@fleox-agent-crm/agentcrm 0.0.0-stage → 0.3.0

package/dist/agent/chunks/firebase-DxGVQV9E.mjs

@@ -0,0 +1,454 @@
+import { createRequire as __acrmRequire } from "node:module";
+import { fileURLToPath as __acrmPath } from "node:url";
+import { dirname as __acrmDirname } from "node:path";
+const require2 = __acrmRequire(import.meta.url);
+const __filename = __acrmPath(import.meta.url);
+const __dirname = __acrmDirname(__filename);
+import "./jsx-runtime-Ca2uwGDr.mjs";
+import { r as reactExports } from "./index-Bnmav-Oh.mjs";
+import { c as createStoreCore, p as plainCopy, e as emptySnapshot, n as normalizeDoc } from "./core-Dy7vY9H6.mjs";
+import { w as withFileStore, F as FileStoreUnavailableError } from "./index-RCmo-uld.mjs";
+import { COLLECTIONS } from "./types-BOy9PUl7.mjs";
+import { a as assertFileId } from "./ids-u-noYcy5.mjs";
+import "./_commonjsHelpers-ClciMIcB.mjs";
+const adapters = /* @__PURE__ */ new Map();
+function registerAuthAdapter(backend, adapter) {
+  adapters.set(backend, adapter);
+}
+reactExports.createContext(null);
+const DELETE_FIELD = Symbol("deleteField");
+function errorCode(err) {
+  return err?.code ?? "";
+}
+function isPermissionDenied(err) {
+  const code = errorCode(err);
+  return code === "permission-denied" || code === "firestore/permission-denied";
+}
+const FIRESTORE_BATCH_LIMIT = 500;
+function chunk(items, size) {
+  const out = [];
+  for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size));
+  return out;
+}
+const INVITES_COLLECTION = "invites";
+const EXTENSION_CHUNKS_COLLECTION = "extensionChunks";
+const EXTENSION_CHUNK_CHARS = 3e5;
+const INBOX_COLLECTION = "inbox";
+const ROLES = ["admin", "member", "viewer"];
+class FirebaseAccessError extends Error {
+  constructor(reason, message, email) {
+    super(message);
+    this.reason = reason;
+    this.email = email;
+    this.name = "FirebaseAccessError";
+  }
+}
+function isFirebaseStore(store) {
+  return store.kind === "firebase" && typeof store.accessError === "function";
+}
+function toData(doc) {
+  const { id: _id, ...rest } = plainCopy(doc);
+  return rest;
+}
+function fromData(d) {
+  return normalizeDoc({ ...d.data, id: d.id });
+}
+function isRole(v) {
+  return typeof v === "string" && ROLES.includes(v);
+}
+function emailKey(email) {
+  return typeof email === "string" ? email.trim().toLowerCase() : "";
+}
+function isPlaceholder(doc) {
+  return !!doc && !doc.authUid && !!emailKey(doc.email);
+}
+function inviteOps(mutations, before, after) {
+  const ops = /* @__PURE__ */ new Map();
+  for (const m of mutations) {
+    if (m.collection !== "users") continue;
+    const id = m.op === "set" ? m.doc.id : m.id;
+    const prev = before(id);
+    const next = after.users.get(id);
+    const prevEmail = isPlaceholder(prev) ? emailKey(prev.email) : "";
+    const nextEmail = isPlaceholder(next) ? emailKey(next.email) : "";
+    if (prevEmail && prevEmail !== nextEmail) ops.set(prevEmail, { type: "delete", collection: INVITES_COLLECTION, id: prevEmail });
+    if (nextEmail && next) {
+      if (next.disabled) ops.set(nextEmail, { type: "delete", collection: INVITES_COLLECTION, id: nextEmail });
+      else ops.set(nextEmail, { type: "set", collection: INVITES_COLLECTION, id: nextEmail, data: { role: isRole(next.role) ? next.role : "member", userId: id, email: nextEmail } });
+    }
+  }
+  return [...ops.values()];
+}
+const chunkId = (ext, file, i) => `${ext}__${file}__${i}`;
+function chunkCounts(doc) {
+  const files = doc?.files ?? {};
+  const out = {};
+  for (const [k, v] of Object.entries(files)) if (typeof v === "string") out[k] = Math.ceil(v.length / EXTENSION_CHUNK_CHARS);
+  return out;
+}
+function extensionSetOps(doc, previous) {
+  const files = doc.files ?? {};
+  const size = Object.values(files).reduce((n, v) => n + (typeof v === "string" ? v.length : 0), 0);
+  const ops = [];
+  const counts = {};
+  const data = toData(doc);
+  if (size > EXTENSION_CHUNK_CHARS) {
+    for (const [file, v] of Object.entries(files)) {
+      if (typeof v !== "string") continue;
+      const n = Math.ceil(v.length / EXTENSION_CHUNK_CHARS);
+      counts[file] = n;
+      for (let i = 0; i < n; i++) {
+        ops.push({ type: "set", collection: EXTENSION_CHUNKS_COLLECTION, id: chunkId(doc.id, file, i), data: { ext: doc.id, file, index: i, data: v.slice(i * EXTENSION_CHUNK_CHARS, (i + 1) * EXTENSION_CHUNK_CHARS) } });
+      }
+    }
+    data.files = {};
+    data.chunks = counts;
+  }
+  for (const [file, n] of Object.entries(chunkCounts(previous))) {
+    for (let i = counts[file] ?? 0; i < n; i++) ops.push({ type: "delete", collection: EXTENSION_CHUNKS_COLLECTION, id: chunkId(doc.id, file, i) });
+  }
+  ops.unshift({ type: "set", collection: "extensions", id: doc.id, data });
+  return ops;
+}
+function assembleExtensionDocs(docs, chunks) {
+  const byExt = /* @__PURE__ */ new Map();
+  for (const c of chunks) {
+    const ext = String(c.data.ext ?? "");
+    byExt.set(ext, [...byExt.get(ext) ?? [], c]);
+  }
+  return docs.map((d) => {
+    const counts = d.data.chunks;
+    if (!counts || typeof counts !== "object") return d;
+    const files = {};
+    const parts = byExt.get(d.id) ?? [];
+    for (const [file, n] of Object.entries(counts)) {
+      const pieces = parts.filter((p) => p.data.file === file).sort((a, b) => Number(a.data.index) - Number(b.data.index));
+      if (pieces.length !== n) continue;
+      files[file] = pieces.map((p) => String(p.data.data ?? "")).join("");
+    }
+    const { chunks: _chunks, ...rest } = d.data;
+    return { id: d.id, data: { ...rest, files } };
+  });
+}
+function mutationOps(mutations, before) {
+  const ops = [];
+  for (const m of mutations) {
+    if (m.op === "set" && m.collection === "extensions") ops.push(...extensionSetOps(m.doc, before.extensions.get(m.doc.id)));
+    else if (m.op === "set") ops.push({ type: "set", collection: m.collection, id: m.doc.id, data: toData(m.doc) });
+    else if (m.op === "delete") {
+      ops.push({ type: "delete", collection: m.collection, id: m.id });
+      if (m.collection === "extensions") {
+        for (const [file, n] of Object.entries(chunkCounts(before.extensions.get(m.id)))) for (let i = 0; i < n; i++) ops.push({ type: "delete", collection: EXTENSION_CHUNKS_COLLECTION, id: chunkId(m.id, file, i) });
+      }
+    } else {
+      if (!before[m.collection].has(m.id)) continue;
+      const data = {};
+      for (const [k, v] of Object.entries(m.fields)) {
+        if (k === "id" || k.startsWith("id.")) continue;
+        data[k] = v === void 0 ? DELETE_FIELD : plainCopy(v);
+      }
+      if (Object.keys(data).length) ops.push({ type: "update", collection: m.collection, id: m.id, data });
+    }
+  }
+  return ops;
+}
+const STORAGE_FILES_DIR = "files";
+const STORAGE_NOT_ENABLED = "Firebase Storage isn't enabled for this project: enable it in the Firebase console (Build → Storage), add `storageBucket` to the web config and deploy the storage rules (docs/files.md).";
+function firebaseFileStore(api) {
+  const storage = () => {
+    if (!api.storage) throw new FileStoreUnavailableError(STORAGE_NOT_ENABLED);
+    return api.storage;
+  };
+  const path = (id) => {
+    assertFileId(id);
+    return `${STORAGE_FILES_DIR}/${id}`;
+  };
+  const wrap = async (fn) => {
+    try {
+      return await fn();
+    } catch (err) {
+      const code = errorCode(err);
+      if (code === "storage/unknown" || code === "storage/bucket-not-found" || code === "storage/no-default-bucket") throw new FileStoreUnavailableError(STORAGE_NOT_ENABLED);
+      throw err;
+    }
+  };
+  return {
+    kind: "firebase",
+    put: (id, bytes, meta) => wrap(() => storage().put(path(id), bytes, meta?.mime)),
+    async putMany(items) {
+      for (const it of items) await wrap(() => storage().put(path(it.id), it.bytes, it.meta?.mime));
+    },
+    get: (id) => wrap(() => storage().get(path(id))),
+    delete: (id) => wrap(() => storage().delete(path(id)))
+  };
+}
+function createFirebaseStoreWith(opts) {
+  const api = opts.api;
+  const requireVerified = opts.requireVerifiedEmail !== false;
+  const now = opts.now ?? Date.now;
+  let identityPromise = null;
+  let currentIdentity = null;
+  let lastAccessError = null;
+  let rawUsers = /* @__PURE__ */ new Map();
+  let reconciling = false;
+  const offAuth = api.auth.onChange((u) => {
+    if (!u || u.uid !== currentIdentity?.uid) {
+      identityPromise = null;
+      currentIdentity = null;
+    }
+  });
+  function buildSnapshot(raw, chunks) {
+    const s = emptySnapshot();
+    for (const c of COLLECTIONS) {
+      const docs = c === "extensions" ? assembleExtensionDocs(raw.get(c) ?? [], chunks) : raw.get(c) ?? [];
+      for (const d of docs) s[c].set(d.id, fromData(d));
+    }
+    rawUsers = new Map(s.users);
+    for (const u of [...s.users.values()]) {
+      if (typeof u.replaces === "string" && u.replaces !== u.id) s.users.delete(u.replaces);
+    }
+    return s;
+  }
+  async function readCollection(c) {
+    try {
+      return await api.listCollection(c);
+    } catch (err) {
+      if (isPermissionDenied(err)) return [];
+      throw err;
+    }
+  }
+  async function ensureUserRecord(user) {
+    const email = emailKey(user.email);
+    let existing = null;
+    try {
+      existing = await api.getDoc("users", user.uid);
+    } catch (err) {
+      if (!isPermissionDenied(err)) throw err;
+    }
+    if (existing) return isRole(existing.role) ? existing.role : "viewer";
+    if (requireVerified && !user.emailVerified) throw new FirebaseAccessError("unverified", "Verify your email address to continue.", email);
+    const base = {
+      email,
+      name: user.displayName || email.split("@")[0] || "User",
+      authUid: user.uid,
+      createdAt: now(),
+      updatedAt: now(),
+      ...user.photoURL ? { avatarUrl: user.photoURL } : {}
+    };
+    const create = (role2, extra = {}) => api.commit([{ type: "set", collection: "users", id: user.uid, data: { ...base, ...extra, role: role2 } }]);
+    try {
+      await create("admin");
+      return "admin";
+    } catch (err) {
+      if (!isPermissionDenied(err)) throw err;
+    }
+    let invite = null;
+    try {
+      invite = email ? await api.getDoc(INVITES_COLLECTION, email) : null;
+    } catch (err) {
+      if (!isPermissionDenied(err)) throw err;
+    }
+    const role = invite && isRole(invite.role) ? invite.role : "member";
+    try {
+      await create(role, invite && typeof invite.userId === "string" ? { replaces: invite.userId } : {});
+      return role;
+    } catch (err) {
+      if (!isPermissionDenied(err)) throw err;
+    }
+    throw new FirebaseAccessError("notInvited", "This account has not been invited to this CRM. Ask an admin to add your email in Settings → Users.", email);
+  }
+  async function resolveIdentity() {
+    const user = await api.auth.currentUser();
+    if (!user) {
+      lastAccessError = null;
+      return null;
+    }
+    try {
+      const role = await ensureUserRecord(user);
+      lastAccessError = null;
+      return { uid: user.uid, email: emailKey(user.email), displayName: user.displayName || emailKey(user.email), role };
+    } catch (err) {
+      lastAccessError = err instanceof FirebaseAccessError ? err : new FirebaseAccessError("error", err.message, emailKey(user.email));
+      return null;
+    }
+  }
+  async function persist(mutations, before, after) {
+    const ops = mutationOps(mutations, before);
+    if (currentIdentity?.role === "admin") ops.push(...inviteOps(mutations, (id) => before.users.get(id) ?? rawUsers.get(id), after));
+    for (const part of chunk(ops, FIRESTORE_BATCH_LIMIT)) await api.commit(part);
+    for (const m of mutations) {
+      if (m.collection !== "users") continue;
+      const id = m.op === "set" ? m.doc.id : m.id;
+      const doc = after.users.get(id);
+      if (doc) rawUsers.set(id, doc);
+      else rawUsers.delete(id);
+    }
+  }
+  const core = createStoreCore({
+    kind: "firebase",
+    async load() {
+      const raw = /* @__PURE__ */ new Map();
+      let chunks = [];
+      await Promise.all([...COLLECTIONS.map(async (c) => raw.set(c, await readCollection(c))), readCollection(EXTENSION_CHUNKS_COLLECTION).then((d) => chunks = d)]);
+      const snap = buildSnapshot(raw, chunks);
+      scheduleReconcile();
+      return snap;
+    },
+    persist: (mutations, before, after) => persist(mutations, before, after),
+    watch(onRemote) {
+      const raw = /* @__PURE__ */ new Map();
+      let chunks = null;
+      const emit = () => {
+        if (raw.size < COLLECTIONS.length || chunks === null) return;
+        onRemote(buildSnapshot(raw, chunks));
+        scheduleReconcile();
+      };
+      const offs = COLLECTIONS.map(
+        (c) => api.watchCollection(
+          c,
+          (docs) => {
+            raw.set(c, docs);
+            emit();
+          },
+          (err) => {
+            if (isPermissionDenied(err)) raw.set(c, []);
+            else console.warn(`[firebase] live updates of ${c} stopped:`, err);
+          }
+        )
+      );
+      offs.push(
+        api.watchCollection(
+          EXTENSION_CHUNKS_COLLECTION,
+          (docs) => {
+            chunks = docs;
+            emit();
+          },
+          (err) => {
+            if (isPermissionDenied(err)) chunks = [];
+            else console.warn("[firebase] live updates of extension chunks stopped:", err);
+          }
+        )
+      );
+      return () => offs.forEach((off) => off());
+    },
+    identity() {
+      if (!identityPromise) {
+        identityPromise = resolveIdentity().then((id) => {
+          currentIdentity = id;
+          if (!id) identityPromise = null;
+          return id;
+        });
+      }
+      return identityPromise;
+    },
+    close() {
+      offAuth();
+    }
+  });
+  function scheduleReconcile() {
+    if (currentIdentity?.role !== "admin" || reconciling) return;
+    const joined = [...rawUsers.values()].filter((u) => typeof u.replaces === "string");
+    if (!joined.length) return;
+    reconciling = true;
+    setTimeout(() => {
+      void reconcile(joined).finally(() => reconciling = false);
+    }, 0);
+  }
+  async function reconcile(joined) {
+    const mutations = [];
+    const inviteDeletes = [];
+    const objects = core.list("objects");
+    const userFields = new Map(
+      objects.map((o) => [o.id, (o.fields ?? []).filter((f) => f.type === "user").map((f) => f.id)])
+    );
+    for (const u of joined) {
+      const from = u.replaces;
+      const to = u.id;
+      const placeholder = rawUsers.get(from);
+      for (const r of core.list("records")) {
+        const fields = {};
+        if (r.ownerId === from) fields.ownerId = to;
+        if (r.createdBy === from) fields.createdBy = to;
+        for (const f of userFields.get(r.object) ?? []) {
+          const v = r.fields?.[f];
+          if (v === from) fields[`fields.${f}`] = to;
+          else if (Array.isArray(v) && v.includes(from)) fields[`fields.${f}`] = v.map((x) => x === from ? to : x);
+        }
+        if (Object.keys(fields).length) mutations.push({ op: "patch", collection: "records", id: r.id, fields });
+      }
+      for (const a of core.list("activities")) {
+        if (a.assigneeId === from) mutations.push({ op: "patch", collection: "activities", id: a.id, fields: { assigneeId: to } });
+      }
+      const settings = core.get("settings", "general");
+      if (settings?.ownerUserId === from) mutations.push({ op: "patch", collection: "settings", id: "general", fields: { ownerUserId: to } });
+      if (placeholder) {
+        mutations.push({ op: "delete", collection: "users", id: from });
+        if (emailKey(placeholder.email)) inviteDeletes.push({ type: "delete", collection: INVITES_COLLECTION, id: emailKey(placeholder.email) });
+      }
+      mutations.push({ op: "patch", collection: "users", id: to, fields: { replaces: void 0, ...placeholder && placeholder.role !== u.role && isRole(placeholder.role) ? { role: placeholder.role } : {} } });
+    }
+    try {
+      await core.write(mutations, { message: "Link invited users" });
+      if (inviteDeletes.length) await api.commit(inviteDeletes);
+    } catch (err) {
+      console.warn("[firebase] could not link invited users:", err);
+    }
+  }
+  withFileStore(core, firebaseFileStore(api));
+  return Object.assign(core, {
+    api,
+    accessError: () => lastAccessError,
+    resetSession() {
+      identityPromise = null;
+      currentIdentity = null;
+      lastAccessError = null;
+    }
+  });
+}
+const apis = /* @__PURE__ */ new Map();
+function firebaseApiFor(config) {
+  const key = config.firebase.projectId ?? "default";
+  let api = apis.get(key);
+  if (!api) {
+    api = import("./sdk-whvfg786.mjs").then((n) => n.s).then((m) => m.createSdkFirebaseApi(config.firebase));
+    apis.set(key, api);
+    api.catch(() => apis.delete(key));
+  }
+  return api;
+}
+let activeApi = null;
+registerAuthAdapter("firebase", {
+  async signOut() {
+    await activeApi?.auth.signOut();
+  }
+});
+async function createFirebaseStore(config, _opts = {}) {
+  const cfg = config;
+  if (!cfg.firebase?.apiKey || !cfg.firebase.projectId) throw new Error("The Firebase web config (apiKey, projectId) is missing.");
+  const api = await firebaseApiFor(cfg);
+  activeApi = api;
+  return createFirebaseStoreWith({ api });
+}
+export {
+  DELETE_FIELD,
+  EXTENSION_CHUNKS_COLLECTION,
+  EXTENSION_CHUNK_CHARS,
+  FIRESTORE_BATCH_LIMIT,
+  FirebaseAccessError,
+  INBOX_COLLECTION,
+  INVITES_COLLECTION,
+  STORAGE_FILES_DIR,
+  STORAGE_NOT_ENABLED,
+  assembleExtensionDocs,
+  chunk,
+  createFirebaseStore,
+  createFirebaseStoreWith,
+  emailKey,
+  errorCode,
+  firebaseApiFor,
+  firebaseFileStore,
+  inviteOps,
+  isFirebaseStore,
+  isPermissionDenied,
+  mutationOps
+};

package/dist/agent/chunks/firebaseRules-iori-s7U.mjs

@@ -0,0 +1,221 @@
+import { createRequire as __acrmRequire } from "node:module";
+import { fileURLToPath as __acrmPath } from "node:url";
+import { dirname as __acrmDirname } from "node:path";
+const require2 = __acrmRequire(import.meta.url);
+const __filename = __acrmPath(import.meta.url);
+const __dirname = __acrmDirname(__filename);
+const INBOX_LIMITS = {
+  maxFields: 60,
+  maxMetaKeys: 10,
+  formIdPattern: "^[A-Za-z0-9_-]{1,64}$",
+  // Accepted clock skew of `createdAt` vs the server (visitors' clocks).
+  clockSkewMs: 864e5
+};
+const EMAIL_RE = /^[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}$/;
+const DOMAIN_RE = /^[a-z0-9-]+(\.[a-z0-9-]+)+$/;
+function normalizeRulesOptions(opts) {
+  const adminEmail = opts.adminEmail.trim().toLowerCase();
+  if (!EMAIL_RE.test(adminEmail)) throw new Error(`"${opts.adminEmail}" is not a valid admin email for the rules.`);
+  const allowedDomains = (opts.allowedDomains ?? []).map((d) => d.trim().toLowerCase().replace(/^@/, "")).filter(Boolean);
+  for (const d of allowedDomains) if (!DOMAIN_RE.test(d)) throw new Error(`"${d}" is not a valid domain.`);
+  const signup = opts.signup ?? (allowedDomains.length ? "domain" : "invite");
+  if (signup === "domain" && !allowedDomains.length) throw new Error('Sign-up "domain" needs at least one allowed domain.');
+  return { adminEmail, signup, allowedDomains, requireVerifiedEmail: opts.requireVerifiedEmail !== false };
+}
+const ADMIN_WRITE = ["objects", "pipelines", "forms", "settings", "config", "extensions"];
+const MEMBER_WRITE = ["records", "activities"];
+function buildFirestoreRules(input) {
+  const o = normalizeRulesOptions(input);
+  const verified = o.requireVerifiedEmail ? " && request.auth.token.email_verified == true" : "";
+  const signupRule = o.signup === "open" ? "true" : o.signup === "domain" ? `callerEmail().matches('^[^@]+@(${o.allowedDomains.map((d) => d.replace(/\./g, "[.]")).join("|")})$')` : "false";
+  const lines = [
+    "rules_version = '2';",
+    "",
+    "// Generated by AgentCRM (src/ops/firebaseRules.ts) — see docs/firebase.md.",
+    `// Sign-up: ${o.signup}${o.signup === "domain" ? ` (${o.allowedDomains.join(", ")})` : ""}. Re-generate rather than edit by hand.`,
+    "service cloud.firestore {",
+    "  match /databases/{database}/documents {",
+    "",
+    "    // ─── Identity & roles ─────────────────────────────────────────────",
+    "    function bootstrapAdminEmail() {",
+    `      return "${o.adminEmail}";`,
+    "    }",
+    "",
+    "    function signedIn() {",
+    "      return request.auth != null;",
+    "    }",
+    "",
+    "    function hasEmail() {",
+    `      return signedIn() && request.auth.token.email != null${verified};`,
+    "    }",
+    "",
+    "    function callerEmail() {",
+    "      return request.auth.token.email.lower();",
+    "    }",
+    "",
+    "    function isBootstrapAdmin() {",
+    "      return hasEmail() && callerEmail() == bootstrapAdminEmail();",
+    "    }",
+    "",
+    "    function selfPath() {",
+    "      return /databases/$(database)/documents/users/$(request.auth.uid);",
+    "    }",
+    "",
+    "    // admin | member | viewer | none (no record / disabled).",
+    "    function role() {",
+    "      return isBootstrapAdmin() ? 'admin'",
+    "        : !exists(selfPath()) ? 'none'",
+    "        : get(selfPath()).data.get('disabled', false) == true ? 'none'",
+    "        : get(selfPath()).data.get('role', 'none');",
+    "    }",
+    "",
+    "    function isAdmin() {",
+    "      return signedIn() && role() == 'admin';",
+    "    }",
+    "",
+    "    function isMember() {",
+    "      return signedIn() && role() in ['admin', 'member'];",
+    "    }",
+    "",
+    "    function isActive() {",
+    "      return signedIn() && role() in ['admin', 'member', 'viewer'];",
+    "    }",
+    "",
+    "    function validRole(r) {",
+    "      return r in ['admin', 'member', 'viewer'];",
+    "    }",
+    "",
+    "    // ─── invites/{email} ──────────────────────────────────────────────",
+    "    // Mirrored by the admin from the users it adds (Settings → Users).",
+    "    function invitePath() {",
+    "      return /databases/$(database)/documents/invites/$(callerEmail());",
+    "    }",
+    "",
+    "    match /invites/{email} {",
+    "      allow read: if isAdmin() || (hasEmail() && callerEmail() == email);",
+    "      allow create, update: if isAdmin() && email == email.lower()",
+    "        && validRole(request.resource.data.role);",
+    "      allow delete: if isAdmin();",
+    "    }",
+    "",
+    "    // ─── users/{uid} ──────────────────────────────────────────────────",
+    "    function signupAllowed() {",
+    `      return ${signupRule};`,
+    "    }",
+    "",
+    "    // First sign-in: the caller creates its own record.",
+    "    function selfCreate(uid) {",
+    "      let d = request.resource.data;",
+    "      return hasEmail() && request.auth.uid == uid",
+    "        && d.email == callerEmail()",
+    "        && d.get('authUid', '') == uid",
+    "        && d.get('disabled', false) == false",
+    "        && (",
+    "          (isBootstrapAdmin() && d.role == 'admin')",
+    "          || (exists(invitePath()) && d.role == get(invitePath()).data.role",
+    "              && d.get('replaces', get(invitePath()).data.get('userId', '')) == get(invitePath()).data.get('userId', ''))",
+    "          || (!exists(invitePath()) && signupAllowed() && d.role == 'member' && !('replaces' in d))",
+    "        );",
+    "    }",
+    "",
+    "    match /users/{uid} {",
+    "      allow read: if isActive() || (signedIn() && request.auth.uid == uid);",
+    "      allow create: if (isAdmin() && validRole(request.resource.data.role)) || selfCreate(uid);",
+    "      // Nobody changes their own role / email / disabled flag.",
+    "      allow update: if (isAdmin() && validRole(request.resource.data.role))",
+    "        || (isActive() && request.auth.uid == uid",
+    "            && request.resource.data.diff(resource.data).affectedKeys().hasOnly(['name', 'avatarUrl', 'updatedAt']));",
+    "      allow delete: if isAdmin();",
+    "    }",
+    "",
+    "    // ─── CRM data ─────────────────────────────────────────────────────"
+  ];
+  for (const c of MEMBER_WRITE) {
+    lines.push(`    match /${c}/{id} {`, "      allow read: if isActive();", "      allow create, update, delete: if isMember();", "    }", "");
+  }
+  lines.push(
+    "    // Views: members manage their own private views; shared views are admin-only.",
+    "    match /views/{id} {",
+    "      allow read: if isActive();",
+    "      allow create: if isAdmin()",
+    "        || (isMember() && request.resource.data.get('ownerId', '') == request.auth.uid",
+    "            && request.resource.data.get('shared', false) == false);",
+    "      allow update: if isAdmin()",
+    "        || (isMember() && resource.data.get('ownerId', '') == request.auth.uid",
+    "            && request.resource.data.get('ownerId', '') == request.auth.uid",
+    "            && request.resource.data.get('shared', false) == false);",
+    "      allow delete: if isAdmin() || (isMember() && resource.data.get('ownerId', '') == request.auth.uid);",
+    "    }",
+    "",
+    "    // Automations: admins edit; members running them may stamp lastRunAt.",
+    "    match /automations/{id} {",
+    "      allow read: if isActive();",
+    "      allow create, delete: if isAdmin();",
+    "      allow update: if isAdmin()",
+    "        || (isMember() && request.resource.data.diff(resource.data).affectedKeys().hasOnly(['lastRunAt', 'updatedAt']));",
+    "    }",
+    "",
+    "    match /automationRuns/{id} {",
+    "      allow read: if isActive();",
+    "      allow create, update: if isMember();",
+    "      allow delete: if isAdmin();",
+    "    }",
+    "",
+    "    // File metadata (bytes in Firebase Storage, see storage.rules): members",
+    "    // upload / attach / soft-delete; only admins purge (compact).",
+    "    match /files/{id} {",
+    "      allow read: if isActive();",
+    "      allow create, update: if isMember();",
+    "      allow delete: if isAdmin();",
+    "    }",
+    ""
+  );
+  for (const c of ADMIN_WRITE) {
+    lines.push(`    match /${c}/{id} {`, "      allow read: if isActive();", "      allow write: if isAdmin();", "    }", "");
+  }
+  lines.push(
+    "    // Pieces of large extension bundles (src/data/firebase.ts).",
+    "    match /extensionChunks/{id} {",
+    "      allow read: if isActive();",
+    "      allow write: if isAdmin();",
+    "    }",
+    "",
+    "    // ─── inbox/{id}: public lead-form submissions ──────────────────────",
+    "    function validSubmission(d) {",
+    "      return d.keys().hasAll(['formId', 'data', 'createdAt'])",
+    "        && d.keys().hasOnly(['formId', 'data', 'createdAt', 'meta'])",
+    `        && d.formId is string && d.formId.matches('${INBOX_LIMITS.formIdPattern}')`,
+    "        && exists(/databases/$(database)/documents/forms/$(d.formId))",
+    `        && d.data is map && d.data.size() <= ${INBOX_LIMITS.maxFields}`,
+    `        && (!('meta' in d) || (d.meta is map && d.meta.size() <= ${INBOX_LIMITS.maxMetaKeys}))`,
+    "        && d.createdAt is int",
+    `        && d.createdAt > request.time.toMillis() - ${INBOX_LIMITS.clockSkewMs}`,
+    `        && d.createdAt < request.time.toMillis() + ${INBOX_LIMITS.clockSkewMs};`,
+    "    }",
+    "",
+    "    match /inbox/{id} {",
+    "      // Public: anyone (the static lead form) may create, nobody else reads.",
+    "      allow create: if validSubmission(request.resource.data);",
+    "      // Ingested (then deleted) by members — the admin or the CLI.",
+    "      allow read, delete: if isMember();",
+    "      // Failed submissions are only marked {status, error}.",
+    "      allow update: if isMember()",
+    "        && request.resource.data.diff(resource.data).affectedKeys().hasOnly(['status', 'error']);",
+    "    }",
+    "",
+    "    // Anything else: closed.",
+    "    match /{document=**} {",
+    "      allow read, write: if false;",
+    "    }",
+    "  }",
+    "}",
+    ""
+  );
+  return lines.join("\n");
+}
+[...MEMBER_WRITE, "views", "automations", "automationRuns", "files", ...ADMIN_WRITE, "users"];
+export {
+  INBOX_LIMITS,
+  buildFirestoreRules,
+  normalizeRulesOptions
+};