[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_161":162,"_163":164},"routes/_app.x.$handle.$name",{"_96":95,"_32":44,"_105":86,"_27":106,"_13":14,"_107":-5,"_11":108,"_109":110,"_111":112,"_113":114,"_115":116,"_20":-5,"_117":-5,"_118":-5,"_119":48,"_120":121,"_122":25,"_123":-5,"_124":-5,"_125":126},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_32":44,"_37":45,"_46":-5,"_47":48,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":25,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":48},"version",16,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",true,"deletedHere","path","_tmp_bcc.ts","latestPath","fileId","8b54d0ea-a0b7-11f1-88e5-1607ee4eb77e","name","fileType","script","content","// TEMPORARY: confirm SendGrid accepts the bcc field in the exact payload the\n// val now sends. `to` is the owner's own address, NOT Crystal Coolers.\nconst KEY = Deno.env.get(\"SENDGRID_API_KEY\")!;\nconst FROM = Deno.env.get(\"REPORT_FROM_EMAIL\") ?? \"info@tribecabeverage.com\";\n\nconst JPEG =\n \"/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/wAALCAABAAEBAREA/8QAFAABAAAAAAAAAAAAAAAAAAAACf/EABQQAQAAAAAAAAAAAAAAAAAAAAD/2gAIAQEAAD8AKp//2Q==\";\n\nconst res = await fetch(\"https://api.sendgrid.com/v3/mail/send\", {\n method: \"POST\",\n headers: { Authorization: `Bearer ${KEY}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n personalizations: [{\n to: [{ email: \"aschoffme@gmail.com\" }],\n bcc: [{ email: FROM }],\n }],\n from: { email: FROM, name: \"TriBeCa Beverage\" },\n reply_to: { email: FROM },\n subject: \"Compromised water cooler\",\n content: [{\n type: \"text/plain\",\n value: \"TEST of the BCC archive copy - please ignore.\\n\\nThe serial number photo is attached.\",\n }],\n attachments: [{\n content: JPEG,\n filename: \"serial.jpg\",\n type: \"image/jpeg\",\n disposition: \"attachment\",\n }],\n }),\n});\nconsole.log(`SendGrid HTTP ${res.status}${res.status === 202 ? \" (accepted)\" : \"\"}`);\nconsole.log(`to aschoffme@gmail.com (test address, NOT Crystal Coolers)`);\nconsole.log(`bcc ${FROM}`);\nif (!res.ok) console.log((await res.text()).slice(0, 400));\n","createdAt",["D",1787684570958],"branchVersion","branchId","7ca66a6a-1b58-4bf5-903e-c8c856ccda9b","id","43d84ff0-963f-4ef2-afe4-361b8dc9f0c6","tribeca-cooler-service-report",["D",1787682484536],"deletedAt","legacyEnvVars",false,"privacy","public","httpPrivacy","description","Phone page: photo a cooler serial, email Crystal Coolers","imageUrl","c5acd3b3-60a7-4deb-bc6d-528f83012ea9","pinnedFileId","b6262b3e-a0b2-11f1-aeac-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f8fe2-cdfc-775d-a845-a69af13d39cb","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_96":95,"_104":100},"org",{"_96":95,"_97":98,"_99":100,"_18":55,"_101":102,"_103":48},"branch",{"_13":85,"_32":86,"_42":41,"_87":43,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":44,"_94":95},"isOwned",27,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","Tribeca_Rep","handle","displayName","M A","avatar","https://lh3.googleusercontent.com/a/ACg8ocI9znhXn2hWp1wjjyWzeuOyoO_JrDgJo8aD0umFraR7bAG3UAmc=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_42":43,"_32":44,"_37":157,"_46":-5,"_47":48,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":25,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":158,"_80":159,"_82":160,"_84":48},"tree",[152],"files",[152],"counts",{"_140":62,"_141":142,"_143":62,"_144":145,"_146":147},"contents",[127],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_42":128,"_32":129,"_30":57,"_130":-5,"_40":41,"_39":131,"_132":48,"_37":133,"_13":134,"_33":135,"_35":136,"_24":48,"_137":138,"_27":139},"b25286ed-588b-4891-9930-99b2c20fbe8a","main.ts","parentId",14,"latest",["D",1787684544637],6,"http","// Cooler service report - a phone page for the field.\n//\n// Someone standing in front of a broken cooler opens this on their phone,\n// photographs the serial plate, optionally types what is wrong, and presses\n// send. The photo and note are emailed to Crystal Coolers.\n//\n// DELIVERY\n// --------\n// Val Town's own mailer cannot do what this val is for, on two counts:\n//\n// 1. `from` is fixed. It refuses anything but `username.valname@valtown.email`\n// - \"Invalid `from` email: info@tribecabeverage.com\".\n// 2. On the free tier `to` must be the account owner. Sending to\n// tkeller@crystalcoolers.com is rejected outright.\n//\n// So the real path is SendGrid, which can send as info@tribecabeverage.com once\n// that sender is verified there. If SENDGRID_API_KEY is absent the val falls\n// back to Val Town mail addressed to the account owner, so a report is never\n// silently lost - it just lands in the Tribeca inbox instead of Crystal's, and\n// the page says so.\nimport { email as valtownEmail } from \"https://esm.town/v/std/email\";\n\nconst TO = Deno.env.get(\"REPORT_TO_EMAIL\") ?? \"tkeller@crystalcoolers.com\";\nconst FROM = Deno.env.get(\"REPORT_FROM_EMAIL\") ?? \"info@tribecabeverage.com\";\nconst COOKIE = \"coolerauth\";\n\n// 8MB after client-side downscaling is already generous; this is a backstop\n// against a client that ignores the resize, not the expected size.\nconst MAX_BYTES = 8 * 1024 * 1024;\n\nconst html = (body: string, status = 200) =>\n new Response(body, {\n status,\n headers: { \"Content-Type\": \"text/html; charset=utf-8\", \"Cache-Control\": \"no-store\" },\n });\n\n// Length-independent compare, so a wrong password cannot be narrowed down by\n// timing the response.\nfunction secretsMatch(a: string, b: string): boolean {\n const enc = new TextEncoder();\n const x = enc.encode(a), y = enc.encode(b);\n let diff = x.length ^ y.length;\n for (let i = 0; i < Math.max(x.length, y.length); i++) diff |= (x[i] ?? 0) ^ (y[i] ?? 0);\n return diff === 0;\n}\n\nfunction authed(req: Request): boolean {\n const expected = Deno.env.get(\"REPORT_ACCESS_KEY\");\n if (!expected) return false;\n const raw = req.headers.get(\"cookie\") ?? \"\";\n const hit = raw.split(\";\").map((c) => c.trim()).find((c) => c.startsWith(`${COOKIE}=`));\n return !!hit && secretsMatch(decodeURIComponent(hit.slice(COOKIE.length + 1)), expected);\n}\n\nconst STYLE = `\n :root { color-scheme: light dark;\n --bg:#fff; --fg:#111827; --muted:#6b7280; --line:#e5e7eb; --panel:#f9fafb;\n --accent:#2563eb; --ok:#15803d; --bad:#b91c1c; }\n @media (prefers-color-scheme: dark) {\n :root { --bg:#0f172a; --fg:#e2e8f0; --muted:#94a3b8; --line:#1e293b; --panel:#1e293b;\n --accent:#3b82f6; --ok:#4ade80; --bad:#fca5a5; }\n }\n * { box-sizing:border-box; -webkit-tap-highlight-color:transparent; }\n body { margin:0; padding:20px 16px 40px; background:var(--bg); color:var(--fg);\n font:16px/1.5 ui-sans-serif,system-ui,-apple-system,\"Segoe UI\",sans-serif; }\n .wrap { max-width:520px; margin:0 auto; }\n h1 { font-size:19px; margin:0 0 4px; }\n .sub { color:var(--muted); font-size:13px; margin:0 0 22px; }\n label { display:block; font-weight:600; font-size:14px; margin:0 0 6px; }\n .hint { color:var(--muted); font-weight:400; font-size:12.5px; }\n /* A 56px target, because this is used one-handed standing in a stockroom. */\n .shoot { display:flex; align-items:center; justify-content:center; gap:10px;\n width:100%; min-height:56px; margin-bottom:6px; padding:14px;\n border:2px dashed var(--line); border-radius:12px; background:var(--panel);\n color:var(--fg); font:inherit; font-weight:600; cursor:pointer; }\n .shoot:active { border-color:var(--accent); }\n input[type=file] { display:none; }\n #preview { display:none; width:100%; border-radius:12px; border:1px solid var(--line);\n margin:10px 0 4px; }\n #retake { display:none; background:none; border:0; color:var(--accent);\n font:inherit; font-size:13px; padding:4px 0; cursor:pointer; }\n textarea { width:100%; min-height:96px; padding:11px 12px; border-radius:10px;\n border:1px solid var(--line); background:var(--panel); color:var(--fg);\n font:inherit; font-size:16px; resize:vertical; }\n .send { width:100%; min-height:56px; margin-top:20px; border:0; border-radius:12px;\n background:var(--accent); color:#fff; font:inherit; font-size:17px;\n font-weight:650; cursor:pointer; }\n .send:disabled { opacity:.45; cursor:default; }\n #msg { margin-top:16px; padding:13px 14px; border-radius:10px; font-size:14px; display:none; }\n #msg.ok { display:block; background:rgba(21,128,61,.12); color:var(--ok); }\n #msg.bad { display:block; background:rgba(185,28,28,.12); color:var(--bad); }\n .field { margin-bottom:20px; }\n input[type=password] { width:100%; padding:12px; font:inherit; font-size:16px;\n border-radius:10px; border:1px solid var(--line);\n background:var(--panel); color:var(--fg); }\n`;\n\nfunction loginPage(bad = false) {\n return html(`\n\nCooler service report

Cooler service report

Enter the password to continue.

\n \n ${bad ? `

That password is not right.

` : \"\"}\n

`);\n}\n\nfunction formPage(fallbackOnly: boolean) {\n return html(`\n\nCooler service report

Cooler service report

Photograph the serial number, add a note if it helps, and send.

\n\n

\n Serial number photo required\n \n \n \n $\"\"$ \n \n

\n\n

\n What is wrong? optional\n \n

\n\n \n

\n`);\n}\n\n// base64 in chunks: a 6MB photo spread over one apply() call blows the argument\n// limit and throws RangeError.\nfunction toBase64(bytes: Uint8Array): string {\n let bin = \"\";\n const CHUNK = 0x8000;\n for (let i = 0; i < bytes.length; i += CHUNK) {\n bin += String.fromCharCode(...bytes.subarray(i, i + CHUNK));\n }\n return btoa(bin);\n}\n\nasync function sendReport(photo: Uint8Array, note: string, filename: string) {\n const subject = \"Compromised water cooler\";\n const text = [\n \"A cooler service request was submitted from the Tribeca field form.\",\n \"\",\n note.trim() ? `Reported problem:\\n${note.trim()}` : \"No description was given.\",\n \"\",\n \"The serial number photo is attached.\",\n ].join(\"\\n\");\n const b64 = toBase64(photo);\n\n const sendgrid = Deno.env.get(\"SENDGRID_API_KEY\");\n if (sendgrid) {\n const res = await fetch(\"https://api.sendgrid.com/v3/mail/send\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${sendgrid}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n // BCC keeps a copy in the Tribeca inbox. Without it the only record of\n // a report is a log line saying one was sent - the photo and the note\n // themselves would exist nowhere but Crystal's mailbox, so \"which\n // serial did the driver photograph?\" would be unanswerable.\n personalizations: [{ to: [{ email: TO }], bcc: [{ email: FROM }] }],\n from: { email: FROM, name: \"TriBeCa Beverage\" },\n reply_to: { email: FROM },\n subject,\n content: [{ type: \"text/plain\", value: text }],\n attachments: [{\n content: b64,\n filename,\n type: \"image/jpeg\",\n disposition: \"attachment\",\n }],\n }),\n });\n if (!res.ok) {\n throw new Error(`SendGrid ${res.status}: ${(await res.text()).slice(0, 300)}`);\n }\n return { to: TO, bcc: FROM, via: \"sendgrid\" as const };\n }\n\n // Fallback. Val Town will not deliver to Crystal Coolers on this plan, so the\n // report goes to the Tribeca inbox to be forwarded by hand rather than lost.\n await valtownEmail({\n subject: `${subject} (NOT sent to Crystal - forward manually)`,\n text: `${text}\\n\\nThis went to the Tribeca inbox because SENDGRID_API_KEY is not set.\\nIntended recipient: ${TO}`,\n attachments: [{ filename, content: b64, type: \"image/jpeg\" }],\n } as any);\n return { to: \"the Tribeca inbox\", bcc: null, via: \"valtown\" as const };\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const { pathname } = url;\n\n if (!Deno.env.get(\"REPORT_ACCESS_KEY\")) {\n return html(\n `` +\n `

Not configured

` +\n `

Set REPORT_ACCESS_KEY on this val to switch the page on.

`,\n 503,\n );\n }\n\n if (pathname === \"/login\" && req.method === \"POST\") {\n const form = await req.formData().catch(() => null);\n const given = String(form?.get(\"password\") ?? \"\");\n const expected = Deno.env.get(\"REPORT_ACCESS_KEY\")!;\n if (given && secretsMatch(given, expected)) {\n return new Response(null, {\n status: 302,\n headers: {\n Location: \"/\",\n // 90 days: a field phone should not be asked to log in every shift.\n \"Set-Cookie\": `${COOKIE}=${encodeURIComponent(expected)}; Path=/; Max-Age=7776000; ` +\n `HttpOnly; Secure; SameSite=Lax`,\n },\n });\n }\n return loginPage(true);\n }\n\n if (pathname === \"/logout\") {\n return new Response(null, {\n status: 302,\n headers: { Location: \"/\", \"Set-Cookie\": `${COOKIE}=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax` },\n });\n }\n\n if (!authed(req)) return loginPage();\n\n if (pathname === \"/send\" && req.method === \"POST\") {\n try {\n const form = await req.formData();\n const photo = form.get(\"photo\");\n if (!(photo instanceof File) || photo.size === 0) {\n return Response.json({ ok: false, error: \"No photo was attached.\" }, { status: 400 });\n }\n if (photo.size > MAX_BYTES) {\n return Response.json(\n { ok: false, error: \"That photo is too large to send.\" },\n { status: 413 },\n );\n }\n const bytes = new Uint8Array(await photo.arrayBuffer());\n const sent = await sendReport(bytes, String(form.get(\"note\") ?? \"\"), \"serial.jpg\");\n console.log(\n `report sent via ${sent.via} to ${sent.to}` +\n `${sent.bcc ? ` bcc ${sent.bcc}` : \"\"} (${bytes.length} bytes)`,\n );\n return Response.json({\n ok: true,\n message: sent.via === \"sendgrid\"\n ? `Sent to ${TO}.`\n : `Sent to ${sent.to}. Crystal Coolers was NOT emailed - SendGrid is not configured yet.`,\n });\n } catch (err) {\n console.log(`send failed: ${String(err)}`);\n return Response.json(\n { ok: false, error: \"The email did not go out. Try again, or tell the office.\" },\n { status: 500 },\n );\n }\n }\n\n return formPage(!Deno.env.get(\"SENDGRID_API_KEY\"));\n}\n","label","tribeca-cooler-report",[129],"pulls","branches",1,"forks","envVars",{"_148":150,"_151":62},"connections",{"_148":62,"_149":62},"count","unfilledCount",2,"emptyCount",{"_42":128,"_32":129,"_30":57,"_130":-5,"_40":41,"_39":131,"_132":48,"_37":153,"_13":134,"_33":135,"_35":136,"_24":48,"_137":138,"_154":155,"_27":156},["D",1787684544637],"children",[],[129],["D",1787682484536],{"_96":95,"_104":100},{"_96":95,"_97":98,"_99":100,"_18":55,"_101":102,"_103":48},{"_13":85,"_32":86,"_42":41,"_87":43,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":44,"_94":95},"ctx",{"_78":-5,"_124":194,"_195":196,"_197":198,"_199":48,"_200":48,"_201":48,"_202":25,"_203":-5,"_204":-7,"_205":-7,"_206":62,"_207":48,"_208":48,"_209":-5,"_210":48,"_211":48,"_212":48,"_213":-5},"ENV",{"_165":166,"_167":168,"_169":86,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189,"_190":191,"_192":193},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v16