[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_105":106,"_107":108},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","gerardroy","name","amazon-pharmacy-rfp-demo","path","main.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":32,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/gerardroy/amazon-pharmacy-rfp-demo/code/main.ts","extension","id","867bf115-b92e-44bc-915a-f55493b2610c","fileId","bb2ce91e-a103-11f1-9f86-1607ee4eb77e","parentId","branchId","36b2eede-ee42-4fc8-b1ac-8c6b087de9ea","branchVersion",20,"latest",true,"createdAt",["D",1787786800326],"version",18,"fileType","http","content","// Backend for the Amazon Pharmacy RFP reference-call demo agent (Vapi tool server).\n// One endpoint, dispatched by function name.\n//\n// Design rules, carried from prior pharmacy builds plus what this RFP grades:\n// - The OTP is generated, stored and compared HERE; the model never sees the code.\n// - Verification is enforced server-side, not by a model-supplied boolean.\n// - No arithmetic in the model: prices, doses and day supplies are precomputed AND\n// pre-worded (`*_spoken`) so currency and dose registers are always read correctly.\n// - A misheard drug name returns `did_you_mean`, never a bare failure.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport {\n CATALOG, Drug, decimalWords, didYouMean, intWords, matchDrug, moneyWords,\n resolveSupply, supplyNote, unitLong,\n} from \"./catalog.ts\";\n\n// ---- account ----------------------------------------------------------------\n// Deliberately unnamed, matching the reference call: nothing account-specific is\n// spoken before the code clears.\nconst ACCOUNT = {\n account_id: \"AMZ-PH-40192\",\n mobile_on_file: Deno.env.get(\"DEMO_MEMBER_PHONE\") ?? \"\",\n email_masked: \"j••••••n@gmail.com\",\n same_day_delivery_eligible: true,\n recent_order: {\n medication: \"Aspirin\",\n spoken: \"your Aspirin eighty-one milligram order\",\n status: \"delivered\",\n },\n};\n\n// ---- OTP ---------------------------------------------------------------------\nconst OTP_TTL_MIN = 10, OTP_MAX_ATTEMPTS = 3, OTP_MAX_SENDS = 3;\n\nlet ready: Promise | null = null;\nfunction init() {\n ready ??= Promise.all([\n sqlite.execute(`CREATE TABLE IF NOT EXISTS rfp_otp (\n call_id TEXT PRIMARY KEY, code TEXT NOT NULL, destination TEXT NOT NULL,\n expires_at TEXT NOT NULL, attempts INTEGER NOT NULL DEFAULT 0,\n sends INTEGER NOT NULL DEFAULT 1, verified_at TEXT)`),\n sqlite.execute(`CREATE TABLE IF NOT EXISTS rfp_events (\n id INTEGER PRIMARY KEY AUTOINCREMENT, ts TEXT NOT NULL, call_id TEXT,\n type TEXT NOT NULL, payload TEXT)`),\n ]).then(() => {});\n return ready;\n}\n\n// Best-effort. The event log is for demo observability only, so a transient libsql\n// blip must never take down a customer-facing answer mid-call.\nasync function logEvent(callId: string, type: string, payload: unknown) {\n try {\n await init();\n await sqlite.execute({\n sql: `INSERT INTO rfp_events (ts, call_id, type, payload) VALUES (?, ?, ?, ?)`,\n args: [new Date().toISOString(), callId, type, JSON.stringify(payload)],\n });\n } catch (e) {\n console.error(\"logEvent failed (non-fatal):\", String(e));\n }\n}\n\nasync function otpRow(callId: string) {\n if (!callId) return null;\n await init();\n const rs = await sqlite.execute({\n sql: `SELECT code,destination,expires_at,attempts,sends,verified_at FROM rfp_otp WHERE call_id=?`,\n args: [callId],\n });\n const r = rs.rows[0];\n if (!r) return null;\n return {\n code: String(r[0]), destination: String(r[1]), expires_at: String(r[2]),\n attempts: Number(r[3]), sends: Number(r[4]), verified_at: r[5] ? String(r[5]) : null,\n };\n}\n\nfunction toE164(raw: unknown): string | null {\n const s = String(raw ?? \"\").trim(), d = s.replace(/[^\\d]/g, \"\");\n if (s.startsWith(\"+\") && d.length >= 11) return \"+\" + d;\n if (d.length === 11 && d.startsWith(\"1\")) return \"+\" + d;\n if (d.length === 10) return \"+1\" + d;\n return null;\n}\n\nconst last4 = (e: string) => e.slice(-4);\n\n// Where the verification code goes. Priority matters: the number the caller is\n// actually calling from ALWAYS wins. DEMO_MEMBER_PHONE is only a fallback for web\n// calls and chat tests, where there is no caller ID at all — if it takes priority,\n// every real caller gets someone else's phone texted instead of their own.\n//\n// The number is read from the call object, never from tool arguments, so the model\n// cannot redirect the code to a destination of its choosing.\nfunction resolveDestination(ctx: { customerNumber?: string }):\n { to: string; source: \"caller_id\" | \"demo_fallback\" } | null {\n const live = toE164(ctx.customerNumber);\n if (live) return { to: live, source: \"caller_id\" };\n const demo = toE164(ACCOUNT.mobile_on_file);\n if (demo) return { to: demo, source: \"demo_fallback\" };\n return null;\n}\n\nconst WORD_DIGITS: Record = {\n zero: \"0\", oh: \"0\", o: \"0\", one: \"1\", won: \"1\", two: \"2\", to: \"2\", too: \"2\",\n three: \"3\", four: \"4\", for: \"4\", fore: \"4\", five: \"5\", six: \"6\", seven: \"7\",\n eight: \"8\", ate: \"8\", nine: \"9\",\n};\n\n// Callers give the code three ways: spoken words, spoken digits, or DTMF keypad.\n// All three arrive here as text, so normalize them to bare digits.\nfunction normalizeCode(raw: unknown): string {\n return String(raw ?? \"\").toLowerCase()\n .replace(/[a-z]+/g, (w) => WORD_DIGITS[w] ?? \" \")\n .replace(/[^\\d]/g, \"\");\n}\n\n// Sends through Vapi's own Twilio SMS transport, so no Twilio credentials live here.\n// useLLMGeneratedMessageForOutbound:false forwards the body verbatim — the code is\n// never seen by any language model.\nasync function sendSms(to: string, body: string): Promise<{ ok: true } | { ok: false; message: string }> {\n const key = Deno.env.get(\"VAPI_API_KEY\");\n const phoneNumberId = Deno.env.get(\"VAPI_PHONE_NUMBER_ID\");\n const assistantId = Deno.env.get(\"VAPI_SMS_ASSISTANT_ID\");\n if (!key || !phoneNumberId || !assistantId) {\n return { ok: false, message: \"SMS is not configured on this server\" };\n }\n let res: Response;\n try {\n res = await fetch(\"https://api.vapi.ai/chat\", {\n method: \"POST\",\n headers: { Authorization: `Bearer ${key}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n assistantId, input: body,\n transport: {\n type: \"twilio.sms\", phoneNumberId, customer: { number: to },\n useLLMGeneratedMessageForOutbound: false,\n },\n }),\n });\n } catch (e) {\n return { ok: false, message: `could not reach the SMS provider: ${String(e)}` };\n }\n if (res.status === 429) return { ok: false, message: \"the SMS provider is rate limited right now\" };\n if (!res.ok) {\n const t = await res.text().catch(() => \"\");\n let m = `SMS provider returned ${res.status}`;\n try { const j = JSON.parse(t); if (j?.message) m = String(j.message); } catch { /* keep status */ }\n return { ok: false, message: m };\n }\n return { ok: true };\n}\n\nconst smsConfigured = () => !!(Deno.env.get(\"VAPI_API_KEY\") &&\n Deno.env.get(\"VAPI_PHONE_NUMBER_ID\") && Deno.env.get(\"VAPI_SMS_ASSISTANT_ID\"));\n\n// Server-authoritative: a model-supplied \"verified\" flag is never trusted.\nasync function gateVerified(callId: string): Promise {\n const row = await otpRow(callId);\n if (row?.verified_at) return null;\n return {\n error: \"verification_required\",\n message: \"The caller has not passed code verification. Run send_verification_code and check_verification_code first. Note that general catalog questions — availability, strengths, price — do NOT require verification.\",\n };\n}\n\n// ---- tool handlers -----------------------------------------------------------\nasync function handleTool(name: string, args: any, callId: string, ctx: { customerNumber?: string }): Promise {\n switch (name) {\n case \"lookup_account\": {\n // We can only SMS-verify the line the caller is on, so a caller who says this\n // is not their account number cannot be verified here — that is a handoff, not\n // a prompt for another number. Accepting a spoken number would also let anyone\n // point the code at a handset they control.\n if (args?.mobile_confirmed === false) {\n return {\n error: \"mobile_not_confirmed\",\n message: \"The caller says this is not the mobile on their account. We can only send a code to the line they are calling from, so hand off with transfer_to_human, department customer_care, reason_code mobile_not_on_account.\",\n };\n }\n const dest = resolveDestination(ctx);\n if (!dest) {\n return {\n error: \"no_account_match\",\n message: \"No account could be matched to a mobile number. Hand off with transfer_to_human, department customer_care.\",\n };\n }\n await logEvent(callId, \"account_lookup\", { mobile_last4: last4(dest.to), source: dest.source });\n return {\n account_found: true, mobile_last4: last4(dest.to), email_masked: ACCOUNT.email_masked,\n next_step: \"Send the code with send_verification_code. Speak no account detail yet.\",\n };\n }\n\n case \"send_verification_code\": {\n if (!callId) return { error: \"no_call_context\", message: \"This tool only works during a live call or chat.\" };\n const existing = await otpRow(callId);\n if (existing?.verified_at) {\n return { status: \"already_verified\", message: \"Already verified on this call. Continue with the caller's request.\" };\n }\n // A resend clears the attempt counter, so a locked call must not buy fresh guesses.\n if (existing && existing.attempts >= OTP_MAX_ATTEMPTS) {\n return { error: \"verification_locked\", message: \"Locked after too many incorrect codes. Do not resend. Use transfer_to_human with reason_code verification_failed.\" };\n }\n if (existing && existing.sends >= OTP_MAX_SENDS) {\n return { error: \"too_many_sends\", message: `A code was already sent ${existing.sends} times. Use transfer_to_human with reason_code verification_failed.` };\n }\n const dest = resolveDestination(ctx);\n if (!dest) return { error: \"no_phone_on_file\", message: \"No mobile number available to text. Use transfer_to_human with reason_code verification_failed.\" };\n const to = dest.to;\n const code = String(100000 + (crypto.getRandomValues(new Uint32Array(1))[0] % 900000));\n const sent = await sendSms(to, `Amazon Pharmacy: ${code} is your verification code. It expires in ${OTP_TTL_MIN} minutes. We will never ask you to share it by email or text reply.`);\n if (!sent.ok) {\n await logEvent(callId, \"otp_send_failed\", { mobile_last4: last4(to), source: dest.source, reason: sent.message });\n return { error: \"sms_failed\", message: `The code could not be sent (${sent.message}). Apologize briefly and use transfer_to_human with reason_code verification_failed.` };\n }\n await init();\n await sqlite.execute({\n sql: `INSERT INTO rfp_otp (call_id,code,destination,expires_at,attempts,sends,verified_at)\n VALUES (?,?,?,?,0,1,NULL)\n ON CONFLICT(call_id) DO UPDATE SET code=excluded.code, destination=excluded.destination,\n expires_at=excluded.expires_at, attempts=0, sends=rfp_otp.sends+1`,\n args: [callId, code, to, new Date(Date.now() + OTP_TTL_MIN * 60000).toISOString()],\n });\n await logEvent(callId, \"otp_sent\", { mobile_last4: last4(to), source: dest.source, resend: !!existing });\n return {\n status: \"code_sent\", digits: 6, mobile_last4: last4(to), email_masked: ACCOUNT.email_masked,\n expires_in_minutes: OTP_TTL_MIN,\n instruction: \"Tell the caller a six-digit code went to their email and mobile, and that they can speak it or enter it on the keypad. You cannot see the code — never say it, guess it, or confirm a partial match.\",\n };\n }\n\n case \"check_verification_code\": {\n if (!callId) return { error: \"no_call_context\", message: \"This tool only works during a live call or chat.\" };\n const row = await otpRow(callId);\n if (!row) return { error: \"no_code_issued\", message: \"No code has been sent yet. Call send_verification_code first.\" };\n if (row.verified_at) return { verified: true, message: \"Already verified on this call.\" };\n // Hard lock on entry, or the attempt cap is only advisory and the code is\n // brute-forceable by simply calling this tool again.\n if (row.attempts >= OTP_MAX_ATTEMPTS) {\n return {\n verified: false, error: \"too_many_attempts\", attempts_remaining: 0,\n message: \"Locked after too many incorrect codes. Do not retry or resend. Use transfer_to_human with reason_code verification_failed, without explaining why on the call.\",\n };\n }\n const supplied = normalizeCode(args?.code);\n if (supplied.length !== 6) {\n return { error: \"malformed_code\", message: \"That was not six digits. Ask the caller to say or key the six-digit code again. This did not count as an attempt.\" };\n }\n if (Date.now() > Date.parse(row.expires_at)) {\n return {\n verified: false, error: \"code_expired\",\n message: row.sends < OTP_MAX_SENDS\n ? \"That code expired. Offer to send a fresh one, then call send_verification_code.\"\n : \"That code expired and no resends remain. Use transfer_to_human with reason_code verification_failed.\",\n };\n }\n const attempts = row.attempts + 1, ok = supplied === row.code;\n await sqlite.execute({\n sql: `UPDATE rfp_otp SET attempts=?, verified_at=? WHERE call_id=?`,\n args: [attempts, ok ? new Date().toISOString() : null, callId],\n });\n if (ok) {\n await logEvent(callId, \"otp_verified\", { attempts });\n // recent_order is deliberately NOT returned. Leading with \"are you calling\n // about your Aspirin order?\" followed the reference transcript so closely it\n // read as a script rather than a live agent. The data stays on ACCOUNT so\n // this is a one-line change to restore.\n return {\n verified: true,\n same_day_delivery_eligible: ACCOUNT.same_day_delivery_eligible,\n instruction: \"Say the code was correct in one short line, then ask an open question — how can you help them today. Do not guess at their reason for calling and do not bring up any past order.\",\n };\n }\n const remaining = OTP_MAX_ATTEMPTS - attempts;\n await logEvent(callId, \"otp_failed\", { attempts, attempts_remaining: Math.max(remaining, 0) });\n if (remaining <= 0) {\n return {\n verified: false, error: \"too_many_attempts\", attempts_remaining: 0,\n message: \"Too many incorrect codes. Do not retry or resend. Use transfer_to_human with reason_code verification_failed, without explaining why on the call.\",\n };\n }\n return {\n verified: false, attempts_remaining: remaining,\n message: \"That code does not match. Say so plainly and invite them to try again, speaking it or using the keypad. Never hint at the correct digits.\",\n };\n }\n\n case \"check_medication_availability\": {\n const m = matchDrug(args?.medication_name);\n if (!m.exact) return didYouMean(m.suggestions);\n const d: Drug = m.exact;\n const strengths = d.strengths.map((s) => ({ value: s, spoken: `${decimalWords(s)} ${unitLong(d.unit)}` }));\n return {\n medication: d.name, generic: d.generic, category: d.category, form: d.form,\n in_stock: d.stock !== \"backordered\", availability: d.stock,\n strengths, strengths_spoken_list: strengths.map((s) => s.spoken).join(\", \"),\n strength_count_spoken: intWords(d.strengths.length),\n limited_strengths_spoken: d.limited.length\n ? d.limited.map((s) => `${decimalWords(s)} ${unitLong(d.unit)}`).join(\" and \") : null,\n requires_prescription: d.rx,\n day_supply_options: d.supplies,\n availability_note: d.stock === \"backordered\"\n ? `${d.name} is on backorder nationwide. Offer to check an alternative in the same category, or to notify them when it is back.`\n : d.stock === \"limited\"\n ? `${d.name} is available, but the strengths in limited_strengths_spoken are supply-constrained. Mention that only if they ask for one of those.`\n : null,\n next_step: \"Ask which strength, then what day supply, then call get_medication_pricing.\",\n };\n }\n\n case \"get_medication_pricing\": {\n const m = matchDrug(args?.medication_name);\n if (!m.exact) return didYouMean(m.suggestions);\n const d: Drug = m.exact;\n const strengthRaw = parseFloat(String(args?.strength ?? \"\").replace(/[^0-9.]/g, \"\"));\n if (isNaN(strengthRaw) || !d.strengths.includes(strengthRaw)) {\n return {\n error: \"strength_required\",\n available_strengths_spoken: d.strengths.map((s) => `${decimalWords(s)} ${unitLong(d.unit)}`).join(\", \"),\n message: `Ask which strength of ${d.name} they want, offering the values in available_strengths_spoken read exactly as written.`,\n };\n }\n const reqDays = parseInt(String(args?.days_supply ?? \"\").replace(/[^0-9]/g, \"\"), 10);\n if (isNaN(reqDays)) {\n return {\n error: \"days_supply_required\",\n options_spoken: d.supplies.map((s) => `${intWords(s)} day`).join(\", \"),\n message: \"Ask what day supply they want, offering the values in options_spoken.\",\n };\n }\n const days = resolveSupply(d, reqDays);\n const ins = d.insurance[String(days)], cash = d.cash[String(days)];\n // Manufacturer copay cards floor out rather than zeroing a copay: the savings\n // are capped so the caller is never told they could pay nothing.\n const savings = d.couponMax > 0\n ? Math.max(0, Math.min(d.couponMax, Math.round((ins - COUPON_FLOOR) * 100) / 100)) : 0;\n const lowest = Math.round((ins - savings) * 100) / 100;\n const couponApplies = savings > 0;\n const doses = d.schedule === \"weekly\" ? days / 7 : days;\n const ml = (d.schedule === \"weekly\" && d.mlPerDose)\n ? Math.round(d.mlPerDose * doses * 100) / 100 : null;\n const verified = !(await gateVerified(callId));\n await logEvent(callId, \"pricing_quote\", { drug: d.name, strength: strengthRaw, days });\n return {\n medication: d.name, generic: d.generic, form: d.form,\n strength_spoken: `${decimalWords(strengthRaw)} ${unitLong(d.unit)}`,\n days_supply: days, days_supply_spoken: `${intWords(days)} day`,\n supply_note: supplyNote(d, reqDays, days),\n volume_spoken: ml ? `${decimalWords(ml)} milliliters` : null,\n insurance_price_spoken: d.rx ? moneyWords(ins) : null,\n cash_price_spoken: moneyWords(cash),\n coupon_available: couponApplies,\n coupon_savings_spoken: couponApplies ? moneyWords(savings) : null,\n lowest_price_spoken: couponApplies ? moneyWords(lowest) : null,\n coupon_note: (!couponApplies && d.couponMax > 0)\n ? \"A manufacturer coupon exists for this medication, but it cannot go below the copay they already have at this day supply. Do not mention a coupon.\" : null,\n availability: d.stock,\n requires_prescription: d.rx,\n estimate_disclaimer: \"The average insurance price is an estimate based on what other customers paid; the caller's actual price may differ.\",\n same_day_delivery_eligible: verified ? ACCOUNT.same_day_delivery_eligible : null,\n next_step: d.rx\n ? \"Read the price using the spoken fields exactly as written, give the estimate disclaimer, then say a prescription is needed and offer to transfer one from another pharmacy.\"\n : \"Read the price using the spoken fields exactly as written. No prescription is needed for this item.\",\n };\n }\n\n case \"initiate_prescription_transfer\": {\n const g = await gateVerified(callId);\n if (g) return g;\n const m = matchDrug(args?.medication_name);\n if (!m.exact) return didYouMean(m.suggestions);\n if (!String(args?.current_pharmacy ?? \"\").trim()) {\n return { error: \"missing_pharmacy\", message: \"Ask which pharmacy currently holds the prescription, then retry.\" };\n }\n const result = {\n transfer_id: \"TRF-\" + String(30000 + Math.floor(Math.random() * 9000)),\n medication: m.exact.name, from_pharmacy: String(args.current_pharmacy),\n status: \"initiated\",\n expected_spoken: \"one to two business days, and we will text you when it lands\",\n };\n await logEvent(callId, \"transfer_rx\", result);\n return result;\n }\n\n case \"transfer_to_human\": {\n const dept = String(args?.department ?? \"\").toLowerCase().trim();\n if (![\"pharmacist\", \"customer_care\", \"billing\"].includes(dept)) {\n return { error: \"invalid_department\", message: \"department must be one of: pharmacist, customer_care, billing.\" };\n }\n if (!String(args?.call_summary ?? \"\").trim()) {\n return { error: \"missing_call_summary\", message: \"Include a brief call_summary so the specialist has context, then retry.\" };\n }\n const result = {\n status: \"transfer_accepted\", department: dept, queue_position: 1,\n instruction: \"Tell the caller you are connecting them now and the specialist has full context, then end the call. The transfer completes automatically in this demo.\",\n };\n await logEvent(callId, \"transfer_to_human\", { ...result, reason_code: args?.reason_code ?? null, call_summary: args.call_summary });\n return result;\n }\n\n default:\n return { error: \"unknown_tool\", message: `No handler for tool \"${name}\".` };\n }\n}\n\n// ---- catalog rendering -------------------------------------------------------\n// Manufacturer copay cards floor at this price rather than reducing a copay to zero.\nconst COUPON_FLOOR = 25;\n// Money always prints with cents when it has them: $3.10, never $3.1.\nconst USD = (n: number) => \"$\" + (Number.isInteger(n) ? String(n) : n.toFixed(2));\n\nconst STOCK_LABEL: Record = {\n in_stock: \"In stock\", limited: \"Limited supply\", backordered: \"On backorder\",\n};\nconst shortUnit = (u: string) => u === \"units/mL\" ? \"units/mL\" : u;\n\nfunction catalogRows() {\n return CATALOG.map((d) => ({\n name: d.name, generic: d.generic, category: d.category, form: d.form,\n strengths: d.strengths.map((s) => `${s} ${shortUnit(d.unit)}`).join(\", \"),\n strengths_spoken: d.strengths.map((s) => `${decimalWords(s)} ${unitLong(d.unit)}`),\n availability: STOCK_LABEL[d.stock],\n limited: d.limited.map((s) => `${s} ${shortUnit(d.unit)}`).join(\", \"),\n rx: d.rx ? \"Rx\" : \"OTC\",\n supplies: d.supplies,\n insurance: d.rx\n ? d.supplies.map((s) => s + \"d \" + USD(d.insurance[String(s)])).join(\" · \") : \"—\",\n cash: d.supplies.map((s) => s + \"d \" + USD(d.cash[String(s)])).join(\" · \"),\n coupon: d.couponMax > 0\n ? \"up to \" + USD(d.couponMax) + \" off, floor \" + USD(COUPON_FLOOR) : \"—\",\n }));\n}\n\nfunction catalogHtml(): string {\n const rows = catalogRows();\n const cats = [...new Set(rows.map((r) => r.category))];\n const esc = (s: string) => s.replace(/&/g, \"&\").replace(/ {\n const body = rows.filter((r) => r.category === c).map((r) => `\n \n ${esc(r.name)}${esc(r.generic)}\n ${esc(r.form)}${r.rx}\n ${esc(r.strengths)}\n ${esc(r.availability)}${r.limited ? `limited: ${esc(r.limited)}` : \"\"}\n ${esc(r.insurance)}\n ${esc(r.cash)}\n ${esc(r.coupon)}\n `).join(\"\");\n return `

${esc(c)}

\n \n \n ${body}

Medication	Form	Strengths	Availability	Insurance price	Cash price	Coupon

`;\n }).join(\"\");\n const totalStrengths = CATALOG.reduce((n, d) => n + d.strengths.length, 0);\n return `\nAmazon Pharmacy Voice Assistant — Medication Knowledge Base\n\n

Amazon Pharmacy Voice Assistant — Medication Knowledge Base

Every medication, strength, availability state and price the demo assistant can answer for. All values are mock data created for this demonstration.

${CATALOG.length}medications

${totalStrengths}strength options

${cats.length}categories

${CATALOG.filter((d) => d.stock !== \"in_stock\").length}constrained supply

\n${sections}\n\n`;\n}\n\n// ---- Vapi webhook plumbing ---------------------------------------------------\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n if (req.method === \"GET\" && url.pathname === \"/catalog\") {\n return new Response(catalogHtml(), { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } });\n }\n if (req.method === \"GET\" && url.pathname === \"/catalog.json\") {\n return Response.json({ count: CATALOG.length, drugs: catalogRows() });\n }\n if (req.method === \"GET\" && url.pathname === \"/events\") {\n await init();\n const rs = await sqlite.execute(`SELECT ts,call_id,type,payload FROM rfp_events ORDER BY id DESC LIMIT 50`);\n return Response.json({\n events: rs.rows.map((r) => ({ ts: r[0], call_id: r[1], type: r[2], payload: JSON.parse(String(r[3] ?? \"null\")) })),\n });\n }\n if (req.method === \"GET\") {\n return Response.json({\n ok: true, service: \"amazon-pharmacy-rfp-demo\", drugs: CATALOG.length,\n sms_configured: smsConfigured(), member_phone_configured: !!toE164(ACCOUNT.mobile_on_file),\n });\n }\n\n let body: any;\n try { body = await req.json(); } catch { return Response.json({ error: \"invalid_json\" }, { status: 400 }); }\n const msg = body?.message;\n if (msg?.type !== \"tool-calls\") {\n return Response.json({ error: \"unsupported_message_type\", got: msg?.type ?? null }, { status: 400 });\n }\n // Voice calls carry call.id; /chat and simulation runs carry chat/session ids.\n const callId = msg?.call?.id ?? msg?.chat?.id ?? msg?.session?.id ?? msg?.chatId ?? \"\";\n // Read from the call itself, never from tool arguments, so the model cannot\n // redirect the verification text to a number of its choosing.\n const ctx = { customerNumber: msg?.call?.customer?.number ?? msg?.customer?.number };\n const toolCalls = msg.toolCallList ?? msg.toolCalls ?? [];\n\n const results: { toolCallId: string; result: string }[] = [];\n for (const tc of toolCalls) {\n const name = tc.name ?? tc.function?.name;\n let a = tc.arguments ?? tc.function?.arguments ?? {};\n if (typeof a === \"string\") { try { a = JSON.parse(a); } catch { a = {}; } }\n let out: any;\n try { out = await handleTool(name, a, callId, ctx); }\n catch (e) { out = { error: \"internal_error\", message: String(e) }; }\n results.push({ toolCallId: tc.id, result: JSON.stringify(out) });\n }\n return Response.json({ results });\n}\n","deleted",false,"label",[14],"0b43ba0c-da77-4040-85d3-10a58b8e2aa7",["D",1787717048543],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Amazon Pharmacy RFP demo backend: OTP + drug catalog","imageUrl","userId","bf54ad56-9f09-4238-93ec-5919acfb30c0","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f8bc4-813e-715b-b5bf-1cb41e84f338","tursoName","0b43ba0cda77404085d310a58b8e2aa7","tursoHostname","0b43ba0cda77404085d310a58b8e2aa7-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789452068287],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_104":100},"org",{"_9":10,"_97":98,"_99":100,"_55":56,"_101":102,"_103":42},"branch",{"_35":30,"_11":88,"_22":28,"_89":45,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":12,"_96":10},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Gerard Roy","avatar","https://lh3.googleusercontent.com/a/ACg8ocIAPCi5IrLmWavYqxP-lUqAvz0-SYQhvB7c5IAuwONv5alSFg=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_138":139,"_140":141,"_142":143,"_144":42,"_145":42,"_146":42,"_147":32,"_148":-5,"_149":-7,"_150":-7,"_151":62,"_152":42,"_153":42,"_154":-5,"_155":42,"_156":42,"_157":42,"_158":-5},"ENV",{"_109":110,"_111":112,"_113":88,"_114":115,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]