[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_105":106,"_107":108},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","Tribeca_Rep","name","tribeca-tawk-transcripts","path","main.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":32,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":12,"_13":44},"permalink","https://www.val.town/x/Tribeca_Rep/tribeca-tawk-transcripts/code/main.ts","extension","id","1522a6fa-6973-446c-b28a-d2d3b5c949d9","fileId","01a03a6b-1697-71fe-a681-032b2cbe7562","parentId","branchId","ae272551-0b66-498e-893a-608c3c317b83","branchVersion",31,"latest",true,"createdAt",["D",1787763351825],"version",11,"fileType","http","content","// tawk.to chat transcripts -> SQLite, with a Salesforce match.\n//\n// POST / tawk webhook receiver (set this URL in tawk Admin > Webhooks)\n// GET /?key=... read the chats, their full message bodies, and any SF match\n//\n// Env vars:\n// TAWK_WEBHOOK_SECRET required — the secret you set when creating the webhook\n// VIEW_KEY required to open the viewer (transcripts are customer PII)\n// SALESFORCE_AGENT_URL optional — endpoint of tribeca-salesforce-agent\n// SALESFORCE_AGENT_KEY optional — its API_SHARED_SECRET\n// Without the Salesforce pair, transcripts still land; matching reports \"error\".\nimport { allowLookup, getChat, listChats, saveChat } from \"./db.ts\";\nimport { findInSalesforce, scrapeContact } from \"./lookup.ts\";\nimport { ENRICH_JS } from \"./enrich.ts\";\nimport { AGENT_PANEL_JS } from \"./agent-panel.ts\";\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n if (req.method === \"POST\") return receive(req);\n // Served before the viewer's key check: this is public JS for your website,\n // not customer data. It contains no secrets and calls no endpoint.\n if (req.method === \"GET\" && url.pathname === \"/enrich.js\") {\n return new Response(ENRICH_JS.replaceAll(\"__BASE__\", url.origin), {\n headers: {\n \"Content-Type\": \"application/javascript; charset=utf-8\",\n \"Access-Control-Allow-Origin\": \"*\",\n \"Cache-Control\": \"public, max-age=300\",\n },\n });\n }\n if (req.method === \"GET\" && url.pathname === \"/enrich-lookup\") return enrichLookup(req, url);\n if (url.pathname === \"/agent-lookup\") return agentLookup(req, url);\n // Same script, two install paths. .user.js triggers Tampermonkey's installer;\n // .js is what the bookmarklet loads (it reads window.TRIBECA_AGENT_KEY).\n if (\n req.method === \"GET\" &&\n (url.pathname === \"/agent-panel.user.js\" || url.pathname === \"/agent-panel.js\")\n ) {\n return new Response(AGENT_PANEL_JS.replaceAll(\"__BASE__\", url.origin), {\n headers: {\n \"Content-Type\": \"application/javascript; charset=utf-8\",\n \"Access-Control-Allow-Origin\": \"*\",\n \"Cache-Control\": \"no-cache\",\n },\n });\n }\n if (req.method === \"GET\") return viewer(url);\n return new Response(\"Method not allowed\", { status: 405 });\n}\n\n// -------------------------------------------------------- enrichment lookup\n// PUBLIC endpoint, called from the visitor's browser by enrich.js. It cannot\n// carry a secret, so anything it returns is readable by anyone who finds it.\n//\n// Everything here exists to keep that blast radius small:\n// - resolves phone only, never email (Salesforce exposes no email field)\n// - returns ONLY whether they are a customer and the account name.\n// No delivery date, no address, no other contacts, no record ids.\n// - per-IP rate limit\n// - Origin check (friction, not security — a header is trivially forged)\n// - every call logged, so abuse is visible in the val's logs\nconst ALLOWED_ORIGINS = [\"https://tribecabeverage.com\", \"https://www.tribecabeverage.com\"];\n\nasync function enrichLookup(req: Request, url: URL): Promise {\n const cors = (origin: string | null) => ({\n \"Access-Control-Allow-Origin\": origin && ALLOWED_ORIGINS.includes(origin) ? origin : ALLOWED_ORIGINS[0],\n \"Content-Type\": \"application/json\",\n \"Cache-Control\": \"no-store\",\n });\n const origin = req.headers.get(\"Origin\");\n const ip = req.headers.get(\"cf-connecting-ip\") ?? req.headers.get(\"x-forwarded-for\")?.split(\",\")[0]?.trim() ??\n \"unknown\";\n\n if (origin && !ALLOWED_ORIGINS.includes(origin)) {\n console.warn(`enrich-lookup blocked: origin=${origin} ip=${ip}`);\n return new Response(JSON.stringify({ known: false }), { status: 403, headers: cors(origin) });\n }\n\n if (!await allowLookup(ip, 15, 60)) {\n console.warn(`enrich-lookup rate limited: ip=${ip}`);\n return new Response(JSON.stringify({ known: false, throttled: true }), { status: 429, headers: cors(origin) });\n }\n\n const phone = (url.searchParams.get(\"phone\") ?? \"\").replace(/\\D/g, \"\").slice(0, 15);\n if (phone.length < 10) {\n return new Response(JSON.stringify({ known: false }), { headers: cors(origin) });\n }\n\n const base = Deno.env.get(\"ACCOUNT_LOOKUP_URL\") ?? \"https://tribeca-apollo.val.run/account-lookup\";\n const key = Deno.env.get(\"APOLLO_TOOL_KEY\");\n if (!key) {\n console.error(\"enrich-lookup: APOLLO_TOOL_KEY not set\");\n return new Response(JSON.stringify({ known: false }), { headers: cors(origin) });\n }\n\n try {\n const r = await fetch(`${base}?phone=${encodeURIComponent(phone)}`, { headers: { \"x-api-key\": key } });\n const j = await r.json();\n console.log(`enrich-lookup ip=${ip} found=${j.found} ambiguous=${!!j.ambiguous}`);\n // Deliberately narrow: never pass through next_delivery_date or messages.\n if (j.ambiguous) return new Response(JSON.stringify({ known: true, ambiguous: true }), { headers: cors(origin) });\n if (!j.found) return new Response(JSON.stringify({ known: false }), { headers: cors(origin) });\n return new Response(\n JSON.stringify({ known: true, account_name: String(j.account_name ?? \"\").slice(0, 120) }),\n { headers: cors(origin) },\n );\n } catch (err) {\n console.error(\"enrich-lookup failed:\", err);\n return new Response(JSON.stringify({ known: false }), { headers: cors(origin) });\n }\n}\n\n// ------------------------------------------------------------- agent lookup\n// STAFF-facing, used by the Tampermonkey panel inside dashboard.tawk.to.\n// Distinct from /enrich-lookup on purpose:\n// - requires AGENT_LOOKUP_KEY, which lives in the userscript agents install,\n// not in a public web page\n// - so it can return MORE: the delivery date, which is never sent to a visitor\n// - higher rate limit, because a whole office shares one outbound IP\n// If the key ever leaks, rotate it: it reaches only this read-only lookup.\nasync function agentLookup(req: Request, url: URL): Promise {\n const origin = req.headers.get(\"Origin\");\n const headers: Record = {\n \"Content-Type\": \"application/json\",\n \"Cache-Control\": \"no-store\",\n // The userscript runs on tawk's own origin, so CORS must allow it.\n \"Access-Control-Allow-Origin\": origin ?? \"https://dashboard.tawk.to\",\n \"Access-Control-Allow-Headers\": \"x-agent-key\",\n \"Access-Control-Max-Age\": \"86400\",\n };\n if (req.method === \"OPTIONS\") return new Response(null, { status: 204, headers });\n\n const expected = Deno.env.get(\"AGENT_LOOKUP_KEY\");\n if (!expected) return new Response(JSON.stringify({ error: \"AGENT_LOOKUP_KEY not set\" }), { status: 500, headers });\n if (req.headers.get(\"x-agent-key\") !== expected) {\n console.warn(\"agent-lookup: bad or missing x-agent-key\");\n return new Response(JSON.stringify({ error: \"Unauthorized\" }), { status: 401, headers });\n }\n\n const ip = req.headers.get(\"cf-connecting-ip\") ?? \"unknown\";\n if (!await allowLookup(`agent:${ip}`, 300, 60)) {\n return new Response(JSON.stringify({ error: \"throttled\" }), { status: 429, headers });\n }\n\n const phone = (url.searchParams.get(\"phone\") ?? \"\").replace(/\\D/g, \"\").slice(0, 15);\n if (phone.length < 10) return new Response(JSON.stringify({ found: false, message: \"Need a 10-digit phone number.\" }), { headers });\n\n const base = Deno.env.get(\"ACCOUNT_LOOKUP_URL\") ?? \"https://tribeca-apollo.val.run/account-lookup\";\n const key = Deno.env.get(\"APOLLO_TOOL_KEY\");\n if (!key) return new Response(JSON.stringify({ found: false, errored: true, message: \"APOLLO_TOOL_KEY not set\" }), { headers });\n\n try {\n const r = await fetch(`${base}?phone=${encodeURIComponent(phone)}`, { headers: { \"x-api-key\": key } });\n const j = await r.json();\n console.log(`agent-lookup ip=${ip} found=${j.found} ambiguous=${!!j.ambiguous}`);\n return new Response(JSON.stringify(j), { headers });\n } catch (err) {\n console.error(\"agent-lookup failed:\", err);\n return new Response(JSON.stringify({ found: false, errored: true, message: \"Lookup unavailable.\" }), { headers });\n }\n}\n\n// ------------------------------------------------------------------ webhook\nasync function receive(req: Request): Promise {\n const secret = Deno.env.get(\"TAWK_WEBHOOK_SECRET\");\n if (!secret) return new Response(\"TAWK_WEBHOOK_SECRET not set\", { status: 500 });\n\n const raw = await req.text();\n const signature = req.headers.get(\"X-Tawk-Signature\") ?? \"\";\n if (!await verify(raw, signature, secret)) {\n console.error(\"Rejected webhook: bad signature\");\n return new Response(\"Invalid signature\", { status: 401 });\n }\n\n let payload: Record;\n try {\n payload = JSON.parse(raw);\n } catch {\n return new Response(\"Bad JSON\", { status: 400 });\n }\n\n const event = String(payload.event ?? \"unknown\");\n const parsed = parseEvent(event, payload);\n if (!parsed) {\n // Acknowledge anything we don't model, so tawk doesn't retry it for 12h.\n console.log(`Ignoring unmodelled event: ${event}`);\n return Response.json({ received: true, ignored: event });\n }\n\n // Scrape ONLY what the visitor typed. Agents paste the office number and\n // support links constantly; matching on those would tie every chat to Tribeca.\n const { email: foundEmail, phone: foundPhone } = scrapeContact(parsed.visitorText);\n const email = parsed.visitorEmail || foundEmail;\n const match = await findInSalesforce(email, foundPhone);\n\n await saveChat({\n id: parsed.id,\n event,\n time: String(payload.time ?? new Date().toISOString()),\n domain: payload.domain ?? null,\n referrer: payload.referrer ?? null,\n visitorName: parsed.visitorName,\n visitorEmail: parsed.visitorEmail,\n city: parsed.city,\n country: parsed.country,\n foundEmail,\n foundPhone,\n transcript: parsed.transcript,\n sfStatus: match.status,\n sfJson: JSON.stringify(match),\n });\n\n return Response.json({ received: true });\n}\n\ntype Parsed = {\n id: string;\n visitorName: string | null;\n visitorEmail: string | null;\n city: string | null;\n country: string | null;\n transcript: string;\n /** Visitor messages only — what we're allowed to scrape for contact details. */\n visitorText: string;\n};\n\nexport function parseEvent(event: string, p: Record): Parsed | null {\n const v = (o: any) => ({\n visitorName: o?.name ?? null,\n visitorEmail: o?.email ?? null,\n city: o?.city ?? null,\n country: o?.country ?? null,\n });\n\n if (event === \"chat:transcript_created\") {\n const chat = p.chat ?? {};\n const messages: any[] = Array.isArray(chat.messages) ? chat.messages : [];\n const label = (m: any) =>\n m?.sender?.t === \"v\" ? \"visitor\" : m?.sender?.t === \"a\" ? `agent ${m?.sender?.n ?? \"\"}`.trim() : \"system\";\n return {\n id: String(chat.id ?? p.chatId ?? crypto.randomUUID()),\n ...v(chat.visitor),\n transcript: messages.map((m) => `${label(m)}: ${m?.msg ?? \"\"}`).join(\"\\n\"),\n visitorText: messages.filter((m) => m?.sender?.t === \"v\").map((m) => m?.msg ?? \"\").join(\"\\n\"),\n };\n }\n\n if (event === \"chat:start\") {\n const text = p.message?.text ?? \"\";\n const fromVisitor = p.message?.sender?.type === \"visitor\";\n return {\n id: String(p.chatId ?? crypto.randomUUID()),\n ...v(p.visitor),\n transcript: `${fromVisitor ? \"visitor\" : \"agent\"}: ${text}`,\n visitorText: fromVisitor ? text : \"\",\n };\n }\n\n if (event === \"ticket:create\") {\n const t = p.ticket ?? {};\n const text = `${t.subject ?? \"\"}\\n${t.message ?? \"\"}`.trim();\n return {\n id: `ticket-${t.id ?? crypto.randomUUID()}`,\n visitorName: p.requester?.name ?? null,\n visitorEmail: p.requester?.email ?? null,\n city: null,\n country: null,\n transcript: text,\n visitorText: text,\n };\n }\n\n // chat:end carries no message body — the transcript event covers that chat.\n return null;\n}\n\n/** tawk signs with HMAC-SHA1 over the raw body, hex encoded. */\nasync function verify(body: string, signature: string, secret: string): Promise {\n const enc = new TextEncoder();\n const key = await crypto.subtle.importKey(\n \"raw\",\n enc.encode(secret),\n { name: \"HMAC\", hash: \"SHA-1\" },\n false,\n [\"sign\"],\n );\n const sig = await crypto.subtle.sign(\"HMAC\", key, enc.encode(body));\n const hex = [...new Uint8Array(sig)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n return timingSafeEqual(hex, signature.trim().toLowerCase());\n}\n\nfunction timingSafeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\n\n// ------------------------------------------------------------------- viewer\nasync function viewer(url: URL): Promise {\n const expected = Deno.env.get(\"VIEW_KEY\");\n if (!expected) {\n return new Response(\n \"Set a VIEW_KEY environment variable, then open /?key=YOUR_KEY.\\n\" +\n \"This page shows chat transcripts and customer contact details, so it stays closed until you do.\",\n { status: 503 },\n );\n }\n if (url.searchParams.get(\"key\") !== expected) return new Response(\"Not found\", { status: 404 });\n\n const id = url.searchParams.get(\"chat\");\n if (id) {\n const chat = await getChat(id);\n if (!chat) return new Response(\"Not found\", { status: 404 });\n return html(detailPage(chat, url.searchParams.get(\"key\")!));\n }\n return html(listPage(await listChats(), url.searchParams.get(\"key\")!));\n}\n\nconst esc = (s: unknown) =>\n String(s ?? \"\").replace(/[&<>\"]/g, (m) => ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\" }[m]!));\n\nconst STYLE =\n ``;\n\nconst html = (body: string) => new Response(`${STYLE}${body}`, {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n});\n\nfunction listPage(chats: Record[], key: string) {\n if (!chats.length) {\n return `

tawk chats

Nothing received yet. Point a tawk webhook at this URL and start a chat.

`;\n }\n const rows = chats.map((c) =>\n `\n ${esc(String(c.received_at).replace(\"T\", \" \").slice(0, 16))}\n ${esc(c.visitor_name) || '-'}\n ${esc(c.city) || '-'}\n ${esc(c.found_email || c.visitor_email) || '-'}\n ${esc(c.found_phone) || '-'}\n ${esc(String(c.sf_status).replace(/_/g, \" \"))}\n read\n `\n ).join(\"\");\n return `

tawk chats (${chats.length})

\n${rows}

Received	Name	City	Email	Phone	Salesforce

`;\n}\n\nfunction detailPage(c: Record, key: string) {\n let sf = \"\";\n try {\n const m = JSON.parse(String(c.sf_json ?? \"{}\"));\n sf = m.status === \"matched\"\n ? `

Matched on ${esc(m.matchedOn)}

${esc(JSON.stringify(m.records, null, 2))}

`\n : `

${esc(m.status)}${m.error ? `: ${esc(m.error)}` : \"\"}

`;\n } catch {\n sf = `

`;\n }\n return `

← all chats

${esc(c.visitor_name) || \"Visitor\"} ${esc(c.city)}

${esc(c.event)} · ${esc(c.time)} · ${esc(c.referrer)}

Transcript

${esc(c.transcript)}

Scraped from what the visitor typed

email: ${esc(c.found_email) || \"-\"} · phone: ${esc(c.found_phone) || \"-\"}

Salesforce

${sf}`;\n}\n","deleted",false,"label",[14],"68d21ace-3c73-4585-929b-fc6f43782874",["D",1787686491713],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Receives tawk.to chat transcripts, matches to Salesforce","imageUrl","userId","c5acd3b3-60a7-4deb-bc6d-528f83012ea9","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f8fe2-cdfc-775d-a845-a69af13d39cb","tursoName","68d21ace3c734585929bfc6f43782874","tursoHostname","68d21ace3c734585929bfc6f43782874-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789525843977],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_104":100},"org",{"_9":10,"_97":98,"_99":100,"_55":56,"_101":102,"_103":42},"branch",{"_35":30,"_11":88,"_22":28,"_89":45,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":12,"_96":10},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","M A","avatar","https://lh3.googleusercontent.com/a/ACg8ocI9znhXn2hWp1wjjyWzeuOyoO_JrDgJo8aD0umFraR7bAG3UAmc=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_138":139,"_140":141,"_142":143,"_144":42,"_145":42,"_146":42,"_147":32,"_148":-5,"_149":-7,"_150":-7,"_151":62,"_152":42,"_153":42,"_154":-5,"_155":42,"_156":42,"_157":42,"_158":-5},"ENV",{"_109":110,"_111":112,"_113":88,"_114":115,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]