Apollo tools

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_107":108,"_109":110},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","tribeca_airep","name","tribeca-salesforce-agent","path","apollo-tools.ts","project",{"_22":46,"_11":12,"_33":47,"_48":-5,"_49":42,"_50":51,"_52":51,"_53":54,"_55":-5,"_56":57,"_58":59,"_60":32,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":84,"_85":86,"_87":88,"_89":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_13":45},"permalink","https://www.val.town/x/tribeca_airep/tribeca-salesforce-agent/code/apollo-tools.ts","extension","id","d45da689-4ccf-4d40-b153-e54fa243c6cf","fileId","9cef414e-a0be-11f1-957d-1607ee4eb77e","parentId","branchId","ceda7ac1-4fbd-45e5-ab28-65082ea4218c","branchVersion",143,"latest",true,"createdAt",["D",1788534716081],"version",17,"fileType","http","content","// Read-only tools for tawk.to's Apollo AI agent.\n//\n// Lives inside this val on purpose: sfQuery is right here, so there's no proxy\n// hop and no Salesforce credentials copied into a second val.\n//\n// GET /openapi.json the schema tawk fetches (public, no auth)\n// GET /account-lookup the tool Apollo calls (x-api-key required)\n// GET / config status\n//\n// Auth uses its OWN key, APOLLO_TOOL_KEY — deliberately NOT API_SHARED_SECRET.\n// That secret unlocks arbitrary SOQL on main.ts; if the tawk integration ever\n// leaked it, the blast radius would be the entire org. This key only reaches\n// the one narrow lookup below.\nimport { sfQuery } from \"./salesforce.ts\";\n\nfunction esc(v: string): string {\n return v.replace(/\\\\/g, \"\\\\\\\\\").replace(/'/g, \"\\\\'\").slice(0, 120);\n}\n\nfunction normalizePhone(raw: string): string | null {\n const d = raw.replace(/\\D/g, \"\");\n const ten = d.length === 11 && d.startsWith(\"1\") ? d.slice(1) : d;\n return ten.length === 10 ? ten : null;\n}\n\nasync function lookupAccount(phoneRaw?: string | null, email?: string | null) {\n const phone = phoneRaw ? normalizePhone(phoneRaw) : null;\n\n // Email lookup is NOT possible with this integration user's permissions:\n // Contact is not accessible at all, Account has no email column, and\n // Lead.Email is hidden by field-level security. Verified by schema probe\n // 2026-08-25. Phone against Account.Phone is the only route.\n if (!phone) {\n return {\n found: false,\n needs_phone: true,\n message: email\n ? \"Accounts can only be looked up by phone number. Ask the visitor for the phone number on their account.\"\n : \"Need a phone number to look up an account.\",\n };\n }\n\n // Account.Phone is stored formatted — \"(DDD) DDD-DDDD\" in this org — so a\n // bare digit string never matches as a substring. Put wildcards between the\n // area code, exchange and line number so any separator style matches, and a\n // trailing wildcard so extensions (\"x12\") don't break it. Wildcards also\n // match empty, so unformatted values still match.\n const [area, exch, line] = [phone.slice(0, 3), phone.slice(3, 6), phone.slice(6)];\n const pattern = `%${esc(area)}%${esc(exch)}%${esc(line)}%`;\n const accounts = (await sfQuery(\n `SELECT Id, Name, Phone FROM Account WHERE Phone LIKE '${pattern}' LIMIT 2`,\n )).records ?? [];\n\n if (!accounts.length) {\n return { found: false, message: \"No account found with that phone number. The office can check other records.\" };\n }\n if (accounts.length > 1) {\n // Ambiguous: never guess whose account this is. Flagged separately from a\n // genuine no-match so the caller can say \"more than one\" rather than the\n // false \"we have no record of you\".\n return {\n found: false,\n ambiguous: true,\n message: \"That number is on more than one account. The office will need to confirm which one.\",\n };\n }\n\n const c = { AccountId: accounts[0].Id, Account: { Name: accounts[0].Name } };\n const accountName = c.Account?.Name ?? \"your account\";\n let nextDelivery: string | null = null;\n\n if (c.AccountId) {\n const today = new Date().toISOString().slice(0, 10);\n // Deliveries are Opportunities; Route_Date__c is the committed route day,\n // CloseDate the fallback before a route is planned.\n const opps = (await sfQuery(\n `SELECT Id, Route_Date__c, CloseDate FROM Opportunity\n WHERE AccountId = '${esc(String(c.AccountId))}'\n AND StageName = 'Delivery Due'\n AND (Route_Date__c >= ${today} OR (Route_Date__c = null AND CloseDate >= ${today}))\n ORDER BY CloseDate ASC LIMIT 1`,\n )).records ?? [];\n if (opps.length) nextDelivery = opps[0].Route_Date__c ?? opps[0].CloseDate ?? null;\n }\n\n return {\n found: true,\n account_name: accountName,\n next_delivery_date: nextDelivery,\n message: nextDelivery\n ? `Account found. Next scheduled delivery is ${nextDelivery}.`\n : \"Account found, but no delivery is currently scheduled. The office can arrange one.\",\n };\n}\n\n/**\n * Has this visitor already submitted a Lead — through the site's popup, an ad\n * form, anywhere — even though they are not an existing customer?\n *\n * WHY THIS EXISTS. A visitor who filled out the website popup gets a real\n * Salesforce Lead with no connection back to the chat at all — no shared\n * identifier, confirmed 9/3/2026 by checking a real one end to end. If they\n * then start chatting, the bot has no way to know they already gave us their\n * email, and asks for it again from scratch. This closes that gap the same\n * way lookupAccount closes it for actual customers: a narrow, read-only\n * check, called only once the visitor has given the chat a phone or email\n * themselves.\n *\n * TWO SEPARATE ATTEMPTS, TWO SEPARATE try/catch BLOCKS. Lead.Email was found\n * hidden by field-level security for this integration user on 2026-08-25 (see\n * lookupAccount above) — so the email attempt is expected to possibly fail,\n * and it must not be able to take the phone attempt down with it. Left\n * genuinely live rather than skipped outright, because a permission can\n * change without this file knowing, and the only honest way to find out is to\n * try and log what actually comes back.\n */\nasync function lookupLead(phoneRaw, email) {\n const phone = phoneRaw ? normalizePhone(phoneRaw) : null;\n if (!phone && !email) {\n return { found: false, message: \"Need a phone number or email to look up a lead.\" };\n }\n if (phone) {\n const [area, exch, line] = [phone.slice(0, 3), phone.slice(3, 6), phone.slice(6)];\n const pattern = `%${esc(area)}%${esc(exch)}%${esc(line)}%`;\n try {\n const leads = (await sfQuery(`SELECT Id, Company, Status, CreatedDate FROM Lead\n WHERE Phone LIKE '${pattern}' AND IsConverted = false\n ORDER BY CreatedDate DESC LIMIT 2`)).records ?? [];\n if (leads.length === 1) {\n return {\n found: true,\n source: \"phone\",\n company: leads[0].Company ?? null,\n status: leads[0].Status ?? null,\n created_date: leads[0].CreatedDate ? String(leads[0].CreatedDate).slice(0, 10) : null,\n };\n }\n if (leads.length > 1) {\n return { found: false, ambiguous: true, message: \"More than one lead matches that phone number.\" };\n }\n }\n catch (err) {\n console.warn(\"lead-lookup phone query failed:\", String(err).slice(0, 200));\n }\n }\n if (email) {\n try {\n const leads = (await sfQuery(`SELECT Id, Company, Status, CreatedDate FROM Lead\n WHERE Email = '${esc(email)}' AND IsConverted = false\n ORDER BY CreatedDate DESC LIMIT 2`)).records ?? [];\n if (leads.length === 1) {\n return {\n found: true,\n source: \"email\",\n company: leads[0].Company ?? null,\n status: leads[0].Status ?? null,\n created_date: leads[0].CreatedDate ? String(leads[0].CreatedDate).slice(0, 10) : null,\n };\n }\n if (leads.length > 1) {\n return { found: false, ambiguous: true, message: \"More than one lead matches that email address.\" };\n }\n }\n catch (err) {\n // NOT logged as an error — an inaccessible field is an expected,\n // already-documented outcome, not a fault in this code.\n console.warn(\"lead-lookup email query failed (Lead.Email may still be FLS-restricted):\", String(err).slice(0, 200));\n }\n }\n return { found: false, message: \"No matching lead found.\" };\n}\n// Descriptions are read by the AI as instructions, per tawk's docs — so they\n// say when to call and what not to say, not what a developer would want.\nconst openapi = (origin: string) => ({\n openapi: \"3.0.3\",\n info: { title: \"TriBeCa Beverage account tools\", version: \"1.0.0\" },\n servers: [{ url: origin }],\n paths: {\n \"/account-lookup\": {\n get: {\n operationId: \"lookupAccount\",\n summary: \"Look up the customer's own account and next delivery date\",\n description:\n \"Call this when a visitor asks about THEIR OWN account: whether they are already a customer, when their next delivery is, or whether one is scheduled. \" +\n \"You must have a phone number or email address the visitor themselves gave you in this conversation — ask for one if you do not have it. \" +\n \"Never call this with a name only, and never with details the visitor did not provide. \" +\n \"Report only what the response contains. If found is false, say you could not find the account and offer to have the office check. Never confirm or deny whether some other person or business is a customer. \" +\n \"Never promise to change, cancel, or reschedule a delivery — you can only report what is already scheduled.\",\n parameters: [\n {\n name: \"phone\",\n in: \"query\",\n required: false,\n schema: { type: \"string\" },\n description: \"Phone number as the visitor gave it; any common format is fine.\",\n },\n {\n name: \"email\",\n in: \"query\",\n required: false,\n schema: { type: \"string\" },\n description: \"Email address the visitor gave.\",\n },\n ],\n responses: {\n \"200\": {\n description: \"Lookup result, always present even when nothing matched.\",\n content: {\n \"application/json\": {\n schema: {\n type: \"object\",\n properties: {\n found: { type: \"boolean\", description: \"Whether exactly one account matched.\" },\n account_name: { type: \"string\", description: \"Account name on file.\" },\n next_delivery_date: {\n type: \"string\",\n nullable: true,\n description: \"Next scheduled delivery (YYYY-MM-DD), or null if none.\",\n },\n message: {\n type: \"string\",\n description: \"Plain-language summary. Prefer relaying this over inventing wording.\",\n },\n },\n required: [\"found\", \"message\"],\n },\n },\n },\n },\n },\n },\n },\n },\n});\n\n/** The same gate /account-lookup uses. Returns null when the key checks out. */\nfunction rejectUnlessKeyed(req: Request, label: string): Response | null {\n const expected = Deno.env.get(\"APOLLO_TOOL_KEY\");\n if (!expected) return Response.json({ error: \"APOLLO_TOOL_KEY not set on this val\" }, { status: 500 });\n const supplied = req.headers.get(\"x-api-key\");\n if (supplied !== expected) {\n console.warn(\n supplied === null\n ? `${label} REJECTED: no x-api-key header`\n : `${label} REJECTED: x-api-key present but wrong (length ${supplied.length})`,\n );\n return Response.json({ error: \"Unauthorized\" }, { status: 401 });\n }\n return null;\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const origin = url.origin;\n\n if (url.pathname === \"/openapi.json\") return Response.json(openapi(origin));\n\n // Account creation. THE ONLY WRITE IN THIS VAL.\n //\n // POST only, deliberately: a write behind a GET is one link preview or\n // crawler away from creating accounts nobody asked for.\n //\n // This endpoint is NOT in openapi.json. That schema is fetched publicly by\n // tawk, and publishing a create-account tool there would hand it to whichever\n // agent happens to read it. Only our own chat calls this, with the key.\n if (url.pathname === \"/create-account\") {\n if (req.method !== \"POST\") return Response.json({ error: \"POST required\" }, { status: 405 });\n\n const rejected = rejectUnlessKeyed(req, \"create-account\");\n if (rejected) return rejected;\n\n try {\n const { createAccount } = await import(\"./create-account.ts\");\n const result = await createAccount(await req.json().catch(() => ({})));\n // A refusal comes back as HTTP 200 with ok:false. The caller is a chat bot\n // that has to say something to a customer, and \"you already have an\n // account\" or \"a person needs to assign your route\" are answers, not\n // failures — an HTTP error would just become a generic apology.\n return Response.json(result);\n } catch (err) {\n console.error(\"create-account failed:\", err);\n return Response.json({\n ok: false,\n reason: \"error\",\n message: \"The account could not be created right now. The office can set it up.\",\n });\n }\n }\n\n // Balance and pay link. POST only and NOT in openapi.json, for the same\n // reason as /create-account: that schema is public, and this returns money\n // and a link that can update a card on file.\n if (url.pathname === \"/invoice-status\") {\n if (req.method !== \"POST\") return Response.json({ error: \"POST required\" }, { status: 405 });\n\n const rejected = rejectUnlessKeyed(req, \"invoice-status\");\n if (rejected) return rejected;\n\n try {\n const { invoiceStatus } = await import(\"./invoice.ts\");\n const body = await req.json().catch(() => ({}));\n // `authenticated` must mean a real credential check — a signed-in\n // WordPress session. The caller asserts it; this endpoint trusts the\n // caller because the caller holds the key. A phone number is not it.\n const out = await invoiceStatus(body.phone ?? null, { authenticated: body.authenticated === true });\n console.log(`invoice-status found=${out.found} due=${out.balanceDue ?? \"-\"} link=${out.payLink ? \"yes\" : \"no\"}`);\n return Response.json(out);\n } catch (err) {\n console.error(\"invoice-status failed:\", err);\n // A failed query must never read as \"you owe nothing\".\n return Response.json({\n found: false,\n errored: true,\n message: \"I can't check the balance right now. A team member can look it up directly.\",\n });\n }\n }\n\n // NOT IN openapi.json, same reasoning as /create-account and\n // /invoice-status: that schema is fetched publicly by tawk's Apollo agent,\n // and a Lead is closer to a stranger's contact info than an account is —\n // no reason to widen who can query it beyond our own chat, which holds\n // the key.\n if (url.pathname === \"/lead-lookup\") {\n const rejected = rejectUnlessKeyed(req, \"lead-lookup\");\n if (rejected) return rejected;\n\n try {\n const result = await lookupLead(url.searchParams.get(\"phone\"), url.searchParams.get(\"email\"));\n console.log(`lead-lookup found=${result.found} source=${(result as any).source ?? \"-\"}`);\n return Response.json(result);\n } catch (err) {\n console.error(\"lead-lookup failed:\", err);\n return Response.json({\n found: false,\n errored: true,\n message: \"The lookup service is unavailable right now.\",\n });\n }\n }\n\n if (url.pathname === \"/account-lookup\") {\n const expected = Deno.env.get(\"APOLLO_TOOL_KEY\");\n if (!expected) return Response.json({ error: \"APOLLO_TOOL_KEY not set on this val\" }, { status: 500 });\n const supplied = req.headers.get(\"x-api-key\");\n if (supplied !== expected) {\n // Log rejections too, otherwise \"never called\" and \"called with the wrong\n // key\" are indistinguishable when debugging the tawk integration.\n // Never log the value itself — just enough to tell the cases apart.\n console.warn(\n supplied === null\n ? `account-lookup REJECTED: no x-api-key header (headers seen: ${\n [...req.headers.keys()].join(\", \")\n })`\n : `account-lookup REJECTED: x-api-key present but wrong (length ${supplied.length})`,\n );\n return Response.json({ error: \"Unauthorized\" }, { status: 401 });\n }\n try {\n const result = await lookupAccount(url.searchParams.get(\"phone\"), url.searchParams.get(\"email\"));\n console.log(`account-lookup found=${result.found}`);\n return Response.json(result);\n } catch (err) {\n console.error(\"account-lookup failed:\", err);\n // errored is distinct from found:false on purpose. A failed query must\n // never be reported to a visitor as \"no account found\" — that is a\n // different, and wrong, statement about their account.\n // Never leak internals to a customer-facing agent.\n return Response.json({\n found: false,\n errored: true,\n message: \"The lookup service is unavailable right now. The office can check directly.\",\n });\n }\n }\n\n const ok = (v: string) => (Deno.env.get(v) ? \"set\" : \"MISSING\");\n return new Response(\n `Apollo tools\n\n

Apollo tools

tawk → Automation → Integrations → OpenAPI Server:

Schema File URL

${origin}/openapi.json

\nAPI base URL

${origin}

\nAuth: API key · Key x-api-key · Value = APOLLO_TOOL_KEY

APOLLO_TOOL_KEY: ${ok(\"APOLLO_TOOL_KEY\")}

view schema

`,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n}\n","deleted",false,"label","tribeca-apollo",[14],"0979b5fe-99f9-4673-be24-063bb9928dc3",["D",1785197056244],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Read-only Salesforce Account/Opportunity API access","imageUrl","userId","c5acd3b3-60a7-4deb-bc6d-528f83012ea9","pinnedFileId","6093920c-8a18-11f1-a4ec-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f8fe3-60c5-70ee-a317-3aded0417f73","tursoName","0979b5fe99f94673be24063bb9928dc3","tursoHostname","0979b5fe99f94673be24063bb9928dc3-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789491713377],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_106":-5},"org",{"_9":10,"_100":101,"_102":-5,"_56":-5,"_103":104,"_105":42},"branch",{"_35":90,"_11":91,"_22":28,"_92":46,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":12,"_99":10},"isOwned",290,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Tribeca_AIrep","avatar","tier","free","canRestrictVals","profileImageUrl","ctx",{"_83":-5,"_140":141,"_142":143,"_144":145,"_146":42,"_147":42,"_148":42,"_149":32,"_150":-5,"_151":-7,"_152":-7,"_153":64,"_154":42,"_155":42,"_156":-5,"_157":42,"_158":42,"_159":42,"_160":-5},"ENV",{"_111":112,"_113":114,"_115":91,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137,"_138":139},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]