[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_106":107,"_108":109},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","Tribeca_Rep","name","tribeca-chat","path","main.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":32,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":12,"_13":44},"permalink","https://www.val.town/x/Tribeca_Rep/tribeca-chat/code/main.ts","extension","id","095ee5a5-6d54-4a55-bcee-265f8a164d71","fileId","db056860-a5a4-11f1-8f50-1607ee4eb77e","parentId","branchId","7f3f9c05-d6ad-413b-a869-bc1a5f60764f","branchVersion",691,"latest",true,"createdAt",["D",1788877443517],"version",131,"fileType","http","content","// Tribeca Chat — HTTP entry point\n//\n// Visitor routes are public. Agent routes sit behind AGENT_KEY.\n//\n// TWO VAL TOWN CONSTRAINTS SHAPE THIS WHOLE FILE:\n//\n// 1. Work awaited AFTER a streaming response body completes is torn down\n// silently, with nothing in the logs. That is what broke lead extraction in\n// tribeca-afterhours-chat. So the AI turn is finished and persisted BEFORE\n// the visitor's POST returns, and the SSE stream never owns real work.\n//\n// 2. Requests may be served by different isolates, so an in-memory pub/sub\n// fan-out would deliver to whichever isolate happened to hold the\n// subscriber. The SSE streams therefore poll SQLite against a cursor. It\n// costs a query per second per open chat and is correct regardless of how\n// Val Town schedules isolates — the right trade at this volume.\n\nimport { Hono } from \"npm:hono\";\n// The real logo, stored as a val-scoped blob rather than embedded in source\n// — see the /icon.png route for why (SVG-vs-PNG, and why it is not a\n// giant base64 string sitting in this file).\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport * as db from \"./db.ts\";\nimport { aiReply, anthropicKey, nudgeReply } from \"./agent.ts\";\nimport {\n invoiceStatus,\n lookupByPhone,\n lookupLead,\n offerChatCoupon,\n scanFor35PercentClaim,\n scanForEmail,\n scanForPhone,\n} from \"./salesforce.ts\";\nimport { notifyFirstMessage, notifyHandoff } from \"./notify.ts\";\nimport { WIDGET_JS } from \"./widget.ts\";\nimport { DASHBOARD_HTML } from \"./dashboard.ts\";\nimport { MOBILE_HTML } from \"./mobile.ts\";\nimport { pushAll, SERVICE_WORKER, selfTest, VAPID_PUBLIC_KEY } from \"./push.ts\";\nimport { countryFrom, deviceFrom, optedOut } from \"./context.ts\";\nimport { openingGreeting, pageNudge } from \"./greeting.ts\";\n// Surfaced on /health so a stale shared profile is VISIBLE. Val Town caches\n// remote module imports, so editing tribeca-profile does not by itself change\n// what a running isolate sees — and the failure is silent: the bot keeps\n// quoting last week's prices perfectly confidently.\n// OFFICE_* are used by the callback-details flow at the bottom of this file.\n// Taken from the shared profile rather than typed here, so a changed number or\n// a change of opening hours cannot leave this one path quoting the old ones.\nimport {\n OFFICE_EMAIL,\n OFFICE_HOURS,\n OFFICE_PHONE,\n PROFILE_VERSION,\n} from \"https://esm.town/v/Tribeca_Rep/tribeca-profile/profile.ts?v=2026-09-07d\";\n\nconst app = new Hono();\n\n// The widget runs on tribecabeverage.com and the console may run inside\n// Salesforce, so every API call is cross-origin.\n//\n// The visitor endpoints are open by necessity: a browser on the storefront has\n// no credential to present, and locking them to an Origin header would be\n// theatre — Origin is trivially forged outside a browser. What actually\n// protects them is that they only ever act on the conversation id they are\n// given, and that ids are unguessable. The agent endpoints are the ones that\n// matter, and those check AGENT_KEY.\napp.use(\"*\", async (c, next) => {\n const origin = c.req.header(\"origin\") ?? \"*\";\n\n if (c.req.method === \"OPTIONS\") {\n return new Response(null, {\n status: 204,\n headers: {\n \"Access-Control-Allow-Origin\": origin,\n \"Access-Control-Allow-Methods\": \"GET,POST,OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type,x-agent-key\",\n \"Access-Control-Max-Age\": \"86400\",\n },\n });\n }\n\n await next();\n c.res.headers.set(\"Access-Control-Allow-Origin\", origin);\n c.res.headers.set(\"Vary\", \"Origin\");\n});\n\nconst AGENT_KEY = () => Deno.env.get(\"AGENT_KEY\") ?? \"\";\n\n// How often an open stream checks for new messages. One second reads as\n// instant to a person and keeps the query count sane.\nconst POLL_MS = 1000;\n\n// A stream is closed after this long so an abandoned tab cannot poll forever.\n// The widget reconnects, so the customer never notices.\nconst STREAM_MAX_MS = 5 * 60 * 1000;\n\nfunction agentAuthed(c: any): boolean {\n const key = AGENT_KEY();\n if (!key) return false; // Fail closed: unset key locks the dashboard, not opens it.\n const supplied = c.req.header(\"x-agent-key\") ?? new URL(c.req.url).searchParams.get(\"key\");\n return supplied === key;\n}\n\n/* ------------------------------------------------- per-person sessions */\n\nconst MOBILE_COOKIE = \"tbm\";\nconst MOBILE_DAYS = 30;\n\n/**\n * Length-checked, difference-accumulating compare.\n *\n * `a === b` on a secret returns as soon as two bytes differ, and how long that\n * took is measurable. It is a thin channel and a real one, and the fix costs\n * nothing.\n */\nfunction safeEq(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\n\nfunction readCookie(c: any, name: string): string | null {\n const header = c.req.header(\"cookie\") ?? \"\";\n for (const part of header.split(\";\")) {\n const eq = part.indexOf(\"=\");\n if (eq < 0) continue;\n if (part.slice(0, eq).trim() === name) {\n return decodeURIComponent(part.slice(eq + 1).trim());\n }\n }\n return null;\n}\n\n/**\n * The cookie signing key is DERIVED from AGENT_KEY, not equal to it.\n *\n * One root secret, two purposes, and they must not be interchangeable: a\n * signed cookie should never be usable as a master key, and vice versa. The\n * suffix is what separates them, and it is versioned so the derivation can be\n * changed later without ambiguity.\n */\nasync function cookieKey(): Promise {\n const master = AGENT_KEY();\n if (!master) return null;\n return await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(master + \"|tribeca-mobile-cookie-v1\"),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n}\n\nasync function signSession(tid: string, expires: number): Promise {\n const k = await cookieKey();\n if (!k) return \"\";\n const sig = await crypto.subtle.sign(\n \"HMAC\",\n k,\n new TextEncoder().encode(tid + \".\" + expires),\n );\n return [...new Uint8Array(sig)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/**\n * WHO is making this request — not merely whether they are allowed to.\n *\n * Replaces the old boolean. The distinction is the entire point of per-person\n * tokens: the console can message customers as Tribeca, so \"authorised\" is\n * only half an answer and \"who sent that\" needs the other half.\n *\n * TWO CREDENTIALS, DELIBERATELY:\n *\n * 1. AGENT_KEY — the desktop dashboard and the Salesforce console, which\n * authenticate their users through Salesforce and hold this key server\n * side. Reported as \"Team\", which is what those surfaces already sent.\n * 2. A session cookie — one person, from the phone console.\n *\n * The DB is consulted on every cookie request rather than trusting the\n * signature alone. The signature only proves we issued it; the lookup proves\n * it has not since been revoked, which is what makes revocation immediate\n * instead of taking effect whenever a 30-day cookie happens to lapse.\n */\nasync function whoIsAgent(\n c: any,\n): Promise<{ person: string; tokenId: string | null } | null> {\n const key = AGENT_KEY();\n if (!key) return null; // Fail closed, exactly as before.\n\n const supplied = c.req.header(\"x-agent-key\") ?? new URL(c.req.url).searchParams.get(\"key\");\n if (supplied && safeEq(String(supplied), key)) {\n return { person: \"Team\", tokenId: null };\n }\n\n const raw = readCookie(c, MOBILE_COOKIE);\n if (!raw) return null;\n\n const parts = raw.split(\".\");\n if (parts.length !== 3) return null;\n\n const [tid, expStr, sig] = parts;\n const expires = Number(expStr);\n if (!Number.isFinite(expires) || expires < Date.now()) return null;\n\n const expected = await signSession(tid, expires);\n if (!expected || !safeEq(sig, expected)) return null;\n\n await db.init();\n const tok = await db.agentTokenById(tid);\n if (!tok) return null;\n\n return { person: String(tok[\"person\"]), tokenId: tid };\n}\n\n/* ---------------------------------------------------------------- visitor */\n\napp.post(\"/api/session\", async (c) => {\n await db.init();\n const body = await c.req.json().catch(() => ({}));\n\n // The widget generates and persists this in localStorage, so a returning\n // visitor keeps their history and their Salesforce match.\n const visitorId = String(body.visitorId || db.id(\"v\"));\n\n // Someone signalling Global Privacy Control still gets a working chat; they\n // just do not get a profile built around them.\n const quiet = optedOut(body);\n const device = quiet ? { os: null, browser: null } : deviceFrom(c.req.header(\"user-agent\"));\n\n await db.upsertVisitor({\n id: visitorId,\n name: body.name ?? null,\n email: body.email ?? null,\n phone: body.phone ?? null,\n zip: body.zip ?? null,\n company: body.company ?? null,\n wpUserId: body.wpUserId ?? null,\n pageUrl: body.pageUrl ?? null,\n country: quiet ? null : countryFrom(c.req.raw.headers),\n os: device.os,\n browser: device.browser,\n });\n\n const conversationId = await db.openConversation(visitorId);\n const messages = await db.getMessages(conversationId);\n\n // A known phone or email from WordPress is looked up immediately, so an\n // agent picking up the chat already has the account (or lead) on screen.\n // Awaited deliberately: this response is not streamed, so there is no\n // teardown risk here.\n //\n // EMAIL ALONE NOW QUALIFIES. It used to take a phone to trigger this at\n // all, which meant a signed-in customer known only by email — the WP\n // snippet's whole point — never got checked. That gap is also exactly the\n // popup-lead case: no phone captured there, ever, only an email.\n if (body.phone || body.email) {\n await enrich(visitorId, body.phone ? String(body.phone) : null, body.email ? String(body.email) : null);\n }\n\n // THE OPENER IS BUILT HERE, NOT IN THE WIDGET.\n //\n // It needs the ZIP, and the ZIP may have arrived from somewhere the browser\n // cannot see — a WooCommerce login, an earlier form submission, a checkout —\n // so the stored visitor row is the authority rather than whatever this page\n // happened to post. That read is also what lets a returning visitor be\n // greeted with their own region's price on a page that knows nothing.\n //\n // Both lines are sent every time and are cheap to ignore: the widget only\n // shows the greeting when the thread is empty, and only shows the nudge if\n // the greeting goes unanswered.\n const known = await db.getVisitor(visitorId);\n const zip = known?.[\"zip\"] ?? body.zip ?? null;\n\n // A CONFIRMED SALESFORCE MATCH, not merely a phone number typed in chat —\n // enrich() only sets sf_account once lookupByPhone has actually found an\n // account, so this is never a guess. Decides whether the opener and nudge\n // pitch a sale at someone we already deliver to. See openingGreeting.\n const isCustomer = !!known?.[\"sf_account\"];\n\n // The page matters as well as the ZIP: the glass product page gets its own\n // opener, because someone standing on it has already chosen the subject.\n //\n // The visitor id is passed for the split test. It decides which of the five\n // opener variants this person gets, by a hash rather than a coin toss, so\n // the same visitor sees the same line on every page and cannot be counted\n // under two variants at once.\n const opener = openingGreeting(\n zip,\n body.pageUrl ?? null,\n visitorId,\n isCustomer,\n known?.[\"referrer\"] ?? body.referrer ?? null,\n );\n const greeting = opener.text;\n\n // AN EMPTY THREAD MEANS THE WIDGET IS ABOUT TO DRAW THIS GREETING — that is\n // the exact condition it renders on. Recording it here rather than waiting\n // for the widget to report back means the console can show what a visitor was\n // sent straight away, for everybody, instead of only for browsers that have\n // picked up a new widget.js past its five-minute cache.\n //\n // AND IT IS STORED AS A REAL MESSAGE, which it was not until 9/1/2026.\n //\n // THE BUG THIS FIXES, seen in a live chat: the opener offered 25% off, the\n // visitor answered \"Ok\", and the assistant replied \"Hi there! What can I\n // help you with today?\" — because the opener lived only in the visitor's\n // browser and was never part of the conversation the model was given. From\n // the model's side the transcript was one word, \"Ok\", with nothing to be OK\n // about. The visitor's next line was \"Well that failed\".\n //\n // Writing it here makes the opening line a message like any other: the model\n // sees what was offered, the agent console shows a real thread instead of a\n // greyed-out ghost, and the message counts stop reading zero on\n // conversations that plainly said something.\n let opened = messages;\n if (!messages.length) {\n await db.setShownOpener(visitorId, greeting, opener.variant);\n await db.addMessage(conversationId, \"ai\", greeting);\n // Re-read so the widget renders it from the thread instead of drawing its\n // own copy — otherwise the visitor sees the opener twice.\n opened = await db.getMessages(conversationId);\n }\n\n return c.json({\n visitorId,\n conversationId,\n messages: opened,\n greeting,\n // The variant goes with it so the follow-up does not repeat the opener —\n // on the glass page both were quoting the same three numbers, twenty-five\n // seconds apart, with nobody having spoken in between.\n nudge: pageNudge(\n body.pageUrl ?? null,\n opener.variant,\n isCustomer,\n known?.[\"referrer\"] ?? body.referrer ?? null,\n ),\n });\n});\n\n// A handoff older than this with no agent reply yet gets handed back to the\n// bot on the visitor's next message — see the HANDBACK_MS check below.\nconst HANDBACK_MS = 2 * 60 * 1000;\n\napp.post(\"/api/message\", async (c) => {\n await db.init();\n const { conversationId, body: text, pageUrl } = await c.req.json();\n\n if (!conversationId || !text || !String(text).trim()) {\n return c.json({ error: \"conversationId and body required\" }, 400);\n }\n\n const conv = await db.getConversation(conversationId);\n if (!conv) return c.json({ error: \"unknown conversation\" }, 404);\n\n await db.addMessage(conversationId, \"visitor\", String(text).slice(0, 4000));\n\n let status = String(conv[\"status\"]);\n const visitorId = String(conv[\"visitor_id\"]);\n\n // PAGE_URL, RIGHT NOW, NOT WHENEVER THE NEXT HEARTBEAT HAPPENS TO LAND.\n //\n // Presence pings every 45s, so a visitor who navigates to a product page\n // and types within that window was, until now, quoted off whatever page\n // they were on up to 45 seconds ago — which is exactly how a visitor on\n // the GLASS product page got quoted PLASTIC Pennsylvania pricing on\n // 9/4/2026: the opener and nudge that started the conversation were both\n // generic, meaning page_url was still stale when browsingBlock() ran for\n // the pricing turn. Cheap to fix at the one place it actually matters —\n // the instant before the model is asked anything.\n if (pageUrl) {\n await db.upsertVisitor({ id: visitorId, pageUrl: String(pageUrl) });\n }\n\n // Scan every visitor message for a phone number and resolve it against\n // Salesforce in code. The model is never asked to decide whether to look\n // something up — it only ever receives a verified result as fact. This is\n // the single most important design decision in the project: tawk's agent had\n // the same tool wired and simply never called it.\n const phone = scanForPhone(String(text));\n // AN EMAIL TYPED INTO CHAT IS THE OTHER HALF OF THE POPUP CASE. A visitor\n // who fills out the site's popup and later says \"it's jane@...\" in chat has\n // just handed us the only field that Lead lookup can actually match on.\n const email = scanForEmail(String(text));\n if (phone || email) {\n // Is this the FIRST email we've seen for this visitor? enrich's\n // setVisitorEmail COALESCEs, so visitor.email is whatever we saw first — a\n // null here means this message is introducing it. Checked BEFORE enrich\n // stores it. A signed-in customer (email already known from the widget) or\n // anyone who gave it earlier reads as \"already knew\", so is never re-offered.\n const knewEmail = email ? !!(await db.getVisitor(visitorId))?.email : true;\n await enrich(visitorId, phone, email);\n // New email in chat -> mint a real 25%-off code that expires in 24h and let\n // Salesforce email it (the code, then the reminder + last-call drip). The WP\n // endpoint dedups again on its side, so an existing Lead/customer whose email\n // we happen to meet for the first time in chat still isn't couponed twice.\n // Awaited on purpose: work left running after the response returns is torn\n // down on Val Town, so a fire-and-forget coupon would often never mint.\n if (email && !knewEmail) await offerChatCoupon(email, undefined, scanFor35PercentClaim(String(text)) ? 35 : undefined);\n }\n\n // \"SOMEBODY IS TALKING TO US\", as distinct from \"somebody wants a human\".\n //\n // The handoff alert below only fires when a visitor asks for a person, which\n // is a small fraction of real conversations — so a chat could run start to\n // finish with nobody on the team ever knowing it happened. On the FIRST\n // visitor message only, and only when NOTIFY_EVERY_CHAT is on.\n //\n // Awaited, for the teardown reason at the top of this file: work left running\n // after the response body completes is torn down silently.\n if (await db.visitorMessageCount(conversationId) === 1) {\n await notifyFirstMessage(conversationId, conv, String(text));\n }\n\n // An agent has taken over: the AI must stay silent. Not a prompt\n // instruction — a branch.\n if (status === \"human\" || status === \"closed\") {\n return c.json({ ok: true, ai: false });\n }\n\n // GIVE IT BACK TO THE BOT if a handoff has sat unanswered for HANDBACK_MS.\n //\n // A cron sweep can't reach 2-minute granularity here — Val Town's free-tier\n // floor on interval delays is 15 minutes (see nudge.ts, itself already\n // pinned at that floor), so this can't be a clock-driven check. Instead it\n // runs right here, on the visitor's own next message: if nobody has\n // actually replied since the handoff, silently resume AI handling instead\n // of leaving them parked on \"someone will be right with you\" indefinitely.\n //\n // hasAgentMessage, not merely \"status is still needs_human\" — an agent can\n // be mid-typing a first reply, and this must never yank the conversation\n // back to the bot out from under a human who is actually there.\n if (status === \"needs_human\") {\n const handoffAt = Number(conv[\"handoff_at\"] ?? 0);\n if (handoffAt && Date.now() - handoffAt > HANDBACK_MS && !(await db.hasAgentMessage(conversationId))) {\n await db.setStatus(conversationId, \"ai\");\n status = \"ai\";\n console.log(`handoff timed out with no agent reply, returned to bot: ${conversationId}`);\n }\n }\n\n if (status === \"needs_human\" || wantsHuman(String(text))) {\n if (status !== \"needs_human\") {\n await db.setStatus(conversationId, \"needs_human\");\n\n // ASK FOR A NAME AND A NUMBER, rather than saying \"connecting you\" and\n // going quiet.\n //\n // \"Connecting you with someone from the team\" is a promise the system\n // cannot keep on its own: nobody is guaranteed to be watching the\n // console, and out of hours nobody is. The customer sat there waiting\n // for a person who was not coming, and when they gave up we had nothing\n // — no name, no number, no way to win it back. A callback number turns\n // the worst case from a lost conversation into a lead.\n //\n // Skipped entirely when we already know both, which is the case for any\n // signed-in customer. Asking a customer for their own phone number is\n // how a system tells someone it does not know who they are.\n const v = await db.getVisitor(visitorId);\n await db.addMessage(conversationId, \"system\", handoffLine(v));\n\n // Awaited before returning, for the teardown reason at the top of this\n // file. A dropped handoff notification is a customer left waiting with\n // nobody aware of it — the worst failure this system can have.\n await notifyHandoff(conversationId, await db.getConversation(conversationId));\n return c.json({ ok: true, ai: false, handoff: true });\n }\n\n // ALREADY WAITING FOR A PERSON. The model stays out of it — they asked for\n // a human and carrying on selling at them would be the system ignoring what\n // it was just told. The only job left is taking the details.\n const collected = await takeContactDetails(conversationId, visitorId, String(text));\n return c.json({ ok: true, ai: false, handoff: true, collected });\n }\n\n const visitor = await db.getVisitor(visitorId);\n const history = await db.getMessages(conversationId);\n\n // Billing facts are fetched in code, like the account lookup — the model is\n // never asked to decide whether to check a balance. `wp_user_id` is the only\n // thing that counts as authentication here: it means WordPress verified a\n // session. A phone number the visitor typed does not, which is why the pay\n // link is withheld unless this is set.\n let invoice = null;\n if (visitor?.[\"phone\"]) {\n invoice = await invoiceStatus(\n String(visitor[\"phone\"]),\n !!visitor[\"wp_user_id\"],\n );\n }\n\n const replyStartedAt = Date.now();\n const reply = await aiReply(history, visitor, invoice, String(conversationId));\n\n // A SHORT REPLY THAT ARRIVES INSTANTLY READS AS A BOT. A person composing\n // \"sure, got it!\" still takes a beat even though it's four words; a real\n // paragraph takes longer than that. This only ever ADDS wait on top of\n // whatever the model already took, and it sits BEFORE the status re-check\n // below so an interruption during the pause is still caught fresh, exactly\n // like an un-padded reply always was.\n //\n // RAISED FROM A 2500ms CAP ON 9/4/2026 — flagged live as still reading too\n // fast for a longer message once the office was actually watching it. The\n // old cap meant a 250-character price breakdown and a 600-character one\n // waited the identical 2.5s, so length stopped mattering exactly where it\n // is most noticeable. 4000ms leaves real margin under the widget's 6-second\n // failure timeout even on a slow model call — the two numbers are not close\n // enough to trade against each other.\n //\n // ALL THREE NUMBERS SCALED 1.2x ON 9/5/2026, at the owner's request for a\n // slower-reading pace — floor, ceiling and per-character rate together, so\n // the shape of the curve (short replies hit the floor, long ones hit the\n // ceiling) is unchanged, just uniformly slower. The ceiling now leaves\n // 1200ms of margin under the widget's 6-second timeout instead of 2000ms —\n // still real margin, just worth re-checking if that timeout ever moves.\n if (reply) {\n const elapsed = Date.now() - replyStartedAt;\n const target = Math.min(4800, Math.max(480, reply.length * 19.2));\n if (elapsed < target) {\n await new Promise((r) => setTimeout(r, target - elapsed));\n }\n }\n\n // RE-READ THE STATUS. The check at the top of this handler is now several\n // seconds stale, and those seconds are exactly when a person is most likely\n // to step in — they step in BECAUSE they saw the customer's message.\n //\n // On 9/2/2026 this cost a real order: a visitor confirmed at 06:57:22, the\n // office corrected the product 215ms later, and the model — already thinking\n // — posted \"Everything's saved on my end\" 6.7 seconds after that, over the\n // top of a colleague who was mid-correction. The branch above was right and\n // simply ran too early to see it.\n const still = await db.getConversation(conversationId);\n const nowStatus = still ? String(still[\"status\"]) : status;\n if (nowStatus === \"human\" || nowStatus === \"closed\") {\n console.log(`AI reply DISCARDED — ${nowStatus} took over mid-turn ${conversationId}`);\n return c.json({ ok: true, ai: false, superseded: true });\n }\n if (reply) {\n await db.addMessage(conversationId, \"ai\", reply);\n return c.json({ ok: true, ai: true });\n }\n\n // THE MODEL PRODUCED NOTHING. Say so here rather than letting the widget\n // discover it by timing out: it waits six seconds before apologising, which\n // is six seconds of a visitor watching a typing indicator that will never\n // resolve. Written as a real message so it also lands in the transcript the\n // agent console shows — a failed turn the team can see is very different\n // from one only the customer experienced.\n await db.addMessage(\n conversationId,\n \"system\",\n \"Sorry — I couldn't put that together. Try rephrasing, or say you'd like to \"\n + \"talk to someone and I'll bring in the team.\",\n );\n return c.json({ ok: true, ai: false });\n});\n\n/**\n * Presence heartbeat. Runs on every page view, not just when the chat opens.\n *\n * Deliberately the cheapest endpoint here: one UPDATE, and two small reads only\n * when a conversation already exists. It is called far more often than anything\n * else, by people who may never chat at all.\n *\n * The response is what makes agent-initiated chat work: if someone from the\n * team has spoken to this visitor, the widget is told to open itself.\n */\napp.post(\"/api/presence\", async (c) => {\n await db.init();\n const body = await c.req.json().catch(() => ({}));\n const pageUrl = body.pageUrl ? String(body.pageUrl) : null;\n\n // No visitor id yet means a first page view. Create the record now rather\n // than waiting for a chat, otherwise nobody appears on the monitoring\n // screen until they decide to talk — which is the entire point of it.\n // Location and device are read off the request that is already arriving. The\n // IP that country is derived from is Cloudflare's to know — we never see a\n // need for it, never store it, and never send it anywhere. See context.ts.\n const quiet = optedOut(body);\n const country = quiet ? null : countryFrom(c.req.raw.headers);\n const device = quiet ? { os: null, browser: null } : deviceFrom(c.req.header(\"user-agent\"));\n\n let visitorId = body.visitorId ? String(body.visitorId) : null;\n\n // A BROWSER CAN HOLD AN ID WHOSE ROW NO LONGER EXISTS.\n //\n // The 90-day purge deletes visitor rows; nothing clears localStorage. Before\n // this check, such a browser sent its dead id on every page view forever,\n // recordPresence bailed out on the missing row, and that person was\n // invisible on the monitoring screen — permanently, and silently. Only\n // presence was affected, because /api/session upserts unconditionally, so\n // they reappeared the moment they opened the chat. Which is precisely the\n // case nobody would ever notice was broken.\n //\n // THE SUPPLIED ID IS REUSED, NOT REPLACED, and that is not a stylistic\n // choice: the widget adopts an id from this response only when it has none\n // of its own, so minting a fresh one here would be ignored and the browser\n // would go on sending the old one for good.\n const known = visitorId ? await db.getVisitor(visitorId) : null;\n\n if (!visitorId || !known) {\n visitorId = visitorId ?? db.id(\"v\");\n await db.upsertVisitor({\n id: visitorId,\n name: body.name ?? null,\n email: body.email ?? null,\n phone: body.phone ?? null,\n zip: body.zip ?? null,\n company: body.company ?? null,\n wpUserId: body.wpUserId ?? null,\n pageUrl,\n country,\n os: device.os,\n browser: device.browser,\n });\n }\n\n // Runs for a brand-new visitor too: referrer and landing_url are still null\n // on the row we just inserted, so COALESCE fills them from this first ping.\n await db.recordPresence(\n visitorId,\n pageUrl,\n body.referrer ? String(body.referrer).slice(0, 500) : null,\n {\n country,\n os: device.os,\n browser: device.browser,\n optedOut: quiet,\n // Reported by the widget. chatOpen is the panel state right now;\n // shownOpener/shownNudge are the lines it drew in the browser and never\n // sent here as messages, so without this the console shows an empty\n // thread for a visitor who has been spoken to twice.\n chatOpen: body.chatOpen === true,\n // Lives in the visitor's localStorage and nowhere else, so this ping is\n // the only way the console ever learns that somebody closed the chat on\n // us rather than us failing to reach them.\n chatDismissed: body.dismissed === true,\n // Whether the page they are on is WordPress's 404. Only the widget can\n // know this — it reads the error404 body class from inside the page.\n // Left undefined when an older widget build does not send it, so the\n // column stays NULL rather than recording a confident \"no\".\n notFound: typeof body.notFound === \"boolean\" ? body.notFound : undefined,\n // Which chat this visitor was actually shown, in split mode. Reported by\n // the widget from the arm the site assigned it, and reported from BOTH\n // arms — the tawk half runs our widget invisibly, which is the only\n // reason the two can be compared at all.\n arm: body.arm === \"ours\" || body.arm === \"tawk\" ? body.arm : null,\n shownOpener: body.shownOpener ? String(body.shownOpener).slice(0, 1000) : null,\n shownNudge: body.shownNudge ? String(body.shownNudge).slice(0, 1000) : null,\n },\n );\n\n // THE TRAIL, recorded here because this is where a page change is first\n // visible to us. recordPresence overwrites page_url, so a moment later the\n // previous page is simply gone — if it is not written now it is never\n // written at all.\n //\n // AGENT-ONLY DATA. It goes to visitor_events, never to messages, so there is\n // no code path that could put a visitor's own browsing on their screen.\n // Skipped entirely for anyone signalling Do Not Track, on the same principle\n // as the rest of the profiling in this file.\n if (!quiet && pageUrl) {\n // `known` IS THE STATE BEFORE THIS PING, and it has to be — the upsert\n // above has already run, so re-reading the row here would show the new\n // page and make every visitor look like a returning one. That is exactly\n // what happened on the first attempt: \"arrived\" never fired once, because\n // by the time it was checked the visitor always existed.\n const wasOn = known ? String(known[\"page_url\"] ?? \"\") : \"\";\n\n if (!known) {\n await db.recordEvent(visitorId!, \"arrived\", pageUrl);\n } else if (wasOn && wasOn !== pageUrl) {\n await db.recordEvent(visitorId!, \"page\", pageUrl);\n }\n\n // The events that are worth interrupting a conversation for. Each is\n // recorded only on the TRANSITION — recordEvent dedupes against the last\n // row of the same kind, so a steady state does not repeat.\n if (body.notFound === true) await db.recordEvent(visitorId!, \"notfound\", pageUrl);\n if (body.dismissed === true && !(known && Number(known[\"chat_dismissed\"]))) {\n await db.recordEvent(visitorId!, \"closed_chat\", null);\n }\n }\n\n // Retention runs off the back of the busiest endpoint rather than a cron.\n // It self-throttles to once a day and returns immediately otherwise, so this\n // costs one indexed read on a normal page view.\n db.purgeStaleVisitors().catch(() => {});\n\n const conversationId = await db.findOpenConversation(visitorId);\n const invited = conversationId ? await db.hasAgentMessage(conversationId) : false;\n\n return c.json({ visitorId, conversationId, invited });\n});\n\n/**\n * The page-specific follow-up, recorded once the widget has actually drawn it.\n *\n * SAME BUG AS THE OPENER, one step later. The nudge is timed in the browser,\n * so it was never in the transcript either — a visitor who ignored the opener,\n * read the nudge and then replied to THAT was answered by a model that had\n * seen neither line.\n *\n * THE BODY IS NOT TRUSTED. This endpoint takes no text: it recomputes the\n * nudge for the conversation's own page and stores that. The caller can only\n * decide WHEN a line it was already given gets recorded, never what it says.\n * An open endpoint that appended arbitrary text as the assistant would let\n * anybody put words in the company's mouth in front of an agent.\n */\napp.post(\"/api/shown-nudge\", async (c) => {\n await db.init();\n const { conversationId } = await c.req.json().catch(() => ({}));\n if (!conversationId) return c.json({ error: \"conversationId required\" }, 400);\n\n const conv = await db.getConversation(String(conversationId));\n if (!conv) return c.json({ error: \"unknown conversation\" }, 404);\n\n // Only ever on a bot-run conversation, and only when we are still the last\n // one to have spoken. If the visitor has since replied, the moment for a\n // follow-up has passed and recording it would put it out of order.\n if (String(conv[\"status\"]) !== \"ai\") return c.json({ ok: true, stored: false });\n\n const history = await db.getMessages(String(conversationId));\n if (history.some((m: any) => m[\"sender\"] === \"visitor\")) {\n return c.json({ ok: true, stored: false });\n }\n\n // Same variant the opener used, read back off the visitor row rather than\n // trusted from the caller — otherwise this recomputes a nudge that may repeat\n // the opening line the visitor is looking at. sf_account travels with it for\n // the same reason: a customer's opener carried no pitch, so the follow-up\n // must not introduce one either.\n const text = pageNudge(\n conv[\"page_url\"] ?? null,\n conv[\"opener_variant\"] ?? null,\n !!conv[\"sf_account\"],\n conv[\"referrer\"] ?? null,\n );\n if (!text) return c.json({ ok: true, stored: false });\n\n // Once. A reload must not append it again.\n if (history.some((m: any) => String(m[\"body\"]) === text)) {\n return c.json({ ok: true, stored: false });\n }\n\n await db.addMessage(String(conversationId), \"ai\", text);\n return c.json({ ok: true, stored: true });\n});\n\n/**\n * \"This page is going away\" — a pagehide beacon from the widget.\n *\n * WHY IT EXISTS. Until now the console could only infer departure from silence,\n * and silence is also what a locked phone, a switched tab and a throttled timer\n * look like. A visitor who closed the site and one who is still reading with a\n * missed heartbeat were the same row for a minute and a half. This is the one\n * moment a browser will volunteer that it is going, so it is worth taking.\n *\n * IT IS A HINT, NOT A FACT, and everything downstream treats it that way:\n * pagehide also fires on an ordinary click through to the next page and on iOS\n * when a tab is merely backgrounded. The next presence ping clears it, and the\n * console holds off for a few seconds before showing anything, so navigating\n * around the site never flashes up as leaving.\n *\n * SENT BY sendBeacon, which means text/plain and no cookies, and it is READ\n * accordingly — c.req.json() would reject the content type and throw away the\n * body. It also means the response is ignored by the browser, so this returns\n * 204 and does no work worth waiting for.\n */\napp.post(\"/api/gone\", async (c) => {\n await db.init();\n\n let visitorId: string | null = null;\n try {\n const raw = await c.req.text();\n visitorId = raw ? (JSON.parse(raw)?.visitorId ?? null) : null;\n } catch (_e) {\n // A malformed beacon from a page being torn down is not worth a log line.\n }\n\n if (visitorId) await db.markLeft(String(visitorId));\n return c.body(null, 204);\n});\n\n/**\n * Details a visitor VOLUNTEERED through a form on the website.\n *\n * This is the best identification we get: first-party, consented, and typed by\n * the person themselves — not inferred from anything. It is also precisely what\n * tawk could not use, since tawk refused to render attributes for a visitor it\n * considered unidentified.\n *\n * SEPARATE FROM /api/session ON PURPOSE. That endpoint opens a conversation,\n * which would put an empty thread in the agent queue for every form submission\n * on the site. This only enriches the visitor record.\n *\n * Purpose limit: someone filling in a quote form volunteered contact details in\n * order to BE CONTACTED. Using them to greet that person in chat is inside that\n * purpose. This endpoint does not backfill anything else.\n */\napp.post(\"/api/identify\", async (c) => {\n await db.init();\n const body = await c.req.json().catch(() => ({}));\n\n const visitorId = body.visitorId ? String(body.visitorId) : null;\n if (!visitorId) {\n console.warn(\"identify REJECTED: no visitorId\");\n return c.json({ error: \"visitorId required\" }, 400);\n }\n\n // Only enrich a visitor we already know. Creating one here would let any\n // caller mint records by posting arbitrary ids.\n const existing = await db.getVisitor(visitorId);\n if (!existing) {\n console.warn(`identify REJECTED: unknown visitor ${visitorId}`);\n return c.json({ error: \"unknown visitor\" }, 404);\n }\n\n // LOGGED BECAUSE SILENCE HERE IS AMBIGUOUS. Ten checkout visitors arrived\n // with nothing identified, and \"the WordPress snippet never called\" looks\n // exactly like \"it called and the call failed\". One line makes them\n // different. Fields only — never the values.\n console.log(\n `identify ${visitorId} from ${String(body.pageUrl ?? \"?\").slice(0, 80)}`\n + ` fields=[${[\"name\", \"email\", \"phone\", \"zip\", \"company\"].filter((k) => body[k]).join(\",\")}]`,\n );\n\n const clip = (v: unknown) => {\n const s = String(v ?? \"\").trim();\n return s ? s.slice(0, 200) : null;\n };\n\n // upsertVisitor COALESCEs, so this fills gaps and never overwrites something\n // already established — a WordPress-verified phone survives a typo in a form.\n await db.upsertVisitor({\n id: visitorId,\n name: clip(body.name),\n email: clip(body.email),\n phone: clip(body.phone),\n zip: clip(body.zip),\n company: clip(body.company),\n pageUrl: body.pageUrl ? String(body.pageUrl) : String(existing[\"page_url\"] ?? \"\"),\n });\n\n // THE ORDER ITSELF, not merely who placed it.\n //\n // The checkout snippet has always known both and reported only the person,\n // which left the tawk-vs-ours split measurable in conversations opened and\n // messages typed — engagement, none of which is money. Two chat widgets can\n // only be compared honestly on what they sold.\n //\n // The VALUE IS NOT TRUSTED. This endpoint is public, and one absurd number\n // would quietly poison the revenue figure for a whole arm and make the losing\n // widget look like the winner. An implausible total is stored as null while\n // the order still counts, so a bad amount costs the revenue column and never\n // the order count.\n const orderId = clip(body.orderId);\n if (orderId) {\n const n = Number(body.orderTotal);\n const ok = Number.isFinite(n) && n > 0 && n < 100000;\n await db.setVisitorOrder(visitorId, orderId, ok ? Math.round(n * 100) / 100 : null);\n console.log(`order ${orderId} -> ${visitorId}${ok ? ` ${n}` : \" (value rejected)\"}`);\n\n // THE MOMENT IT HAPPENED, on the conversation timeline.\n //\n // The visitor row already recorded THAT they ordered; this records WHEN,\n // in among what was being said at the time. Somebody buying halfway\n // through a chat is the most important thing that can happen in one, and\n // until now it was invisible in the thread — an agent could be mid-answer\n // about pricing to a person who had already paid.\n //\n // GUARDED ON existing.order_id, to match setVisitorOrder's COALESCE\n // exactly: that keeps the FIRST order and ignores later ones, so logging\n // an event for a second order would put a line in the timeline that\n // contradicts the row above it. recordEvent's own dedupe is not enough\n // here — it only compares against the immediately preceding event, and a\n // repeat order weeks later would have pages in between.\n if (!existing[\"order_id\"]) {\n await db.recordEvent(\n visitorId,\n \"ordered\",\n // The rejected-value case deliberately still records the order, for\n // the same reason it is stored: a bad amount must cost the revenue\n // figure, never the fact that somebody bought.\n // CONCATENATED, NOT INTERPOLATED. A literal \"$\" immediately before a\n // ${...} inside a template literal is one editing slip from vanishing,\n // and it vanished here on the first write — the amount would have\n // rendered as \"134.98\" with no currency symbol. greeting.ts carries the\n // same warning for the same reason.\n ok\n ? \"#\" + orderId + \" · $\" + (Math.round(n * 100) / 100).toFixed(2)\n : \"#\" + orderId,\n );\n }\n }\n\n // A volunteered phone is worth resolving immediately, so an agent opening the\n // conversation already has the account on screen rather than waiting for the\n // customer to repeat a number they have just typed once.\n const phone = clip(body.phone);\n if (phone) await enrich(visitorId, phone);\n\n return c.json({ ok: true });\n});\n\n/**\n * \"They have gone quiet\" — reported by the widget, decided by the server.\n *\n * The 15-minute interval sweep in nudge.ts is a backstop, not the mechanism.\n * Free-tier intervals cannot run more often than that, so a sweep alone would\n * deliver \"still there?\" up to eighteen minutes late, to someone who has long\n * since closed the tab. The widget knows the thing the server cannot: whether\n * this person is STILL ON THE PAGE, right now, having stopped typing.\n *\n * The caller is not trusted with the decision, only with the timing. Every\n * guard — engaged, we spoke last, still on the bot, not already nudged, not\n * already ordered — is re-applied here through the same query the sweep uses,\n * so a forged call can at most trigger a nudge this conversation had already\n * earned.\n */\napp.post(\"/api/nudge\", async (c) => {\n await db.init();\n const { conversationId } = await c.req.json().catch(() => ({}));\n if (!conversationId) return c.json({ error: \"conversationId required\" }, 400);\n\n // Idle floor of 0: the widget has already timed it, and re-imposing a floor\n // here would just fight its clock. The CEILING still applies, because a tab\n // rediscovered after an hour should not get a message about it.\n const eligible = await db.listNudgeCandidates(0, 30 * 60 * 1000, 50);\n const row: any = eligible.find((r: any) => String(r[\"id\"]) === String(conversationId));\n if (!row) return c.json({ ok: true, nudged: false });\n\n // Which pick-up this is, taken from the row the query already returned.\n // Round two is the softer one — see nudgeReply.\n const round = Number(row[\"nudge_count\"] ?? 0) + 1;\n\n await db.markNudged(String(conversationId));\n\n const conv = await db.getConversation(String(conversationId));\n if (!conv || String(conv[\"status\"]) !== \"ai\") return c.json({ ok: true, nudged: false });\n\n const history = await db.getMessages(String(conversationId));\n const visitor = await db.getVisitor(String(conv[\"visitor_id\"]));\n const text = await nudgeReply(history, visitor, round);\n if (!text) return c.json({ ok: true, nudged: false });\n\n await db.addMessage(String(conversationId), \"ai\", text);\n console.log(`nudged ${conversationId}: ${text}`);\n return c.json({ ok: true, nudged: true });\n});\n\n/**\n * Visitor has live keystrokes in the textarea, right now — nothing else.\n * Fired on a throttle from the widget, not per keystroke, and read by the\n * consoles as stale (so: not-typing) after a few seconds with no repeat\n * call. No message body is ever accepted here; there is nowhere in this\n * handler a draft's text could even be passed.\n */\napp.post(\"/api/typing\", async (c) => {\n await db.init();\n const { conversationId } = await c.req.json().catch(() => ({}));\n if (!conversationId) return c.json({ error: \"conversationId required\" }, 400);\n const conv = await db.getConversation(String(conversationId));\n if (!conv) return c.json({ ok: true, recorded: false }, 200);\n await db.setTyping(String(conversationId));\n return c.json({ ok: true, recorded: true });\n});\n\n/** Visitor-initiated handoff, from a button rather than a phrase. */\napp.post(\"/api/handoff\", async (c) => {\n await db.init();\n const { conversationId } = await c.req.json();\n const conv = await db.getConversation(conversationId);\n if (!conv) return c.json({ error: \"unknown conversation\" }, 404);\n\n if (String(conv[\"status\"]) === \"ai\") {\n await db.setStatus(conversationId, \"needs_human\");\n await db.addMessage(conversationId, \"system\", \"Connecting you with someone from the team.\");\n await notifyHandoff(conversationId, await db.getConversation(conversationId));\n }\n return c.json({ ok: true });\n});\n\n/* ----------------------------------------------------------------- streams */\n\nfunction sseStream(load: (since: number) => Promise, since0: number) {\n let since = since0;\n const started = Date.now();\n const enc = new TextEncoder();\n\n return new ReadableStream({\n async pull(controller) {\n if (Date.now() - started > STREAM_MAX_MS) {\n controller.close();\n return;\n }\n\n await new Promise((r) => setTimeout(r, POLL_MS));\n\n try {\n const rows = await load(since);\n for (const row of rows) {\n const created = Number(row[\"created_at\"] ?? row[4] ?? 0);\n if (created > since) since = created;\n controller.enqueue(enc.encode(`data: ${JSON.stringify(row)}\\n\\n`));\n }\n // Comment frame doubles as a keep-alive; proxies drop idle connections.\n controller.enqueue(enc.encode(`: ping\\n\\n`));\n } catch (_e) {\n // A transient query failure must not kill the stream — the widget\n // would reconnect anyway, but silently riding it out is smoother.\n controller.enqueue(enc.encode(`: err\\n\\n`));\n }\n },\n });\n}\n\nconst SSE_HEADERS = {\n \"Content-Type\": \"text/event-stream\",\n \"Cache-Control\": \"no-cache\",\n \"Connection\": \"keep-alive\",\n};\n\napp.get(\"/api/stream\", async (c) => {\n await db.init();\n const cid = c.req.query(\"c\");\n const since = Number(c.req.query(\"since\") ?? 0);\n if (!cid) return c.json({ error: \"c required\" }, 400);\n\n return new Response(\n sseStream((s) => db.getMessages(cid, s), since),\n { headers: SSE_HEADERS },\n );\n});\n\n/* ------------------------------------------------------------------ agent */\n\napp.get(\"/api/agent/conversations\", async (c) => {\n const who = await whoIsAgent(c);\n if (!who) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n // since/includeClosed/limit are all optional and default to the original\n // behavior — the Conversations tab calls this with none of them and gets\n // exactly what it always got. The Engaged tab is the one that passes them,\n // for a real 24-hour window that includes threads an agent has since closed.\n const since = Number(c.req.query(\"since\") ?? 0);\n const includeClosed = c.req.query(\"includeClosed\") === \"1\";\n const limit = Number(c.req.query(\"limit\") ?? 50);\n return c.json({ conversations: await db.listConversations({ since, includeClosed, limit }) });\n});\n\napp.get(\"/api/agent/messages\", async (c) => {\n const who = await whoIsAgent(c);\n if (!who) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n const cid = c.req.query(\"c\");\n if (!cid) return c.json({ error: \"c required\" }, 400);\n const conversation = await db.getConversation(cid);\n\n // THE ONLY ENDPOINT THAT RETURNS EVENTS, and it sits behind whoIsAgent above.\n // Nothing on the visitor side reads this route, so a customer has no way to\n // receive their own browsing trail — see the visitor_events table comment.\n return c.json({\n conversation,\n messages: await db.getMessages(cid),\n events: conversation\n ? await db.getEvents(String(conversation[\"visitor_id\"]))\n : [],\n });\n});\n\n/** Who is on the site right now. */\napp.get(\"/api/agent/visitors\", async (c) => {\n const who = await whoIsAgent(c);\n if (!who) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n\n // FOUR times the widget's 45-second heartbeat, not two.\n //\n // Two was too tight and it was measurably hiding people: at 90s the console\n // listed 3 visitors when 8 had pinged within three minutes and 11 within\n // five. The gaps tell the story — they cluster at 1s, 9s, 49s and then jump\n // straight to 133s+, with almost nothing in between, because a single missed\n // ping puts someone the far side of the line. Mobile browsers throttle timers\n // in the background constantly, so missing one is normal rather than a sign\n // the visitor has gone.\n //\n // The cost of being generous here is asymmetric. Showing someone who left a\n // minute ago wastes a glance; hiding someone who is still reading loses the\n // conversation the console exists to start. The list marks how long each has\n // been idle so nobody is mistaken for live.\n const window = 3 * 60 * 1000;\n return c.json({ visitors: await db.listActiveVisitors(Date.now() - window) });\n});\n\n/**\n * The tawk half, reporting what it did.\n *\n * WITHOUT THIS THE SPLIT IS HALF-BLIND. This database would know how many\n * people were offered tawk and nothing about whether they used it, so the tawk\n * arm's engagement would read zero forever and the two arms could never be\n * compared on the same measure.\n *\n * Only two events are accepted, and neither carries any content: whether a\n * chat window opened, and whether the visitor typed at least once. What was\n * said stays in tawk — this is a counter, not a transcript.\n *\n * Unauthenticated by necessity (it is a browser on the storefront) and\n * harmless if forged: the worst a fabricated call does is mark one visitor as\n * having engaged, which nudges a rate nobody bills on.\n */\napp.post(\"/api/tawk-event\", async (c) => {\n await db.init();\n const body = await c.req.json().catch(() => ({}));\n\n const visitorId = body.visitorId ? String(body.visitorId) : null;\n const event = body.event === \"messaged\" ? \"messaged\" : body.event === \"opened\" ? \"opened\" : null;\n if (!visitorId || !event) return c.json({ error: \"visitorId and event required\" }, 400);\n\n // Only ever annotate a visitor we already know. Creating one here would let\n // any caller mint rows by posting arbitrary ids.\n const known = await db.getVisitor(visitorId);\n if (!known) return c.json({ ok: true, recorded: false }, 200);\n\n await db.markTawkEvent(visitorId, event);\n return c.json({ ok: true, recorded: true });\n});\n\n/** Which chat won: visitors offered each, and how many of ours talked. */\napp.get(\"/api/agent/arms\", async (c) => {\n const who = await whoIsAgent(c);\n if (!who) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n const days = Number(c.req.query(\"days\") ?? 7);\n const since = Date.now() - (Number.isFinite(days) ? days : 7) * 24 * 60 * 60 * 1000;\n return c.json({ since, arms: await db.armReport(since) });\n});\n\n/**\n * Opener split test scoreboard: shown, replied, reply rate, per variant.\n *\n * ?days=N limits it to the last N days, default 30. The floor is not\n * decoration — every visitor greeted before the test started carries a null\n * variant, and a large \"(pre-test)\" row at the top of the table is exactly the\n * sort of number that gets quoted as a result.\n */\napp.get(\"/api/agent/openers\", async (c) => {\n const who = await whoIsAgent(c);\n if (!who) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n const days = Number(c.req.query(\"days\") ?? 30);\n const since = Date.now() - (Number.isFinite(days) ? days : 30) * 24 * 60 * 60 * 1000;\n return c.json({ since, variants: await db.openerReport(since) });\n});\n\n/**\n * Funnel past \"did they reply\": shown -> replied -> region confirmed ->\n * quoted -> signed up. See the long comment on db.funnelReport() for what\n * each stage actually detects (text-pattern proxies, not tracked stages) and\n * why every stage past \"replied\" requires the visitor to have said something\n * first. ?days=N limits it to the last N days, default 30.\n */\napp.get(\"/api/agent/funnel\", async (c) => {\n const who = await whoIsAgent(c);\n if (!who) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n const days = Number(c.req.query(\"days\") ?? 30);\n const since = Date.now() - (Number.isFinite(days) ? days : 30) * 24 * 60 * 60 * 1000;\n return c.json({ since, funnel: await db.funnelReport(since) });\n});\n\n/**\n * Anthropic spend so far this calendar month (UTC), for the mobile console's\n * header bar.\n *\n * Uses ANTHROPIC_ADMIN_KEY, an organization-scoped Admin API key created\n * 9/4/2026 specifically for this — the regular ANTHROPIC_API_KEY this val\n * sends chat completions with is workspace-scoped and the Admin API rejects\n * it outright (401 \"requires an Admin API key or an organization-scoped API\n * key\", confirmed live). There is no API for the prepaid credit balance\n * itself (the Console's \"$X credits\" figure) — only usage/cost, which is\n * what this reports.\n *\n * `amount` in the Cost API is a decimal STRING in cents (its own docs example\n * \"123.45\" = $1.23), so every result across every bucket is summed then\n * divided by 100 rather than trusted as dollars.\n */\napp.get(\"/api/agent/spend\", async (c) => {\n const who = await whoIsAgent(c);\n if (!who) return c.json({ error: \"unauthorized\" }, 401);\n const key = Deno.env.get(\"ANTHROPIC_ADMIN_KEY\");\n if (!key) return c.json({ error: \"not configured\" }, 501);\n const now = new Date();\n const monthStart = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));\n const url = \"https://api.anthropic.com/v1/organizations/cost_report\"\n + `?starting_at=${monthStart.toISOString()}&ending_at=${now.toISOString()}&limit=31`;\n let res: Response;\n try {\n res = await fetch(url, {\n headers: { \"anthropic-version\": \"2023-06-01\", \"x-api-key\": key },\n signal: AbortSignal.timeout(8000),\n });\n } catch (e) {\n console.error(\"cost_report fetch failed:\", e);\n return c.json({ error: \"unavailable\" }, 502);\n }\n if (!res.ok) {\n console.error(\"cost_report HTTP\", res.status, (await res.text()).slice(0, 300));\n return c.json({ error: \"unavailable\" }, 502);\n }\n const body = await res.json().catch(() => null);\n let cents = 0;\n for (const bucket of body?.data ?? []) {\n for (const r of bucket?.results ?? []) {\n cents += Number(r?.amount) || 0;\n }\n }\n return c.json({ spendUsd: Math.round(cents) / 100, since: monthStart.toISOString() });\n});\n\n/**\n * Start a conversation with a visitor who has not asked for one.\n *\n * This is the reason presence tracking earns its keep. Watching a list of\n * anonymous sessions is not useful; opening with \"want a hand?\" to someone who\n * has been on the pricing page for four minutes is.\n *\n * Goes straight to 'human' — the AI must not pick up a conversation a person\n * deliberately started.\n */\napp.post(\"/api/agent/invite\", async (c) => {\n const who = await whoIsAgent(c);\n if (!who) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n\n const { visitorId, body, agent } = await c.req.json();\n if (!visitorId || !body || !String(body).trim()) {\n return c.json({ error: \"visitorId and body required\" }, 400);\n }\n\n const visitor = await db.getVisitor(String(visitorId));\n if (!visitor) return c.json({ error: \"unknown visitor\" }, 404);\n\n // Same rule as /reply: a token names its own holder and nobody else.\n const signer = who.tokenId ? who.person : (agent ?? who.person);\n\n const conversationId = await db.openConversation(String(visitorId));\n await db.setStatus(conversationId, \"human\", signer);\n await db.addMessage(conversationId, \"agent\", String(body).slice(0, 4000), signer);\n if (who.tokenId) await db.touchAgentToken(who.tokenId);\n\n return c.json({ ok: true, conversationId });\n});\n\napp.post(\"/api/agent/claim\", async (c) => {\n const who = await whoIsAgent(c);\n if (!who) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n const { conversationId, agent } = await c.req.json();\n const signer = who.tokenId ? who.person : (agent ?? who.person);\n\n await db.setStatus(conversationId, \"human\", signer);\n await db.addMessage(\n conversationId,\n \"system\",\n `${signer} has joined the conversation.`,\n );\n if (who.tokenId) await db.touchAgentToken(who.tokenId);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/agent/reply\", async (c) => {\n const who = await whoIsAgent(c);\n if (!who) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n const { conversationId, body, agent } = await c.req.json();\n if (!conversationId || !body) return c.json({ error: \"conversationId and body required\" }, 400);\n\n // WHOSE NAME GOES ON THIS, decided here rather than by the caller.\n //\n // A token holder gets their own name and cannot claim another — the whole\n // reason for per-person credentials is that \"who sent that\" has an answer,\n // and an answer the sender can edit is not one. The master key keeps the\n // supplied name, because the surfaces that hold it (the Salesforce console,\n // the desktop dashboard) have already authenticated a real person through\n // Salesforce and are reporting who that is.\n const signer = who.tokenId ? who.person : (agent ?? who.person);\n\n // Replying implies taking over. Requiring a separate Claim click is the kind\n // of step that gets skipped under pressure, leaving the AI talking over a\n // human mid-conversation.\n const conv = await db.getConversation(conversationId);\n if (conv && String(conv[\"status\"]) !== \"human\") {\n await db.setStatus(conversationId, \"human\", signer);\n }\n\n await db.addMessage(conversationId, \"agent\", String(body).slice(0, 4000), signer);\n if (who.tokenId) await db.touchAgentToken(who.tokenId);\n return c.json({ ok: true });\n});\n\n/**\n * If this conversation's last message is a visitor question nobody has\n * answered yet, generate and store a reply for it right now.\n *\n * WHY THIS EXISTS. Releasing back to the bot used to just flip status and go\n * silent. A visitor message that arrives while status is \"human\" is blocked\n * from an AI reply by the branch in /api/message (\"An agent has taken over:\n * the AI must stay silent\") -- and release never revisited it, so the bot\n * would only ever answer the visitor's NEXT message. Whatever they already\n * asked sat unanswered until they gave up or wrote again. Confirmed live\n * 9/8/2026: a \"when's my next delivery\" question sat over two minutes after\n * release with nothing happening.\n *\n * Mirrors the reply-generation block in /api/message (history, invoice\n * lookup, humanizing pad, re-checking status before writing) rather than\n * calling into it -- that endpoint's flow is keyed on the status AT MESSAGE\n * ARRIVAL and has its own request/response shape, so duplicating this one\n * block is safer than reworking an already-correct hot path. If the pad\n * constants there change, change them here too.\n */\nasync function answerPendingVisitorMessage(conversationId: string) {\n const history = await db.getMessages(conversationId);\n const last = history[history.length - 1];\n if (!last || last[\"sender\"] !== \"visitor\") return;\n\n const conv = await db.getConversation(conversationId);\n if (!conv) return;\n const visitorId = String(conv[\"visitor_id\"]);\n const visitor = await db.getVisitor(visitorId);\n let invoice = null;\n if (visitor?.[\"phone\"]) {\n invoice = await invoiceStatus(String(visitor[\"phone\"]), !!visitor[\"wp_user_id\"]);\n }\n\n const replyStartedAt = Date.now();\n const reply = await aiReply(history, visitor, invoice, conversationId);\n if (reply) {\n const elapsed = Date.now() - replyStartedAt;\n const target = Math.min(4800, Math.max(480, reply.length * 19.2));\n if (elapsed < target) {\n await new Promise((r) => setTimeout(r, target - elapsed));\n }\n }\n\n // Someone may have reclaimed the conversation while this ran.\n const still = await db.getConversation(conversationId);\n const nowStatus = still ? String(still[\"status\"]) : null;\n if (nowStatus === \"human\" || nowStatus === \"closed\") {\n console.log(`release auto-reply DISCARDED -- ${nowStatus} reclaimed ${conversationId}`);\n return;\n }\n if (reply) {\n await db.addMessage(conversationId, \"ai\", reply);\n }\n // No reply generated: leave it silent rather than injecting a canned\n // apology into a conversation the office just handed off -- unlike\n // /api/message, there is no visitor sitting on a live typing indicator\n // waiting for something to happen this second.\n}\n\napp.post(\"/api/agent/release\", async (c) => {\n const who = await whoIsAgent(c);\n if (!who) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n const { conversationId } = await c.req.json();\n await db.setStatus(conversationId, \"ai\");\n await answerPendingVisitorMessage(String(conversationId));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/agent/close\", async (c) => {\n const who = await whoIsAgent(c);\n if (!who) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n const { conversationId } = await c.req.json();\n await db.setStatus(conversationId, \"closed\");\n return c.json({ ok: true });\n});\n\napp.get(\"/api/agent/stream\", async (c) => {\n const who = await whoIsAgent(c);\n if (!who) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n // The dashboard re-fetches the list on any tick; sending the list itself\n // down the stream would race with the agent's own actions.\n return new Response(\n sseStream(async () => [{ created_at: Date.now(), tick: true }], 0),\n { headers: SSE_HEADERS },\n );\n});\n\n/* ----------------------------------------------------------------- shared */\n\n/**\n * Resolve a phone (and now email) against Salesforce and cache it on the\n * visitor — an ACCOUNT match first, and only when that comes up empty, a\n * LEAD match.\n *\n * WHY LEAD IS SECOND AND CONDITIONAL. A Lead is what a stranger has —\n * somebody who filled out the website popup and nothing more. An Account is\n * what a customer has. If we already know this visitor has an account, a\n * Lead record (real or stale, from before they signed up) has nothing to add\n * and every reason to be left alone: mentioning a \"lead\" to someone we can\n * already see is a paying customer reads as the bot not knowing who they are,\n * the opposite of the point.\n *\n * EMAIL IS NEW HERE. The account lookup still only accepts phone (Salesforce\n * field-level security blocks email on both Account and Lead paths for this\n * integration user, verified separately for each — see salesforce.ts), but a\n * Lead lookup by email is exactly what closes the popup gap: that lead had no\n * phone captured at all, only an email, so phone-only enrichment would never\n * have found it.\n */\nasync function enrich(visitorId: string, phone: string | null, email: string | null = null) {\n // Store what we were given first, before any lookup and regardless of its\n // outcome. The agent console runs its OWN native Salesforce query keyed off\n // the phone, and that query is the one that can show several candidate\n // accounts for a human to choose between. Without this, a number typed in\n // chat reached the bot but never the panel, so the disambiguation the\n // console exists for never fired.\n if (phone) await db.setVisitorPhone(visitorId, phone);\n // Was scanned only for the Lead lookup below and then thrown away —\n // never reached VERIFIED ACCOUNT or anything else keyed on \"do we have\n // an email.\" Stored the same way phone already is, for the same reason.\n if (email) await db.setVisitorEmail(visitorId, email);\n\n const v = await db.getVisitor(visitorId);\n\n // Re-checking every message would add a Val Town cold start plus two SOQL\n // queries to each turn. An hour is far shorter than a delivery schedule\n // changes.\n const checked = Number(v?.[\"sf_checked_at\"] ?? 0);\n // Mutable: the account lookup below can turn this true mid-function. It\n // has to, or a visitor whose very first message matches an Account still\n // pays for a Lead lookup right behind it — a second slow SF round trip\n // for a question already answered by the first.\n let alreadyKnownCustomer = !!v?.[\"sf_account\"];\n\n if (phone && !(checked && Date.now() - checked < 60 * 60 * 1000)) {\n const res = await lookupByPhone(phone);\n // found:false arrives as needs_phone, ambiguous or errored. None is a\n // statement about THIS customer, so none is stored. Ambiguous matters\n // most: that number is on more than one account, and guessing would put\n // another business's name in front of this one.\n if (res?.found) {\n await db.setSalesforce(visitorId, res.account_name ?? null, res.next_delivery_date ?? null);\n alreadyKnownCustomer = true;\n }\n }\n\n if (!alreadyKnownCustomer && (phone || email)) {\n const leadChecked = Number(v?.[\"sf_lead_checked_at\"] ?? 0);\n if (!leadChecked || Date.now() - leadChecked >= 60 * 60 * 1000) {\n const lead = await lookupLead(phone, email);\n // Written whether found or not — see setLead's own comment on why this\n // one is not COALESCEd the way the account fields are.\n await db.setLead(visitorId, lead?.found ? lead.company ?? null : null, lead?.found ? lead.status ?? null : null);\n }\n }\n}\n\n/**\n * Deliberately narrow. A customer saying \"does a human deliver these?\" should\n * not trigger a handoff, so this matches requests, not the word alone.\n */\nfunction wantsHuman(text: string): boolean {\n // An actual request. These stand on their own and always escalate.\n if (/\\b(speak|talk|chat)\\s+(to|with)\\s+(a\\s+)?(human|person|someone|agent|rep)\\b/i.test(text)) {\n return true;\n }\n if (/\\bhuman\\s+(please|help)\\b/i.test(text)) return true;\n\n // \"real person\" / \"live agent\" WITHOUT a request verb in front of it.\n //\n // THIS FIRED ON \"are you a real person?\" AND HANDED THE CHAT OFF — caught\n // 9/1/2026, the first time anyone asked the newly-named assistant who it\n // was. That question is not a request for a human, it is a question about\n // the one already answering, and escalating it drops a live conversation\n // into a queue nobody is watching and leaves the customer waiting for a\n // reply that was one sentence away.\n //\n // It matters more now than it did: giving the assistant a name is precisely\n // what makes people ask.\n if (!/\\b(real|live)\\s+(person|human|agent)\\b/i.test(text)) return false;\n return !asksWhoYouAre(text);\n}\n\n/* ------------------------------------------------- callback details */\n\n/**\n * What the system says the moment a handoff is requested.\n *\n * Three versions, because the wrong one is worse than none. A signed-in\n * customer whose number we already hold should not be asked for it — that\n * reads as a company that does not know who they are.\n */\nfunction handoffLine(v: any): string {\n const haveName = !!v?.[\"name\"];\n const havePhone = !!v?.[\"phone\"];\n\n if (haveName && havePhone) {\n return \"I'll get someone from the team onto this — they have your details \"\n + \"and will come back to you. We're open \" + OFFICE_HOURS + \".\";\n }\n if (havePhone) {\n return \"I'll pass this to the team. What name should I put on it?\";\n }\n if (haveName) {\n return \"I'll pass this to the team, \" + String(v[\"name\"]).split(/\\s+/)[0]\n + \". What's the best number to reach you on?\";\n }\n return \"I'll get this in front of the team. So they can come back to you — \"\n + \"what's your name and the best number to reach you on?\";\n}\n\n/**\n * Take a name and a number from someone who has asked for a person.\n *\n * IN CODE, NOT THROUGH THE MODEL, and that is the point. They asked for a\n * human; letting the assistant keep talking would be the system overriding the\n * one instruction it was just given. This does exactly one thing — records how\n * to call them back — and then goes quiet.\n *\n * The phone has already been scanned, stored and resolved against Salesforce by\n * the caller, so this only has to deal with the name and with what to say.\n */\nasync function takeContactDetails(\n cid: string,\n visitorId: string,\n text: string,\n): Promise {\n // STOP READING NAMES OUT OF MESSAGES ONCE WE HAVE STOPPED ASKING.\n //\n // After the give-up line the conversation is no longer about contact details,\n // so anything typed next is about something else entirely — and guessing a\n // name out of it is how \"Still No\" ended up in a customer name field. The\n // phone scan upstream still runs, because a number is unambiguous.\n const conv = await db.getConversation(cid);\n const givenUp = Number(conv?.[\"contact_asks\"] ?? 0) >= 2;\n\n if (!givenUp) {\n const name = extractName(text);\n if (name) await db.setVisitorName(visitorId, name);\n }\n\n const v = await db.getVisitor(visitorId);\n const haveName = !!v?.[\"name\"];\n const havePhone = !!v?.[\"phone\"];\n\n if (haveName && havePhone) {\n // Notify AGAIN. The first notification went out with nothing useful in it;\n // this is the one that tells the team who to ring.\n await notifyHandoff(cid, await db.getConversation(cid));\n await db.addMessage(\n cid,\n \"system\",\n \"Thanks \" + String(v[\"name\"]).split(/\\s+/)[0] + \" — the team has your \"\n + \"number and will call you back. We're open \" + OFFICE_HOURS\n + \", or you can reach us on \" + OFFICE_PHONE + \".\",\n );\n return true;\n }\n\n // ONE FOLLOW-UP, THEN STOP — and it is not the same sentence twice.\n //\n // The first version asked three times and repeated the opening line word for\n // word each time, so \"no\" was answered with the identical question it had\n // just been given. Somebody who declines twice has decided; asking again is\n // a bot arguing with a customer, and they can still be helped without a\n // number.\n const asks = await db.bumpContactAsks(cid);\n if (asks >= 2) {\n await db.addMessage(\n cid,\n \"system\",\n \"No problem — this is flagged for the team either way. If it's easier, \"\n + OFFICE_PHONE + \" or \" + OFFICE_EMAIL + \" reaches us directly.\",\n );\n return false;\n }\n\n await db.addMessage(\n cid,\n \"system\",\n havePhone\n ? \"Got it. And what name should I put on it?\"\n : (haveName\n ? \"Thanks. What's the best number to reach you on?\"\n // Deliberately worded differently from handoffLine's version of the\n // same request. Hearing the identical sentence back is what makes a\n // system feel like it is not listening.\n : \"No problem either way — a number is just how they'd reach you. \"\n + \"Whereabouts should they call, and who should they ask for?\"),\n );\n return false;\n}\n\n/**\n * A name out of a sentence, or nothing.\n *\n * CONSERVATIVE ON PURPOSE. A wrong name on a callback is worse than a blank\n * one: the team rings up and opens with somebody else's name. So this takes\n * either an explicit introduction (\"my name is...\", \"this is...\") or a reply\n * that is nothing BUT a name, and rejects everything else.\n *\n * Phone numbers and emails are stripped first, because \"John 973-555-0134\" is\n * the commonest single answer to the question this follows.\n */\nfunction extractName(text: string): string | null {\n let s = String(text ?? \"\").replace(/\\S+@\\S+/g, \" \").replace(/[\\d()+\\-.]{7,}/g, \" \");\n\n const intro = s.match(\n /\\b(?:my name is|name is|name's|i am|i'm|this is|it's|its|call me)\\s+([a-z][a-z'.-]*(?:\\s+[a-z][a-z'.-]*){0,2})/i,\n );\n\n let cand = intro ? intro[1] : null;\n\n if (!cand) {\n const bare = s.trim().replace(/[.,!?]+$/, \"\");\n if (bare && bare.length <= 40 && /^[a-z][a-z'.-]*(\\s+[a-z][a-z'.-]*){0,2}$/i.test(bare)) {\n cand = bare;\n }\n }\n\n if (!cand) return null;\n\n // CUT AT THE FIRST WORD THAT CANNOT BE PART OF A NAME.\n //\n // The capture takes up to three words, and \"my name is Dana Whitfield and my\n // number is...\" handed back \"Dana Whitfield And\" — which is what the team\n // would then have read off the screen when they rang her. Names run until\n // the sentence turns into something else, and these are the words it turns\n // into.\n const STOP =\n /^(and|my|the|a|an|is|are|was|number|phone|cell|mobile|email|address|at|on|in|it|its|call|me|you|your|please|thanks|thank|but|or|with|for|to|from|here|there|im|i)$/i;\n\n const words: string[] = [];\n for (const w of cand.trim().split(/\\s+/)) {\n if (STOP.test(w.replace(/[^a-z'.-]/gi, \"\"))) break;\n words.push(w);\n if (words.length === 3) break;\n }\n if (!words.length) return null;\n cand = words.join(\" \");\n\n // Words that pass the shape test and are never part of an answer to \"what's\n // your name\". Tested PER WORD, not against the whole phrase: the first\n // version only checked single words, so \"still no\" sailed through and was\n // stored as the customer name \"Still No\". A wrong name is worse than none —\n // it is what somebody reads off the screen before dialling.\n const NOT_A_NAME =\n /^(yes|no|nope|yep|not|never|still|ok|okay|sure|thanks|thank|hi|hello|hey|please|nothing|none|water|delivery|bottles|help|maybe|later|now|dont|wont|cant|giving|out|stop|leave|alone)$/i;\n\n if (cand.split(/\\s+/).some((w) => NOT_A_NAME.test(w.replace(/[^a-z'.-]/gi, \"\")))) {\n return null;\n }\n\n return cand.trim().split(/\\s+/)\n .map((w) => w.charAt(0).toUpperCase() + w.slice(1))\n .join(\" \")\n .slice(0, 60);\n}\n\n/**\n * \"Are you a real person?\", \"is this a bot?\", \"who am I talking to?\"\n *\n * Answered rather than escalated. Jack is told to say plainly what he is, so\n * the honest answer is already available and is a better reply than a transfer.\n * Anyone who wants a human after that only has to ask for one, and the request\n * patterns above catch it.\n */\nfunction asksWhoYouAre(text: string): boolean {\n return /\\b(are|r)\\s+(you|u)\\b[^.?!]{0,30}\\b(real|human|person|bot|robot|ai|machine|computer)\\b/i.test(text)\n || /\\bis\\s+th(is|at)\\b[^.?!]{0,30}\\b(real|human|person|bot|robot|ai)\\b/i.test(text)\n || /\\bwho\\s+am\\s+i\\s+(talking|speaking|chatting)\\s+(to|with)\\b/i.test(text)\n || /\\bam\\s+i\\s+(talking|speaking|chatting)\\s+(to|with)\\s+(a\\s+)?(real|human|person|bot)\\b/i.test(text);\n}\n\n/* ------------------------------------------------------------ delivery */\n\napp.get(\"/widget.js\", () =>\n new Response(WIDGET_JS, {\n headers: {\n \"Content-Type\": \"application/javascript; charset=utf-8\",\n // Short, so a fix reaches visitors within minutes without hammering the\n // val on every page view of a WooCommerce site.\n \"Cache-Control\": \"public, max-age=300\",\n },\n })\n);\n\n// The standalone console. Kept alongside the Visualforce page as the fallback\n// that works when Salesforce is down or a licence is missing.\napp.get(\"/dashboard\", () =>\n new Response(DASHBOARD_HTML, {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n })\n);\n\n/* ----------------------------------------------------- mobile console */\n\n/**\n * The phone console. Public HTML, because the page itself is just a shell —\n * every byte of customer data behind it comes from an endpoint that checks a\n * credential first, and an unauthenticated visitor gets a login form.\n *\n * no-store, because this is the one page where a cached copy on a shared\n * device would show the previous person's conversation list.\n */\napp.get(\"/m\", () =>\n new Response(MOBILE_HTML, {\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n \"Cache-Control\": \"no-store\",\n \"X-Robots-Tag\": \"noindex, nofollow\",\n },\n })\n);\n\n/**\n * Exchange a token for a session cookie.\n *\n * WHY A COOKIE AND NOT THE TOKEN ON EVERY REQUEST. The token would have to\n * live in localStorage to survive a reload, and anything in localStorage is\n * readable by any script that ever runs on the page. An HttpOnly cookie is not\n * reachable from JavaScript at all, so the credential cannot be exfiltrated by\n * a script the way the desktop dashboard's shared key could be.\n *\n * NO RATE LIMIT, deliberately. These tokens are 128 bits of crypto-random;\n * guessing one is not a thing that happens, and a throttle keyed on a proxied\n * IP is how the /chat control page locked out its own owner on 9/2/2026. The\n * control here is the log line below, which makes a stream of failures visible.\n */\napp.post(\"/api/m/login\", async (c) => {\n await db.init();\n const body = await c.req.json().catch(() => ({}));\n const token = typeof body.token === \"string\" ? body.token.trim() : \"\";\n const person = typeof body.person === \"string\" ? body.person.trim() : \"\";\n const passcode = typeof body.passcode === \"string\" ? body.passcode : \"\";\n\n let tok: any = null;\n\n if (token) {\n tok = await db.resolveAgentToken(token);\n if (!tok) {\n console.warn(\"mobile login REJECTED (token)\");\n return c.json({ error: \"That token was not accepted.\" }, 401);\n }\n } else if (person && passcode) {\n const row = await db.agentByPerson(person);\n\n // A NAME THAT DOES NOT EXIST STILL COSTS A HASH.\n //\n // Returning immediately would make an unknown name answer in a\n // millisecond and a known one in three hundred, which turns this endpoint\n // into a way to enumerate who works here. The dummy derivation makes both\n // paths cost the same.\n if (!row) {\n await db.passcodeHash(passcode, \"00000000000000000000000000000000\");\n console.warn(\"mobile login REJECTED (unknown person)\");\n return c.json({ error: \"Name or passcode not recognised.\" }, 401);\n }\n\n // EXPONENTIAL BACKOFF ON THIS PERSON'S ROW, not on an IP address.\n //\n // A passcode is short enough to be worth guessing, so something has to\n // slow that down. Keying it to the account rather than the caller is what\n // stops a repeat of the /chat lockout, where a shared proxy address meant\n // one machine's failed attempts locked out everybody. The cost here falls\n // only on the account being attacked, and it clears on the next success.\n const fails = Number(row[\"fails\"] ?? 0);\n const lastFail = Number(row[\"last_fail_at\"] ?? 0);\n const waitMs = fails < 3 ? 0 : Math.min(2 ** (fails - 2) * 1000, 5 * 60 * 1000);\n if (waitMs && Date.now() - lastFail < waitMs) {\n const left = Math.ceil((waitMs - (Date.now() - lastFail)) / 1000);\n return c.json({ error: `Too many attempts. Try again in ${left}s.` }, 429);\n }\n\n const given = await db.passcodeHash(passcode, String(row[\"passcode_salt\"]));\n if (!safeEq(given, String(row[\"passcode_hash\"]))) {\n await db.notePasscodeFail(String(row[\"id\"]));\n console.warn(`mobile login REJECTED (passcode) for ${row[\"person\"]}`);\n return c.json({ error: \"Name or passcode not recognised.\" }, 401);\n }\n\n await db.clearPasscodeFails(String(row[\"id\"]));\n tok = { id: row[\"id\"], person: row[\"person\"] };\n } else {\n return c.json({ error: \"Name and passcode required.\" }, 400);\n }\n\n const tid = String(tok[\"id\"]);\n const expires = Date.now() + MOBILE_DAYS * 24 * 60 * 60 * 1000;\n const value = tid + \".\" + expires + \".\" + await signSession(tid, expires);\n\n await db.touchAgentToken(tid);\n console.log(`mobile login: ${tok[\"person\"]}`);\n\n // SameSite=Lax is doing real work: it stops a cross-site form POST from\n // carrying this cookie, which is what would otherwise let another site\n // send a message to a customer as Tribeca on a signed-in person's behalf.\n c.header(\n \"Set-Cookie\",\n `${MOBILE_COOKIE}=${value}; Path=/; Max-Age=${MOBILE_DAYS * 24 * 60 * 60}` +\n `; HttpOnly; Secure; SameSite=Lax`,\n );\n return c.json({ person: tok[\"person\"] });\n});\n\n/* ------------------------------------------------------- web push */\n\n/**\n * The service worker, served from the ROOT.\n *\n * Scope is the sticking point: a worker served from /m could only ever control\n * pages under /m. Serving it from / — and saying so with Service-Worker-Allowed\n * — lets the same registration cover the whole origin.\n */\napp.get(\"/sw.js\", () =>\n new Response(SERVICE_WORKER, {\n headers: {\n \"Content-Type\": \"application/javascript; charset=utf-8\",\n \"Service-Worker-Allowed\": \"/\",\n // Short, not immutable. A stale service worker is unusually painful to\n // dislodge — it is the thing that decides whether updates are noticed.\n \"Cache-Control\": \"max-age=0, must-revalidate\",\n },\n })\n);\n\n/**\n * The web app manifest.\n *\n * iOS only grants notification permission to a site added to the Home Screen,\n * and only treats it as an app when there is a manifest saying so. Without\n * this the install is a bookmark, and a bookmark cannot receive push.\n */\napp.get(\"/manifest.json\", (c) =>\n c.json({\n name: \"Tribeca Chat\",\n short_name: \"Tribeca\",\n start_url: \"/m\",\n scope: \"/\",\n display: \"standalone\",\n background_color: \"#f4f6f9\",\n theme_color: \"#0b5cad\",\n icons: [{ src: \"/icon.png\", sizes: \"512x512\", type: \"image/png\", purpose: \"any maskable\" }],\n })\n);\n\n/**\n * The app icon — the REAL Tribeca Beverage mark, not a placeholder.\n *\n * This used to be a flat blue square with a hand-drawn water drop, served as\n * SVG. Replaced 9/3/2026 with the actual logo tribecabeverage.com serves as\n * its own favicon and apple-touch-icon — same file, pulled from the site\n * itself rather than redrawn — stored as a real PNG in this val's blob\n * storage rather than embedded as a giant base64 string in source.\n *\n * PNG, DELIBERATELY, NOT SVG. iOS has historically been unreliable about SVG\n * specifically for apple-touch-icon (a plain favicon `` is\n * fine with SVG; the home-screen icon is the pickier one), and an icon that\n * fails to decode does not fall back to anything — it shows blank, or the\n * broken-image glyph. manifest.json already declared \"image/png\" for this\n * file while the route served SVG underneath it; that mismatch is gone too.\n */\napp.get(\"/icon.png\", async () => {\n // blob.get RETURNS A Response, NOT THE BYTES — passing it straight to a new\n // Response's body is a string coercion, not a copy, and it served\n // \"[object Response]\" as a 17-byte \"image\" until this was caught live. The\n // body stream is what actually needs forwarding.\n const res = await blob.get(\"tribeca-logo-192.png\");\n if (!res) {\n // Never surface a broken image to a customer over a missing blob. A\n // solid brand-blue square is a worse icon than the real logo, but a\n // strictly better one than a home screen showing nothing at all.\n return new Response(\n ``,\n { headers: { \"Content-Type\": \"image/svg+xml\", \"Cache-Control\": \"max-age=300\" } },\n );\n }\n return new Response(res.body, {\n headers: { \"Content-Type\": \"image/png\", \"Cache-Control\": \"max-age=86400\" },\n });\n});\n\n/**\n * Check the notification plumbing, and optionally buzz every phone.\n *\n * Master key only. ?send=1 fires a real push — the only way to confirm a\n * banner actually reaches a lock screen, which no amount of checking the\n * signature can tell you.\n */\napp.get(\"/api/agent/push-test\", async (c) => {\n if (!agentAuthed(c)) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n const report = await selfTest();\n const sent = c.req.query(\"send\") === \"1\" ? await pushAll() : null;\n return c.json({ ...report, sent });\n});\n\n/** The public half of the VAPID pair, which the browser needs to subscribe. */\napp.get(\"/api/m/push-key\", (c) => c.json({ key: VAPID_PUBLIC_KEY }));\n\n/**\n * Register this phone for notifications.\n *\n * Tied to the signed-in person's token, so revoking their access silently\n * stops their phone receiving customer names — see livePushSubs.\n */\napp.post(\"/api/m/subscribe\", async (c) => {\n const who = await whoIsAgent(c);\n if (!who || !who.tokenId) {\n // Master-key callers have no token row to hang a device off, and the\n // Salesforce console has no use for phone notifications anyway.\n return c.json({ error: \"sign in on the phone console first\" }, 401);\n }\n await db.init();\n\n const { endpoint } = await c.req.json().catch(() => ({}));\n if (!endpoint || typeof endpoint !== \"string\" || !/^https:\\/\\//.test(endpoint)) {\n return c.json({ error: \"endpoint required\" }, 400);\n }\n\n await db.addPushSub(who.tokenId, endpoint);\n console.log(`push subscribed: ${who.person}`);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/m/unsubscribe\", async (c) => {\n const who = await whoIsAgent(c);\n if (!who) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n const { endpoint } = await c.req.json().catch(() => ({}));\n if (endpoint) await db.removePushSub(String(endpoint));\n return c.json({ ok: true });\n});\n\n/**\n * What the service worker shows.\n *\n * The push itself carries nothing — see push.ts — so this is where the banner's\n * words are decided. It reports the CURRENT state rather than the event that\n * triggered it, which is deliberate: by the time a phone wakes up, a colleague\n * may already have answered, and \"3 people waiting\" is truer and more useful\n * than replaying a message from thirty seconds ago.\n */\napp.get(\"/api/m/alert\", async (c) => {\n const who = await whoIsAgent(c);\n if (!who) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n\n const convs = await db.listConversations();\n const waiting = convs.filter((x: any) => String(x[\"status\"]) === \"needs_human\");\n\n // Somebody asking for a human outranks everything else on the list.\n if (waiting.length) {\n const first: any = waiting[0];\n const nm = first[\"name\"] || first[\"email\"] || first[\"phone\"] || \"Someone\";\n return c.json({\n title: waiting.length === 1\n ? `${nm} is waiting to chat`\n : `${waiting.length} people waiting to chat`,\n body: String(first[\"preview\"] ?? \"\").slice(0, 140),\n tag: \"waiting\",\n url: `/m?c=${encodeURIComponent(String(first[\"id\"]))}`,\n });\n }\n\n // Otherwise: the most recent thread where the visitor spoke last, which is\n // the one nobody has answered.\n const live = convs.filter((x: any) =>\n Number(x[\"last_visitor_at\"] ?? 0) >= Number(x[\"last_message_at\"] ?? 0)\n );\n const pick: any = live[0] ?? convs[0];\n if (!pick) return c.json({ error: \"nothing to report\" }, 404);\n\n const nm = pick[\"name\"] || pick[\"email\"] || pick[\"phone\"] || \"Someone\";\n return c.json({\n title: `${nm} started a chat`,\n body: String(pick[\"preview\"] ?? \"\").slice(0, 140),\n tag: String(pick[\"id\"]),\n url: `/m?c=${encodeURIComponent(String(pick[\"id\"]))}`,\n });\n});\n\n/** Is this cookie still good, and whose is it? Drives the auto sign-in. */\napp.get(\"/api/m/me\", async (c) => {\n const who = await whoIsAgent(c);\n if (!who) return c.json({ person: null }, 200);\n return c.json({ person: who.person });\n});\n\napp.post(\"/api/m/logout\", (c) => {\n c.header(\"Set-Cookie\", `${MOBILE_COOKIE}=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax`);\n return c.json({ ok: true });\n});\n\n/* ------------------------------------------------------ token admin */\n\n/**\n * Mint, list and revoke the per-person tokens.\n *\n * MASTER KEY ONLY — not a session cookie. A token holder must not be able to\n * mint another token or revoke a colleague's; that would collapse two levels\n * of access into one and undo the reason for having per-person credentials.\n */\napp.post(\"/api/agent/tokens\", async (c) => {\n if (!agentAuthed(c)) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n const { person } = await c.req.json().catch(() => ({ person: \"\" }));\n if (!person || !String(person).trim()) {\n return c.json({ error: \"person required\" }, 400);\n }\n\n const made = await db.createAgentToken(String(person).trim());\n console.log(`token minted for ${person}`);\n\n // The raw token appears in this response and nowhere else, ever. There is no\n // endpoint that can show it again, because only its hash was stored.\n return c.json({\n id: made.id,\n person: String(person).trim(),\n token: made.token,\n url: new URL(c.req.url).origin + \"/m\",\n note: \"Give this to one person. It cannot be shown again — mint a new one if lost.\",\n });\n});\n\napp.get(\"/api/agent/tokens\", async (c) => {\n if (!agentAuthed(c)) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n return c.json({ tokens: await db.listAgentTokens() });\n});\n\n/**\n * Give one person a passcode, so they can sign in with their name instead of\n * 32 hex characters.\n *\n * Master key only, like the rest of token admin. Setting a passcode does not\n * disturb the token — both work, and both point at the same person, so a\n * message is attributed the same way whichever was used to sign in.\n */\napp.post(\"/api/agent/tokens/passcode\", async (c) => {\n if (!agentAuthed(c)) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n const { id, passcode } = await c.req.json().catch(() => ({}));\n if (!id || !passcode || String(passcode).length < 6) {\n return c.json({ error: \"id and a passcode of at least 6 characters required\" }, 400);\n }\n await db.setPasscode(String(id), String(passcode));\n console.log(`passcode set for token ${id}`);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/agent/tokens/revoke\", async (c) => {\n if (!agentAuthed(c)) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n const { id } = await c.req.json().catch(() => ({ id: \"\" }));\n if (!id) return c.json({ error: \"id required\" }, 400);\n await db.revokeAgentToken(String(id));\n console.log(`token revoked: ${id}`);\n return c.json({ ok: true });\n});\n\n/**\n * Somewhere to try the widget without touching the live storefront.\n *\n * ?wp=1 fakes the enrichment the WordPress snippet would supply for a\n * signed-in customer, so both paths can be exercised: anonymous, where the\n * only thing known is what gets typed, and identified, where the account is\n * resolved before a word is said.\n */\napp.get(\"/test\", (c) => {\n const asCustomer = new URL(c.req.url).searchParams.get(\"wp\") === \"1\";\n\n const enrich = asCustomer\n ? ``\n : \"\";\n\n return new Response(\n `\n\n\nTribeca Chat - test page\n\n\n

Tribeca Chat test page

The widget is live in the corner. Nothing here touches tribecabeverage.com.

\n\n

Mode: ${asCustomer ? \"signed-in customer\" : \"anonymous visitor\"}\n · \n switch to ${asCustomer ? \"anonymous\" : \"signed-in\"}

\n\n

Try this first

Ask When is my next delivery? with no phone number given. It should refuse to\n guess a date and ask for one, rather than inventing something plausible.

\n\n

Then give it a number

Reply with 818-321-4845. The account is resolved in code before the model\n answers, so the name it uses comes from Salesforce, not from the model.

\n\n

Then ask for a person

Say can I talk to a person. The AI stops answering and the conversation moves\n to the top of the agent queue.

\n\n

Watch it arrive

Agent console: standalone or the Visualforce page in Salesforce.\n Both show the same conversation.

\n\n${enrich}\n\n`,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n});\n\napp.get(\"/health\", async (c) => {\n await db.init();\n return c.json({\n ok: true,\n // Compare against tribeca-profile's PROFILE_VERSION. If they differ, this\n // val is serving cached prices and needs a redeploy.\n profile: PROFILE_VERSION,\n anthropic: !!anthropicKey(),\n agentKey: !!AGENT_KEY(),\n apollo: !!Deno.env.get(\"APOLLO_TOOL_KEY\"),\n telegram: !!Deno.env.get(\"TELEGRAM_BOT_TOKEN\"),\n });\n});\n\nexport default app.fetch;\n","deleted",false,"label",[14],"53b5cfec-2084-4c81-ba38-78b35a1e8625",["D",1788226289223],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Chat widget, AI answering, human takeover, Salesforce","imageUrl","userId","c5acd3b3-60a7-4deb-bc6d-528f83012ea9","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f8fe2-cdfc-775d-a845-a69af13d39cb","tursoName","53b5cfec20844c81ba3878b35a1e8625","tursoHostname","53b5cfec20844c81ba3878b35a1e8625-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789484509295],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_105":101},"org",{"_9":10,"_98":99,"_100":101,"_55":56,"_102":103,"_104":42},"branch",{"_35":88,"_11":89,"_22":28,"_90":45,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":12,"_97":10},"isOwned",709,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","M A","avatar","https://lh3.googleusercontent.com/a/ACg8ocI9znhXn2hWp1wjjyWzeuOyoO_JrDgJo8aD0umFraR7bAG3UAmc=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_139":140,"_141":142,"_143":144,"_145":42,"_146":42,"_147":42,"_148":32,"_149":-5,"_150":-7,"_151":-7,"_152":62,"_153":42,"_154":42,"_155":-5,"_156":42,"_157":42,"_158":42,"_159":-5},"ENV",{"_110":111,"_112":113,"_114":89,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]