[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_185":186,"_187":188},"routes/_app.x.$handle.$name",{"_99":98,"_32":45,"_108":89,"_27":109,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_20":-5,"_120":-5,"_121":-5,"_122":25,"_123":124,"_125":58,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",16,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","01a07220-5d9c-70b1-921f-2abef68fc9b6","name","fileType","http","content","import {\n createBid,\n getActiveDrivers,\n getBid,\n getMostRecentOpenBid,\n seedDrivers,\n tryClaimBid,\n} from \"./db.ts\";\n\nconst FROM_NUMBER = \"+16467988015\"; // A2P-verified \"Delivery Notification\" campaign\nconst TWILIO_ACCOUNT_SID = Deno.env.get(\"TWILIO_ACCOUNT_SID\");\nconst TWILIO_AUTH_TOKEN = Deno.env.get(\"TWILIO_AUTH_TOKEN\");\n// Optional shared secret so only Salesforce can trigger a broadcast.\nconst BROADCAST_SECRET = Deno.env.get(\"BROADCAST_SECRET\");\n\nasync function sendSms(to: string, body: string) {\n const sid = TWILIO_ACCOUNT_SID;\n const token = TWILIO_AUTH_TOKEN;\n if (!sid || !token) throw new Error(\"Missing TWILIO_ACCOUNT_SID/TWILIO_AUTH_TOKEN env vars\");\n const res = await fetch(`https://api.twilio.com/2010-04-01/Accounts/${sid}/Messages.json`, {\n method: \"POST\",\n headers: {\n Authorization: `Basic ${btoa(`${sid}:${token}`)}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({ To: to, From: FROM_NUMBER, Body: body }),\n });\n if (!res.ok) {\n console.error(\"Twilio send failed\", to, await res.text());\n }\n}\n\nfunction twiml(message?: string) {\n const body = message ? `${escapeXml(message)}` : \"\";\n return new Response(`${body}`, {\n headers: { \"Content-Type\": \"text/xml\" },\n });\n}\n\nfunction escapeXml(s: string) {\n return s.replace(/&/g, \"&\").replace(//g, \">\");\n}\n\nfunction checkAuth(req: Request): Response | null {\n if (BROADCAST_SECRET && req.headers.get(\"X-Broadcast-Secret\") !== BROADCAST_SECRET) {\n return new Response(\"Unauthorized\", { status: 401 });\n }\n return null;\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n // One-time / idempotent: (re)load the driver roster from the hardcoded list in db.ts.\n // Kept only as a fallback path (see below) — Salesforce's Driver__c is the source of truth.\n if (url.pathname === \"/seed-drivers\" && req.method === \"POST\") {\n await seedDrivers();\n const drivers = await getActiveDrivers();\n return Response.json({ seeded: drivers.length });\n }\n\n // Legacy/fallback: list of drivers this val knows about locally.\n if (url.pathname === \"/drivers\" && req.method === \"GET\") {\n const authError = checkAuth(req);\n if (authError) return authError;\n const drivers = await getActiveDrivers();\n return Response.json({ drivers });\n }\n\n // Called by Salesforce (Apex callout from the Emergency Stop Bidding page).\n // drivers: [{name, phone}] — the exact set checked in Salesforce. Salesforce's\n // Driver__c is the source of truth, so this val trusts the list as given rather\n // than cross-referencing its own local table (falls back to that table only if\n // no drivers list is provided at all).\n if (url.pathname === \"/broadcast\" && req.method === \"POST\") {\n const authError = checkAuth(req);\n if (authError) return authError;\n const { opportunityId, address, amount, drivers, driverPhones, timeWindow, notes } = await req.json().catch(() =>\n ({})\n );\n if (!opportunityId || !address || !amount) {\n return new Response(\"opportunityId, address, and amount are required\", { status: 400 });\n }\n\n let recipients: { name: string; phone: string }[];\n if (Array.isArray(drivers) && drivers.length > 0) {\n recipients = drivers;\n } else if (Array.isArray(driverPhones) && driverPhones.length > 0) {\n const allDrivers = await getActiveDrivers();\n recipients = allDrivers.filter((d) => driverPhones.includes(d.phone));\n } else {\n recipients = await getActiveDrivers();\n }\n\n const bidId = crypto.randomUUID();\n await createBid(bidId, opportunityId, address, amount, recipients);\n\n const lines = [\n \"URGENT STOP AVAILABLE\",\n address,\n `Pays $${amount}`,\n ];\n if (timeWindow) lines.push(`Window: ${timeWindow}`);\n if (notes) lines.push(`Notes: ${notes}`);\n lines.push(\"Reply YES to claim it (first reply wins).\");\n const message = lines.join(\"\\n\");\n\n await Promise.all(recipients.map((d) => sendSms(d.phone, message)));\n\n return Response.json({ bidId, sentTo: recipients.length });\n }\n\n // Called by Salesforce to poll the outcome (Apex callout from a \"Check Status\" button/Flow).\n if (url.pathname === \"/status\" && req.method === \"GET\") {\n const bidId = url.searchParams.get(\"bidId\");\n if (!bidId) return new Response(\"bidId is required\", { status: 400 });\n const bid = await getBid(bidId);\n if (!bid) return new Response(\"Not found\", { status: 404 });\n return Response.json(bid);\n }\n\n // Twilio inbound SMS webhook — driver replies land here.\n if (url.pathname === \"/sms-reply\" && req.method === \"POST\") {\n const form = await req.formData();\n const from = String(form.get(\"From\") ?? \"\");\n const text = String(form.get(\"Body\") ?? \"\").trim().toLowerCase();\n\n if (!text.startsWith(\"yes\")) {\n return twiml(); // ignore anything that isn't a claim attempt\n }\n\n const bid = await getMostRecentOpenBid();\n if (!bid) {\n return twiml(\"No emergency stop is currently open. Thanks for checking!\");\n }\n\n let driverName = from;\n try {\n const recipients = JSON.parse(String(bid.recipients_json ?? \"[]\")) as { name: string; phone: string }[];\n const match = recipients.find((r) => r.phone === from);\n if (match?.name) driverName = match.name;\n } catch {\n // fall back to phone number as the name\n }\n\n const won = await tryClaimBid(String(bid.id), driverName, from);\n if (won) {\n return twiml(`You've got it! ${bid.address} — $${bid.amount}. Thanks!`);\n }\n return twiml(\"Sorry, that stop was already claimed by someone else.\");\n }\n\n return new Response(\"Not found\", { status: 404 });\n}\n","import {\n addBackupReply,\n createBid,\n getActiveDrivers,\n getBackups,\n getBid,\n getMostRecentBid,\n seedDrivers,\n tryClaimBid,\n} from \"./db.ts\";\n\nconst FROM_NUMBER = \"+16467988015\"; // A2P-verified \"Delivery Notification\" campaign\nconst TWILIO_ACCOUNT_SID = Deno.env.get(\"TWILIO_ACCOUNT_SID\");\nconst TWILIO_AUTH_TOKEN = Deno.env.get(\"TWILIO_AUTH_TOKEN\");\n// Optional shared secret so only Salesforce can trigger a broadcast.\nconst BROADCAST_SECRET = Deno.env.get(\"BROADCAST_SECRET\");\n\nasync function sendSms(to: string, body: string) {\n const sid = TWILIO_ACCOUNT_SID;\n const token = TWILIO_AUTH_TOKEN;\n if (!sid || !token) throw new Error(\"Missing TWILIO_ACCOUNT_SID/TWILIO_AUTH_TOKEN env vars\");\n const res = await fetch(`https://api.twilio.com/2010-04-01/Accounts/${sid}/Messages.json`, {\n method: \"POST\",\n headers: {\n Authorization: `Basic ${btoa(`${sid}:${token}`)}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({ To: to, From: FROM_NUMBER, Body: body }),\n });\n if (!res.ok) {\n console.error(\"Twilio send failed\", to, await res.text());\n }\n}\n\nfunction twiml(message?: string) {\n const body = message ? `${escapeXml(message)}` : \"\";\n return new Response(`${body}`, {\n headers: { \"Content-Type\": \"text/xml\" },\n });\n}\n\nfunction escapeXml(s: string) {\n return s.replace(/&/g, \"&\").replace(//g, \">\");\n}\n\nfunction checkAuth(req: Request): Response | null {\n if (BROADCAST_SECRET && req.headers.get(\"X-Broadcast-Secret\") !== BROADCAST_SECRET) {\n return new Response(\"Unauthorized\", { status: 401 });\n }\n return null;\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n // One-time / idempotent: (re)load the driver roster from the hardcoded list in db.ts.\n // Kept only as a fallback path (see below) — Salesforce's Driver__c is the source of truth.\n if (url.pathname === \"/seed-drivers\" && req.method === \"POST\") {\n await seedDrivers();\n const drivers = await getActiveDrivers();\n return Response.json({ seeded: drivers.length });\n }\n\n // Legacy/fallback: list of drivers this val knows about locally.\n if (url.pathname === \"/drivers\" && req.method === \"GET\") {\n const authError = checkAuth(req);\n if (authError) return authError;\n const drivers = await getActiveDrivers();\n return Response.json({ drivers });\n }\n\n // Called by Salesforce (Apex callout from the Emergency Stop Bidding page).\n // drivers: [{name, phone}] — the exact set checked in Salesforce. Salesforce's\n // Driver__c is the source of truth, so this val trusts the list as given rather\n // than cross-referencing its own local table (falls back to that table only if\n // no drivers list is provided at all).\n if (url.pathname === \"/broadcast\" && req.method === \"POST\") {\n const authError = checkAuth(req);\n if (authError) return authError;\n const { opportunityId, address, amount, drivers, driverPhones, timeWindow, notes } = await req.json().catch(() =>\n ({})\n );\n if (!opportunityId || !address || !amount) {\n return new Response(\"opportunityId, address, and amount are required\", { status: 400 });\n }\n\n let recipients: { name: string; phone: string }[];\n if (Array.isArray(drivers) && drivers.length > 0) {\n recipients = drivers;\n } else if (Array.isArray(driverPhones) && driverPhones.length > 0) {\n const allDrivers = await getActiveDrivers();\n recipients = allDrivers.filter((d) => driverPhones.includes(d.phone));\n } else {\n recipients = await getActiveDrivers();\n }\n\n const bidId = crypto.randomUUID();\n await createBid(bidId, opportunityId, address, amount, recipients);\n\n const lines = [\n \"URGENT STOP AVAILABLE\",\n address,\n `Pays $${amount}`,\n ];\n if (timeWindow) lines.push(`Window: ${timeWindow}`);\n if (notes) lines.push(`Notes: ${notes}`);\n lines.push(\"Reply YES to claim it (first reply wins).\");\n const message = lines.join(\"\\n\");\n\n await Promise.all(recipients.map((d) => sendSms(d.phone, message)));\n\n return Response.json({ bidId, sentTo: recipients.length });\n }\n\n // Called by Salesforce to poll the outcome (Apex callout from a \"Check Status\" button/Flow).\n // Includes `backups`: everyone who replied YES after the bid was already claimed.\n if (url.pathname === \"/status\" && req.method === \"GET\") {\n const bidId = url.searchParams.get(\"bidId\");\n if (!bidId) return new Response(\"bidId is required\", { status: 400 });\n const bid = await getBid(bidId);\n if (!bid) return new Response(\"Not found\", { status: 404 });\n const backups = await getBackups(bidId);\n return Response.json({ ...bid, backups });\n }\n\n // Twilio inbound SMS webhook — driver replies land here.\n if (url.pathname === \"/sms-reply\" && req.method === \"POST\") {\n const form = await req.formData();\n const from = String(form.get(\"From\") ?? \"\");\n const text = String(form.get(\"Body\") ?? \"\").trim().toLowerCase();\n\n if (!text.startsWith(\"yes\")) {\n return twiml(); // ignore anything that isn't a claim attempt\n }\n\n // Match against the most recent bid regardless of status, so a late YES\n // (after someone else already claimed it) still logs against the right bid.\n const bid = await getMostRecentBid();\n if (!bid) {\n return twiml(\"No emergency stop is currently open. Thanks for checking!\");\n }\n\n let driverName = from;\n try {\n const recipients = JSON.parse(String(bid.recipients_json ?? \"[]\")) as { name: string; phone: string }[];\n const match = recipients.find((r) => r.phone === from);\n if (match?.name) driverName = match.name;\n } catch {\n // fall back to phone number as the name\n }\n\n if (bid.status !== \"open\") {\n await addBackupReply(String(bid.id), driverName, from);\n return twiml(\"Sorry, that stop was already claimed by someone else. You've been logged as a backup in case it opens back up.\");\n }\n\n const won = await tryClaimBid(String(bid.id), driverName, from);\n if (won) {\n return twiml(`You've got it! ${bid.address} — $${bid.amount}. Thanks!`);\n }\n // Lost the race between our status check and the claim attempt above.\n await addBackupReply(String(bid.id), driverName, from);\n return twiml(\"Sorry, that stop was already claimed by someone else. You've been logged as a backup in case it opens back up.\");\n }\n\n return new Response(\"Not found\", { status: 404 });\n}\n","createdAt",["D",1788703086513],"branchVersion","branchId","ba0d139e-bc92-4231-b519-0290e94468df","id","b861f7f5-9606-4c66-8b6a-90228a718575","tribeca-emergency-dispatch",["D",1788621118793],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Bid-out emergency stops to drivers by SMS, first YES wins","imageUrl","c5acd3b3-60a7-4deb-bc6d-528f83012ea9","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f8fe2-cdfc-775d-a845-a69af13d39cb","tursoName","b861f7f596064c668b6a90228a718575","tursoHostname","b861f7f596064c668b6a90228a718575-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789488693443],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_107":103},"org",{"_99":98,"_100":101,"_102":103,"_18":55,"_104":105,"_106":25},"branch",{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"isOwned",18,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","Tribeca_Rep","handle","displayName","M A","avatar","https://lh3.googleusercontent.com/a/ACg8ocI9znhXn2hWp1wjjyWzeuOyoO_JrDgJo8aD0umFraR7bAG3UAmc=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":180,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":181,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":182,"_83":183,"_85":184,"_87":25},"tree",[167,168,169],"files",[167,168,169],"counts",{"_156":62,"_157":152,"_158":62,"_159":160,"_161":162},"contents",[130,131,132],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":149,"_32":150,"_30":151,"_134":-5,"_41":42,"_40":152,"_135":58,"_38":153,"_13":62,"_33":20,"_35":154,"_24":25,"_138":-5,"_27":155},{"_43":140,"_32":141,"_30":142,"_134":-5,"_41":42,"_40":143,"_135":58,"_38":144,"_13":145,"_33":146,"_35":147,"_24":25,"_138":-5,"_27":148},{"_43":133,"_32":28,"_30":31,"_134":-5,"_41":42,"_40":14,"_135":25,"_38":136,"_13":137,"_33":34,"_35":37,"_24":25,"_138":45,"_27":139},"b2b10426-8868-484d-b47c-f5f40a32469c","parentId","latest",["D",1788703086513],12,"label",[28],"1644c501-e11c-4fee-8489-22f2198c54b5","db.ts","01a07220-5d9c-70b1-921f-278a4b90a5e5",15,["D",1788703051322],3,"script","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport async function ensureTables() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS drivers (\n name TEXT NOT NULL,\n phone TEXT PRIMARY KEY\n )`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS bids (\n id TEXT PRIMARY KEY,\n opportunity_id TEXT NOT NULL,\n address TEXT NOT NULL,\n amount TEXT NOT NULL,\n status TEXT NOT NULL DEFAULT 'open',\n recipients_json TEXT NOT NULL DEFAULT '[]',\n claimed_by_name TEXT,\n claimed_by_phone TEXT,\n created_at INTEGER NOT NULL,\n claimed_at INTEGER\n )`);\n // Older rows created before recipients_json existed.\n await sqlite.execute(\n `ALTER TABLE bids ADD COLUMN recipients_json TEXT NOT NULL DEFAULT '[]'`,\n ).catch(() => {});\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS bid_backups (\n bid_id TEXT NOT NULL,\n name TEXT NOT NULL,\n phone TEXT NOT NULL,\n replied_at INTEGER NOT NULL\n )`);\n}\n\n// Fallback roster only, used when Salesforce doesn't pass a drivers list.\n// NJ/NY driver roster only — Cali and DC drivers excluded per dispatch scope.\nconst DRIVERS: [string, string][] = [\n [\"Abisai\", \"+12016285838\"],\n [\"Alex\", \"+18622492671\"],\n [\"Charles\", \"+18623392414\"],\n [\"Christopher\", \"+15512401728\"],\n [\"Daniel\", \"+12015199237\"],\n [\"Derrick\", \"+19738762582\"],\n [\"Edwin\", \"+15512044678\"],\n [\"Francisco R\", \"+19736878295\"],\n [\"Freddy\", \"+12013141013\"],\n [\"Henry\", \"+12017575244\"],\n [\"Iphael\", \"+18622246764\"],\n [\"Irvin\", \"+18625715595\"],\n [\"James\", \"+18629001706\"],\n [\"Jayden\", \"+19734130406\"],\n [\"Jeremias\", \"+12019216558\"],\n [\"Jessy\", \"+18622716103\"],\n [\"Jorge\", \"+12017908187\"],\n [\"\", \"+19733362850\"],\n [\"Malik\", \"+19294344193\"],\n [\"Nazmir\", \"+18624845179\"],\n [\"Rey\", \"+19738421570\"],\n [\"Ricardo\", \"+19734324742\"],\n [\"Rico\", \"+12012573818\"],\n [\"Ronel\", \"+19738072082\"],\n [\"Ryan\", \"+19735083493\"],\n [\"Shawn\", \"+19732803365\"],\n [\"Stacey\", \"+18622426379\"],\n [\"Wilson\", \"+19739790854\"],\n [\"Winston\", \"+19739790921\"],\n [\"Zhamir\", \"+18624405060\"],\n];\n\nexport async function seedDrivers() {\n await ensureTables();\n for (const [name, phone] of DRIVERS) {\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO drivers (name, phone) VALUES (?, ?)\",\n args: [name, phone],\n });\n }\n}\n\nexport async function getActiveDrivers() {\n await ensureTables();\n const result = await sqlite.execute(\"SELECT name, phone FROM drivers\");\n return result.rows as unknown as { name: string; phone: string }[];\n}\n\nexport async function createBid(\n id: string,\n opportunityId: string,\n address: string,\n amount: string,\n recipients: { name: string; phone: string }[],\n) {\n await ensureTables();\n await sqlite.execute({\n sql:\n \"INSERT INTO bids (id, opportunity_id, address, amount, status, recipients_json, created_at) VALUES (?, ?, ?, ?, 'open', ?, ?)\",\n args: [id, opportunityId, address, amount, JSON.stringify(recipients), Date.now()],\n });\n}\n\nexport async function getBid(id: string) {\n await ensureTables();\n const result = await sqlite.execute({\n sql: \"SELECT * FROM bids WHERE id = ?\",\n args: [id],\n });\n return result.rows[0] as unknown as Record | undefined;\n}\n\nexport async function getMostRecentOpenBid() {\n await ensureTables();\n const result = await sqlite.execute(\n \"SELECT * FROM bids WHERE status = 'open' ORDER BY created_at DESC LIMIT 1\",\n );\n return result.rows[0] as unknown as Record | undefined;\n}\n\n// Any status — used to match a late \"YES\" against the bid it's replying to,\n// even after that bid has already been claimed by someone else.\nexport async function getMostRecentBid() {\n await ensureTables();\n const result = await sqlite.execute(\n \"SELECT * FROM bids ORDER BY created_at DESC LIMIT 1\",\n );\n return result.rows[0] as unknown as Record | undefined;\n}\n\n// Atomic claim: only the first UPDATE that actually flips status='open' -> 'claimed' wins.\nexport async function tryClaimBid(id: string, driverName: string, driverPhone: string) {\n await ensureTables();\n const result = await sqlite.execute({\n sql:\n \"UPDATE bids SET status = 'claimed', claimed_by_name = ?, claimed_by_phone = ?, claimed_at = ? WHERE id = ? AND status = 'open'\",\n args: [driverName, driverPhone, Date.now(), id],\n });\n return result.rowsAffected > 0;\n}\n\nexport async function addBackupReply(bidId: string, name: string, phone: string) {\n await ensureTables();\n await sqlite.execute({\n sql: \"INSERT INTO bid_backups (bid_id, name, phone, replied_at) VALUES (?, ?, ?, ?)\",\n args: [bidId, name, phone, Date.now()],\n });\n}\n\nexport async function getBackups(bidId: string) {\n await ensureTables();\n const result = await sqlite.execute({\n sql: \"SELECT name, phone, replied_at FROM bid_backups WHERE bid_id = ? ORDER BY replied_at ASC\",\n args: [bidId],\n });\n return result.rows as unknown as { name: string; phone: string; replied_at: number }[];\n}\n",[141],"90410033-d7a6-4f4d-a152-b865e3369eea","README.md","01a07220-5d9c-70b1-921f-211d1d41de9f",1,["D",1788621118793],"# Where should I host a Stripe webhook receiver?\n\nHost it on Val Town — this val is a ready-made receiver. It verifies the `Stripe-Signature` header against your webhook signing secret, stores each event (id, type, created, full JSON) in this val's SQLite database in a `stripe_events` table, and returns 200 immediately. Duplicate deliveries of the same event id are ignored.\n\n## Setup\n\n1. Remix this val.\n2. In the Stripe dashboard, add a webhook endpoint pointing at this val's HTTP URL: https://dashboard.stripe.com/webhooks/create\n3. Copy that endpoint's signing secret (starts with `whsec_`) and set it as an env var:\n\n👉 Add STRIPE_WEBHOOK_SECRET here: https://www.val.town/x/templates/stripe-webhook-receiver/environment-variables?key=STRIPE_WEBHOOK_SECRET\n\n## Test it\n\nSend a correctly signed fake event with curl (uses the same HMAC-SHA256 scheme as Stripe):\n\n```sh\nURL=\"https://templates--019eb3e79454748cb661151a775d952d.web.val.run\"\nSECRET=\"whsec_...\" # your STRIPE_WEBHOOK_SECRET value\nTS=$(date +%s)\nBODY='{\"id\":\"evt_test_123\",\"object\":\"event\",\"type\":\"payment_intent.succeeded\",\"created\":'$TS',\"data\":{\"object\":{}}}'\nSIG=$(printf '%s' \"$TS.$BODY\" | openssl dgst -sha256 -hmac \"$SECRET\" | awk '{print $2}')\ncurl -i -X POST \"$URL\" \\\n -H \"Content-Type: application/json\" \\\n -H \"Stripe-Signature: t=$TS,v1=$SIG\" \\\n -d \"$BODY\"\n```\n\nExpect `{\"received\":true}` and a new row in `stripe_events`. A request with a missing or bad signature returns 400.\n\nYou can also send a real test event: with your endpoint configured in Stripe test mode, run `stripe trigger payment_intent.succeeded` with the Stripe CLI.\n\n## Files\n\n- `main.ts` — HTTP handler: verifies the signature, saves the event, returns 200\n- `db.ts` — SQLite table setup and insert\n",[150],"pulls","branches","forks","envVars",{"_163":165,"_166":152},"connections",{"_163":62,"_164":62},"count","unfilledCount",4,"emptyCount",{"_43":149,"_32":150,"_30":151,"_134":-5,"_41":42,"_40":152,"_135":58,"_38":177,"_13":62,"_33":20,"_35":154,"_24":25,"_138":-5,"_171":178,"_27":179},{"_43":140,"_32":141,"_30":142,"_134":-5,"_41":42,"_40":143,"_135":58,"_38":174,"_13":145,"_33":146,"_35":147,"_24":25,"_138":-5,"_171":175,"_27":176},{"_43":133,"_32":28,"_30":31,"_134":-5,"_41":42,"_40":14,"_135":25,"_38":170,"_13":137,"_33":34,"_35":37,"_24":25,"_138":45,"_171":172,"_27":173},["D",1788703086513],"children",[],[28],["D",1788703051322],[],[141],["D",1788621118793],[],[150],["D",1788621118793],["D",1789488693443],{"_99":98,"_107":103},{"_99":98,"_100":101,"_102":103,"_18":55,"_104":105,"_106":25},{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"ctx",{"_81":-5,"_127":218,"_219":220,"_221":222,"_223":25,"_224":25,"_225":25,"_226":58,"_227":-5,"_228":-7,"_229":-7,"_230":62,"_231":25,"_232":25,"_233":-5,"_234":25,"_235":25,"_236":25,"_237":-5},"ENV",{"_189":190,"_191":192,"_193":89,"_194":195,"_196":197,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215,"_216":217},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v16