twenty-app-intake 0.3.0 → 0.5.0

package/src/logic-functions/test-ingest.mjs

@@ -21,6 +21,9 @@ var __anyHandler = {
 var __anyStub = new Proxy(() => void 0, __anyHandler);
 var defineLogicFunction = __defineFactoryStub;
 
+// src/logic-functions/test-ingest.ts
+import { CoreApiClient } from "twenty-client-sdk/core";
+
 // src/lib/flattener.ts
 var MAX_DEPTH = 8;
 function flatten(input, prefix = "", depth = 0, seen = /* @__PURE__ */ new WeakSet()) {
@@ -77,7 +80,7 @@ function detectStructure(raw) {
 
 // src/constants/field-map.ts
 function normaliseKey(key) {
-  return key.replace(/([A-Z])/g, "_$1").toLowerCase().replace(/[-\s.]/g, "_").replace(/_{2,}/g, "_");
+  return key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").toLowerCase().replace(/[-\s.]/g, "_").replace(/_{2,}/g, "_");
 }
 var FIELD_MAP = {
   // ── Phone ─────────────────────────────────────────────────────────────────
@@ -277,16 +280,163 @@ function classify(key, value) {
   return "field";
 }
 
+// src/lib/merge.ts
+function decideMerge(existing, incoming, policy, strategy = "INHERIT") {
+  if (isEmpty(incoming)) return { write: false, status: "preserved" };
+  if (isEmpty(existing)) return { write: true, status: "filled-empty" };
+  if (sameValue(existing, incoming)) return { write: false, status: "unchanged" };
+  const effective = strategy === "INHERIT" ? policy : strategy;
+  return effective === "NEWEST_WINS" ? { write: true, status: "set" } : { write: false, status: "preserved" };
+}
+function mergePatch(existing, incoming, policy, strategyFor = () => "INHERIT") {
+  const patch = {};
+  const decisions = {};
+  for (const [key, value] of Object.entries(incoming)) {
+    const decision = decideMerge(existing[key], value, policy, strategyFor(key));
+    decisions[key] = decision;
+    if (decision.write) patch[key] = value;
+  }
+  return { patch, decisions };
+}
+function parseFieldMergeStrategy(raw) {
+  switch ((raw ?? "").toUpperCase()) {
+    case "PRESERVE":
+      return "PRESERVE";
+    case "NEWEST_WINS":
+      return "NEWEST_WINS";
+    default:
+      return "INHERIT";
+  }
+}
+function isEmpty(value) {
+  if (value === null || value === void 0) return true;
+  if (typeof value === "string") return value.trim() === "";
+  if (Array.isArray(value)) return value.length === 0;
+  if (typeof value === "object") {
+    const entries = Object.entries(value);
+    if (entries.length === 0) return true;
+    const meaningful = entries.filter(([k]) => !IGNORED_COMPOSITE_KEYS.has(k));
+    if (meaningful.length === 0) return true;
+    return meaningful.every(([, v]) => isEmpty(v));
+  }
+  return false;
+}
+var IGNORED_COMPOSITE_KEYS = /* @__PURE__ */ new Set([
+  "currencyCode",
+  "primaryLinkLabel",
+  "primaryPhoneCountryCode",
+  "primaryPhoneCallingCode",
+  "additionalLinks",
+  "additionalEmails",
+  "additionalPhones"
+]);
+function sameValue(a, b) {
+  if (a === b) return true;
+  if (typeof a === "object" && typeof b === "object" && a !== null && b !== null) {
+    try {
+      return JSON.stringify(sortKeys(a)) === JSON.stringify(sortKeys(b));
+    } catch {
+      return false;
+    }
+  }
+  return String(a) === String(b);
+}
+function sortKeys(value) {
+  if (value === null || typeof value !== "object") return value;
+  if (Array.isArray(value)) return value.map(sortKeys);
+  const obj = value;
+  const out = {};
+  for (const key of Object.keys(obj).sort()) out[key] = sortKeys(obj[key]);
+  return out;
+}
+
 // src/lib/normalizer.ts
-function normalizeFields(flat, rules = []) {
-  const sorted = [...rules].sort((a, b) => b.priority - a.priority);
+function actionForRule(rule) {
+  if (rule.action) return rule.action;
+  switch ((rule.fieldType ?? "").toUpperCase()) {
+    case "SKIP":
+      return "skip";
+    case "NOTE":
+      return "note";
+    default:
+      return "field";
+  }
+}
+function typeForRule(rule) {
+  switch ((rule.fieldType ?? "").toUpperCase()) {
+    case "NOTE":
+      return "RICH_TEXT";
+    case "SKIP":
+      return "TEXT";
+    case "":
+      return "TEXT";
+    default:
+      return rule.fieldType;
+  }
+}
+var OPPORTUNITY_KEY_PREFIXES = ["opportunity_", "opp_", "deal_"];
+function parseTargetObject(raw) {
+  switch ((raw ?? "").toUpperCase()) {
+    case "PERSON":
+      return "person";
+    case "COMPANY":
+      return "company";
+    case "OPPORTUNITY":
+      return "opportunity";
+    default:
+      return "auto";
+  }
+}
+var PROTECTED_CANONICAL_NAMES = /* @__PURE__ */ new Set([
+  "email",
+  "phone",
+  "firstName",
+  "lastName",
+  "fullName"
+]);
+function compileRule(rule) {
+  try {
+    return { ...rule, matcher: new RegExp(rule.inputPattern, "i") };
+  } catch {
+    return { ...rule, matcher: null };
+  }
+}
+function ruleMatches(rule, key, lookupKey) {
+  if (rule.inputPattern === key || rule.inputPattern === lookupKey) return true;
+  if (!rule.matcher) return false;
+  return rule.matcher.test(key) || rule.matcher.test(lookupKey);
+}
+function normalizeFields(flat, rules = [], warnings = []) {
+  const compiled = [...rules].sort((a, b) => b.priority - a.priority).map(compileRule);
   return Object.entries(flat).map(
-    ([key, value]) => normalizeField(key, value, sorted)
+    ([key, value]) => normalizeField(key, value, compiled, warnings)
   );
 }
-function normalizeField(key, value, rules) {
+function normalizeField(key, value, rules, warnings) {
   const lookupKey = normaliseKey(key);
   const builtIn = FIELD_MAP[lookupKey];
+  for (const rule of rules) {
+    if (!ruleMatches(rule, key, lookupKey)) continue;
+    if (builtIn && PROTECTED_CANONICAL_NAMES.has(builtIn.canonicalName)) {
+      const displaces = rule.canonicalName !== builtIn.canonicalName || actionForRule(rule) !== "field";
+      if (displaces) {
+        warnings.push(
+          `Rule "${rule.inputPattern}" matched "${key}", which the built-in map holds as the contact's ${builtIn.canonicalName}. The built-in mapping was kept: a contact with no ${builtIn.canonicalName} cannot be found again, so every submission would create a duplicate. Point the rule at a key the built-in map does not already own.`
+        );
+        continue;
+      }
+    }
+    return {
+      originalKey: key,
+      canonicalName: rule.canonicalName,
+      twentyType: typeForRule(rule),
+      action: actionForRule(rule),
+      value,
+      source: "rule",
+      targetObject: parseTargetObject(rule.targetObject),
+      mergeStrategy: parseFieldMergeStrategy(rule.mergeStrategy)
+    };
+  }
   if (builtIn) {
     return {
       originalKey: key,
@@ -294,37 +444,24 @@ function normalizeField(key, value, rules) {
       twentyType: builtIn.twentyType,
       action: builtIn.action,
       value,
-      source: "builtin"
+      source: "builtin",
+      targetObject: "auto"
     };
   }
-  for (const rule of rules) {
-    let matches = false;
-    try {
-      matches = rule.inputPattern === key || rule.inputPattern === lookupKey || new RegExp(rule.inputPattern, "i").test(key);
-    } catch {
-      matches = rule.inputPattern === key;
-    }
-    if (matches) {
-      return {
-        originalKey: key,
-        canonicalName: rule.canonicalName,
-        twentyType: rule.fieldType,
-        action: rule.action,
-        value,
-        source: "rule"
-      };
-    }
-  }
   const detectedType = detectType(value);
   const classification = classify(key, value);
-  const canonicalName = classification === "field" ? toExtFieldName(key) : lookupKey;
+  const prefix = OPPORTUNITY_KEY_PREFIXES.find((p) => lookupKey.startsWith(p));
+  const targetObject = prefix ? "opportunity" : "auto";
+  const bareKey = prefix ? lookupKey.slice(prefix.length) : key;
+  const canonicalName = classification === "field" ? toExtFieldName(bareKey) : lookupKey;
   return {
     originalKey: key,
     canonicalName,
     twentyType: detectedType,
     action: classification === "field" ? "field" : classification,
     value,
-    source: "passthrough"
+    source: "passthrough",
+    targetObject
   };
 }
 function toExtFieldName(key) {
@@ -488,54 +625,720 @@ var coreApi = {
   post: (path, body) => request(`${apiUrl()}/rest`, "POST", path, body),
   patch: (path, body) => request(`${apiUrl()}/rest`, "PATCH", path, body)
 };
+var metaApi = {
+  get: (path) => request(`${apiUrl()}/rest/metadata`, "GET", path),
+  post: (path, body) => request(`${apiUrl()}/rest/metadata`, "POST", path, body)
+};
+
+// src/constants/free-email-domains.ts
+var FREE_EMAIL_DOMAINS = /* @__PURE__ */ new Set([
+  // Google
+  "gmail.com",
+  "googlemail.com",
+  // Microsoft
+  "outlook.com",
+  "outlook.co.uk",
+  "outlook.fr",
+  "outlook.de",
+  "outlook.es",
+  "hotmail.com",
+  "hotmail.co.uk",
+  "hotmail.fr",
+  "hotmail.de",
+  "hotmail.it",
+  "hotmail.es",
+  "live.com",
+  "live.co.uk",
+  "live.nl",
+  "msn.com",
+  "passport.com",
+  // Yahoo
+  "yahoo.com",
+  "yahoo.co.uk",
+  "yahoo.co.jp",
+  "yahoo.ca",
+  "yahoo.com.au",
+  "yahoo.de",
+  "yahoo.fr",
+  "yahoo.es",
+  "yahoo.it",
+  "yahoo.in",
+  "ymail.com",
+  "rocketmail.com",
+  // Apple
+  "icloud.com",
+  "me.com",
+  "mac.com",
+  // AOL / Verizon / legacy US ISPs — common on older consumer accounts
+  "aol.com",
+  "aim.com",
+  "verizon.net",
+  "att.net",
+  "sbcglobal.net",
+  "bellsouth.net",
+  "comcast.net",
+  "cox.net",
+  "charter.net",
+  "earthlink.net",
+  "juno.com",
+  "netzero.net",
+  "roadrunner.com",
+  "rr.com",
+  "optonline.net",
+  "frontier.com",
+  "windstream.net",
+  // Privacy-oriented providers
+  "proton.me",
+  "protonmail.com",
+  "protonmail.ch",
+  "pm.me",
+  "tutanota.com",
+  "tutanota.de",
+  "tuta.io",
+  "tuta.com",
+  "hushmail.com",
+  "fastmail.com",
+  "fastmail.fm",
+  "posteo.de",
+  "mailbox.org",
+  // Other large free providers
+  "gmx.com",
+  "gmx.net",
+  "gmx.de",
+  "gmx.at",
+  "gmx.ch",
+  "mail.com",
+  "email.com",
+  "usa.com",
+  "inbox.com",
+  "zoho.com",
+  "zohomail.com",
+  "yandex.com",
+  "yandex.ru",
+  "ya.ru",
+  "mail.ru",
+  "bk.ru",
+  "list.ru",
+  "inbox.ru",
+  "rambler.ru",
+  "qq.com",
+  "foxmail.com",
+  "163.com",
+  "126.com",
+  "sina.com",
+  "sina.cn",
+  "sohu.com",
+  "naver.com",
+  "hanmail.net",
+  "daum.net",
+  "nate.com",
+  "seznam.cz",
+  "wp.pl",
+  "o2.pl",
+  "onet.pl",
+  "interia.pl",
+  "libero.it",
+  "virgilio.it",
+  "alice.it",
+  "tiscali.it",
+  "orange.fr",
+  "wanadoo.fr",
+  "free.fr",
+  "laposte.net",
+  "sfr.fr",
+  "bbox.fr",
+  "neuf.fr",
+  "web.de",
+  "t-online.de",
+  "freenet.de",
+  "arcor.de",
+  "btinternet.com",
+  "sky.com",
+  "talktalk.net",
+  "virginmedia.com",
+  "ntlworld.com",
+  "bigpond.com",
+  "bigpond.net.au",
+  "optusnet.com.au",
+  "iinet.net.au",
+  "xtra.co.nz",
+  "terra.com.br",
+  "uol.com.br",
+  "bol.com.br",
+  "ig.com.br",
+  "rediffmail.com",
+  "sify.com",
+  "indiatimes.com",
+  // Throwaway / disposable services — never a real employer
+  "mailinator.com",
+  "guerrillamail.com",
+  "guerrillamail.net",
+  "sharklasers.com",
+  "10minutemail.com",
+  "temp-mail.org",
+  "tempmail.com",
+  "throwawaymail.com",
+  "yopmail.com",
+  "trashmail.com",
+  "getnada.com",
+  "dispostable.com",
+  "maildrop.cc",
+  "mintemail.com",
+  "fakeinbox.com",
+  "spamgourmet.com",
+  "mailnesia.com",
+  "moakt.com",
+  "emailondeck.com",
+  "burnermail.io",
+  "anonaddy.com",
+  "simplelogin.io",
+  "duck.com",
+  "relay.firefox.com",
+  // Placeholder domains that show up in test and pasted payloads
+  "example.com",
+  "example.org",
+  "example.net",
+  "test.com",
+  "localhost"
+]);
+function isFreeEmailDomain(host) {
+  const normalised = host.trim().toLowerCase().replace(/^www\./, "").replace(/\.$/, "");
+  if (!normalised) return false;
+  return FREE_EMAIL_DOMAINS.has(normalised);
+}
+
+// src/lib/lookup.ts
+async function firstMatch(collection, query) {
+  try {
+    const res = await coreApi.get(`/${collection}?${query}&first=1`);
+    return res.data?.[collection]?.edges?.[0]?.node ?? null;
+  } catch {
+    return null;
+  }
+}
+async function findPersonByEmail(email) {
+  if (!email) return null;
+  return firstMatch("people", `filter=emails.primaryEmail[eq]:${encodeURIComponent(email)}`);
+}
+async function findCompanyByDomain(domain) {
+  if (!domain) return null;
+  const host = extractHost(domain);
+  if (!host) return null;
+  if (isFreeEmailDomain(host)) return null;
+  return firstMatch(
+    "companies",
+    `filter=domainName.primaryLinkUrl[like]:%25${encodeURIComponent(host)}%25`
+  );
+}
+function isCompanyDomain(domain) {
+  const host = extractHost(domain);
+  return host.length > 0 && !isFreeEmailDomain(host);
+}
+function extractHost(url) {
+  try {
+    return new URL(url).hostname.replace(/^www\./, "");
+  } catch {
+    return url;
+  }
+}
+function primaryEmailOf(assembled) {
+  const emails = assembled["emails"];
+  const value = emails?.["primaryEmail"];
+  return typeof value === "string" ? value : "";
+}
+function primaryDomainOf(standard) {
+  const domainName = standard["domainName"];
+  if (typeof domainName === "string") return domainName;
+  const value = domainName?.["primaryLinkUrl"];
+  return typeof value === "string" ? value : "";
+}
+
+// src/lib/diff.ts
+var STANDARD_BY_OBJECT = {
+  person: /* @__PURE__ */ new Set([
+    "name",
+    "emails",
+    "phones",
+    "firstName",
+    "lastName",
+    "fullName",
+    "email",
+    "phone",
+    "linkedInLink",
+    "xLink",
+    "jobTitle",
+    "city",
+    "companyName",
+    "domainName",
+    "address"
+  ]),
+  company: /* @__PURE__ */ new Set([
+    "name",
+    "domainName",
+    "address",
+    "companyName",
+    "linkedInLink",
+    "xLink",
+    "employees",
+    "annualRecurringRevenue",
+    "idealCustomerProfile",
+    "city"
+  ]),
+  opportunity: /* @__PURE__ */ new Set(["name", "stage", "amount", "closeDate"])
+};
+async function buildDiff(input) {
+  const clean = input.crmFields.filter((f) => !f.originalKey.startsWith("__"));
+  const { assembled, remainder } = assembleComposites(clean);
+  for (const f of remainder) assembled[f.canonicalName] = f.value;
+  const objects = [];
+  const existingFields = await objectFieldNames();
+  const strategyFor = (field) => clean.find((f) => f.canonicalName === field)?.mergeStrategy ?? "INHERIT";
+  const companyName = input.structuredCompany?.["name"] ?? assembled["companyName"];
+  if (companyName || input.targetObject === "COMPANY") {
+    const standard = { ...input.structuredCompany ?? {} };
+    if (companyName && !standard["name"]) standard["name"] = companyName;
+    if (!standard["domainName"] && assembled["domainName"]) standard["domainName"] = assembled["domainName"];
+    if (!standard["address"] && assembled["address"]) standard["address"] = assembled["address"];
+    const proposedDomain = primaryDomainOf(standard);
+    if (proposedDomain && !isCompanyDomain(proposedDomain)) {
+      delete standard["domainName"];
+      input.warnings.push(
+        `"${extractHost(proposedDomain)}" is an email provider, not a company domain \u2014 it was left off the company record.`
+      );
+    }
+    if (!standard["name"] && !standard["domainName"]) {
+      input.warnings.push("No company name or domain in this payload \u2014 no company was created.");
+    } else {
+      const domain = primaryDomainOf(standard);
+      const existing = domain ? await findCompanyByDomain(domain) : null;
+      objects.push(describe(
+        "company",
+        existing,
+        domain ? { field: "domainName", value: domain } : null,
+        { ...standard, ...customFor(clean, "company") },
+        clean,
+        existingFields["company"] ?? /* @__PURE__ */ new Set(),
+        input.policy,
+        strategyFor
+      ));
+    }
+  }
+  const hasPersonData = assembled["emails"] || assembled["name"] || input.structuredPerson;
+  if (hasPersonData || input.targetObject === "PERSON") {
+    const standard = { ...input.structuredPerson ?? {} };
+    if (!standard["name"] && assembled["name"]) standard["name"] = assembled["name"];
+    if (!standard["emails"] && assembled["emails"]) standard["emails"] = assembled["emails"];
+    if (!standard["phones"] && assembled["phones"]) standard["phones"] = assembled["phones"];
+    const email = primaryEmailOf(standard) || primaryEmailOf(assembled);
+    const existing = email ? await findPersonByEmail(email) : null;
+    objects.push(describe(
+      "person",
+      existing,
+      email ? { field: "emails.primaryEmail", value: email } : null,
+      { ...standard, ...customFor(clean, "person") },
+      clean,
+      existingFields["person"] ?? /* @__PURE__ */ new Set(),
+      input.policy,
+      strategyFor
+    ));
+  }
+  if (input.createOpportunity && objects.some((o) => o.operation !== "skip")) {
+    const oppCustom = customFor(clean, "opportunity");
+    const oppStandard = {};
+    for (const f of clean) {
+      if (f.targetObject === "opportunity" && (f.canonicalName === "amount" || f.canonicalName === "closeDate")) {
+        oppStandard[f.canonicalName] = f.value;
+      }
+    }
+    objects.push(describe(
+      "opportunity",
+      null,
+      null,
+      { ...oppStandard, ...oppCustom },
+      clean,
+      existingFields["opportunity"] ?? /* @__PURE__ */ new Set(),
+      input.policy,
+      strategyFor
+    ));
+  }
+  return {
+    objects,
+    noteFields: input.noteFields.map((f) => f.canonicalName),
+    skipped: input.skipped.map((f) => f.originalKey),
+    warnings: input.warnings
+  };
+}
+function customFor(fields, object) {
+  const out = {};
+  for (const f of fields) {
+    const target = f.targetObject === "auto" ? impliedPrimary(fields) : f.targetObject;
+    if (target !== object) continue;
+    if (STANDARD_BY_OBJECT[object]?.has(f.canonicalName)) continue;
+    out[f.canonicalName] = f.value;
+  }
+  return out;
+}
+function impliedPrimary(fields) {
+  const hasPerson = fields.some((f) => ["firstName", "lastName", "email", "phone", "fullName", "emails", "phones", "name"].includes(f.canonicalName));
+  return hasPerson ? "person" : "company";
+}
+function describe(object, existing, matchedBy, incoming, normalized, objectFields, policy, strategyFor) {
+  const { decisions } = existing ? mergePatch(existing, incoming, policy, strategyFor) : { decisions: {} };
+  const fields = [];
+  const fieldsToCreate = [];
+  for (const [name, value] of Object.entries(incoming)) {
+    const source = normalized.find((f) => f.canonicalName === name);
+    const isStandard = STANDARD_BY_OBJECT[object]?.has(name) ?? false;
+    const wouldCreate = !isStandard && !objectFields.has(name);
+    if (wouldCreate) fieldsToCreate.push({ name, type: source?.twentyType ?? "TEXT" });
+    let status = "create";
+    if (existing) {
+      const decided = decisions[name]?.status;
+      status = decided === "filled-empty" ? "fill-empty" : decided === "unchanged" ? "unchanged" : decided === "set" ? "overwrite" : "preserved";
+    }
+    fields.push({
+      name,
+      from: source?.source ?? "derived",
+      incoming: value,
+      ...existing ? { existing: existing[name] } : {},
+      status,
+      fieldWouldBeCreated: wouldCreate,
+      twentyType: source?.twentyType
+    });
+  }
+  return {
+    object,
+    operation: existing ? "update" : "create",
+    recordId: existing?.["id"] ?? null,
+    matchedBy,
+    fields,
+    fieldsToCreate
+  };
+}
+async function objectFieldNames() {
+  try {
+    const res = await metaApi.get("/objects");
+    const list = Array.isArray(res) ? res : res.data ?? [];
+    const out = {};
+    for (const node of list) {
+      out[node.nameSingular] = new Set((node.fields ?? []).map((f) => f.name));
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
+
+// src/lib/spam.ts
+var HONEYPOT_SCORE = 100;
+var DISPOSABLE_EMAIL_DOMAINS = /* @__PURE__ */ new Set([
+  "mailinator.com",
+  "guerrillamail.com",
+  "guerrillamail.net",
+  "sharklasers.com",
+  "10minutemail.com",
+  "10minutemail.net",
+  "tempmail.com",
+  "temp-mail.org",
+  "throwawaymail.com",
+  "yopmail.com",
+  "yopmail.net",
+  "trashmail.com",
+  "dispostable.com",
+  "getnada.com",
+  "nada.email",
+  "fakeinbox.com",
+  "maildrop.cc",
+  "mintemail.com",
+  "spamgourmet.com",
+  "mailnesia.com",
+  "tempinbox.com",
+  "emailondeck.com",
+  "moakt.com",
+  "mohmal.com",
+  "inboxkitten.com",
+  "mailcatch.com",
+  "mytemp.email",
+  "discard.email"
+]);
+var PLACEHOLDER_EMAIL_DOMAINS = /* @__PURE__ */ new Set([
+  "example.com",
+  "example.org",
+  "example.net",
+  "test.com",
+  "localhost",
+  "domain.com",
+  "email.com",
+  "yourdomain.com"
+]);
+var URL_RE2 = /https?:\/\/|www\./i;
+var GLOBAL_URL_RE = /https?:\/\/[^\s<>"']+/gi;
+var MARKUP_RE = /<\s*a\s|<\s*script|\[url[=\]]|\[link[=\]]|\]\(https?:/i;
+var EMAIL_RE2 = /^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/;
+var NAME_KEYS = /* @__PURE__ */ new Set([
+  "name",
+  "fullName",
+  "firstName",
+  "lastName",
+  "contact_name",
+  "your_name"
+]);
+var MESSAGE_KEYS = /* @__PURE__ */ new Set([
+  "message",
+  "description",
+  "comments",
+  "notes",
+  "body",
+  "details",
+  "content",
+  "text",
+  "inquiry",
+  "summary",
+  "feedback"
+]);
+function scoreSpam(flat, honeypotKey) {
+  const signals = [];
+  if (honeypotKey) {
+    const hit = Object.entries(flat).find(
+      ([k, v]) => k.toLowerCase() === honeypotKey.toLowerCase() && isFilled(v)
+    );
+    if (hit) {
+      return {
+        score: HONEYPOT_SCORE,
+        signals: [{ reason: `Honeypot field "${hit[0]}" was filled`, points: HONEYPOT_SCORE }],
+        honeypot: true
+      };
+    }
+  }
+  const add = (reason, points) => signals.push({ reason, points });
+  for (const [key, value] of Object.entries(flat)) {
+    if (typeof value !== "string" || value === "") continue;
+    const bare = key.replace(/^(opportunity_|opp_|deal_)/i, "");
+    if (NAME_KEYS.has(bare) || NAME_KEYS.has(key)) {
+      if (URL_RE2.test(value)) add(`Name field "${key}" contains a URL`, 4);
+      if (MARKUP_RE.test(value)) add(`Name field "${key}" contains markup or a link tag`, 4);
+    }
+    if (MESSAGE_KEYS.has(bare) || MESSAGE_KEYS.has(key)) {
+      const urls = value.match(GLOBAL_URL_RE) ?? [];
+      const distinct = new Set(urls.map((u) => u.toLowerCase()));
+      if (distinct.size >= 5) add(`Message field "${key}" contains ${distinct.size} links`, 3);
+      if (MARKUP_RE.test(value)) add(`Message field "${key}" contains anchor or BBCode markup`, 2);
+    }
+  }
+  const email = firstEmail(flat);
+  if (email !== null) {
+    if (!EMAIL_RE2.test(email)) {
+      add(`Email "${truncate(email)}" is not a valid address`, 3);
+    } else {
+      const domain = email.slice(email.lastIndexOf("@") + 1).toLowerCase();
+      if (DISPOSABLE_EMAIL_DOMAINS.has(domain)) {
+        add(`Email domain "${domain}" is a disposable inbox`, 4);
+      } else if (PLACEHOLDER_EMAIL_DOMAINS.has(domain)) {
+        add(`Email domain "${domain}" is a placeholder domain`, 3);
+      }
+    }
+  }
+  const repeated = mostRepeatedValue(flat);
+  if (repeated && repeated.count >= 4) {
+    add(`The same value appears in ${repeated.count} different fields`, 2);
+  }
+  const phone = firstPhone(flat);
+  if (phone && isImplausiblePhone(phone)) {
+    add(`Phone "${truncate(phone)}" is a placeholder number`, 2);
+  }
+  const score = signals.reduce((sum, s) => sum + s.points, 0);
+  return { score, signals, honeypot: false };
+}
+function describeVerdict(verdict) {
+  return verdict.signals.map((s) => s.reason).join("; ").slice(0, 500);
+}
+function isFilled(value) {
+  if (value === null || value === void 0) return false;
+  if (typeof value === "string") return value.trim() !== "";
+  if (typeof value === "boolean") return value;
+  return true;
+}
+function firstEmail(flat) {
+  for (const [key, value] of Object.entries(flat)) {
+    if (typeof value !== "string" || value === "") continue;
+    if (/mail/i.test(key)) return value.trim();
+  }
+  return null;
+}
+function firstPhone(flat) {
+  for (const [key, value] of Object.entries(flat)) {
+    if (typeof value !== "string" || value === "") continue;
+    if (/phone|mobile|tel|cell/i.test(key)) return value.trim();
+  }
+  return null;
+}
+function isImplausiblePhone(raw) {
+  const digits = raw.replace(/\D/g, "");
+  if (digits.length < 7) return false;
+  if (/^(\d)\1+$/.test(digits)) return true;
+  const ascending = digits.split("").every((d, i, arr) => i === 0 || Number(d) === (Number(arr[i - 1]) + 1) % 10);
+  return ascending;
+}
+function mostRepeatedValue(flat) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const value of Object.values(flat)) {
+    if (typeof value !== "string") continue;
+    const v = value.trim();
+    if (v.length < 8) continue;
+    counts.set(v, (counts.get(v) ?? 0) + 1);
+  }
+  let best = null;
+  for (const [value, count] of counts) {
+    if (!best || count > best.count) best = { value, count };
+  }
+  return best;
+}
+function truncate(s) {
+  return s.length > 60 ? `${s.slice(0, 60)}\u2026` : s;
+}
+
+// src/lib/settings.ts
+function str(key, fallback) {
+  const v = process.env[key];
+  return v === void 0 || v === "" ? fallback : v;
+}
+function int(key, fallback) {
+  const parsed = parseInt(process.env[key] ?? "", 10);
+  return Number.isFinite(parsed) ? parsed : fallback;
+}
+function bool(key, fallback) {
+  const v = process.env[key];
+  if (v === void 0 || v === "") return fallback;
+  return v.toLowerCase() === "true";
+}
+function mergePolicy() {
+  return str("INTAKE_MERGE_POLICY", "PRESERVE").toUpperCase() === "NEWEST_WINS" ? "NEWEST_WINS" : "PRESERVE";
+}
+function spamFilterEnabled() {
+  return bool("INTAKE_SPAM_FILTER_ENABLED", false);
+}
+function spamScoreThreshold() {
+  return int("INTAKE_SPAM_SCORE_THRESHOLD", 5);
+}
+function honeypotField() {
+  return str("INTAKE_HONEYPOT_FIELD", "");
+}
 
 // src/logic-functions/test-ingest.ts
 var handler = async (params) => {
   const sourceSlug = params.pathParameters?.["slug"];
-  if (!sourceSlug) {
-    return { statusCode: 400, body: { error: "Missing source slug" } };
-  }
+  if (!sourceSlug) return { statusCode: 400, body: { error: "Missing source slug" } };
   let rawPayload = {};
   if (params.body && typeof params.body === "object" && !Array.isArray(params.body)) {
     rawPayload = params.body;
   }
-  const srcResult = await coreApi.get(
-    `/intakeSources?filter=slug[eq]:${encodeURIComponent(sourceSlug)}&first=1`
-  ).catch(() => null);
-  const source = srcResult?.data?.intakeSources?.edges?.[0]?.node;
+  const source = await loadSource(sourceSlug);
+  const rules = await loadRules(source?.id);
   const structure = detectStructure(rawPayload);
-  const flat = structure.type === "flat" ? structure.data : flatten(structure.type === "structured" ? structure.extra ?? {} : rawPayload);
-  const normalized = normalizeFields(flat);
+  const flat = structure.type === "flat" ? structure.data : flatten(structure.extra ?? {});
+  const warnings = [];
+  const normalized = normalizeFields(flat, rules, warnings);
   const { crmFields, noteFields, skipped } = partition(normalized);
-  const { assembled, remainder } = assembleComposites(crmFields);
-  for (const f of remainder) assembled[f.canonicalName] = f.value;
-  const extFields = Object.keys(assembled).filter((k) => /^ext[A-Z]/.test(k));
-  const standardFields = Object.keys(assembled).filter((k) => !/^ext[A-Z]/.test(k));
+  const honeypot = source?.honeypotField || honeypotField();
+  const verdict = scoreSpam(flat, honeypot);
+  const wouldQuarantine = verdict.honeypot || spamFilterEnabled() && verdict.score >= spamScoreThreshold();
+  if (!source) warnings.push(`No source registered with slug "${sourceSlug}" \u2014 previewing with default settings. A live request would return 404.`);
+  if (source?.status === "PAUSED") warnings.push("This source is PAUSED \u2014 a live request would return 423.");
   const noteOverflow = {};
   for (const f of noteFields) noteOverflow[f.canonicalName] = f.value;
+  const diff = wouldQuarantine ? null : await buildDiff({
+    crmFields,
+    noteFields,
+    skipped,
+    structuredCompany: structure.type === "structured" ? structure.company ?? void 0 : void 0,
+    structuredPerson: structure.type === "structured" ? structure.person ?? void 0 : void 0,
+    createOpportunity: source?.createOpportunity ?? true,
+    targetObject: source?.targetObject ?? "AUTO",
+    policy: parsePolicy(source?.mergePolicy) ?? mergePolicy(),
+    warnings
+  });
   return {
     statusCode: 200,
     body: {
       dryRun: true,
-      source: source ? { id: source.id, name: source.name } : null,
+      source: source ? { id: source.id, name: source.name, slug: source.slug, status: source.status } : null,
       payloadHash: computePayloadHash(rawPayload),
       payloadStructure: structure.type,
-      wouldCreate: {
-        standardFields,
-        customFieldsToCreate: extFields,
-        noteFields: noteFields.map((f) => f.canonicalName),
-        skipped: skipped.map((f) => f.originalKey)
+      spam: {
+        score: verdict.score,
+        threshold: spamScoreThreshold(),
+        filterEnabled: spamFilterEnabled(),
+        honeypotField: honeypot || null,
+        wouldQuarantine,
+        signals: verdict.signals,
+        reason: verdict.signals.length > 0 ? describeVerdict(verdict) : null
       },
-      notePreview: noteFields.length > 0 ? formatNote(source?.name ?? sourceSlug, noteOverflow) : null,
+      mergePolicy: parsePolicy(source?.mergePolicy) ?? mergePolicy(),
+      /**
+       * Per object: whether it would be created or updated, which record it
+       * matched, what each field would do to the value already there, and which
+       * fields do not exist yet and would be added to the schema.
+       */
+      diff,
+      note: noteFields.length > 0 ? { fields: noteFields.map((f) => f.canonicalName), preview: formatNote(source?.name ?? sourceSlug, noteOverflow) } : null,
+      rulesApplied: rules.length,
+      warnings,
       rawFlat: flat
     }
   };
 };
+async function loadSource(slug) {
+  try {
+    const res = await coreApi.get(
+      `/intakeSources?filter=slug[eq]:${encodeURIComponent(slug)}&first=1`
+    );
+    return res.data?.intakeSources?.edges?.[0]?.node ?? null;
+  } catch {
+    return null;
+  }
+}
+async function loadRules(sourceId) {
+  try {
+    const client = new CoreApiClient();
+    const filter = sourceId ? { or: [{ intakeSource: { id: { eq: sourceId } } }, { intakeSource: { id: { is: "NULL" } } }] } : { intakeSource: { id: { is: "NULL" } } };
+    const result = await client.query({
+      intakeFieldRules: {
+        __args: {
+          filter: { and: [filter, { isActive: { eq: true } }] },
+          orderBy: { priority: "DescNullsLast" }
+        },
+        edges: {
+          node: {
+            inputPattern: true,
+            canonicalName: true,
+            fieldType: true,
+            priority: true,
+            targetObject: true,
+            mergeStrategy: true
+          }
+        }
+      }
+    });
+    return (result.intakeFieldRules?.edges ?? []).map((e) => e.node);
+  } catch {
+    return [];
+  }
+}
+function parsePolicy(raw) {
+  switch ((raw ?? "").toUpperCase()) {
+    case "PRESERVE":
+      return "PRESERVE";
+    case "NEWEST_WINS":
+      return "NEWEST_WINS";
+    default:
+      return null;
+  }
+}
 var test_ingest_default = defineLogicFunction({
   universalIdentifier: "3f7a9c21-8d4b-4e6f-a1c2-5b8d0f2e7a4c",
   name: "intake-test",
-  description: "Dry-run: validates a payload and shows what would be created without writing to the CRM.",
-  timeoutSeconds: 15,
+  description: "Dry-run: returns a structured diff of what would be created or updated, writing nothing.",
+  timeoutSeconds: 20,
   handler,
   httpRouteTriggerSettings: {
     path: "/intake/:slug/test",