@classytic/crm 0.8.0 → 1.0.0

package/dist/index.js

@@ -1,125 +1,38 @@
-import { t as __exportAll } from "./chunk.js";
+import { t as __exportAll } from "./rolldown-runtime.js";
+import { Repository, aggregateHelpersPlugin, appendOnlyPlugin, defineModels, isDuplicateKeyError, methodRegistryPlugin, multiTenantPlugin, withTransaction } from "@classytic/mongokit";
 import { Schema } from "mongoose";
-import { Repository, aggregateHelpersPlugin, isDuplicateKeyError, methodRegistryPlugin, multiTenantPlugin, withTransaction } from "@classytic/mongokit";
-import { createEvent as createEvent$1, matchEventPattern } from "@classytic/primitives/events";
-import { IllegalTransitionError, assertAndClaim, defineStateMachine } from "@classytic/primitives/state-machine";
+import { EmailFormatError, normalizeEmail } from "@classytic/contact/email";
+import { createEvent as createEvent$1 } from "@classytic/primitives/events";
+import { IllegalTransitionError, defineStateMachine } from "@classytic/primitives/state-machine";
 import { randomUUID } from "node:crypto";
+import { InProcessEventBus } from "@classytic/primitives/event-infra";
 import { z } from "zod";
 import { civilDateOf } from "@classytic/primitives/timezone";
 import { CURRENCY_PATTERN } from "@classytic/primitives/currency";
 import { appendStatus, lastTransitionTo, latestEntry, timeInStatus } from "@classytic/primitives/status-history";
-//#region src/core/errors.ts
+//#region src/engine/modules.ts
+const ALL_CRM_MODULES = Object.freeze({
+	sales: true,
+	engagement: true,
+	automation: true
+});
 /**
-* CRM error vocabulary. Hosts catch `CrmError` at API edges.
+* Resolve module dependencies once at boot.
+*
+* Omitting `modules` preserves the pre-module package behaviour (everything
+* enabled). Supplying it is opt-in: unspecified modules are disabled.
 */
-var CrmError = class extends Error {
-	code;
-	details;
-	constructor(code, message, details) {
-		super(message);
-		this.name = "CrmError";
-		this.code = code;
-		if (details !== void 0) this.details = details;
-	}
-};
-var NotFoundError = class extends CrmError {
-	constructor(kind, id) {
-		super(`${kind.toUpperCase()}_NOT_FOUND`, `${kind} '${id}' not found`, {
-			kind,
-			id
-		});
-	}
-};
-var InvalidLeadTransitionError = class extends CrmError {
-	constructor(details) {
-		super("INVALID_LEAD_TRANSITION", `Lead ${details.leadId} cannot move from '${details.from}' to '${details.to}'`, details);
-	}
-};
-var InvalidOpportunityTransitionError = class extends CrmError {
-	constructor(details) {
-		super("INVALID_OPPORTUNITY_TRANSITION", `Opportunity ${details.opportunityId} cannot move from '${details.from}' to '${details.to}'`, details);
-	}
-};
-var InvalidActivityTransitionError = class extends CrmError {
-	constructor(details) {
-		super("INVALID_ACTIVITY_TRANSITION", `Activity ${details.activityId} cannot move from '${details.from}' to '${details.to}'`, details);
-	}
-};
-var StageNotInPipelineError = class extends CrmError {
-	constructor(details) {
-		super("STAGE_NOT_IN_PIPELINE", `Stage '${details.stageId}' is not defined on pipeline '${details.pipelineId}'`, details);
-	}
-};
-var LeadAlreadyConvertedError = class extends CrmError {
-	constructor(leadId) {
-		super("LEAD_ALREADY_CONVERTED", `Lead '${leadId}' is already converted`, { leadId });
-	}
-};
-var DuplicateLeadError = class extends CrmError {
-	constructor(details) {
-		super("DUPLICATE_LEAD", `A lead with this email / phone already exists`, details);
-	}
-};
-var UnmanagedSessionError = class extends CrmError {
-	constructor(eventType) {
-		super("UNMANAGED_SESSION", "ctx.session was provided but no event delivery path exists — inside a host-owned transaction the event would either leak to subscribers before commit or be lost on rollback. Use engine.withTransaction(ctx, fn), wire CrmConfig.outbox, or attach a ctx[PENDING_EVENTS] queue and call flushPending() after commit (PACKAGE_RULES §P8.1).", eventType !== void 0 ? { eventType } : void 0);
-	}
-};
-var CrmModelCollisionError = class extends CrmError {
-	constructor(modelName) {
-		super("CRM_MODEL_COLLISION", `Mongoose model '${modelName}' is already registered on this connection. Another engine (or a hot reload) owns it. Pass { forceRecreate: true } to createCrm() for test/hot-reload fixtures, or use a separate mongoose connection per engine in production (PACKAGE_RULES §21).`, { modelName });
-	}
-};
-var EmptyPipelineError = class extends CrmError {
-	constructor(pipelineId) {
-		super("EMPTY_PIPELINE", `Pipeline '${pipelineId}' has no stages`, { pipelineId });
-	}
-};
-var InvalidCampaignTransitionError = class extends CrmError {
-	constructor(details) {
-		super("INVALID_CAMPAIGN_TRANSITION", `Campaign ${details.campaignId} cannot move from '${details.from}' to '${details.to}'`, details);
-	}
-};
-var DuplicateCampaignError = class extends CrmError {
-	constructor(name) {
-		super("DUPLICATE_CAMPAIGN", `A campaign named '${name}' already exists`, { name });
-	}
-};
-var InvalidSubscriptionTransitionError = class extends CrmError {
-	constructor(details) {
-		super("INVALID_SUBSCRIPTION_TRANSITION", `Subscription ${details.subscriptionId} cannot move from '${details.from}' to '${details.to}'`, details);
-	}
-};
-var DuplicateSubscriptionError = class extends CrmError {
-	constructor(details) {
-		super("DUPLICATE_SUBSCRIPTION", `Contact '${details.contactId}' already has a live subscription on campaign '${details.campaignId}'`, details);
-	}
-};
-var InvalidConfirmationTokenError = class extends CrmError {
-	constructor() {
-		super("INVALID_CONFIRMATION_TOKEN", "No subscription matches the supplied confirmation token, or it has already been used");
-	}
-};
-var InvalidUnsubscribeTokenError = class extends CrmError {
-	constructor() {
-		super("INVALID_UNSUBSCRIBE_TOKEN", "No subscription matches the supplied unsubscribe token");
-	}
-};
-var InvalidSequenceTransitionError = class extends CrmError {
-	constructor(details) {
-		super("INVALID_SEQUENCE_TRANSITION", `Sequence ${details.sequenceId} cannot move from '${details.from}' to '${details.to}'`, details);
-	}
-};
-var InvalidEnrollmentTransitionError = class extends CrmError {
-	constructor(details) {
-		super("INVALID_ENROLLMENT_TRANSITION", `Enrollment ${details.enrollmentId} cannot move from '${details.from}' to '${details.to}'`, details);
-	}
-};
-var AlreadyEnrolledError = class extends CrmError {
-	constructor(details) {
-		super("ALREADY_ENROLLED", `Subject '${details.subjectId}' already has an active enrollment in sequence '${details.sequenceId}'`, details);
-	}
-};
+function resolveCrmModules(modules) {
+	if (modules === void 0) return ALL_CRM_MODULES;
+	const automation = modules.automation === true;
+	const engagement = modules.engagement === true || automation;
+	const sales = modules.sales === true || engagement;
+	return Object.freeze({
+		sales,
+		engagement,
+		automation
+	});
+}
 //#endregion
 //#region src/models/tenant-field.ts
 /**
@@ -130,6 +43,9 @@ var AlreadyEnrolledError = class extends CrmError {
 * `.populate()`, QueryParser `?lookup=organizationId`); hosts with
 * UUID/slug auth pick `'string'`.
 */
+function crmModelName(config, base) {
+	return `${config.modelPrefix ?? ""}${base}`;
+}
 /**
 * Tenant-column schema definition. Use this anywhere a model has
 * `organizationId` — never write the raw type in a schema file.
@@ -275,6 +191,316 @@ function canTransitionLead(from, to) {
 	return LEAD_TRANSITIONS[from].includes(to);
 }
 //#endregion
+//#region src/core/errors.ts
+/**
+* `status` makes every CRM throwable satisfy `HttpError` from
+* `@classytic/repo-core/errors` (PACKAGE_RULES "Errors and wire envelopes"),
+* so arc's global handler serializes it natively with the right code AND the
+* right status — no per-host `errorMapper`. Without it every CRM error
+* reached the client as `arc.internal_error` / 500: `NotFoundError` answered
+* 500 instead of 404, which tells a caller "the server broke" when the truth
+* was "that lead doesn't exist".
+*
+* Defaults to 422 (well-formed request, violates a domain invariant) —
+* the common case here. Subclasses override with `readonly status = N`;
+* the subclass field initializer runs after this constructor, so it wins.
+*/
+var CrmError = class extends Error {
+	code;
+	status = 422;
+	details;
+	constructor(code, message, details) {
+		super(message);
+		this.name = "CrmError";
+		this.code = code;
+		if (details !== void 0) this.details = details;
+	}
+};
+var NotFoundError = class extends CrmError {
+	status = 404;
+	constructor(kind, id) {
+		super(`${kind.toUpperCase()}_NOT_FOUND`, `${kind} '${id}' not found`, {
+			kind,
+			id
+		});
+	}
+};
+var InvalidLeadTransitionError = class extends CrmError {
+	status = 422;
+	constructor(details) {
+		super("INVALID_LEAD_TRANSITION", `Lead ${details.leadId} cannot move from '${details.from}' to '${details.to}'`, details);
+	}
+};
+var InvalidOpportunityTransitionError = class extends CrmError {
+	status = 422;
+	constructor(details) {
+		super("INVALID_OPPORTUNITY_TRANSITION", `Opportunity ${details.opportunityId} cannot move from '${details.from}' to '${details.to}'`, details);
+	}
+};
+var InvalidActivityTransitionError = class extends CrmError {
+	status = 422;
+	constructor(details) {
+		super("INVALID_ACTIVITY_TRANSITION", `Activity ${details.activityId} cannot move from '${details.from}' to '${details.to}'`, details);
+	}
+};
+var StageNotInPipelineError = class extends CrmError {
+	status = 422;
+	constructor(details) {
+		super("STAGE_NOT_IN_PIPELINE", `Stage '${details.stageId}' is not defined on pipeline '${details.pipelineId}'`, details);
+	}
+};
+var LeadAlreadyConvertedError = class extends CrmError {
+	status = 409;
+	constructor(leadId) {
+		super("LEAD_ALREADY_CONVERTED", `Lead '${leadId}' is already converted`, { leadId });
+	}
+};
+var DuplicateLeadError = class extends CrmError {
+	status = 409;
+	constructor(details) {
+		super("DUPLICATE_LEAD", `A lead with this email / phone already exists`, details);
+	}
+};
+var DuplicateContactError = class extends CrmError {
+	status = 409;
+	constructor(details) {
+		super("DUPLICATE_CONTACT", `A contact with email '${details.email}' already exists in this organization`, details);
+	}
+};
+var UnmanagedSessionError = class extends CrmError {
+	status = 500;
+	constructor(eventType) {
+		super("UNMANAGED_SESSION", "ctx.session was provided but no event delivery path exists — inside a host-owned transaction the event would either leak to subscribers before commit or be lost on rollback. Use engine.withTransaction(ctx, fn), wire the `outbox` runtime option, or attach a ctx[PENDING_EVENTS] queue and call flushPending() after commit (PACKAGE_RULES §P8.1).", eventType !== void 0 ? { eventType } : void 0);
+	}
+};
+var EmptyPipelineError = class extends CrmError {
+	status = 422;
+	constructor(pipelineId) {
+		super("EMPTY_PIPELINE", `Pipeline '${pipelineId}' has no stages`, { pipelineId });
+	}
+};
+var InvalidCampaignTransitionError = class extends CrmError {
+	status = 422;
+	constructor(details) {
+		super("INVALID_CAMPAIGN_TRANSITION", `Campaign ${details.campaignId} cannot move from '${details.from}' to '${details.to}'`, details);
+	}
+};
+var DuplicateCampaignError = class extends CrmError {
+	status = 409;
+	constructor(name) {
+		super("DUPLICATE_CAMPAIGN", `A campaign named '${name}' already exists`, { name });
+	}
+};
+var InvalidSubscriptionTransitionError = class extends CrmError {
+	status = 422;
+	constructor(details) {
+		super("INVALID_SUBSCRIPTION_TRANSITION", `Subscription ${details.subscriptionId} cannot move from '${details.from}' to '${details.to}'`, details);
+	}
+};
+var DuplicateSubscriptionError = class extends CrmError {
+	status = 409;
+	constructor(details) {
+		super("DUPLICATE_SUBSCRIPTION", `Contact '${details.contactId}' already has a live subscription on campaign '${details.campaignId}'`, details);
+	}
+};
+var InvalidConfirmationTokenError = class extends CrmError {
+	status = 422;
+	constructor() {
+		super("INVALID_CONFIRMATION_TOKEN", "No subscription matches the supplied confirmation token, or it has already been used");
+	}
+};
+var InvalidUnsubscribeTokenError = class extends CrmError {
+	status = 422;
+	constructor() {
+		super("INVALID_UNSUBSCRIBE_TOKEN", "No subscription matches the supplied unsubscribe token");
+	}
+};
+var InvalidSequenceTransitionError = class extends CrmError {
+	status = 422;
+	constructor(details) {
+		super("INVALID_SEQUENCE_TRANSITION", `Sequence ${details.sequenceId} cannot move from '${details.from}' to '${details.to}'`, details);
+	}
+};
+var InvalidEnrollmentTransitionError = class extends CrmError {
+	status = 422;
+	constructor(details) {
+		super("INVALID_ENROLLMENT_TRANSITION", `Enrollment ${details.enrollmentId} cannot move from '${details.from}' to '${details.to}'`, details);
+	}
+};
+var AlreadyEnrolledError = class extends CrmError {
+	status = 409;
+	constructor(details) {
+		super("ALREADY_ENROLLED", `Subject '${details.subjectId}' already has an active enrollment in sequence '${details.sequenceId}'`, details);
+	}
+};
+/**
+* An address handed to a suppression-list WRITE could not be canonicalised.
+*
+* 400, not 422 — the request itself is malformed at the field, no domain
+* invariant was consulted. This is `@classytic/contact`'s `EmailFormatError`
+* re-thrown as a CRM error so arc serializes it natively; the same shape party
+* uses for `PartyPhoneFormatError`. `contact` sits below every domain kernel
+* and knows nothing about HTTP, so the mapping has to happen here.
+*
+* Only WRITES throw. Reads fail closed instead — see
+* `suppression.repository.ts`, which writes the asymmetry down.
+*/
+var SuppressionEmailFormatError = class extends CrmError {
+	status = 400;
+	constructor(details) {
+		super("SUPPRESSION_EMAIL_INVALID", `'${details.email}' cannot be canonicalised as an email address (${details.reason}), so it is NOT written to the suppression list. A malformed entry stored verbatim is a do-not-contact record that can never match a send — it suppresses nothing and reports success.`, details);
+	}
+};
+/**
+* An address handed to `LeadRepository.createLead` could not be canonicalised.
+*
+* 400, same shape and same reason as `SuppressionEmailFormatError`: the field is
+* malformed, no domain invariant was consulted. Thrown from
+* `core/email-identity.ts`, which owns the write-throws / setter-degrades
+* asymmetry and writes down why each side goes the way it does.
+*/
+var LeadEmailFormatError = class extends CrmError {
+	status = 400;
+	constructor(details) {
+		super("LEAD_EMAIL_INVALID", `'${details.email}' cannot be canonicalised as an email address (${details.reason}), so no lead is created. Stored verbatim it would defeat the (organizationId, email) unique index it is supposed to arm — uncanonicalisable spellings never collide, so the same broken address inserts without limit while every call reports success.`, details);
+	}
+};
+/** As {@link LeadEmailFormatError}, for `ContactRepository.createContact`. */
+var ContactEmailFormatError = class extends CrmError {
+	status = 400;
+	constructor(details) {
+		super("CONTACT_EMAIL_INVALID", `'${details.email}' cannot be canonicalised as an email address (${details.reason}), so no contact is created. A contact whose only identity field is unusable cannot be deduped, contacted, or matched against a suppression list.`, details);
+	}
+};
+//#endregion
+//#region src/core/email-identity.ts
+/**
+* WHERE the email key rule is applied inside CRM. **Not a second copy of the
+* rule** — the rule is `normalizeEmail` from `@classytic/contact/email`, imported
+* directly here as it is in `suppression.repository.ts`. What this module owns is
+* the two things a shared kernel cannot decide for us: which mongoose fields carry
+* the key, and what happens when the kernel refuses an input.
+*
+* It exists as a module rather than a copy-paste because Lead and Contact both
+* carry an email identity. Two schemas hand-rolling the same setter is the drift
+* this package already paid for once.
+*
+* ## Why the SETTER, and not only the repository verbs
+*
+* `LeadRepository.createLead` / `ContactRepository.createContact` are NOT on the
+* HTTP path. `@spinekit/crm` mounts both resources through arc's mongoose CRUD
+* adapter, so `POST /crm/leads` calls the inherited `Repository.create()` and the
+* verbs' pre-check never runs. A fix that lived only on the verbs would leave the
+* live route forking one mailbox into two rows, and the tests for the verbs would
+* be green while it did.
+*
+* The narrowest boundary EVERY write must cross is the schema field, so the key
+* rule is applied there. That is also what makes the partial-unique
+* `(organizationId, email)` index authoritative: an index can only dedup what the
+* key already folded, and `lowercase: true` does not IDNA-fold. `ada@bücher.de`
+* and `ada@xn--bcher-kva.de` are one host in two encodings — the index saw two
+* strings and admitted both, no error, one mailbox as two leads.
+*
+* Mongoose runs string setters on QUERY FILTERS as well as on writes (this is why
+* `lowercase: true` already made `getOne({ email: 'ADA@x.com' })` match a stored
+* `ada@x.com`), so the setter fixes the read side in the same stroke. The
+* repository verbs still canonicalise EXPLICITLY before querying — see
+* `requireLeadEmailKey`'s call sites. That is not redundancy for its own sake:
+* a pre-check that depends on an invisible schema option silently WIDENS the day
+* someone edits the field, and a widened filter does not fail, it matches nothing
+* and reports "no duplicate".
+*
+* ## The setter must NEVER throw, and it does not
+*
+* A throw inside a setter surfaces during query casting as an opaque `CastError`,
+* which would turn a malformed filter into a 500 on a READ. So the setter degrades
+* to the LEGACY folding (`trim().toLowerCase()`) for anything the kernel refuses —
+* exactly the behaviour those values have today, so nothing already stored is
+* re-keyed by a rule that cannot explain itself.
+*
+* Refusing is the WRITE VERBS' job, where a typed 400 can be thrown and the caller
+* is a deliberate domain call rather than a filter. Same asymmetry, same reason as
+* `suppression.repository.ts`: the safe direction differs per side.
+*/
+/**
+* The canonical key for `email`, or `null` when it has none.
+*
+* Exported so a host can tell "not on file" apart from "not an address" without
+* re-deriving the rule — the same reason `suppressionEmailKey` is exported.
+*/
+function crmEmailKey(email) {
+	try {
+		return normalizeEmail(email);
+	} catch (err) {
+		if (err instanceof EmailFormatError) return null;
+		throw err;
+	}
+}
+/**
+* Mongoose setter for every field holding an email IDENTITY (one that a unique
+* index or a dedup pre-check reads). Canonicalises what it can; falls back to the
+* legacy fold for what it cannot. Never throws — see the module docblock.
+*
+* Non-strings pass through untouched: `anonymize()` writes `null` to clear the
+* field, and a canonicaliser that coerced that to `''` would put the row back in
+* the partial-unique index it was meant to leave.
+*/
+function canonicalEmailSetter(value) {
+	if (typeof value !== "string") return value;
+	return crmEmailKey(value) ?? value.trim().toLowerCase();
+}
+/**
+* The canonical key for a Lead's email, or a 400.
+*
+* `createLead` is a WRITE, and a lead keyed by an address that is not an address
+* defeats the guard it is supposed to arm: uncanonicalisable spellings never
+* collide with each other, so the `(organizationId, email)` unique index admits
+* the same broken input without limit while reporting success on every insert.
+* The row also cannot be contacted, matched against a suppression list, or merged
+* later — it is a duplicate factory that looks like a lead.
+*
+* Reachability, checked rather than assumed: be-prod gates the CRM write
+* permission with `requireAuth()` (`be-prod/src/modules/sales/crm.module.ts`), and
+* there is no public lead-capture route in this repo — so this 400 reaches an
+* authenticated operator or an importer, never an anonymous form visitor. If a
+* deployment ever puts a public form in front of `POST /crm/leads`, note that the
+* arc-CRUD route does NOT reach this function at all (see the module docblock);
+* that route's leniency is deliberate and separate.
+*/
+function requireLeadEmailKey(email) {
+	try {
+		return normalizeEmail(email);
+	} catch (err) {
+		if (err instanceof EmailFormatError) throw new LeadEmailFormatError({
+			email,
+			reason: err.code
+		});
+		throw err;
+	}
+}
+/**
+* The canonical key for a Contact's email, or a 400. Same rationale as
+* {@link requireLeadEmailKey}.
+*
+* One extra caller worth naming: `LeadService.convert()` passes the lead's stored
+* email straight into `createContact`, so converting a lead whose address cannot
+* be canonicalised now FAILS instead of minting a Contact whose only identity
+* field is unusable. That is a deliberate behaviour change — the alternative
+* (dropping the address during convert) creates a Contact the operator believes
+* carries the lead's email and which silently does not.
+*/
+function requireContactEmailKey(email) {
+	try {
+		return normalizeEmail(email);
+	} catch (err) {
+		if (err instanceof EmailFormatError) throw new ContactEmailFormatError({
+			email,
+			reason: err.code
+		});
+		throw err;
+	}
+}
+//#endregion
 //#region src/models/lead.schema.ts
 /**
 * Lead — top-of-funnel inquiry, pre-qualification.
@@ -332,8 +558,7 @@ function buildLeadSchema(config) {
 		},
 		email: {
 			type: String,
-			trim: true,
-			lowercase: true,
+			set: canonicalEmailSetter,
 			maxlength: 255
 		},
 		phone: {
@@ -389,15 +614,15 @@ function buildLeadSchema(config) {
 		},
 		convertedContactId: {
 			type: Schema.Types.ObjectId,
-			ref: "Contact"
+			ref: crmModelName(config, "Contact")
 		},
 		convertedAccountId: {
 			type: Schema.Types.ObjectId,
-			ref: "Account"
+			ref: crmModelName(config, "Account")
 		},
 		convertedOpportunityId: {
 			type: Schema.Types.ObjectId,
-			ref: "Opportunity"
+			ref: crmModelName(config, "Opportunity")
 		},
 		convertedAt: { type: Date },
 		disqualifyReason: {
@@ -405,6 +630,7 @@ function buildLeadSchema(config) {
 			trim: true,
 			maxlength: 500
 		},
+		anonymizedAt: { type: Date },
 		metadata: { type: Schema.Types.Mixed }
 	}, { timestamps: true });
 	schema.index({
@@ -488,15 +714,15 @@ function buildOpportunitySchema(config) {
 		},
 		accountId: {
 			type: Schema.Types.ObjectId,
-			ref: "Account"
+			ref: crmModelName(config, "Account")
 		},
 		primaryContactId: {
 			type: Schema.Types.ObjectId,
-			ref: "Contact"
+			ref: crmModelName(config, "Contact")
 		},
 		pipelineId: {
 			type: Schema.Types.ObjectId,
-			ref: "Pipeline",
+			ref: crmModelName(config, "Pipeline"),
 			required: true
 		},
 		stageId: {
@@ -532,7 +758,7 @@ function buildOpportunitySchema(config) {
 		closedAt: { type: Date },
 		lostReasonId: {
 			type: Schema.Types.ObjectId,
-			ref: "LossReason"
+			ref: crmModelName(config, "LossReason")
 		},
 		ownerId: {
 			type: String,
@@ -540,7 +766,7 @@ function buildOpportunitySchema(config) {
 		},
 		sourceLeadId: {
 			type: Schema.Types.ObjectId,
-			ref: "Lead"
+			ref: crmModelName(config, "Lead")
 		},
 		tags: {
 			type: [String],
@@ -617,14 +843,12 @@ const nameSchema = new Schema({
 const contactInfoSchema$1 = new Schema({
 	email: {
 		type: String,
-		trim: true,
-		lowercase: true,
+		set: canonicalEmailSetter,
 		maxlength: 255
 	},
 	personalEmail: {
 		type: String,
-		trim: true,
-		lowercase: true,
+		set: canonicalEmailSetter,
 		maxlength: 255
 	},
 	phone: {
@@ -676,7 +900,7 @@ function buildContactSchema(config) {
 		},
 		accountId: {
 			type: Schema.Types.ObjectId,
-			ref: "Account"
+			ref: crmModelName(config, "Account")
 		},
 		ownerId: {
 			type: String,
@@ -686,7 +910,8 @@ function buildContactSchema(config) {
 			type: [String],
 			default: []
 		},
-		metadata: { type: Schema.Types.Mixed }
+		metadata: { type: Schema.Types.Mixed },
+		anonymizedAt: { type: Date }
 	}, {
 		timestamps: true,
 		toJSON: { virtuals: true },
@@ -695,6 +920,9 @@ function buildContactSchema(config) {
 	schema.index({
 		organizationId: 1,
 		"contact.email": 1
+	}, {
+		unique: true,
+		partialFilterExpression: { "contact.email": { $type: "string" } }
 	});
 	schema.index({
 		organizationId: 1,
@@ -991,12 +1219,12 @@ function buildSubscriptionSchema(config) {
 		organizationId: tenantFieldDef(config),
 		contactId: {
 			type: Schema.Types.ObjectId,
-			ref: "Contact",
+			ref: crmModelName(config, "Contact"),
 			required: true
 		},
 		campaignId: {
 			type: Schema.Types.ObjectId,
-			ref: "Campaign",
+			ref: crmModelName(config, "Campaign"),
 			required: true
 		},
 		status: {
@@ -1455,7 +1683,7 @@ function buildEmailEventSchema(config) {
 		},
 		campaignId: {
 			type: Schema.Types.ObjectId,
-			ref: "Campaign",
+			ref: crmModelName(config, "Campaign"),
 			index: true
 		},
 		messageId: {
@@ -1665,7 +1893,7 @@ function buildMessageSchema(config) {
 		organizationId: tenantFieldDef(config),
 		conversationId: {
 			type: Schema.Types.ObjectId,
-			ref: "Conversation",
+			ref: crmModelName(config, "Conversation"),
 			required: true,
 			index: true
 		},
@@ -1719,7 +1947,7 @@ function buildMessageSchema(config) {
 		partialFilterExpression: { externalMessageId: { $type: "string" } }
 	});
 	schema.index({ sentAt: 1 }, {
-		expireAfterSeconds: 365 * 24 * 60 * 60,
+		expireAfterSeconds: 31536e3,
 		sparse: true,
 		name: "sentAt_ttl"
 	});
@@ -1913,7 +2141,7 @@ function buildEnrollmentSchema(config) {
 		sequenceId: {
 			type: config.tenantFieldType === "objectId" ? Schema.Types.ObjectId : String,
 			required: true,
-			ref: "Sequence"
+			ref: crmModelName(config, "Sequence")
 		},
 		subjectKind: {
 			type: String,
@@ -1988,7 +2216,20 @@ function buildEnrollmentSchema(config) {
 }
 //#endregion
 //#region src/models/create-models.ts
-/** Mongoose model names this package registers — drives the §21 collision check. */
+/**
+* CRM model specification — the ONE authoritative place the CRM model set is
+* described (Kernel Construction Standard §5/§6).
+*
+* `defineCrmModels(config)` returns a connection-free mongokit `ModelBlueprint`;
+* `defineCrm` binds it during engine construction. Optional model families
+* (sales / engagement / automation) become CONDITIONAL `ModelSpec` entries — a
+* disabled module contributes no spec, so it registers no model (invariant §11.10).
+*
+* Collision handling, auto-index and the tenant-column shape live here once.
+* A name collision surfaces as mongokit's typed `ModelCollisionError` — there is
+* no CRM-specific collision error.
+*/
+/** Mongoose model names this package can register (before `modelPrefix`). Reference/documentation. */
 const CRM_MODEL_NAMES = [
 	"Pipeline",
 	"Lead",
@@ -2007,34 +2248,132 @@ const CRM_MODEL_NAMES = [
 	"Sequence",
 	"Enrollment"
 ];
-function createCrmModels(connection, config) {
-	const forceRecreate = config.forceRecreate ?? false;
+/**
+* Describe the CRM model set as a connection-free blueprint. Pure — builds no
+* schema and registers nothing until `.bind(connection)`. Only the enabled
+* module families contribute `ModelSpec` entries.
+*/
+function defineCrmModels(config) {
 	const autoIndex = config.autoIndex ?? true;
-	const namesToCheck = [...CRM_MODEL_NAMES, "Subscription"];
-	if (forceRecreate) {
-		for (const name of namesToCheck) if (connection.models[name]) connection.deleteModel(name);
-	} else for (const name of CRM_MODEL_NAMES) if (connection.models[name]) throw new CrmModelCollisionError(name);
-	const register = (name, schema) => {
-		schema.set("autoIndex", autoIndex);
-		return connection.model(name, schema);
-	};
-	return Object.freeze({
-		Pipeline: register("Pipeline", buildPipelineSchema(config)),
-		Lead: register("Lead", buildLeadSchema(config)),
-		Opportunity: register("Opportunity", buildOpportunitySchema(config)),
-		Contact: register("Contact", buildContactSchema(config)),
-		Account: register("Account", buildAccountSchema(config)),
-		Campaign: register("Campaign", buildCampaignSchema(config)),
-		Subscription: register("EmailSubscription", buildSubscriptionSchema(config)),
-		Suppression: register("Suppression", buildSuppressionSchema(config)),
-		Activity: register("Activity", buildActivitySchema(config)),
-		Note: register("Note", buildNoteSchema(config)),
-		LossReason: register("LossReason", buildLossReasonSchema(config)),
-		EmailEvent: register("EmailEvent", buildEmailEventSchema(config)),
-		Conversation: register("Conversation", buildConversationSchema(config)),
-		Message: register("Message", buildMessageSchema(config)),
-		Sequence: register("Sequence", buildSequenceSchema(config)),
-		Enrollment: register("Enrollment", buildEnrollmentSchema(config))
+	const existing = config.forceRecreate ? {
+		mode: "replace",
+		environment: "test"
+	} : { mode: "throw" };
+	const salesEntries = [
+		{
+			key: "Pipeline",
+			baseName: "Pipeline",
+			build: buildPipelineSchema
+		},
+		{
+			key: "Lead",
+			baseName: "Lead",
+			build: buildLeadSchema
+		},
+		{
+			key: "Opportunity",
+			baseName: "Opportunity",
+			build: buildOpportunitySchema
+		},
+		{
+			key: "Contact",
+			baseName: "Contact",
+			build: buildContactSchema
+		},
+		{
+			key: "Account",
+			baseName: "Account",
+			build: buildAccountSchema
+		},
+		{
+			key: "Activity",
+			baseName: "Activity",
+			build: buildActivitySchema
+		},
+		{
+			key: "Note",
+			baseName: "Note",
+			build: buildNoteSchema
+		},
+		{
+			key: "LossReason",
+			baseName: "LossReason",
+			build: buildLossReasonSchema
+		}
+	];
+	const engagementEntries = [
+		{
+			key: "Subscription",
+			baseName: "EmailSubscription",
+			build: buildSubscriptionSchema
+		},
+		{
+			key: "Suppression",
+			baseName: "Suppression",
+			build: buildSuppressionSchema
+		},
+		{
+			key: "EmailEvent",
+			baseName: "EmailEvent",
+			build: buildEmailEventSchema
+		},
+		{
+			key: "Conversation",
+			baseName: "Conversation",
+			build: buildConversationSchema
+		},
+		{
+			key: "Message",
+			baseName: "Message",
+			build: buildMessageSchema
+		}
+	];
+	const automationEntries = [
+		{
+			key: "Campaign",
+			baseName: "Campaign",
+			build: buildCampaignSchema
+		},
+		{
+			key: "Sequence",
+			baseName: "Sequence",
+			build: buildSequenceSchema
+		},
+		{
+			key: "Enrollment",
+			baseName: "Enrollment",
+			build: buildEnrollmentSchema
+		}
+	];
+	const entries = [
+		...config.modules.sales ? salesEntries : [],
+		...config.modules.engagement ? engagementEntries : [],
+		...config.modules.automation ? automationEntries : []
+	];
+	const keyByRegistryName = /* @__PURE__ */ new Map();
+	const specs = entries.map((entry) => {
+		const name = crmModelName(config, entry.baseName);
+		keyByRegistryName.set(name, entry.key);
+		return {
+			name,
+			schema: () => {
+				const schema = entry.build(config);
+				schema.set("autoIndex", autoIndex);
+				return schema;
+			},
+			existing
+		};
+	});
+	return defineModels({
+		models: specs,
+		assemble: (models) => {
+			const bag = {};
+			for (const [name, key] of keyByRegistryName) {
+				const model = models.get(name);
+				if (model) bag[key] = model;
+			}
+			return Object.freeze(bag);
+		}
 	});
 }
 //#endregion
@@ -2090,9 +2429,11 @@ const CRM_EVENTS = {
 	EMAIL_EVENT_UNSUBSCRIBED: "crm:email_event.unsubscribed",
 	LEAD_ENRICHED: "crm:lead.enriched",
 	LEAD_ASSIGNED: "crm:lead.assigned",
+	LEAD_ANONYMIZED: "crm:lead.anonymized",
 	CONTACT_ENRICHED: "crm:contact.enriched",
 	CONTACT_ASSIGNED: "crm:contact.assigned",
 	CONTACT_MERGED: "crm:contact.merged",
+	CONTACT_ANONYMIZED: "crm:contact.anonymized",
 	ACCOUNT_ENRICHED: "crm:account.enriched",
 	ACCOUNT_ASSIGNED: "crm:account.assigned",
 	ACCOUNT_MERGED: "crm:account.merged",
@@ -2293,6 +2634,19 @@ function composeScorers(...rules) {
 	return (lead) => rules.reduce((acc, r) => acc + r(lead), 0);
 }
 //#endregion
+//#region src/repositories/transition-support.ts
+/**
+* mongokit `applyTransition()` race-outcome detection — pure races /
+* vanished rows remap to each verb's historical error (typed transition
+* error built from a fresh read, or NotFound where that was the
+* contract); now-illegal races throw the machine's errorFactory error
+* with the on-disk status natively.
+*/
+function isTransitionRace(err) {
+	const code = err?.code;
+	return code === "TRANSITION_RACE_LOST" || code === "TRANSITION_TARGET_MISSING";
+}
+//#endregion
 //#region src/repositories/lead.repository.ts
 /** signal → engagement counter field. */
 const ENGAGEMENT_COUNTER = {
@@ -2315,15 +2669,22 @@ var LeadRepository = class extends Repository {
 	* Create a Lead. Auto-scores on insert so hosts can route immediately.
 	* Rejects duplicate emails inside the same tenant unless
 	* `rejectDuplicates: false` was set at engine boot.
+	*
+	* Throws `LeadEmailFormatError` (400) on an email that cannot be canonicalised
+	* — nothing is written. The reason lives beside the helper in
+	* `core/email-identity.ts`, which also explains why the SCHEMA setter degrades
+	* where this verb refuses.
 	*/
 	async createLead(input, ctx) {
-		if (this.rejectDuplicates && input.email) {
-			if (await this.getOne({ email: input.email }, ctx)) throw new DuplicateLeadError({ email: input.email });
+		const email = input.email === void 0 ? void 0 : requireLeadEmailKey(input.email);
+		if (this.rejectDuplicates && email) {
+			if (await this.getOne({ email }, ctx)) throw new DuplicateLeadError({ email });
 		}
 		const now = /* @__PURE__ */ new Date();
-		const computedFullName = input.fullName ?? ([input.firstName, input.lastName].filter(Boolean).join(" ").trim() || input.email || input.phone);
+		const computedFullName = input.fullName ?? ([input.firstName, input.lastName].filter(Boolean).join(" ").trim() || email || input.phone);
 		const draft = {
 			...input,
+			...email !== void 0 ? { email } : {},
 			status: input.status ?? "new",
 			score: 0,
 			statusHistory: [{
@@ -2336,7 +2697,7 @@ var LeadRepository = class extends Repository {
 		try {
 			created = await this.create(draft, ctx);
 		} catch (err) {
-			if (this.rejectDuplicates && input.email && isDuplicateKeyError(err)) throw new DuplicateLeadError({ email: input.email });
+			if (this.rejectDuplicates && email && isDuplicateKeyError(err)) throw new DuplicateLeadError({ email });
 			throw err;
 		}
 		const score = this.scorer(created);
@@ -2451,6 +2812,67 @@ var LeadRepository = class extends Repository {
 		}, ctx));
 		return updated;
 	}
+	/**
+	* The `converted` hop, owned by `LeadService.convert()` (the only caller
+	* — the four cross-repo writes make it a service concern). Kept on the
+	* repo so the atomic state write goes through `applyTransition` — a
+	* machine-guarded CAS that `$push`es the history entry instead of
+	* read-then-replacing the whole `statusHistory` array (no lost-update
+	* window). Deliberately emits NO `lead.status_changed`: `lead.converted`
+	* is the canonical signal for this transition and is dispatched by the
+	* service alongside the cross-repo refs.
+	*/
+	async markConverted(id, from, patch, entry, ctx) {
+		return await this.applyTransition(id, LEAD_MACHINE, {
+			from,
+			to: "converted",
+			set: patch,
+			push: { statusHistory: entry },
+			history: false
+		}, ctx).catch(async (err) => {
+			if (!isTransitionRace(err)) throw err;
+			throw new InvalidLeadTransitionError({
+				from: (await this.getById(id, ctx))?.status ?? from,
+				to: "converted",
+				leadId: id
+			});
+		});
+	}
+	/**
+	* GDPR right-to-erasure for a Lead. Scrubs the PII fields
+	* (`fullName`/`firstName`/`lastName`/`email`/`phone`) in place while
+	* preserving non-PII aggregates (`score`, `status`, `statusHistory`,
+	* `engagement`, firmographic `companyName`/`source`) and the id. Sets
+	* `anonymizedAt` and emits `crm:lead.anonymized`.
+	*
+	* `fullName` is `required`, so it becomes the `'[redacted]'` sentinel;
+	* the optional PII scalars are nulled (dropping `email` out of the
+	* partial-unique email index). Idempotent.
+	*/
+	async anonymize(id, ctx) {
+		if (!await this.getById(id, ctx)) throw new NotFoundError("Lead", id);
+		const patch = {
+			fullName: "[redacted]",
+			firstName: null,
+			lastName: null,
+			email: null,
+			phone: null,
+			anonymizedAt: /* @__PURE__ */ new Date()
+		};
+		const updated = await this.update(id, patch, ctx);
+		if (!updated) throw new NotFoundError("Lead", id);
+		await this.events.dispatch(ctx, createEvent(CRM_EVENTS.LEAD_ANONYMIZED, {
+			leadId: id,
+			fields: [
+				"fullName",
+				"firstName",
+				"lastName",
+				"email",
+				"phone"
+			]
+		}, ctx));
+		return updated;
+	}
 	async _transition(id, target, extras, ctx) {
 		const existing = await this.getById(id, ctx);
 		if (!existing) throw new NotFoundError("Lead", id);
@@ -2461,19 +2883,19 @@ var LeadRepository = class extends Repository {
 			...extras.by !== void 0 ? { by: extras.by } : {},
 			...extras.note !== void 0 ? { note: extras.note } : {}
 		};
-		const updated = await assertAndClaim(LEAD_MACHINE, this, id, {
+		const updated = await this.applyTransition(id, LEAD_MACHINE, {
 			from: existing.status,
 			to: target,
-			patch: {
-				...extras.patch ?? {},
-				statusHistory: [...existing.statusHistory ?? [], entry]
-			},
-			options: ctx
-		});
-		if (!updated) throw new InvalidLeadTransitionError({
-			from: (await this.getById(id, ctx))?.status ?? existing.status,
-			to: target,
-			leadId: id
+			set: extras.patch ?? {},
+			push: { statusHistory: entry },
+			history: false
+		}, ctx).catch(async (err) => {
+			if (!isTransitionRace(err)) throw err;
+			throw new InvalidLeadTransitionError({
+				from: (await this.getById(id, ctx))?.status ?? existing.status,
+				to: target,
+				leadId: id
+			});
 		});
 		await this.events.dispatch(ctx, createEvent(CRM_EVENTS.LEAD_STATUS_CHANGED, {
 			leadId: id,
@@ -2719,7 +3141,6 @@ var OpportunityRepository = class extends Repository {
 	async _closeStatus(id, target, patch, extras, ctx) {
 		const existing = await this.getById(id, ctx);
 		if (!existing) throw new NotFoundError("Opportunity", id);
-		OPPORTUNITY_MACHINE.assertTransition(id, existing.status, target);
 		const entry = {
 			status: target,
 			stageId: existing.stageId,
@@ -2727,59 +3148,52 @@ var OpportunityRepository = class extends Repository {
 			...extras.by !== void 0 ? { by: extras.by } : {},
 			...extras.note !== void 0 ? { note: extras.note } : {}
 		};
-		const updated = await assertAndClaim(OPPORTUNITY_MACHINE, this, id, {
+		return await this.applyTransition(id, OPPORTUNITY_MACHINE, {
 			from: existing.status,
 			to: target,
-			patch: {
-				...patch,
-				statusHistory: [...existing.statusHistory ?? [], entry]
-			},
-			options: ctx
-		});
-		if (!updated) throw new InvalidOpportunityTransitionError({
-			from: (await this.getById(id, ctx))?.status ?? existing.status,
-			to: target,
-			opportunityId: id
+			set: patch,
+			push: { statusHistory: entry },
+			history: false
+		}, ctx).catch(async (err) => {
+			if (!isTransitionRace(err)) throw err;
+			throw new InvalidOpportunityTransitionError({
+				from: (await this.getById(id, ctx))?.status ?? existing.status,
+				to: target,
+				opportunityId: id
+			});
 		});
-		return updated;
 	}
 	/** Count opportunities with status `open`. Used by dashboard KPI tiles. */
 	async countOpen(ctx) {
 		return this.count({ status: "open" }, ctx);
 	}
 	/**
-	* Sum `amount` on won opportunities updated within `since`.
-	* Goes through the tenant-scoped `findAll()` — the multiTenant plugin
-	* injects `organizationId`, so a missing ctx can't leak other tenants'
-	* revenue (a manual `if (ctx)` filter would).
+	* Sum `amount` on won opportunities updated on/after `since`, grouped by
+	* currency. Returns one row per currency (descending by total) — a deal
+	* book is multi-currency, so collapsing to a single total would silently
+	* drop every non-top currency's revenue.
+	*
+	* Uses `aggregatePipeline` (a DB-side `$group`) instead of loading every
+	* won opp into memory: the multiTenant + soft-delete policy hooks prepend
+	* their `$match` so a missing ctx can't leak other tenants' revenue, and
+	* the row count is bounded by the number of distinct currencies, not the
+	* number of deals.
 	*/
 	async sumWonSince(since, ctx) {
-		const rows = await this.findAll({
-			status: "won",
-			updatedAt: { $gte: since }
-		}, {
-			...ctx,
-			select: {
-				amount: 1,
-				currency: 1
-			}
-		});
-		if (rows.length === 0) return null;
-		const byCurrency = /* @__PURE__ */ new Map();
-		for (const r of rows) {
-			const cur = r.currency ?? "UNKNOWN";
-			byCurrency.set(cur, (byCurrency.get(cur) ?? 0) + (r.amount ?? 0));
-		}
-		let topCurrency = "";
-		let topTotal = -Infinity;
-		for (const [cur, total] of byCurrency) if (total > topTotal) {
-			topTotal = total;
-			topCurrency = cur;
-		}
-		return {
-			total: topTotal,
-			currency: topCurrency
-		};
+		return (await this.aggregatePipeline([
+			{ $match: {
+				status: "won",
+				updatedAt: { $gte: since }
+			} },
+			{ $group: {
+				_id: { $ifNull: ["$currency", "UNKNOWN"] },
+				total: { $sum: { $ifNull: ["$amount", 0] } }
+			} },
+			{ $sort: { total: -1 } }
+		], ctx)).map((r) => ({
+			currency: r._id ?? "UNKNOWN",
+			total: r.total
+		}));
 	}
 	/** Latest `limit` opportunities — lightweight projection for the activity feed. */
 	async findRecentForFeed(limit, ctx) {
@@ -2800,16 +3214,45 @@ var OpportunityRepository = class extends Repository {
 //#region src/repositories/contact.repository.ts
 var ContactRepository = class extends Repository {
 	events;
+	rejectDuplicates;
 	constructor(model, plugins, deps, pagination) {
 		super(model, plugins, pagination);
 		this.events = deps.events;
+		this.rejectDuplicates = deps.rejectDuplicates ?? true;
 	}
 	/**
 	* Create + emit `crm:contact.created`. Hosts call this instead of
 	* `create()` when they want the event side-effect (e.g. webhook fan-out).
+	*
+	* Rejects duplicate emails inside the same tenant unless
+	* `rejectDuplicates: false` was set — mirrors `LeadRepository.createLead`.
+	* The partial-unique `(organizationId, contact.email)` index is the
+	* authoritative guard; the pre-check only closes the fast path.
+	*
+	* Throws `ContactEmailFormatError` (400) on an email that cannot be
+	* canonicalised — nothing is written. See `core/email-identity.ts` for the
+	* reason, including what it means for `LeadService.convert()`.
 	*/
 	async createContact(input, ctx) {
-		const created = await this.create(input, ctx);
+		const raw = input.contact?.email;
+		const email = raw === void 0 ? void 0 : requireContactEmailKey(raw);
+		if (this.rejectDuplicates && email) {
+			if (await this.getOne({ "contact.email": email }, ctx)) throw new DuplicateContactError({ email });
+		}
+		const draft = email === void 0 ? input : {
+			...input,
+			contact: {
+				...input.contact ?? {},
+				email
+			}
+		};
+		let created;
+		try {
+			created = await this.create(draft, ctx);
+		} catch (err) {
+			if (this.rejectDuplicates && email && isDuplicateKeyError(err)) throw new DuplicateContactError({ email });
+			throw err;
+		}
 		await this.events.dispatch(ctx, createEvent(CRM_EVENTS.CONTACT_CREATED, {
 			contactId: String(created._id),
 			email: created.contact?.email
@@ -2888,14 +3331,19 @@ var ContactRepository = class extends Repository {
 				...stripEmpty(winnerName)
 			},
 			contact: mergedContactInfo,
-			tags: Array.from(new Set([...primary.tags ?? [], ...secondary.tags ?? []])),
+			tags: Array.from(/* @__PURE__ */ new Set([...primary.tags ?? [], ...secondary.tags ?? []])),
 			...winner.jobTitle !== void 0 ? { jobTitle: winner.jobTitle } : loser.jobTitle !== void 0 ? { jobTitle: loser.jobTitle } : {},
 			...winner.accountId !== void 0 ? { accountId: winner.accountId } : loser.accountId !== void 0 ? { accountId: loser.accountId } : {},
 			...winner.ownerId !== void 0 ? { ownerId: winner.ownerId } : loser.ownerId !== void 0 ? { ownerId: loser.ownerId } : {}
 		};
+		if (input.repoint) await input.repoint({
+			primaryId,
+			secondaryId,
+			...ctx !== void 0 ? { ctx } : {}
+		});
+		await this.delete(secondaryId, ctx);
 		const updated = await this.update(primaryId, patch, ctx);
 		if (!updated) throw new NotFoundError("Contact", primaryId);
-		await this.delete(secondaryId, ctx);
 		await this.events.dispatch(ctx, createEvent(CRM_EVENTS.CONTACT_MERGED, {
 			primaryId,
 			secondaryId,
@@ -2903,7 +3351,54 @@ var ContactRepository = class extends Repository {
 		}, ctx));
 		return updated;
 	}
+	/**
+	* GDPR right-to-erasure. Scrubs every PII field on the contact in place —
+	* the structured `name` and ALL `contact.*` channels (email,
+	* personalEmail, phone, alternatePhone, whatsapp, telegram, linkedin,
+	* instagram) — while preserving the id and non-PII aggregates
+	* (`accountId`, `ownerId`, `tags`, timestamps) so historical rollups and
+	* relationships survive. Sets `anonymizedAt` as a tombstone and emits
+	* `crm:contact.anonymized`. Idempotent: a second call re-scrubs to the
+	* same sentinel.
+	*
+	* `name.given` is `required`, so it becomes the `'[redacted]'` sentinel
+	* rather than empty; every other name part and the whole `contact`
+	* subdocument are cleared. Unsetting `contact.email` also drops the row
+	* out of the partial-unique email index, freeing the address for reuse.
+	*/
+	async anonymize(id, ctx) {
+		if (!await this.getById(id, ctx)) throw new NotFoundError("Contact", id);
+		const patch = {
+			name: {
+				given: REDACTED,
+				family: ""
+			},
+			contact: {},
+			anonymizedAt: /* @__PURE__ */ new Date()
+		};
+		const updated = await this.update(id, patch, ctx);
+		if (!updated) throw new NotFoundError("Contact", id);
+		await this.events.dispatch(ctx, createEvent(CRM_EVENTS.CONTACT_ANONYMIZED, {
+			contactId: id,
+			fields: PII_CONTACT_FIELDS
+		}, ctx));
+		return updated;
+	}
 };
+/** Sentinel written to `required` PII fields that can't be cleared to empty. */
+const REDACTED = "[redacted]";
+/** PII field set scrubbed by `anonymize()` — surfaced in the event payload. */
+const PII_CONTACT_FIELDS = [
+	"name",
+	"contact.email",
+	"contact.personalEmail",
+	"contact.phone",
+	"contact.alternatePhone",
+	"contact.whatsapp",
+	"contact.telegram",
+	"contact.linkedin",
+	"contact.instagram"
+];
 function stripEmpty(obj) {
 	const out = {};
 	for (const [k, v] of Object.entries(obj)) if (v !== void 0 && v !== null && v !== "") out[k] = v;
@@ -2974,7 +3469,7 @@ var AccountRepository = class extends Repository {
 		if (!secondary) throw new NotFoundError("Account", secondaryId);
 		const winner = strategy === "preferPrimary" ? primary : secondary;
 		const loser = strategy === "preferPrimary" ? secondary : primary;
-		const mergedTags = Array.from(new Set([...primary.tags ?? [], ...secondary.tags ?? []]));
+		const mergedTags = Array.from(/* @__PURE__ */ new Set([...primary.tags ?? [], ...secondary.tags ?? []]));
 		const patch = {
 			name: winner.name || loser.name,
 			tags: mergedTags,
@@ -3075,28 +3570,26 @@ var CampaignRepository = class extends Repository {
 	async _transition(id, target, extras, ctx, patch = {}) {
 		const existing = await this.getById(id, ctx);
 		if (!existing) throw new NotFoundError("Campaign", id);
-		CAMPAIGN_MACHINE.assertTransition(id, existing.status, target);
 		const entry = {
 			status: target,
 			occurredAt: /* @__PURE__ */ new Date(),
 			...extras.by !== void 0 ? { by: extras.by } : {},
 			...extras.note !== void 0 ? { note: extras.note } : {}
 		};
-		const updated = await assertAndClaim(CAMPAIGN_MACHINE, this, id, {
+		return await this.applyTransition(id, CAMPAIGN_MACHINE, {
 			from: existing.status,
 			to: target,
-			patch: {
-				...patch,
-				statusHistory: [...existing.statusHistory ?? [], entry]
-			},
-			options: ctx
-		});
-		if (!updated) throw new InvalidCampaignTransitionError({
-			from: (await this.getById(id, ctx))?.status ?? existing.status,
-			to: target,
-			campaignId: id
+			set: patch,
+			push: { statusHistory: entry },
+			history: false
+		}, ctx).catch(async (err) => {
+			if (!isTransitionRace(err)) throw err;
+			throw new InvalidCampaignTransitionError({
+				from: (await this.getById(id, ctx))?.status ?? existing.status,
+				to: target,
+				campaignId: id
+			});
 		});
-		return updated;
 	}
 };
 //#endregion
@@ -3237,34 +3730,60 @@ var SubscriptionRepository = class extends Repository {
 	async _transition(id, target, opts, ctx) {
 		const existing = await this.getById(id, ctx);
 		if (!existing) throw new NotFoundError("Subscription", id);
-		SUBSCRIPTION_MACHINE.assertTransition(id, existing.status, target);
 		const entry = {
 			status: target,
 			occurredAt: /* @__PURE__ */ new Date(),
 			...opts.by !== void 0 ? { by: opts.by } : {},
 			...opts.note !== void 0 ? { note: opts.note } : {}
 		};
-		const updated = await assertAndClaim(SUBSCRIPTION_MACHINE, this, id, {
+		return await this.applyTransition(id, SUBSCRIPTION_MACHINE, {
 			from: existing.status,
 			to: target,
-			patch: {
-				...opts.patch ?? {},
-				statusHistory: [...existing.statusHistory ?? [], entry]
-			},
-			options: ctx
-		});
-		if (!updated) throw new InvalidSubscriptionTransitionError({
-			from: (await this.getById(id, ctx))?.status ?? existing.status,
-			to: target,
-			subscriptionId: id
+			set: opts.patch ?? {},
+			push: { statusHistory: entry },
+			history: false
+		}, ctx).catch(async (err) => {
+			if (!isTransitionRace(err)) throw err;
+			throw new InvalidSubscriptionTransitionError({
+				from: (await this.getById(id, ctx))?.status ?? existing.status,
+				to: target,
+				subscriptionId: id
+			});
 		});
-		return updated;
 	}
 };
 //#endregion
 //#region src/repositories/suppression.repository.ts
-function normalizeEmail(email) {
-	return email.trim().toLowerCase();
+/**
+* The suppression key for `email`, or `null` when it cannot be canonicalised.
+*
+* Exported because it is the ONLY way a caller can distinguish "this address is on
+* the list" from "this address is not an address" — the read verbs collapse both
+* to `true` on purpose (see the fail-closed rule in the module docblock), and a
+* caller that needs the distinction should not re-derive the rule to get it.
+*/
+function suppressionEmailKey(email) {
+	try {
+		return normalizeEmail(email);
+	} catch (err) {
+		if (err instanceof EmailFormatError) return null;
+		throw err;
+	}
+}
+/**
+* The suppression key for `email`, or a 400. Used by the WRITE verbs only —
+* storing an address that can never match is a suppression that suppresses nothing.
+*/
+function requireSuppressionEmailKey(email) {
+	try {
+		return normalizeEmail(email);
+	} catch (err) {
+		if (err instanceof EmailFormatError) throw new SuppressionEmailFormatError({
+			email,
+			reason: err.code
+		});
+		throw err;
+	}
 }
 var SuppressionRepository = class extends Repository {
 	events;
@@ -3277,9 +3796,12 @@ var SuppressionRepository = class extends Repository {
 	* `getOrCreate` on the unique (org, email) index — of N concurrent
 	* calls exactly one inserts. Emits `crm:suppression.added` only for
 	* the inserting call; an existing row is returned unchanged, no event.
+	*
+	* Throws `SuppressionEmailFormatError` (400) on an address that cannot be
+	* canonicalised — nothing is written.
 	*/
 	async suppress(email, input, ctx) {
-		const normalized = normalizeEmail(email);
+		const normalized = requireSuppressionEmailKey(email);
 		const draft = {
 			email: normalized,
 			reason: input.reason,
@@ -3297,37 +3819,68 @@ var SuppressionRepository = class extends Repository {
 		}, ctx));
 		return doc;
 	}
-	/** True when `email` is on the org's suppression list. */
+	/**
+	* True when `email` is on the org's suppression list — **or when it cannot be
+	* canonicalised at all**, which is the fail-closed half of the module rule
+	* above. Never throws on a malformed address: the safe answer is "do not send",
+	* and this verb's job is to produce that answer, not to police the input.
+	*/
 	async isSuppressed(email, ctx) {
-		return await this.exists({ email: normalizeEmail(email) }, ctx) !== null;
+		const key = suppressionEmailKey(email);
+		if (key === null) return true;
+		return await this.exists({ email: key }, ctx) !== null;
 	}
 	/**
-	* Return the suppressed subset of `emails` (normalized) as a Set —
-	* ONE `$in` query, built for the campaign-fanout hot path:
+	* Return the suppressed subset of `emails` as a Set — ONE `$in` query, built for
+	* the campaign-fanout hot path:
 	*
 	* ```ts
 	* const blocked = await suppression.filterSuppressed(recipients, ctx);
-	* const sendable = recipients.filter((e) => !blocked.has(e.toLowerCase()));
+	* const sendable = recipients.filter((e) => !blocked.has(suppressionEmailKey(e) ?? e));
 	* ```
+	*
+	* The Set is keyed CANONICALLY, so a caller must canonicalise its own recipient
+	* before testing membership — matching on the raw spelling is how the punycode
+	* miss came back. `suppressionEmailKey` is exported for exactly that, and returns
+	* `null` for an address with no canonical form.
+	*
+	* An address that cannot be canonicalised is reported as BLOCKED, keyed by the
+	* caller's original spelling (there is no canonical form to key it by, and the
+	* caller has to be able to find it). It is not thrown: one malformed recipient
+	* must not abort a fanout to thousands of valid ones.
 	*/
 	async filterSuppressed(emails, ctx) {
 		if (emails.length === 0) return /* @__PURE__ */ new Set();
-		const normalized = [...new Set(emails.map(normalizeEmail))];
-		const rows = await this.findAll({ email: { $in: normalized } }, {
-			...ctx ?? {},
-			select: "email",
-			lean: true
-		});
-		return new Set(rows.map((row) => row.email));
+		const blocked = /* @__PURE__ */ new Set();
+		const keys = /* @__PURE__ */ new Set();
+		for (const email of emails) {
+			const key = suppressionEmailKey(email);
+			if (key === null) blocked.add(email);
+			else keys.add(key);
+		}
+		if (keys.size > 0) {
+			const rows = await this.findAll({ email: { $in: [...keys] } }, {
+				...ctx ?? {},
+				select: "email",
+				lean: true
+			});
+			for (const row of rows) blocked.add(row.email);
+		}
+		return blocked;
 	}
 	/**
 	* Remove `email` from the org's suppression list. Single atomic
 	* `deleteMany` on the (unique) email key — emits
 	* `crm:suppression.removed` only when a row was actually removed.
 	* Returns whether a row was removed.
+	*
+	* Throws `SuppressionEmailFormatError` (400) on an address that cannot be
+	* canonicalised, rather than answering `false`. This is the verb that re-enables
+	* sending, and `false` would read as "already removed" when the truth is "that
+	* was never an address" — an operator would close the ticket either way.
 	*/
 	async unsuppress(email, ctx) {
-		const normalized = normalizeEmail(email);
+		const normalized = requireSuppressionEmailKey(email);
 		const removed = (await this.deleteMany({ email: normalized }, ctx ?? {})).deletedCount > 0;
 		if (removed) await this.events.dispatch(ctx, createEvent(CRM_EVENTS.SUPPRESSION_REMOVED, { email: normalized }, ctx));
 		return removed;
@@ -3427,19 +3980,19 @@ var ActivityRepository = class extends Repository {
 	async _transition(id, target, patch, ctx) {
 		const existing = await this.getById(id, ctx);
 		if (!existing) throw new NotFoundError("Activity", id);
-		ACTIVITY_MACHINE.assertTransition(id, existing.status, target);
-		const updated = await assertAndClaim(ACTIVITY_MACHINE, this, id, {
+		return await this.applyTransition(id, ACTIVITY_MACHINE, {
 			from: existing.status,
 			to: target,
-			patch,
-			options: ctx
-		});
-		if (!updated) throw new InvalidActivityTransitionError({
-			from: (await this.getById(id, ctx))?.status ?? existing.status,
-			to: target,
-			activityId: id
+			set: patch,
+			history: false
+		}, ctx).catch(async (err) => {
+			if (!isTransitionRace(err)) throw err;
+			throw new InvalidActivityTransitionError({
+				from: (await this.getById(id, ctx))?.status ?? existing.status,
+				to: target,
+				activityId: id
+			});
 		});
-		return updated;
 	}
 	/** Count `planned` activities with `dueDate` before `asOf`. Dashboard KPI. */
 	async countOverduePlanned(asOf, ctx) {
@@ -3510,7 +4063,7 @@ const KIND_TO_EVENT = {
 var EmailEventRepository = class extends Repository {
 	events;
 	constructor(model, plugins, deps, pagination) {
-		super(model, plugins, pagination);
+		super(model, [...plugins, appendOnlyPlugin({ allow: ["deleteMany"] })], pagination);
 		this.events = deps.events;
 	}
 	async recordOpen(input, ctx) {
@@ -3735,24 +4288,24 @@ var SequenceRepository = class extends Repository {
 	async _transition(id, target, ctx) {
 		const existing = await this.getById(id, ctx);
 		if (!existing) throw new NotFoundError("Sequence", id);
-		SEQUENCE_MACHINE.assertTransition(id, existing.status, target);
 		const entry = {
 			status: target,
 			occurredAt: /* @__PURE__ */ new Date(),
 			...ctx?.actorId !== void 0 ? { by: String(ctx.actorId) } : {}
 		};
-		const updated = await assertAndClaim(SEQUENCE_MACHINE, this, id, {
+		return await this.applyTransition(id, SEQUENCE_MACHINE, {
 			from: existing.status,
 			to: target,
-			patch: { statusHistory: [...existing.statusHistory ?? [], entry] },
-			options: ctx
-		});
-		if (!updated) throw new InvalidSequenceTransitionError({
-			from: (await this.getById(id, ctx))?.status ?? existing.status,
-			to: target,
-			sequenceId: id
+			push: { statusHistory: entry },
+			history: false
+		}, ctx).catch(async (err) => {
+			if (!isTransitionRace(err)) throw err;
+			throw new InvalidSequenceTransitionError({
+				from: (await this.getById(id, ctx))?.status ?? existing.status,
+				to: target,
+				sequenceId: id
+			});
 		});
-		return updated;
 	}
 };
 //#endregion
@@ -3839,16 +4392,16 @@ var EnrollmentRepository = class extends Repository {
 			occurredAt: /* @__PURE__ */ new Date(),
 			...ctx?.actorId ? { by: String(ctx.actorId) } : {}
 		};
-		const updated = await assertAndClaim(ENROLLMENT_MACHINE, this, id, {
+		const updated = await this.applyTransition(id, ENROLLMENT_MACHINE, {
 			from,
 			to: "exited",
-			patch: {
-				exitReason,
-				statusHistory: [...existing.statusHistory ?? [], entry]
-			},
-			options: ctx
+			set: { exitReason },
+			push: { statusHistory: entry },
+			history: false
+		}, ctx).catch((err) => {
+			if (isTransitionRace(err)) throw new NotFoundError("Enrollment", id);
+			throw err;
 		});
-		if (!updated) throw new NotFoundError("Enrollment", id);
 		await this.events.dispatch(ctx, createEvent(CRM_EVENTS.ENROLLMENT_EXITED, {
 			enrollmentId: id,
 			exitReason
@@ -3907,27 +4460,25 @@ var EnrollmentRepository = class extends Repository {
 	async _transition(id, target, ctx, patch = {}) {
 		const existing = await this.getById(id, ctx);
 		if (!existing) throw new NotFoundError("Enrollment", id);
-		ENROLLMENT_MACHINE.assertTransition(id, existing.status, target);
 		const entry = {
 			status: target,
 			occurredAt: /* @__PURE__ */ new Date(),
 			...ctx?.actorId ? { by: String(ctx.actorId) } : {}
 		};
-		const updated = await assertAndClaim(ENROLLMENT_MACHINE, this, id, {
+		return await this.applyTransition(id, ENROLLMENT_MACHINE, {
 			from: existing.status,
 			to: target,
-			patch: {
-				...patch,
-				statusHistory: [...existing.statusHistory ?? [], entry]
-			},
-			options: ctx
-		});
-		if (!updated) throw new InvalidEnrollmentTransitionError({
-			from: (await this.getById(id, ctx))?.status ?? existing.status,
-			to: target,
-			enrollmentId: id
+			set: patch,
+			push: { statusHistory: entry },
+			history: false
+		}, ctx).catch(async (err) => {
+			if (!isTransitionRace(err)) throw err;
+			throw new InvalidEnrollmentTransitionError({
+				from: (await this.getById(id, ctx))?.status ?? existing.status,
+				to: target,
+				enrollmentId: id
+			});
 		});
-		return updated;
 	}
 };
 //#endregion
@@ -3954,49 +4505,48 @@ function createCrmRepositories(models, deps) {
 	}));
 	plugins.push(aggregateHelpersPlugin());
 	if (config.plugins.length > 0) plugins.push(...config.plugins);
-	const pipeline = new PipelineRepository(models.Pipeline, plugins, { events }, pagination);
-	const lead = new LeadRepository(models.Lead, plugins, { events }, pagination);
-	const opportunity = new OpportunityRepository(models.Opportunity, plugins, {
-		events,
-		pipelines: pipeline
-	}, pagination);
-	const contact = new ContactRepository(models.Contact, plugins, { events }, pagination);
-	const account = new AccountRepository(models.Account, plugins, { events }, pagination);
-	const campaign = new CampaignRepository(models.Campaign, plugins, { events }, pagination);
-	const subscription = new SubscriptionRepository(models.Subscription, plugins, { events }, pagination);
-	const suppression = new SuppressionRepository(models.Suppression, plugins, { events }, pagination);
-	const activity = new ActivityRepository(models.Activity, plugins, { events }, pagination);
-	const note = new NoteRepository(models.Note, plugins, { events }, pagination);
-	const lossReason = new LossReasonRepository(models.LossReason, plugins, { events }, pagination);
-	const emailEvent = new EmailEventRepository(models.EmailEvent, plugins, { events }, pagination);
-	const conversation = new ConversationRepository(models.Conversation, plugins, { events }, pagination);
-	const message = new MessageRepository(models.Message, plugins, {
-		events,
-		conversations: conversation
-	}, pagination);
-	const sequence = new SequenceRepository(models.Sequence, plugins, { events }, pagination);
-	const enrollment = new EnrollmentRepository(models.Enrollment, plugins, {
-		events,
-		sequences: sequence
-	}, pagination);
-	return Object.freeze({
-		pipeline,
-		lead,
-		opportunity,
-		contact,
-		account,
-		campaign,
-		subscription,
-		suppression,
-		activity,
-		note,
-		lossReason,
-		emailEvent,
-		conversation,
-		message,
-		sequence,
-		enrollment
-	});
+	const repositories = {};
+	if (config.modules.sales) {
+		const { Pipeline, Lead, Opportunity, Contact, Account, Activity, Note, LossReason } = models;
+		if (!Pipeline || !Lead || !Opportunity || !Contact || !Account || !Activity || !Note || !LossReason) throw new Error("[crm] sales module model graph is incomplete");
+		const pipeline = new PipelineRepository(Pipeline, plugins, { events }, pagination);
+		repositories.pipeline = pipeline;
+		repositories.lead = new LeadRepository(Lead, plugins, { events }, pagination);
+		repositories.opportunity = new OpportunityRepository(Opportunity, plugins, {
+			events,
+			pipelines: pipeline
+		}, pagination);
+		repositories.contact = new ContactRepository(Contact, plugins, { events }, pagination);
+		repositories.account = new AccountRepository(Account, plugins, { events }, pagination);
+		repositories.activity = new ActivityRepository(Activity, plugins, { events }, pagination);
+		repositories.note = new NoteRepository(Note, plugins, { events }, pagination);
+		repositories.lossReason = new LossReasonRepository(LossReason, plugins, { events }, pagination);
+	}
+	if (config.modules.engagement) {
+		const { Subscription, Suppression, EmailEvent, Conversation, Message } = models;
+		if (!Subscription || !Suppression || !EmailEvent || !Conversation || !Message) throw new Error("[crm] engagement module model graph is incomplete");
+		const conversation = new ConversationRepository(Conversation, plugins, { events }, pagination);
+		repositories.subscription = new SubscriptionRepository(Subscription, plugins, { events }, pagination);
+		repositories.suppression = new SuppressionRepository(Suppression, plugins, { events }, pagination);
+		repositories.emailEvent = new EmailEventRepository(EmailEvent, plugins, { events }, pagination);
+		repositories.conversation = conversation;
+		repositories.message = new MessageRepository(Message, plugins, {
+			events,
+			conversations: conversation
+		}, pagination);
+	}
+	if (config.modules.automation) {
+		const { Campaign, Sequence, Enrollment } = models;
+		if (!Campaign || !Sequence || !Enrollment) throw new Error("[crm] automation module model graph is incomplete");
+		const sequence = new SequenceRepository(Sequence, plugins, { events }, pagination);
+		repositories.campaign = new CampaignRepository(Campaign, plugins, { events }, pagination);
+		repositories.sequence = sequence;
+		repositories.enrollment = new EnrollmentRepository(Enrollment, plugins, {
+			events,
+			sequences: sequence
+		}, pagination);
+	}
+	return Object.freeze(repositories);
 }
 //#endregion
 //#region src/events/dispatch.ts
@@ -4028,7 +4578,9 @@ var CrmEventDispatcher = class {
 		return this.transport.publish(event);
 	}
 	subscribe(pattern, handler) {
-		return this.transport.subscribe(pattern, handler);
+		const subscribe = this.transport.subscribe?.bind(this.transport);
+		if (!subscribe) throw new Error("crm: configured event transport does not support subscribe");
+		return subscribe(pattern, handler);
 	}
 	async close() {
 		await this.transport.close?.();
@@ -4074,37 +4626,24 @@ async function flushPending(transport, events, logger) {
 //#region src/events/in-process-bus.ts
 /**
 * In-process event bus — default fallback when no `eventTransport` is
-* provided to `createCrm`. Structurally identical to arc's
-* `MemoryEventTransport`; pattern matching is delegated to primitives.
-* Handler errors are swallowed — event emission never blocks writes.
+* provided to `blueprint.bind(connection, runtime)`.
+*
+* A thin subclass of `@classytic/primitives/event-infra`'s shared
+* `InProcessEventBus`. Prior semantics preserved: glob matching via
+* `matchEventPattern`, per-handler error isolation, idempotent `close()`.
+* CRM historically SWALLOWED handler errors when no logger was supplied —
+* that default is preserved by passing `logger: null` unless the host
+* injects a `CrmLogger`, whose structured `error(msg, meta)` slot is
+* bridged onto the shared error-logger contract.
 */
-var InProcessCrmBus = class {
-	name = "in-process-crm";
-	subs = [];
-	logger;
+var InProcessCrmBus = class extends InProcessEventBus {
 	constructor(options) {
-		if (options?.logger) this.logger = options.logger;
-	}
-	async publish(event) {
-		const matching = this.subs.filter((s) => matchEventPattern(s.pattern, event.type));
-		for (const sub of matching) try {
-			await sub.handler(event);
-		} catch (err) {
-			this.logger?.error?.(`[crm] event handler error [${event.type}]`, { error: err instanceof Error ? err.message : String(err) });
-		}
-	}
-	async subscribe(pattern, handler) {
-		const sub = {
-			pattern,
-			handler
-		};
-		this.subs.push(sub);
-		return () => {
-			this.subs = this.subs.filter((s) => s !== sub);
-		};
-	}
-	async close() {
-		this.subs = [];
+		const crmLogger = options?.logger;
+		super({
+			name: "in-process-crm",
+			logLabel: "crm",
+			logger: crmLogger?.error ? { error: (message, ...args) => crmLogger.error?.(message, { args }) } : null
+		});
 	}
 };
 //#endregion
@@ -4162,53 +4701,179 @@ async function runUnit(config, ctx, body) {
 	return result;
 }
 //#endregion
-//#region src/engine/create-crm.ts
-async function createCrm(config) {
-	if (!config.connection) throw new Error("[crm] CrmConfig.connection is required");
-	const resolved = {
-		connection: config.connection,
-		tenantFieldType: config.tenantFieldType ?? "objectId",
-		multiTenant: config.multiTenant ?? true,
-		forceRecreate: config.forceRecreate ?? false,
-		autoIndex: config.autoIndex ?? true,
-		...config.logger !== void 0 ? { logger: config.logger } : {},
-		...config.pagination !== void 0 ? { pagination: config.pagination } : {},
-		plugins: config.plugins ?? []
-	};
-	const events = new CrmEventDispatcher({
-		transport: config.eventTransport ?? new InProcessCrmBus(config.logger ? { logger: config.logger } : void 0),
-		outbox: config.outbox,
-		logger: config.logger
+//#region src/engine/define-crm.ts
+function defineCrm(shape = {}) {
+	const tenantFieldType = shape.tenantFieldType ?? "objectId";
+	const multiTenant = shape.multiTenant ?? true;
+	const forceRecreate = shape.forceRecreate ?? false;
+	const autoIndex = shape.autoIndex ?? true;
+	const modules = resolveCrmModules(shape.modules);
+	const modelBlueprint = defineCrmModels({
+		tenantFieldType,
+		...shape.modelPrefix !== void 0 ? { modelPrefix: shape.modelPrefix } : {},
+		modules,
+		forceRecreate,
+		autoIndex
 	});
-	const models = createCrmModels(config.connection, resolved);
-	const repositories = createCrmRepositories(models, {
-		events,
-		config: resolved
-	});
-	assertCrmCapabilities(repositories.lead, {
-		...config.allowNonTransactional !== void 0 ? { allowNonTransactional: config.allowNonTransactional } : {},
-		...config.logger?.warn !== void 0 ? { logger: { warn: (m) => config.logger?.warn?.(m) } } : {}
-	});
-	return Object.freeze({
-		models,
-		repositories,
-		events,
-		config: Object.freeze(resolved),
-		withTransaction(ctx, body) {
-			return runUnit({
-				connection: config.connection,
+	return {
+		id: "crm",
+		modelNames: modelBlueprint.modelNames,
+		bind(connection, runtime = {}) {
+			/**
+			* VERIFY (boot gate) — an injected outbox MUST enlist `ctx.session`.
+			*
+			* Checked FIRST, before the model blueprint binds, for two reasons: a cheaper error
+			* should report before a costlier one (a model collision would otherwise surface first
+			* and hide this), and a bind that throws here must not have mutated the connection's
+			* model registry.
+			*
+			* WHY CRM. `OutboxWriteOptions.session` is best-effort BY CONTRACT, so a store that
+			* ignores it persists events for mutations that later roll back. CRM is the only kernel
+			* in the batch reviewed alongside it with a LIVE, WIRED consumer whose side effect is not
+			* re-derivable: be-prod's `crmCustomerProjectionHandlers` sits on the crm module's arc
+			* `eventHandlers` arm and, on `crm:lead.converted` / `crm:opportunity.won`, WRITES
+			* `crm.stage` and `crm.convertedFromLeadId` onto the Customer document in another
+			* collection. Nothing recomputes those fields and no reconciler exists, so a ghost event
+			* marks a customer converted/won permanently and silently — the exact bug class AGENTS.md
+			* FAIL LOUD is about (a plausible-looking result instead of an error).
+			*
+			* The rollback window is package-owned, not hypothetical: `LeadService.convert()` writes
+			* Account + Contact + Opportunity + the lead transition inside `runUnit`'s transaction and
+			* dispatches `crm:lead.converted` from within it, and spine-crm's convert route calls it
+			* through `engine.withTransaction`.
+			*
+			* `!== true` and not `=== false`: a hand-rolled store has the flag ABSENT, not `false`,
+			* and absence of an answer is not a positive answer (FAIL LOUD rule 3).
+			*
+			* `allowNonTransactional` does NOT waive this. That flag downgrades the BACKEND's
+			* `transactions` capability for hosts that never convert under a session (see
+			* `assertCrmCapabilities`). This gate is about the injected STORE, which is wrong on a
+			* replica set too — letting a dev-convenience flag disable it would be a general default
+			* overriding a specific correctness check (FAIL LOUD rule 1).
+			*/
+			if (runtime.outbox && runtime.outbox.transactionalSave !== true) throw new Error("[crm] the configured OutboxStore does not declare `outbox.transactionalSave` — crm events would not commit atomically with the writes that emit them. See OutboxStore.transactionalSave in @classytic/primitives/outbox; arc's `repositoryAsOutboxStore` declares it. This is a property of the STORE, not of the database, and `allowNonTransactional` does not waive it.");
+			const resolved = {
+				connection,
+				tenantFieldType,
+				...shape.modelPrefix !== void 0 ? { modelPrefix: shape.modelPrefix } : {},
+				multiTenant,
+				forceRecreate,
+				autoIndex,
+				modules,
+				...runtime.logger !== void 0 ? { logger: runtime.logger } : {},
+				...runtime.pagination !== void 0 ? { pagination: runtime.pagination } : {},
+				plugins: runtime.plugins ?? []
+			};
+			const ownsTransport = runtime.eventTransport === void 0;
+			const events = new CrmEventDispatcher({
+				transport: runtime.eventTransport ?? new InProcessCrmBus(runtime.logger ? { logger: runtime.logger } : void 0),
+				...runtime.outbox !== void 0 ? { outbox: runtime.outbox } : {},
+				...runtime.logger !== void 0 ? { logger: runtime.logger } : {}
+			});
+			const models = modelBlueprint.bind(connection);
+			const repositories = createCrmRepositories(models, {
 				events,
-				logger: config.logger,
-				allowNonTransactional: config.allowNonTransactional ?? false
-			}, ctx, body);
-		},
-		async syncIndexes() {
-			await Promise.all(Object.values(models).map((m) => m.syncIndexes()));
-		},
-		async dispose() {
-			await events.close();
+				config: resolved
+			});
+			const allowNonTransactional = runtime.allowNonTransactional ?? false;
+			if (repositories.lead) assertCrmCapabilities(repositories.lead, {
+				allowNonTransactional,
+				...runtime.logger?.warn !== void 0 ? { logger: { warn: (m) => runtime.logger?.warn?.(m) } } : {}
+			});
+			const moduleViews = {};
+			if (modules.sales) {
+				const { Pipeline, Lead, Opportunity, Contact, Account, Activity, Note, LossReason } = models;
+				const { pipeline, lead, opportunity, contact, account, activity, note, lossReason } = repositories;
+				if (!Pipeline || !Lead || !Opportunity || !Contact || !Account || !Activity || !Note || !LossReason || !pipeline || !lead || !opportunity || !contact || !account || !activity || !note || !lossReason) throw new Error("[crm] sales module failed to initialize");
+				moduleViews.sales = Object.freeze({
+					models: Object.freeze({
+						Pipeline,
+						Lead,
+						Opportunity,
+						Contact,
+						Account,
+						Activity,
+						Note,
+						LossReason
+					}),
+					repositories: Object.freeze({
+						pipeline,
+						lead,
+						opportunity,
+						contact,
+						account,
+						activity,
+						note,
+						lossReason
+					})
+				});
+			}
+			if (modules.engagement) {
+				const { Subscription, Suppression, EmailEvent, Conversation, Message } = models;
+				const { subscription, suppression, emailEvent, conversation, message } = repositories;
+				if (!Subscription || !Suppression || !EmailEvent || !Conversation || !Message || !subscription || !suppression || !emailEvent || !conversation || !message) throw new Error("[crm] engagement module failed to initialize");
+				moduleViews.engagement = Object.freeze({
+					models: Object.freeze({
+						Subscription,
+						Suppression,
+						EmailEvent,
+						Conversation,
+						Message
+					}),
+					repositories: Object.freeze({
+						subscription,
+						suppression,
+						emailEvent,
+						conversation,
+						message
+					})
+				});
+			}
+			if (modules.automation) {
+				const { Campaign, Sequence, Enrollment } = models;
+				const { campaign, sequence, enrollment } = repositories;
+				if (!Campaign || !Sequence || !Enrollment || !campaign || !sequence || !enrollment) throw new Error("[crm] automation module failed to initialize");
+				moduleViews.automation = Object.freeze({
+					models: Object.freeze({
+						Campaign,
+						Sequence,
+						Enrollment
+					}),
+					repositories: Object.freeze({
+						campaign,
+						sequence,
+						enrollment
+					})
+				});
+			}
+			Object.freeze(moduleViews);
+			let closed = false;
+			const close = async () => {
+				if (closed) return;
+				closed = true;
+				if (ownsTransport) await events.close();
+			};
+			return Object.freeze({
+				models,
+				repositories,
+				events,
+				config: Object.freeze(resolved),
+				modules: moduleViews,
+				withTransaction(ctx, body) {
+					return runUnit({
+						connection,
+						events,
+						...resolved.logger !== void 0 ? { logger: resolved.logger } : {},
+						allowNonTransactional
+					}, ctx, body);
+				},
+				async syncIndexes() {
+					await Promise.all(Object.values(models).map((model) => model.syncIndexes()));
+				},
+				close
+			});
 		}
-	});
+	};
 }
 //#endregion
 //#region src/services/lead.service.ts
@@ -4254,7 +4919,9 @@ var LeadService = class LeadService {
 		const lead = await this.leads.getById(leadId, ctx);
 		if (!lead) throw new NotFoundError("Lead", leadId);
 		if (lead.status === "converted") throw new LeadAlreadyConvertedError(leadId);
-		if (!LEAD_MACHINE.canTransition(lead.status, "converted")) throw new InvalidLeadTransitionError({
+		const canQualifyHop = LEAD_MACHINE.canTransition(lead.status, "qualified");
+		const canConvertDirect = LEAD_MACHINE.canTransition(lead.status, "converted");
+		if (!canQualifyHop && !canConvertDirect) throw new InvalidLeadTransitionError({
 			from: lead.status,
 			to: "converted",
 			leadId
@@ -4347,17 +5014,7 @@ var LeadService = class LeadService {
 			occurredAt: /* @__PURE__ */ new Date(),
 			...crossRefs.by !== void 0 ? { by: crossRefs.by } : {}
 		};
-		const current = await this.leads.getById(leadId, ctx);
-		const updated = await this.leads.claim(leadId, {
-			field: "status",
-			from: fromStatus,
-			to: "converted"
-		}, {
-			...patch,
-			statusHistory: [...current?.statusHistory ?? [], entry]
-		}, ctx);
-		if (!updated) throw new NotFoundError("Lead", leadId);
-		return updated;
+		return this.leads.markConverted(leadId, fromStatus, patch, entry, ctx);
 	}
 };
 /**
@@ -4502,6 +5159,15 @@ const LeadAssigned = defineCrmEvent({
 	description: "assign() (re)assigned the lead owner.",
 	zodSchema: z.object({ leadId: z.string() }).extend(ownerChangeSchema.shape)
 });
+const LeadAnonymized = defineCrmEvent({
+	name: CRM_EVENTS.LEAD_ANONYMIZED,
+	resource: "lead",
+	description: "anonymize() scrubbed a lead's PII (name/email/phone) in place — GDPR right-to-erasure. Non-PII aggregates (score/status/engagement) and the id are preserved; `anonymizedAt` tombstones the row.",
+	zodSchema: z.object({
+		leadId: z.string(),
+		fields: z.array(z.string())
+	})
+});
 const AccountCreated = defineCrmEvent({
 	name: CRM_EVENTS.ACCOUNT_CREATED,
 	resource: "account",
@@ -4568,6 +5234,15 @@ const ContactMerged = defineCrmEvent({
 	description: "merge() folded a secondary contact into the primary; secondary deleted.",
 	zodSchema: mergeSchema
 });
+const ContactAnonymized = defineCrmEvent({
+	name: CRM_EVENTS.CONTACT_ANONYMIZED,
+	resource: "contact",
+	description: "anonymize() scrubbed a contact's PII (name + every contact channel) in place — GDPR right-to-erasure. Non-PII aggregates (accountId, ownerId, tags) and the id are preserved; `anonymizedAt` tombstones the row.",
+	zodSchema: z.object({
+		contactId: z.string(),
+		fields: z.array(z.string())
+	})
+});
 const OpportunityCreated = defineCrmEvent({
 	name: CRM_EVENTS.OPPORTUNITY_CREATED,
 	resource: "opportunity",
@@ -5023,6 +5698,7 @@ const crmEventDefinitions = [
 	LeadDisqualified,
 	LeadEnriched,
 	LeadAssigned,
+	LeadAnonymized,
 	AccountCreated,
 	AccountUpdated,
 	AccountEnriched,
@@ -5033,6 +5709,7 @@ const crmEventDefinitions = [
 	ContactEnriched,
 	ContactAssigned,
 	ContactMerged,
+	ContactAnonymized,
 	OpportunityCreated,
 	OpportunityStageAdvanced,
 	OpportunityStageRegressed,
@@ -5149,8 +5826,10 @@ function pipelineConversion(opportunities, stageIds) {
 		for (const o of opportunities) {
 			if (o.stageId === stageId && o.status === "open") currentCount++;
 			if (o.status === "won" || o.status === "lost") {
-				if (o.statusHistory?.some((h) => h.stageId === stageId) || o.stageId === stageId) if (o.status === "won") wonFromHere++;
-				else lostFromHere++;
+				if (o.statusHistory?.some((h) => h.stageId === stageId) || o.stageId === stageId) {
+					if (o.status === "won") wonFromHere++;
+					else lostFromHere++;
+				}
 			}
 		}
 		const closed = wonFromHere + lostFromHere;
@@ -5577,4 +6256,4 @@ var validators_exports = /* @__PURE__ */ __exportAll({
 	updateSequenceSchema: () => updateSequenceSchema
 });
 //#endregion
-export { ACTIVITY_MACHINE, ACTIVITY_STATUSES, ACTIVITY_TRANSITIONS, ACTIVITY_TYPES, AccountAssigned, AccountCreated, AccountEnriched, AccountMerged, AccountRepository, AccountUpdated, ActivityCancelled, ActivityCompleted, ActivityOutcomeRecorded, ActivityPlanned, ActivityRepository, ActivityRescheduled, AlreadyEnrolledError, CAMPAIGN_MACHINE, CAMPAIGN_STATUSES, CAMPAIGN_TRANSITIONS, CONVERSATION_CHANNELS, CONVERSATION_PARTICIPANT_KINDS, CONVERSATION_STATUSES, CRM_EVENTS, CRM_MODEL_NAMES, CampaignActivated, CampaignArchived, CampaignCompleted, CampaignCreated, CampaignPaused, CampaignRepository, CampaignResumed, ContactAssigned, ContactCreated, ContactEnriched, ContactMerged, ContactRepository, ContactUpdated, ConversationAssigned, ConversationCreated, ConversationReopened, ConversationRepository, ConversationResolved, CrmError, CrmEventDispatcher, DuplicateCampaignError, DuplicateLeadError, DuplicateSubscriptionError, EMAIL_EVENT_KINDS, EMAIL_EVENT_SUBJECT_KINDS, ENROLLMENT_MACHINE, ENROLLMENT_STATUSES, ENROLLMENT_SUBJECT_KINDS, ENROLLMENT_TRANSITIONS, EVENT_DERIVED_SUPPRESSION_REASONS, EmailEventBounced, EmailEventClicked, EmailEventComplained, EmailEventOpened, EmailEventRepository, EmailEventUnsubscribed, EmptyPipelineError, EnrollmentCompleted, EnrollmentCreated, EnrollmentExited, EnrollmentPaused, EnrollmentRepository, EnrollmentResumed, EnrollmentStepSent, InProcessCrmBus, InvalidActivityTransitionError, InvalidCampaignTransitionError, InvalidConfirmationTokenError, InvalidEnrollmentTransitionError, InvalidLeadTransitionError, InvalidOpportunityTransitionError, InvalidSequenceTransitionError, InvalidSubscriptionTransitionError, InvalidUnsubscribeTokenError, LEAD_MACHINE, LEAD_STATUSES, LEAD_TRANSITIONS, LeadAlreadyConvertedError, LeadAssigned, LeadConverted, LeadCreated, LeadDisqualified, LeadEnriched, LeadRepository, LeadScored, LeadService, LeadStatusChanged, LossReasonRepository, MESSAGE_DELIVERY_STATUSES, MESSAGE_DIRECTIONS, MessageReceived, MessageRepository, MessageSent, NotFoundError, NoteAdded, NoteRepository, OPPORTUNITY_MACHINE, OPPORTUNITY_STATUSES, OPPORTUNITY_TRANSITIONS, OpportunityAbandoned, OpportunityAmountChanged, OpportunityAssigned, OpportunityCreated, OpportunityExtended, OpportunityLost, OpportunityRepository, OpportunityStageAdvanced, OpportunityStageRegressed, OpportunityWon, PENDING_EVENTS, PipelineArchived, PipelineCreated, PipelineRepository, SEQUENCE_MACHINE, SEQUENCE_STATUSES, SEQUENCE_TRANSITIONS, SUBJECT_KINDS, SUBSCRIPTION_MACHINE, SUBSCRIPTION_STATUSES, SUBSCRIPTION_TRANSITIONS, SUPPRESSION_REASONS, SequenceActivated, SequenceArchived, SequenceCreated, SequencePaused, SequenceRepository, StageNotInPipelineError, SubscriptionBounced, SubscriptionComplained, SubscriptionConfirmed, SubscriptionCreated, SubscriptionRepository, SubscriptionUnsubscribed, SuppressionAdded, SuppressionRemoved, SuppressionRepository, UnmanagedSessionError, appendStatus, buildAccountSchema, buildActivitySchema, buildCampaignSchema, buildContactSchema, buildConversationSchema, buildEmailEventSchema, buildEnrollmentSchema, buildLeadSchema, buildLossReasonSchema, buildMessageSchema, buildNoteSchema, buildOpportunitySchema, buildPipelineSchema, buildSequenceSchema, buildSubscriptionSchema, buildSuppressionSchema, canTransitionActivity, canTransitionCampaign, canTransitionEnrollment, canTransitionLead, canTransitionOpportunity, canTransitionSequence, canTransitionSubscription, composeScorers, createAccountModel, createActivityModel, createCampaignModel, createContactModel, createConversationModel, createCrm, createCrmModels, createCrmRepositories, createEmailEventModel, createEvent, createLeadModel, createLossReasonModel, createMessageModel, createNoteModel, createOpportunityModel, createPipelineModel, createSubscriptionModel, crmEventDefinitions, defaultLeadScorer, flushPending, forecast, lastTransitionTo, latestEntry, pipelineConversion, runUnit, tenantFieldDef, timeInStatus, validators_exports as validators };
+export { ACTIVITY_MACHINE, ACTIVITY_STATUSES, ACTIVITY_TRANSITIONS, ACTIVITY_TYPES, ALL_CRM_MODULES, AccountAssigned, AccountCreated, AccountEnriched, AccountMerged, AccountRepository, AccountUpdated, ActivityCancelled, ActivityCompleted, ActivityOutcomeRecorded, ActivityPlanned, ActivityRepository, ActivityRescheduled, AlreadyEnrolledError, CAMPAIGN_MACHINE, CAMPAIGN_STATUSES, CAMPAIGN_TRANSITIONS, CONVERSATION_CHANNELS, CONVERSATION_PARTICIPANT_KINDS, CONVERSATION_STATUSES, CRM_EVENTS, CRM_MODEL_NAMES, CampaignActivated, CampaignArchived, CampaignCompleted, CampaignCreated, CampaignPaused, CampaignRepository, CampaignResumed, ContactAnonymized, ContactAssigned, ContactCreated, ContactEmailFormatError, ContactEnriched, ContactMerged, ContactRepository, ContactUpdated, ConversationAssigned, ConversationCreated, ConversationReopened, ConversationRepository, ConversationResolved, CrmError, CrmEventDispatcher, DuplicateCampaignError, DuplicateContactError, DuplicateLeadError, DuplicateSubscriptionError, EMAIL_EVENT_KINDS, EMAIL_EVENT_SUBJECT_KINDS, ENROLLMENT_MACHINE, ENROLLMENT_STATUSES, ENROLLMENT_SUBJECT_KINDS, ENROLLMENT_TRANSITIONS, EVENT_DERIVED_SUPPRESSION_REASONS, EmailEventBounced, EmailEventClicked, EmailEventComplained, EmailEventOpened, EmailEventRepository, EmailEventUnsubscribed, EmptyPipelineError, EnrollmentCompleted, EnrollmentCreated, EnrollmentExited, EnrollmentPaused, EnrollmentRepository, EnrollmentResumed, EnrollmentStepSent, InProcessCrmBus, InvalidActivityTransitionError, InvalidCampaignTransitionError, InvalidConfirmationTokenError, InvalidEnrollmentTransitionError, InvalidLeadTransitionError, InvalidOpportunityTransitionError, InvalidSequenceTransitionError, InvalidSubscriptionTransitionError, InvalidUnsubscribeTokenError, LEAD_MACHINE, LEAD_STATUSES, LEAD_TRANSITIONS, LeadAlreadyConvertedError, LeadAnonymized, LeadAssigned, LeadConverted, LeadCreated, LeadDisqualified, LeadEmailFormatError, LeadEnriched, LeadRepository, LeadScored, LeadService, LeadStatusChanged, LossReasonRepository, MESSAGE_DELIVERY_STATUSES, MESSAGE_DIRECTIONS, MessageReceived, MessageRepository, MessageSent, NotFoundError, NoteAdded, NoteRepository, OPPORTUNITY_MACHINE, OPPORTUNITY_STATUSES, OPPORTUNITY_TRANSITIONS, OpportunityAbandoned, OpportunityAmountChanged, OpportunityAssigned, OpportunityCreated, OpportunityExtended, OpportunityLost, OpportunityRepository, OpportunityStageAdvanced, OpportunityStageRegressed, OpportunityWon, PENDING_EVENTS, PipelineArchived, PipelineCreated, PipelineRepository, SEQUENCE_MACHINE, SEQUENCE_STATUSES, SEQUENCE_TRANSITIONS, SUBJECT_KINDS, SUBSCRIPTION_MACHINE, SUBSCRIPTION_STATUSES, SUBSCRIPTION_TRANSITIONS, SUPPRESSION_REASONS, SequenceActivated, SequenceArchived, SequenceCreated, SequencePaused, SequenceRepository, StageNotInPipelineError, SubscriptionBounced, SubscriptionComplained, SubscriptionConfirmed, SubscriptionCreated, SubscriptionRepository, SubscriptionUnsubscribed, SuppressionAdded, SuppressionEmailFormatError, SuppressionRemoved, SuppressionRepository, UnmanagedSessionError, appendStatus, buildAccountSchema, buildActivitySchema, buildCampaignSchema, buildContactSchema, buildConversationSchema, buildEmailEventSchema, buildEnrollmentSchema, buildLeadSchema, buildLossReasonSchema, buildMessageSchema, buildNoteSchema, buildOpportunitySchema, buildPipelineSchema, buildSequenceSchema, buildSubscriptionSchema, buildSuppressionSchema, canTransitionActivity, canTransitionCampaign, canTransitionEnrollment, canTransitionLead, canTransitionOpportunity, canTransitionSequence, canTransitionSubscription, composeScorers, createAccountModel, createActivityModel, createCampaignModel, createContactModel, createConversationModel, createCrmRepositories, createEmailEventModel, createEvent, createLeadModel, createLossReasonModel, createMessageModel, createNoteModel, createOpportunityModel, createPipelineModel, createSubscriptionModel, crmEmailKey, crmEventDefinitions, crmModelName, defaultLeadScorer, defineCrm, defineCrmModels, flushPending, forecast, lastTransitionTo, latestEntry, pipelineConversion, resolveCrmModules, runUnit, suppressionEmailKey, tenantFieldDef, timeInStatus, validators_exports as validators };