[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_248":249,"_250":251},"routes/_app.x.$handle.$name",{"_100":99,"_32":45,"_109":90,"_27":110,"_13":14,"_111":-5,"_11":112,"_113":114,"_115":116,"_117":118,"_119":120,"_20":-5,"_121":-5,"_122":-5,"_123":25,"_124":125,"_126":59,"_127":-5,"_128":-5,"_129":130},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":25},"version",69,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","salesforce.ts","latestPath","fileId","186d5df2-a5a5-11f1-8342-1607ee4eb77e","name","fileType","script","content","// Salesforce lookup — deterministic, never a model decision.\n//\n// Calls the same narrow endpoint the other three vals use, inside\n// tribeca-salesforce-agent. That val holds the Salesforce credentials; this\n// key unlocks only the one read-only account lookup, never arbitrary SOQL.\n//\n// PHONE IS THE ONLY ROUTE. The Salesforce integration user cannot read Contact\n// at all, Account has no email column, and Lead.Email is hidden by field-level\n// security (verified by schema probe 8/25/2026). An email address, however\n// confidently a customer supplies it, cannot be resolved.\n\nconst ENDPOINT = \"https://tribeca-apollo.val.run/account-lookup\";\n\nexport interface LookupResult {\n found: boolean;\n account_name?: string;\n next_delivery_date?: string | null;\n message: string;\n // found:false arrives in three distinct flavours. They are kept separate on\n // purpose: reporting a failed query as \"no account found\" is a different,\n // and wrong, statement about a real customer.\n needs_phone?: boolean;\n ambiguous?: boolean;\n errored?: boolean;\n}\n\nconst PHONE_RE = /(?:\\+?1[\\s.\\-]?)?\$?\\d{3}\$?[\\s.\\-]?\\d{3}[\\s.\\-]?\\d{4}/;\n\n/** Pull the first plausible 10-digit US number out of free text. */\nexport function scanForPhone(text: string): string | null {\n const m = String(text ?? \"\").match(PHONE_RE);\n if (!m) return null;\n\n let d = m[0].replace(/\\D/g, \"\");\n if (d.length === 11 && d.startsWith(\"1\")) d = d.slice(1);\n return d.length === 10 ? d : null;\n}\n\nexport async function lookupByPhone(phone: string): Promise {\n const key = Deno.env.get(\"APOLLO_TOOL_KEY\");\n if (!key) {\n console.error(\"APOLLO_TOOL_KEY not set — skipping Salesforce lookup\");\n return null;\n }\n\n try {\n const res = await fetch(`${ENDPOINT}?phone=${encodeURIComponent(phone)}`, {\n headers: { \"x-api-key\": key },\n // Two SOQL queries behind a possible cold start. Longer than this and\n // the customer is watching a spinner; shorter and legitimate lookups\n // get cut off.\n signal: AbortSignal.timeout(9000),\n });\n\n if (!res.ok) {\n console.error(`account-lookup HTTP ${res.status}`);\n return null;\n }\n\n return await res.json();\n } catch (err) {\n // An outage is not an answer. Returning null means the caller stores\n // nothing, so the panel stays empty rather than asserting something false.\n console.error(\"account-lookup failed:\", err);\n return null;\n }\n}\n","// Salesforce lookup — deterministic, never a model decision.\n//\n// Calls the same narrow endpoint the other three vals use, inside\n// tribeca-salesforce-agent. That val holds the Salesforce credentials; this\n// key unlocks only the one read-only account lookup, never arbitrary SOQL.\n//\n// PHONE IS THE ONLY ROUTE. The Salesforce integration user cannot read Contact\n// at all, Account has no email column, and Lead.Email is hidden by field-level\n// security (verified by schema probe 8/25/2026). An email address, however\n// confidently a customer supplies it, cannot be resolved.\n\nconst ENDPOINT = \"https://tribeca-apollo.val.run/account-lookup\";\nconst INVOICE_ENDPOINT = \"https://tribeca-apollo.val.run/invoice-status\";\n\nexport interface InvoiceResult {\n found: boolean;\n ambiguous?: boolean;\n errored?: boolean;\n balanceDue?: number;\n invoiceNumber?: string | null;\n status?: string | null;\n dueDate?: string | null;\n /** Only ever present for a signed-in visitor. See invoice.ts on the tool val. */\n payLink?: string;\n emailOnFile?: string | null;\n message: string;\n}\n\n/**\n * What this customer owes, and — only for a signed-in visitor — the pay link.\n *\n * `authenticated` must mean a real credential check: a WordPress/WooCommerce\n * session, which is what `wpUserId` on the visitor represents. A phone number\n * typed into the chat box is NOT authentication. The pay link exposes the\n * invoice with its line items and updates the card on file, and it is keyed\n * only on a Salesforce record id rather than a secret token — so handing it to\n * someone who merely guessed a phone number would be handing over a stranger's\n * bill.\n *\n * Called fresh on each turn rather than cached: a stale balance shown to a\n * customer who has just paid is its own kind of wrong.\n */\nexport async function invoiceStatus(\n phone: string,\n authenticated: boolean,\n): Promise {\n const key = Deno.env.get(\"APOLLO_TOOL_KEY\");\n if (!key) {\n console.error(\"APOLLO_TOOL_KEY not set — skipping invoice lookup\");\n return null;\n }\n\n try {\n const res = await fetch(INVOICE_ENDPOINT, {\n method: \"POST\",\n headers: { \"x-api-key\": key, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ phone, authenticated }),\n signal: AbortSignal.timeout(9000),\n });\n if (!res.ok) {\n console.error(`invoice-status HTTP ${res.status}`);\n return null;\n }\n return await res.json();\n } catch (err) {\n // Same rule as the account lookup: an outage is not an answer. Null means\n // the model is told nothing about a balance rather than told there is none.\n console.error(\"invoice-status failed:\", err);\n return null;\n }\n}\n\nexport interface LookupResult {\n found: boolean;\n account_name?: string;\n next_delivery_date?: string | null;\n message: string;\n // found:false arrives in three distinct flavours. They are kept separate on\n // purpose: reporting a failed query as \"no account found\" is a different,\n // and wrong, statement about a real customer.\n needs_phone?: boolean;\n ambiguous?: boolean;\n errored?: boolean;\n}\n\nconst PHONE_RE = /(?:\\+?1[\\s.\\-]?)?\$?\\d{3}\$?[\\s.\\-]?\\d{3}[\\s.\\-]?\\d{4}/;\n\n/** Pull the first plausible 10-digit US number out of free text. */\nexport function scanForPhone(text: string): string | null {\n const m = String(text ?? \"\").match(PHONE_RE);\n if (!m) return null;\n\n let d = m[0].replace(/\\D/g, \"\");\n if (d.length === 11 && d.startsWith(\"1\")) d = d.slice(1);\n return d.length === 10 ? d : null;\n}\n\nexport async function lookupByPhone(phone: string): Promise {\n const key = Deno.env.get(\"APOLLO_TOOL_KEY\");\n if (!key) {\n console.error(\"APOLLO_TOOL_KEY not set — skipping Salesforce lookup\");\n return null;\n }\n\n try {\n const res = await fetch(`${ENDPOINT}?phone=${encodeURIComponent(phone)}`, {\n headers: { \"x-api-key\": key },\n // Two SOQL queries behind a possible cold start. Longer than this and\n // the customer is watching a spinner; shorter and legitimate lookups\n // get cut off.\n signal: AbortSignal.timeout(9000),\n });\n\n if (!res.ok) {\n console.error(`account-lookup HTTP ${res.status}`);\n return null;\n }\n\n return await res.json();\n } catch (err) {\n // An outage is not an answer. Returning null means the caller stores\n // nothing, so the panel stays empty rather than asserting something false.\n console.error(\"account-lookup failed:\", err);\n return null;\n }\n}\n","createdAt",["D",1788277577931],"branchVersion","branchId","7f3f9c05-d6ad-413b-a869-bc1a5f60764f","id","53b5cfec-2084-4c81-ba38-78b35a1e8625","tribeca-chat",["D",1788226289223],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Chat widget, AI answering, human takeover, Salesforce","imageUrl","c5acd3b3-60a7-4deb-bc6d-528f83012ea9","pinnedFileId","db056860-a5a4-11f1-8f50-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f8fe2-cdfc-775d-a845-a69af13d39cb","tursoName","53b5cfec20844c81ba3878b35a1e8625","tursoHostname","53b5cfec20844c81ba3878b35a1e8625-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789484509295],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_100":99,"_108":104},"org",{"_100":99,"_101":102,"_103":104,"_18":55,"_105":106,"_107":25},"branch",{"_13":89,"_32":90,"_43":42,"_91":44,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":45,"_98":99},"isOwned",709,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","Tribeca_Rep","handle","displayName","M A","avatar","https://lh3.googleusercontent.com/a/ACg8ocI9znhXn2hWp1wjjyWzeuOyoO_JrDgJo8aD0umFraR7bAG3UAmc=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":243,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":244,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":245,"_84":246,"_86":247,"_88":25},"tree",[210,211,212,213,214,215,216,217],"files",[210,211,212,213,214,215,216,217],"counts",{"_199":63,"_200":152,"_201":63,"_202":203,"_204":205},"contents",[131,132,133,134,135,136,137,138],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":191,"_32":192,"_30":193,"_142":-5,"_41":42,"_40":194,"_144":25,"_38":195,"_13":196,"_33":34,"_35":197,"_24":25,"_148":-5,"_27":198},{"_43":184,"_32":185,"_30":186,"_142":-5,"_41":42,"_40":187,"_144":59,"_38":188,"_13":63,"_33":34,"_35":189,"_24":25,"_148":-5,"_27":190},{"_43":177,"_32":178,"_30":179,"_142":-5,"_41":42,"_40":180,"_144":59,"_38":181,"_13":63,"_33":34,"_35":182,"_24":25,"_148":-5,"_27":183},{"_43":169,"_32":170,"_30":171,"_142":-5,"_41":42,"_40":172,"_144":25,"_38":173,"_13":174,"_33":34,"_35":175,"_24":25,"_148":-5,"_27":176},{"_43":161,"_32":162,"_30":57,"_142":-5,"_41":42,"_40":163,"_144":25,"_38":164,"_13":165,"_33":166,"_35":167,"_24":25,"_148":45,"_27":168},{"_43":154,"_32":155,"_30":156,"_142":-5,"_41":42,"_40":157,"_144":25,"_38":158,"_13":63,"_33":34,"_35":159,"_24":25,"_148":-5,"_27":160},{"_43":150,"_32":28,"_30":31,"_142":-5,"_41":42,"_40":14,"_144":25,"_38":151,"_13":152,"_33":34,"_35":37,"_24":25,"_148":-5,"_27":153},{"_43":139,"_32":140,"_30":141,"_142":-5,"_41":42,"_40":143,"_144":25,"_38":145,"_13":146,"_33":34,"_35":147,"_24":25,"_148":-5,"_27":149},"2d9ee119-7f8b-4377-a830-998ef8cb8cb2","widget.ts","3cd4f40c-a5a5-11f1-ac9a-1607ee4eb77e","parentId",49,"latest",["D",1788268280773],10,"// Visitor widget.\n//\n// Served from /widget.js and embedded with a single script tag. No build step,\n// no dependencies.\n//\n// SHADOW DOM, NOT AN IFRAME. tawk uses a cross-origin iframe, which is exactly\n// what stopped us injecting anything into the conversation all day — no\n// buttons, no cards, no reading what the visitor typed except through its own\n// callbacks. A shadow root gives full isolation from the WooCommerce theme's\n// CSS while leaving the DOM ours to do anything with.\n//\n// Enrichment is read from window.TribecaChat, set by the WordPress snippet\n// before this loads. Absent that, the visitor is simply anonymous — and unlike\n// tawk, an anonymous visitor still displays everything we know, because the\n// dashboard is ours.\n\nexport const WIDGET_JS = /* js */ `(function () {\n if (window.__tribecaChatLoaded) return;\n window.__tribecaChatLoaded = true;\n\n var API = document.currentScript\n ? new URL(document.currentScript.src).origin\n : '';\n var WP = window.TribecaChat || {};\n\n // Returning visitors keep their history and their resolved account.\n var visitorId = null;\n try { visitorId = localStorage.getItem('tribecaChatVisitor'); } catch (e) {}\n\n // Global Privacy Control is the opt-out signal with legal weight behind it\n // in several US states; Do Not Track has none but costs nothing to respect.\n // Only readable here, so the verdict is sent to the server rather than the\n // raw signals. When set, the chat still works — nothing is profiled.\n var DNT = 0;\n try {\n if (navigator.globalPrivacyControl === true ||\n navigator.doNotTrack === '1' ||\n window.doNotTrack === '1' ||\n navigator.msDoNotTrack === '1') DNT = 1;\n } catch (e) {}\n\n var conversationId = null;\n var since = 0;\n var es = null;\n var open = false;\n var awaitingAI = false;\n var seen = {};\n\n // Bodies of messages drawn optimistically on send, awaiting their echo from\n // the stream. Without this the visitor sees everything they type twice: once\n // instantly with a local id, once again with the real one.\n var pendingLocal = [];\n\n /* -------------------------------------------------------------- shell */\n\n // Presence-only mode. The script loads on every page and reports who is on\n // the site, but renders nothing at all — no bubble, no panel, no shadow root.\n // This is how you get full visitor statistics while another chat product is\n // still the one customers actually talk to.\n if (WP.hidden) {\n var quiet = null;\n try { quiet = localStorage.getItem('tribecaChatVisitor'); } catch (e) {}\n\n var ping = function () {\n fetch(API + '/api/presence', {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n visitorId: quiet,\n pageUrl: location.href,\n referrer: document.referrer || null,\n dnt: DNT,\n name: WP.name, email: WP.email, phone: WP.phone,\n zip: WP.zip, company: WP.company, wpUserId: WP.wpUserId\n })\n })\n .then(function (r) { return r.json(); })\n .then(function (d) {\n if (d.visitorId && !quiet) {\n quiet = d.visitorId;\n try { localStorage.setItem('tribecaChatVisitor', quiet); } catch (e) {}\n }\n })\n .catch(function () {});\n };\n\n ping();\n setInterval(function () {\n if (document.visibilityState === 'visible') ping();\n }, 45000);\n return;\n }\n\n var host = document.createElement('div');\n host.style.cssText = 'position:fixed;bottom:0;right:0;z-index:2147483000;';\n document.body.appendChild(host);\n var root = host.attachShadow({ mode: 'open' });\n\n root.innerHTML = [\n '',\n '',\n '',\n '

',\n '

TriBeCa Beverage

',\n '

Ask us about delivery

',\n '

'\n ].join('');\n\n var $ = function (s) { return root.querySelector(s); };\n var bubble = $('.bubble'), panel = $('.panel'), body = $('#body'), dot = $('.dot');\n\n function esc(s){ return String(s==null?'':s).replace(/[&<>]/g,function(c){\n return {'&':'&','<':'<','>':'>'}[c]; }); }\n\n function scroll(){ body.scrollTop = body.scrollHeight; }\n\n function render(m) {\n if (seen[m.id]) return;\n seen[m.id] = 1;\n\n // The stream echo of something already drawn locally. Swallow it — the\n // bubble is already on screen, and its id will never match the local one.\n if (m.sender === 'visitor' && !m.local) {\n var dup = pendingLocal.indexOf(m.body);\n if (dup > -1) { pendingLocal.splice(dup, 1); return; }\n }\n\n var d = document.createElement('div');\n if (m.sender === 'system') {\n d.className = 'm sys';\n d.innerHTML = '

' + esc(m.body) + '

';\n } else if (m.sender === 'visitor') {\n d.className = 'm me';\n d.innerHTML = '

' + esc(m.body) + '

';\n } else {\n d.className = 'm them';\n // Agent replies are named; the AI is not labelled, because \"AI\" in front\n // of every line invites people to discount correct answers.\n var who = m.sender === 'agent' && m.sender_name\n ? '

' + esc(m.sender_name) + '

' : '';\n d.innerHTML = who + '

' + esc(m.body) + '

';\n }\n body.appendChild(d);\n\n if (m.sender !== 'visitor') clearTyping();\n if (m.sender === 'agent') $('#sub').textContent = esc(m.sender_name || 'Team') + ' is here';\n if (!open && m.sender !== 'visitor') dot.style.display = 'block';\n scroll();\n }\n\n function showTyping() {\n if (root.querySelector('.typing')) return;\n var d = document.createElement('div');\n d.className = 'm them typing';\n d.innerHTML = '

Typing…

';\n body.appendChild(d);\n scroll();\n }\n function clearTyping() {\n var t = root.querySelector('.typing');\n if (t) t.remove();\n awaitingAI = false;\n }\n\n /* ---------------------------------------------------------- transport */\n\n function start() {\n return fetch(API + '/api/session', {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n visitorId: visitorId,\n dnt: DNT,\n name: WP.name, email: WP.email, phone: WP.phone,\n zip: WP.zip, company: WP.company, wpUserId: WP.wpUserId,\n pageUrl: location.href\n })\n })\n .then(function (r) { return r.json(); })\n .then(function (d) {\n visitorId = d.visitorId;\n conversationId = d.conversationId;\n try { localStorage.setItem('tribecaChatVisitor', visitorId); } catch (e) {}\n\n (d.messages || []).forEach(function (m) {\n render(m);\n if (m.created_at > since) since = m.created_at;\n });\n\n if (!(d.messages || []).length) {\n render({ id:'greet', sender:'ai',\n body:'Hi! Ask us about delivery in your area, pricing, or your account.' });\n }\n listen();\n });\n }\n\n // The server closes a stream after five minutes so abandoned tabs cannot\n // poll forever. Reconnecting is expected, not an error.\n function listen() {\n if (es) es.close();\n es = new EventSource(API + '/api/stream?c=' + encodeURIComponent(conversationId) + '&since=' + since);\n\n es.onmessage = function (ev) {\n try {\n var m = JSON.parse(ev.data);\n if (!m || !m.id) return;\n if (m.created_at > since) since = m.created_at;\n render(m);\n } catch (e) {}\n };\n\n es.onerror = function () {\n es.close();\n setTimeout(listen, 3000);\n };\n }\n\n function send(text) {\n if (!text.trim() || !conversationId) return;\n\n pendingLocal.push(text);\n render({ id: 'local_' + Date.now(), sender: 'visitor', body: text, local: true });\n showTyping();\n awaitingAI = true;\n\n fetch(API + '/api/message', {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ conversationId: conversationId, body: text })\n })\n .then(function (r) { return r.json(); })\n .then(function (d) {\n // The AI turn completes inside that POST, so if it produced nothing the\n // model failed. Say so and offer a person rather than leaving a spinner\n // running forever.\n if (d && d.ai === false && !d.handoff) clearTyping();\n if (d && d.ai && awaitingAI) {\n setTimeout(function () {\n if (!awaitingAI) return;\n clearTyping();\n render({ id:'err_'+Date.now(), sender:'system',\n body:'Sorry — I had trouble with that. Tap \"Talk to a person\" and someone will help.' });\n }, 6000);\n }\n })\n .catch(function () {\n clearTyping();\n render({ id:'off_'+Date.now(), sender:'system',\n body:'Message not sent. Check your connection and try again.' });\n });\n }\n\n function askHuman() {\n if (!conversationId) return;\n fetch(API + '/api/handoff', {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ conversationId: conversationId })\n });\n $('#sub').textContent = 'Connecting you with the team';\n }\n\n /* -------------------------------------------------------------- wiring */\n\n bubble.onclick = function () {\n open = true;\n panel.classList.add('on');\n bubble.style.display = 'none';\n dot.style.display = 'none';\n if (!conversationId) start();\n else scroll();\n $('#in').focus();\n };\n\n $('#x').onclick = function () {\n open = false;\n panel.classList.remove('on');\n bubble.style.display = 'flex';\n };\n\n $('#go').onclick = function () {\n var el = $('#in');\n send(el.value);\n el.value = '';\n el.style.height = '38px';\n };\n\n $('#in').onkeydown = function (e) {\n if (e.key === 'Enter' && !e.shiftKey) { e.preventDefault(); $('#go').click(); }\n };\n\n // Grow with the message, up to a point.\n $('#in').oninput = function () {\n this.style.height = '38px';\n this.style.height = Math.min(this.scrollHeight, 110) + 'px';\n };\n\n $('#hu').onclick = askHuman;\n\n /* ------------------------------------------------------------ presence */\n\n var invitedShown = false;\n\n // Runs on page load and on a heartbeat, whether or not the chat is ever\n // opened. This is what puts someone on the agent's monitoring screen — and\n // what lets an agent speak to them first.\n function presence() {\n fetch(API + '/api/presence', {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n visitorId: visitorId,\n pageUrl: location.href,\n // Only the referrer that brought them TO the site is interesting, and\n // the server keeps the first one it is told, so sending it on every\n // ping is harmless — internal navigation never overwrites it.\n referrer: document.referrer || null,\n dnt: DNT,\n name: WP.name, email: WP.email, phone: WP.phone,\n zip: WP.zip, company: WP.company, wpUserId: WP.wpUserId\n })\n })\n .then(function (r) { return r.json(); })\n .then(function (d) {\n if (d.visitorId && !visitorId) {\n visitorId = d.visitorId;\n try { localStorage.setItem('tribecaChatVisitor', visitorId); } catch (e) {}\n }\n\n // Someone from the team has spoken. Open the widget for them — once.\n // Popping open repeatedly would be obnoxious, and a conversation the\n // visitor started themselves must never trigger this.\n if (d.invited && !open && !invitedShown) {\n invitedShown = true;\n bubble.click();\n }\n })\n .catch(function () {});\n }\n\n presence();\n\n // Only while the tab is actually being looked at. A background tab left open\n // all afternoon should not keep reporting its owner as present, or the\n // monitoring screen fills with people who wandered off hours ago.\n setInterval(function () {\n if (document.visibilityState === 'visible') presence();\n }, 45000);\n})();`;\n","label",[140],"f13f7209-3406-4c38-97de-16a7f9268f6c",["D",1788277577931],1,[28],"e56614f5-86e1-477a-a563-4247d6461a16","notify.ts","1d3300c6-a5a5-11f1-8182-1607ee4eb77e",4,["D",1788226400302],"// Handoff notification — Telegram.\n//\n// THIS IS THE LOAD-BEARING PIECE OF THE WHOLE PROJECT.\n//\n// A custom widget is easy; an agent console is a weekend. What kept Tribeca on\n// tawk was its mobile app: the team needs to KNOW a customer is waiting while\n// away from a desk. Telegram supplies real push notifications on iOS and\n// Android with no app to build and nothing to pay.\n//\n// The cut-over decision from tawk rests entirely on whether these arrive\n// reliably. Until the team trusts them, both systems run in parallel.\n\nconst API = \"https://api.telegram.org/bot\";\n\nfunction esc(s: string): string {\n // Telegram HTML parse mode. Only these three need escaping, and a customer\n // typing \"<3\" must not break the message.\n return String(s ?? \"\")\n .replace(/&/g, \"&\")\n .replace(//g, \">\");\n}\n\n/**\n * Fire a push when a conversation flips to needs_human.\n *\n * Awaited by the caller before its response returns — see the teardown note in\n * main.ts. A dropped notification means a customer waiting with nobody aware\n * of it, which is the worst failure this system has.\n */\nexport async function notifyHandoff(conversationId: string, conv: any): Promise {\n const token = Deno.env.get(\"TELEGRAM_BOT_TOKEN\");\n const chatId = Deno.env.get(\"TELEGRAM_CHAT_ID\");\n\n if (!token || !chatId) {\n // Loud, because silence here is indistinguishable from \"nobody replied\".\n console.error(\"HANDOFF UNNOTIFIED — TELEGRAM_BOT_TOKEN/TELEGRAM_CHAT_ID not set\", conversationId);\n return false;\n }\n\n const dashboard = Deno.env.get(\"DASHBOARD_URL\") ?? \"\";\n const who = conv?.[\"name\"] || conv?.[\"email\"] || conv?.[\"phone\"] || \"Anonymous visitor\";\n\n // Everything an agent needs to decide whether to pick it up, without opening\n // anything. Salesforce context included when we have it — that is the whole\n // point of resolving the account before the handoff rather than after.\n const lines = [\n `Someone is waiting to chat`,\n ``,\n `${esc(who)}`,\n ];\n\n if (conv?.[\"sf_account\"]) {\n lines.push(`Account: ${esc(conv[\"sf_account\"])}`);\n }\n if (conv?.[\"sf_next_delivery\"]) {\n lines.push(`Next delivery: ${esc(conv[\"sf_next_delivery\"])}`);\n }\n if (conv?.[\"phone\"]) lines.push(`Phone: ${esc(conv[\"phone\"])}`);\n if (conv?.[\"page_url\"]) lines.push(`On: ${esc(conv[\"page_url\"])}`);\n\n if (dashboard) {\n lines.push(``, `${dashboard}?c=${encodeURIComponent(conversationId)}`);\n }\n\n try {\n const res = await fetch(`${API}${token}/sendMessage`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n chat_id: chatId,\n text: lines.join(\"\\n\"),\n parse_mode: \"HTML\",\n disable_web_page_preview: true,\n }),\n signal: AbortSignal.timeout(8000),\n });\n\n if (!res.ok) {\n const detail = await res.text().catch(() => \"\");\n console.error(`HANDOFF UNNOTIFIED — Telegram ${res.status}`, detail.slice(0, 200));\n return false;\n }\n\n console.log(`handoff notified ${conversationId}`);\n return true;\n } catch (err) {\n console.error(\"HANDOFF UNNOTIFIED — Telegram threw\", err);\n return false;\n }\n}\n",[155],"a6039290-a3e7-4b51-9d3a-1c226ae1ff5d","main.ts",68,["D",1788275838060],19,"http","// Tribeca Chat — HTTP entry point\n//\n// Visitor routes are public. Agent routes sit behind AGENT_KEY.\n//\n// TWO VAL TOWN CONSTRAINTS SHAPE THIS WHOLE FILE:\n//\n// 1. Work awaited AFTER a streaming response body completes is torn down\n// silently, with nothing in the logs. That is what broke lead extraction in\n// tribeca-afterhours-chat. So the AI turn is finished and persisted BEFORE\n// the visitor's POST returns, and the SSE stream never owns real work.\n//\n// 2. Requests may be served by different isolates, so an in-memory pub/sub\n// fan-out would deliver to whichever isolate happened to hold the\n// subscriber. The SSE streams therefore poll SQLite against a cursor. It\n// costs a query per second per open chat and is correct regardless of how\n// Val Town schedules isolates — the right trade at this volume.\n\nimport { Hono } from \"npm:hono\";\nimport * as db from \"./db.ts\";\nimport { aiReply, anthropicKey } from \"./agent.ts\";\nimport { lookupByPhone, scanForPhone } from \"./salesforce.ts\";\nimport { notifyHandoff } from \"./notify.ts\";\nimport { WIDGET_JS } from \"./widget.ts\";\nimport { DASHBOARD_HTML } from \"./dashboard.ts\";\nimport { countryFrom, deviceFrom, optedOut } from \"./context.ts\";\n// Surfaced on /health so a stale shared profile is VISIBLE. Val Town caches\n// remote module imports, so editing tribeca-profile does not by itself change\n// what a running isolate sees — and the failure is silent: the bot keeps\n// quoting last week's prices perfectly confidently.\nimport { PROFILE_VERSION } from \"https://esm.town/v/Tribeca_Rep/tribeca-profile/profile.ts?v=2026-09-01g\";\n\nconst app = new Hono();\n\n// The widget runs on tribecabeverage.com and the console may run inside\n// Salesforce, so every API call is cross-origin.\n//\n// The visitor endpoints are open by necessity: a browser on the storefront has\n// no credential to present, and locking them to an Origin header would be\n// theatre — Origin is trivially forged outside a browser. What actually\n// protects them is that they only ever act on the conversation id they are\n// given, and that ids are unguessable. The agent endpoints are the ones that\n// matter, and those check AGENT_KEY.\napp.use(\"*\", async (c, next) => {\n const origin = c.req.header(\"origin\") ?? \"*\";\n\n if (c.req.method === \"OPTIONS\") {\n return new Response(null, {\n status: 204,\n headers: {\n \"Access-Control-Allow-Origin\": origin,\n \"Access-Control-Allow-Methods\": \"GET,POST,OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type,x-agent-key\",\n \"Access-Control-Max-Age\": \"86400\",\n },\n });\n }\n\n await next();\n c.res.headers.set(\"Access-Control-Allow-Origin\", origin);\n c.res.headers.set(\"Vary\", \"Origin\");\n});\n\nconst AGENT_KEY = () => Deno.env.get(\"AGENT_KEY\") ?? \"\";\n\n// How often an open stream checks for new messages. One second reads as\n// instant to a person and keeps the query count sane.\nconst POLL_MS = 1000;\n\n// A stream is closed after this long so an abandoned tab cannot poll forever.\n// The widget reconnects, so the customer never notices.\nconst STREAM_MAX_MS = 5 * 60 * 1000;\n\nfunction agentAuthed(c: any): boolean {\n const key = AGENT_KEY();\n if (!key) return false; // Fail closed: unset key locks the dashboard, not opens it.\n const supplied = c.req.header(\"x-agent-key\") ?? new URL(c.req.url).searchParams.get(\"key\");\n return supplied === key;\n}\n\n/* ---------------------------------------------------------------- visitor */\n\napp.post(\"/api/session\", async (c) => {\n await db.init();\n const body = await c.req.json().catch(() => ({}));\n\n // The widget generates and persists this in localStorage, so a returning\n // visitor keeps their history and their Salesforce match.\n const visitorId = String(body.visitorId || db.id(\"v\"));\n\n // Someone signalling Global Privacy Control still gets a working chat; they\n // just do not get a profile built around them.\n const quiet = optedOut(body);\n const device = quiet ? { os: null, browser: null } : deviceFrom(c.req.header(\"user-agent\"));\n\n await db.upsertVisitor({\n id: visitorId,\n name: body.name ?? null,\n email: body.email ?? null,\n phone: body.phone ?? null,\n zip: body.zip ?? null,\n company: body.company ?? null,\n wpUserId: body.wpUserId ?? null,\n pageUrl: body.pageUrl ?? null,\n country: quiet ? null : countryFrom(c.req.raw.headers),\n os: device.os,\n browser: device.browser,\n });\n\n const conversationId = await db.openConversation(visitorId);\n const messages = await db.getMessages(conversationId);\n\n // A known phone from WordPress is looked up immediately, so an agent picking\n // up the chat already has the account on screen. Awaited deliberately: this\n // response is not streamed, so there is no teardown risk here.\n if (body.phone) {\n await enrich(visitorId, String(body.phone));\n }\n\n return c.json({ visitorId, conversationId, messages });\n});\n\napp.post(\"/api/message\", async (c) => {\n await db.init();\n const { conversationId, body: text } = await c.req.json();\n\n if (!conversationId || !text || !String(text).trim()) {\n return c.json({ error: \"conversationId and body required\" }, 400);\n }\n\n const conv = await db.getConversation(conversationId);\n if (!conv) return c.json({ error: \"unknown conversation\" }, 404);\n\n await db.addMessage(conversationId, \"visitor\", String(text).slice(0, 4000));\n\n const status = String(conv[\"status\"]);\n const visitorId = String(conv[\"visitor_id\"]);\n\n // Scan every visitor message for a phone number and resolve it against\n // Salesforce in code. The model is never asked to decide whether to look\n // something up — it only ever receives a verified result as fact. This is\n // the single most important design decision in the project: tawk's agent had\n // the same tool wired and simply never called it.\n const phone = scanForPhone(String(text));\n if (phone) await enrich(visitorId, phone);\n\n // An agent has taken over: the AI must stay silent. Not a prompt\n // instruction — a branch.\n if (status === \"human\" || status === \"closed\") {\n return c.json({ ok: true, ai: false });\n }\n\n if (status === \"needs_human\" || wantsHuman(String(text))) {\n if (status !== \"needs_human\") {\n await db.setStatus(conversationId, \"needs_human\");\n await db.addMessage(\n conversationId,\n \"system\",\n \"Connecting you with someone from the team.\",\n );\n // Awaited before returning, for the teardown reason at the top of this\n // file. A dropped handoff notification is a customer left waiting with\n // nobody aware of it — the worst failure this system can have.\n await notifyHandoff(conversationId, await db.getConversation(conversationId));\n }\n return c.json({ ok: true, ai: false, handoff: true });\n }\n\n const visitor = await db.getVisitor(visitorId);\n const history = await db.getMessages(conversationId);\n\n const reply = await aiReply(history, visitor);\n if (reply) await db.addMessage(conversationId, \"ai\", reply);\n\n return c.json({ ok: true, ai: true });\n});\n\n/**\n * Presence heartbeat. Runs on every page view, not just when the chat opens.\n *\n * Deliberately the cheapest endpoint here: one UPDATE, and two small reads only\n * when a conversation already exists. It is called far more often than anything\n * else, by people who may never chat at all.\n *\n * The response is what makes agent-initiated chat work: if someone from the\n * team has spoken to this visitor, the widget is told to open itself.\n */\napp.post(\"/api/presence\", async (c) => {\n await db.init();\n const body = await c.req.json().catch(() => ({}));\n const pageUrl = body.pageUrl ? String(body.pageUrl) : null;\n\n // No visitor id yet means a first page view. Create the record now rather\n // than waiting for a chat, otherwise nobody appears on the monitoring\n // screen until they decide to talk — which is the entire point of it.\n // Location and device are read off the request that is already arriving. The\n // IP that country is derived from is Cloudflare's to know — we never see a\n // need for it, never store it, and never send it anywhere. See context.ts.\n const quiet = optedOut(body);\n const country = quiet ? null : countryFrom(c.req.raw.headers);\n const device = quiet ? { os: null, browser: null } : deviceFrom(c.req.header(\"user-agent\"));\n\n let visitorId = body.visitorId ? String(body.visitorId) : null;\n if (!visitorId) {\n visitorId = db.id(\"v\");\n await db.upsertVisitor({\n id: visitorId,\n name: body.name ?? null,\n email: body.email ?? null,\n phone: body.phone ?? null,\n zip: body.zip ?? null,\n company: body.company ?? null,\n wpUserId: body.wpUserId ?? null,\n pageUrl,\n country,\n os: device.os,\n browser: device.browser,\n });\n }\n\n // Runs for a brand-new visitor too: referrer and landing_url are still null\n // on the row we just inserted, so COALESCE fills them from this first ping.\n await db.recordPresence(\n visitorId,\n pageUrl,\n body.referrer ? String(body.referrer).slice(0, 500) : null,\n { country, os: device.os, browser: device.browser, optedOut: quiet },\n );\n\n // Retention runs off the back of the busiest endpoint rather than a cron.\n // It self-throttles to once a day and returns immediately otherwise, so this\n // costs one indexed read on a normal page view.\n db.purgeStaleVisitors().catch(() => {});\n\n const conversationId = await db.findOpenConversation(visitorId);\n const invited = conversationId ? await db.hasAgentMessage(conversationId) : false;\n\n return c.json({ visitorId, conversationId, invited });\n});\n\n/**\n * Details a visitor VOLUNTEERED through a form on the website.\n *\n * This is the best identification we get: first-party, consented, and typed by\n * the person themselves — not inferred from anything. It is also precisely what\n * tawk could not use, since tawk refused to render attributes for a visitor it\n * considered unidentified.\n *\n * SEPARATE FROM /api/session ON PURPOSE. That endpoint opens a conversation,\n * which would put an empty thread in the agent queue for every form submission\n * on the site. This only enriches the visitor record.\n *\n * Purpose limit: someone filling in a quote form volunteered contact details in\n * order to BE CONTACTED. Using them to greet that person in chat is inside that\n * purpose. This endpoint does not backfill anything else.\n */\napp.post(\"/api/identify\", async (c) => {\n await db.init();\n const body = await c.req.json().catch(() => ({}));\n\n const visitorId = body.visitorId ? String(body.visitorId) : null;\n if (!visitorId) return c.json({ error: \"visitorId required\" }, 400);\n\n // Only enrich a visitor we already know. Creating one here would let any\n // caller mint records by posting arbitrary ids.\n const existing = await db.getVisitor(visitorId);\n if (!existing) return c.json({ error: \"unknown visitor\" }, 404);\n\n const clip = (v: unknown) => {\n const s = String(v ?? \"\").trim();\n return s ? s.slice(0, 200) : null;\n };\n\n // upsertVisitor COALESCEs, so this fills gaps and never overwrites something\n // already established — a WordPress-verified phone survives a typo in a form.\n await db.upsertVisitor({\n id: visitorId,\n name: clip(body.name),\n email: clip(body.email),\n phone: clip(body.phone),\n zip: clip(body.zip),\n company: clip(body.company),\n pageUrl: body.pageUrl ? String(body.pageUrl) : String(existing[\"page_url\"] ?? \"\"),\n });\n\n // A volunteered phone is worth resolving immediately, so an agent opening the\n // conversation already has the account on screen rather than waiting for the\n // customer to repeat a number they have just typed once.\n const phone = clip(body.phone);\n if (phone) await enrich(visitorId, phone);\n\n return c.json({ ok: true });\n});\n\n/** Visitor-initiated handoff, from a button rather than a phrase. */\napp.post(\"/api/handoff\", async (c) => {\n await db.init();\n const { conversationId } = await c.req.json();\n const conv = await db.getConversation(conversationId);\n if (!conv) return c.json({ error: \"unknown conversation\" }, 404);\n\n if (String(conv[\"status\"]) === \"ai\") {\n await db.setStatus(conversationId, \"needs_human\");\n await db.addMessage(conversationId, \"system\", \"Connecting you with someone from the team.\");\n await notifyHandoff(conversationId, await db.getConversation(conversationId));\n }\n return c.json({ ok: true });\n});\n\n/* ----------------------------------------------------------------- streams */\n\nfunction sseStream(load: (since: number) => Promise, since0: number) {\n let since = since0;\n const started = Date.now();\n const enc = new TextEncoder();\n\n return new ReadableStream({\n async pull(controller) {\n if (Date.now() - started > STREAM_MAX_MS) {\n controller.close();\n return;\n }\n\n await new Promise((r) => setTimeout(r, POLL_MS));\n\n try {\n const rows = await load(since);\n for (const row of rows) {\n const created = Number(row[\"created_at\"] ?? row[4] ?? 0);\n if (created > since) since = created;\n controller.enqueue(enc.encode(`data: ${JSON.stringify(row)}\\n\\n`));\n }\n // Comment frame doubles as a keep-alive; proxies drop idle connections.\n controller.enqueue(enc.encode(`: ping\\n\\n`));\n } catch (_e) {\n // A transient query failure must not kill the stream — the widget\n // would reconnect anyway, but silently riding it out is smoother.\n controller.enqueue(enc.encode(`: err\\n\\n`));\n }\n },\n });\n}\n\nconst SSE_HEADERS = {\n \"Content-Type\": \"text/event-stream\",\n \"Cache-Control\": \"no-cache\",\n \"Connection\": \"keep-alive\",\n};\n\napp.get(\"/api/stream\", async (c) => {\n await db.init();\n const cid = c.req.query(\"c\");\n const since = Number(c.req.query(\"since\") ?? 0);\n if (!cid) return c.json({ error: \"c required\" }, 400);\n\n return new Response(\n sseStream((s) => db.getMessages(cid, s), since),\n { headers: SSE_HEADERS },\n );\n});\n\n/* ------------------------------------------------------------------ agent */\n\napp.get(\"/api/agent/conversations\", async (c) => {\n if (!agentAuthed(c)) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n return c.json({ conversations: await db.listConversations() });\n});\n\napp.get(\"/api/agent/messages\", async (c) => {\n if (!agentAuthed(c)) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n const cid = c.req.query(\"c\");\n if (!cid) return c.json({ error: \"c required\" }, 400);\n return c.json({\n conversation: await db.getConversation(cid),\n messages: await db.getMessages(cid),\n });\n});\n\n/** Who is on the site right now. */\napp.get(\"/api/agent/visitors\", async (c) => {\n if (!agentAuthed(c)) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n\n // Twice the widget's heartbeat, so a single dropped ping does not make\n // someone blink out of the list while an agent is deciding whether to\n // reach out to them.\n const window = 90 * 1000;\n return c.json({ visitors: await db.listActiveVisitors(Date.now() - window) });\n});\n\n/**\n * Start a conversation with a visitor who has not asked for one.\n *\n * This is the reason presence tracking earns its keep. Watching a list of\n * anonymous sessions is not useful; opening with \"want a hand?\" to someone who\n * has been on the pricing page for four minutes is.\n *\n * Goes straight to 'human' — the AI must not pick up a conversation a person\n * deliberately started.\n */\napp.post(\"/api/agent/invite\", async (c) => {\n if (!agentAuthed(c)) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n\n const { visitorId, body, agent } = await c.req.json();\n if (!visitorId || !body || !String(body).trim()) {\n return c.json({ error: \"visitorId and body required\" }, 400);\n }\n\n const visitor = await db.getVisitor(String(visitorId));\n if (!visitor) return c.json({ error: \"unknown visitor\" }, 404);\n\n const conversationId = await db.openConversation(String(visitorId));\n await db.setStatus(conversationId, \"human\", agent ?? \"Team\");\n await db.addMessage(conversationId, \"agent\", String(body).slice(0, 4000), agent ?? \"Team\");\n\n return c.json({ ok: true, conversationId });\n});\n\napp.post(\"/api/agent/claim\", async (c) => {\n if (!agentAuthed(c)) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n const { conversationId, agent } = await c.req.json();\n\n await db.setStatus(conversationId, \"human\", agent ?? \"Team\");\n await db.addMessage(\n conversationId,\n \"system\",\n `${agent ?? \"A team member\"} has joined the conversation.`,\n );\n return c.json({ ok: true });\n});\n\napp.post(\"/api/agent/reply\", async (c) => {\n if (!agentAuthed(c)) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n const { conversationId, body, agent } = await c.req.json();\n if (!conversationId || !body) return c.json({ error: \"conversationId and body required\" }, 400);\n\n // Replying implies taking over. Requiring a separate Claim click is the kind\n // of step that gets skipped under pressure, leaving the AI talking over a\n // human mid-conversation.\n const conv = await db.getConversation(conversationId);\n if (conv && String(conv[\"status\"]) !== \"human\") {\n await db.setStatus(conversationId, \"human\", agent ?? \"Team\");\n }\n\n await db.addMessage(conversationId, \"agent\", String(body).slice(0, 4000), agent ?? \"Team\");\n return c.json({ ok: true });\n});\n\napp.post(\"/api/agent/release\", async (c) => {\n if (!agentAuthed(c)) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n const { conversationId } = await c.req.json();\n await db.setStatus(conversationId, \"ai\");\n return c.json({ ok: true });\n});\n\napp.post(\"/api/agent/close\", async (c) => {\n if (!agentAuthed(c)) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n const { conversationId } = await c.req.json();\n await db.setStatus(conversationId, \"closed\");\n return c.json({ ok: true });\n});\n\napp.get(\"/api/agent/stream\", async (c) => {\n if (!agentAuthed(c)) return c.json({ error: \"unauthorized\" }, 401);\n await db.init();\n // The dashboard re-fetches the list on any tick; sending the list itself\n // down the stream would race with the agent's own actions.\n return new Response(\n sseStream(async () => [{ created_at: Date.now(), tick: true }], 0),\n { headers: SSE_HEADERS },\n );\n});\n\n/* ----------------------------------------------------------------- shared */\n\n/** Resolve a phone against Salesforce and cache it on the visitor. */\nasync function enrich(visitorId: string, phone: string) {\n // Store the number first, before any lookup and regardless of its outcome.\n // The agent console runs its OWN native Salesforce query keyed off this, and\n // that query is the one that can show several candidate accounts for a human\n // to choose between. Without this, a number typed in chat reached the bot but\n // never the panel, so the disambiguation the console exists for never fired.\n await db.setVisitorPhone(visitorId, phone);\n\n const v = await db.getVisitor(visitorId);\n\n // Re-checking every message would add a Val Town cold start plus two SOQL\n // queries to each turn. An hour is far shorter than a delivery schedule\n // changes.\n const checked = Number(v?.[\"sf_checked_at\"] ?? 0);\n if (checked && Date.now() - checked < 60 * 60 * 1000) return;\n\n const res = await lookupByPhone(phone);\n // found:false arrives as needs_phone, ambiguous or errored. None is a\n // statement about THIS customer, so none is stored. Ambiguous matters most:\n // that number is on more than one account, and guessing would put another\n // business's name in front of this one.\n if (res?.found) {\n await db.setSalesforce(visitorId, res.account_name ?? null, res.next_delivery_date ?? null);\n }\n}\n\n/**\n * Deliberately narrow. A customer saying \"does a human deliver these?\" should\n * not trigger a handoff, so this matches requests, not the word alone.\n */\nfunction wantsHuman(text: string): boolean {\n return /\\b(speak|talk|chat)\\s+(to|with)\\s+(a\\s+)?(human|person|someone|agent|rep)\\b/i.test(text)\n || /\\b(real|live)\\s+(person|human|agent)\\b/i.test(text)\n || /\\bhuman\\s+(please|help)\\b/i.test(text);\n}\n\n/* ------------------------------------------------------------ delivery */\n\napp.get(\"/widget.js\", () =>\n new Response(WIDGET_JS, {\n headers: {\n \"Content-Type\": \"application/javascript; charset=utf-8\",\n // Short, so a fix reaches visitors within minutes without hammering the\n // val on every page view of a WooCommerce site.\n \"Cache-Control\": \"public, max-age=300\",\n },\n })\n);\n\n// The standalone console. Kept alongside the Visualforce page as the fallback\n// that works when Salesforce is down or a licence is missing.\napp.get(\"/dashboard\", () =>\n new Response(DASHBOARD_HTML, {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n })\n);\n\n/**\n * Somewhere to try the widget without touching the live storefront.\n *\n * ?wp=1 fakes the enrichment the WordPress snippet would supply for a\n * signed-in customer, so both paths can be exercised: anonymous, where the\n * only thing known is what gets typed, and identified, where the account is\n * resolved before a word is said.\n */\napp.get(\"/test\", (c) => {\n const asCustomer = new URL(c.req.url).searchParams.get(\"wp\") === \"1\";\n\n const enrich = asCustomer\n ? ``\n : \"\";\n\n return new Response(\n `\n\n\nTribeca Chat - test page\n\n\n

Tribeca Chat test page

The widget is live in the corner. Nothing here touches tribecabeverage.com.

\n\n

Mode: ${asCustomer ? \"signed-in customer\" : \"anonymous visitor\"}\n · \n switch to ${asCustomer ? \"anonymous\" : \"signed-in\"}

\n\n

Try this first

Ask When is my next delivery? with no phone number given. It should refuse to\n guess a date and ask for one, rather than inventing something plausible.

\n\n

Then give it a number

Reply with 818-321-4845. The account is resolved in code before the model\n answers, so the name it uses comes from Salesforce, not from the model.

\n\n

Then ask for a person

Say can I talk to a person. The AI stops answering and the conversation moves\n to the top of the agent queue.

\n\n

Watch it arrive

Agent console: standalone or the Visualforce page in Salesforce.\n Both show the same conversation.

\n\n${enrich}\n\n`,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n});\n\napp.get(\"/health\", async (c) => {\n await db.init();\n return c.json({\n ok: true,\n // Compare against tribeca-profile's PROFILE_VERSION. If they differ, this\n // val is serving cached prices and needs a redeploy.\n profile: PROFILE_VERSION,\n anthropic: !!anthropicKey(),\n agentKey: !!AGENT_KEY(),\n apollo: !!Deno.env.get(\"APOLLO_TOOL_KEY\"),\n telegram: !!Deno.env.get(\"TELEGRAM_BOT_TOKEN\"),\n });\n});\n\nexport default app.fetch;\n",[162],"863eb1c9-9783-43c5-bda1-dd35b8416170","db.ts","fcd6841a-a5a4-11f1-abb7-1607ee4eb77e",51,["D",1788268336091],18,"// Tribeca Chat — storage layer\n//\n// Built to replacement spec for tawk.to, run in parallel until the team trusts\n// the notifications. See conversations.status for the AI/human handoff model.\n//\n// Val-scoped SQLite. Every write goes through here so the SSE fan-out in\n// main.ts has exactly one place to hook.\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\n\n// Bump when the shape changes; init() is safe to call on every request.\nconst SCHEMA_VERSION = 1;\n\nlet ready: Promise | null = null;\n\nexport function init(): Promise {\n // Memoised, not because the CREATEs are expensive, but because Val Town can\n // serve several requests from one isolate and re-running them per request\n // shows up as latency on the visitor's first message.\n if (ready) return ready;\n\n ready = (async () => {\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS visitors (\n id TEXT PRIMARY KEY,\n name TEXT,\n email TEXT,\n phone TEXT,\n zip TEXT,\n company TEXT,\n wp_user_id TEXT,\n -- Salesforce answers are cached on the visitor, not looked up per\n -- message. The lookup is two SOQL queries behind a Val Town cold\n -- start; doing it per turn would be felt by the customer.\n sf_account TEXT,\n sf_next_delivery TEXT,\n sf_checked_at INTEGER,\n first_seen INTEGER NOT NULL,\n last_seen INTEGER NOT NULL,\n page_url TEXT,\n user_agent TEXT,\n country TEXT\n )`,\n\n `CREATE TABLE IF NOT EXISTS conversations (\n id TEXT PRIMARY KEY,\n visitor_id TEXT NOT NULL,\n -- ai AI is answering\n -- needs_human handoff requested, nobody has claimed it yet\n -- human an agent has taken over; the AI must stay silent\n -- closed ended\n status TEXT NOT NULL DEFAULT 'ai',\n assigned_to TEXT,\n -- Set when status first becomes needs_human, so we can measure how\n -- long customers actually wait. That number is the whole argument for\n -- or against cutting over from tawk.\n handoff_at INTEGER,\n claimed_at INTEGER,\n created_at INTEGER NOT NULL,\n last_message_at INTEGER NOT NULL,\n FOREIGN KEY (visitor_id) REFERENCES visitors(id)\n )`,\n\n `CREATE TABLE IF NOT EXISTS messages (\n id TEXT PRIMARY KEY,\n conversation_id TEXT NOT NULL,\n -- visitor | ai | agent | system\n sender TEXT NOT NULL,\n -- Display name for agent messages; null for visitor/ai/system.\n sender_name TEXT,\n body TEXT NOT NULL,\n created_at INTEGER NOT NULL,\n FOREIGN KEY (conversation_id) REFERENCES conversations(id)\n )`,\n\n // The dashboard's default view is \"conversations needing attention,\n // newest first\", and the visitor stream polls by conversation. Both are\n // hot paths on every keystroke, so they get indexes from day one.\n `CREATE INDEX IF NOT EXISTS idx_msg_conv ON messages(conversation_id, created_at)`,\n `CREATE INDEX IF NOT EXISTS idx_conv_status ON conversations(status, last_message_at DESC)`,\n `CREATE INDEX IF NOT EXISTS idx_conv_visitor ON conversations(visitor_id)`,\n\n `CREATE TABLE IF NOT EXISTS meta (k TEXT PRIMARY KEY, v TEXT)`,\n ]);\n\n // Additive migrations. CREATE TABLE IF NOT EXISTS does nothing to a table\n // that already exists, so each new column is added on its own and its\n // \"duplicate column\" error swallowed. Cheaper than a migration framework\n // for a handful of columns, and safe to run on every cold start.\n for (const stmt of [\n `ALTER TABLE visitors ADD COLUMN referrer TEXT`,\n `ALTER TABLE visitors ADD COLUMN landing_url TEXT`,\n `ALTER TABLE visitors ADD COLUMN visits INTEGER DEFAULT 1`,\n `ALTER TABLE visitors ADD COLUMN session_started INTEGER`,\n // Coarse device, derived from the User-Agent and stored INSTEAD of it.\n // The raw UA string is a fingerprint we have no use for; \"Windows\" and\n // \"Chrome\" is the entire operational value of it.\n `ALTER TABLE visitors ADD COLUMN os TEXT`,\n `ALTER TABLE visitors ADD COLUMN browser TEXT`,\n `ALTER TABLE visitors ADD COLUMN page_views INTEGER DEFAULT 0`,\n `ALTER TABLE visitors ADD COLUMN time_on_site_ms INTEGER DEFAULT 0`,\n // Set when the browser sent Global Privacy Control or Do Not Track. A\n // stored flag, so it is auditable rather than merely honoured in passing.\n `ALTER TABLE visitors ADD COLUMN dnt INTEGER DEFAULT 0`,\n ]) {\n try {\n await sqlite.execute(stmt);\n } catch (_e) {\n // Column already present. Nothing to do.\n }\n }\n\n await sqlite.execute({\n sql: `INSERT INTO meta (k, v) VALUES ('schema_version', ?)\n ON CONFLICT(k) DO UPDATE SET v = excluded.v`,\n args: [String(SCHEMA_VERSION)],\n });\n })();\n\n return ready;\n}\n\nexport function now(): number {\n return Date.now();\n}\n\n// Prefixed so an id is self-describing in logs and in the dashboard URL.\nexport function id(prefix: string): string {\n return prefix + \"_\" + crypto.randomUUID().replace(/-/g, \"\").slice(0, 20);\n}\n\n/**\n * std/sqlite returns each row as an ARRAY of values, not an object.\n *\n * Everything downstream — the widget, both consoles, and the model's turn\n * builder — reads rows by column name, so they all silently saw `undefined`\n * and produced nothing. Converting here, at the single place every query\n * passes through, rather than teaching four callers about tuple order.\n */\nfunction rowsToObjects(result: any): any[] {\n const cols: string[] = result?.columns ?? [];\n return (result?.rows ?? []).map((row: any) =>\n Array.isArray(row)\n ? Object.fromEntries(cols.map((c, i) => [c, row[i]]))\n : row\n );\n}\n\n/* ------------------------------------------------------------------ visitors */\n\nexport async function upsertVisitor(v: {\n id: string;\n name?: string | null;\n email?: string | null;\n phone?: string | null;\n zip?: string | null;\n company?: string | null;\n wpUserId?: string | null;\n pageUrl?: string | null;\n country?: string | null;\n os?: string | null;\n browser?: string | null;\n}) {\n const t = now();\n\n // COALESCE on update, so a later page view that knows less about the visitor\n // never blanks out what an earlier one established. Enrichment only ever\n // adds. The exception is page_url, which should always be the current page.\n await sqlite.execute({\n sql: `INSERT INTO visitors\n (id, name, email, phone, zip, company, wp_user_id,\n first_seen, last_seen, page_url, country, os, browser)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)\n ON CONFLICT(id) DO UPDATE SET\n name = COALESCE(excluded.name, visitors.name),\n email = COALESCE(excluded.email, visitors.email),\n phone = COALESCE(excluded.phone, visitors.phone),\n zip = COALESCE(excluded.zip, visitors.zip),\n company = COALESCE(excluded.company, visitors.company),\n wp_user_id = COALESCE(excluded.wp_user_id, visitors.wp_user_id),\n last_seen = excluded.last_seen,\n page_url = excluded.page_url,\n country = COALESCE(excluded.country, visitors.country),\n os = COALESCE(excluded.os, visitors.os),\n browser = COALESCE(excluded.browser, visitors.browser)`,\n args: [\n v.id, v.name ?? null, v.email ?? null, v.phone ?? null, v.zip ?? null,\n v.company ?? null, v.wpUserId ?? null, t, t,\n v.pageUrl ?? null, v.country ?? null, v.os ?? null, v.browser ?? null,\n ],\n });\n}\n\n/**\n * Record a phone number the visitor typed in the chat.\n *\n * Separate from upsertVisitor because that one always overwrites page_url, and\n * this is called mid-conversation where we know nothing else about the page.\n *\n * COALESCE, so a number WordPress already verified for a signed-in customer is\n * not replaced by one typed into a chat box. The typed number is still used for\n * the lookup either way — this only decides what the agent panel keys off.\n */\nexport async function setVisitorPhone(visitorId: string, phone: string) {\n await sqlite.execute({\n sql: `UPDATE visitors SET phone = COALESCE(phone, ?) WHERE id = ?`,\n args: [phone, visitorId],\n });\n}\n\nexport async function setSalesforce(\n visitorId: string,\n account: string | null,\n nextDelivery: string | null,\n) {\n await sqlite.execute({\n sql: `UPDATE visitors\n SET sf_account = ?, sf_next_delivery = ?, sf_checked_at = ?\n WHERE id = ?`,\n args: [account, nextDelivery, now(), visitorId],\n });\n}\n\nexport async function getVisitor(visitorId: string) {\n const r = await sqlite.execute({\n sql: `SELECT * FROM visitors WHERE id = ?`,\n args: [visitorId],\n });\n return rowsToObjects(r)[0] ?? null;\n}\n\n/* ------------------------------------------------------- conversations */\n\nexport async function openConversation(visitorId: string): Promise {\n // One live conversation per visitor. Reusing it means a customer who\n // refreshes mid-chat lands back in the same thread instead of orphaning it\n // — orphaned threads are how a handoff gets silently dropped.\n const existing = await sqlite.execute({\n sql: `SELECT id FROM conversations\n WHERE visitor_id = ? AND status != 'closed'\n ORDER BY last_message_at DESC LIMIT 1`,\n args: [visitorId],\n });\n\n const prior = rowsToObjects(existing)[0];\n if (prior) return String(prior[\"id\"]);\n\n const cid = id(\"c\");\n const t = now();\n await sqlite.execute({\n sql: `INSERT INTO conversations\n (id, visitor_id, status, created_at, last_message_at)\n VALUES (?, ?, 'ai', ?, ?)`,\n args: [cid, visitorId, t, t],\n });\n return cid;\n}\n\nexport async function getConversation(cid: string) {\n const r = await sqlite.execute({\n sql: `SELECT c.*, v.name, v.email, v.phone, v.zip, v.company,\n v.sf_account, v.sf_next_delivery, v.page_url, v.country,\n v.os, v.browser, v.visits, v.page_views, v.time_on_site_ms,\n v.referrer, v.landing_url, v.session_started, v.dnt\n FROM conversations c\n JOIN visitors v ON v.id = c.visitor_id\n WHERE c.id = ?`,\n args: [cid],\n });\n return rowsToObjects(r)[0] ?? null;\n}\n\nexport async function setStatus(\n cid: string,\n status: \"ai\" | \"needs_human\" | \"human\" | \"closed\",\n agent?: string | null,\n) {\n const t = now();\n // handoff_at is stamped only on the FIRST transition into needs_human, so a\n // customer who asks twice doesn't have their wait time reset to zero.\n await sqlite.execute({\n sql: `UPDATE conversations\n SET status = ?,\n assigned_to = COALESCE(?, assigned_to),\n handoff_at = CASE\n WHEN ? = 'needs_human' AND handoff_at IS NULL THEN ?\n ELSE handoff_at END,\n claimed_at = CASE\n WHEN ? = 'human' AND claimed_at IS NULL THEN ?\n ELSE claimed_at END\n WHERE id = ?`,\n args: [status, agent ?? null, status, t, status, t, cid],\n });\n}\n\n/** Conversation list for the dashboard, newest activity first. */\nexport async function listConversations(limit = 50) {\n const r = await sqlite.execute({\n sql: `SELECT c.id, c.status, c.assigned_to, c.last_message_at, c.handoff_at,\n v.name, v.email, v.phone, v.sf_account, v.country,\n (SELECT body FROM messages m\n WHERE m.conversation_id = c.id\n ORDER BY m.created_at DESC LIMIT 1) AS preview\n FROM conversations c\n JOIN visitors v ON v.id = c.visitor_id\n WHERE c.status != 'closed'\n ORDER BY\n -- Anyone waiting on a human sorts to the top regardless of\n -- recency. A customer waiting eight minutes must not be pushed\n -- down the list by a bot conversation that just ticked.\n CASE c.status WHEN 'needs_human' THEN 0 ELSE 1 END,\n c.last_message_at DESC\n LIMIT ?`,\n args: [limit],\n });\n return rowsToObjects(r);\n}\n\n/* ----------------------------------------------------------- messages */\n\nexport async function addMessage(\n cid: string,\n sender: \"visitor\" | \"ai\" | \"agent\" | \"system\",\n body: string,\n senderName?: string | null,\n): Promise<{ id: string; created_at: number }> {\n const mid = id(\"m\");\n const t = now();\n\n await sqlite.batch([\n {\n sql: `INSERT INTO messages\n (id, conversation_id, sender, sender_name, body, created_at)\n VALUES (?, ?, ?, ?, ?, ?)`,\n args: [mid, cid, sender, senderName ?? null, body, t],\n },\n {\n sql: `UPDATE conversations SET last_message_at = ? WHERE id = ?`,\n args: [t, cid],\n },\n ]);\n\n return { id: mid, created_at: t };\n}\n\nexport async function getMessages(cid: string, sinceMs = 0) {\n const r = await sqlite.execute({\n sql: `SELECT id, sender, sender_name, body, created_at\n FROM messages\n WHERE conversation_id = ? AND created_at > ?\n ORDER BY created_at ASC`,\n args: [cid, sinceMs],\n });\n return rowsToObjects(r);\n}\n\n/* ----------------------------------------------------------- presence */\n\n/**\n * A gap this long means they left and came back, so it counts as a new visit.\n * Thirty minutes is the usual analytics convention and matches how people\n * actually browse — a tab left open over lunch is not two visits.\n */\nconst SESSION_GAP_MS = 30 * 60 * 1000;\n\n/**\n * How long a visitor who never spoke to us is kept.\n *\n * Browsing data has a short useful life and a long liability tail. Ninety days\n * covers \"have they been back since we quoted them\" and nothing beyond it.\n * Anyone who actually held a conversation is exempt — that is a customer\n * record, not analytics.\n */\nconst RETENTION_MS = 90 * 24 * 60 * 60 * 1000;\n\n/**\n * Heartbeat. Runs on every page view, so it stays a single UPDATE.\n *\n * referrer and landing_url use COALESCE because only the FIRST answer is\n * interesting: how they found you, and where they came in. Overwriting them on\n * every page would just leave you with the previous page of your own site.\n */\nexport async function recordPresence(\n visitorId: string,\n pageUrl: string | null,\n referrer: string | null,\n opts: {\n country?: string | null;\n os?: string | null;\n browser?: string | null;\n optedOut?: boolean;\n } = {},\n) {\n const v = await getVisitor(visitorId);\n if (!v) return { newSession: false };\n\n const t = now();\n const last = Number(v[\"last_seen\"] ?? 0);\n const first = Number(v[\"first_seen\"] ?? 0);\n const gap = last ? t - last : 0;\n\n // The row was inserted milliseconds ago by this same request, so first_seen\n // and last_seen are the same stamp. That is a first page view, NOT a second\n // session — counting it as one would have every visitor arrive at \"visit 2\",\n // and it would bank the insert-to-update milliseconds as time on site.\n const brandNew = !last || last === first;\n\n const isNew = !brandNew && gap > SESSION_GAP_MS ? 1 : 0;\n\n // Global Privacy Control, honoured. They still appear on the monitoring\n // screen and chat works exactly as normal — the console would be useless\n // otherwise, and refusing to talk to someone is not a privacy feature. What\n // stops is the profile: no counters, no device, no country, ever.\n if (opts.optedOut) {\n await sqlite.execute({\n sql: `UPDATE visitors\n SET last_seen = ?, page_url = COALESCE(?, page_url), dnt = 1\n WHERE id = ?`,\n args: [t, pageUrl, visitorId],\n });\n return { newSession: isNew === 1 };\n }\n\n // Page views count PAGES, not heartbeats. The widget pings every 45 seconds,\n // so counting pings would report eighty views for one long article and make\n // the number worse than useless — it would look like engagement.\n const samePage = !!pageUrl && String(v[\"page_url\"] ?? \"\") === pageUrl;\n const viewed = brandNew || isNew || !samePage ? 1 : 0;\n\n // Dwell time accrues from the gap between pings, and only within a session.\n // The hours between two visits are not time on site, and a tab left open\n // over a weekend must not report as a three-day reading session.\n const dwell = brandNew || isNew ? 0 : Math.min(gap, SESSION_GAP_MS);\n\n await sqlite.execute({\n sql: `UPDATE visitors\n SET last_seen = ?,\n page_url = COALESCE(?, page_url),\n referrer = COALESCE(referrer, ?),\n landing_url = COALESCE(landing_url, ?),\n visits = COALESCE(visits, 1) + ?,\n page_views = COALESCE(page_views, 0) + ?,\n time_on_site_ms = COALESCE(time_on_site_ms, 0) + ?,\n country = COALESCE(?, country),\n os = COALESCE(?, os),\n browser = COALESCE(?, browser),\n session_started = CASE WHEN ? = 1 THEN ?\n ELSE COALESCE(session_started, ?) END\n WHERE id = ?`,\n args: [\n t, pageUrl, referrer, pageUrl, isNew, viewed, dwell,\n opts.country ?? null, opts.os ?? null, opts.browser ?? null,\n isNew, t, t, visitorId,\n ],\n });\n\n return { newSession: isNew === 1 };\n}\n\n/**\n * Delete browsing rows past their retention window.\n *\n * Throttled through `meta` rather than run on a cron, so it cannot fire on\n * every request and needs no second scheduled file. Once a day is far more\n * often than ninety-day retention requires.\n *\n * Visitors with any conversation are excluded outright. Deleting those would\n * orphan the messages and lose the account match an agent worked for.\n */\nexport async function purgeStaleVisitors(): Promise {\n const t = now();\n\n const seen = await sqlite.execute({\n sql: `SELECT v FROM meta WHERE k = 'last_purge'`,\n });\n const lastRun = Number(rowsToObjects(seen)[0]?.[\"v\"] ?? 0);\n if (lastRun && t - lastRun < 24 * 60 * 60 * 1000) return 0;\n\n // Stamp BEFORE deleting, so a failure cannot put this in a retry loop that\n // runs a table scan on every page view of the storefront.\n await sqlite.execute({\n sql: `INSERT INTO meta (k, v) VALUES ('last_purge', ?)\n ON CONFLICT(k) DO UPDATE SET v = excluded.v`,\n args: [String(t)],\n });\n\n const res = await sqlite.execute({\n sql: `DELETE FROM visitors\n WHERE last_seen < ?\n AND id NOT IN (SELECT visitor_id FROM conversations)`,\n args: [t - RETENTION_MS],\n });\n\n const n = Number((res as any)?.rowsAffected ?? 0);\n if (n) console.log(\"retention: purged \" + n + \" visitor rows past 90 days\");\n return n;\n}\n\n/**\n * Who is on the site right now.\n *\n * A visitor counts as present if they pinged within the window the caller\n * passes — roughly twice the heartbeat interval, so one missed ping does not\n * make someone vanish from an agent's screen mid-thought.\n */\nexport async function listActiveVisitors(activeSince: number) {\n const r = await sqlite.execute({\n sql: `SELECT v.id, v.name, v.email, v.phone, v.company,\n v.sf_account, v.sf_next_delivery,\n v.page_url, v.country, v.first_seen, v.last_seen,\n v.referrer, v.landing_url, v.visits, v.session_started,\n v.os, v.browser, v.page_views, v.time_on_site_ms, v.dnt,\n (SELECT c.id FROM conversations c\n WHERE c.visitor_id = v.id AND c.status != 'closed'\n ORDER BY c.last_message_at DESC LIMIT 1) AS conversation_id,\n (SELECT COUNT(*) FROM messages m\n JOIN conversations c2 ON c2.id = m.conversation_id\n WHERE c2.visitor_id = v.id) AS message_count\n FROM visitors v\n WHERE v.last_seen > ?\n ORDER BY v.last_seen DESC\n LIMIT 100`,\n args: [activeSince],\n });\n return rowsToObjects(r);\n}\n\n/** Existing open conversation, WITHOUT creating one. */\nexport async function findOpenConversation(visitorId: string): Promise {\n const r = await sqlite.execute({\n sql: `SELECT id FROM conversations\n WHERE visitor_id = ? AND status != 'closed'\n ORDER BY last_message_at DESC LIMIT 1`,\n args: [visitorId],\n });\n const row = rowsToObjects(r)[0];\n return row ? String(row[\"id\"]) : null;\n}\n\n/**\n * Has anyone spoken to this visitor yet?\n *\n * Used by the presence ping to decide whether to pop the widget open. A chat\n * the visitor started themselves must not re-open on every page view — only an\n * agent reaching out unprompted should do that.\n */\nexport async function hasAgentMessage(conversationId: string): Promise {\n const r = await sqlite.execute({\n sql: `SELECT COUNT(*) AS n FROM messages\n WHERE conversation_id = ? AND sender = 'agent'`,\n args: [conversationId],\n });\n const row = rowsToObjects(r)[0];\n return Number(row?.[\"n\"] ?? 0) > 0;\n}\n",[170],"97f24a8c-642d-407f-a4ed-20751dade82e","dashboard.ts","416f436e-a5a5-11f1-9747-1607ee4eb77e",7,["D",1788226461106],"// Agent console.\n//\n// Three columns, same shape as tawk so nobody has to relearn: conversation\n// list, thread, visitor details. One deliberate departure — Salesforce sits at\n// the TOP of the details panel, beside the visitor's name.\n//\n// In tawk that information was buried under Email / Phone / Job title, fields\n// that are usually empty and rarely change the answer. The account name and\n// next delivery date are the two things that actually change what an agent\n// says, so they go where the eye lands first.\n//\n// Vanilla JS on purpose: no build step, no framework version to pin, and the\n// whole console is one file you can read in a sitting.\n\nexport const DASHBOARD_HTML = /* html */ `\n\n\n\n\nTribeca Chat\n\n\n\n\n

Conversations

\n\n

\n \n \n \n \n

Select a conversation

\n \n \n

\n\n

\n\n\n\n`;\n",[178],"e33746c7-fd19-4a43-8541-6bcd5571e809","context.ts","3c44c9b6-a606-11f1-bf87-1607ee4eb77e",35,["D",1788268113604],"// Visitor context — where they are and what they are browsing on.\n//\n// THE RULE IN THIS FILE: the IP address is never stored and never sent\n// anywhere. It is read off the request, used to nothing, and dropped.\n//\n// WHY THERE IS NO CITY OR REGION HERE, WHICH tawk DOES SHOW\n// Val Town sits behind Cloudflare, which hands us `cf-ipcountry` for free on\n// every request. Country therefore costs nothing and discloses nothing.\n//\n// City and region are a different bargain entirely. No header carries them, so\n// getting them means POSTing every visitor's IP address to a third-party\n// geolocation service on their first page view. That would recreate exactly the\n// third-party data flow that moving off tawk is meant to remove, in exchange\n// for a field that is wrong often enough to be misleading — IP geolocation\n// routinely resolves to a carrier's routing hub rather than the person, which\n// is why tawk placed a New Jersey visitor in \"Trenton\".\n//\n// The accurate location signal we already hold is the ZIP the customer gives us\n// or that WooCommerce knows, and it costs nothing to collect. So: country, yes.\n// City, no.\n\n/** Two-letter country code from the edge, or null. Never derived from an IP. */\nexport function countryFrom(headers: Headers): string | null {\n const c = headers.get(\"cf-ipcountry\");\n // Cloudflare uses XX for unknown and T1 for Tor exit nodes; neither is a\n // place, and storing them would put nonsense in front of an agent.\n if (!c || c === \"XX\" || c === \"T1\") return null;\n return c.toUpperCase().slice(0, 2);\n}\n\nexport type Device = { os: string | null; browser: string | null };\n\n/**\n * OS and browser from the User-Agent string.\n *\n * Deliberately coarse. An agent needs \"they are on a phone\" to judge whether a\n * long reply is reasonable; nobody needs the patch version of anything, and a\n * precise UA string is a fingerprinting surface we have no use for.\n *\n * Order matters throughout: Edge advertises itself as Chrome, Chrome advertises\n * itself as Safari, and iPadOS advertises itself as a Mac.\n */\nexport function deviceFrom(ua: string | null | undefined): Device {\n const s = String(ua ?? \"\");\n if (!s) return { os: null, browser: null };\n\n let os: string | null = null;\n if (/iPhone|iPod/i.test(s)) os = \"iOS\";\n else if (/iPad/i.test(s) || (/Macintosh/i.test(s) && /Mobile/i.test(s))) os = \"iPadOS\";\n else if (/Android/i.test(s)) os = \"Android\";\n else if (/Windows NT/i.test(s)) os = \"Windows\";\n else if (/Mac OS X|Macintosh/i.test(s)) os = \"macOS\";\n else if (/CrOS/i.test(s)) os = \"ChromeOS\";\n else if (/Linux/i.test(s)) os = \"Linux\";\n\n let browser: string | null = null;\n if (/Edg[A-Z]?\\//i.test(s)) browser = \"Edge\";\n else if (/OPR\\/|Opera/i.test(s)) browser = \"Opera\";\n else if (/SamsungBrowser/i.test(s)) browser = \"Samsung Internet\";\n else if (/FxiOS|Firefox/i.test(s)) browser = \"Firefox\";\n else if (/CriOS/i.test(s)) browser = \"Chrome\";\n else if (/Chrome\\//i.test(s)) browser = \"Chrome\";\n else if (/Safari\\//i.test(s)) browser = \"Safari\";\n\n return { os, browser };\n}\n\n/** True for a phone or tablet, which is most of this site's traffic. */\nexport function isMobile(ua: string | null | undefined): boolean {\n return /Mobile|Android|iPhone|iPad|iPod/i.test(String(ua ?? \"\"));\n}\n\n/**\n * Has this visitor asked not to be profiled?\n *\n * Global Privacy Control is the signal with legal weight behind it in several\n * US states; Do Not Track has none but costs nothing to respect. Strictly,\n * neither obliges a first-party site to stop counting its own page views. We\n * honour them anyway: when this is true the visitor still appears on the\n * monitoring screen and chat works normally, but no profile is built around\n * them — no country, no device, no counters.\n *\n * The widget reads the browser signals and sends the verdict, because\n * navigator.globalPrivacyControl is only readable client-side.\n */\nexport function optedOut(body: any): boolean {\n return body?.dnt === 1 || body?.dnt === true || body?.dnt === \"1\";\n}\n",[185],"ad060421-a1f3-4ea2-9029-2e756e0cc0f3","agent.ts","21f9ee12-a5a5-11f1-8c6d-1607ee4eb77e",67,["D",1788275833366],11,"// The AI turn.\n//\n// The model writes prose. It does not decide anything factual: the Salesforce\n// lookup already ran in code before this is called, and its result arrives\n// below as settled fact. That separation is the entire lesson from tawk's\n// agent, which had the same tool wired and never once called it, then invented\n// a delivery date when asked about an account it could not see.\n\nconst MODEL = \"claude-sonnet-5\";\n\n/** Exported so /health reports the same answer aiReply will actually get. */\nexport function anthropicKey(): string | undefined {\n return Deno.env.get(\"ANTHROPIC_API_KEY\")\n ?? Deno.env.get(\"Anthropic_API_Key\")\n ?? Deno.env.get(\"Anthropic_Key\")\n ?? Deno.env.get(\"anthropic_api_key\");\n}\n\n// Deliberately tight. Long answers in a chat widget read as evasive, and every\n// extra sentence is another chance to assert something unverified.\nconst MAX_TOKENS = 400;\n\n// Pricing and coverage come from ONE place, shared by every channel. This used\n// to be a hand-copied paragraph here, and it was both vaguer than the SMS and\n// phone bots' version and wrong on a product name — it said \"purified\" where\n// the catalogue says \"distilled\".\n//\n// Do not paste a price into this file. Edit tribeca-profile.\n//\n// THE ?v= IS LOad-BEARING. Val Town caches a remote module by URL, so editing\n// tribeca-profile alone does NOT change what this bot says — it keeps quoting\n// the old prices, confidently, with nothing in the logs. Bump the version here\n// (and in every other consumer) whenever PROFILE_VERSION changes.\nimport {\n BUSINESS_PROFILE,\n PRICING_RULE,\n} from \"https://esm.town/v/Tribeca_Rep/tribeca-profile/profile.ts?v=2026-09-01g\";\n\n// Chat-specific facts, which are about this CHANNEL rather than the business,\n// so they do not belong in the shared profile.\nconst CHANNEL = `\nCustomers order through the website; the chat cannot place or modify orders.\n`.trim();\n\nconst SYSTEM = `\nYou are the chat assistant for TriBeCa Beverage.\n\n${BUSINESS_PROFILE}\n\n${CHANNEL}\n\nSTYLE\nShort, direct, conversational. Answer the question first, then stop.\nOne question at a time. No filler openers like \"Happy to help\" or \"Absolutely\".\nNever end every message with a follow-up question.\n\nWHAT YOU MUST NOT DO\nNever state, estimate or imply a delivery date unless it appears in the\nVERIFIED ACCOUNT section below. If it is not there, you do not know it.\nNever confirm an order, payment, cancellation, skip or delivery change was\nmade. You can only note a request for the team.\n${PRICING_RULE}\nNever say whether some other person or business is a customer.\nDo not invent coverage. The service areas above are the complete list; if a ZIP\nor town is not clearly inside one of them, say the team will confirm rather\nthan guessing either way.\n\nWHEN YOU DO NOT KNOW\nSay so plainly and offer to pass it to the team. That is always a better answer\nthan a plausible guess. A customer told \"someone will confirm\" is mildly\ninconvenienced; a customer told a delivery date that does not exist waits at\nhome for nothing.\n\nHANDOFF\nIf the customer asks for a person, or is upset, or the request needs\noperational authority you do not have, tell them you are bringing in the team.\nDo not attempt to resolve it yourself.\n\nCOLLECTING DETAILS\nA phone number is the only way an account can be looked up, so it is worth\nasking for. Ask once, naturally, and do not badger.\n`.trim();\n\n/** Facts the model is allowed to rely on, assembled from verified data only. */\nfunction verifiedBlock(visitor: any): string {\n if (!visitor) return \"\";\n\n const parts: string[] = [];\n\n if (visitor[\"name\"]) parts.push(`Name: ${visitor[\"name\"]}`);\n if (visitor[\"email\"]) parts.push(`Email: ${visitor[\"email\"]}`);\n if (visitor[\"phone\"]) parts.push(`Phone: ${visitor[\"phone\"]}`);\n if (visitor[\"zip\"]) parts.push(`ZIP: ${visitor[\"zip\"]}`);\n if (visitor[\"company\"]) parts.push(`Company: ${visitor[\"company\"]}`);\n\n if (visitor[\"sf_account\"]) {\n parts.push(`Salesforce account: ${visitor[\"sf_account\"]}`);\n parts.push(\n visitor[\"sf_next_delivery\"]\n ? `Next scheduled delivery: ${visitor[\"sf_next_delivery\"]}`\n : `No delivery is currently scheduled for this account.`,\n );\n }\n\n if (!parts.length) {\n // Said explicitly rather than left blank. An empty section invites the\n // model to fill the gap; a stated absence does not.\n return `\\n\\nVERIFIED ACCOUNT\\nNothing is known about this visitor yet. `\n + `You have NOT looked up their account. Do not imply otherwise.`;\n }\n\n return `\\n\\nVERIFIED ACCOUNT\\nThese facts are confirmed. Everything else is unknown.\\n`\n + parts.join(\"\\n\");\n}\n\n/** Map stored messages into the Anthropic format. */\nfunction toTurns(history: any[]): Array<{ role: \"user\" | \"assistant\"; content: string }> {\n const turns: Array<{ role: \"user\" | \"assistant\"; content: string }> = [];\n\n for (const m of history) {\n const sender = String(m[\"sender\"]);\n // System notices are stage directions for the visitor, not conversation.\n if (sender === \"system\") continue;\n\n const role = sender === \"visitor\" ? \"user\" : \"assistant\";\n const body = String(m[\"body\"] ?? \"\").trim();\n if (!body) continue;\n\n // Merge consecutive same-role turns — a visitor sending three quick\n // messages is one turn as far as the model is concerned.\n const last = turns[turns.length - 1];\n if (last && last.role === role) last.content += \"\\n\" + body;\n else turns.push({ role, content: body });\n }\n\n // The API requires the first turn to be from the user.\n while (turns.length && turns[0].role === \"assistant\") turns.shift();\n\n return turns;\n}\n\nexport async function aiReply(history: any[], visitor: any): Promise {\n // Val Town env var names are case-sensitive, and a capitalisation slip in\n // the UI disables the AI silently. Accept the obvious variants rather than\n // fail closed over a capital letter.\n const key = anthropicKey();\n if (!key) {\n console.error(\"ANTHROPIC_API_KEY not set — no AI reply\");\n return null;\n }\n\n const messages = toTurns(history);\n if (!messages.length) return null;\n\n try {\n const res = await fetch(\"https://api.anthropic.com/v1/messages\", {\n method: \"POST\",\n headers: {\n \"x-api-key\": key,\n \"anthropic-version\": \"2023-06-01\",\n \"content-type\": \"application/json\",\n },\n body: JSON.stringify({\n model: MODEL,\n max_tokens: MAX_TOKENS,\n system: SYSTEM + verifiedBlock(visitor),\n messages,\n }),\n signal: AbortSignal.timeout(20000),\n });\n\n if (!res.ok) {\n const detail = await res.text().catch(() => \"\");\n console.error(`anthropic ${res.status}`, detail.slice(0, 300));\n return null;\n }\n\n const data = await res.json();\n const text = (data?.content ?? [])\n .filter((b: any) => b?.type === \"text\")\n .map((b: any) => b.text)\n .join(\"\")\n .trim();\n\n return text || null;\n } catch (err) {\n // Returning null means the visitor sees nothing rather than an error\n // string. The widget shows a quiet fallback and offers a human.\n console.error(\"anthropic call failed:\", err);\n return null;\n }\n}\n",[192],"pulls","branches","forks","envVars",{"_206":208,"_209":63},"connections",{"_206":63,"_207":63},"count","unfilledCount",12,"emptyCount",{"_43":191,"_32":192,"_30":193,"_142":-5,"_41":42,"_40":194,"_144":25,"_38":240,"_13":196,"_33":34,"_35":197,"_24":25,"_148":-5,"_219":241,"_27":242},{"_43":184,"_32":185,"_30":186,"_142":-5,"_41":42,"_40":187,"_144":59,"_38":237,"_13":63,"_33":34,"_35":189,"_24":25,"_148":-5,"_219":238,"_27":239},{"_43":177,"_32":178,"_30":179,"_142":-5,"_41":42,"_40":180,"_144":59,"_38":234,"_13":63,"_33":34,"_35":182,"_24":25,"_148":-5,"_219":235,"_27":236},{"_43":169,"_32":170,"_30":171,"_142":-5,"_41":42,"_40":172,"_144":25,"_38":231,"_13":174,"_33":34,"_35":175,"_24":25,"_148":-5,"_219":232,"_27":233},{"_43":161,"_32":162,"_30":57,"_142":-5,"_41":42,"_40":163,"_144":25,"_38":228,"_13":165,"_33":166,"_35":167,"_24":25,"_148":45,"_219":229,"_27":230},{"_43":154,"_32":155,"_30":156,"_142":-5,"_41":42,"_40":157,"_144":25,"_38":225,"_13":63,"_33":34,"_35":159,"_24":25,"_148":-5,"_219":226,"_27":227},{"_43":150,"_32":28,"_30":31,"_142":-5,"_41":42,"_40":14,"_144":25,"_38":222,"_13":152,"_33":34,"_35":37,"_24":25,"_148":-5,"_219":223,"_27":224},{"_43":139,"_32":140,"_30":141,"_142":-5,"_41":42,"_40":143,"_144":25,"_38":218,"_13":146,"_33":34,"_35":147,"_24":25,"_148":-5,"_219":220,"_27":221},["D",1788268280773],"children",[],[140],["D",1788277577931],[],[28],["D",1788226400302],[],[155],["D",1788275838060],[],[162],["D",1788268336091],[],[170],["D",1788226461106],[],[178],["D",1788268113604],[],[185],["D",1788275833366],[],[192],["D",1788226289223],["D",1789484509295],{"_100":99,"_108":104},{"_100":99,"_101":102,"_103":104,"_18":55,"_105":106,"_107":25},{"_13":89,"_32":90,"_43":42,"_91":44,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":45,"_98":99},"ctx",{"_82":-5,"_128":281,"_282":283,"_284":285,"_286":25,"_287":25,"_288":25,"_289":59,"_290":-5,"_291":-7,"_292":-7,"_293":63,"_294":25,"_295":25,"_296":-5,"_297":25,"_298":25,"_299":25,"_300":-5},"ENV",{"_252":253,"_254":255,"_256":90,"_257":258,"_259":260,"_261":262,"_263":264,"_265":266,"_267":268,"_269":270,"_271":272,"_273":274,"_275":276,"_277":278,"_279":280},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v69