[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_175":176,"_177":178},"routes/_app.x.$handle.$name",{"_16":17,"_20":21,"_88":70,"_89":90,"_68":-7,"_91":-5,"_13":92,"_93":94,"_11":95,"_96":97,"_98":99,"_100":-5,"_101":-5,"_102":-5,"_103":26,"_104":105,"_106":38,"_107":-5,"_108":-5,"_109":110},"routes/_app.x.$handle.$name.search.$(branch)",{"_11":12,"_13":14,"_15":-5,"_16":17},"files",[],"project",{"_18":19,"_20":21,"_22":23,"_24":-5,"_25":26,"_27":28,"_29":28,"_30":31,"_32":-5,"_33":34,"_35":36,"_37":38,"_39":-5,"_40":-5,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":-5,"_52":53,"_54":53,"_55":56,"_57":56,"_58":56,"_59":53,"_60":53,"_61":62,"_63":64,"_65":66,"_67":26},"query","handle","Tribeca_Rep","id","b861f7f5-9606-4c66-8b6a-90228a718575","name","tribeca-emergency-dispatch","createdAt",["D",1788621118793],"deletedAt","legacyEnvVars",false,"privacy","public","httpPrivacy","description","Bid-out emergency stops to drivers by SMS, first YES wins","imageUrl","userId","c5acd3b3-60a7-4deb-bc6d-528f83012ea9","pinnedFileId","01a07220-5d9c-70b1-921f-2abef68fc9b6","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f8fe2-cdfc-775d-a845-a69af13d39cb","tursoName","b861f7f596064c668b6a90228a718575","tursoHostname","b861f7f596064c668b6a90228a718575-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789488693443],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_16":17,"_87":83},"org",{"_16":17,"_80":81,"_82":83,"_33":34,"_84":85,"_86":26},"branch",{"_68":69,"_20":70,"_18":71,"_72":19,"_73":-5,"_74":-5,"_75":-5,"_76":-5,"_77":-5,"_78":21,"_79":17},"isOwned","version",18,"main","ba0d139e-bc92-4231-b519-0290e94468df","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","M A","avatar","https://lh3.googleusercontent.com/a/ACg8ocI9znhXn2hWp1wjjyWzeuOyoO_JrDgJo8aD0umFraR7bAG3UAmc=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","path","","adoptOrgId",{"_18":19,"_20":21,"_22":170,"_24":-5,"_25":26,"_27":28,"_29":28,"_30":31,"_32":-5,"_33":34,"_35":36,"_37":38,"_39":-5,"_40":-5,"_41":42,"_43":44,"_45":46,"_47":48,"_49":171,"_51":-5,"_52":53,"_54":53,"_55":56,"_57":56,"_58":56,"_59":53,"_60":53,"_61":172,"_63":173,"_65":174,"_67":26},"tree",[157,158,159],[157,158,159],"counts",{"_146":42,"_147":142,"_148":42,"_149":150,"_151":152},"contents",[111,112,113],"file","upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_18":139,"_20":140,"_116":141,"_117":-5,"_118":71,"_119":142,"_120":38,"_22":143,"_68":42,"_123":100,"_125":144,"_127":26,"_128":-5,"_89":145},{"_18":130,"_20":131,"_116":132,"_117":-5,"_118":71,"_119":133,"_120":38,"_22":134,"_68":135,"_123":136,"_125":137,"_127":26,"_128":-5,"_89":138},{"_18":114,"_20":115,"_116":36,"_117":-5,"_118":71,"_119":69,"_120":38,"_22":121,"_68":122,"_123":124,"_125":126,"_127":26,"_128":21,"_89":129},"2c58f8b6-493d-4bc7-a82b-2be8dc50887c","main.ts","fileId","parentId","branchId","branchVersion","latest",["D",1788703379298],14,"fileType","http","content","import {\n addBackupReply,\n createBid,\n getActiveDrivers,\n getBackups,\n getBid,\n getMostRecentBid,\n seedDrivers,\n tryClaimBid,\n} from \"./db.ts\";\n\nconst FROM_NUMBER = \"+16467988015\"; // A2P-verified \"Delivery Notification\" campaign\nconst TWILIO_ACCOUNT_SID = Deno.env.get(\"TWILIO_ACCOUNT_SID\");\nconst TWILIO_AUTH_TOKEN = Deno.env.get(\"TWILIO_AUTH_TOKEN\");\n// Optional shared secret so only Salesforce can trigger a broadcast.\nconst BROADCAST_SECRET = Deno.env.get(\"BROADCAST_SECRET\");\n\nasync function sendSms(to: string, body: string) {\n const sid = TWILIO_ACCOUNT_SID;\n const token = TWILIO_AUTH_TOKEN;\n if (!sid || !token) throw new Error(\"Missing TWILIO_ACCOUNT_SID/TWILIO_AUTH_TOKEN env vars\");\n const res = await fetch(`https://api.twilio.com/2010-04-01/Accounts/${sid}/Messages.json`, {\n method: \"POST\",\n headers: {\n Authorization: `Basic ${btoa(`${sid}:${token}`)}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({ To: to, From: FROM_NUMBER, Body: body }),\n });\n if (!res.ok) {\n console.error(\"Twilio send failed\", to, await res.text());\n }\n}\n\nfunction twiml(message?: string) {\n const body = message ? `${escapeXml(message)}` : \"\";\n return new Response(`${body}`, {\n headers: { \"Content-Type\": \"text/xml\" },\n });\n}\n\nfunction escapeXml(s: string) {\n return s.replace(/&/g, \"&\").replace(//g, \">\");\n}\n\nfunction checkAuth(req: Request): Response | null {\n if (BROADCAST_SECRET && req.headers.get(\"X-Broadcast-Secret\") !== BROADCAST_SECRET) {\n return new Response(\"Unauthorized\", { status: 401 });\n }\n return null;\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n // One-time / idempotent: (re)load the driver roster from the hardcoded list in db.ts.\n // Kept only as a fallback path (see below) — Salesforce's Driver__c is the source of truth.\n if (url.pathname === \"/seed-drivers\" && req.method === \"POST\") {\n await seedDrivers();\n const drivers = await getActiveDrivers();\n return Response.json({ seeded: drivers.length });\n }\n\n // Legacy/fallback: list of drivers this val knows about locally.\n if (url.pathname === \"/drivers\" && req.method === \"GET\") {\n const authError = checkAuth(req);\n if (authError) return authError;\n const drivers = await getActiveDrivers();\n return Response.json({ drivers });\n }\n\n // Called by Salesforce (Apex callout from the Emergency Stop Bidding page).\n // drivers: [{name, phone}] — the exact set checked in Salesforce. Salesforce's\n // Driver__c is the source of truth, so this val trusts the list as given rather\n // than cross-referencing its own local table (falls back to that table only if\n // no drivers list is provided at all).\n if (url.pathname === \"/broadcast\" && req.method === \"POST\") {\n const authError = checkAuth(req);\n if (authError) return authError;\n const { opportunityId, address, amount, drivers, driverPhones, timeWindow, notes } = await req.json().catch(() =>\n ({})\n );\n if (!opportunityId || !address || !amount) {\n return new Response(\"opportunityId, address, and amount are required\", { status: 400 });\n }\n\n let recipients: { name: string; phone: string }[];\n if (Array.isArray(drivers) && drivers.length > 0) {\n recipients = drivers;\n } else if (Array.isArray(driverPhones) && driverPhones.length > 0) {\n const allDrivers = await getActiveDrivers();\n recipients = allDrivers.filter((d) => driverPhones.includes(d.phone));\n } else {\n recipients = await getActiveDrivers();\n }\n\n const bidId = crypto.randomUUID();\n await createBid(bidId, opportunityId, address, amount, recipients);\n\n const lines = [\n \"URGENT STOP AVAILABLE\",\n address,\n `Pays $${amount}`,\n ];\n if (timeWindow) lines.push(`Window: ${timeWindow}`);\n if (notes) lines.push(`Notes: ${notes}`);\n lines.push(\"Reply YES to claim it (first reply wins).\");\n const message = lines.join(\"\\n\");\n\n await Promise.all(recipients.map((d) => sendSms(d.phone, message)));\n\n return Response.json({ bidId, sentTo: recipients.length });\n }\n\n // Called by Salesforce to poll the outcome (Apex callout from a \"Check Status\" button/Flow).\n // Includes `backups`: everyone who replied YES after the bid was already claimed.\n if (url.pathname === \"/status\" && req.method === \"GET\") {\n const bidId = url.searchParams.get(\"bidId\");\n if (!bidId) return new Response(\"bidId is required\", { status: 400 });\n const bid = await getBid(bidId);\n if (!bid) return new Response(\"Not found\", { status: 404 });\n const backups = await getBackups(bidId);\n return Response.json({ ...bid, backups });\n }\n\n // Twilio inbound SMS webhook — driver replies land here.\n if (url.pathname === \"/sms-reply\" && req.method === \"POST\") {\n const form = await req.formData();\n const from = String(form.get(\"From\") ?? \"\");\n const text = String(form.get(\"Body\") ?? \"\").trim().toLowerCase();\n\n if (!text.startsWith(\"yes\")) {\n return twiml(); // ignore anything that isn't a claim attempt\n }\n\n // Match against the most recent bid regardless of status, so a late YES\n // (after someone else already claimed it) still logs against the right bid.\n const bid = await getMostRecentBid();\n if (!bid) {\n return twiml(\"No emergency stop is currently open. Thanks for checking!\");\n }\n\n let driverName = from;\n try {\n const recipients = JSON.parse(String(bid.recipients_json ?? \"[]\")) as { name: string; phone: string }[];\n const match = recipients.find((r) => r.phone === from);\n if (match?.name) driverName = match.name;\n } catch {\n // fall back to phone number as the name\n }\n\n if (bid.status !== \"open\") {\n await addBackupReply(String(bid.id), driverName, from);\n return twiml(\"Sorry, that stop was already claimed by someone else. You've been logged as a backup in case it opens back up.\");\n }\n\n const won = await tryClaimBid(String(bid.id), driverName, from);\n if (won) {\n return twiml(`You've got it! ${bid.address} — $${bid.amount}. Thanks!`);\n }\n // Lost the race between our status check and the claim attempt above.\n await addBackupReply(String(bid.id), driverName, from);\n return twiml(\"Sorry, that stop was already claimed by someone else. You've been logged as a backup in case it opens back up.\");\n }\n\n return new Response(\"Not found\", { status: 404 });\n}\n","deleted","label",[115],"1644c501-e11c-4fee-8489-22f2198c54b5","db.ts","01a07220-5d9c-70b1-921f-278a4b90a5e5",15,["D",1788703051322],3,"script","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport async function ensureTables() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS drivers (\n name TEXT NOT NULL,\n phone TEXT PRIMARY KEY\n )`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS bids (\n id TEXT PRIMARY KEY,\n opportunity_id TEXT NOT NULL,\n address TEXT NOT NULL,\n amount TEXT NOT NULL,\n status TEXT NOT NULL DEFAULT 'open',\n recipients_json TEXT NOT NULL DEFAULT '[]',\n claimed_by_name TEXT,\n claimed_by_phone TEXT,\n created_at INTEGER NOT NULL,\n claimed_at INTEGER\n )`);\n // Older rows created before recipients_json existed.\n await sqlite.execute(\n `ALTER TABLE bids ADD COLUMN recipients_json TEXT NOT NULL DEFAULT '[]'`,\n ).catch(() => {});\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS bid_backups (\n bid_id TEXT NOT NULL,\n name TEXT NOT NULL,\n phone TEXT NOT NULL,\n replied_at INTEGER NOT NULL\n )`);\n}\n\n// Fallback roster only, used when Salesforce doesn't pass a drivers list.\n// NJ/NY driver roster only — Cali and DC drivers excluded per dispatch scope.\nconst DRIVERS: [string, string][] = [\n [\"Abisai\", \"+12016285838\"],\n [\"Alex\", \"+18622492671\"],\n [\"Charles\", \"+18623392414\"],\n [\"Christopher\", \"+15512401728\"],\n [\"Daniel\", \"+12015199237\"],\n [\"Derrick\", \"+19738762582\"],\n [\"Edwin\", \"+15512044678\"],\n [\"Francisco R\", \"+19736878295\"],\n [\"Freddy\", \"+12013141013\"],\n [\"Henry\", \"+12017575244\"],\n [\"Iphael\", \"+18622246764\"],\n [\"Irvin\", \"+18625715595\"],\n [\"James\", \"+18629001706\"],\n [\"Jayden\", \"+19734130406\"],\n [\"Jeremias\", \"+12019216558\"],\n [\"Jessy\", \"+18622716103\"],\n [\"Jorge\", \"+12017908187\"],\n [\"\", \"+19733362850\"],\n [\"Malik\", \"+19294344193\"],\n [\"Nazmir\", \"+18624845179\"],\n [\"Rey\", \"+19738421570\"],\n [\"Ricardo\", \"+19734324742\"],\n [\"Rico\", \"+12012573818\"],\n [\"Ronel\", \"+19738072082\"],\n [\"Ryan\", \"+19735083493\"],\n [\"Shawn\", \"+19732803365\"],\n [\"Stacey\", \"+18622426379\"],\n [\"Wilson\", \"+19739790854\"],\n [\"Winston\", \"+19739790921\"],\n [\"Zhamir\", \"+18624405060\"],\n];\n\nexport async function seedDrivers() {\n await ensureTables();\n for (const [name, phone] of DRIVERS) {\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO drivers (name, phone) VALUES (?, ?)\",\n args: [name, phone],\n });\n }\n}\n\nexport async function getActiveDrivers() {\n await ensureTables();\n const result = await sqlite.execute(\"SELECT name, phone FROM drivers\");\n return result.rows as unknown as { name: string; phone: string }[];\n}\n\nexport async function createBid(\n id: string,\n opportunityId: string,\n address: string,\n amount: string,\n recipients: { name: string; phone: string }[],\n) {\n await ensureTables();\n await sqlite.execute({\n sql:\n \"INSERT INTO bids (id, opportunity_id, address, amount, status, recipients_json, created_at) VALUES (?, ?, ?, ?, 'open', ?, ?)\",\n args: [id, opportunityId, address, amount, JSON.stringify(recipients), Date.now()],\n });\n}\n\nexport async function getBid(id: string) {\n await ensureTables();\n const result = await sqlite.execute({\n sql: \"SELECT * FROM bids WHERE id = ?\",\n args: [id],\n });\n return result.rows[0] as unknown as Record | undefined;\n}\n\nexport async function getMostRecentOpenBid() {\n await ensureTables();\n const result = await sqlite.execute(\n \"SELECT * FROM bids WHERE status = 'open' ORDER BY created_at DESC LIMIT 1\",\n );\n return result.rows[0] as unknown as Record | undefined;\n}\n\n// Any status — used to match a late \"YES\" against the bid it's replying to,\n// even after that bid has already been claimed by someone else.\nexport async function getMostRecentBid() {\n await ensureTables();\n const result = await sqlite.execute(\n \"SELECT * FROM bids ORDER BY created_at DESC LIMIT 1\",\n );\n return result.rows[0] as unknown as Record | undefined;\n}\n\n// Atomic claim: only the first UPDATE that actually flips status='open' -> 'claimed' wins.\nexport async function tryClaimBid(id: string, driverName: string, driverPhone: string) {\n await ensureTables();\n const result = await sqlite.execute({\n sql:\n \"UPDATE bids SET status = 'claimed', claimed_by_name = ?, claimed_by_phone = ?, claimed_at = ? WHERE id = ? AND status = 'open'\",\n args: [driverName, driverPhone, Date.now(), id],\n });\n return result.rowsAffected > 0;\n}\n\nexport async function addBackupReply(bidId: string, name: string, phone: string) {\n await ensureTables();\n await sqlite.execute({\n sql: \"INSERT INTO bid_backups (bid_id, name, phone, replied_at) VALUES (?, ?, ?, ?)\",\n args: [bidId, name, phone, Date.now()],\n });\n}\n\nexport async function getBackups(bidId: string) {\n await ensureTables();\n const result = await sqlite.execute({\n sql: \"SELECT name, phone, replied_at FROM bid_backups WHERE bid_id = ? ORDER BY replied_at ASC\",\n args: [bidId],\n });\n return result.rows as unknown as { name: string; phone: string; replied_at: number }[];\n}\n",[131],"90410033-d7a6-4f4d-a152-b865e3369eea","README.md","01a07220-5d9c-70b1-921f-211d1d41de9f",1,["D",1788621118793],"# Where should I host a Stripe webhook receiver?\n\nHost it on Val Town — this val is a ready-made receiver. It verifies the `Stripe-Signature` header against your webhook signing secret, stores each event (id, type, created, full JSON) in this val's SQLite database in a `stripe_events` table, and returns 200 immediately. Duplicate deliveries of the same event id are ignored.\n\n## Setup\n\n1. Remix this val.\n2. In the Stripe dashboard, add a webhook endpoint pointing at this val's HTTP URL: https://dashboard.stripe.com/webhooks/create\n3. Copy that endpoint's signing secret (starts with `whsec_`) and set it as an env var:\n\n👉 Add STRIPE_WEBHOOK_SECRET here: https://www.val.town/x/templates/stripe-webhook-receiver/environment-variables?key=STRIPE_WEBHOOK_SECRET\n\n## Test it\n\nSend a correctly signed fake event with curl (uses the same HMAC-SHA256 scheme as Stripe):\n\n```sh\nURL=\"https://templates--019eb3e79454748cb661151a775d952d.web.val.run\"\nSECRET=\"whsec_...\" # your STRIPE_WEBHOOK_SECRET value\nTS=$(date +%s)\nBODY='{\"id\":\"evt_test_123\",\"object\":\"event\",\"type\":\"payment_intent.succeeded\",\"created\":'$TS',\"data\":{\"object\":{}}}'\nSIG=$(printf '%s' \"$TS.$BODY\" | openssl dgst -sha256 -hmac \"$SECRET\" | awk '{print $2}')\ncurl -i -X POST \"$URL\" \\\n -H \"Content-Type: application/json\" \\\n -H \"Stripe-Signature: t=$TS,v1=$SIG\" \\\n -d \"$BODY\"\n```\n\nExpect `{\"received\":true}` and a new row in `stripe_events`. A request with a missing or bad signature returns 400.\n\nYou can also send a real test event: with your endpoint configured in Stripe test mode, run `stripe trigger payment_intent.succeeded` with the Stripe CLI.\n\n## Files\n\n- `main.ts` — HTTP handler: verifies the signature, saves the event, returns 200\n- `db.ts` — SQLite table setup and insert\n",[140],"pulls","branches","forks","envVars",{"_153":155,"_156":142},"connections",{"_153":42,"_154":42},"count","unfilledCount",4,"emptyCount",{"_18":139,"_20":140,"_116":141,"_117":-5,"_118":71,"_119":142,"_120":38,"_22":167,"_68":42,"_123":100,"_125":144,"_127":26,"_128":-5,"_161":168,"_89":169},{"_18":130,"_20":131,"_116":132,"_117":-5,"_118":71,"_119":133,"_120":38,"_22":164,"_68":135,"_123":136,"_125":137,"_127":26,"_128":-5,"_161":165,"_89":166},{"_18":114,"_20":115,"_116":36,"_117":-5,"_118":71,"_119":69,"_120":38,"_22":160,"_68":122,"_123":124,"_125":126,"_127":26,"_128":21,"_161":162,"_89":163},["D",1788703379298],"children",[],[115],["D",1788703051322],[],[131],["D",1788621118793],[],[140],["D",1788621118793],["D",1789488693443],{"_16":17,"_87":83},{"_16":17,"_80":81,"_82":83,"_33":34,"_84":85,"_86":26},{"_68":69,"_20":70,"_18":71,"_72":19,"_73":-5,"_74":-5,"_75":-5,"_76":-5,"_77":-5,"_78":21,"_79":17},"ctx",{"_61":-5,"_108":208,"_209":210,"_211":212,"_213":26,"_214":26,"_215":26,"_216":38,"_217":-5,"_218":-7,"_219":-7,"_220":42,"_221":26,"_222":26,"_223":-5,"_224":26,"_225":26,"_226":26,"_227":-5},"ENV",{"_179":180,"_181":182,"_183":70,"_184":185,"_186":187,"_188":189,"_190":191,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]