@aglyn/plugins-crm 1.0.0-beta.143

package/src/lib/server/inbound-address.d.ts

@@ -0,0 +1,61 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * `POST /api/crm/inbound-address` — the workspace's email capture address
+ * (AGL-2657).
+ *
+ * Body: `{ hostId }` under a site, `{ orgId, hostId? }` at the organization
+ * level, and `rotate: true` to replace the token. Answers
+ * `{ ok: true, address, createdAtMs, rotatedAtMs?, rotated }`.
+ *
+ * ## Why a route and not a read of the org document
+ *
+ * The token is on the org document, which every member may read, and the
+ * address is the token in a fixed shape — but the shape's domain is the
+ * deployment's, `CRM_INBOUND_DOMAIN`, which a browser does not know, and
+ * the token does not exist until somebody asks for the address. So the
+ * first ask mints it, inside a transaction, and every ask answers the
+ * whole address. The org document is the read side for nothing but the
+ * rules, which deny the key to every client.
+ *
+ * ## Who may ask, and who may rotate
+ *
+ * Asking takes what opening the CRM takes: `data.manage` on the site's
+ * org, for a member who reaches the site — the sender's own gate in
+ * `email-send.ts`, restated — or, at the organization level, org-wide
+ * reach with the same permission. Rotating is a workspace OWNER or ADMIN's
+ * act, because the old address stops filing the moment the new token is
+ * written and every mailbox rule that carried it goes quiet: the same bar
+ * every CRM setting has, and the erasure route's. Staff are admitted to
+ * read as they are on every CRM route, and refused the rotation as the
+ * erasure route refuses them — it is the workspace's address to retire.
+ */
+export declare const CRM_INBOUND_ADDRESS_ROUTE: "crm/inbound-address";
+/** What a successful call answers with. */
+export interface CrmInboundAddressResponse {
+    ok: true;
+    /** `crm+<token>@<capture domain>`. */
+    address: string;
+    createdAtMs: number;
+    rotatedAtMs?: number;
+    /** True when this call replaced the token. */
+    rotated: boolean;
+}
+export declare const CRM_INBOUND_ROTATE_REFUSAL = "Rotating the capture address requires a workspace owner or admin.";
+export declare const crmInboundAddressHandler: PluginApiHandler;
+export default crmInboundAddressHandler;

package/src/lib/server/inbound-address.js

@@ -0,0 +1,188 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { canManageOrg, crmInboundAddress, crmInboundDomain, isOrgWideMember } from "@aglyn/aglyn/server";
+import { ensureCrmInboundToken, firebaseAdmin, getOrgForHost, logOrgActivity, memberHasOrgPermission, resolveOrgMembership } from "@aglyn/tenant-data-admin";
+import { isRefusedIdToken } from "@aglyn/tenant-data-admin/server/id-token-refusal";
+import { CRM_API_ROUTES } from "../constants/api-routes.js";
+import { authorizeOrgCaller, readCrmRouteScope } from "./org-caller.js";
+import { crmSuiteRefusal } from "./suite-gate.js";
+/**
+ * `POST /api/crm/inbound-address` — the workspace's email capture address
+ * (AGL-2657).
+ *
+ * Body: `{ hostId }` under a site, `{ orgId, hostId? }` at the organization
+ * level, and `rotate: true` to replace the token. Answers
+ * `{ ok: true, address, createdAtMs, rotatedAtMs?, rotated }`.
+ *
+ * ## Why a route and not a read of the org document
+ *
+ * The token is on the org document, which every member may read, and the
+ * address is the token in a fixed shape — but the shape's domain is the
+ * deployment's, `CRM_INBOUND_DOMAIN`, which a browser does not know, and
+ * the token does not exist until somebody asks for the address. So the
+ * first ask mints it, inside a transaction, and every ask answers the
+ * whole address. The org document is the read side for nothing but the
+ * rules, which deny the key to every client.
+ *
+ * ## Who may ask, and who may rotate
+ *
+ * Asking takes what opening the CRM takes: `data.manage` on the site's
+ * org, for a member who reaches the site — the sender's own gate in
+ * `email-send.ts`, restated — or, at the organization level, org-wide
+ * reach with the same permission. Rotating is a workspace OWNER or ADMIN's
+ * act, because the old address stops filing the moment the new token is
+ * written and every mailbox rule that carried it goes quiet: the same bar
+ * every CRM setting has, and the erasure route's. Staff are admitted to
+ * read as they are on every CRM route, and refused the rotation as the
+ * erasure route refuses them — it is the workspace's address to retire.
+ */ export const CRM_INBOUND_ADDRESS_ROUTE = CRM_API_ROUTES.inboundAddress;
+export const CRM_INBOUND_ROTATE_REFUSAL = 'Rotating the capture address requires a workspace owner or admin.';
+const refuse = (status, error)=>({
+        ok: false,
+        status,
+        error
+    });
+/**
+ * The site variant's caller: a verified token, then `data.manage` on the
+ * site's org for a member who reaches the site, staff passing as they do
+ * on every CRM route. Rotation needs the org role itself.
+ */ async function authorizeSiteCaller(req, hostId) {
+    var _req_headers_authorization, _ref, _decoded_email, _ref1;
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return refuse(401, 'Unauthenticated');
+    let decoded;
+    try {
+        decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+    } catch (error) {
+        // A refused credential is the caller's 401; a failure to check one is
+        // ours and keeps a 5xx (AGL-2852).
+        if (isRefusedIdToken(error)) return refuse(401, 'Unauthenticated');
+        console.error('[crm] inbound-address could not verify the caller', error);
+        return refuse(500, 'The sign-in could not be checked. Try again.');
+    }
+    const resolved = await getOrgForHost(hostId).catch(()=>null);
+    if (!resolved) return refuse(404, 'Unknown site');
+    const { orgId } = resolved;
+    const membership = await resolveOrgMembership(decoded.uid, orgId).catch(()=>null);
+    const member = (_ref = membership == null ? void 0 : membership.member) != null ? _ref : null;
+    if (decoded.staff !== true) {
+        var _member_hostAccess;
+        const reaches = isOrgWideMember(member) || Boolean(member == null ? void 0 : (_member_hostAccess = member.hostAccess) == null ? void 0 : _member_hostAccess[hostId]);
+        const allowed = member && reaches && await memberHasOrgPermission(orgId, member, 'data.manage');
+        if (!allowed) {
+            return refuse(403, 'Reading the capture address requires the data.manage permission on this site');
+        }
+    }
+    return {
+        ok: true,
+        uid: decoded.uid,
+        email: (_decoded_email = decoded.email) != null ? _decoded_email : null,
+        orgId,
+        org: resolved.org,
+        canRotate: canManageOrg((_ref1 = member == null ? void 0 : member.role) != null ? _ref1 : null)
+    };
+}
+/** The organization variant's caller, by the org the body names (AGL-2634). */ async function authorizeOrgLevelCaller(req, orgId, rotate) {
+    const caller = await authorizeOrgCaller(req, orgId, {
+        needs: rotate ? 'manage-org' : 'data.manage',
+        refusal: rotate ? CRM_INBOUND_ROTATE_REFUSAL : 'Reading the capture address at the organization level requires the ' + 'data.manage permission across the whole workspace'
+    });
+    if (caller.ok === false) return refuse(caller.status, caller.error);
+    return {
+        ok: true,
+        uid: caller.uid,
+        email: caller.email,
+        orgId,
+        org: caller.org,
+        // `manage-org` admitted them when they asked to rotate; a reader who
+        // did not ask is not told whether they could.
+        canRotate: rotate
+    };
+}
+export const crmInboundAddressHandler = async (req, res)=>{
+    var _req_body;
+    if (req.method !== 'POST') {
+        res.setHeader('Allow', 'POST');
+        res.status(405).json({
+            error: 'Method not allowed'
+        });
+        return;
+    }
+    const body = typeof req.body === 'string' ? JSON.parse(req.body) : (_req_body = req.body) != null ? _req_body : {};
+    const scope = readCrmRouteScope(body);
+    if (!scope) {
+        res.status(400).json({
+            error: 'Missing hostId'
+        });
+        return;
+    }
+    const rotate = body['rotate'] === true;
+    try {
+        const caller = scope.level === 'org' ? await authorizeOrgLevelCaller(req, scope.orgId, rotate) : await authorizeSiteCaller(req, scope.hostId);
+        if (caller.ok === false) {
+            res.status(caller.status).json({
+                error: caller.error
+            });
+            return;
+        }
+        if (rotate && !caller.canRotate) {
+            res.status(403).json({
+                error: CRM_INBOUND_ROTATE_REFUSAL
+            });
+            return;
+        }
+        // The first ask mints the token, so reading the address is a write on
+        // a plan without the suite; the webhook refuses such a plan's mail too.
+        const suite = crmSuiteRefusal(caller.org, 'The email capture address');
+        if (suite) {
+            res.status(suite.status).json(suite.body);
+            return;
+        }
+        const firestore = firebaseAdmin.app().firestore();
+        const result = await ensureCrmInboundToken(firestore, caller.orgId, {
+            rotate
+        });
+        if (result.rotated) {
+            // The old address went quiet with this write; the feed says who did it.
+            await logOrgActivity(caller.orgId, {
+                uid: caller.uid,
+                email: caller.email
+            }, 'Rotated the email capture address', {
+                type: 'org'
+            });
+        }
+        const answer = _extends({
+            ok: true,
+            address: crmInboundAddress(result.token, crmInboundDomain()),
+            createdAtMs: result.createdAtMs
+        }, typeof result.rotatedAtMs === 'number' ? {
+            rotatedAtMs: result.rotatedAtMs
+        } : {}, {
+            rotated: result.rotated
+        });
+        res.status(200).json(answer);
+    } catch (error) {
+        console.error('[crm] inbound-address failed', scope, error);
+        res.status(500).json({
+            error: 'The capture address could not be read.'
+        });
+    }
+};
+export default crmInboundAddressHandler;
+
+//# sourceMappingURL=inbound-address.js.map

package/src/lib/server/inbound-address.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/inbound-address.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  type AglynOrgMember,\n  canManageOrg,\n  crmInboundAddress,\n  crmInboundDomain,\n  isOrgWideMember,\n  type PluginApiHandler,\n  type PluginApiRequest,\n} from '@aglyn/aglyn/server'\nimport {\n  ensureCrmInboundToken,\n  firebaseAdmin,\n  getOrgForHost,\n  logOrgActivity,\n  memberHasOrgPermission,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport { CRM_API_ROUTES } from '../constants/api-routes'\nimport { authorizeOrgCaller, readCrmRouteScope } from './org-caller'\nimport { crmSuiteRefusal } from './suite-gate'\n\n/**\n * `POST /api/crm/inbound-address` — the workspace's email capture address\n * (AGL-2657).\n *\n * Body: `{ hostId }` under a site, `{ orgId, hostId? }` at the organization\n * level, and `rotate: true` to replace the token. Answers\n * `{ ok: true, address, createdAtMs, rotatedAtMs?, rotated }`.\n *\n * ## Why a route and not a read of the org document\n *\n * The token is on the org document, which every member may read, and the\n * address is the token in a fixed shape — but the shape's domain is the\n * deployment's, `CRM_INBOUND_DOMAIN`, which a browser does not know, and\n * the token does not exist until somebody asks for the address. So the\n * first ask mints it, inside a transaction, and every ask answers the\n * whole address. The org document is the read side for nothing but the\n * rules, which deny the key to every client.\n *\n * ## Who may ask, and who may rotate\n *\n * Asking takes what opening the CRM takes: `data.manage` on the site's\n * org, for a member who reaches the site — the sender's own gate in\n * `email-send.ts`, restated — or, at the organization level, org-wide\n * reach with the same permission. Rotating is a workspace OWNER or ADMIN's\n * act, because the old address stops filing the moment the new token is\n * written and every mailbox rule that carried it goes quiet: the same bar\n * every CRM setting has, and the erasure route's. Staff are admitted to\n * read as they are on every CRM route, and refused the rotation as the\n * erasure route refuses them — it is the workspace's address to retire.\n */\n\nexport const CRM_INBOUND_ADDRESS_ROUTE = CRM_API_ROUTES.inboundAddress\n\n/** What a successful call answers with. */\nexport interface CrmInboundAddressResponse {\n  ok: true\n  /** `crm+<token>@<capture domain>`. */\n  address: string\n  createdAtMs: number\n  rotatedAtMs?: number\n  /** True when this call replaced the token. */\n  rotated: boolean\n}\n\nexport const CRM_INBOUND_ROTATE_REFUSAL =\n  'Rotating the capture address requires a workspace owner or admin.'\n\ntype Refusal = { ok: false; status: number; error: string }\n\ninterface Caller {\n  ok: true\n  uid: string\n  email: string | null\n  orgId: string\n  /** The org document, for the plan the address belongs to. */\n  org: unknown\n  /** Whether this caller may replace the token. */\n  canRotate: boolean\n}\n\nconst refuse = (status: number, error: string): Refusal => ({ ok: false, status, error })\n\n/**\n * The site variant's caller: a verified token, then `data.manage` on the\n * site's org for a member who reaches the site, staff passing as they do\n * on every CRM route. Rotation needs the org role itself.\n */\nasync function authorizeSiteCaller(\n  req: PluginApiRequest,\n  hostId: string,\n): Promise<Caller | Refusal> {\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return refuse(401, 'Unauthenticated')\n  let decoded: { uid: string; email?: string; staff?: unknown }\n  try {\n    decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n  } catch (error) {\n    // A refused credential is the caller's 401; a failure to check one is\n    // ours and keeps a 5xx (AGL-2852).\n    if (isRefusedIdToken(error)) return refuse(401, 'Unauthenticated')\n    console.error('[crm] inbound-address could not verify the caller', error)\n    return refuse(500, 'The sign-in could not be checked. Try again.')\n  }\n  const resolved = await getOrgForHost(hostId).catch(() => null)\n  if (!resolved) return refuse(404, 'Unknown site')\n  const { orgId } = resolved\n  const membership = await resolveOrgMembership(decoded.uid, orgId).catch(() => null)\n  const member = (membership?.member ?? null) as Partial<AglynOrgMember> | null\n  if (decoded.staff !== true) {\n    const reaches =\n      isOrgWideMember(member) || Boolean(member?.hostAccess?.[hostId])\n    const allowed =\n      member && reaches && (await memberHasOrgPermission(orgId, member, 'data.manage'))\n    if (!allowed) {\n      return refuse(\n        403,\n        'Reading the capture address requires the data.manage permission on this site',\n      )\n    }\n  }\n  return {\n    ok: true,\n    uid: decoded.uid,\n    email: decoded.email ?? null,\n    orgId,\n    org: resolved.org,\n    canRotate: canManageOrg(member?.role ?? null),\n  }\n}\n\n/** The organization variant's caller, by the org the body names (AGL-2634). */\nasync function authorizeOrgLevelCaller(\n  req: PluginApiRequest,\n  orgId: string,\n  rotate: boolean,\n): Promise<Caller | Refusal> {\n  const caller = await authorizeOrgCaller(req, orgId, {\n    needs: rotate ? 'manage-org' : 'data.manage',\n    refusal: rotate\n      ? CRM_INBOUND_ROTATE_REFUSAL\n      : 'Reading the capture address at the organization level requires the ' +\n        'data.manage permission across the whole workspace',\n  })\n  if (caller.ok === false) return refuse(caller.status, caller.error)\n  return {\n    ok: true,\n    uid: caller.uid,\n    email: caller.email,\n    orgId,\n    org: caller.org,\n    // `manage-org` admitted them when they asked to rotate; a reader who\n    // did not ask is not told whether they could.\n    canRotate: rotate,\n  }\n}\n\nexport const crmInboundAddressHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  const body = (\n    typeof req.body === 'string' ? JSON.parse(req.body) : (req.body ?? {})\n  ) as Record<string, unknown>\n  const scope = readCrmRouteScope(body)\n  if (!scope) {\n    res.status(400).json({ error: 'Missing hostId' })\n    return\n  }\n  const rotate = body['rotate'] === true\n  try {\n    const caller =\n      scope.level === 'org'\n        ? await authorizeOrgLevelCaller(req, scope.orgId, rotate)\n        : await authorizeSiteCaller(req, scope.hostId)\n    if (caller.ok === false) {\n      res.status(caller.status).json({ error: caller.error })\n      return\n    }\n    if (rotate && !caller.canRotate) {\n      res.status(403).json({ error: CRM_INBOUND_ROTATE_REFUSAL })\n      return\n    }\n    // The first ask mints the token, so reading the address is a write on\n    // a plan without the suite; the webhook refuses such a plan's mail too.\n    const suite = crmSuiteRefusal(caller.org, 'The email capture address')\n    if (suite) {\n      res.status(suite.status).json(suite.body)\n      return\n    }\n    const firestore = firebaseAdmin.app().firestore()\n    const result = await ensureCrmInboundToken(firestore, caller.orgId, { rotate })\n    if (result.rotated) {\n      // The old address went quiet with this write; the feed says who did it.\n      await logOrgActivity(\n        caller.orgId,\n        { uid: caller.uid, email: caller.email },\n        'Rotated the email capture address',\n        { type: 'org' },\n      )\n    }\n    const answer: CrmInboundAddressResponse = {\n      ok: true,\n      address: crmInboundAddress(result.token, crmInboundDomain()),\n      createdAtMs: result.createdAtMs,\n      ...(typeof result.rotatedAtMs === 'number' ? { rotatedAtMs: result.rotatedAtMs } : {}),\n      rotated: result.rotated,\n    }\n    res.status(200).json(answer)\n  } catch (error) {\n    console.error('[crm] inbound-address failed', scope, error)\n    res.status(500).json({ error: 'The capture address could not be read.' })\n  }\n}\n\nexport default crmInboundAddressHandler\n"],"names":["canManageOrg","crmInboundAddress","crmInboundDomain","isOrgWideMember","ensureCrmInboundToken","firebaseAdmin","getOrgForHost","logOrgActivity","memberHasOrgPermission","resolveOrgMembership","isRefusedIdToken","CRM_API_ROUTES","authorizeOrgCaller","readCrmRouteScope","crmSuiteRefusal","CRM_INBOUND_ADDRESS_ROUTE","inboundAddress","CRM_INBOUND_ROTATE_REFUSAL","refuse","status","error","ok","authorizeSiteCaller","req","hostId","decoded","authorization","String","headers","idToken","startsWith","slice","length","undefined","app","auth","verifyIdToken","console","resolved","catch","orgId","membership","uid","member","staff","reaches","Boolean","hostAccess","allowed","email","org","canRotate","role","authorizeOrgLevelCaller","rotate","caller","needs","refusal","crmInboundAddressHandler","res","method","setHeader","json","body","JSON","parse","scope","level","suite","firestore","result","rotated","type","answer","address","token","createdAtMs","rotatedAtMs"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAEEA,YAAY,EACZC,iBAAiB,EACjBC,gBAAgB,EAChBC,eAAe,QAGV,sBAAqB;AAC5B,SACEC,qBAAqB,EACrBC,aAAa,EACbC,aAAa,EACbC,cAAc,EACdC,sBAAsB,EACtBC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,gBAAgB,QAAQ,mDAAkD;AACnF,SAASC,cAAc,QAAQ,6BAAyB;AACxD,SAASC,kBAAkB,EAAEC,iBAAiB,QAAQ,kBAAc;AACpE,SAASC,eAAe,QAAQ,kBAAc;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BC,GAED,OAAO,MAAMC,4BAA4BJ,eAAeK,cAAc,CAAA;AAatE,OAAO,MAAMC,6BACX,oEAAmE;AAerE,MAAMC,SAAS,CAACC,QAAgBC,QAA4B,CAAA;QAAEC,IAAI;QAAOF;QAAQC;IAAM,CAAA;AAEvF;;;;CAIC,GACD,eAAeE,oBACbC,GAAqB,EACrBC,MAAc;QAEeD,kCAmCpBE;IAnCT,MAAMC,gBAAgBC,QAAOJ,6BAAAA,IAAIK,OAAO,CAACF,aAAa,YAAzBH,6BAA6B;IAC1D,MAAMM,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOX,OAAO,KAAK;IACjC,IAAIO;IACJ,IAAI;QACFA,UAAU,MAAMpB,cAAc6B,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACP;IAC3D,EAAE,OAAOT,OAAO;QACd,sEAAsE;QACtE,mCAAmC;QACnC,IAAIV,iBAAiBU,QAAQ,OAAOF,OAAO,KAAK;QAChDmB,QAAQjB,KAAK,CAAC,qDAAqDA;QACnE,OAAOF,OAAO,KAAK;IACrB;IACA,MAAMoB,WAAW,MAAMhC,cAAckB,QAAQe,KAAK,CAAC,IAAM;IACzD,IAAI,CAACD,UAAU,OAAOpB,OAAO,KAAK;IAClC,MAAM,EAAEsB,KAAK,EAAE,GAAGF;IAClB,MAAMG,aAAa,MAAMhC,qBAAqBgB,QAAQiB,GAAG,EAAEF,OAAOD,KAAK,CAAC,IAAM;IAC9E,MAAMI,iBAAUF,8BAAAA,WAAYE,MAAM,mBAAI;IACtC,IAAIlB,QAAQmB,KAAK,KAAK,MAAM;YAEWD;QADrC,MAAME,UACJ1C,gBAAgBwC,WAAWG,QAAQH,2BAAAA,qBAAAA,OAAQI,UAAU,qBAAlBJ,kBAAoB,CAACnB,OAAO;QACjE,MAAMwB,UACJL,UAAUE,WAAY,MAAMrC,uBAAuBgC,OAAOG,QAAQ;QACpE,IAAI,CAACK,SAAS;YACZ,OAAO9B,OACL,KACA;QAEJ;IACF;IACA,OAAO;QACLG,IAAI;QACJqB,KAAKjB,QAAQiB,GAAG;QAChBO,KAAK,GAAExB,iBAAAA,QAAQwB,KAAK,YAAbxB,iBAAiB;QACxBe;QACAU,KAAKZ,SAASY,GAAG;QACjBC,WAAWnD,sBAAa2C,0BAAAA,OAAQS,IAAI,oBAAI;IAC1C;AACF;AAEA,6EAA6E,GAC7E,eAAeC,wBACb9B,GAAqB,EACrBiB,KAAa,EACbc,MAAe;IAEf,MAAMC,SAAS,MAAM3C,mBAAmBW,KAAKiB,OAAO;QAClDgB,OAAOF,SAAS,eAAe;QAC/BG,SAASH,SACLrC,6BACA,wEACA;IACN;IACA,IAAIsC,OAAOlC,EAAE,KAAK,OAAO,OAAOH,OAAOqC,OAAOpC,MAAM,EAAEoC,OAAOnC,KAAK;IAClE,OAAO;QACLC,IAAI;QACJqB,KAAKa,OAAOb,GAAG;QACfO,OAAOM,OAAON,KAAK;QACnBT;QACAU,KAAKK,OAAOL,GAAG;QACf,qEAAqE;QACrE,8CAA8C;QAC9CC,WAAWG;IACb;AACF;AAEA,OAAO,MAAMI,2BAA6C,OAAOnC,KAAKoC;QAOXpC;IANzD,IAAIA,IAAIqC,MAAM,KAAK,QAAQ;QACzBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIxC,MAAM,CAAC,KAAK2C,IAAI,CAAC;YAAE1C,OAAO;QAAqB;QACnD;IACF;IACA,MAAM2C,OACJ,OAAOxC,IAAIwC,IAAI,KAAK,WAAWC,KAAKC,KAAK,CAAC1C,IAAIwC,IAAI,KAAKxC,YAAAA,IAAIwC,IAAI,YAARxC,YAAY,CAAC;IAEtE,MAAM2C,QAAQrD,kBAAkBkD;IAChC,IAAI,CAACG,OAAO;QACVP,IAAIxC,MAAM,CAAC,KAAK2C,IAAI,CAAC;YAAE1C,OAAO;QAAiB;QAC/C;IACF;IACA,MAAMkC,SAASS,IAAI,CAAC,SAAS,KAAK;IAClC,IAAI;QACF,MAAMR,SACJW,MAAMC,KAAK,KAAK,QACZ,MAAMd,wBAAwB9B,KAAK2C,MAAM1B,KAAK,EAAEc,UAChD,MAAMhC,oBAAoBC,KAAK2C,MAAM1C,MAAM;QACjD,IAAI+B,OAAOlC,EAAE,KAAK,OAAO;YACvBsC,IAAIxC,MAAM,CAACoC,OAAOpC,MAAM,EAAE2C,IAAI,CAAC;gBAAE1C,OAAOmC,OAAOnC,KAAK;YAAC;YACrD;QACF;QACA,IAAIkC,UAAU,CAACC,OAAOJ,SAAS,EAAE;YAC/BQ,IAAIxC,MAAM,CAAC,KAAK2C,IAAI,CAAC;gBAAE1C,OAAOH;YAA2B;YACzD;QACF;QACA,sEAAsE;QACtE,wEAAwE;QACxE,MAAMmD,QAAQtD,gBAAgByC,OAAOL,GAAG,EAAE;QAC1C,IAAIkB,OAAO;YACTT,IAAIxC,MAAM,CAACiD,MAAMjD,MAAM,EAAE2C,IAAI,CAACM,MAAML,IAAI;YACxC;QACF;QACA,MAAMM,YAAYhE,cAAc6B,GAAG,GAAGmC,SAAS;QAC/C,MAAMC,SAAS,MAAMlE,sBAAsBiE,WAAWd,OAAOf,KAAK,EAAE;YAAEc;QAAO;QAC7E,IAAIgB,OAAOC,OAAO,EAAE;YAClB,wEAAwE;YACxE,MAAMhE,eACJgD,OAAOf,KAAK,EACZ;gBAAEE,KAAKa,OAAOb,GAAG;gBAAEO,OAAOM,OAAON,KAAK;YAAC,GACvC,qCACA;gBAAEuB,MAAM;YAAM;QAElB;QACA,MAAMC,SAAoC;YACxCpD,IAAI;YACJqD,SAASzE,kBAAkBqE,OAAOK,KAAK,EAAEzE;YACzC0E,aAAaN,OAAOM,WAAW;WAC3B,OAAON,OAAOO,WAAW,KAAK,WAAW;YAAEA,aAAaP,OAAOO,WAAW;QAAC,IAAI,CAAC;YACpFN,SAASD,OAAOC,OAAO;;QAEzBZ,IAAIxC,MAAM,CAAC,KAAK2C,IAAI,CAACW;IACvB,EAAE,OAAOrD,OAAO;QACdiB,QAAQjB,KAAK,CAAC,gCAAgC8C,OAAO9C;QACrDuC,IAAIxC,MAAM,CAAC,KAAK2C,IAAI,CAAC;YAAE1C,OAAO;QAAyC;IACzE;AACF,EAAC;AAED,eAAesC,yBAAwB"}

package/src/lib/server/lead-convert.d.ts

@@ -0,0 +1,78 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * `POST /api/crm/lead-convert` — a lead becomes a contact, and optionally a
+ * company and a deal (AGL-2608).
+ *
+ * This is the console's door onto `convertHostLead` (the tenancy runtime),
+ * which owns the four writes, their order, and the idempotency on the lead;
+ * the REST API's `POST /v1/leads/{id}/convert` is the other door onto the
+ * same function (AGL-2627). What lives here is what only this door knows:
+ * the ID token, the body the convert dialog posts, and the statuses and
+ * sentences the dialog shows.
+ *
+ * ## What the caller has to be
+ *
+ * A signed-in member of the host's org holding `data.manage` — the same key
+ * the console gate on the CRM surface enforces — with a role on this site.
+ * Checked here with the Admin SDK rather than trusted from the client,
+ * because this route writes into collections the caller's own rules would
+ * otherwise decide about.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+export { stageForNewDeal } from '@aglyn/tenant-runtime/convert-host-lead';
+/** The body the console's convert dialog posts. */
+export interface LeadConvertRequest {
+    hostId: string;
+    /** `hosts/{hostId}/leads/{leadId}` — the document id, which is the person key. */
+    leadId: string;
+    /**
+     * Who owns the resulting contact (and deal). Defaults to the lead's own
+     * owner; failing that the org's assignment rules and the site's default
+     * owner decide (AGL-2618), and failing those the caller — somebody
+     * converted this person, and a record with no owner is one nobody
+     * follows up.
+     */
+    ownerUid?: string;
+    /** Link an existing `orgs/{orgId}/companies/{companyId}`. */
+    companyId?: string;
+    /** Or create one. Ignored when `companyId` is given. */
+    createCompany?: {
+        name: string;
+        domain?: string;
+    };
+    /** Open a deal in the org's default pipeline. */
+    deal?: {
+        title: string;
+        amountCents?: number;
+        /** Lowercase ISO 4217; `usd` when absent or malformed. */
+        currency?: string;
+        /** A stage of the default pipeline; its first open stage when absent. */
+        stageId?: string;
+    };
+}
+/** What the route answers on success. */
+export interface LeadConvertResponse {
+    ok: true;
+    contactId: string;
+    companyId?: string;
+    dealId?: string;
+    /** The lead was converted before this call; nothing was created now. */
+    alreadyConverted: boolean;
+}
+export declare const leadConvertHandler: PluginApiHandler;
+export default leadConvertHandler;

package/src/lib/server/lead-convert.js

@@ -0,0 +1,250 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * `POST /api/crm/lead-convert` — a lead becomes a contact, and optionally a
+ * company and a deal (AGL-2608).
+ *
+ * This is the console's door onto `convertHostLead` (the tenancy runtime),
+ * which owns the four writes, their order, and the idempotency on the lead;
+ * the REST API's `POST /v1/leads/{id}/convert` is the other door onto the
+ * same function (AGL-2627). What lives here is what only this door knows:
+ * the ID token, the body the convert dialog posts, and the statuses and
+ * sentences the dialog shows.
+ *
+ * ## What the caller has to be
+ *
+ * A signed-in member of the host's org holding `data.manage` — the same key
+ * the console gate on the CRM surface enforces — with a role on this site.
+ * Checked here with the Admin SDK rather than trusted from the client,
+ * because this route writes into collections the caller's own rules would
+ * otherwise decide about.
+ */ import { CONTACT_ERASED_MESSAGE, CRM_RECORDS_BAND_FULL_MESSAGE, normalizeCompanyDomain } from "@aglyn/aglyn/server";
+import { firebaseAdmin, getOrgForHost } from "@aglyn/tenant-data-admin";
+import { convertHostLead } from "@aglyn/tenant-runtime/convert-host-lead";
+import { resolveOrgPermissions } from "@aglyn/tenant-runtime/org-permissions";
+import { holdsDataManage } from "./org-caller.js";
+import { crmSuiteRefusal } from "./suite-gate.js";
+// The stage picker moved to the runtime with the writes; re-exported so the
+// pipeline code that imports it from here keeps its import.
+export { stageForNewDeal } from "@aglyn/tenant-runtime/convert-host-lead";
+const COMPANY_NAME_MAX = 120;
+const DEAL_TITLE_MAX = 200;
+const CURRENCY_PATTERN = /^[a-z]{3}$/;
+/**
+ * How each refusal the writes can answer reads at this door — the status
+ * and the sentence the convert dialog has always shown for it.
+ */ const REFUSALS = {
+    'unknown-lead': {
+        status: 404,
+        body: {
+            error: 'Unknown lead'
+        }
+    },
+    'no-email': {
+        status: 422,
+        body: {
+            error: 'This lead has no usable email address to convert'
+        }
+    },
+    'contact-not-created': {
+        status: 409,
+        body: {
+            error: 'The contact could not be created — the audience band may be ' + 'full. Nothing was changed.'
+        }
+    },
+    'band-full': {
+        status: 409,
+        body: {
+            error: CRM_RECORDS_BAND_FULL_MESSAGE,
+            reason: 'band'
+        }
+    },
+    // The contact create route's own answer for an erased address (AGL-2623),
+    // so the convert dialog and the add-contact drawer say one thing about
+    // one person.
+    erased: {
+        status: 409,
+        body: {
+            error: CONTACT_ERASED_MESSAGE,
+            reason: 'erased'
+        }
+    },
+    'unknown-company': {
+        status: 404,
+        body: {
+            error: 'Unknown company'
+        }
+    },
+    'no-stages': {
+        status: 409,
+        body: {
+            error: 'The default pipeline has no stages to open a deal in'
+        }
+    }
+};
+export const leadConvertHandler = async (req, res)=>{
+    var _req_headers_authorization, _req_body, _body_hostId, _body_leadId, _body_companyId;
+    if (req.method !== 'POST') {
+        res.setHeader('Allow', 'POST');
+        res.status(405).json({
+            error: 'Method not allowed'
+        });
+        return;
+    }
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) {
+        res.status(401).json({
+            error: 'Unauthenticated'
+        });
+        return;
+    }
+    const body = typeof req.body === 'string' ? JSON.parse(req.body) : (_req_body = req.body) != null ? _req_body : {};
+    const hostId = String((_body_hostId = body.hostId) != null ? _body_hostId : '').trim();
+    const leadId = String((_body_leadId = body.leadId) != null ? _body_leadId : '').trim();
+    if (!hostId || !leadId) {
+        res.status(400).json({
+            error: 'Missing hostId or leadId'
+        });
+        return;
+    }
+    /*
+   * Validate the optional parts BEFORE any read, so a malformed request costs
+   * nothing and a bad company domain is refused rather than silently dropped
+   * — a converter who typed a domain expects the company to carry it.
+   */ const requestedCompanyId = String((_body_companyId = body.companyId) != null ? _body_companyId : '').trim();
+    let createCompany = null;
+    if (!requestedCompanyId && body.createCompany) {
+        var _body_createCompany_name, _body_createCompany_domain;
+        const name = String((_body_createCompany_name = body.createCompany.name) != null ? _body_createCompany_name : '').trim().slice(0, COMPANY_NAME_MAX);
+        if (!name) {
+            res.status(400).json({
+                error: 'A company needs a name'
+            });
+            return;
+        }
+        const rawDomain = String((_body_createCompany_domain = body.createCompany.domain) != null ? _body_createCompany_domain : '').trim();
+        const domain = rawDomain ? normalizeCompanyDomain(rawDomain) : null;
+        if (rawDomain && !domain) {
+            res.status(400).json({
+                error: 'That does not look like a domain'
+            });
+            return;
+        }
+        createCompany = {
+            name,
+            domain
+        };
+    }
+    let deal = null;
+    if (body.deal) {
+        var _body_deal_title, _body_deal_currency;
+        const title = String((_body_deal_title = body.deal.title) != null ? _body_deal_title : '').trim().slice(0, DEAL_TITLE_MAX);
+        if (!title) {
+            res.status(400).json({
+                error: 'A deal needs a title'
+            });
+            return;
+        }
+        const amount = Number(body.deal.amountCents);
+        const currency = String((_body_deal_currency = body.deal.currency) != null ? _body_deal_currency : '').trim().toLowerCase();
+        deal = {
+            title,
+            amountCents: Number.isFinite(amount) && amount >= 0 ? Math.round(amount) : null,
+            currency: CURRENCY_PATTERN.test(currency) ? currency : 'usd',
+            stageId: body.deal.stageId ? String(body.deal.stageId) : undefined
+        };
+    }
+    try {
+        var _decoded_email;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        const staff = decoded['staff'] === true;
+        /*
+     * The console's own gate on the CRM is `data.manage`, asked of the
+     * permission catalog (`holdsDataManage`), and additionally that the
+     * caller has a role on THIS site — an org member scoped to a sibling site
+     * holds the key but not the host, and a lead is the host's record.
+     * `resolveOrgPermissions` answers the site role and fails closed on a
+     * lookup error when a host is named, so an absent membership refuses.
+     */ const membership = await resolveOrgPermissions(decoded.uid, {
+            hostId
+        });
+        if (!staff && !(membership.hostRole && await holdsDataManage(membership.orgId, decoded.uid))) {
+            res.status(403).json({
+                error: 'Converting a lead requires the data permission on this site'
+            });
+            return;
+        }
+        const resolved = await getOrgForHost(hostId);
+        if (!resolved) {
+            res.status(404).json({
+                error: 'Unknown site'
+            });
+            return;
+        }
+        const { orgId, org } = resolved;
+        // A lead's conversion is the CRM's, like its status and owner (AGL-2787).
+        const suite = crmSuiteRefusal(org, 'Converting a lead');
+        if (suite) {
+            res.status(suite.status).json(suite.body);
+            return;
+        }
+        const result = await convertHostLead(_extends({
+            firestore: firebaseAdmin.app().firestore(),
+            hostId,
+            orgId,
+            org: org,
+            leadId,
+            actor: {
+                uid: decoded.uid,
+                email: (_decoded_email = decoded.email) != null ? _decoded_email : null,
+                kind: 'member'
+            }
+        }, body.ownerUid ? {
+            ownerUid: String(body.ownerUid)
+        } : {}, requestedCompanyId ? {
+            companyId: requestedCompanyId
+        } : {}, {
+            createCompany,
+            deal
+        }));
+        if (result.ok === false) {
+            const refusal = REFUSALS[result.reason];
+            res.status(refusal.status).json(refusal.body);
+            return;
+        }
+        const answer = _extends({
+            ok: true,
+            contactId: result.contactId
+        }, result.companyId ? {
+            companyId: result.companyId
+        } : {}, result.dealId ? {
+            dealId: result.dealId
+        } : {}, {
+            alreadyConverted: result.alreadyConverted
+        });
+        res.status(200).json(answer);
+    } catch (error) {
+        console.error('lead-convert failed', error);
+        res.status(500).json({
+            error: 'The lead could not be converted.'
+        });
+    }
+};
+export default leadConvertHandler;
+
+//# sourceMappingURL=lead-convert.js.map

package/src/lib/server/lead-convert.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/lead-convert.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * `POST /api/crm/lead-convert` — a lead becomes a contact, and optionally a\n * company and a deal (AGL-2608).\n *\n * This is the console's door onto `convertHostLead` (the tenancy runtime),\n * which owns the four writes, their order, and the idempotency on the lead;\n * the REST API's `POST /v1/leads/{id}/convert` is the other door onto the\n * same function (AGL-2627). What lives here is what only this door knows:\n * the ID token, the body the convert dialog posts, and the statuses and\n * sentences the dialog shows.\n *\n * ## What the caller has to be\n *\n * A signed-in member of the host's org holding `data.manage` — the same key\n * the console gate on the CRM surface enforces — with a role on this site.\n * Checked here with the Admin SDK rather than trusted from the client,\n * because this route writes into collections the caller's own rules would\n * otherwise decide about.\n */\n\nimport {\n  CONTACT_ERASED_MESSAGE,\n  CRM_RECORDS_BAND_FULL_MESSAGE,\n  normalizeCompanyDomain,\n  type PluginApiHandler,\n} from '@aglyn/aglyn/server'\nimport { firebaseAdmin, getOrgForHost } from '@aglyn/tenant-data-admin'\nimport {\n  type ConvertHostLeadRefusal,\n  convertHostLead,\n} from '@aglyn/tenant-runtime/convert-host-lead'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\nimport { holdsDataManage } from './org-caller'\nimport { crmSuiteRefusal } from './suite-gate'\n\n// The stage picker moved to the runtime with the writes; re-exported so the\n// pipeline code that imports it from here keeps its import.\nexport { stageForNewDeal } from '@aglyn/tenant-runtime/convert-host-lead'\n\n/** The body the console's convert dialog posts. */\nexport interface LeadConvertRequest {\n  hostId: string\n  /** `hosts/{hostId}/leads/{leadId}` — the document id, which is the person key. */\n  leadId: string\n  /**\n   * Who owns the resulting contact (and deal). Defaults to the lead's own\n   * owner; failing that the org's assignment rules and the site's default\n   * owner decide (AGL-2618), and failing those the caller — somebody\n   * converted this person, and a record with no owner is one nobody\n   * follows up.\n   */\n  ownerUid?: string\n  /** Link an existing `orgs/{orgId}/companies/{companyId}`. */\n  companyId?: string\n  /** Or create one. Ignored when `companyId` is given. */\n  createCompany?: { name: string; domain?: string }\n  /** Open a deal in the org's default pipeline. */\n  deal?: {\n    title: string\n    amountCents?: number\n    /** Lowercase ISO 4217; `usd` when absent or malformed. */\n    currency?: string\n    /** A stage of the default pipeline; its first open stage when absent. */\n    stageId?: string\n  }\n}\n\n/** What the route answers on success. */\nexport interface LeadConvertResponse {\n  ok: true\n  contactId: string\n  companyId?: string\n  dealId?: string\n  /** The lead was converted before this call; nothing was created now. */\n  alreadyConverted: boolean\n}\n\nconst COMPANY_NAME_MAX = 120\nconst DEAL_TITLE_MAX = 200\nconst CURRENCY_PATTERN = /^[a-z]{3}$/\n\n/**\n * How each refusal the writes can answer reads at this door — the status\n * and the sentence the convert dialog has always shown for it.\n */\nconst REFUSALS: Record<\n  ConvertHostLeadRefusal,\n  { status: number; body: Record<string, unknown> }\n> = {\n  'unknown-lead': { status: 404, body: { error: 'Unknown lead' } },\n  'no-email': {\n    status: 422,\n    body: { error: 'This lead has no usable email address to convert' },\n  },\n  'contact-not-created': {\n    status: 409,\n    body: {\n      error:\n        'The contact could not be created — the audience band may be ' +\n        'full. Nothing was changed.',\n    },\n  },\n  'band-full': {\n    status: 409,\n    body: { error: CRM_RECORDS_BAND_FULL_MESSAGE, reason: 'band' },\n  },\n  // The contact create route's own answer for an erased address (AGL-2623),\n  // so the convert dialog and the add-contact drawer say one thing about\n  // one person.\n  erased: {\n    status: 409,\n    body: { error: CONTACT_ERASED_MESSAGE, reason: 'erased' },\n  },\n  'unknown-company': { status: 404, body: { error: 'Unknown company' } },\n  'no-stages': {\n    status: 409,\n    body: { error: 'The default pipeline has no stages to open a deal in' },\n  },\n}\n\nexport const leadConvertHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) {\n    res.status(401).json({ error: 'Unauthenticated' })\n    return\n  }\n  const body: Partial<LeadConvertRequest> =\n    typeof req.body === 'string' ? JSON.parse(req.body) : (req.body ?? {})\n  const hostId = String(body.hostId ?? '').trim()\n  const leadId = String(body.leadId ?? '').trim()\n  if (!hostId || !leadId) {\n    res.status(400).json({ error: 'Missing hostId or leadId' })\n    return\n  }\n\n  /*\n   * Validate the optional parts BEFORE any read, so a malformed request costs\n   * nothing and a bad company domain is refused rather than silently dropped\n   * — a converter who typed a domain expects the company to carry it.\n   */\n  const requestedCompanyId = String(body.companyId ?? '').trim()\n  let createCompany: { name: string; domain: string | null } | null = null\n  if (!requestedCompanyId && body.createCompany) {\n    const name = String(body.createCompany.name ?? '')\n      .trim()\n      .slice(0, COMPANY_NAME_MAX)\n    if (!name) {\n      res.status(400).json({ error: 'A company needs a name' })\n      return\n    }\n    const rawDomain = String(body.createCompany.domain ?? '').trim()\n    const domain = rawDomain ? normalizeCompanyDomain(rawDomain) : null\n    if (rawDomain && !domain) {\n      res.status(400).json({ error: 'That does not look like a domain' })\n      return\n    }\n    createCompany = { name, domain }\n  }\n  let deal: {\n    title: string\n    amountCents: number | null\n    currency: string\n    stageId: string | undefined\n  } | null = null\n  if (body.deal) {\n    const title = String(body.deal.title ?? '')\n      .trim()\n      .slice(0, DEAL_TITLE_MAX)\n    if (!title) {\n      res.status(400).json({ error: 'A deal needs a title' })\n      return\n    }\n    const amount = Number(body.deal.amountCents)\n    const currency = String(body.deal.currency ?? '')\n      .trim()\n      .toLowerCase()\n    deal = {\n      title,\n      amountCents:\n        Number.isFinite(amount) && amount >= 0 ? Math.round(amount) : null,\n      currency: CURRENCY_PATTERN.test(currency) ? currency : 'usd',\n      stageId: body.deal.stageId ? String(body.deal.stageId) : undefined,\n    }\n  }\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const staff = decoded['staff'] === true\n    /*\n     * The console's own gate on the CRM is `data.manage`, asked of the\n     * permission catalog (`holdsDataManage`), and additionally that the\n     * caller has a role on THIS site — an org member scoped to a sibling site\n     * holds the key but not the host, and a lead is the host's record.\n     * `resolveOrgPermissions` answers the site role and fails closed on a\n     * lookup error when a host is named, so an absent membership refuses.\n     */\n    const membership = await resolveOrgPermissions(decoded.uid, { hostId })\n    if (\n      !staff &&\n      !(membership.hostRole && (await holdsDataManage(membership.orgId, decoded.uid)))\n    ) {\n      res\n        .status(403)\n        .json({ error: 'Converting a lead requires the data permission on this site' })\n      return\n    }\n\n    const resolved = await getOrgForHost(hostId)\n    if (!resolved) {\n      res.status(404).json({ error: 'Unknown site' })\n      return\n    }\n    const { orgId, org } = resolved\n    // A lead's conversion is the CRM's, like its status and owner (AGL-2787).\n    const suite = crmSuiteRefusal(org, 'Converting a lead')\n    if (suite) {\n      res.status(suite.status).json(suite.body)\n      return\n    }\n    const result = await convertHostLead({\n      firestore: firebaseAdmin.app().firestore(),\n      hostId,\n      orgId,\n      org: org as Record<string, unknown>,\n      leadId,\n      actor: { uid: decoded.uid, email: decoded.email ?? null, kind: 'member' },\n      ...(body.ownerUid ? { ownerUid: String(body.ownerUid) } : {}),\n      ...(requestedCompanyId ? { companyId: requestedCompanyId } : {}),\n      createCompany,\n      deal,\n    })\n    if (result.ok === false) {\n      const refusal = REFUSALS[result.reason]\n      res.status(refusal.status).json(refusal.body)\n      return\n    }\n    const answer: LeadConvertResponse = {\n      ok: true,\n      contactId: result.contactId,\n      ...(result.companyId ? { companyId: result.companyId } : {}),\n      ...(result.dealId ? { dealId: result.dealId } : {}),\n      alreadyConverted: result.alreadyConverted,\n    }\n    res.status(200).json(answer)\n  } catch (error) {\n    console.error('lead-convert failed', error)\n    res.status(500).json({ error: 'The lead could not be converted.' })\n  }\n}\n\nexport default leadConvertHandler\n"],"names":["CONTACT_ERASED_MESSAGE","CRM_RECORDS_BAND_FULL_MESSAGE","normalizeCompanyDomain","firebaseAdmin","getOrgForHost","convertHostLead","resolveOrgPermissions","holdsDataManage","crmSuiteRefusal","stageForNewDeal","COMPANY_NAME_MAX","DEAL_TITLE_MAX","CURRENCY_PATTERN","REFUSALS","status","body","error","reason","erased","leadConvertHandler","req","res","method","setHeader","json","authorization","String","headers","idToken","startsWith","slice","length","undefined","JSON","parse","hostId","trim","leadId","requestedCompanyId","companyId","createCompany","name","rawDomain","domain","deal","title","amount","Number","amountCents","currency","toLowerCase","isFinite","Math","round","test","stageId","decoded","app","auth","verifyIdToken","staff","membership","uid","hostRole","orgId","resolved","org","suite","result","firestore","actor","email","kind","ownerUid","ok","refusal","answer","contactId","dealId","alreadyConverted","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;CAkBC,GAED,SACEA,sBAAsB,EACtBC,6BAA6B,EAC7BC,sBAAsB,QAEjB,sBAAqB;AAC5B,SAASC,aAAa,EAAEC,aAAa,QAAQ,2BAA0B;AACvE,SAEEC,eAAe,QACV,0CAAyC;AAChD,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SAASC,eAAe,QAAQ,kBAAc;AAC9C,SAASC,eAAe,QAAQ,kBAAc;AAE9C,4EAA4E;AAC5E,4DAA4D;AAC5D,SAASC,eAAe,QAAQ,0CAAyC;AAwCzE,MAAMC,mBAAmB;AACzB,MAAMC,iBAAiB;AACvB,MAAMC,mBAAmB;AAEzB;;;CAGC,GACD,MAAMC,WAGF;IACF,gBAAgB;QAAEC,QAAQ;QAAKC,MAAM;YAAEC,OAAO;QAAe;IAAE;IAC/D,YAAY;QACVF,QAAQ;QACRC,MAAM;YAAEC,OAAO;QAAmD;IACpE;IACA,uBAAuB;QACrBF,QAAQ;QACRC,MAAM;YACJC,OACE,iEACA;QACJ;IACF;IACA,aAAa;QACXF,QAAQ;QACRC,MAAM;YAAEC,OAAOf;YAA+BgB,QAAQ;QAAO;IAC/D;IACA,0EAA0E;IAC1E,uEAAuE;IACvE,cAAc;IACdC,QAAQ;QACNJ,QAAQ;QACRC,MAAM;YAAEC,OAAOhB;YAAwBiB,QAAQ;QAAS;IAC1D;IACA,mBAAmB;QAAEH,QAAQ;QAAKC,MAAM;YAAEC,OAAO;QAAkB;IAAE;IACrE,aAAa;QACXF,QAAQ;QACRC,MAAM;YAAEC,OAAO;QAAuD;IACxE;AACF;AAEA,OAAO,MAAMG,qBAAuC,OAAOC,KAAKC;QAMjCD,4BAS4BA,WACnCL,cACAA,cAWYA;IA3BlC,IAAIK,IAAIE,MAAM,KAAK,QAAQ;QACzBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIP,MAAM,CAAC,KAAKU,IAAI,CAAC;YAAER,OAAO;QAAqB;QACnD;IACF;IACA,MAAMS,gBAAgBC,QAAON,6BAAAA,IAAIO,OAAO,CAACF,aAAa,YAAzBL,6BAA6B;IAC1D,MAAMQ,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS;QACZP,IAAIP,MAAM,CAAC,KAAKU,IAAI,CAAC;YAAER,OAAO;QAAkB;QAChD;IACF;IACA,MAAMD,OACJ,OAAOK,IAAIL,IAAI,KAAK,WAAWkB,KAAKC,KAAK,CAACd,IAAIL,IAAI,KAAKK,YAAAA,IAAIL,IAAI,YAARK,YAAY,CAAC;IACtE,MAAMe,SAAST,QAAOX,eAAAA,KAAKoB,MAAM,YAAXpB,eAAe,IAAIqB,IAAI;IAC7C,MAAMC,SAASX,QAAOX,eAAAA,KAAKsB,MAAM,YAAXtB,eAAe,IAAIqB,IAAI;IAC7C,IAAI,CAACD,UAAU,CAACE,QAAQ;QACtBhB,IAAIP,MAAM,CAAC,KAAKU,IAAI,CAAC;YAAER,OAAO;QAA2B;QACzD;IACF;IAEA;;;;GAIC,GACD,MAAMsB,qBAAqBZ,QAAOX,kBAAAA,KAAKwB,SAAS,YAAdxB,kBAAkB,IAAIqB,IAAI;IAC5D,IAAII,gBAAgE;IACpE,IAAI,CAACF,sBAAsBvB,KAAKyB,aAAa,EAAE;YACzBzB,0BAOKA;QAPzB,MAAM0B,OAAOf,QAAOX,2BAAAA,KAAKyB,aAAa,CAACC,IAAI,YAAvB1B,2BAA2B,IAC5CqB,IAAI,GACJN,KAAK,CAAC,GAAGpB;QACZ,IAAI,CAAC+B,MAAM;YACTpB,IAAIP,MAAM,CAAC,KAAKU,IAAI,CAAC;gBAAER,OAAO;YAAyB;YACvD;QACF;QACA,MAAM0B,YAAYhB,QAAOX,6BAAAA,KAAKyB,aAAa,CAACG,MAAM,YAAzB5B,6BAA6B,IAAIqB,IAAI;QAC9D,MAAMO,SAASD,YAAYxC,uBAAuBwC,aAAa;QAC/D,IAAIA,aAAa,CAACC,QAAQ;YACxBtB,IAAIP,MAAM,CAAC,KAAKU,IAAI,CAAC;gBAAER,OAAO;YAAmC;YACjE;QACF;QACAwB,gBAAgB;YAAEC;YAAME;QAAO;IACjC;IACA,IAAIC,OAKO;IACX,IAAI7B,KAAK6B,IAAI,EAAE;YACQ7B,kBAQGA;QARxB,MAAM8B,QAAQnB,QAAOX,mBAAAA,KAAK6B,IAAI,CAACC,KAAK,YAAf9B,mBAAmB,IACrCqB,IAAI,GACJN,KAAK,CAAC,GAAGnB;QACZ,IAAI,CAACkC,OAAO;YACVxB,IAAIP,MAAM,CAAC,KAAKU,IAAI,CAAC;gBAAER,OAAO;YAAuB;YACrD;QACF;QACA,MAAM8B,SAASC,OAAOhC,KAAK6B,IAAI,CAACI,WAAW;QAC3C,MAAMC,WAAWvB,QAAOX,sBAAAA,KAAK6B,IAAI,CAACK,QAAQ,YAAlBlC,sBAAsB,IAC3CqB,IAAI,GACJc,WAAW;QACdN,OAAO;YACLC;YACAG,aACED,OAAOI,QAAQ,CAACL,WAAWA,UAAU,IAAIM,KAAKC,KAAK,CAACP,UAAU;YAChEG,UAAUrC,iBAAiB0C,IAAI,CAACL,YAAYA,WAAW;YACvDM,SAASxC,KAAK6B,IAAI,CAACW,OAAO,GAAG7B,OAAOX,KAAK6B,IAAI,CAACW,OAAO,IAAIvB;QAC3D;IACF;IAEA,IAAI;YAwCkCwB;QAvCpC,MAAMA,UAAU,MAAMrD,cAAcsD,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAAC/B;QAC/D,MAAMgC,QAAQJ,OAAO,CAAC,QAAQ,KAAK;QACnC;;;;;;;KAOC,GACD,MAAMK,aAAa,MAAMvD,sBAAsBkD,QAAQM,GAAG,EAAE;YAAE3B;QAAO;QACrE,IACE,CAACyB,SACD,CAAEC,CAAAA,WAAWE,QAAQ,IAAK,MAAMxD,gBAAgBsD,WAAWG,KAAK,EAAER,QAAQM,GAAG,CAAC,GAC9E;YACAzC,IACGP,MAAM,CAAC,KACPU,IAAI,CAAC;gBAAER,OAAO;YAA8D;YAC/E;QACF;QAEA,MAAMiD,WAAW,MAAM7D,cAAc+B;QACrC,IAAI,CAAC8B,UAAU;YACb5C,IAAIP,MAAM,CAAC,KAAKU,IAAI,CAAC;gBAAER,OAAO;YAAe;YAC7C;QACF;QACA,MAAM,EAAEgD,KAAK,EAAEE,GAAG,EAAE,GAAGD;QACvB,0EAA0E;QAC1E,MAAME,QAAQ3D,gBAAgB0D,KAAK;QACnC,IAAIC,OAAO;YACT9C,IAAIP,MAAM,CAACqD,MAAMrD,MAAM,EAAEU,IAAI,CAAC2C,MAAMpD,IAAI;YACxC;QACF;QACA,MAAMqD,SAAS,MAAM/D,gBAAgB;YACnCgE,WAAWlE,cAAcsD,GAAG,GAAGY,SAAS;YACxClC;YACA6B;YACAE,KAAKA;YACL7B;YACAiC,OAAO;gBAAER,KAAKN,QAAQM,GAAG;gBAAES,KAAK,GAAEf,iBAAAA,QAAQe,KAAK,YAAbf,iBAAiB;gBAAMgB,MAAM;YAAS;WACpEzD,KAAK0D,QAAQ,GAAG;YAAEA,UAAU/C,OAAOX,KAAK0D,QAAQ;QAAE,IAAI,CAAC,GACvDnC,qBAAqB;YAAEC,WAAWD;QAAmB,IAAI,CAAC;YAC9DE;YACAI;;QAEF,IAAIwB,OAAOM,EAAE,KAAK,OAAO;YACvB,MAAMC,UAAU9D,QAAQ,CAACuD,OAAOnD,MAAM,CAAC;YACvCI,IAAIP,MAAM,CAAC6D,QAAQ7D,MAAM,EAAEU,IAAI,CAACmD,QAAQ5D,IAAI;YAC5C;QACF;QACA,MAAM6D,SAA8B;YAClCF,IAAI;YACJG,WAAWT,OAAOS,SAAS;WACvBT,OAAO7B,SAAS,GAAG;YAAEA,WAAW6B,OAAO7B,SAAS;QAAC,IAAI,CAAC,GACtD6B,OAAOU,MAAM,GAAG;YAAEA,QAAQV,OAAOU,MAAM;QAAC,IAAI,CAAC;YACjDC,kBAAkBX,OAAOW,gBAAgB;;QAE3C1D,IAAIP,MAAM,CAAC,KAAKU,IAAI,CAACoD;IACvB,EAAE,OAAO5D,OAAO;QACdgE,QAAQhE,KAAK,CAAC,uBAAuBA;QACrCK,IAAIP,MAAM,CAAC,KAAKU,IAAI,CAAC;YAAER,OAAO;QAAmC;IACnE;AACF,EAAC;AAED,eAAeG,mBAAkB"}