${escapeHtml(label)}

${value}

${sub}

`;\n\n const statsBar = `\n

\n ${statTile(\"Connect rate\", pct(connectedCount), `${connectedCount}/${totalCalls} reached a conversation`)}\n ${statTile(\"Voicemail rate\", pct(voicemailCount), `${voicemailCount}/${totalCalls} hit voicemail`)}\n ${statTile(\"Total spend\", \"$\" + totalSpend.toFixed(2), \"Twilio + Claude, this page\")}\n

Calls by source

${sourceBreakdown || \"—\"}

`;\n\n const hotLeads = index\n .map((r, i) => ({ record: r, twilioCost: twilioCosts[i], address: extractCapturedAddress(r.summary) }))\n .filter((h) => h.address !== null);\n\n const hotLeadRows = hotLeads.map(({ record: r, address }) => {\n const when = new Date(r.timestamp).toLocaleString(\"en-US\", { timeZone: \"America/New_York\" });\n return `\n \n ${escapeHtml(when)}\n ${escapeHtml(r.callerName || \"—\")}\n ${escapeHtml(r.from)}\n ${escapeHtml(r.company || r.source || \"—\")}\n ${escapeHtml(address!)}\n \n

Full summary

${escapeHtml(r.summary)}

\n \n `;\n }).join(\"\");\n\n const hotLeadsSection = `\n

🔥 Hot leads (${hotLeads.length})

Calls where a real delivery address was captured — follow up on these first.

\n \n \n \n \n \n \n \n \n \n \n \n \n ${hotLeadRows || ``}\n \n

Time (ET)	Name	Phone	Source	Delivery address
No hot leads captured yet.

`;\n\n const controlPanelUrl = `https://tribeca-control-panel.val.run/?key=${encodeURIComponent(providedKey ?? \"\")}`;\n\n const rows = index.map((r, i) => {\n const when = new Date(r.timestamp).toLocaleString(\"en-US\", { timeZone: \"America/New_York\" });\n const badgeColor = r.direction === \"inbound\" ? \"#2563eb\" : \"#059669\";\n const twilioCost = twilioCosts[i];\n const claudeCost = r.anthropicCostUsd ?? null;\n const totalCost = twilioCost != null || claudeCost != null ? (twilioCost ?? 0) + (claudeCost ?? 0) : null;\n return `\n \n ${escapeHtml(when)}\n \n ${escapeHtml(r.direction)}\n \n ${escapeHtml(r.callerName || \"—\")}\n ${escapeHtml(r.from)}\n ${escapeHtml(r.company || r.source || \"—\")}\n ${r.attempt ?? \"—\"}\n ${escapeHtml(formatDuration(r.durationSeconds))}\n ${escapeHtml(r.summary)}\n \n Twilio: ${escapeHtml(formatUsd(twilioCost))}
\n Claude: ${escapeHtml(formatUsd(claudeCost))}
\n Total: ${escapeHtml(formatUsd(totalCost))}\n \n \n

Transcript

${escapeHtml(r.transcript)}

\n \n `;\n }).join(\"\");\n\n const html = `\n\n\n \n TriBeCa Beverage — Call Activity\n \n\n\n

TriBeCa Beverage — Call Activity

${index.length} most recent call${index.length === 1 ? \"\" : \"s\"} (max ${MAX_DASHBOARD_ENTRIES} kept). Newest first.

\n Open pause/resume control panel →\n (kept on a separate always-on file, so it stays reachable even when everything else is paused)\n

\n ${hotLeadsSection}\n ${statsBar}\n

\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n ${rows || ``}\n \n

Time (ET)	Direction	Name	Phone	Source	Attempt	Duration	Summary	Cost
No calls yet.

\n\n`;\n\n return new Response(html, { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } });\n}\n\nfunction escapeHtml(s: string): string {\n return s\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\");\n}\n\n// ============================================================================\n// /fb-lead-webhook — Meta (Facebook) Lead Ads webhook. No longer triggers a\n// call directly: Facebook leads flow into Salesforce through their own\n// separate sync, and salesforce-lead-caller.ts's polling loop is now the sole\n// place that places outbound calls (Facebook-sourced or not), since it's the\n// only path with correct Lead-id write-back, attempt cadence, and DNC sync.\n// This handler still verifies and acknowledges the webhook (so Meta's\n// subscription stays healthy) and logs which leads came in from\n// TARGET_FB_FORM_ID, but no longer looks the lead up via the Graph API or\n// calls placeOutboundCall.\n//\n// Setup requires a Meta developer app with the Webhooks product subscribed to\n// the \"leadgen\" field on your Page, plus this env var:\n// FB_WEBHOOK_VERIFY_TOKEN - arbitrary string, must match what you enter in\n// the Meta webhook setup form (Callback Verify Token)\n// FB_APP_SECRET - from the Meta app's Settings > Basic, used to\n// validate the X-Hub-Signature-256 header\n// (FB_PAGE_ACCESS_TOKEN is no longer used by this file — it was only needed\n// for the Graph API lookup this handler used to do.)\n// ============================================================================\n\nconst TARGET_FB_FORM_ID = \"1551858649716828\"; // \"AM_New High Intent Long Form\" — the specific form this logs about\n\nasync function handleFbLeadWebhook(req: Request): Promise {\n const url = new URL(req.url);\n\n if (req.method === \"GET\") {\n const verifyToken = Deno.env.get(\"FB_WEBHOOK_VERIFY_TOKEN\");\n const mode = url.searchParams.get(\"hub.mode\");\n const token = url.searchParams.get(\"hub.verify_token\");\n const challenge = url.searchParams.get(\"hub.challenge\");\n if (mode === \"subscribe\" && verifyToken && token === verifyToken && challenge) {\n return new Response(challenge, { status: 200 });\n }\n return new Response(\"Forbidden\", { status: 403 });\n }\n\n const rawBody = await req.text();\n if (!(await verifyFacebookSignature(req, rawBody))) {\n return new Response(\"Forbidden\", { status: 403 });\n }\n\n let payload: any = {};\n try {\n payload = JSON.parse(rawBody || \"{}\");\n } catch {\n return Response.json({ status: \"ignored\", reason: \"invalid JSON\" });\n }\n\n const changes = (payload.entry ?? []).flatMap((e: any) => e.changes ?? []);\n for (const change of changes) {\n if (change.field !== \"leadgen\") continue;\n const value = change.value ?? {};\n const leadgenId = value.leadgen_id;\n const formId = value.form_id ? String(value.form_id) : null;\n if (!leadgenId || formId !== TARGET_FB_FORM_ID) continue;\n\n // No longer looked up or auto-called here — salesforce-lead-caller.ts's\n // polling loop picks this lead up once it lands in Salesforce.\n console.log(`/fb-lead-webhook: received leadgen ${leadgenId} for TARGET_FB_FORM_ID (logged only, not auto-called)`);\n }\n\n // Meta expects a fast 200 regardless of downstream processing outcome.\n return Response.json({ status: \"ok\" });\n}\n\n// Meta signs webhook payloads: sha256=HMAC-SHA256(rawBody, app secret)\nasync function verifyFacebookSignature(req: Request, rawBody: string): Promise {\n const appSecret = Deno.env.get(\"FB_APP_SECRET\");\n if (!appSecret) return true; // not configured yet — allow through during initial setup\n const signature = req.headers.get(\"X-Hub-Signature-256\") ?? \"\";\n if (!signature.startsWith(\"sha256=\")) return false;\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(appSecret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const mac = await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(rawBody));\n const expected = Array.from(new Uint8Array(mac)).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n return expected === signature.slice(\"sha256=\".length);\n}\n\n// ============================================================================\n// /turn — each conversational turn\n// ============================================================================\n\nasync function handleTurn(req: Request): Promise {\n if (!(await verifyTwilioRequest(req))) return new Response(\"Forbidden\", { status: 403 });\n\n const form = await req.formData();\n const callSid = (form.get(\"CallSid\") as string) ?? \"unknown\";\n const from = (form.get(\"From\") as string) ?? \"\";\n const speech = ((form.get(\"SpeechResult\") as string) ?? \"\").trim();\n\n const turnUrl = new URL(req.url); // action url for the next Gather (same path)\n\n if (!speech) {\n return twiml(`\n \n Sorry, I didn't catch that — could you say that again?\n \n Sorry, I'm having trouble hearing you. Our office will follow up. Goodbye.\n `);\n }\n\n // Explicit stop / do-not-call request\n if (/\\b(stop calling|don'?t call|remove me|do not call)\\b/i.test(speech)) {\n if (from) {\n const isNew = await addDoNotCall(from);\n if (isNew) await notifyDoNotCallAdded(from);\n }\n const dncLeadId = turnUrl.searchParams.get(\"leadId\");\n if (dncLeadId) {\n updateSalesforceLead(dncLeadId, {\n AI_Call_Status__c: \"DNC Requested\",\n DoNotCall: true,\n }).catch((err) => console.error(\"Failed to write DNC request back to Salesforce Lead:\", err));\n }\n return twiml(`Understood — I've removed you from our calling list. Sorry to bother you, and have a good day.`);\n }\n\n const historyKey = `voice-history-${callSid}`;\n let history: GeminiTurn[] = (await blob.getJSON(historyKey).catch(() => null)) ?? [];\n // FIRST TURN OF THE CALL. Nothing is stored yet under this callSid, which is\n // indistinguishable from \"no history\" unless it is seeded here — and without\n // it, generateContent() below sees only the customer's bare reply to a\n // question it does not know was ever asked.\n if (!history.length) {\n history.push({ role: \"model\", parts: [{ text: OPENING_LINE }] });\n }\n history.push({ role: \"user\", parts: [{ text: speech }] });\n if (history.length > MAX_HISTORY_MESSAGES) history = history.slice(history.length - MAX_HISTORY_MESSAGES);\n while (history.length && history[0].role !== \"user\") history.shift();\n\n let reply = FALLBACK_REPLY;\n let wantsHuman = false;\n let text = \"\";\n const genAI = new GoogleGenerativeAI(Deno.env.get(\"GEMINI_API_KEY\")!);\n const model = genAI.getGenerativeModel({ model: MODEL, systemInstruction: SYSTEM_PROMPT });\n\n for (let attempt = 0; attempt < 2; attempt++) {\n try {\n const result = await model.generateContent({ contents: history });\n text = result.response.text().trim();\n break;\n } catch (err) {\n console.error(`Gemini call failed (attempt ${attempt + 1}):`, err);\n if (attempt === 0) await new Promise((r) => setTimeout(r, 600)); // brief retry before giving up\n }\n }\n\n if (text) {\n reply = text;\n history.push({ role: \"model\", parts: [{ text }] });\n await blob.setJSON(historyKey, history);\n wantsHuman = /connect(ing)? you to (our )?office/i.test(text);\n } else {\n wantsHuman = true; // both attempts failed\n }\n\n if (wantsHuman) {\n return twiml(`\n ${escapeXml(reply)}\n ${OFFICE_NUMBER}\n `);\n }\n\n return twiml(`\n \n ${escapeXml(reply)}\n \n Thanks so much, our office will follow up to finalize everything. Goodbye.\n `);\n}\n\n// ============================================================================\n// /sms-inbound — a personal command channel for the business owner only.\n// Point the Twilio number's \"A message comes in\" webhook here. Anyone NOT in\n// OWNER_PHONE_NUMBERS is silently ignored (no reply) so this doesn't\n// advertise itself as a command interface to customers.\n//\n// Env var to add: OWNER_PHONE_NUMBERS - comma-separated E.164 numbers allowed\n// to command the agent, e.g. \"+12016000792,+19735551234\"\n// ============================================================================\n\nexport const OWNER_SMS_SYSTEM_PROMPT =\n `You are an operations assistant for the owner of TriBeCa Beverage Company, reachable by text message. ` +\n `The owner is texting you directly to get quick information or trigger actions in their AI phone system. ` +\n `You are NOT talking to a customer — only the verified business owner can reach you here.\\n\\n` +\n `Keep replies short — this is a text message, not an email. Use tools to look up real data or take real ` +\n `actions rather than guessing. If a request is ambiguous (e.g. which number to call), ask a brief ` +\n `clarifying question instead of guessing.`;\n\nexport const SMS_TOOLS = [\n {\n functionDeclarations: [\n {\n name: \"place_call\",\n description: \"Place an outbound AI sales call to a phone number, same as the automated lead-call system.\",\n parameters: {\n type: SchemaType.OBJECT,\n properties: {\n phone: { type: SchemaType.STRING, description: \"Phone number in E.164 format, e.g. +12016000792\" },\n },\n required: [\"phone\"],\n },\n },\n {\n name: \"list_recent_calls\",\n description: \"List recent call activity (inbound and outbound) with time, direction, phone, name, and summary.\",\n parameters: {\n type: SchemaType.OBJECT,\n properties: {\n limit: { type: SchemaType.INTEGER, description: \"Max number of calls to return, default 5\" },\n },\n },\n },\n {\n name: \"add_do_not_call\",\n description: \"Add a phone number to the do-not-call list so the AI system never calls it again.\",\n parameters: {\n type: SchemaType.OBJECT,\n properties: { phone: { type: SchemaType.STRING, description: \"Phone number in E.164 format\" } },\n required: [\"phone\"],\n },\n },\n {\n name: \"remove_do_not_call\",\n description: \"Remove a phone number from the do-not-call list.\",\n parameters: {\n type: SchemaType.OBJECT,\n properties: { phone: { type: SchemaType.STRING, description: \"Phone number in E.164 format\" } },\n required: [\"phone\"],\n },\n },\n {\n name: \"create_customer_account\",\n description:\n \"Create a new customer account: makes a WooCommerce customer + order on tribecabeverage.com and pushes it to Salesforce via WP Fusion. Use when asked to add/create/set up a new customer or account.\",\n parameters: {\n type: SchemaType.OBJECT,\n properties: {\n email: { type: SchemaType.STRING, description: \"Customer email address (required)\" },\n first_name: { type: SchemaType.STRING },\n last_name: { type: SchemaType.STRING },\n phone: { type: SchemaType.STRING },\n address_1: { type: SchemaType.STRING },\n address_2: { type: SchemaType.STRING },\n city: { type: SchemaType.STRING },\n state: { type: SchemaType.STRING },\n postcode: { type: SchemaType.STRING },\n country: { type: SchemaType.STRING, description: \"2-letter country code, defaults to US\" },\n company: { type: SchemaType.STRING },\n water_type: { type: SchemaType.STRING, description: \"Defaults to Alkaline if not specified\" },\n bottles: { type: SchemaType.STRING, description: \"Number of 5-gallon bottles, defaults to 2\" },\n water_cooler: { type: SchemaType.STRING, description: \"Defaults to 'No Water Cooler Needed'\" },\n },\n required: [\"email\", \"first_name\", \"last_name\", \"address_1\", \"city\", \"state\", \"postcode\"],\n },\n },\n ],\n },\n];\n\nexport async function runSmsTool(name: string, args: Record): Promise {\n try {\n if (name === \"place_call\") {\n const phone = String(args.phone ?? \"\");\n const result = await placeOutboundCall(phone, { source: \"owner-request\" });\n return result.ok ? `Call placed. Call SID: ${result.callSid}` : `Not placed (${result.status}): ${result.reason}`;\n }\n if (name === \"list_recent_calls\") {\n const limit = typeof args.limit === \"number\" ? args.limit : 5;\n const index: CallRecord[] = (await blob.getJSON(CALL_INDEX_KEY).catch(() => null)) ?? [];\n const recent = index.slice(0, limit);\n if (recent.length === 0) return \"No calls recorded yet.\";\n return recent.map((r) => {\n const when = new Date(r.timestamp).toLocaleString(\"en-US\", { timeZone: \"America/New_York\" });\n return `${when} | ${r.direction} | ${r.callerName || \"unknown name\"} (${r.from}) | ${r.summary}`;\n }).join(\"\\n---\\n\");\n }\n if (name === \"add_do_not_call\") {\n const phone = String(args.phone ?? \"\");\n const isNew = await addDoNotCall(phone);\n return isNew ? `Added ${phone} to the do-not-call list.` : `${phone} was already on the do-not-call list.`;\n }\n if (name === \"remove_do_not_call\") {\n const phone = String(args.phone ?? \"\");\n const removed = await removeDoNotCall(phone);\n return removed ? `Removed ${phone} from the do-not-call list.` : `${phone} wasn't on the do-not-call list.`;\n }\n if (name === \"create_customer_account\") {\n const email = String(args.email ?? \"\");\n // Salesforce requires Shipping Street/City/State on the push (see the sync\n // endpoint's own comment) — enforce these here rather than let a partial\n // instruction silently create a WooCommerce order with a broken/incomplete\n // Salesforce record behind it.\n const REQUIRED = [\"email\", \"first_name\", \"last_name\", \"address_1\", \"city\", \"state\", \"postcode\"];\n const missing = REQUIRED.filter((k) => !String((args as Record)[k] ?? \"\").trim());\n if (missing.length > 0) {\n return `Can't create the account yet — missing: ${missing.join(\", \")}. Please provide these and try again.`;\n }\n const res = await fetch(\"https://tribecabeverage.com/wp-json/tribeca/v1/sync-customer\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"X-Sync-Secret\": Deno.env.get(\"MF_SYNC_SECRET\") ?? \"\",\n },\n body: JSON.stringify({\n email,\n first_name: args.first_name ?? \"\",\n last_name: args.last_name ?? \"\",\n phone: args.phone ?? \"\",\n address_1: args.address_1 ?? \"\",\n address_2: args.address_2 ?? \"\",\n city: args.city ?? \"\",\n state: args.state ?? \"\",\n postcode: args.postcode ?? \"\",\n country: args.country ?? \"US\",\n company: args.company ?? \"\",\n water_type: args.water_type ?? \"Alkaline\",\n bottles: args.bottles ?? \"2\",\n water_cooler: args.water_cooler ?? \"No Water Cooler Needed\",\n }),\n });\n const body = await res.json().catch(() => ({}));\n if (!res.ok) {\n return `Failed to create account (${res.status}): ${body.error ?? body.details ?? \"unknown error\"}`;\n }\n return `Account ${body.action === \"created\" ? \"created\" : \"updated\"} for ${email}. WooCommerce order #${body.order_id}. Synced to Salesforce.`;\n }\n return `Unknown tool: ${name}`;\n } catch (err) {\n return `Tool error: ${err instanceof Error ? err.message : String(err)}`;\n }\n}\n\nfunction smsReply(text: string): Response {\n return twiml(`${escapeXml(text)}`);\n}\n\nasync function handleSmsInbound(req: Request): Promise {\n console.log(\"/sms-inbound: request received\");\n if (!(await verifyTwilioRequest(req))) {\n console.log(\"/sms-inbound: signature verification failed\");\n return new Response(\"Forbidden\", { status: 403 });\n }\n\n const form = await req.formData();\n const from = (form.get(\"From\") as string) ?? \"\";\n const body = ((form.get(\"Body\") as string) ?? \"\").trim();\n console.log(`/sms-inbound: from=${from} body=${JSON.stringify(body)}`);\n\n const ownerNumbers = (Deno.env.get(\"OWNER_PHONE_NUMBERS\") ?? \"\")\n .split(\",\").map((s) => s.trim()).filter(Boolean);\n if (!ownerNumbers.includes(from)) {\n // Not an authorized number — stay silent, don't reveal this is a command channel.\n console.log(`/sms-inbound: ${from} not in OWNER_PHONE_NUMBERS — ignoring`);\n return twiml(\"\");\n }\n\n if (!body) return smsReply(\"Didn't catch a message — try again?\");\n\n const geminiKey = Deno.env.get(\"GEMINI_API_KEY\");\n if (!geminiKey) return smsReply(\"Agent isn't configured — missing GEMINI_API_KEY.\");\n\n const genAI = new GoogleGenerativeAI(geminiKey);\n const model = genAI.getGenerativeModel({\n model: MODEL,\n systemInstruction: OWNER_SMS_SYSTEM_PROMPT,\n tools: SMS_TOOLS,\n });\n\n // Twilio gives up on the webhook (and logs error 11200) around 15s, so this\n // must always produce *some* valid TwiML well before that — a slow/looping\n // Gemini tool-calling round trip must never be allowed to time out the\n // whole request. Race the actual work against a hard cutoff.\n const TIMEOUT_MS = 12_000;\n const work = (async (): Promise => {\n const chat = model.startChat();\n let response = await chat.sendMessage(body);\n for (let round = 0; round < 4; round++) {\n const calls = response.response.functionCalls();\n if (!calls || calls.length === 0) {\n return response.response.text().trim() || \"Sorry, I wasn't able to finish that — try rephrasing?\";\n }\n const functionResponses = [];\n for (const call of calls) {\n const output = await runSmsTool(call.name, (call.args as Record) ?? {});\n functionResponses.push({ functionResponse: { name: call.name, response: { result: output } } });\n }\n response = await chat.sendMessage(functionResponses);\n }\n return \"Sorry, I wasn't able to finish that — try rephrasing?\";\n })();\n const timeout = new Promise((resolve) =>\n setTimeout(() => resolve(\"Still working on that — texting me again in a few seconds may help, or try rephrasing shorter.\"), TIMEOUT_MS)\n );\n\n let replyText: string;\n try {\n replyText = await Promise.race([work, timeout]);\n } catch (err) {\n console.error(\"SMS owner-agent failed:\", err);\n replyText = \"Sorry, that failed on my end — try again?\";\n }\n\n return smsReply(replyText);\n}\n\n// ============================================================================\n// Helpers\n// ============================================================================\n\nfunction twiml(inner: string): Response {\n return new Response(`${inner}`, {\n headers: { \"Content-Type\": \"text/xml\" },\n });\n}\n\nfunction escapeXml(s: string): string {\n return s\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\");\n}\n\n// Twilio signs webhooks: Base64(HMAC-SHA1(url + sorted(key+value) pairs, auth token))\nasync function verifyTwilioRequest(req: Request): Promise {\n const authToken = Deno.env.get(\"TWILIO_AUTH_TOKEN\");\n if (!authToken) return true; // not configured yet — allow through during initial setup\n const signature = req.headers.get(\"X-Twilio-Signature\") ?? \"\";\n const form = req.clone();\n const formData = await form.formData().catch(() => null);\n const params: Record = {};\n if (formData) for (const [k, v] of formData.entries()) params[k] = String(v);\n const data = req.url + Object.keys(params).sort().map((k) => k + params[k]).join(\"\");\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(authToken),\n { name: \"HMAC\", hash: \"SHA-1\" },\n false,\n [\"sign\"],\n );\n const mac = await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(data));\n const expected = btoa(String.fromCharCode(...new Uint8Array(mac)));\n return expected === signature;\n}\n",[147],"1b431eda-8e4d-4ddc-a5cc-dba3c34b7c91","inbox.ts","e1444430-8925-11f1-ab69-1607ee4eb77e",505,["D",1786625138528],31,"email","import { email } from \"https://esm.town/v/std/email\";\nimport { GoogleGenerativeAI } from \"npm:@google/generative-ai\";\nimport { MODEL, OWNER_SMS_SYSTEM_PROMPT, SMS_TOOLS, runSmsTool } from \"./main.ts\";\n\nfunction extractAddress(from: string): string {\n const match = from.match(/<([^>]+)>/);\n return (match ? match[1] : from).trim().toLowerCase();\n}\n\nconst EMAIL_SYSTEM_PROMPT = OWNER_SMS_SYSTEM_PROMPT.replace(\n \"reachable by text message\",\n \"reachable by email\",\n).replace(\n \"The owner is texting you directly\",\n \"The owner is emailing you directly\",\n);\n\nexport default async function (e: Email) {\n const allowed = (Deno.env.get(\"OWNER_EMAILS\") ?? \"\")\n .split(\",\")\n .map((s) => s.trim().toLowerCase())\n .filter(Boolean);\n\n const sender = extractAddress(e.from);\n if (!allowed.includes(sender)) {\n console.log(`/inbox: ${e.from} not in OWNER_EMAILS — ignoring`);\n return;\n }\n\n const instruction = (e.text ?? e.subject ?? \"\").trim();\n if (!instruction) {\n console.log(\"/inbox: authorized sender, but no readable body/subject.\");\n return;\n }\n console.log(`/inbox: authorized instruction from ${e.from}: ${instruction}`);\n\n const geminiKey = Deno.env.get(\"GEMINI_API_KEY\");\n if (!geminiKey) {\n await email({ to: sender, subject: `Re: ${e.subject ?? \"\"}`, text: \"Agent isn't configured — missing GEMINI_API_KEY.\" });\n return;\n }\n\n const genAI = new GoogleGenerativeAI(geminiKey);\n const model = genAI.getGenerativeModel({\n model: MODEL,\n systemInstruction: EMAIL_SYSTEM_PROMPT,\n tools: SMS_TOOLS,\n });\n\n // Only ONE Gemini call is made (to decide which tool(s) to run). We then email\n // the tool's raw output directly rather than making a second Gemini call to\n // \"polish\" it into prose — that second round trip is what was silently hanging\n // past Val Town's 60s free-tier execution ceiling. Raw tool output here is\n // already human-readable, so this trades a little polish for reliability.\n const TIMEOUT_MS = 20_000;\n const work = (async (): Promise => {\n const chat = model.startChat();\n const response = await chat.sendMessage(instruction);\n const calls = response.response.functionCalls();\n if (!calls || calls.length === 0) {\n return response.response.text().trim() || \"No response generated.\";\n }\n const outputs: string[] = [];\n for (const call of calls) {\n console.log(`/inbox: tool call ${call.name}`, JSON.stringify(call.args));\n const output = await runSmsTool(call.name, (call.args as Record) ?? {});\n console.log(`/inbox: tool result: ${output.slice(0, 300)}`);\n outputs.push(output);\n }\n return outputs.join(\"\\n\\n\");\n })();\n const timeout = new Promise((resolve) =>\n setTimeout(\n () =>\n resolve(\n \"That action may have gone through, but the response timed out on my end (e.g. a call may have been placed). Try 'list recent calls' to check.\",\n ),\n TIMEOUT_MS,\n )\n );\n\n let replyText: string;\n try {\n replyText = await Promise.race([work, timeout]);\n } catch (err) {\n console.error(\"/inbox: agent failed:\", err);\n replyText = `Sorry, that failed on my end: ${err}`;\n }\n\n // Free-tier Val Town accounts can only send email to the account owner's own\n // address — any explicit `to` (even the same address that wrote in) is\n // rejected. Omitting `to` lets std/email default to the owner's address.\n // replyTo points back at this val's own inbox address so hitting \"Reply\" in\n // an email client addresses the next message here instead of Val Town's\n // generic notifications@valtown.email sender.\n try {\n await email({\n subject: `Re: ${e.subject ?? \"Sales call agent\"}`,\n text: replyText,\n replyTo: \"Tribeca_Rep-e1444430892511f1ab691607ee4eb77e@valtown.email\",\n });\n console.log(\"/inbox: reply sent to val owner's default address\");\n } catch (err) {\n console.error(\"/inbox: sending reply email failed:\", err);\n }\n}\n",[155],"9145e0c0-111e-48d2-b955-c52edd7f2d81","control.ts","85f1f910-8dd0-11f1-8d42-1607ee4eb77e",470,["D",1786023488511],18,"// Pause/Resume control panel — deliberately its OWN file, separate from\n// main.ts. main.ts is one of the three files \"Pause everything\" turns off\n// (salesforce-lead-caller.ts, main.ts, inbox.ts), so if these buttons lived\n// on main.ts's /dashboard page, pausing would also take down the very page\n// the Resume button lives on. This file is never touched by pause/resume,\n// so it stays reachable no matter what state the other three are in.\n//\n// Uses Val Town's own REST API to change file types, authenticated via a\n// Personal Access Token the account owner created at val.town/settings/api\n// and stored as VALTOWN_API_TOKEN. (The automatic Deno.env.get(\"valtown\")\n// binding every val gets was tried first but turned out to be\n// insufficiently scoped — it authenticates fine but 403s on writes.)\n//\n// Known gap: the public API can change a file's TYPE but has no endpoint\n// for an interval's paused/active schedule state (confirmed against\n// https://api.val.town/openapi.json — no interval/cron schema exists at\n// all). Flipping salesforce-lead-caller.ts's type off and back to\n// \"interval\" left its underlying schedule stuck showing Paused in Val\n// Town's UI more than once, requiring a manual \"Resume\" click there every\n// time — the type flip alone doesn't reliably restore it.\n//\n// Fix: salesforce-lead-caller.ts's fileType/schedule is no longer touched\n// here at all. It stays a permanently-live interval (fixed once manually\n// in Val Town's UI), and pause/resume for it works instead through the\n// outbound_calls_paused blob flag below, which placeOutboundCall() (and\n// salesforce-lead-caller.ts itself) check on every run — a flag is always\n// reliably settable via the API, unlike the interval's hidden active state.\n\n// Val Town blob storage turned out to be scoped per independently-deployed\n// file, not per val (confirmed 2026-08-06 — see main.ts's setOutboundPaused\n// comment). Calling blob.setJSON directly from THIS file would write to a\n// scope only this file can ever read back — so pause/resume go through\n// main.ts's exported setter/getter instead, which always run in main.ts's\n// own scope regardless of which file calls them.\nimport { setOutboundPaused } from \"./main.ts\";\n\nconst THIS_VAL_ID = \"87b7f315-3ae0-4b4d-a5c9-ea08f8fffa3b\"; // Tribeca_Rep/tribeca-outbound-sales-call\n\nconst PAUSE_RESUME_FILES: { path: string; liveType: \"email\" | \"http\" }[] = [\n { path: \"inbox.ts\", liveType: \"email\" },\n { path: \"main.ts\", liveType: \"http\" },\n];\n\nasync function setFileType(path: string, type: string): Promise<{ ok: boolean; error?: string }> {\n // VALTOWN_API_TOKEN (the first token created) 403s on writes — insufficient\n // scope. VALTOWN_API_TOKEN_2 has explicit full read/write permissions.\n const token = Deno.env.get(\"VALTOWN_API_TOKEN_2\");\n if (!token) return { ok: false, error: \"Missing VALTOWN_API_TOKEN_2 env var\" };\n const res = await fetch(\n `https://api.val.town/v2/vals/${THIS_VAL_ID}/files?path=${encodeURIComponent(path)}`,\n {\n method: \"PUT\",\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ type }),\n },\n );\n if (!res.ok) {\n const body = await res.text().catch(() => \"\");\n return { ok: false, error: `${res.status} ${body}` };\n }\n return { ok: true };\n}\n\nfunction checkKey(req: Request): boolean {\n const expectedKey = Deno.env.get(\"DASHBOARD_SECRET\");\n const providedKey = new URL(req.url).searchParams.get(\"key\");\n return !!expectedKey && providedKey === expectedKey;\n}\n\nasync function pauseAll(): Promise> {\n const results: Record = {};\n for (const f of PAUSE_RESUME_FILES) {\n const r = await setFileType(f.path, \"script\");\n results[f.path] = r.ok ? \"paused\" : `FAILED: ${r.error}`;\n }\n await setOutboundPaused(true);\n results[\"salesforce-lead-caller.ts\"] = \"paused (outbound_calls_paused flag set — stays a live interval, just no-ops every run)\";\n return results;\n}\n\nasync function resumeAll(): Promise> {\n const results: Record = {};\n for (const f of PAUSE_RESUME_FILES) {\n const r = await setFileType(f.path, f.liveType);\n results[f.path] = r.ok ? `restored to ${f.liveType}` : `FAILED: ${r.error}`;\n }\n await setOutboundPaused(false);\n results[\"salesforce-lead-caller.ts\"] = \"resumed (outbound_calls_paused flag cleared)\";\n return results;\n}\n\nfunction escapeHtml(s: string): string {\n return s.replace(/&/g, \"&\").replace(//g, \">\").replace(/\"/g, \""\");\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n if (!checkKey(req)) {\n return new Response(\"Unauthorized — append ?key=... with the dashboard access key to this URL.\", {\n status: 401,\n headers: { \"Content-Type\": \"text/plain\" },\n });\n }\n\n if (req.method === \"POST\") {\n const action = url.searchParams.get(\"action\");\n if (action === \"pause\") {\n return Response.json({ status: \"done\", results: await pauseAll() });\n }\n if (action === \"resume\") {\n return Response.json({ status: \"done\", results: await resumeAll() });\n }\n return Response.json({ error: \"Unknown action\" }, { status: 400 });\n }\n\n const key = url.searchParams.get(\"key\")!;\n const html = `\n\n\n \n TriBeCa Beverage — Control Panel\n \n\n\n

TriBeCa Beverage — Control Panel

\n Pauses/resumes the outbound calling system (salesforce-lead-caller.ts, main.ts, inbox.ts).\n This page lives in its own file specifically so it stays reachable even when everything else is paused.\n

\n ← Back to call activity dashboard\n (won't load while main.ts is paused)\n

\n \n \n

\n \n\n`;\n return new Response(html, { headers: { \"Content-Type\": \"text/html\" } });\n}\n","tribeca-control-panel",[164],"pulls","branches",1,"forks","envVars",{"_180":182,"_183":62},"connections",{"_180":62,"_181":62},"count","unfilledCount",19,"emptyCount",{"_42":163,"_32":164,"_30":165,"_137":-5,"_40":41,"_39":166,"_139":25,"_37":198,"_13":168,"_33":151,"_35":169,"_24":48,"_144":170,"_189":199,"_27":200},{"_42":154,"_32":155,"_30":156,"_137":-5,"_40":41,"_39":157,"_139":25,"_37":195,"_13":159,"_33":160,"_35":161,"_24":48,"_144":-5,"_189":196,"_27":197},{"_42":146,"_32":147,"_30":57,"_137":-5,"_40":41,"_39":148,"_139":48,"_37":192,"_13":150,"_33":151,"_35":152,"_24":48,"_144":44,"_189":193,"_27":194},{"_42":134,"_32":135,"_30":136,"_137":-5,"_40":41,"_39":138,"_139":25,"_37":188,"_13":141,"_33":142,"_35":143,"_24":48,"_144":-5,"_189":190,"_27":191},["D",1786026710807],"children",[],[135],["D",1788619517257],[],[147],["D",1786625138528],[],[155],["D",1786023488511],[],[164],["D",1784848264718],["D",1789473745358],{"_99":98,"_107":103},{"_99":98,"_100":101,"_102":103,"_18":55,"_104":105,"_106":48},{"_13":88,"_32":89,"_42":41,"_90":43,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":44,"_97":98},"ctx",{"_81":-5,"_127":239,"_240":241,"_242":243,"_244":48,"_245":48,"_246":48,"_247":25,"_248":-5,"_249":-7,"_250":-7,"_251":62,"_252":48,"_253":48,"_254":-5,"_255":48,"_256":48,"_257":48,"_258":-5},"ENV",{"_210":211,"_212":213,"_214":89,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224,"_225":226,"_227":228,"_229":230,"_231":232,"_233":234,"_235":236,"_237":238},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v533