[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_183":184,"_185":186},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_139":-5,"_20":140,"_22":141,"_142":143,"_144":145,"_26":146,"_24":147,"_148":-5,"_149":-5,"_150":51,"_151":152,"_153":43,"_154":-5,"_155":-5,"_156":157},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","Tribeca_Rep","name","tribeca-emergency-dispatch","branchName","main","version","path","README.md","project",{"_33":81,"_13":14,"_44":82,"_83":-5,"_84":51,"_85":86,"_87":86,"_88":89,"_90":-5,"_91":92,"_93":59,"_94":43,"_95":-5,"_96":-5,"_97":46,"_98":99,"_100":101,"_102":103,"_104":105,"_106":-5,"_107":108,"_109":108,"_110":111,"_112":111,"_113":111,"_114":108,"_115":108,"_116":117,"_118":119,"_120":121,"_122":51},"tree",[54,55,56],"file",{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":24,"_48":49,"_50":51,"_52":-5,"_18":53},"contents",[],"upstream","pull","ahead","behind","envVars","id","90410033-d7a6-4f4d-a152-b865e3369eea","fileId","01a07220-5d9c-70b1-921f-211d1d41de9f","parentId","branchId","ba0d139e-bc92-4231-b519-0290e94468df","branchVersion",1,"latest",true,"createdAt",["D",1788621118793],0,"fileType","content","# Where should I host a Stripe webhook receiver?\n\nHost it on Val Town — this val is a ready-made receiver. It verifies the `Stripe-Signature` header against your webhook signing secret, stores each event (id, type, created, full JSON) in this val's SQLite database in a `stripe_events` table, and returns 200 immediately. Duplicate deliveries of the same event id are ignored.\n\n## Setup\n\n1. Remix this val.\n2. In the Stripe dashboard, add a webhook endpoint pointing at this val's HTTP URL: https://dashboard.stripe.com/webhooks/create\n3. Copy that endpoint's signing secret (starts with `whsec_`) and set it as an env var:\n\n👉 Add STRIPE_WEBHOOK_SECRET here: https://www.val.town/x/templates/stripe-webhook-receiver/environment-variables?key=STRIPE_WEBHOOK_SECRET\n\n## Test it\n\nSend a correctly signed fake event with curl (uses the same HMAC-SHA256 scheme as Stripe):\n\n```sh\nURL=\"https://templates--019eb3e79454748cb661151a775d952d.web.val.run\"\nSECRET=\"whsec_...\" # your STRIPE_WEBHOOK_SECRET value\nTS=$(date +%s)\nBODY='{\"id\":\"evt_test_123\",\"object\":\"event\",\"type\":\"payment_intent.succeeded\",\"created\":'$TS',\"data\":{\"object\":{}}}'\nSIG=$(printf '%s' \"$TS.$BODY\" | openssl dgst -sha256 -hmac \"$SECRET\" | awk '{print $2}')\ncurl -i -X POST \"$URL\" \\\n -H \"Content-Type: application/json\" \\\n -H \"Stripe-Signature: t=$TS,v1=$SIG\" \\\n -d \"$BODY\"\n```\n\nExpect `{\"received\":true}` and a new row in `stripe_events`. A request with a missing or bad signature returns 400.\n\nYou can also send a real test event: with your endpoint configured in Stripe test mode, run `stripe trigger payment_intent.succeeded` with the Stripe CLI.\n\n## Files\n\n- `main.ts` — HTTP handler: verifies the signature, saves the event, returns 200\n- `db.ts` — SQLite table setup and insert\n","deleted",false,"label",[19],{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":78,"_17":46,"_47":24,"_48":49,"_50":51,"_52":-5,"_65":79,"_18":80},{"_33":68,"_13":69,"_35":70,"_37":-5,"_38":39,"_40":71,"_42":43,"_44":72,"_17":73,"_47":74,"_48":75,"_50":51,"_52":-5,"_65":76,"_18":77},{"_33":57,"_13":58,"_35":59,"_37":-5,"_38":39,"_40":60,"_42":43,"_44":61,"_17":62,"_47":63,"_48":64,"_50":51,"_52":14,"_65":66,"_18":67},"2c58f8b6-493d-4bc7-a82b-2be8dc50887c","main.ts","01a07220-5d9c-70b1-921f-2abef68fc9b6",18,["D",1788703379298],14,"http","import {\n addBackupReply,\n createBid,\n getActiveDrivers,\n getBackups,\n getBid,\n getMostRecentBid,\n seedDrivers,\n tryClaimBid,\n} from \"./db.ts\";\n\nconst FROM_NUMBER = \"+16467988015\"; // A2P-verified \"Delivery Notification\" campaign\nconst TWILIO_ACCOUNT_SID = Deno.env.get(\"TWILIO_ACCOUNT_SID\");\nconst TWILIO_AUTH_TOKEN = Deno.env.get(\"TWILIO_AUTH_TOKEN\");\n// Optional shared secret so only Salesforce can trigger a broadcast.\nconst BROADCAST_SECRET = Deno.env.get(\"BROADCAST_SECRET\");\n\nasync function sendSms(to: string, body: string) {\n const sid = TWILIO_ACCOUNT_SID;\n const token = TWILIO_AUTH_TOKEN;\n if (!sid || !token) throw new Error(\"Missing TWILIO_ACCOUNT_SID/TWILIO_AUTH_TOKEN env vars\");\n const res = await fetch(`https://api.twilio.com/2010-04-01/Accounts/${sid}/Messages.json`, {\n method: \"POST\",\n headers: {\n Authorization: `Basic ${btoa(`${sid}:${token}`)}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({ To: to, From: FROM_NUMBER, Body: body }),\n });\n if (!res.ok) {\n console.error(\"Twilio send failed\", to, await res.text());\n }\n}\n\nfunction twiml(message?: string) {\n const body = message ? `${escapeXml(message)}` : \"\";\n return new Response(`${body}`, {\n headers: { \"Content-Type\": \"text/xml\" },\n });\n}\n\nfunction escapeXml(s: string) {\n return s.replace(/&/g, \"&\").replace(//g, \">\");\n}\n\nfunction checkAuth(req: Request): Response | null {\n if (BROADCAST_SECRET && req.headers.get(\"X-Broadcast-Secret\") !== BROADCAST_SECRET) {\n return new Response(\"Unauthorized\", { status: 401 });\n }\n return null;\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n // One-time / idempotent: (re)load the driver roster from the hardcoded list in db.ts.\n // Kept only as a fallback path (see below) — Salesforce's Driver__c is the source of truth.\n if (url.pathname === \"/seed-drivers\" && req.method === \"POST\") {\n await seedDrivers();\n const drivers = await getActiveDrivers();\n return Response.json({ seeded: drivers.length });\n }\n\n // Legacy/fallback: list of drivers this val knows about locally.\n if (url.pathname === \"/drivers\" && req.method === \"GET\") {\n const authError = checkAuth(req);\n if (authError) return authError;\n const drivers = await getActiveDrivers();\n return Response.json({ drivers });\n }\n\n // Called by Salesforce (Apex callout from the Emergency Stop Bidding page).\n // drivers: [{name, phone}] — the exact set checked in Salesforce. Salesforce's\n // Driver__c is the source of truth, so this val trusts the list as given rather\n // than cross-referencing its own local table (falls back to that table only if\n // no drivers list is provided at all).\n if (url.pathname === \"/broadcast\" && req.method === \"POST\") {\n const authError = checkAuth(req);\n if (authError) return authError;\n const { opportunityId, address, amount, drivers, driverPhones, timeWindow, notes } = await req.json().catch(() =>\n ({})\n );\n if (!opportunityId || !address || !amount) {\n return new Response(\"opportunityId, address, and amount are required\", { status: 400 });\n }\n\n let recipients: { name: string; phone: string }[];\n if (Array.isArray(drivers) && drivers.length > 0) {\n recipients = drivers;\n } else if (Array.isArray(driverPhones) && driverPhones.length > 0) {\n const allDrivers = await getActiveDrivers();\n recipients = allDrivers.filter((d) => driverPhones.includes(d.phone));\n } else {\n recipients = await getActiveDrivers();\n }\n\n const bidId = crypto.randomUUID();\n await createBid(bidId, opportunityId, address, amount, recipients);\n\n const lines = [\n \"URGENT STOP AVAILABLE\",\n address,\n `Pays $${amount}`,\n ];\n if (timeWindow) lines.push(`Window: ${timeWindow}`);\n if (notes) lines.push(`Notes: ${notes}`);\n lines.push(\"Reply YES to claim it (first reply wins).\");\n const message = lines.join(\"\\n\");\n\n await Promise.all(recipients.map((d) => sendSms(d.phone, message)));\n\n return Response.json({ bidId, sentTo: recipients.length });\n }\n\n // Called by Salesforce to poll the outcome (Apex callout from a \"Check Status\" button/Flow).\n // Includes `backups`: everyone who replied YES after the bid was already claimed.\n if (url.pathname === \"/status\" && req.method === \"GET\") {\n const bidId = url.searchParams.get(\"bidId\");\n if (!bidId) return new Response(\"bidId is required\", { status: 400 });\n const bid = await getBid(bidId);\n if (!bid) return new Response(\"Not found\", { status: 404 });\n const backups = await getBackups(bidId);\n return Response.json({ ...bid, backups });\n }\n\n // Twilio inbound SMS webhook — driver replies land here.\n if (url.pathname === \"/sms-reply\" && req.method === \"POST\") {\n const form = await req.formData();\n const from = String(form.get(\"From\") ?? \"\");\n const text = String(form.get(\"Body\") ?? \"\").trim().toLowerCase();\n\n if (!text.startsWith(\"yes\")) {\n return twiml(); // ignore anything that isn't a claim attempt\n }\n\n // Match against the most recent bid regardless of status, so a late YES\n // (after someone else already claimed it) still logs against the right bid.\n const bid = await getMostRecentBid();\n if (!bid) {\n return twiml(\"No emergency stop is currently open. Thanks for checking!\");\n }\n\n let driverName = from;\n try {\n const recipients = JSON.parse(String(bid.recipients_json ?? \"[]\")) as { name: string; phone: string }[];\n const match = recipients.find((r) => r.phone === from);\n if (match?.name) driverName = match.name;\n } catch {\n // fall back to phone number as the name\n }\n\n if (bid.status !== \"open\") {\n await addBackupReply(String(bid.id), driverName, from);\n return twiml(\"Sorry, that stop was already claimed by someone else. You've been logged as a backup in case it opens back up.\");\n }\n\n const won = await tryClaimBid(String(bid.id), driverName, from);\n if (won) {\n return twiml(`You've got it! ${bid.address} — $${bid.amount}. Thanks!`);\n }\n // Lost the race between our status check and the claim attempt above.\n await addBackupReply(String(bid.id), driverName, from);\n return twiml(\"Sorry, that stop was already claimed by someone else. You've been logged as a backup in case it opens back up.\");\n }\n\n return new Response(\"Not found\", { status: 404 });\n}\n","children",[],[58],"1644c501-e11c-4fee-8489-22f2198c54b5","db.ts","01a07220-5d9c-70b1-921f-278a4b90a5e5",15,["D",1788703051322],3,"script","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport async function ensureTables() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS drivers (\n name TEXT NOT NULL,\n phone TEXT PRIMARY KEY\n )`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS bids (\n id TEXT PRIMARY KEY,\n opportunity_id TEXT NOT NULL,\n address TEXT NOT NULL,\n amount TEXT NOT NULL,\n status TEXT NOT NULL DEFAULT 'open',\n recipients_json TEXT NOT NULL DEFAULT '[]',\n claimed_by_name TEXT,\n claimed_by_phone TEXT,\n created_at INTEGER NOT NULL,\n claimed_at INTEGER\n )`);\n // Older rows created before recipients_json existed.\n await sqlite.execute(\n `ALTER TABLE bids ADD COLUMN recipients_json TEXT NOT NULL DEFAULT '[]'`,\n ).catch(() => {});\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS bid_backups (\n bid_id TEXT NOT NULL,\n name TEXT NOT NULL,\n phone TEXT NOT NULL,\n replied_at INTEGER NOT NULL\n )`);\n}\n\n// Fallback roster only, used when Salesforce doesn't pass a drivers list.\n// NJ/NY driver roster only — Cali and DC drivers excluded per dispatch scope.\nconst DRIVERS: [string, string][] = [\n [\"Abisai\", \"+12016285838\"],\n [\"Alex\", \"+18622492671\"],\n [\"Charles\", \"+18623392414\"],\n [\"Christopher\", \"+15512401728\"],\n [\"Daniel\", \"+12015199237\"],\n [\"Derrick\", \"+19738762582\"],\n [\"Edwin\", \"+15512044678\"],\n [\"Francisco R\", \"+19736878295\"],\n [\"Freddy\", \"+12013141013\"],\n [\"Henry\", \"+12017575244\"],\n [\"Iphael\", \"+18622246764\"],\n [\"Irvin\", \"+18625715595\"],\n [\"James\", \"+18629001706\"],\n [\"Jayden\", \"+19734130406\"],\n [\"Jeremias\", \"+12019216558\"],\n [\"Jessy\", \"+18622716103\"],\n [\"Jorge\", \"+12017908187\"],\n [\"\", \"+19733362850\"],\n [\"Malik\", \"+19294344193\"],\n [\"Nazmir\", \"+18624845179\"],\n [\"Rey\", \"+19738421570\"],\n [\"Ricardo\", \"+19734324742\"],\n [\"Rico\", \"+12012573818\"],\n [\"Ronel\", \"+19738072082\"],\n [\"Ryan\", \"+19735083493\"],\n [\"Shawn\", \"+19732803365\"],\n [\"Stacey\", \"+18622426379\"],\n [\"Wilson\", \"+19739790854\"],\n [\"Winston\", \"+19739790921\"],\n [\"Zhamir\", \"+18624405060\"],\n];\n\nexport async function seedDrivers() {\n await ensureTables();\n for (const [name, phone] of DRIVERS) {\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO drivers (name, phone) VALUES (?, ?)\",\n args: [name, phone],\n });\n }\n}\n\nexport async function getActiveDrivers() {\n await ensureTables();\n const result = await sqlite.execute(\"SELECT name, phone FROM drivers\");\n return result.rows as unknown as { name: string; phone: string }[];\n}\n\nexport async function createBid(\n id: string,\n opportunityId: string,\n address: string,\n amount: string,\n recipients: { name: string; phone: string }[],\n) {\n await ensureTables();\n await sqlite.execute({\n sql:\n \"INSERT INTO bids (id, opportunity_id, address, amount, status, recipients_json, created_at) VALUES (?, ?, ?, ?, 'open', ?, ?)\",\n args: [id, opportunityId, address, amount, JSON.stringify(recipients), Date.now()],\n });\n}\n\nexport async function getBid(id: string) {\n await ensureTables();\n const result = await sqlite.execute({\n sql: \"SELECT * FROM bids WHERE id = ?\",\n args: [id],\n });\n return result.rows[0] as unknown as Record | undefined;\n}\n\nexport async function getMostRecentOpenBid() {\n await ensureTables();\n const result = await sqlite.execute(\n \"SELECT * FROM bids WHERE status = 'open' ORDER BY created_at DESC LIMIT 1\",\n );\n return result.rows[0] as unknown as Record | undefined;\n}\n\n// Any status — used to match a late \"YES\" against the bid it's replying to,\n// even after that bid has already been claimed by someone else.\nexport async function getMostRecentBid() {\n await ensureTables();\n const result = await sqlite.execute(\n \"SELECT * FROM bids ORDER BY created_at DESC LIMIT 1\",\n );\n return result.rows[0] as unknown as Record | undefined;\n}\n\n// Atomic claim: only the first UPDATE that actually flips status='open' -> 'claimed' wins.\nexport async function tryClaimBid(id: string, driverName: string, driverPhone: string) {\n await ensureTables();\n const result = await sqlite.execute({\n sql:\n \"UPDATE bids SET status = 'claimed', claimed_by_name = ?, claimed_by_phone = ?, claimed_at = ? WHERE id = ? AND status = 'open'\",\n args: [driverName, driverPhone, Date.now(), id],\n });\n return result.rowsAffected > 0;\n}\n\nexport async function addBackupReply(bidId: string, name: string, phone: string) {\n await ensureTables();\n await sqlite.execute({\n sql: \"INSERT INTO bid_backups (bid_id, name, phone, replied_at) VALUES (?, ?, ?, ?)\",\n args: [bidId, name, phone, Date.now()],\n });\n}\n\nexport async function getBackups(bidId: string) {\n await ensureTables();\n const result = await sqlite.execute({\n sql: \"SELECT name, phone, replied_at FROM bid_backups WHERE bid_id = ? ORDER BY replied_at ASC\",\n args: [bidId],\n });\n return result.rows as unknown as { name: string; phone: string; replied_at: number }[];\n}\n",[],[69],["D",1788621118793],[],[19],"b861f7f5-9606-4c66-8b6a-90228a718575",["D",1788621118793],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Bid-out emergency stops to drivers by SMS, first YES wins","imageUrl","userId","c5acd3b3-60a7-4deb-bc6d-528f83012ea9","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","019f8fe2-cdfc-775d-a845-a69af13d39cb","tursoName","b861f7f596064c668b6a90228a718575","tursoHostname","b861f7f596064c668b6a90228a718575-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789488693443],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_138":134},"org",{"_11":12,"_131":132,"_133":134,"_91":92,"_135":136,"_137":51},"branch",{"_17":60,"_13":16,"_33":39,"_123":81,"_124":-5,"_125":-5,"_126":-5,"_127":-5,"_128":-5,"_129":14,"_130":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","M A","avatar","https://lh3.googleusercontent.com/a/ACg8ocI9znhXn2hWp1wjjyWzeuOyoO_JrDgJo8aD0umFraR7bAG3UAmc=s96-c","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":81,"_13":14,"_44":178,"_83":-5,"_84":51,"_85":86,"_87":86,"_88":89,"_90":-5,"_91":92,"_93":59,"_94":43,"_95":-5,"_96":-5,"_97":46,"_98":99,"_100":101,"_102":103,"_104":179,"_106":-5,"_107":108,"_109":108,"_110":111,"_112":111,"_113":111,"_114":108,"_115":108,"_116":180,"_118":181,"_120":182,"_122":51},[169,170,171],"files",[169,170,171],"counts",{"_159":46,"_160":41,"_161":46,"_32":162,"_163":164},[],{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":24,"_48":49,"_50":51,"_52":-5,"_18":158},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},[19],"pulls","branches","forks",{"_165":167,"_168":41},"connections",{"_165":46,"_166":46},"count","unfilledCount",4,"emptyCount",{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":78,"_17":46,"_47":24,"_48":49,"_50":51,"_52":-5,"_65":176,"_18":177},{"_33":68,"_13":69,"_35":70,"_37":-5,"_38":39,"_40":71,"_42":43,"_44":72,"_17":73,"_47":74,"_48":75,"_50":51,"_52":-5,"_65":174,"_18":175},{"_33":57,"_13":58,"_35":59,"_37":-5,"_38":39,"_40":60,"_42":43,"_44":61,"_17":62,"_47":63,"_48":64,"_50":51,"_52":14,"_65":172,"_18":173},[],[58],[],[69],[],[19],["D",1788621118793],["D",1789488693443],{"_11":12,"_138":134},{"_11":12,"_131":132,"_133":134,"_91":92,"_135":136,"_137":51},{"_17":60,"_13":16,"_33":39,"_123":81,"_124":-5,"_125":-5,"_126":-5,"_127":-5,"_128":-5,"_129":14,"_130":12},"ctx",{"_116":-5,"_155":216,"_217":218,"_219":220,"_221":51,"_222":51,"_223":51,"_224":43,"_225":-5,"_226":-7,"_227":-7,"_228":46,"_229":51,"_230":51,"_231":-5,"_232":51,"_233":51,"_234":51,"_235":-5},"ENV",{"_187":188,"_189":190,"_191":16,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]