Turn every Bland AI post-call result into verified CRM delivery.

import crypto from "node:crypto";

app.use(
  "/bland/post-call",
  express.raw({ type: "application/json" })
);

app.post("/bland/post-call", async (req, res) => {
  const signature = req.headers["x-webhook-signature"];
  const secret = process.env.BLAND_WEBHOOK_SECRET;
  if (
    !secret ||
    typeof signature !== "string" ||
    !/^[0-9a-f]{64}$/i.test(signature)
  ) {
    return res.sendStatus(401);
  }

  const expected = crypto
    .createHmac("sha256", secret)
    .update(req.body)
    .digest("hex");

  const authentic = crypto.timingSafeEqual(
    Buffer.from(signature, "hex"),
    Buffer.from(expected, "hex")
  );
  if (!authentic) return res.sendStatus(401);

  const event = JSON.parse(req.body.toString("utf-8"));
  const lead = {
    name: event.analysis?.name,
    email: event.analysis?.email,
    phone: event.analysis?.phone
  };

  if (event.call_id && lead.name && lead.email) {
    await deliveryQueue.send({ callId: event.call_id, lead });
  }
  return res.sendStatus(204);
});

export async function deliverBlandLead({ callId, lead }) {
  const response = await fetch(
    "https://leadproof.jessesay.chatgpt.site/api/v1/leads",
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.LEADPROOF_API_KEY}`,
        "Content-Type": "application/json",
        "Idempotency-Key": callId
      },
      body: JSON.stringify({
        destination: process.env.CRM_WEBHOOK_URL,
        ...lead,
        source: "bland_ai_post_call"
      })
    }
  );

  if (!response.ok) throw new Error("Lead delivery failed");
  const delivery = await response.json();
  await persistReceipt(callId, delivery.receipt?.id);
}