@aglyn/plugins-crm 1.0.0-beta.217 → 1.0.0-beta.219

package/src/lib/server/api-v1/crm-deals.js

@@ -0,0 +1,631 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { _ as _object_without_properties_loose } from "@swc/helpers/_/_object_without_properties_loose";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * `/v1/deals` (AGL-2606) — the most commercially sensitive row in the CRM.
+ *
+ * ## The stage owns the status
+ *
+ * `status` is denormalized from the stage's `kind` (`crm.ts`), so the two
+ * can never disagree on a stored deal. A client may move a deal by either
+ * name: `stageId` picks a stage and the status follows; `status` alone picks
+ * the pipeline's one `won` or `lost` stage, or its FIRST open stage for
+ * `open` — a reopen has to land somewhere, and the top of the pipeline is
+ * the only somewhere that needs no second field. Both together must agree,
+ * and a pair that does not is refused rather than resolved in favor of
+ * either, because whichever one we picked would be the one the client did
+ * not mean.
+ *
+ * Every stage move stamps `stageChangedAtMs`, which is what "stuck in
+ * stage" reports read, and a move into or out of a closed stage sets or
+ * clears `closedAtMs`.
+ *
+ * ## A won deal makes its contact a customer
+ *
+ * The console's stage route floors the linked contact's lifecycle stage at
+ * `customer` when a deal is won (AGL-2641), and this resource is the same
+ * writer with a different door: a `PATCH` that moves a deal into its `won`
+ * stage, or a `POST` that creates one there, applies the same floor to the
+ * contact the deal names, in the facet of the deal's site — filling an
+ * empty stage, advancing an earlier one, never moving anybody back. The
+ * deal's own write is not undone by a contact write that fails; the deal
+ * is what the integrator asked for, and the floor is what the win implies.
+ *
+ * ## The line items own the amount
+ *
+ * A deal may carry `lineItems` (AGL-2620) — the products behind its value,
+ * each in the deal's currency. With one or more lines the stored
+ * `amountCents` IS their sum, written beside them, so a typed `amountCents`
+ * in the same body, or alone on a deal that has lines, is refused rather
+ * than reconciled: whichever number we kept would be the one the client did
+ * not mean. `lineItems: []` clears the lines and hands the amount back to
+ * the client; the last sum stays until it is retyped. Changing the currency
+ * of a deal with lines needs the lines resent in that currency, because
+ * their sum is one number in one unit.
+ */ import { CRM_COLLECTIONS, CRM_MEDIA_IDS_MAX, createResourceUid, crmNewRecordListFields, dealStageById, lineItemsTotalCents, normalizeCrmMediaIds, readDealLineItems } from "@aglyn/aglyn/server";
+import { apiJson, ApiErrors, restampCrmListFieldsAt } from "@aglyn/tenant-data-admin";
+import { Timestamp } from "firebase-admin/firestore";
+import { claimWrite, readJsonBody, requireScope } from "@aglyn/tenant-data-admin/server/api-v1-kit";
+import { floorContactLifecycleStage } from "../contact-lifecycle-floor.js";
+import { orderedStages, resolvePipeline } from "./crm-pipelines.js";
+import { CRM_TEXT_MAX, CRM_TITLE_MAX, createPayload, crmCollection, crmCreateStamp, crmCustomUpdate, crmCustomView, crmRecordsBandRefusal, crmRefErrors, crmTimes, crmValidationFailed, isoFromMs, listCrm, memberError, parseIsoInstant, readChoice, readCrmCustomBody, readCrmSite, readEqualityFilters, readOptionalText, readRefId, refuseUnknownKeys, updatePayload } from "./crm-shared.js";
+const DEAL_STATUSES = [
+    'open',
+    'won',
+    'lost'
+];
+/** One line as published: the stored shape, with `productId` always present. */ function lineItemView(item) {
+    var _item_productId;
+    return {
+        productId: (_item_productId = item.productId) != null ? _item_productId : null,
+        name: item.name,
+        quantity: item.quantity,
+        unitAmountCents: item.unitAmountCents,
+        currency: item.currency
+    };
+}
+/** The deal object as published. Every writable field appears here. */ function dealView(doc) {
+    var _doc_data, _data_title, _data_pipelineId, _data_stageId, _data_status, _data_currency, _data_ownerUid, _data_contactId, _data_companyId, _data_lostReason, _data_notes, _data_hostId;
+    const data = (_doc_data = doc.data()) != null ? _doc_data : {};
+    return _extends({
+        id: doc.id,
+        object: 'deal',
+        title: (_data_title = data.title) != null ? _data_title : null,
+        pipelineId: (_data_pipelineId = data.pipelineId) != null ? _data_pipelineId : null,
+        stageId: (_data_stageId = data.stageId) != null ? _data_stageId : null,
+        status: (_data_status = data.status) != null ? _data_status : null,
+        amountCents: typeof data.amountCents === 'number' ? data.amountCents : null,
+        // `'usd'` when absent, as the model says — a deal with no currency is a
+        // dollar deal, not a deal with an unknown one.
+        currency: (_data_currency = data.currency) != null ? _data_currency : 'usd',
+        lineItems: Array.isArray(data.lineItems) ? data.lineItems.map(lineItemView) : [],
+        expectedCloseAt: isoFromMs(data.expectedCloseAtMs),
+        closedAt: isoFromMs(data.closedAtMs),
+        stageChangedAt: isoFromMs(data.stageChangedAtMs),
+        ownerUid: (_data_ownerUid = data.ownerUid) != null ? _data_ownerUid : null,
+        contactId: (_data_contactId = data.contactId) != null ? _data_contactId : null,
+        companyId: (_data_companyId = data.companyId) != null ? _data_companyId : null,
+        lostReason: (_data_lostReason = data.lostReason) != null ? _data_lostReason : null,
+        notes: (_data_notes = data.notes) != null ? _data_notes : null,
+        // The org's deal custom fields, keyed by field key (AGL-2661).
+        custom: crmCustomView(data),
+        // When the earliest open task against the deal is due — see
+        // `CrmDeal.nextTaskAtMs`. Read-only: the tasks resource maintains it.
+        nextTaskAt: isoFromMs(data.nextTaskAtMs),
+        mediaIds: normalizeCrmMediaIds(data.mediaIds),
+        siteId: (_data_hostId = data.hostId) != null ? _data_hostId : null
+    }, crmTimes(data));
+}
+const DEAL_WRITABLE = new Set([
+    'title',
+    'stageId',
+    'status',
+    'amountCents',
+    'currency',
+    'lineItems',
+    'expectedCloseAt',
+    'ownerUid',
+    'contactId',
+    'companyId',
+    'lostReason',
+    'notes',
+    'custom',
+    'mediaIds'
+]);
+/**
+ * The writable half of a deal, validated. `pipelineId` is accepted on a
+ * create only: a deal's stages are its pipeline's, and moving one between
+ * pipelines is a new deal in the other pipeline, not an edit.
+ */ function readDealInput(body, { partial }) {
+    const errors = {};
+    const values = {};
+    const allowed = new Set(DEAL_WRITABLE);
+    if (!partial) {
+        allowed.add('consentSiteId');
+        allowed.add('pipelineId');
+    }
+    refuseUnknownKeys(body, allowed, 'deal', errors);
+    if (partial && body.pipelineId !== undefined) {
+        errors.pipelineId = 'Not writable — create the deal in the other pipeline';
+    }
+    if (body.mediaIds !== undefined) {
+        if (!Array.isArray(body.mediaIds)) {
+            errors.mediaIds = 'Must be an array of media ids';
+        } else if (body.mediaIds.length > CRM_MEDIA_IDS_MAX) {
+            errors.mediaIds = `At most ${CRM_MEDIA_IDS_MAX} files may be attached`;
+        } else {
+            // The SAME normalizer the console card writes through, so the API
+            // cannot store a list the console would refuse. An empty array is
+            // legal and clears the attachments.
+            values.mediaIds = normalizeCrmMediaIds(body.mediaIds);
+        }
+    }
+    if (body.title !== undefined || !partial) {
+        var _body_title;
+        const title = String((_body_title = body.title) != null ? _body_title : '').trim().slice(0, CRM_TITLE_MAX);
+        if (title) values.title = title;
+        else errors.title = partial ? 'Must not be empty' : 'A title is required';
+    }
+    if (!partial && body.pipelineId !== undefined) {
+        const pipelineId = readRefId(body, 'pipelineId', errors);
+        if (pipelineId) values.pipelineId = pipelineId;
+        else if (pipelineId === null) errors.pipelineId = 'Must be an id';
+    }
+    const stageId = readRefId(body, 'stageId', errors);
+    if (stageId) values.stageId = stageId;
+    else if (stageId === null) errors.stageId = 'Must be a stage id';
+    const status = readChoice(body, 'status', DEAL_STATUSES, errors);
+    if (status) values.status = status;
+    if (body.amountCents !== undefined) {
+        if (body.amountCents === null) {
+            values.amountCents = null;
+        } else if (typeof body.amountCents !== 'number' || !Number.isInteger(body.amountCents) || body.amountCents < 0) {
+            errors.amountCents = 'Must be a whole number of cents, 0 or more';
+        } else {
+            values.amountCents = body.amountCents;
+        }
+    }
+    if (body.currency !== undefined) {
+        var _body_currency;
+        const currency = String((_body_currency = body.currency) != null ? _body_currency : '').trim().toLowerCase();
+        if (/^[a-z]{3}$/.test(currency)) values.currency = currency;
+        else errors.currency = 'Must be a three-letter ISO 4217 code, like usd';
+    }
+    if (body.lineItems !== undefined) {
+        if (body.lineItems === null || Array.isArray(body.lineItems) && body.lineItems.length === 0) {
+            values.lineItems = [];
+        } else if (!Array.isArray(body.lineItems)) {
+            errors.lineItems = 'Must be a list of line items';
+        } else {
+            values.lineItems = body.lineItems;
+            if (body.amountCents !== undefined) {
+                errors.amountCents = 'Derived from lineItems — omit it, or send lineItems: [] to type an amount';
+            }
+        }
+    }
+    if (body.expectedCloseAt !== undefined) {
+        if (body.expectedCloseAt === null) {
+            values.expectedCloseAtMs = null;
+        } else {
+            const ms = parseIsoInstant(body.expectedCloseAt);
+            if (ms === null) {
+                errors.expectedCloseAt = 'Must be an ISO 8601 instant, like 2026-12-31T00:00:00Z';
+            } else {
+                values.expectedCloseAtMs = ms;
+            }
+        }
+    }
+    const ownerUid = readOptionalText(body, 'ownerUid', CRM_TITLE_MAX, errors);
+    if (ownerUid !== undefined) values.ownerUid = ownerUid;
+    const contactId = readRefId(body, 'contactId', errors);
+    if (contactId !== undefined) values.contactId = contactId;
+    const companyId = readRefId(body, 'companyId', errors);
+    if (companyId !== undefined) values.companyId = companyId;
+    const lostReason = readOptionalText(body, 'lostReason', CRM_TEXT_MAX, errors);
+    if (lostReason !== undefined) values.lostReason = lostReason;
+    const notes = readOptionalText(body, 'notes', CRM_TEXT_MAX, errors);
+    if (notes !== undefined) values.notes = notes;
+    // `custom` is shape-checked here and judged against the org's
+    // definitions by the writers, which is where the read is paid.
+    if (body.custom !== undefined) {
+        if (!body.custom || typeof body.custom !== 'object' || Array.isArray(body.custom)) {
+            errors.custom = 'Must be an object of field values keyed by field key';
+        }
+    }
+    return Object.keys(errors).length ? {
+        errors
+    } : {
+        values
+    };
+}
+/**
+ * The stage a write lands the deal in, from `stageId` and/or `status` — see
+ * the module header for the rule. `null` when neither was sent, which on a
+ * PATCH means "leave the stage alone" and on a create means the first open
+ * stage.
+ */ function resolveStage(pipeline, values) {
+    const stages = orderedStages(pipeline);
+    if (values.stageId) {
+        const stage = dealStageById(pipeline, values.stageId);
+        if (!stage) return {
+            errors: {
+                stageId: 'No such stage in this pipeline'
+            }
+        };
+        if (values.status && values.status !== stage.kind) {
+            return {
+                errors: {
+                    status: `Must match the stage, which is ${stage.kind}`
+                }
+            };
+        }
+        return {
+            stage
+        };
+    }
+    if (values.status) {
+        const stage = values.status === 'open' ? stages.find((candidate)=>candidate.kind === 'open') : stages.find((candidate)=>candidate.kind === values.status);
+        if (!stage) {
+            return {
+                errors: {
+                    status: `This pipeline has no ${values.status} stage`
+                }
+            };
+        }
+        return {
+            stage
+        };
+    }
+    return {
+        stage: null
+    };
+}
+/**
+ * The stored lines and the amount they derive, for a write that sent
+ * `lineItems`, validated against the currency the deal WILL have — the
+ * body's, else the stored one, else `usd`. Returns nothing to write when
+ * the body carried no lines.
+ */ function placeLineItems(values, stored) {
+    var _ref, _values_currency;
+    if (values.lineItems === undefined) return {
+        fields: {}
+    };
+    const currency = (_ref = (_values_currency = values.currency) != null ? _values_currency : stored == null ? void 0 : stored.currency) != null ? _ref : 'usd';
+    const read = readDealLineItems(values.lineItems, currency);
+    if ('error' in read) return {
+        errors: {
+            lineItems: read.error
+        }
+    };
+    return {
+        fields: _extends({
+            lineItems: read.items
+        }, read.items.length ? {
+            amountCents: lineItemsTotalCents(read.items)
+        } : {})
+    };
+}
+/**
+ * The customer floor a win applies to the deal's contact (AGL-2641), after
+ * the deal itself is written. A contact write that fails is logged and
+ * swallowed: the deal is already won, and a `500` would tell the integrator
+ * the move they can see in the console did not happen.
+ */ async function floorWonDealContact(ctx, deal) {
+    var _deal_contactId;
+    const contactId = String((_deal_contactId = deal.contactId) != null ? _deal_contactId : '').trim();
+    if (!contactId) return;
+    try {
+        var _deal_hostId;
+        await floorContactLifecycleStage({
+            contactRef: ctx.firestore.collection('orgs').doc(ctx.orgId).collection('contacts').doc(contactId),
+            org: ctx.org,
+            hostId: (_deal_hostId = deal.hostId) != null ? _deal_hostId : null,
+            floor: 'customer'
+        });
+    } catch (error) {
+        console.error('[api-v1] deals: the customer floor failed', contactId, error);
+    }
+}
+/** The fields a stage move writes, beside the stage itself. */ function stageMove(stage, nowMs) {
+    return {
+        stageId: stage.id,
+        status: stage.kind,
+        stageChangedAtMs: nowMs,
+        closedAtMs: stage.kind === 'open' ? null : nowMs
+    };
+}
+/** The membership and reference checks a deal write makes, merged. */ async function dealRefErrors(ctx, values) {
+    var _values_contactId, _values_companyId;
+    const [owner, refs] = await Promise.all([
+        memberError(ctx, 'ownerUid', values.ownerUid),
+        crmRefErrors(ctx, {
+            contactId: (_values_contactId = values.contactId) != null ? _values_contactId : undefined,
+            companyId: (_values_companyId = values.companyId) != null ? _values_companyId : undefined
+        })
+    ]);
+    return _extends({}, owner, refs);
+}
+/**
+ * `POST /v1/deals`. The pipeline is resolved AFTER the claim because
+ * resolving it can create one (`resolvePipeline`), and a refusal past that
+ * point releases the key so the retry that names a real stage still can.
+ */ async function createDeal(request, ctx) {
+    const body = await readJsonBody(request);
+    const parsed = readDealInput(body, {
+        partial: false
+    });
+    if ('errors' in parsed) return crmValidationFailed(ctx, 'deal', parsed.errors);
+    const site = readCrmSite(ctx, 'deal', body);
+    if ('response' in site) return site.response;
+    const refErrors = await dealRefErrors(ctx, parsed.values);
+    if (Object.keys(refErrors).length) return crmValidationFailed(ctx, 'deal', refErrors);
+    // Judged against the org's deal definitions, above the claim (AGL-2661).
+    const custom = await readCrmCustomBody(ctx, body, 'deal');
+    if (custom && 'errors' in custom) return crmValidationFailed(ctx, 'deal', custom.errors);
+    const customValues = custom && 'values' in custom ? custom.values : {};
+    const collection = crmCollection(ctx, CRM_COLLECTIONS.deals);
+    const claimed = await claimWrite(ctx, '*', request.headers.get('Idempotency-Key'), 'deals');
+    if ('replay' in claimed) return claimed.replay;
+    const { claim } = claimed;
+    try {
+        var _placed_stage;
+        const _parsed_values = parsed.values, { title, pipelineId, stageId, status, lineItems } = _parsed_values, rest = _object_without_properties_loose(_parsed_values, [
+            "title",
+            "pipelineId",
+            "stageId",
+            "status",
+            "lineItems"
+        ]);
+        const placedLines = placeLineItems({
+            lineItems,
+            currency: rest.currency
+        }, null);
+        if ('errors' in placedLines) {
+            await claim.release();
+            return crmValidationFailed(ctx, 'deal', placedLines.errors);
+        }
+        const resolved = await resolvePipeline(ctx, site.siteId, pipelineId);
+        if ('error' in resolved) {
+            await claim.release();
+            return crmValidationFailed(ctx, 'deal', {
+                pipelineId: resolved.error
+            });
+        }
+        const placed = resolveStage(resolved.pipeline, {
+            stageId,
+            status
+        });
+        if ('errors' in placed) {
+            await claim.release();
+            return crmValidationFailed(ctx, 'deal', placed.errors);
+        }
+        const stage = (_placed_stage = placed.stage) != null ? _placed_stage : orderedStages(resolved.pipeline)[0];
+        if (!stage) {
+            await claim.release();
+            return crmValidationFailed(ctx, 'deal', {
+                pipelineId: 'This pipeline has no stages'
+            });
+        }
+        // The records band (AGL-2611), asked last so a refusal past the pipeline
+        // resolution releases the key exactly as a bad stage does.
+        const bandFull = await crmRecordsBandRefusal(ctx);
+        if (bandFull) {
+            await claim.release();
+            return bandFull;
+        }
+        const id = createResourceUid();
+        // One clock: the stage move is stamped with the instant the record's own
+        // `createdAt` carries, so a deal created won closed the moment it began.
+        const stamp = crmCreateStamp(ctx, site.siteId);
+        const record = _extends({
+            title,
+            titleLower: (title != null ? title : '').toLowerCase(),
+            pipelineId: resolved.id
+        }, createPayload(_extends({}, rest, placedLines.fields, stageMove(stage, stamp.createdAt.toMillis()))), Object.keys(customValues).length ? {
+            custom: createPayload(customValues)
+        } : {}, stamp);
+        // What the console's Deals list searches and filters by (AGL-3321).
+        await collection.doc(id).create(_extends({}, record, crmNewRecordListFields('deals', record)));
+        // A deal created won is a won deal: its contact is a customer from birth.
+        if (stage.kind === 'won') {
+            await floorWonDealContact(ctx, {
+                contactId: rest.contactId,
+                hostId: site.siteId
+            });
+        }
+        const view = dealView(await collection.doc(id).get());
+        await claim.record(200, view);
+        return apiJson(view, {
+            status: 201,
+            headers: ctx.headers
+        });
+    } catch (error) {
+        await claim.release();
+        throw error;
+    }
+}
+/** `PATCH /v1/deals/{id}`. */ async function updateDeal(request, ctx, ref) {
+    var _stored_currency;
+    const body = await readJsonBody(request);
+    const parsed = readDealInput(body, {
+        partial: true
+    });
+    if ('errors' in parsed) return crmValidationFailed(ctx, 'deal', parsed.errors);
+    const snap = await ref.get();
+    if (!snap.exists) {
+        return ApiErrors.notFound({
+            message: 'No such deal',
+            headers: ctx.headers
+        });
+    }
+    const refErrors = await dealRefErrors(ctx, parsed.values);
+    if (Object.keys(refErrors).length) return crmValidationFailed(ctx, 'deal', refErrors);
+    const custom = await readCrmCustomBody(ctx, body, 'deal');
+    if (custom && 'errors' in custom) return crmValidationFailed(ctx, 'deal', custom.errors);
+    const _parsed_values = parsed.values, { title, stageId, status, lineItems } = _parsed_values, rest = _object_without_properties_loose(_parsed_values, [
+        "title",
+        "stageId",
+        "status",
+        "lineItems"
+    ]);
+    const stored = snap.data();
+    const storedLines = Array.isArray(stored.lineItems) && stored.lineItems.length > 0;
+    const keepsLines = storedLines && lineItems === undefined;
+    if (keepsLines && rest.amountCents !== undefined) {
+        return crmValidationFailed(ctx, 'deal', {
+            amountCents: "This deal's amount is the sum of its line items — edit lineItems instead"
+        });
+    }
+    if (keepsLines && rest.currency !== undefined && rest.currency !== ((_stored_currency = stored.currency) != null ? _stored_currency : 'usd')) {
+        return crmValidationFailed(ctx, 'deal', {
+            currency: "Every line item is in the deal's currency — send lineItems in the new currency with it"
+        });
+    }
+    const placedLines = placeLineItems({
+        lineItems,
+        currency: rest.currency
+    }, stored);
+    if ('errors' in placedLines) return crmValidationFailed(ctx, 'deal', placedLines.errors);
+    const update = _extends({}, title !== undefined ? {
+        title,
+        titleLower: title.toLowerCase()
+    } : {}, updatePayload(_extends({}, rest, placedLines.fields)), custom && 'values' in custom ? crmCustomUpdate(custom.values) : {});
+    // The write's one instant: `updatedAt`, and the stage move if there is one,
+    // so a deal closed at T reads updated at T.
+    const now = Timestamp.now();
+    let won = false;
+    if (stageId !== undefined || status !== undefined) {
+        const current = snap.data();
+        const resolved = await resolvePipeline(ctx, current.hostId, current.pipelineId, {
+            allowArchived: true
+        });
+        if ('error' in resolved) {
+            return crmValidationFailed(ctx, 'deal', {
+                stageId: "This deal's pipeline no longer exists"
+            });
+        }
+        const placed = resolveStage(resolved.pipeline, {
+            stageId,
+            status
+        });
+        if ('errors' in placed) return crmValidationFailed(ctx, 'deal', placed.errors);
+        if (placed.stage && placed.stage.id !== current.stageId) {
+            Object.assign(update, stageMove(placed.stage, now.toMillis()));
+            // The transition INTO won, not a won deal edited: a deal already
+            // closed won floored its contact when it closed.
+            won = placed.stage.kind === 'won' && current.status !== 'won';
+        }
+    }
+    if (Object.keys(update).length > 0) {
+        await ref.update(_extends({}, update, {
+            updatedAt: now
+        }));
+        // What the console's Deals list searches (AGL-3321).
+        if ('title' in update) await restampCrmListFieldsAt(ref, 'deals');
+    }
+    if (won) {
+        await floorWonDealContact(ctx, {
+            contactId: rest.contactId !== undefined ? rest.contactId : stored.contactId,
+            hostId: stored.hostId
+        });
+    }
+    return apiJson(dealView(await ref.get()), {
+        headers: ctx.headers
+    });
+}
+/** `DELETE /v1/deals/{id}` — the deal alone; its tasks and activities stay. */ async function deleteDeal(request, ctx, ref) {
+    const claimed = await claimWrite(ctx, '*', request.headers.get('Idempotency-Key'), 'deal-deletes');
+    if ('replay' in claimed) return claimed.replay;
+    const { claim } = claimed;
+    try {
+        const snap = await ref.get();
+        if (!snap.exists) {
+            await claim.release();
+            return ApiErrors.notFound({
+                message: 'No such deal',
+                headers: ctx.headers
+            });
+        }
+        await ref.delete();
+        const view = {
+            id: ref.id,
+            object: 'deal',
+            deleted: true
+        };
+        await claim.record(200, view);
+        return apiJson(view, {
+            headers: ctx.headers
+        });
+    } catch (error) {
+        await claim.release();
+        throw error;
+    }
+}
+/**
+ * `GET /v1/deals` filters, most selective first — the order `listCrm`
+ * indexes them in. `status` is validated against the three values a deal
+ * can hold, because `?status=closed` matching nothing is the plausible empty
+ * page the conventions refuse to serve.
+ */ async function listDeals(ctx, collection, url) {
+    const rawStatus = url.searchParams.get('status');
+    if (rawStatus !== null && rawStatus.trim() !== '' && !DEAL_STATUSES.includes(rawStatus.trim())) {
+        return crmValidationFailed(ctx, 'deal filter', {
+            status: `Must be one of: ${DEAL_STATUSES.join(', ')}`
+        });
+    }
+    const filters = readEqualityFilters(url, [
+        'contactId',
+        'companyId',
+        'pipelineId',
+        'ownerUid',
+        'status'
+    ]);
+    return listCrm(ctx, collection, url, filters, dealView);
+}
+export async function handleDeals(request, ctx, segments, url) {
+    const collection = crmCollection(ctx, CRM_COLLECTIONS.deals);
+    const [, dealId] = segments;
+    if (!dealId) {
+        if (request.method === 'GET') {
+            const denied = requireScope(ctx, 'crm:read');
+            if (denied) return denied;
+            return listDeals(ctx, collection, url);
+        }
+        if (request.method === 'POST') {
+            const denied = requireScope(ctx, 'crm:write');
+            if (denied) return denied;
+            return createDeal(request, ctx);
+        }
+        return ApiErrors.methodNotAllowed({
+            headers: _extends({}, ctx.headers, {
+                Allow: 'GET, POST'
+            })
+        });
+    }
+    const ref = collection.doc(dealId);
+    if (request.method === 'GET') {
+        const denied = requireScope(ctx, 'crm:read');
+        if (denied) return denied;
+        const snap = await ref.get();
+        if (!snap.exists) {
+            return ApiErrors.notFound({
+                message: 'No such deal',
+                headers: ctx.headers
+            });
+        }
+        return apiJson(dealView(snap), {
+            headers: ctx.headers
+        });
+    }
+    if (request.method === 'PATCH') {
+        const denied = requireScope(ctx, 'crm:write');
+        if (denied) return denied;
+        return updateDeal(request, ctx, ref);
+    }
+    if (request.method === 'DELETE') {
+        const denied = requireScope(ctx, 'crm:write');
+        if (denied) return denied;
+        return deleteDeal(request, ctx, ref);
+    }
+    return ApiErrors.methodNotAllowed({
+        headers: _extends({}, ctx.headers, {
+            Allow: 'GET, PATCH, DELETE'
+        })
+    });
+}
+
+//# sourceMappingURL=crm-deals.js.map