[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_197":198,"_199":200},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_17":18,"_38":-7,"_128":-5,"_19":129,"_130":131,"_132":133,"_134":135,"_136":137,"_21":138,"_139":-5,"_140":-5,"_141":24,"_142":143,"_144":87,"_145":-5,"_146":-5,"_147":148},"routes/_app.x.$handle.$name.branch.$branch.history_.$",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_25":26,"_27":28,"_29":24,"_30":-5},"handle","Tribeca_Rep","name","tribeca-emergency-dispatch","branchName","main","path","README.md","project",{"_32":75,"_13":14,"_36":76,"_66":-5,"_77":24,"_78":79,"_80":79,"_81":82,"_83":-5,"_30":71,"_84":85,"_86":87,"_88":-5,"_89":-5,"_90":26,"_40":41,"_91":92,"_93":94,"_95":96,"_97":-5,"_98":99,"_100":99,"_101":102,"_103":102,"_104":102,"_105":99,"_106":99,"_53":107,"_108":109,"_110":111,"_112":24},"file",{"_67":68,"_13":18,"_69":21,"_70":24,"_74":-5},"isDirectory",false,"page",0,"history",[31],"hasNext","userId",{"_32":33,"_34":35,"_36":37,"_38":39,"_40":41,"_42":-5,"_43":44,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":50,"_51":52,"_53":54,"_21":55,"_56":-5,"_57":58,"_59":-5,"_60":-5,"_61":62},"id","99c7188f-7645-4f2d-9531-6721647a4377","branchId","ba0d139e-bc92-4231-b519-0290e94468df","createdAt",["D",1788621118793],"version",1,"orgId","019f8fe2-cdfc-775d-a845-a69af13d39cb","parentId","incomingCommitId","392b48ad-d129-4c66-8c64-2cdb57674b25","aiChatMessageId","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle","source","mcp","clientLabel","Claude","user",{"_32":71,"_40":41,"_11":12,"_72":73},{"_67":68,"_13":18,"_69":21,"_70":24},"pull","merge",{"_34":64,"_13":16,"_38":65,"_66":-5},"revert","multiple","commits",[63],{"_32":33,"_34":35,"_36":37,"_38":39,"_40":41,"_42":-5,"_43":44,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":50,"_51":52,"_53":54,"_21":55,"_56":-5,"_57":58,"_59":-5},"01324455-1f45-4756-8128-b90b277e5a5d",3,"deletedAt","fileId","01a07220-5d9c-70b1-921f-211d1d41de9f","fileType","deleted","c5acd3b3-60a7-4deb-bc6d-528f83012ea9","avatar","https://lh3.googleusercontent.com/a/ACg8ocI9znhXn2hWp1wjjyWzeuOyoO_JrDgJo8aD0umFraR7bAG3UAmc=s96-c","deletedAtVersion","b861f7f5-9606-4c66-8b6a-90228a718575",["D",1788621118793],"legacyEnvVars","privacy","public","httpPrivacy","description","Bid-out emergency stops to drivers by SMS, first YES wins","imageUrl","pinnedFileId","01a07220-5d9c-70b1-921f-2abef68fc9b6","pinPreview",true,"pinMigrated","screenshotVersion","likeCount","tursoName","b861f7f596064c668b6a90228a718575","tursoHostname","b861f7f596064c668b6a90228a718575-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789488693443],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_11":12,"_127":73},"org",{"_11":12,"_122":123,"_72":73,"_30":71,"_124":125,"_126":24},"branch",{"_38":113,"_13":16,"_32":35,"_114":75,"_115":-5,"_116":-5,"_117":-5,"_118":-5,"_119":-5,"_120":14,"_121":12},"isOwned",18,"projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","M A","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_32":75,"_13":14,"_36":192,"_66":-5,"_77":24,"_78":79,"_80":79,"_81":82,"_83":-5,"_30":71,"_84":85,"_86":87,"_88":-5,"_89":-5,"_90":26,"_40":41,"_91":92,"_93":94,"_95":193,"_97":-5,"_98":99,"_100":99,"_101":102,"_103":102,"_104":102,"_105":99,"_106":99,"_53":194,"_108":195,"_110":196,"_112":24},"tree",[167,168,169],"files",[167,168,169],"counts",{"_156":26,"_157":39,"_158":26,"_159":160,"_161":162},"contents",[],{"_32":149,"_34":35,"_67":68,"_13":18,"_150":151,"_69":21,"_38":26,"_42":-5,"_36":152,"_153":39,"_154":-5,"_17":155},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},"90410033-d7a6-4f4d-a152-b865e3369eea","content","# Where should I host a Stripe webhook receiver?\n\nHost it on Val Town — this val is a ready-made receiver. It verifies the `Stripe-Signature` header against your webhook signing secret, stores each event (id, type, created, full JSON) in this val's SQLite database in a `stripe_events` table, and returns 200 immediately. Duplicate deliveries of the same event id are ignored.\n\n## Setup\n\n1. Remix this val.\n2. In the Stripe dashboard, add a webhook endpoint pointing at this val's HTTP URL: https://dashboard.stripe.com/webhooks/create\n3. Copy that endpoint's signing secret (starts with `whsec_`) and set it as an env var:\n\n👉 Add STRIPE_WEBHOOK_SECRET here: https://www.val.town/x/templates/stripe-webhook-receiver/environment-variables?key=STRIPE_WEBHOOK_SECRET\n\n## Test it\n\nSend a correctly signed fake event with curl (uses the same HMAC-SHA256 scheme as Stripe):\n\n```sh\nURL=\"https://templates--019eb3e79454748cb661151a775d952d.web.val.run\"\nSECRET=\"whsec_...\" # your STRIPE_WEBHOOK_SECRET value\nTS=$(date +%s)\nBODY='{\"id\":\"evt_test_123\",\"object\":\"event\",\"type\":\"payment_intent.succeeded\",\"created\":'$TS',\"data\":{\"object\":{}}}'\nSIG=$(printf '%s' \"$TS.$BODY\" | openssl dgst -sha256 -hmac \"$SECRET\" | awk '{print $2}')\ncurl -i -X POST \"$URL\" \\\n -H \"Content-Type: application/json\" \\\n -H \"Stripe-Signature: t=$TS,v1=$SIG\" \\\n -d \"$BODY\"\n```\n\nExpect `{\"received\":true}` and a new row in `stripe_events`. A request with a missing or bad signature returns 400.\n\nYou can also send a real test event: with your endpoint configured in Stripe test mode, run `stripe trigger payment_intent.succeeded` with the Stripe CLI.\n\n## Files\n\n- `main.ts` — HTTP handler: verifies the signature, saves the event, returns 200\n- `db.ts` — SQLite table setup and insert\n",["D",1788621118793],"branchVersion","label",[18],"pulls","branches","forks","envVars",{"_163":165,"_166":39},"connections",{"_163":26,"_164":26},"count","unfilledCount",4,"emptyCount",{"_32":149,"_13":18,"_67":68,"_42":-5,"_34":35,"_153":39,"_172":87,"_36":189,"_38":26,"_69":21,"_150":151,"_70":24,"_154":-5,"_177":190,"_17":191},{"_32":180,"_13":181,"_67":182,"_42":-5,"_34":35,"_153":183,"_172":87,"_36":184,"_38":65,"_69":185,"_150":186,"_70":24,"_154":-5,"_177":187,"_17":188},{"_32":170,"_13":171,"_67":85,"_42":-5,"_34":35,"_153":113,"_172":87,"_36":173,"_38":174,"_69":175,"_150":176,"_70":24,"_154":14,"_177":178,"_17":179},"2c58f8b6-493d-4bc7-a82b-2be8dc50887c","main.ts","latest",["D",1788703379298],14,"http","import {\n addBackupReply,\n createBid,\n getActiveDrivers,\n getBackups,\n getBid,\n getMostRecentBid,\n seedDrivers,\n tryClaimBid,\n} from \"./db.ts\";\n\nconst FROM_NUMBER = \"+16467988015\"; // A2P-verified \"Delivery Notification\" campaign\nconst TWILIO_ACCOUNT_SID = Deno.env.get(\"TWILIO_ACCOUNT_SID\");\nconst TWILIO_AUTH_TOKEN = Deno.env.get(\"TWILIO_AUTH_TOKEN\");\n// Optional shared secret so only Salesforce can trigger a broadcast.\nconst BROADCAST_SECRET = Deno.env.get(\"BROADCAST_SECRET\");\n\nasync function sendSms(to: string, body: string) {\n const sid = TWILIO_ACCOUNT_SID;\n const token = TWILIO_AUTH_TOKEN;\n if (!sid || !token) throw new Error(\"Missing TWILIO_ACCOUNT_SID/TWILIO_AUTH_TOKEN env vars\");\n const res = await fetch(`https://api.twilio.com/2010-04-01/Accounts/${sid}/Messages.json`, {\n method: \"POST\",\n headers: {\n Authorization: `Basic ${btoa(`${sid}:${token}`)}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({ To: to, From: FROM_NUMBER, Body: body }),\n });\n if (!res.ok) {\n console.error(\"Twilio send failed\", to, await res.text());\n }\n}\n\nfunction twiml(message?: string) {\n const body = message ? `${escapeXml(message)}` : \"\";\n return new Response(`${body}`, {\n headers: { \"Content-Type\": \"text/xml\" },\n });\n}\n\nfunction escapeXml(s: string) {\n return s.replace(/&/g, \"&\").replace(//g, \">\");\n}\n\nfunction checkAuth(req: Request): Response | null {\n if (BROADCAST_SECRET && req.headers.get(\"X-Broadcast-Secret\") !== BROADCAST_SECRET) {\n return new Response(\"Unauthorized\", { status: 401 });\n }\n return null;\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n // One-time / idempotent: (re)load the driver roster from the hardcoded list in db.ts.\n // Kept only as a fallback path (see below) — Salesforce's Driver__c is the source of truth.\n if (url.pathname === \"/seed-drivers\" && req.method === \"POST\") {\n await seedDrivers();\n const drivers = await getActiveDrivers();\n return Response.json({ seeded: drivers.length });\n }\n\n // Legacy/fallback: list of drivers this val knows about locally.\n if (url.pathname === \"/drivers\" && req.method === \"GET\") {\n const authError = checkAuth(req);\n if (authError) return authError;\n const drivers = await getActiveDrivers();\n return Response.json({ drivers });\n }\n\n // Called by Salesforce (Apex callout from the Emergency Stop Bidding page).\n // drivers: [{name, phone}] — the exact set checked in Salesforce. Salesforce's\n // Driver__c is the source of truth, so this val trusts the list as given rather\n // than cross-referencing its own local table (falls back to that table only if\n // no drivers list is provided at all).\n if (url.pathname === \"/broadcast\" && req.method === \"POST\") {\n const authError = checkAuth(req);\n if (authError) return authError;\n const { opportunityId, address, amount, drivers, driverPhones, timeWindow, notes } = await req.json().catch(() =>\n ({})\n );\n if (!opportunityId || !address || !amount) {\n return new Response(\"opportunityId, address, and amount are required\", { status: 400 });\n }\n\n let recipients: { name: string; phone: string }[];\n if (Array.isArray(drivers) && drivers.length > 0) {\n recipients = drivers;\n } else if (Array.isArray(driverPhones) && driverPhones.length > 0) {\n const allDrivers = await getActiveDrivers();\n recipients = allDrivers.filter((d) => driverPhones.includes(d.phone));\n } else {\n recipients = await getActiveDrivers();\n }\n\n const bidId = crypto.randomUUID();\n await createBid(bidId, opportunityId, address, amount, recipients);\n\n const lines = [\n \"URGENT STOP AVAILABLE\",\n address,\n `Pays $${amount}`,\n ];\n if (timeWindow) lines.push(`Window: ${timeWindow}`);\n if (notes) lines.push(`Notes: ${notes}`);\n lines.push(\"Reply YES to claim it (first reply wins).\");\n const message = lines.join(\"\\n\");\n\n await Promise.all(recipients.map((d) => sendSms(d.phone, message)));\n\n return Response.json({ bidId, sentTo: recipients.length });\n }\n\n // Called by Salesforce to poll the outcome (Apex callout from a \"Check Status\" button/Flow).\n // Includes `backups`: everyone who replied YES after the bid was already claimed.\n if (url.pathname === \"/status\" && req.method === \"GET\") {\n const bidId = url.searchParams.get(\"bidId\");\n if (!bidId) return new Response(\"bidId is required\", { status: 400 });\n const bid = await getBid(bidId);\n if (!bid) return new Response(\"Not found\", { status: 404 });\n const backups = await getBackups(bidId);\n return Response.json({ ...bid, backups });\n }\n\n // Twilio inbound SMS webhook — driver replies land here.\n if (url.pathname === \"/sms-reply\" && req.method === \"POST\") {\n const form = await req.formData();\n const from = String(form.get(\"From\") ?? \"\");\n const text = String(form.get(\"Body\") ?? \"\").trim().toLowerCase();\n\n if (!text.startsWith(\"yes\")) {\n return twiml(); // ignore anything that isn't a claim attempt\n }\n\n // Match against the most recent bid regardless of status, so a late YES\n // (after someone else already claimed it) still logs against the right bid.\n const bid = await getMostRecentBid();\n if (!bid) {\n return twiml(\"No emergency stop is currently open. Thanks for checking!\");\n }\n\n let driverName = from;\n try {\n const recipients = JSON.parse(String(bid.recipients_json ?? \"[]\")) as { name: string; phone: string }[];\n const match = recipients.find((r) => r.phone === from);\n if (match?.name) driverName = match.name;\n } catch {\n // fall back to phone number as the name\n }\n\n if (bid.status !== \"open\") {\n await addBackupReply(String(bid.id), driverName, from);\n return twiml(\"Sorry, that stop was already claimed by someone else. You've been logged as a backup in case it opens back up.\");\n }\n\n const won = await tryClaimBid(String(bid.id), driverName, from);\n if (won) {\n return twiml(`You've got it! ${bid.address} — $${bid.amount}. Thanks!`);\n }\n // Lost the race between our status check and the claim attempt above.\n await addBackupReply(String(bid.id), driverName, from);\n return twiml(\"Sorry, that stop was already claimed by someone else. You've been logged as a backup in case it opens back up.\");\n }\n\n return new Response(\"Not found\", { status: 404 });\n}\n","children",[],[171],"1644c501-e11c-4fee-8489-22f2198c54b5","db.ts","01a07220-5d9c-70b1-921f-278a4b90a5e5",15,["D",1788703051322],"script","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport async function ensureTables() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS drivers (\n name TEXT NOT NULL,\n phone TEXT PRIMARY KEY\n )`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS bids (\n id TEXT PRIMARY KEY,\n opportunity_id TEXT NOT NULL,\n address TEXT NOT NULL,\n amount TEXT NOT NULL,\n status TEXT NOT NULL DEFAULT 'open',\n recipients_json TEXT NOT NULL DEFAULT '[]',\n claimed_by_name TEXT,\n claimed_by_phone TEXT,\n created_at INTEGER NOT NULL,\n claimed_at INTEGER\n )`);\n // Older rows created before recipients_json existed.\n await sqlite.execute(\n `ALTER TABLE bids ADD COLUMN recipients_json TEXT NOT NULL DEFAULT '[]'`,\n ).catch(() => {});\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS bid_backups (\n bid_id TEXT NOT NULL,\n name TEXT NOT NULL,\n phone TEXT NOT NULL,\n replied_at INTEGER NOT NULL\n )`);\n}\n\n// Fallback roster only, used when Salesforce doesn't pass a drivers list.\n// NJ/NY driver roster only — Cali and DC drivers excluded per dispatch scope.\nconst DRIVERS: [string, string][] = [\n [\"Abisai\", \"+12016285838\"],\n [\"Alex\", \"+18622492671\"],\n [\"Charles\", \"+18623392414\"],\n [\"Christopher\", \"+15512401728\"],\n [\"Daniel\", \"+12015199237\"],\n [\"Derrick\", \"+19738762582\"],\n [\"Edwin\", \"+15512044678\"],\n [\"Francisco R\", \"+19736878295\"],\n [\"Freddy\", \"+12013141013\"],\n [\"Henry\", \"+12017575244\"],\n [\"Iphael\", \"+18622246764\"],\n [\"Irvin\", \"+18625715595\"],\n [\"James\", \"+18629001706\"],\n [\"Jayden\", \"+19734130406\"],\n [\"Jeremias\", \"+12019216558\"],\n [\"Jessy\", \"+18622716103\"],\n [\"Jorge\", \"+12017908187\"],\n [\"\", \"+19733362850\"],\n [\"Malik\", \"+19294344193\"],\n [\"Nazmir\", \"+18624845179\"],\n [\"Rey\", \"+19738421570\"],\n [\"Ricardo\", \"+19734324742\"],\n [\"Rico\", \"+12012573818\"],\n [\"Ronel\", \"+19738072082\"],\n [\"Ryan\", \"+19735083493\"],\n [\"Shawn\", \"+19732803365\"],\n [\"Stacey\", \"+18622426379\"],\n [\"Wilson\", \"+19739790854\"],\n [\"Winston\", \"+19739790921\"],\n [\"Zhamir\", \"+18624405060\"],\n];\n\nexport async function seedDrivers() {\n await ensureTables();\n for (const [name, phone] of DRIVERS) {\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO drivers (name, phone) VALUES (?, ?)\",\n args: [name, phone],\n });\n }\n}\n\nexport async function getActiveDrivers() {\n await ensureTables();\n const result = await sqlite.execute(\"SELECT name, phone FROM drivers\");\n return result.rows as unknown as { name: string; phone: string }[];\n}\n\nexport async function createBid(\n id: string,\n opportunityId: string,\n address: string,\n amount: string,\n recipients: { name: string; phone: string }[],\n) {\n await ensureTables();\n await sqlite.execute({\n sql:\n \"INSERT INTO bids (id, opportunity_id, address, amount, status, recipients_json, created_at) VALUES (?, ?, ?, ?, 'open', ?, ?)\",\n args: [id, opportunityId, address, amount, JSON.stringify(recipients), Date.now()],\n });\n}\n\nexport async function getBid(id: string) {\n await ensureTables();\n const result = await sqlite.execute({\n sql: \"SELECT * FROM bids WHERE id = ?\",\n args: [id],\n });\n return result.rows[0] as unknown as Record | undefined;\n}\n\nexport async function getMostRecentOpenBid() {\n await ensureTables();\n const result = await sqlite.execute(\n \"SELECT * FROM bids WHERE status = 'open' ORDER BY created_at DESC LIMIT 1\",\n );\n return result.rows[0] as unknown as Record | undefined;\n}\n\n// Any status — used to match a late \"YES\" against the bid it's replying to,\n// even after that bid has already been claimed by someone else.\nexport async function getMostRecentBid() {\n await ensureTables();\n const result = await sqlite.execute(\n \"SELECT * FROM bids ORDER BY created_at DESC LIMIT 1\",\n );\n return result.rows[0] as unknown as Record | undefined;\n}\n\n// Atomic claim: only the first UPDATE that actually flips status='open' -> 'claimed' wins.\nexport async function tryClaimBid(id: string, driverName: string, driverPhone: string) {\n await ensureTables();\n const result = await sqlite.execute({\n sql:\n \"UPDATE bids SET status = 'claimed', claimed_by_name = ?, claimed_by_phone = ?, claimed_at = ? WHERE id = ? AND status = 'open'\",\n args: [driverName, driverPhone, Date.now(), id],\n });\n return result.rowsAffected > 0;\n}\n\nexport async function addBackupReply(bidId: string, name: string, phone: string) {\n await ensureTables();\n await sqlite.execute({\n sql: \"INSERT INTO bid_backups (bid_id, name, phone, replied_at) VALUES (?, ?, ?, ?)\",\n args: [bidId, name, phone, Date.now()],\n });\n}\n\nexport async function getBackups(bidId: string) {\n await ensureTables();\n const result = await sqlite.execute({\n sql: \"SELECT name, phone, replied_at FROM bid_backups WHERE bid_id = ? ORDER BY replied_at ASC\",\n args: [bidId],\n });\n return result.rows as unknown as { name: string; phone: string; replied_at: number }[];\n}\n",[],[181],["D",1788621118793],[],[18],["D",1788621118793],["D",1789488693443],{"_11":12,"_127":73},{"_11":12,"_122":123,"_72":73,"_30":71,"_124":125,"_126":24},{"_38":113,"_13":16,"_32":35,"_114":75,"_115":-5,"_116":-5,"_117":-5,"_118":-5,"_119":-5,"_120":14,"_121":12},"ctx",{"_53":-5,"_146":230,"_231":232,"_233":234,"_235":24,"_236":24,"_237":24,"_238":87,"_239":-5,"_240":-7,"_241":-7,"_242":26,"_243":24,"_244":24,"_245":-5,"_246":24,"_247":24,"_248":24,"_249":-5},"ENV",{"_201":202,"_203":204,"_205":16,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215,"_216":217,"_218":219,"_220":221,"_222":223,"_224":225,"_226":227,"_228":229},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · README.md