value cache\n * refuses one. A promise held across requests is awaited by renders that did\n * not create it, and one that never settles stalled every page of every site\n * on the instance until the function timed out (AGL-3565).\n */\nconst stylesheets = createSettledValueCache<string, GoogleFontFace[] | null>()\n\n/** Test seam: the process cache would otherwise leak between cases. */\nexport function resetSelfHostedFontsForTests(): void {\n  stylesheets.clear()\n}\n\n/**\n * Google's faces for a stylesheet URL, or null; never waits past `ms`. The\n * deadline is a real timer (`boundedAwait`): an abort signal alone did not\n * bound Next's patched fetch on Vercel, whose promise could never settle.\n */\nfunction fetchFaces(url: string, ms: number): Promise<GoogleFontFace[] | null> {\n  return boundedAwait(\n    (signal) =>\n      fetch(url, {\n        headers: { 'User-Agent': WOFF2_USER_AGENT },\n        signal,\n        next: { revalidate: STYLESHEET_TTL_MS / 1000 },\n      } as RequestInit)\n        .then(async (response) => {\n          if (!response.ok) return null\n          const parsed = parseGoogleFontFaces(await response.text())\n          return parsed.length ? parsed : null\n        })\n        .catch(() => null),\n    ms,\n    null,\n    'self-hosted-fonts.stylesheet',\n  )\n}\n\n/**\n * Google's faces for a stylesheet URL, from this process's cache when it has\n * them. Null when the fetch failed, timed out or answered with nothing usable;\n * the page then links the stylesheet as it always did, rather than losing its\n * font. Asked through `fetch` with a day's revalidation, which on the server is\n * Next's data cache: a cold process reads the stored stylesheet rather than\n * asking Google again.\n */\nfunction facesFor(url: string): Promise<GoogleFontFace[] | null> {\n  return stylesheets.readThrough(\n    url,\n    () => fetchFaces(url, STYLESHEET_TIMEOUT_MS),\n    (faces) => (faces ? STYLESHEET_TTL_MS : FAILURE_TTL_MS),\n  )\n}\n\n/** What a page inlines in its head for its theme's fonts. */\nexport interface SelfHostedThemeFonts {\n  /** The `@font-face` rules, every `src` on the site's own origin. */\n  css: string\n  /** The one or two files the first screen paints with, to preload. */\n  preloads: string[]\n}\n\n/**\n * The theme's Google fonts as rules to inline and files to preload, or null\n * when the theme loads none or Google could not be read — in which case the\n * caller links the stylesheet as before.\n */\nexport async function selfHostedThemeFonts(\n  theme: Pick<HostTheme, 'fonts' | 'typography'> | undefined,\n): Promise<SelfHostedThemeFonts | null> {\n  const url = getGoogleFontsUrl(theme?.fonts)\n  if (!url) return null\n  const faces = await facesFor(url)\n  if (!faces) return null\n  return {\n    css: selfHostedFontFaceCss(faces),\n    preloads: selfHostedFontPreloads(theme, faces),\n  }\n}\n\n/**\n * One font file, fetched from Google and answered from the site's origin with\n * a year-long `immutable` policy. `path` is the part below `/s/` on Google's\n * origin (`inter/v18/….woff2`); anything else is a 404, so this route cannot\n * be pointed at any other URL.\n *\n * The edge keeps the answer for the year too (`s-maxage`), so Google is asked\n * once per file per edge region rather than once per visitor.\n */\nexport async function serveSelfHostedFont(path: string): Promise<Response> {\n  const notFound = () =>\n    new Response('Not found', {\n      status: 404,\n      headers: { 'Cache-Control': 'public, max-age=300' },\n    })\n  if (!isSelfHostedFontPath(path)) return notFound()\n  let upstream: Response\n  try {\n    upstream = await fetch(googleFontFileUrl(path), {\n      headers: { 'User-Agent': WOFF2_USER_AGENT },\n      cache: 'force-cache',\n    })\n  } catch {\n    return new Response('Font unavailable', {\n      status: 502,\n      headers: { 'Cache-Control': 'no-store' },\n    })\n  }\n  if (upstream.status === 404) return notFound()\n  const length = Number(upstream.headers.get('content-length') ?? 0)\n  if (!upstream.ok || !upstream.body || length > MAX_FONT_BYTES) {\n    return new Response('Font unavailable', {\n      status: 502,\n      headers: { 'Cache-Control': 'no-store' },\n    })\n  }\n  return new Response(upstream.body, {\n    status: 200,\n    headers: {\n      'Content-Type': 'font/woff2',\n      'Cache-Control': SELF_HOSTED_FONT_CACHE_CONTROL,\n      'X-Content-Type-Options': 'nosniff',\n      // Fonts are fetched in CORS mode; a site reached on two hostnames (its\n      // own domain and its platform subdomain) shares one cached answer.\n      'Access-Control-Allow-Origin': '*',\n      ...(length ? { 'Content-Length': String(length) } : {}),\n    },\n  })\n}\n"],"names":["boundedAwait","createSettledValueCache","getGoogleFontsUrl","googleFontFileUrl","isSelfHostedFontPath","parseGoogleFontFaces","selfHostedFontFaceCss","selfHostedFontPreloads","WOFF2_USER_AGENT","STYLESHEET_TTL_MS","FAILURE_TTL_MS","STYLESHEET_TIMEOUT_MS","MAX_FONT_BYTES","SELF_HOSTED_FONT_CACHE_CONTROL","stylesheets","resetSelfHostedFontsForTests","clear","fetchFaces","url","ms","signal","fetch","headers","next","revalidate","then","response","ok","parsed","text","length","catch","facesFor","readThrough","faces","selfHostedThemeFonts","theme","fonts","css","preloads","serveSelfHostedFont","path","upstream","notFound","Response","status","cache","Number","get","body","String"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SACEA,YAAY,EACZC,uBAAuB,QAClB,wCAAuC;AAC9C,0EAA0E;AAC1E,4BAA4B;AAC5B,SAASC,iBAAiB,QAAQ,yCAAwC;AAC1E,SAEEC,iBAAiB,EACjBC,oBAAoB,EACpBC,oBAAoB,EACpBC,qBAAqB,EACrBC,sBAAsB,QACjB,gDAA+C;AAEtD;;;;;CAKC,GAED;;;;CAIC,GACD,MAAMC,mBACJ,wEACA;AAEF,yDAAyD,GACzD,MAAMC,oBAAoB,KAAK,KAAK,KAAK;AAEzC,oEAAoE,GACpE,MAAMC,iBAAiB,IAAI,KAAK;AAEhC,iEAAiE,GACjE,MAAMC,wBAAwB;AAE9B,kDAAkD,GAClD,MAAMC,iBAAiB,IAAI,OAAO;AAElC,2EAA2E,GAC3E,OAAO,MAAMC,iCACX,yDAAwD;AAE1D;;;;;;CAMC,GACD,MAAMC,cAAcb;AAEpB,qEAAqE,GACrE,OAAO,SAASc;IACdD,YAAYE,KAAK;AACnB;AAEA;;;;CAIC,GACD,SAASC,WAAWC,GAAW,EAAEC,EAAU;IACzC,OAAOnB,aACL,CAACoB,SACCC,MAAMH,KAAK;YACTI,SAAS;gBAAE,cAAcd;YAAiB;YAC1CY;YACAG,MAAM;gBAAEC,YAAYf,oBAAoB;YAAK;QAC/C,GACGgB,IAAI,CAAC,OAAOC;YACX,IAAI,CAACA,SAASC,EAAE,EAAE,OAAO;YACzB,MAAMC,SAASvB,qBAAqB,MAAMqB,SAASG,IAAI;YACvD,OAAOD,OAAOE,MAAM,GAAGF,SAAS;QAClC,GACCG,KAAK,CAAC,IAAM,OACjBZ,IACA,MACA;AAEJ;AAEA;;;;;;;CAOC,GACD,SAASa,SAASd,GAAW;IAC3B,OAAOJ,YAAYmB,WAAW,CAC5Bf,KACA,IAAMD,WAAWC,KAAKP,wBACtB,CAACuB,QAAWA,QAAQzB,oBAAoBC;AAE5C;AAUA;;;;CAIC,GACD,OAAO,eAAeyB,qBACpBC,KAA0D;IAE1D,MAAMlB,MAAMhB,kBAAkBkC,yBAAAA,MAAOC,KAAK;IAC1C,IAAI,CAACnB,KAAK,OAAO;IACjB,MAAMgB,QAAQ,MAAMF,SAASd;IAC7B,IAAI,CAACgB,OAAO,OAAO;IACnB,OAAO;QACLI,KAAKhC,sBAAsB4B;QAC3BK,UAAUhC,uBAAuB6B,OAAOF;IAC1C;AACF;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeM,oBAAoBC,IAAY;QAoB9BC;IAnBtB,MAAMC,WAAW,IACf,IAAIC,SAAS,aAAa;YACxBC,QAAQ;YACRvB,SAAS;gBAAE,iBAAiB;YAAsB;QACpD;IACF,IAAI,CAAClB,qBAAqBqC,OAAO,OAAOE;IACxC,IAAID;IACJ,IAAI;QACFA,WAAW,MAAMrB,MAAMlB,kBAAkBsC,OAAO;YAC9CnB,SAAS;gBAAE,cAAcd;YAAiB;YAC1CsC,OAAO;QACT;IACF,EAAE,eAAM;QACN,OAAO,IAAIF,SAAS,oBAAoB;YACtCC,QAAQ;YACRvB,SAAS;gBAAE,iBAAiB;YAAW;QACzC;IACF;IACA,IAAIoB,SAASG,MAAM,KAAK,KAAK,OAAOF;IACpC,MAAMb,SAASiB,QAAOL,wBAAAA,SAASpB,OAAO,CAAC0B,GAAG,CAAC,6BAArBN,wBAA0C;IAChE,IAAI,CAACA,SAASf,EAAE,IAAI,CAACe,SAASO,IAAI,IAAInB,SAASlB,gBAAgB;QAC7D,OAAO,IAAIgC,SAAS,oBAAoB;YACtCC,QAAQ;YACRvB,SAAS;gBAAE,iBAAiB;YAAW;QACzC;IACF;IACA,OAAO,IAAIsB,SAASF,SAASO,IAAI,EAAE;QACjCJ,QAAQ;QACRvB,SAAS;YACP,gBAAgB;YAChB,iBAAiBT;YACjB,0BAA0B;YAC1B,uEAAuE;YACvE,mEAAmE;YACnE,+BAA+B;WAC3BiB,SAAS;YAAE,kBAAkBoB,OAAOpB;QAAQ,IAAI,CAAC;IAEzD;AACF"}

package/src/lib/assign-contact-owner.d.ts

@@ -1,162 +0,0 @@
-/**
- * @license
- * Copyright 2026 Aglyn LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-import { type ContactSource, type CrmAssignmentTarget } from '@aglyn/aglyn/server';
-/**
- * WHO A NEW RECORD BELONGS TO — the one place an owner is decided on the
- * server (AGL-2618).
- *
- * Two entry points over one transaction. `assignOwnerForCapture` is the
- * capture door's pass: it runs the org's assignment rules in order, falls
- * back to the capturing site's default owner, and touches only a record
- * that has NO owner — a door that named one (the console's drawer, an
- * import column, a conversion with a picked owner) has expressed a person's
- * choice. `reassignContactOwner` is the automation's: an author who put
- * "assign an owner" on a stage change means to reassign, and the step hands
- * this either a member or the rotation.
- *
- * ## One transaction, because the pointer is shared
- *
- * The round-robin pool's pointer lives on the org document, and two
- * captures landing together must take two different members. Firestore
- * transactions serialize on what they read, so the org document, the
- * contact and the roster documents are all read inside the transaction and
- * the pointer is advanced in the same commit that writes the owner: a
- * concurrent capture that read the same pointer retries and reads the moved
- * one. The alternative — read the pointer, decide, then write — is exactly
- * the read-then-write shape that lets two captures pick the same person.
- *
- * ## The roster is checked, once per member per attempt
- *
- * A rule may name a member who has since left, and a pool may hold one. A
- * rule naming nobody on the roster is passed over rather than stopping the
- * pass — the next rule may well assign — and a pool member who is gone is
- * skipped for the next in the order. `orgs/{orgId}/members/{uid}` is keyed
- * by uid, so the check is one document read per candidate, and only the
- * roster is consulted: a project-level Auth lookup would admit people who
- * are not on this organization at all (AGL-1122).
- *
- * ## The lead follows the contact
- *
- * The capture doors that file a lead (`addHostLead`: a form routed to leads,
- * a sign-up, a booking) key it by `personKey(email)`, so the lead's document
- * is addressable from the capture alone. When it exists it is given the same
- * owner in the same transaction; two doors write the lead AFTER the contact
- * they `void`ed, so for those sources the mirror is retried a few times over
- * the next seconds, detached, and the person's Leads list shows the owner
- * as soon as the lead is there.
- *
- * ## The owner is told, unless they chose themselves
- *
- * One console notification per assignment, for the record the recipient
- * will open: the lead when the site holds one for this person, the contact
- * otherwise. Not when the actor IS the new owner — a rep who converts a
- * lead into their own contact has not been handed anything.
- *
- * ## Never rejects
- *
- * The capture has already succeeded and a form submission must not fail
- * because the CRM could not decide who follows up; a failure is logged and
- * answered as `none`, and the record is exactly as assignable by hand as it
- * was before this existed. The automation executor turns a `none` into the
- * step's recorded error.
- */
-export interface OwnerAssignmentInput {
-    hostId: string;
-    /** `orgs/{orgId}/contacts/{contactId}` — the record the owner is written on. */
-    contactId: string;
-    /** The contact's address, which keys the lead and names the person in the notification. */
-    email: string;
-    /**
-     * The signed-in person making the assignment, when there is one. Never
-     * notified about their own choice; absent for a capture and an automation.
-     */
-    actorUid?: string | null;
-}
-export interface CaptureAssignmentInput extends OwnerAssignmentInput {
-    source: ContactSource;
-    /** The form the capture came through, for a rule conditioned on it. */
-    formId?: string | null;
-    /** The tags the capture carried; the contact's own are read from the facet. */
-    tags?: readonly string[];
-}
-export interface ReassignmentInput extends OwnerAssignmentInput {
-    assign: CrmAssignmentTarget;
-}
-/** Why an assignment assigned nobody — the automation reports these verbatim. */
-export type OwnerAssignmentRefusal = 'no-org' | 'no-contact' | 'no-rule' | 'empty-pool' | 'not-a-member' | 'failed';
-/** What decided an assignment: a rule, the site default, the step's member, or the rotation. */
-export type OwnerAssignedBy = 'rule' | 'default' | 'member' | 'roundRobin';
-export type OwnerAssignment = {
-    outcome: 'assigned';
-    ownerUid: string;
-    by: OwnerAssignedBy;
-    /** The rule that decided it, when one did. */
-    ruleId?: string;
-    /** The lead document existed and now carries the owner too. */
-    leadMirrored: boolean;
-    /** A notification was fanned out to the new owner. */
-    notified: boolean;
-}
-/** The record already had this owner (a capture), or the same one was named again (a reassignment). */
- | {
-    outcome: 'unchanged';
-    ownerUid: string;
-} | {
-    outcome: 'none';
-    reason: OwnerAssignmentRefusal;
-};
-/** The words the run history and the log give each refusal. */
-export declare const OWNER_ASSIGNMENT_REFUSALS: Record<OwnerAssignmentRefusal, string>;
-/** The record an assignment notification opens. */
-export type AssignedRecord = {
-    kind: 'contact';
-    id: string;
-} | {
-    kind: 'lead';
-    id: string;
-};
-/**
- * Tells a member a record is now theirs — one console notification, typed
- * by the record it opens — unless the member handed it to themselves.
- * Shared by the pass above and by the routes where a person picks the
- * owner outright (a lead conversion naming a colleague), so every server
- * path that writes `ownerUid` says so in the same words. Never throws;
- * the fan-out swallows its own failures.
- */
-export declare function notifyRecordAssigned(input: {
-    hostId: string;
-    orgId: string;
-    ownerUid: string;
-    actorUid?: string | null;
-    record: AssignedRecord;
-    /** How the person reads in the message: their name, else their address. */
-    who: string;
-}): Promise<boolean>;
-/**
- * The capture door's pass: the org's rules in order, then the capturing
- * site's default owner, on a record that has no owner yet. See the module
- * comment for the whole of it.
- */
-export declare function assignOwnerForCapture(input: CaptureAssignmentInput): Promise<OwnerAssignment>;
-/**
- * The deliberate assignment — the `assignContactOwner` step, and a person
- * handing a record to somebody: a member by uid (verified on the roster) or
- * the next in the round-robin pool, overwriting whoever held it. Naming the
- * owner the record already has changes nothing and tells nobody.
- */
-export declare function reassignContactOwner(input: ReassignmentInput): Promise<OwnerAssignment>;
-export default assignOwnerForCapture;

package/src/lib/assign-contact-owner.js

@@ -1,340 +0,0 @@
-import { _ as _extends } from "@swc/helpers/_/_extends";
-/**
- * @license
- * Copyright 2026 Aglyn LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */ import { assignmentRuleMatches, consentGroupForHost, contactFacetPath, CRM_ROUND_ROBIN_LAST_ASSIGNED_PATH, personKey, readContactFacet, readCrmAssignmentSettings, roundRobinOrder } from "@aglyn/aglyn/server";
-import { firebaseAdmin, getHostDocAdmin, getOrgForHost, hostDisplayName, notifyUsers, restampCrmListFieldsAt } from "@aglyn/tenant-data-admin";
-import { FieldValue } from "firebase-admin/firestore";
-/** The words the run history and the log give each refusal. */ export const OWNER_ASSIGNMENT_REFUSALS = {
-    'no-org': 'this site has no organization',
-    'no-contact': 'the contact no longer exists',
-    'no-rule': 'no assignment rule matched and the site has no default owner',
-    'empty-pool': 'the round-robin pool has nobody on the roster in it',
-    'not-a-member': 'the owner named is not on the team',
-    failed: 'the owner could not be assigned'
-};
-/**
- * The doors whose lead lands after the contact they `void`ed — the ones the
- * mirror is worth retrying for. An order, an import, a manual add and an
- * API call file no lead, and a retry for them would be reads for nothing.
- */ const LEAD_FILING_SOURCES = new Set([
-    'form',
-    'member',
-    'booking'
-]);
-/** How long the detached lead mirror waits between its looks, in order. */ const LEAD_MIRROR_RETRY_MS = [
-    1000,
-    2000,
-    3000
-];
-/**
- * The console path the owner's notification opens, in the `/{hostDocId}/rest`
- * shape every host notification uses — the console rewrites it to
- * `/{orgSlug}/hosts/{subdomain}/rest` when the link is followed, which is
- * why `hostId` and `orgId` travel on the document. The same spelling the
- * CRM's task notification uses; the hub's own route builder lives in the
- * plugin, which this layer cannot import.
- */ function recordLink(hostId, record) {
-    const section = record.kind === 'contact' ? 'contacts' : 'leads';
-    return `/${hostId}/crm/${section}/${encodeURIComponent(record.id)}`;
-}
-/**
- * Tells a member a record is now theirs — one console notification, typed
- * by the record it opens — unless the member handed it to themselves.
- * Shared by the pass above and by the routes where a person picks the
- * owner outright (a lead conversion naming a colleague), so every server
- * path that writes `ownerUid` says so in the same words. Never throws;
- * the fan-out swallows its own failures.
- */ export async function notifyRecordAssigned(input) {
-    var _input_actorUid;
-    if (!input.ownerUid || input.ownerUid === ((_input_actorUid = input.actorUid) != null ? _input_actorUid : '')) return false;
-    const lead = input.record.kind === 'lead';
-    /*
-   * THE BODY SAYS WHAT HAPPENED, AND ON WHICH SITE (AGL-3432).
-   *
-   * It was the bare name, so a member who owns records on several sites read
-   * "Ada" in an email body and could not tell what Ada was or where. The
-   * site's name is one request-cached read of a document most callers have
-   * already paid for, taken only when somebody is actually notified; a read
-   * that fails drops the "on {site}" clause rather than the notification.
-   */ let site = '';
-    try {
-        const host = await getHostDocAdmin(input.hostId);
-        if (host) site = ` on ${hostDisplayName(host, input.hostId)}`;
-    } catch (unused) {
-    // The clause goes, never the notification.
-    }
-    await notifyUsers([
-        input.ownerUid
-    ], {
-        type: lead ? 'content.leadAssigned' : 'content.contactAssigned',
-        title: lead ? 'Lead assigned to you' : 'Contact assigned to you',
-        body: `${input.who} was assigned to you as a ${lead ? 'lead' : 'contact'}${site}.`,
-        link: recordLink(input.hostId, input.record),
-        orgId: input.orgId,
-        hostId: input.hostId
-    });
-    return true;
-}
-async function assignOwner(policy) {
-    const { input } = policy;
-    try {
-        const resolved = await getOrgForHost(input.hostId);
-        if (!resolved) return {
-            outcome: 'none',
-            reason: 'no-org'
-        };
-        const { orgId } = resolved;
-        const firestore = firebaseAdmin.app().firestore();
-        const orgRef = firestore.collection('orgs').doc(orgId);
-        const contactRef = orgRef.collection('contacts').doc(input.contactId);
-        const membersRef = orgRef.collection('members');
-        const leadKey = personKey(input.email);
-        // Beside the contact on the org, keyed by the same address (AGL-3275).
-        const leadRef = leadKey ? orgRef.collection('leads').doc(leadKey) : null;
-        let contactName = '';
-        const verdict = await firestore.runTransaction(async (tx)=>{
-            var _orgSnapshot_data, _contactSnapshot_data, _contact_name, _ref;
-            /*
-         * ALL READS BEFORE THE WRITE, which Firestore requires. The org
-         * document is read here rather than trusted from `getOrgForHost`,
-         * because the pointer it carries is the one thing a concurrent
-         * capture may have moved, and the rules and the pool are read from
-         * the same snapshot so the decision and the pointer agree.
-         */ const [orgSnapshot, contactSnapshot, leadSnapshot] = await Promise.all([
-                tx.get(orgRef),
-                tx.get(contactRef),
-                leadRef ? tx.get(leadRef) : Promise.resolve(null)
-            ]);
-            if (!contactSnapshot.exists) {
-                return {
-                    outcome: 'none',
-                    reason: 'no-contact'
-                };
-            }
-            const org = (_orgSnapshot_data = orgSnapshot.data()) != null ? _orgSnapshot_data : {};
-            const contact = (_contactSnapshot_data = contactSnapshot.data()) != null ? _contactSnapshot_data : {};
-            contactName = String((_contact_name = contact['name']) != null ? _contact_name : '');
-            const group = consentGroupForHost(org, input.hostId);
-            const facet = readContactFacet(contact, group.groupId);
-            const current = typeof facet.ownerUid === 'string' ? facet.ownerUid : '';
-            if (policy.kind === 'capture' && current) {
-                return {
-                    outcome: 'unchanged',
-                    ownerUid: current
-                };
-            }
-            const settings = readCrmAssignmentSettings(org);
-            // One read per candidate per attempt; a retried transaction reads
-            // afresh, as it must.
-            const onRoster = new Map();
-            const isMember = (uid)=>{
-                let known = onRoster.get(uid);
-                if (!known) {
-                    known = tx.get(membersRef.doc(uid)).then((snapshot)=>snapshot.exists);
-                    onRoster.set(uid, known);
-                }
-                return known;
-            };
-            const fromPool = async ()=>{
-                for (const uid of roundRobinOrder(settings.pool.memberUids, settings.pool.lastAssignedUid)){
-                    if (await isMember(uid)) return uid;
-                }
-                return null;
-            };
-            const resolveTarget = async (target)=>{
-                if ('roundRobin' in target) {
-                    const uid = await fromPool();
-                    return uid ? {
-                        uid,
-                        advancePointer: true
-                    } : null;
-                }
-                return await isMember(target.memberUid) ? {
-                    uid: target.memberUid,
-                    advancePointer: false
-                } : null;
-            };
-            let decision = null;
-            let refusal = 'no-rule';
-            if (policy.kind === 'capture') {
-                var _policy_input_formId, _policy_input_tags, _facet_tags;
-                const capture = {
-                    source: policy.input.source,
-                    email: input.email,
-                    formId: (_policy_input_formId = policy.input.formId) != null ? _policy_input_formId : null,
-                    tags: [
-                        ...(_policy_input_tags = policy.input.tags) != null ? _policy_input_tags : [],
-                        ...(_facet_tags = facet.tags) != null ? _facet_tags : []
-                    ]
-                };
-                for (const rule of settings.rules){
-                    if (!assignmentRuleMatches(rule.when, capture)) continue;
-                    const hit = await resolveTarget(rule.assign);
-                    if (hit) {
-                        decision = _extends({}, hit, {
-                            ownerUid: hit.uid,
-                            by: 'rule',
-                            ruleId: rule.id
-                        });
-                        break;
-                    }
-                }
-                const fallback = settings.hostDefaultOwners[input.hostId];
-                if (!decision && fallback && await isMember(fallback)) {
-                    decision = {
-                        ownerUid: fallback,
-                        by: 'default',
-                        advancePointer: false
-                    };
-                }
-            } else {
-                const { assign } = policy.input;
-                const hit = await resolveTarget(assign);
-                if (hit) {
-                    decision = _extends({}, hit, {
-                        ownerUid: hit.uid,
-                        by: 'roundRobin' in assign ? 'roundRobin' : 'member'
-                    });
-                } else {
-                    refusal = 'roundRobin' in assign ? 'empty-pool' : 'not-a-member';
-                }
-            }
-            if (!decision) return {
-                outcome: 'none',
-                reason: refusal
-            };
-            if (decision.ownerUid === current) {
-                return {
-                    outcome: 'unchanged',
-                    ownerUid: current
-                };
-            }
-            tx.update(contactRef, {
-                [contactFacetPath(group.groupId, 'ownerUid')]: decision.ownerUid,
-                updatedAt: FieldValue.serverTimestamp()
-            });
-            if (decision.advancePointer) {
-                tx.update(orgRef, {
-                    [CRM_ROUND_ROBIN_LAST_ASSIGNED_PATH]: decision.ownerUid
-                });
-            }
-            /*
-         * A lead somebody already assigned by hand keeps its owner on a
-         * capture — the contact was new, the lead may not have been — and
-         * follows the contact on a deliberate reassignment.
-         */ const leadOwner = String((_ref = leadSnapshot == null ? void 0 : leadSnapshot.get('ownerUid')) != null ? _ref : '');
-            const leadMirrored = Boolean((leadSnapshot == null ? void 0 : leadSnapshot.exists) && (policy.kind === 'reassign' || !leadOwner));
-            if (leadMirrored && leadRef) {
-                tx.update(leadRef, {
-                    ownerUid: decision.ownerUid,
-                    updatedAt: FieldValue.serverTimestamp()
-                });
-            }
-            return _extends({
-                outcome: 'assigned',
-                ownerUid: decision.ownerUid,
-                by: decision.by
-            }, decision.ruleId ? {
-                ruleId: decision.ruleId
-            } : {}, {
-                leadMirrored,
-                notified: false
-            });
-        });
-        if (verdict.outcome !== 'assigned') return verdict;
-        // The owner is what the Contacts list filters by (AGL-3321).
-        await restampCrmListFieldsAt(contactRef, 'contacts');
-        if (!verdict.leadMirrored && leadRef && policy.kind === 'capture' && LEAD_FILING_SOURCES.has(policy.input.source)) {
-            void mirrorOwnerOntoLeadLater(leadRef, verdict.ownerUid);
-        }
-        const notified = await notifyRecordAssigned({
-            hostId: input.hostId,
-            orgId,
-            ownerUid: verdict.ownerUid,
-            actorUid: input.actorUid,
-            record: verdict.leadMirrored && leadKey ? {
-                kind: 'lead',
-                id: leadKey
-            } : {
-                kind: 'contact',
-                id: input.contactId
-            },
-            who: contactName || input.email
-        });
-        return _extends({}, verdict, {
-            notified
-        });
-    } catch (error) {
-        console.error('assignContactOwner failed', input.hostId, input.contactId, error);
-        return {
-            outcome: 'none',
-            reason: 'failed'
-        };
-    }
-}
-/**
- * The detached second look for a lead that lands after the contact.
- *
- * Bounded, and only ever ADDS an owner: a lead that arrived with one (a
- * person assigned it in the meantime) is left alone, and a lead that never
- * arrives costs three reads over six seconds and nothing else. Detached
- * because the capture must not hold `contactCreated` back for it — an
- * automation welcoming the contact has nothing to do with the lead's owner
- * column.
- */ async function mirrorOwnerOntoLeadLater(leadRef, ownerUid, delaysMs = LEAD_MIRROR_RETRY_MS) {
-    for (const delay of delaysMs){
-        await new Promise((resolve)=>setTimeout(resolve, delay));
-        try {
-            var _lead_get;
-            const lead = await leadRef.get();
-            if (!lead.exists) continue;
-            if (String((_lead_get = lead.get('ownerUid')) != null ? _lead_get : '')) return false;
-            await leadRef.update({
-                ownerUid,
-                updatedAt: FieldValue.serverTimestamp()
-            });
-            return true;
-        } catch (error) {
-            console.error('assignContactOwner lead mirror failed', leadRef.path, error);
-            return false;
-        }
-    }
-    return false;
-}
-/**
- * The capture door's pass: the org's rules in order, then the capturing
- * site's default owner, on a record that has no owner yet. See the module
- * comment for the whole of it.
- */ export function assignOwnerForCapture(input) {
-    return assignOwner({
-        kind: 'capture',
-        input
-    });
-}
-/**
- * The deliberate assignment — the `assignContactOwner` step, and a person
- * handing a record to somebody: a member by uid (verified on the roster) or
- * the next in the round-robin pool, overwriting whoever held it. Naming the
- * owner the record already has changes nothing and tells nobody.
- */ export function reassignContactOwner(input) {
-    return assignOwner({
-        kind: 'reassign',
-        input
-    });
-}
-export default assignOwnerForCapture;
-
-//# sourceMappingURL=assign-contact-owner.js.map