[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_105":106,"_107":108},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","tribeca_airep","name","tribeca-salesforce-agent","path","email-actions.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":58,"_59":32,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/tribeca_airep/tribeca-salesforce-agent/code/email-actions.ts","extension","id","def625b9-ba6f-43e3-8d65-7699d49621b9","fileId","8afdccb8-abcb-11f1-8b09-1607ee4eb77e","parentId","branchId","ceda7ac1-4fbd-45e5-ab28-65082ea4218c","branchVersion",290,"latest",true,"createdAt",["D",1789218214851],"version",36,"fileType","http","content","// Email-driven Salesforce changes for the Gmail add-on (\"Salesforce Account\n// Lookup Sidebar\", Apps Script project 1p2qIBm3…).\n//\n// POST /propose read a customer email + the matched Account / latest\n// Delivery (Opportunity) and return the exact field changes\n// the add-on could make, each with a reason. NOTHING IS\n// WRITTEN HERE. If the email is not about something on the\n// allow-list below, `actions` is empty and the add-on shows\n// only the summary.\n// POST /apply apply a list of changes a person has ticked and approved in\n// the add-on. Re-validated against the same allow-list, then\n// read back from Salesforce so the summary shows what is\n// actually on the record now, not what we asked for.\n//\n// Auth: API_SHARED_SECRET (?key= or x-api-key), same as main.ts, because this\n// file writes.\n//\n// WHY THE ALLOW-LIST IS THIS SMALL. The Connected App runs as the \"Salesforce\n// Agent\" user (005Pm00000rbvjxIAA). Its permission set can EDIT only Account,\n// Opportunity, Lead and Recurring_Delivery_Product__c, and within those only a\n// handful of fields (checked against FieldPermissions on 2026-09-08; Opportunity\n// .Needs_Delivery_ASAP__c was granted edit on 2026-09-09). Anything not listed\n// here either cannot be written by this user at all (Account.Phone, shipping\n// address) or is deliberately kept a human decision (Terms__c,\n// Payment_Method_Type__c, Delivery_Region__c, OwnerId).\n// The model never sees fields outside this list, and the server drops anything\n// it invents anyway.\nimport { sfQuery, sfUpdateMany } from \"./salesforce.ts\";\n\ntype FieldSpec = {\n label: string;\n type: \"string\" | \"number\" | \"date\" | \"email\" | \"picklist\" | \"checkbox\";\n values?: string[];\n hint: string;\n // Extra rule applied to (current, new) before a change is accepted.\n guard?: (current: unknown, next: string, record: Record) => string | null;\n};\n\nconst CATALOG: Record> = {\n Account: {\n Frequency__c: {\n label: \"Delivery Frequency\",\n type: \"picklist\",\n // Values as actually used in the org (counts checked 2026-09-08):\n // 30 Days 12.7k, Call in 7k, Bi-Weekly 2.4k, Cancelled 2.1k, 60 Days 1.1k,\n // Weekly 608. \"15 Days\" and \"4 Weeks\" exist in the picklist but are not\n // used in practice, so the model is not offered them.\n values: [\"Weekly\", \"Bi-Weekly\", \"30 Days\", \"60 Days\", \"Call in\", \"Cancelled\"],\n hint: \"How often the customer gets a standing delivery. 'Cancelled' ends recurring service for good. \" +\n \"Every-other-week / biweekly / twice a month = 'Bi-Weekly'. Monthly = '30 Days'. Every two months = '60 Days'. \" +\n \"'Call in' = no standing schedule, customer calls when they need water.\",\n },\n Amount_of_Bottles__c: {\n label: \"Amount of Bottles\",\n type: \"number\",\n hint: \"Number of 5-gallon bottles per standing delivery.\",\n guard: (_c, n) => Number(n) >= 0 && Number(n) <= 500 ? null : \"bottle count out of range\",\n },\n Water_Type__c: {\n // Free-text field in Salesforce, but the office writes it in a fixed\n // shorthand (ALK 13.9k, SPRING 5.4k, ALKALINE 1.3k, GLASS SPRING 622,\n // ALK/SPRING 222, DISTILLED 192, GLASS ALK 157 ...). Offer only that\n // shorthand so a change lands in the same vocabulary as every other record.\n label: \"Water Type\",\n type: \"picklist\",\n values: [\"ALK\", \"SPRING\", \"DISTILLED\", \"GLASS ALK\", \"GLASS SPRING\", \"ALK/SPRING\"],\n hint: \"Which water the customer receives. ALK = alkaline in plastic 5-gal bottles, SPRING = spring water, \" +\n \"GLASS ... = the same in glass bottles, ALK/SPRING = a mix. 'ALKALINE' on a record means the same as 'ALK' - do not propose that change.\",\n },\n Email_Address__c: {\n label: \"Email Address\",\n type: \"email\",\n hint: \"The customer's contact/billing email on the account.\",\n },\n Name: {\n label: \"Account Name\",\n type: \"string\",\n hint: \"Business or customer name. Only change when the customer explicitly says the name is wrong or has changed.\",\n },\n },\n Opportunity: {\n CloseDate: {\n label: \"Delivery Date\",\n type: \"date\",\n hint: \"The scheduled date of this delivery. Change when the customer asks to move / reschedule the upcoming delivery.\",\n guard: (_c, _n, rec) => rec.StageName === \"Delivery Due\" ? null : \"only a 'Delivery Due' delivery can be rescheduled\",\n },\n // ROUTE DATE IS NOT WRITABLE EITHER, and this one was measured.\n //\n // The rule here used to be \"if Route_Date__c is set, move it to the same new\n // date as the Delivery Date\". Field history, switched on 2026-09-11, made it\n // checkable: of 113 occasions where a PERSON moved a delivery's close date\n // and a route date existed to move, they\n // left it untouched 98 (86.7%)\n // cleared it to null 11 ( 9.7%)\n // moved it to match 2 ( 1.8%) <- what we were proposing\n // set another date 2 ( 1.8%)\n // So the rule was wrong in 98 cases out of 113. Dispatch owns the route; a\n // moved delivery simply falls off it and gets re-planned, which is why the\n // second-place behaviour is clearing rather than moving.\n //\n // Left out of the catalog rather than softened in the prompt, so validate()\n // rejects a Route_Date__c action however it was arrived at. Removed\n // 2026-09-12. If this is ever reconsidered, re-run the measurement first -\n // the query is in the daily review task.\n Needs_Delivery_ASAP__c: {\n label: \"Needs Delivery ASAP\",\n type: \"checkbox\",\n hint: \"Dispatch's urgency flag on this delivery, and the one the office actually acts on. \" +\n \"Tick it whenever the customer is out of water, chasing a delivery that has not come, or says they need it urgently. \" +\n \"Tick it alongside a date change rather than instead of one.\",\n // ONLY EVER SET, NEVER CLEARED. A flag raised in error is visible noise\n // the office can ignore; a flag cleared in error is silent and the\n // customer simply keeps waiting. 326 of ~13,000 open deliveries carry it\n // (2026-09-09), so it is a real signal and not a formality. Unticking\n // stays a human's job.\n guard: (_c, n, rec) => {\n if (n !== \"true\") return \"this flag may only be set, never cleared\";\n return rec.StageName === \"Delivery Due\" ? null : \"only a 'Delivery Due' delivery can be flagged urgent\";\n },\n },\n // STAGE IS DELIBERATELY NOT WRITABLE. Do not put it back.\n //\n // It used to allow 'Delivery Due' -> 'Void Delivery' so that a skip request\n // could cancel the delivery. That is the wrong answer: voiding throws the\n // delivery away instead of postponing it, and the customer is left on a\n // standing order with nothing scheduled. A skip is a DATE change - push the\n // delivery out by one service cycle - which is what the office does by hand.\n // Removed on the owner's instruction, 2026-09-10.\n //\n // Kept out of the catalog rather than merely discouraged in the prompt, so\n // validate() rejects a StageName action outright however it was arrived at.\n },\n};\n\nconst ACCOUNT_URL = \"https://tribecabeverage.lightning.force.com/lightning/r/Account/\";\nconst OPP_URL = \"https://tribecabeverage.lightning.force.com/lightning/r/Opportunity/\";\n\nfunction json(body: unknown, status = 200) {\n return new Response(JSON.stringify(body), { status, headers: { \"Content-Type\": \"application/json\" } });\n}\n\nfunction esc(v: string) {\n return v.replace(/\\\\/g, \"\\\\\\\\\").replace(/'/g, \"\\\\'\");\n}\n\n/** Normalize a proposed value to what Salesforce will accept; null = reject. */\nfunction coerce(spec: FieldSpec, raw: unknown): { value: unknown; error?: string } {\n const s = String(raw ?? \"\").trim();\n switch (spec.type) {\n case \"number\": {\n const n = Number(s);\n return Number.isFinite(n) ? { value: n } : { value: null, error: `'${s}' is not a number` };\n }\n case \"date\": {\n if (!/^\\d{4}-\\d{2}-\\d{2}$/.test(s)) return { value: null, error: `'${s}' is not a YYYY-MM-DD date` };\n const d = new Date(s + \"T12:00:00Z\");\n if (Number.isNaN(d.getTime())) return { value: null, error: `'${s}' is not a real date` };\n return { value: s };\n }\n case \"email\": {\n return /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(s) ? { value: s } : { value: null, error: `'${s}' is not an email address` };\n }\n case \"picklist\": {\n const hit = (spec.values ?? []).find((v) => v.toLowerCase() === s.toLowerCase());\n return hit ? { value: hit } : { value: null, error: `'${s}' is not one of: ${(spec.values ?? []).join(\", \")}` };\n }\n case \"checkbox\": {\n const t = s.toLowerCase();\n if ([\"true\", \"yes\", \"y\", \"1\", \"checked\"].includes(t)) return { value: true };\n if ([\"false\", \"no\", \"n\", \"0\", \"unchecked\"].includes(t)) return { value: false };\n return { value: null, error: `'${s}' is not true or false` };\n }\n default:\n return s.length > 0 && s.length <= 255 ? { value: s } : { value: null, error: \"empty or too long\" };\n }\n}\n\nfunction sameValue(a: unknown, b: unknown) {\n if (a == null && b == null) return true;\n if (typeof a === \"number\" || typeof b === \"number\") return Number(a) === Number(b);\n return String(a ?? \"\").trim().toLowerCase() === String(b ?? \"\").trim().toLowerCase();\n}\n\n/** Human-readable description of the writable surface, for the prompt. */\nfunction describeCatalog() {\n return Object.entries(CATALOG).map(([obj, fields]) =>\n `${obj}:\\n` + Object.entries(fields).map(([f, s]) =>\n ` - ${f} (\"${s.label}\", ${s.type}${s.values ? `, one of: ${s.values.join(\" | \")}` : \"\"}): ${s.hint}`\n ).join(\"\\n\")\n ).join(\"\\n\");\n}\n\nfunction todayInET() {\n const now = new Date();\n const date = now.toLocaleDateString(\"en-CA\", { timeZone: \"America/New_York\" }); // YYYY-MM-DD\n const weekday = now.toLocaleDateString(\"en-US\", { timeZone: \"America/New_York\", weekday: \"long\" });\n // The date an \"expedite this\" email moves the delivery to is TODAY, by the\n // owner's instruction on 2026-09-09. Worth knowing what it does and does not\n // do: the route crons run 5:30-5:40am ET, so today's trucks are already out\n // before the office reads its mail, and this does not put the stop on one.\n // What it does is stop the delivery sitting weeks out and make it read as due\n // now, which is the office's cue to fit it in. Actual dispatch still needs\n // Route_Date__c, which this integration user may not set from empty.\n return { date, weekday, soonestDate: date };\n}\n\nconst PROPOSAL_SCHEMA = {\n type: \"OBJECT\",\n properties: {\n relevant: { type: \"BOOLEAN\", description: \"true only if the email asks for something that maps to a listed field\" },\n summary: { type: \"STRING\", description: \"one or two plain-English sentences: what the customer wants\" },\n recommendation: { type: \"STRING\", description: \"what staff should do; 'No action needed' if nothing\" },\n needs_human: { type: \"STRING\", description: \"anything the customer asked for that is NOT covered by the listed fields (address change, billing dispute, equipment, complaints...). Empty string if none.\" },\n actions: {\n type: \"ARRAY\",\n items: {\n type: \"OBJECT\",\n properties: {\n sobject: { type: \"STRING\", description: \"Account or Opportunity\" },\n field: { type: \"STRING\", description: \"API name exactly as listed\" },\n newValue: { type: \"STRING\", description: \"the new value; dates as YYYY-MM-DD\" },\n reason: { type: \"STRING\", description: \"one sentence quoting or paraphrasing the customer's request\" },\n assumed: { type: \"BOOLEAN\", description: \"true ONLY when the customer wanted the delivery sooner but named no date, so you chose the next working day for them. false whenever the customer named the value themselves.\" },\n },\n required: [\"sobject\", \"field\", \"newValue\", \"reason\", \"assumed\"],\n },\n },\n },\n required: [\"relevant\", \"summary\", \"recommendation\", \"needs_human\", \"actions\"],\n};\n\n// PRIMARY MODEL: Claude Opus 5, reached through claude-json.ts in\n// Tribeca_Rep/tribeca-chat. That val is on a different Val Town account and is\n// the one holding ANTHROPIC_API_KEY; secrets cannot be read or shared across\n// accounts, so the call is proxied to where the key already lives (gated by\n// LLM_PROXY_KEY, set on both vals). The Gemini JSON schema below is plain JSON\n// Schema apart from upper-case type names, so one schema serves both.\nconst CLAUDE_PROXY_URL = \"https://tribeca_rep--586be75cabd111f196d01607ee4eb77e.web.val.run\";\n\nfunction toJsonSchema(node: any): any {\n if (Array.isArray(node)) return node.map(toJsonSchema);\n if (node && typeof node === \"object\") {\n const out: any = {};\n for (const [k, v] of Object.entries(node)) {\n out[k] = k === \"type\" && typeof v === \"string\" ? v.toLowerCase() : toJsonSchema(v);\n }\n if (out.type === \"object\" && out.properties && out.additionalProperties === undefined) {\n out.additionalProperties = false;\n }\n return out;\n }\n return node;\n}\n\nasync function callClaude(prompt: string, model?: string): Promise<{ out: any; model: string }> {\n const key = Deno.env.get(\"LLM_PROXY_KEY\");\n if (!key) throw new Error(\"LLM_PROXY_KEY not set\");\n const res = await fetch(CLAUDE_PROXY_URL, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", \"x-proxy-key\": key },\n body: JSON.stringify({\n prompt,\n schema: toJsonSchema(PROPOSAL_SCHEMA),\n effort: \"medium\",\n max_tokens: 4000,\n // Caller may ask for a cheaper model. The proxy owns the allow-list, so\n // an unknown name falls back to its default rather than erroring. The\n // background sweep uses Sonnet; a person pressing Analyze gets the default.\n ...(model ? { model } : {}),\n }),\n signal: AbortSignal.timeout(50_000),\n });\n const data = await res.json().catch(() => ({}));\n if (!res.ok || !data?.ok) {\n throw new Error(`Claude proxy ${res.status}: ${data?.error ?? \"no body\"}`);\n }\n return { out: data.parsed, model: String(data.model ?? \"claude\") };\n}\n\n// Claude first; Gemini only if the proxy is unreachable or declines, so an\n// outage on one provider does not take the Analyze button down.\nasync function callModel(prompt: string, model?: string): Promise<{ out: any; model: string }> {\n try {\n return await callClaude(prompt, model);\n } catch (err) {\n console.error(\"claude failed, falling back to gemini:\", String(err).slice(0, 300));\n const out = await callGemini(prompt);\n return { out, model: \"gemini-flash-latest (fallback)\" };\n }\n}\n\n// FALLBACK MODEL. 429/503 from Gemini are transient (the shared \"flash-latest\"\n// alias gets overloaded), so retry a couple of times before giving up - the\n// person is waiting on a button press in Gmail, not a batch.\nasync function callGemini(prompt: string) {\n const apiKey = Deno.env.get(\"GEMINI_API_KEY\");\n let lastErr = \"\";\n for (let attempt = 0; attempt < 3; attempt++) {\n if (attempt > 0) await new Promise((r) => setTimeout(r, 1200 * attempt));\n const res = await fetch(\n `https://generativelanguage.googleapis.com/v1beta/models/gemini-flash-latest:generateContent?key=${apiKey}`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n contents: [{ parts: [{ text: prompt }] }],\n generationConfig: {\n temperature: 0.1,\n responseMimeType: \"application/json\",\n responseSchema: PROPOSAL_SCHEMA,\n },\n }),\n },\n );\n if (res.status === 429 || res.status === 503) {\n lastErr = `Gemini ${res.status}: ${(await res.text()).slice(0, 300)}`;\n console.log(\"gemini retryable\", lastErr);\n continue;\n }\n if (!res.ok) throw new Error(`Gemini request failed: ${res.status} ${(await res.text()).slice(0, 500)}`);\n const data = await res.json();\n const text = data?.candidates?.[0]?.content?.parts?.[0]?.text ?? \"\";\n return JSON.parse(text.replace(/```json|```/g, \"\").trim());\n }\n throw new Error(`Gemini unavailable after 3 attempts. ${lastErr}`);\n}\n\nfunction buildPrompt(emailText: string, account: Record | null, opportunity: Record | null) {\n const { date, weekday, soonestDate } = todayInET();\n return `You help office staff at Tribeca Beverage (5-gallon bottled water delivery, NYC / NJ / Florida) act on customer emails inside Salesforce.\n\nToday is ${weekday}, ${date} (America/New_York). Resolve relative dates (\"next Tuesday\", \"the 15th\") against today; a date with no year is the next occurrence.\n\nCustomer email:\n\"\"\"\n${emailText}\n\"\"\"\n\nMatched Salesforce Account (current values, read-only JSON):\n${JSON.stringify(account)}\n\nLatest delivery record for that account (Opportunity, current values):\n${JSON.stringify(opportunity)}\n\nThe ONLY fields that can be changed, with their meaning:\n${describeCatalog()}\n\nRules:\n- Propose a change ONLY when this email asks for it and it maps to one of the fields above. Never infer or \"improve\" anything the customer did not ask for. The single exception is the expedite rule below.\n- EXPEDITE. If the customer wants their delivery sooner - they are chasing a delivery that has not arrived, saying they are out of water, asking why nothing has come, or complaining that they have been asking for a while - propose BOTH of these: Opportunity.Needs_Delivery_ASAP__c = true (assumed=false, this is what they are actually asking for), and, when they named no date, Opportunity.CloseDate = ${soonestDate} (today) with assumed=true and a reason saying they did not name a date. If they DID name a date, use their date with assumed=false and still tick the urgency flag.\n- Set assumed=false on every change where the customer named the value themselves, and never use assumed for anything except a delivery date they left unsaid.\n- Do NOT expedite when the customer is only asking a question, disputing a bill, or is content with the date already on the record.\n- Never propose a value equal to the current value.\n- SKIP. If the customer wants to skip, hold, postpone or cancel THIS upcoming delivery, never void or cancel the delivery record - move it. Propose Opportunity.CloseDate pushed forward, assumed=false: to the date or timeframe they named if they named one, otherwise by one service cycle from the current CloseDate using Account.Frequency__c (Weekly +7 days, Bi-Weekly +14, 30 Days +30, 60 Days +60). If Frequency__c is \"Call in\" or missing, propose no date and put it in needs_human instead. Never tick Needs_Delivery_ASAP__c on a skip.\n- CANCELLING SERVICE IS NOT A SKIP, and it is the most damaging thing on this list: Account.Frequency__c = \"Cancelled\" ends every future delivery, not just this one. Propose it ONLY when the customer plainly says they want to stop service for good - \"cancel my service\", \"close the account\", \"we are switching suppliers\", \"stop deliveries permanently\". Wording like \"not at this time\", \"not right now\", \"we don't need any this week\", \"skip this one\", \"hold off\", \"pause\", \"we're fine for now\" is a SKIP: move the date and leave Frequency__c alone. If you genuinely cannot tell which one they mean, propose nothing and say so in needs_human.\n- If the customer wants a different delivery day, change Opportunity.CloseDate and nothing else. Do NOT touch the route date: dispatch owns it, and when the office moves a delivery they leave the route date alone 87% of the time and clear it the rest. Moving it is not our call.\n- WHICH DAY, when the customer names a WEEK rather than a date (\"the week of the 21st\", \"next week\"). If the email itself states a close-date rule, follow the email. Otherwise use the account's Frequency__c: for \"Weekly\" or \"Bi-Weekly\" pick the FRIDAY of that week - that is the house pattern, 67% and 78% of those deliveries respectively fall on a Friday (measured 2026-09-11). For \"30 Days\" and \"60 Days\" there is NO house pattern, so keep the same weekday as the delivery's current Close Date rather than inventing one.\n- Anything requested that is not covered above goes in needs_human, not in actions.\n- If the email is spam, a vendor, an internal message, or not a customer request, set relevant=false with an empty actions list.\n- Address the account by name in summary/recommendation when useful. Be brief.`;\n}\n\ntype Action = { sobject: string; id: string; field: string; newValue: unknown };\n\n/** Validate raw actions against the catalog and the current records. */\nfunction validate(\n raw: any[],\n records: Record | null>, // { Account: {...}, Opportunity: {...} }\n) {\n const accepted: any[] = [];\n const skipped: any[] = [];\n const seen = new Set();\n for (const a of Array.isArray(raw) ? raw : []) {\n const sobject = String(a?.sobject ?? \"\");\n const field = String(a?.field ?? \"\");\n const spec = CATALOG[sobject]?.[field];\n const rec = records[sobject];\n const why = (reason: string) => skipped.push({ sobject, field, newValue: a?.newValue, reason });\n if (!spec) { why(\"not an allowed object/field\"); continue; }\n if (!rec || !rec.Id) { why(`no ${sobject} record in context`); continue; }\n if (a?.id && a.id !== rec.Id) { why(\"record id does not match the matched record\"); continue; }\n if (seen.has(sobject + \".\" + field)) { why(\"duplicate\"); continue; }\n const { value, error } = coerce(spec, a?.newValue);\n if (error) { why(error); continue; }\n if (sameValue(rec[field], value)) { why(\"already set to that value\"); continue; }\n const g = spec.guard?.(rec[field], String(value), rec);\n if (g) { why(g); continue; }\n // An ASSUMED date is one the customer never said out loud, so it gets a\n // rule the model cannot talk its way past: it must be a date field, and it\n // must move the delivery EARLIER. That is the whole point of expediting.\n // It also means an already-overdue delivery is left alone rather than\n // quietly pushed out, and \"assumed\" can never be borrowed to justify\n // changing water type, frequency or anything else unasked.\n const assumed = a?.assumed === true;\n if (assumed) {\n if (spec.type !== \"date\") { why(\"only a date may be assumed\"); continue; }\n const current = String(rec[field] ?? \"\");\n if (!current) { why(\"cannot assume a date when the record has none\"); continue; }\n if (String(value) >= current) { why(`assumed date ${value} is not earlier than the current ${current}`); continue; }\n // AND IT MUST NOT HAVE GONE STALE. An assumed date is always \"today\" at\n // the moment the email was analysed, but the proposal sits on the panel\n // until someone looks at it - overnight, or over a weekend. Applying it\n // then would backdate the delivery to a day nobody chose, and the rule\n // above cannot catch it because a past date is still earlier than the\n // one on the record. Seen on a real row the morning after, 2026-09-11.\n const today = todayInET().date;\n if (String(value) < today) {\n why(`assumed date ${value} was today's date when this was analysed and is now in the past; re-analyse the email`);\n continue;\n }\n }\n seen.add(sobject + \".\" + field);\n accepted.push({\n sobject,\n id: rec.Id,\n recordName: rec.Name ?? null,\n recordUrl: (sobject === \"Account\" ? ACCOUNT_URL : OPP_URL) + rec.Id + \"/view\",\n field,\n label: spec.label,\n currentValue: rec[field] ?? null,\n newValue: value,\n assumed,\n reason: String(a?.reason ?? \"\").slice(0, 300),\n });\n }\n return { accepted, skipped };\n}\n\nconst READBACK_FIELDS: Record = {\n Account: \"Id, Name, Frequency__c, Amount_of_Bottles__c, Water_Type__c, Email_Address__c\",\n Opportunity: \"Id, Name, StageName, CloseDate, Route_Date__c, Route_Name__c, Needs_Delivery_ASAP__c\",\n};\n\nasync function fetchRecord(sobject: string, id: string) {\n const fields = READBACK_FIELDS[sobject];\n if (!fields || !/^[a-zA-Z0-9]{15,18}$/.test(id)) return null;\n const r = await sfQuery(`SELECT ${fields} FROM ${sobject} WHERE Id = '${esc(id)}' LIMIT 1`);\n return r.records?.[0] ?? null;\n}\n\nasync function propose(body: any) {\n const emailText = String(body.emailText ?? \"\").slice(0, 6000);\n if (!emailText.trim()) return json({ error: \"emailText is required\" }, 400);\n const account = body.account ?? null;\n const opportunity = body.opportunity ?? null;\n if (!account?.Id) {\n // No customer matched: nothing on the allow-list can apply. Still give a summary so the card is useful.\n const { out, model } = await callModel(buildPrompt(emailText, null, null), body.model);\n return json({ relevant: false, model, summary: out.summary ?? \"\", recommendation: out.recommendation ?? \"\", needs_human: out.needs_human ?? \"\", actions: [], skipped: [] });\n }\n // Refresh from Salesforce so the model reasons about (and we diff against) live values,\n // not the copy the add-on cached when the card first rendered.\n const [liveAccount, liveOpp] = await Promise.all([\n fetchRecord(\"Account\", String(account.Id)),\n opportunity?.Id ? fetchRecord(\"Opportunity\", String(opportunity.Id)) : Promise.resolve(null),\n ]);\n const acct = liveAccount ?? account;\n const opp = liveOpp ?? opportunity;\n const { out, model } = await callModel(buildPrompt(emailText, acct, opp), body.model);\n const { accepted, skipped } = validate(out.actions, { Account: acct, Opportunity: opp });\n return json({\n relevant: Boolean(out.relevant) && accepted.length > 0,\n model,\n summary: out.summary ?? \"\",\n recommendation: out.recommendation ?? \"\",\n needs_human: out.needs_human ?? \"\",\n actions: accepted,\n skipped,\n });\n}\n\nasync function apply(body: any) {\n // Second factor on top of the shared API key: the person pressing Apply in\n // Gmail must type the approval password. Checked here, not in Apps Script,\n // so it never sits in the add-on source. Fails closed if the env var is\n // missing - a misconfigured val must not become an open write path.\n const expected = Deno.env.get(\"EMAIL_ACTIONS_APPROVAL_PASSWORD\");\n if (!expected) return json({ error: \"Approval password is not configured on the server\", code: \"no_password\" }, 500);\n if (String(body.password ?? \"\") !== expected) {\n return json({ error: \"Incorrect approval password. Nothing was changed.\", code: \"bad_password\" }, 403);\n }\n const actions: Action[] = Array.isArray(body.actions) ? body.actions : [];\n if (actions.length === 0) return json({ error: \"actions is empty\" }, 400);\n if (actions.length > 20) return json({ error: \"at most 20 changes per call\" }, 400);\n\n // Re-read every touched record: the approval may be minutes old and the\n // guards (stage, route date) must be judged against what is there NOW.\n const ids = new Map(); // key sobject|id\n for (const a of actions) ids.set(`${a.sobject}|${a.id}`, a.id);\n const live: Record> = {};\n await Promise.all([...ids.keys()].map(async (k) => {\n const [sobject, id] = k.split(\"|\");\n const rec = await fetchRecord(sobject, id);\n if (rec) live[k] = rec;\n }));\n\n const accepted: any[] = [];\n const rejected: any[] = [];\n for (const a of actions) {\n const rec = live[`${a.sobject}|${a.id}`] ?? null;\n const v = validate([a], { [a.sobject]: rec } as any);\n if (v.accepted.length) accepted.push(v.accepted[0]);\n else rejected.push({ ...a, reason: v.skipped[0]?.reason ?? (rec ? \"rejected\" : \"record not found\") });\n }\n\n // One PATCH per record, grouped by object, allOrNone off - Salesforce reports\n // each record's own verdict and we pass it through.\n const results: any[] = [];\n const bySobject = new Map>();\n for (const a of accepted) {\n if (!bySobject.has(a.sobject)) bySobject.set(a.sobject, new Map());\n const m = bySobject.get(a.sobject)!;\n if (!m.has(a.id)) m.set(a.id, []);\n m.get(a.id)!.push(a);\n }\n for (const [sobject, byId] of bySobject) {\n const records = [...byId.entries()].map(([id, acts]) => ({\n id,\n fields: Object.fromEntries(acts.map((a) => [a.field, a.newValue])),\n }));\n let verdicts: any[] = [];\n let callError: string | null = null;\n try {\n verdicts = await sfUpdateMany(sobject, records);\n } catch (err) {\n callError = String(err);\n }\n for (let i = 0; i < records.length; i++) {\n const verdict = verdicts[i];\n const ok = !callError && verdict?.success === true;\n const error = callError ?? (ok ? null : (verdict?.errors ?? []).map((e: any) => e.message).join(\"; \") || \"update failed\");\n const after = ok ? await fetchRecord(sobject, records[i].id) : null;\n for (const a of byId.get(records[i].id)!) {\n const confirmed = after ? after[a.field] ?? null : null;\n results.push({\n ...a,\n ok: ok && sameValue(confirmed, a.newValue),\n confirmedValue: confirmed,\n error: ok ? (sameValue(confirmed, a.newValue) ? null : \"Salesforce accepted the update but the field reads back differently (an automation may have changed it)\") : error,\n });\n }\n }\n }\n\n const applied = results.filter((r) => r.ok).length;\n const failed = results.length - applied + rejected.length;\n return json({\n applied,\n failed,\n results,\n rejected,\n summary: `${applied} change${applied === 1 ? \"\" : \"s\"} applied` + (failed ? `, ${failed} not applied` : \"\") + \".\",\n });\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const providedKey = url.searchParams.get(\"key\") ?? req.headers.get(\"x-api-key\");\n // Rotated 2026-09-10; the previous key is no longer accepted. See main.ts.\n if (providedKey !== Deno.env.get(\"API_SHARED_SECRET\")) {\n return new Response(\"Unauthorized\", { status: 401 });\n }\n if (req.method === \"GET\") {\n return json({ ok: true, routes: [\"POST /propose\", \"POST /apply\"], catalog: Object.fromEntries(Object.entries(CATALOG).map(([o, f]) => [o, Object.keys(f)])) });\n }\n if (req.method !== \"POST\") return json({ error: \"POST required\" }, 405);\n let body: any;\n try {\n body = await req.json();\n } catch {\n return json({ error: \"Invalid JSON body\" }, 400);\n }\n try {\n if (url.pathname.endsWith(\"/propose\")) return await propose(body);\n if (url.pathname.endsWith(\"/apply\")) return await apply(body);\n return json({ error: \"unknown route; use /propose or /apply\" }, 404);\n } catch (err) {\n // 500, not 502: Val Town's edge replaces a 502 body with its own\n // \"error code: 502\" page, which would hide the message from the add-on.\n return json({ error: String(err) }, 500);\n }\n}\n","deleted",false,"label",[14],"0979b5fe-99f9-4673-be24-063bb9928dc3",["D",1785197056244],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Read-only Salesforce Account/Opportunity API access","imageUrl","userId","c5acd3b3-60a7-4deb-bc6d-528f83012ea9","pinnedFileId","6093920c-8a18-11f1-a4ec-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f8fe3-60c5-70ee-a317-3aded0417f73","tursoName","0979b5fe99f94673be24063bb9928dc3","tursoHostname","0979b5fe99f94673be24063bb9928dc3-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789491713377],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_104":-5},"org",{"_9":10,"_98":99,"_100":-5,"_55":-5,"_101":102,"_103":42},"branch",{"_35":30,"_11":89,"_22":28,"_90":45,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":12,"_97":10},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Tribeca_AIrep","avatar","tier","free","canRestrictVals","profileImageUrl","ctx",{"_82":-5,"_138":139,"_140":141,"_142":143,"_144":42,"_145":42,"_146":42,"_147":32,"_148":-5,"_149":-7,"_150":-7,"_151":63,"_152":42,"_153":42,"_154":-5,"_155":42,"_156":42,"_157":42,"_158":-5},"ENV",{"_109":110,"_111":112,"_113":89,"_114":115,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]