[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_221":222,"_223":224},"routes/_app.x.$handle.$name",{"_98":97,"_31":43,"_107":88,"_26":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":24,"_122":123,"_124":57,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_41":42,"_31":43,"_36":44,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":24},"version",28,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":33,"_34":35,"_36":37,"_38":14,"_39":40,"_23":24},"previous","deleted",false,"deletedHere","path","agent-panel.ts","latestPath","fileId","785d88d0-a16e-11f1-9b27-1607ee4eb77e","name","fileType","script","content","// Tampermonkey userscript that injects a Salesforce panel into tawk's agent\n// dashboard, served from /agent-panel.user.js so agents get updates for free.\n//\n// DURABILITY NOTE\n// tawk's dashboard is a Vue SPA, but its classes are semantic rather than\n// hashed: `.contact-details-section--about`, `.collapsible-section-title`.\n// Those are the anchors used here. The Vue scoped attributes (data-v-xxxxxxxx)\n// ARE regenerated on every build, so nothing below touches them.\n// If tawk renames those classes the panel simply never appears — it is written\n// to fail invisibly rather than break an agent's dashboard mid-shift.\nexport const AGENT_PANEL_JS = String.raw`// ==UserScript==\n// @name Tribeca — Salesforce panel in tawk\n// @namespace tribecabeverage.com\n// @version 1.0.0\n// @description Shows the Salesforce account and next delivery for the visitor in view\n// @match https://dashboard.tawk.to/*\n// @grant none\n// @run-at document-idle\n// @updateURL __BASE__/agent-panel.user.js\n// @downloadURL __BASE__/agent-panel.user.js\n// ==/UserScript==\n\n(function () {\n \"use strict\";\n\n var BASE = \"__BASE__\";\n // Paste the AGENT_LOOKUP_KEY value here after installing.\n var AGENT_KEY = \"PASTE_AGENT_LOOKUP_KEY_HERE\";\n\n var PANEL_ID = \"tribeca-sf-panel\";\n var lastPhone = null;\n var inFlight = false;\n\n function digits(s) { return String(s || \"\").replace(/\\D/g, \"\"); }\n\n function normalise(raw) {\n var d = digits(raw);\n if (d.length === 11 && d.charAt(0) === \"1\") d = d.slice(1);\n return d.length === 10 ? d : null;\n }\n\n // The About section is purpose-named, so this is the most stable hook tawk\n // gives us. Everything else keys off it.\n function aboutSection() {\n return document.querySelector(\".contact-details-section--about\");\n }\n\n // Pull a phone from the visitor panel: the tel: link if tawk rendered one,\n // otherwise any 10-digit number in the section (which catches the\n // visitor-phone custom attribute written by enrich.js).\n function currentPhone() {\n var about = aboutSection();\n if (!about) return null;\n var tel = about.querySelector('a[href^=\"tel:\"]');\n if (tel) { var n = normalise(tel.getAttribute(\"href\").replace(\"tel:\", \"\")); if (n) return n; }\n var text = about.innerText || \"\";\n var m = text.match(/(?:\\+?1[\\s.-]?)?\$?\\d{3}\$?[\\s.-]?\\d{3}[\\s.-]?\\d{4}/);\n return m ? normalise(m[0]) : null;\n }\n\n function styleOnce() {\n if (document.getElementById(PANEL_ID + \"-style\")) return;\n var s = document.createElement(\"style\");\n s.id = PANEL_ID + \"-style\";\n s.textContent = [\n \"#\" + PANEL_ID + \"{margin:8px 16px 12px;border:1px solid #e3e8ee;border-radius:8px;\",\n \"font:13px/1.5 -apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;overflow:hidden}\",\n \"#\" + PANEL_ID + \" .hd{padding:7px 11px;font-size:11px;font-weight:700;letter-spacing:.05em;\",\n \"text-transform:uppercase;color:#5a6672;background:#f6f8fa;border-bottom:1px solid #e3e8ee}\",\n \"#\" + PANEL_ID + \" .bd{padding:9px 11px}\",\n \"#\" + PANEL_ID + \" .row{display:flex;justify-content:space-between;gap:10px;padding:2px 0}\",\n \"#\" + PANEL_ID + \" .k{color:#8a94a0}\",\n \"#\" + PANEL_ID + \" .v{font-weight:600;text-align:right;word-break:break-word}\",\n \"#\" + PANEL_ID + \" .pill{display:inline-block;padding:2px 8px;border-radius:99px;font-size:11px;font-weight:700}\",\n \"#\" + PANEL_ID + \" .ok{background:#dcfce7;color:#14532d}\",\n \"#\" + PANEL_ID + \" .warn{background:#fef3c7;color:#78350f}\",\n \"#\" + PANEL_ID + \" .none{background:#f1f5f9;color:#475569}\",\n \"#\" + PANEL_ID + \" .err{background:#fee2e2;color:#7f1d1d}\",\n ].join(\"\");\n document.head.appendChild(s);\n }\n\n function render(state, data) {\n styleOnce();\n var about = aboutSection();\n if (!about) return;\n\n var el = document.getElementById(PANEL_ID);\n if (!el) {\n el = document.createElement(\"div\");\n el.id = PANEL_ID;\n about.parentElement.insertBefore(el, about);\n }\n\n var body = \"\";\n if (state === \"loading\") {\n body = '

Checking Salesforce…

';\n } else if (state === \"nophone\") {\n body = '

No phone number on this visitor yet

';\n } else if (state === \"error\") {\n body = '

lookup unavailable

';\n } else if (data && data.ambiguous) {\n body = '

on more than one account

' +\n '

Office must confirm which

';\n } else if (data && data.found) {\n body = '

existing customer

' +\n '

Account' + esc(data.account_name || \"—\") + \"

\" +\n '

Next delivery' +\n esc(data.next_delivery_date || \"none scheduled\") + \"

\";\n } else {\n body = '

no account match

';\n }\n el.innerHTML = '

Salesforce

' + body + \"

\";\n }\n\n function esc(s) {\n return String(s == null ? \"\" : s).replace(/[&<>\"]/g, function (m) {\n return { \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\" }[m];\n });\n }\n\n function refresh() {\n var about = aboutSection();\n if (!about) { lastPhone = null; return; }\n\n var phone = currentPhone();\n if (phone === lastPhone && document.getElementById(PANEL_ID)) return;\n lastPhone = phone;\n\n if (!phone) { render(\"nophone\"); return; }\n if (inFlight) return;\n inFlight = true;\n render(\"loading\");\n\n fetch(BASE + \"/agent-lookup?phone=\" + encodeURIComponent(phone), {\n headers: { \"x-agent-key\": AGENT_KEY },\n credentials: \"omit\",\n })\n .then(function (r) { return r.ok ? r.json() : null; })\n .then(function (j) { render(j ? \"done\" : \"error\", j); })\n .catch(function () { render(\"error\"); })\n .then(function () { inFlight = false; });\n }\n\n // The SPA swaps conversations without navigating, so poll the DOM rather than\n // trying to hook Vue's router. Cheap, and it survives their internals changing.\n var mo = new MutationObserver(function () {\n clearTimeout(mo._t);\n mo._t = setTimeout(refresh, 400);\n });\n mo.observe(document.body, { childList: true, subtree: true });\n setTimeout(refresh, 1500);\n})();\n`;\n","createdAt",["D",1787763126296],"branchVersion","branchId","ae272551-0b66-498e-893a-608c3c317b83","id","68d21ace-3c73-4585-929b-fc6f43782874","tribeca-tawk-transcripts",["D",1787686491713],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Receives tawk.to chat transcripts, matches to Salesforce","imageUrl","c5acd3b3-60a7-4deb-bc6d-528f83012ea9","pinnedFileId","01a03a6b-1697-71fe-a681-032b2cbe7562","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f8fe2-cdfc-775d-a845-a69af13d39cb","tursoName","68d21ace3c734585929bfc6f43782874","tursoHostname","68d21ace3c734585929bfc6f43782874-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789438866375],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_106":102},"org",{"_98":97,"_99":100,"_101":102,"_18":53,"_103":104,"_105":24},"branch",{"_13":87,"_31":88,"_41":40,"_89":42,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":43,"_96":97},"isOwned",31,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","Tribeca_Rep","handle","displayName","M A","avatar","https://lh3.googleusercontent.com/a/ACg8ocI9znhXn2hWp1wjjyWzeuOyoO_JrDgJo8aD0umFraR7bAG3UAmc=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_41":42,"_31":43,"_36":216,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":217,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":218,"_82":219,"_84":220,"_86":24},"tree",[191,192,193,194,195,196],"files",[191,192,193,194,195,196],"counts",{"_180":61,"_181":182,"_183":61,"_184":185,"_186":187},"contents",[129,130,131,132,133,134],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_41":172,"_31":173,"_29":174,"_137":-5,"_39":40,"_38":175,"_139":57,"_36":176,"_13":177,"_32":20,"_34":178,"_23":24,"_144":-5,"_26":179},{"_41":169,"_31":27,"_29":30,"_137":-5,"_39":40,"_38":14,"_139":24,"_36":170,"_13":61,"_32":33,"_34":35,"_23":24,"_144":-5,"_26":171},{"_41":161,"_31":162,"_29":163,"_137":-5,"_39":40,"_38":164,"_139":57,"_36":165,"_13":166,"_32":33,"_34":167,"_23":24,"_144":-5,"_26":168},{"_41":153,"_31":154,"_29":155,"_137":-5,"_39":40,"_38":156,"_139":57,"_36":157,"_13":158,"_32":33,"_34":159,"_23":24,"_144":-5,"_26":160},{"_41":146,"_31":147,"_29":148,"_137":-5,"_39":40,"_38":149,"_139":57,"_36":150,"_13":61,"_32":33,"_34":151,"_23":24,"_144":-5,"_26":152},{"_41":135,"_31":136,"_29":55,"_137":-5,"_39":40,"_38":138,"_139":24,"_36":140,"_13":141,"_32":142,"_34":143,"_23":24,"_144":43,"_26":145},"5d239a2b-d0e6-4c59-b110-4ae92d166205","main.ts","parentId",27,"latest",["D",1787763090902],9,"http","// tawk.to chat transcripts -> SQLite, with a Salesforce match.\n//\n// POST / tawk webhook receiver (set this URL in tawk Admin > Webhooks)\n// GET /?key=... read the chats, their full message bodies, and any SF match\n//\n// Env vars:\n// TAWK_WEBHOOK_SECRET required — the secret you set when creating the webhook\n// VIEW_KEY required to open the viewer (transcripts are customer PII)\n// SALESFORCE_AGENT_URL optional — endpoint of tribeca-salesforce-agent\n// SALESFORCE_AGENT_KEY optional — its API_SHARED_SECRET\n// Without the Salesforce pair, transcripts still land; matching reports \"error\".\nimport { allowLookup, getChat, listChats, saveChat } from \"./db.ts\";\nimport { findInSalesforce, scrapeContact } from \"./lookup.ts\";\nimport { ENRICH_JS } from \"./enrich.ts\";\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n if (req.method === \"POST\") return receive(req);\n // Served before the viewer's key check: this is public JS for your website,\n // not customer data. It contains no secrets and calls no endpoint.\n if (req.method === \"GET\" && url.pathname === \"/enrich.js\") {\n return new Response(ENRICH_JS.replaceAll(\"__BASE__\", url.origin), {\n headers: {\n \"Content-Type\": \"application/javascript; charset=utf-8\",\n \"Access-Control-Allow-Origin\": \"*\",\n \"Cache-Control\": \"public, max-age=300\",\n },\n });\n }\n if (req.method === \"GET\" && url.pathname === \"/enrich-lookup\") return enrichLookup(req, url);\n if (url.pathname === \"/agent-lookup\") return agentLookup(req, url);\n if (req.method === \"GET\" && url.pathname === \"/agent-panel.user.js\") {\n return new Response(AGENT_PANEL_JS.replaceAll(\"__BASE__\", url.origin), {\n headers: {\n \"Content-Type\": \"application/javascript; charset=utf-8\",\n \"Cache-Control\": \"no-cache\",\n },\n });\n }\n if (req.method === \"GET\") return viewer(url);\n return new Response(\"Method not allowed\", { status: 405 });\n}\n\n// -------------------------------------------------------- enrichment lookup\n// PUBLIC endpoint, called from the visitor's browser by enrich.js. It cannot\n// carry a secret, so anything it returns is readable by anyone who finds it.\n//\n// Everything here exists to keep that blast radius small:\n// - resolves phone only, never email (Salesforce exposes no email field)\n// - returns ONLY whether they are a customer and the account name.\n// No delivery date, no address, no other contacts, no record ids.\n// - per-IP rate limit\n// - Origin check (friction, not security — a header is trivially forged)\n// - every call logged, so abuse is visible in the val's logs\nconst ALLOWED_ORIGINS = [\"https://tribecabeverage.com\", \"https://www.tribecabeverage.com\"];\n\nasync function enrichLookup(req: Request, url: URL): Promise {\n const cors = (origin: string | null) => ({\n \"Access-Control-Allow-Origin\": origin && ALLOWED_ORIGINS.includes(origin) ? origin : ALLOWED_ORIGINS[0],\n \"Content-Type\": \"application/json\",\n \"Cache-Control\": \"no-store\",\n });\n const origin = req.headers.get(\"Origin\");\n const ip = req.headers.get(\"cf-connecting-ip\") ?? req.headers.get(\"x-forwarded-for\")?.split(\",\")[0]?.trim() ??\n \"unknown\";\n\n if (origin && !ALLOWED_ORIGINS.includes(origin)) {\n console.warn(`enrich-lookup blocked: origin=${origin} ip=${ip}`);\n return new Response(JSON.stringify({ known: false }), { status: 403, headers: cors(origin) });\n }\n\n if (!await allowLookup(ip, 15, 60)) {\n console.warn(`enrich-lookup rate limited: ip=${ip}`);\n return new Response(JSON.stringify({ known: false, throttled: true }), { status: 429, headers: cors(origin) });\n }\n\n const phone = (url.searchParams.get(\"phone\") ?? \"\").replace(/\\D/g, \"\").slice(0, 15);\n if (phone.length < 10) {\n return new Response(JSON.stringify({ known: false }), { headers: cors(origin) });\n }\n\n const base = Deno.env.get(\"ACCOUNT_LOOKUP_URL\") ?? \"https://tribeca-apollo.val.run/account-lookup\";\n const key = Deno.env.get(\"APOLLO_TOOL_KEY\");\n if (!key) {\n console.error(\"enrich-lookup: APOLLO_TOOL_KEY not set\");\n return new Response(JSON.stringify({ known: false }), { headers: cors(origin) });\n }\n\n try {\n const r = await fetch(`${base}?phone=${encodeURIComponent(phone)}`, { headers: { \"x-api-key\": key } });\n const j = await r.json();\n console.log(`enrich-lookup ip=${ip} found=${j.found} ambiguous=${!!j.ambiguous}`);\n // Deliberately narrow: never pass through next_delivery_date or messages.\n if (j.ambiguous) return new Response(JSON.stringify({ known: true, ambiguous: true }), { headers: cors(origin) });\n if (!j.found) return new Response(JSON.stringify({ known: false }), { headers: cors(origin) });\n return new Response(\n JSON.stringify({ known: true, account_name: String(j.account_name ?? \"\").slice(0, 120) }),\n { headers: cors(origin) },\n );\n } catch (err) {\n console.error(\"enrich-lookup failed:\", err);\n return new Response(JSON.stringify({ known: false }), { headers: cors(origin) });\n }\n}\n\n// ------------------------------------------------------------- agent lookup\n// STAFF-facing, used by the Tampermonkey panel inside dashboard.tawk.to.\n// Distinct from /enrich-lookup on purpose:\n// - requires AGENT_LOOKUP_KEY, which lives in the userscript agents install,\n// not in a public web page\n// - so it can return MORE: the delivery date, which is never sent to a visitor\n// - higher rate limit, because a whole office shares one outbound IP\n// If the key ever leaks, rotate it: it reaches only this read-only lookup.\nasync function agentLookup(req: Request, url: URL): Promise {\n const origin = req.headers.get(\"Origin\");\n const headers: Record = {\n \"Content-Type\": \"application/json\",\n \"Cache-Control\": \"no-store\",\n // The userscript runs on tawk's own origin, so CORS must allow it.\n \"Access-Control-Allow-Origin\": origin ?? \"https://dashboard.tawk.to\",\n \"Access-Control-Allow-Headers\": \"x-agent-key\",\n \"Access-Control-Max-Age\": \"86400\",\n };\n if (req.method === \"OPTIONS\") return new Response(null, { status: 204, headers });\n\n const expected = Deno.env.get(\"AGENT_LOOKUP_KEY\");\n if (!expected) return new Response(JSON.stringify({ error: \"AGENT_LOOKUP_KEY not set\" }), { status: 500, headers });\n if (req.headers.get(\"x-agent-key\") !== expected) {\n console.warn(\"agent-lookup: bad or missing x-agent-key\");\n return new Response(JSON.stringify({ error: \"Unauthorized\" }), { status: 401, headers });\n }\n\n const ip = req.headers.get(\"cf-connecting-ip\") ?? \"unknown\";\n if (!await allowLookup(`agent:${ip}`, 300, 60)) {\n return new Response(JSON.stringify({ error: \"throttled\" }), { status: 429, headers });\n }\n\n const phone = (url.searchParams.get(\"phone\") ?? \"\").replace(/\\D/g, \"\").slice(0, 15);\n if (phone.length < 10) return new Response(JSON.stringify({ found: false, message: \"Need a 10-digit phone number.\" }), { headers });\n\n const base = Deno.env.get(\"ACCOUNT_LOOKUP_URL\") ?? \"https://tribeca-apollo.val.run/account-lookup\";\n const key = Deno.env.get(\"APOLLO_TOOL_KEY\");\n if (!key) return new Response(JSON.stringify({ found: false, errored: true, message: \"APOLLO_TOOL_KEY not set\" }), { headers });\n\n try {\n const r = await fetch(`${base}?phone=${encodeURIComponent(phone)}`, { headers: { \"x-api-key\": key } });\n const j = await r.json();\n console.log(`agent-lookup ip=${ip} found=${j.found} ambiguous=${!!j.ambiguous}`);\n return new Response(JSON.stringify(j), { headers });\n } catch (err) {\n console.error(\"agent-lookup failed:\", err);\n return new Response(JSON.stringify({ found: false, errored: true, message: \"Lookup unavailable.\" }), { headers });\n }\n}\n\n// ------------------------------------------------------------------ webhook\nasync function receive(req: Request): Promise {\n const secret = Deno.env.get(\"TAWK_WEBHOOK_SECRET\");\n if (!secret) return new Response(\"TAWK_WEBHOOK_SECRET not set\", { status: 500 });\n\n const raw = await req.text();\n const signature = req.headers.get(\"X-Tawk-Signature\") ?? \"\";\n if (!await verify(raw, signature, secret)) {\n console.error(\"Rejected webhook: bad signature\");\n return new Response(\"Invalid signature\", { status: 401 });\n }\n\n let payload: Record;\n try {\n payload = JSON.parse(raw);\n } catch {\n return new Response(\"Bad JSON\", { status: 400 });\n }\n\n const event = String(payload.event ?? \"unknown\");\n const parsed = parseEvent(event, payload);\n if (!parsed) {\n // Acknowledge anything we don't model, so tawk doesn't retry it for 12h.\n console.log(`Ignoring unmodelled event: ${event}`);\n return Response.json({ received: true, ignored: event });\n }\n\n // Scrape ONLY what the visitor typed. Agents paste the office number and\n // support links constantly; matching on those would tie every chat to Tribeca.\n const { email: foundEmail, phone: foundPhone } = scrapeContact(parsed.visitorText);\n const email = parsed.visitorEmail || foundEmail;\n const match = await findInSalesforce(email, foundPhone);\n\n await saveChat({\n id: parsed.id,\n event,\n time: String(payload.time ?? new Date().toISOString()),\n domain: payload.domain ?? null,\n referrer: payload.referrer ?? null,\n visitorName: parsed.visitorName,\n visitorEmail: parsed.visitorEmail,\n city: parsed.city,\n country: parsed.country,\n foundEmail,\n foundPhone,\n transcript: parsed.transcript,\n sfStatus: match.status,\n sfJson: JSON.stringify(match),\n });\n\n return Response.json({ received: true });\n}\n\ntype Parsed = {\n id: string;\n visitorName: string | null;\n visitorEmail: string | null;\n city: string | null;\n country: string | null;\n transcript: string;\n /** Visitor messages only — what we're allowed to scrape for contact details. */\n visitorText: string;\n};\n\nexport function parseEvent(event: string, p: Record): Parsed | null {\n const v = (o: any) => ({\n visitorName: o?.name ?? null,\n visitorEmail: o?.email ?? null,\n city: o?.city ?? null,\n country: o?.country ?? null,\n });\n\n if (event === \"chat:transcript_created\") {\n const chat = p.chat ?? {};\n const messages: any[] = Array.isArray(chat.messages) ? chat.messages : [];\n const label = (m: any) =>\n m?.sender?.t === \"v\" ? \"visitor\" : m?.sender?.t === \"a\" ? `agent ${m?.sender?.n ?? \"\"}`.trim() : \"system\";\n return {\n id: String(chat.id ?? p.chatId ?? crypto.randomUUID()),\n ...v(chat.visitor),\n transcript: messages.map((m) => `${label(m)}: ${m?.msg ?? \"\"}`).join(\"\\n\"),\n visitorText: messages.filter((m) => m?.sender?.t === \"v\").map((m) => m?.msg ?? \"\").join(\"\\n\"),\n };\n }\n\n if (event === \"chat:start\") {\n const text = p.message?.text ?? \"\";\n const fromVisitor = p.message?.sender?.type === \"visitor\";\n return {\n id: String(p.chatId ?? crypto.randomUUID()),\n ...v(p.visitor),\n transcript: `${fromVisitor ? \"visitor\" : \"agent\"}: ${text}`,\n visitorText: fromVisitor ? text : \"\",\n };\n }\n\n if (event === \"ticket:create\") {\n const t = p.ticket ?? {};\n const text = `${t.subject ?? \"\"}\\n${t.message ?? \"\"}`.trim();\n return {\n id: `ticket-${t.id ?? crypto.randomUUID()}`,\n visitorName: p.requester?.name ?? null,\n visitorEmail: p.requester?.email ?? null,\n city: null,\n country: null,\n transcript: text,\n visitorText: text,\n };\n }\n\n // chat:end carries no message body — the transcript event covers that chat.\n return null;\n}\n\n/** tawk signs with HMAC-SHA1 over the raw body, hex encoded. */\nasync function verify(body: string, signature: string, secret: string): Promise {\n const enc = new TextEncoder();\n const key = await crypto.subtle.importKey(\n \"raw\",\n enc.encode(secret),\n { name: \"HMAC\", hash: \"SHA-1\" },\n false,\n [\"sign\"],\n );\n const sig = await crypto.subtle.sign(\"HMAC\", key, enc.encode(body));\n const hex = [...new Uint8Array(sig)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n return timingSafeEqual(hex, signature.trim().toLowerCase());\n}\n\nfunction timingSafeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\n\n// ------------------------------------------------------------------- viewer\nasync function viewer(url: URL): Promise {\n const expected = Deno.env.get(\"VIEW_KEY\");\n if (!expected) {\n return new Response(\n \"Set a VIEW_KEY environment variable, then open /?key=YOUR_KEY.\\n\" +\n \"This page shows chat transcripts and customer contact details, so it stays closed until you do.\",\n { status: 503 },\n );\n }\n if (url.searchParams.get(\"key\") !== expected) return new Response(\"Not found\", { status: 404 });\n\n const id = url.searchParams.get(\"chat\");\n if (id) {\n const chat = await getChat(id);\n if (!chat) return new Response(\"Not found\", { status: 404 });\n return html(detailPage(chat, url.searchParams.get(\"key\")!));\n }\n return html(listPage(await listChats(), url.searchParams.get(\"key\")!));\n}\n\nconst esc = (s: unknown) =>\n String(s ?? \"\").replace(/[&<>\"]/g, (m) => ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\" }[m]!));\n\nconst STYLE =\n ``;\n\nconst html = (body: string) => new Response(`${STYLE}${body}`, {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n});\n\nfunction listPage(chats: Record[], key: string) {\n if (!chats.length) {\n return `

tawk chats

Nothing received yet. Point a tawk webhook at this URL and start a chat.

`;\n }\n const rows = chats.map((c) =>\n `\n ${esc(String(c.received_at).replace(\"T\", \" \").slice(0, 16))}\n ${esc(c.visitor_name) || '-'}\n ${esc(c.city) || '-'}\n ${esc(c.found_email || c.visitor_email) || '-'}\n ${esc(c.found_phone) || '-'}\n ${esc(String(c.sf_status).replace(/_/g, \" \"))}\n read\n `\n ).join(\"\");\n return `

tawk chats (${chats.length})

\n${rows}

Received	Name	City	Email	Phone	Salesforce

`;\n}\n\nfunction detailPage(c: Record, key: string) {\n let sf = \"\";\n try {\n const m = JSON.parse(String(c.sf_json ?? \"{}\"));\n sf = m.status === \"matched\"\n ? `

Matched on ${esc(m.matchedOn)}

${esc(JSON.stringify(m.records, null, 2))}

`\n : `

${esc(m.status)}${m.error ? `: ${esc(m.error)}` : \"\"}

`;\n } catch {\n sf = `

`;\n }\n return `

← all chats

${esc(c.visitor_name) || \"Visitor\"} ${esc(c.city)}

${esc(c.event)} · ${esc(c.time)} · ${esc(c.referrer)}

Transcript

${esc(c.transcript)}

Scraped from what the visitor typed

email: ${esc(c.found_email) || \"-\"} · phone: ${esc(c.found_phone) || \"-\"}

Salesforce

${sf}`;\n}\n","label",[136],"6511678d-a93c-4496-b757-90e21c120849","lookup.ts","2d97073e-a0bc-11f1-80af-1607ee4eb77e",3,["D",1787686550422],"// Scrape contact details out of what the visitor typed, then ask Salesforce\n// whether we already know them.\n//\n// This runs server-side and the answer is only ever shown to your own team, so\n// matching here is safe in a way it would NOT be if a bot were reporting the\n// result back to the visitor. Never reuse this to tell a visitor whether an\n// account exists — that lets anyone probe your customer list.\n\nconst EMAIL_RE = /[\\w.+-]+@[\\w-]+\\.[\\w.-]+/;\n// US-ish: optional +1, then 3-3-4 with common separators.\nconst PHONE_RE = /(?:\\+?1[\\s.-]?)?\$?\\d{3}\$?[\\s.-]?\\d{3}[\\s.-]?\\d{4}/;\n\nexport function scrapeContact(text: string) {\n const email = text.match(EMAIL_RE)?.[0] ?? null;\n const rawPhone = text.match(PHONE_RE)?.[0] ?? null;\n return { email, phone: rawPhone ? normalizePhone(rawPhone) : null };\n}\n\n/** Digits only, dropping a leading US country code. */\nfunction normalizePhone(raw: string): string | null {\n const digits = raw.replace(/\\D/g, \"\");\n const ten = digits.length === 11 && digits.startsWith(\"1\") ? digits.slice(1) : digits;\n return ten.length === 10 ? ten : null;\n}\n\n/** SOQL has no bound parameters here, so escape what we interpolate. */\nfunction soqlEscape(v: string): string {\n return v.replace(/\\\\/g, \"\\\\\\\\\").replace(/'/g, \"\\\\'\").slice(0, 120);\n}\n\nasync function query(soql: string): Promise[]> {\n const base = Deno.env.get(\"SALESFORCE_AGENT_URL\");\n const key = Deno.env.get(\"SALESFORCE_AGENT_KEY\");\n if (!base || !key) throw new Error(\"SALESFORCE_AGENT_URL / SALESFORCE_AGENT_KEY not set\");\n const url = `${base}${base.includes(\"?\") ? \"&\" : \"?\"}q=${encodeURIComponent(soql)}`;\n const res = await fetch(url, { headers: { \"x-api-key\": key } });\n if (!res.ok) throw new Error(`Salesforce proxy ${res.status}: ${(await res.text()).slice(0, 200)}`);\n const json = await res.json();\n return json.records ?? [];\n}\n\nexport type Match = {\n status: \"matched\" | \"no_match\" | \"no_identifier\" | \"error\";\n matchedOn?: string;\n records?: Record[];\n error?: string;\n};\n\n/**\n * Look for an existing Contact, Lead, or Account.\n * Email and phone only — deliberately not name. Names aren't unique and a\n * confident wrong match is worse than no match.\n */\nexport async function findInSalesforce(email: string | null, phone: string | null): Promise {\n if (!email && !phone) return { status: \"no_identifier\" };\n try {\n if (email) {\n const e = soqlEscape(email);\n const contacts = await query(\n `SELECT Id, Name, Email, Phone, Account.Name FROM Contact WHERE Email = '${e}' LIMIT 3`,\n );\n if (contacts.length) return { status: \"matched\", matchedOn: \"contact email\", records: contacts };\n\n const leads = await query(\n `SELECT Id, Name, Company, Email, Phone, Status FROM Lead WHERE Email = '${e}' AND IsConverted = false LIMIT 3`,\n );\n if (leads.length) return { status: \"matched\", matchedOn: \"lead email\", records: leads };\n }\n\n if (phone) {\n // Salesforce stores phones inconsistently formatted, so compare on the\n // last 7 digits rather than the whole string.\n const tail = soqlEscape(phone.slice(-7));\n const contacts = await query(\n `SELECT Id, Name, Email, Phone, Account.Name FROM Contact WHERE Phone LIKE '%${tail}' LIMIT 3`,\n );\n if (contacts.length) return { status: \"matched\", matchedOn: \"contact phone\", records: contacts };\n\n const leads = await query(\n `SELECT Id, Name, Company, Email, Phone, Status FROM Lead WHERE Phone LIKE '%${tail}' AND IsConverted = false LIMIT 3`,\n );\n if (leads.length) return { status: \"matched\", matchedOn: \"lead phone\", records: leads };\n }\n\n return { status: \"no_match\" };\n } catch (err) {\n return { status: \"error\", error: String(err).slice(0, 300) };\n }\n}\n",[147],"e3c46d6e-1937-40e1-8f6f-a389d0f6a480","enrich.ts","a7465ac4-a0cd-11f1-88e7-1607ee4eb77e",25,["D",1787762013212],7,"// Agent-facing enrichment for the tawk widget, served as plain JS.\n//\n// Scans what the VISITOR types for a phone number, email, or ZIP and writes\n// them into tawk's visitor attributes, so they appear in the agent's Details\n// panel the moment they're mentioned — instead of the agent scrolling the\n// transcript hunting for a number.\n//\n// It deliberately performs NO lookup. Everything it surfaces is something the\n// visitor just said out loud in that chat, so there is no endpoint for a\n// stranger to probe and nothing disclosed that the agent couldn't already read.\n// The agent has authenticated Salesforce access; the last mile is theirs.\n//\n// Only `name` and `email` need tawk's Secure Mode. These are all custom\n// attributes (alphanumeric + dash keys), so no Secure Mode and no hashing.\nexport const ENRICH_JS = String.raw`\n(function () {\n if (window.__tribecaTawkEnrich) return;\n window.__tribecaTawkEnrich = true;\n\n var EMAIL_RE = /[\\w.+-]+@[\\w-]+\\.[\\w.-]+/;\n var PHONE_RE = /(?:\\+?1[\\s.-]?)?\$?\\d{3}\$?[\\s.-]?\\d{3}[\\s.-]?\\d{4}/;\n var ZIP_RE = /\\b\\d{5}(?:-\\d{4})?\\b/;\n\n window.Tawk_API = window.Tawk_API || {};\n\n // Accumulated across the whole conversation, so a number given in message one\n // is still on screen when the agent joins at message six.\n var found = {};\n\n function normPhone(raw) {\n var d = String(raw).replace(/\\D/g, \"\");\n if (d.length === 11 && d.charAt(0) === \"1\") d = d.slice(1);\n return d.length === 10 ? d.slice(0, 3) + \"-\" + d.slice(3, 6) + \"-\" + d.slice(6) : null;\n }\n\n // Tags render on the conversation itself, so an agent sees the status without\n // opening the Details panel. Max 10 per chat; we use at most one, and only\n // ever add it once.\n var tagged = null;\n function tag(name) {\n if (tagged === name) return;\n if (!window.Tawk_API || typeof window.Tawk_API.addTags !== \"function\") return;\n var prior = tagged;\n tagged = name;\n try {\n window.Tawk_API.addTags([name], function (err) {\n if (err) { tagged = prior; console.warn(\"tawk enrich: addTags failed\", err); }\n });\n } catch (e) {\n tagged = prior;\n console.warn(\"tawk enrich: addTags threw\", e);\n }\n }\n\n // WordPress emits window.TribecaVisitor for logged-in users only, with the\n // Secure Mode hash computed server-side. Because WordPress actually knows who\n // is signed in, vouching for that identity is legitimate — unlike signing an\n // email a browser merely claimed.\n function wpVisitor() {\n var v = window.TribecaVisitor;\n return v && typeof v === \"object\" && v.email ? v : null;\n }\n\n function apply() {\n if (!window.Tawk_API || typeof window.Tawk_API.setAttributes !== \"function\") return;\n var attrs = {};\n var wp = wpVisitor();\n if (wp) {\n // name/email are standard fields and require Secure Mode + hash. Send all\n // three together or tawk rejects the call.\n if (wp.hash) {\n if (wp.name) attrs[\"name\"] = String(wp.name).slice(0, 255);\n attrs[\"email\"] = String(wp.email).slice(0, 255);\n attrs[\"hash\"] = wp.hash;\n }\n // Normalise, so a number from WordPress and one typed into the chat are\n // displayed identically to the agent.\n if (wp.phone && !found.phone) found.phone = normPhone(wp.phone) || wp.phone;\n if (!found.email) found.email = wp.email;\n if (wp.zip && !found.zip) found.zip = wp.zip;\n if (wp.company) attrs[\"wp-company\"] = String(wp.company).slice(0, 255);\n if (wp.wpuser) attrs[\"wp-user-id\"] = String(wp.wpuser).slice(0, 255);\n attrs[\"signed-in\"] = \"yes\";\n }\n if (found.phone) attrs[\"visitor-phone\"] = found.phone;\n if (found.email) attrs[\"visitor-email\"] = found.email;\n if (found.zip) attrs[\"mentioned-zip\"] = found.zip;\n if (found.sfStatus) attrs[\"sf-status\"] = found.sfStatus;\n if (found.sfAccount) attrs[\"sf-account\"] = found.sfAccount;\n var keys = [];\n for (var k in attrs) if (attrs.hasOwnProperty(k)) keys.push(k);\n if (!keys.length) return;\n try {\n window.Tawk_API.setAttributes(attrs, function (err) {\n if (err) console.warn(\"tawk enrich: setAttributes failed\", err);\n });\n } catch (e) {\n console.warn(\"tawk enrich: setAttributes threw\", e);\n }\n }\n\n function scan(text) {\n if (!text) return;\n var changed = false;\n if (!found.email) {\n var e = text.match(EMAIL_RE);\n if (e) { found.email = e[0]; changed = true; }\n }\n if (!found.phone) {\n var p = text.match(PHONE_RE);\n if (p) { var n = normPhone(p[0]); if (n) { found.phone = n; changed = true; } }\n }\n if (!found.zip) {\n // Run the ZIP check on text with any phone number removed, so the digits\n // of a phone can never be mistaken for a postal code.\n var stripped = text.replace(new RegExp(PHONE_RE.source, \"g\"), \" \");\n var z = stripped.match(ZIP_RE);\n if (z) { found.zip = z[0]; changed = true; }\n }\n if (changed) apply();\n if (changed && found.phone && !looked) resolve(found.phone);\n }\n\n // Resolve the phone to a Salesforce account once per conversation and stamp\n // the result for the agent. The endpoint returns only \"known\" plus the\n // account name — never a delivery date, address, or record id.\n var looked = false;\n function resolve(phone) {\n looked = true;\n var u = \"__BASE__/enrich-lookup?phone=\" + encodeURIComponent(phone.replace(/\\D/g, \"\"));\n fetch(u, { credentials: \"omit\" })\n .then(function (r) { return r.ok ? r.json() : null; })\n .then(function (j) {\n if (!j) return;\n if (j.ambiguous) {\n found.sfStatus = \"existing customer - multiple accounts\";\n tag(\"multiple-accounts\");\n } else if (j.known) {\n found.sfStatus = \"existing customer\";\n if (j.account_name) found.sfAccount = j.account_name;\n tag(\"existing-customer\");\n } else {\n found.sfStatus = \"no account match\";\n tag(\"no-account-match\");\n }\n apply();\n })\n .catch(function () { looked = false; /* allow a retry on the next message */ });\n }\n\n // Chain onto any existing handlers rather than replacing them — another\n // script on the page may already own these callbacks.\n var prevMessage = window.Tawk_API.onChatMessageVisitor;\n window.Tawk_API.onChatMessageVisitor = function (message) {\n if (typeof prevMessage === \"function\") { try { prevMessage(message); } catch (e) {} }\n try {\n scan(typeof message === \"string\" ? message : (message && (message.message || message.text)) || \"\");\n } catch (e) { /* never let enrichment break the chat */ }\n };\n\n var prevPrechat = window.Tawk_API.onPrechatSubmit;\n window.Tawk_API.onPrechatSubmit = function (data) {\n if (typeof prevPrechat === \"function\") { try { prevPrechat(data); } catch (e) {} }\n try { scan(JSON.stringify(data || {})); } catch (e) {}\n };\n\n // On load, stamp whatever WordPress told us — this is what identifies a\n // signed-in customer BEFORE they type anything, so the visitor dashboard shows\n // who they are while they're still just browsing.\n var prevLoad = window.Tawk_API.onLoad;\n window.Tawk_API.onLoad = function () {\n if (typeof prevLoad === \"function\") { try { prevLoad(); } catch (e) {} }\n apply();\n var wp = wpVisitor();\n if (wp && wp.phone && !looked) resolve(wp.phone);\n };\n})();\n`;\n",[154],"4eb5f669-0cbf-4496-a085-2f5ba5c26cb4","db.ts","01a03a6b-1697-71fe-a680-fddd67ed3651",14,["D",1787694405142],2,"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport type ChatRow = {\n id: string;\n event: string;\n time: string;\n domain: string | null;\n referrer: string | null;\n visitorName: string | null;\n visitorEmail: string | null;\n city: string | null;\n country: string | null;\n /** Contact details scraped out of what the visitor actually typed. */\n foundEmail: string | null;\n foundPhone: string | null;\n transcript: string;\n sfStatus: string;\n sfJson: string | null;\n};\n\nlet ready: Promise | null = null;\n/** Runs once per isolate; CREATE TABLE IF NOT EXISTS makes it safe to repeat. */\nfunction init() {\n ready ??= sqlite.execute(`CREATE TABLE IF NOT EXISTS tawk_chats (\n id TEXT PRIMARY KEY,\n event TEXT NOT NULL,\n time TEXT NOT NULL,\n domain TEXT,\n referrer TEXT,\n visitor_name TEXT,\n visitor_email TEXT,\n city TEXT,\n country TEXT,\n found_email TEXT,\n found_phone TEXT,\n transcript TEXT NOT NULL,\n sf_status TEXT NOT NULL DEFAULT 'not_checked',\n sf_json TEXT,\n received_at TEXT NOT NULL\n )`);\n return ready;\n}\n\n/**\n * Per-IP rate limit for the public enrichment lookup.\n * Returns true if the caller may proceed. Counts calls in a rolling window.\n */\nexport async function allowLookup(ip: string, limit: number, windowMinutes: number): Promise {\n await init();\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS lookup_hits (\n ip TEXT NOT NULL,\n at TEXT NOT NULL\n )`);\n const cutoff = new Date(Date.now() - windowMinutes * 60_000).toISOString();\n await sqlite.execute({ sql: `DELETE FROM lookup_hits WHERE at < ?`, args: [cutoff] });\n const res = await sqlite.execute({\n sql: `SELECT COUNT(*) FROM lookup_hits WHERE ip = ? AND at >= ?`,\n args: [ip, cutoff],\n });\n const used = Number(res.rows?.[0]?.[0] ?? 0);\n if (used >= limit) return false;\n await sqlite.execute({\n sql: `INSERT INTO lookup_hits (ip, at) VALUES (?, ?)`,\n args: [ip, new Date().toISOString()],\n });\n return true;\n}\n\nexport async function saveChat(row: ChatRow) {\n await init();\n // REPLACE not IGNORE: chat:start arrives first with one message, then\n // chat:transcript_created arrives with the full thread for the same chatId.\n // The later, richer payload should win.\n await sqlite.execute({\n sql: `INSERT OR REPLACE INTO tawk_chats\n (id, event, time, domain, referrer, visitor_name, visitor_email, city, country,\n found_email, found_phone, transcript, sf_status, sf_json, received_at)\n VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,\n args: [\n row.id,\n row.event,\n row.time,\n row.domain,\n row.referrer,\n row.visitorName,\n row.visitorEmail,\n row.city,\n row.country,\n row.foundEmail,\n row.foundPhone,\n row.transcript,\n row.sfStatus,\n row.sfJson,\n new Date().toISOString(),\n ],\n });\n}\n\nexport async function listChats(limit = 100) {\n await init();\n const res = await sqlite.execute({\n sql: `SELECT * FROM tawk_chats ORDER BY received_at DESC LIMIT ?`,\n args: [limit],\n });\n return rowsToObjects(res);\n}\n\nexport async function getChat(id: string) {\n await init();\n const res = await sqlite.execute({\n sql: `SELECT * FROM tawk_chats WHERE id = ?`,\n args: [id],\n });\n return rowsToObjects(res)[0] ?? null;\n}\n\n/** std/sqlite returns {columns, rows}; zip them into plain objects. */\nfunction rowsToObjects(res: { columns: string[]; rows: unknown[][] }) {\n return res.rows.map((r) => Object.fromEntries(res.columns.map((c, i) => [c, r[i]])));\n}\n",[162],"6ba08d19-c34e-4132-857e-029928f7348d",["D",1787763126296],[27],"2eadb934-c3dd-46da-aef6-23012980f565","README.md","01a03a6b-1697-71fe-a680-fa2e6414fd9f",20,["D",1787694504963],4,"# tawk.to chat transcripts → SQLite → Salesforce match\n\nReceives tawk.to webhooks, stores the full message body of every chat, scrapes\ncontact details out of what the **visitor** typed, and checks whether that\nperson is already in Salesforce.\n\nFree and ungated — this uses tawk webhooks, not the beta REST API, and needs no\nplan upgrade.\n\n## Endpoints\n\n| | |\n| --- | --- |\n| `POST /` | webhook receiver. Put this URL in tawk **Admin → Webhooks**. |\n| `GET /enrich.js` | agent-facing enrichment script for your website (public, no secrets) |\n| `GET /?key=…` | list of chats |\n| `GET /?key=…&chat=` | one chat: full transcript, what was scraped, Salesforce match |\n\n## Setup\n\n1. In tawk: **Admin → Webhooks** → add a webhook pointing at this val's URL.\n Subscribe to **chat:transcript_created** (the one carrying the message body);\n `chat:start` and `ticket:create` are also handled. Set a secret.\n2. Set the env vars below.\n\n| Key | Required | What it does |\n| --- | --- | --- |\n| `TAWK_WEBHOOK_SECRET` | yes | The secret from step 1. Requests failing HMAC are rejected with 401. |\n| `VIEW_KEY` | to read anything | Any random string. Transcripts are customer PII, so the viewer stays shut until this is set. Use letters and digits only — it goes in a URL. |\n| `SALESFORCE_AGENT_URL` | for matching | Endpoint of `tribeca-salesforce-agent`. Copy from `tribeca-outbound-sales-call`. |\n| `SALESFORCE_AGENT_KEY` | for matching | That val's `API_SHARED_SECRET`. |\n\nWithout the Salesforce pair, transcripts still land — matches just report `error`.\n\n## enrich.js — showing agents who they're talking to\n\nAdd this to tribecabeverage.com **above the tawk embed** (tawk reads its\n`Tawk_API` callbacks at init, so load order matters):\n\n```html\n\n\n```\n\nIt hooks `onChatMessageVisitor` and `onPrechatSubmit`, scans what the visitor\ntypes, and writes these into tawk's visitor attributes so they show in the\nagent's Details panel:\n\n| Attribute | Source |\n| --- | --- |\n| `visitor-phone` | scraped from the visitor's own messages |\n| `visitor-email` | scraped |\n| `mentioned-zip` | scraped (phone digits stripped first so they can't be mistaken for a ZIP) |\n| `sf-status` | `existing customer` / `existing customer - multiple accounts` / `no account match` |\n| `sf-account` | Salesforce account name, when exactly one matched |\n\nValues accumulate across the conversation, so a number given in message one is\nstill on screen when an agent joins at message six.\n\nCustom attributes need no Secure Mode — only `name`/`email` do, which is why\nthese use dashed custom keys.\n\n### The `/enrich-lookup` tradeoff — read before changing it\n\n`sf-status` and `sf-account` require a lookup the **visitor's browser** performs,\nso `/enrich-lookup` cannot carry a secret. Anything it returns is readable by\nanyone who finds the URL: feed it phone numbers, learn which are customers and\nwhat those accounts are called.\n\nThat was accepted deliberately. The controls that bound it:\n\n- **phone only** — Salesforce exposes no email field to this integration user\n- **minimal response** — `known`, `ambiguous`, `account_name`. Never a delivery\n date, address, other contact, or record id. Do not widen this.\n- **per-IP rate limit** — 15/hour (verified: 16th request returns 429)\n- **Origin allow-list** — non-Tribeca origins get 403 (friction only; a header\n is trivially forged with curl)\n- **every call logged** with IP and outcome, so abuse is visible\n\nThe clean fix, if it ever matters: tawk's REST API (beta, gated behind their\naccess-request form) would let this val set visitor attributes server-side, and\n`/enrich-lookup` could then be deleted entirely.\n\n## Two deliberate design decisions\n\n**Only visitor messages are scraped for contact details.** Agents paste the\noffice number and support address constantly; scraping the whole transcript\nwould match every single chat to Tribeca itself. Verified: given a thread where\nMichael pastes 973-913-4568 and info@tribecabeverage.com, the scraper returns\nonly the visitor's own `dana@acmedeli.com` / `2015550147`.\n\n**Matching is by email and phone, never by name.** Names aren't unique and a\nconfident wrong match is worse than no match.\n\n## Do not reuse this for a customer-facing bot\n\nThe Salesforce match here is safe because the result is only ever shown to your\nown team. Wiring the same lookup into a bot that tells a *visitor* whether an\naccount exists would let anyone probe your customer list — type a name, learn\nwhether that business is a customer, then get handed their address. If that\ncapability is wanted in Apollo, it needs to match on something the real customer\nwould know before revealing anything.\n\n## Related\n\n- `tribeca-afterhours-chat` — the standalone after-hours widget (superseded if\n tawk's Apollo AI agent gets turned on)\n- `tribeca-salesforce-agent` — the read-only SOQL proxy this queries\n",[173],"pulls","branches",1,"forks","envVars",{"_188":166,"_190":182},"connections",{"_188":61,"_189":61},"count","unfilledCount","emptyCount",{"_41":172,"_31":173,"_29":174,"_137":-5,"_39":40,"_38":175,"_139":57,"_36":213,"_13":177,"_32":20,"_34":178,"_23":24,"_144":-5,"_198":214,"_26":215},{"_41":169,"_31":27,"_29":30,"_137":-5,"_39":40,"_38":14,"_139":24,"_36":210,"_13":61,"_32":33,"_34":35,"_23":24,"_144":-5,"_198":211,"_26":212},{"_41":161,"_31":162,"_29":163,"_137":-5,"_39":40,"_38":164,"_139":57,"_36":207,"_13":166,"_32":33,"_34":167,"_23":24,"_144":-5,"_198":208,"_26":209},{"_41":153,"_31":154,"_29":155,"_137":-5,"_39":40,"_38":156,"_139":57,"_36":204,"_13":158,"_32":33,"_34":159,"_23":24,"_144":-5,"_198":205,"_26":206},{"_41":146,"_31":147,"_29":148,"_137":-5,"_39":40,"_38":149,"_139":57,"_36":201,"_13":61,"_32":33,"_34":151,"_23":24,"_144":-5,"_198":202,"_26":203},{"_41":135,"_31":136,"_29":55,"_137":-5,"_39":40,"_38":138,"_139":24,"_36":197,"_13":141,"_32":142,"_34":143,"_23":24,"_144":43,"_198":199,"_26":200},["D",1787763090902],"children",[],[136],["D",1787686550422],[],[147],["D",1787762013212],[],[154],["D",1787694405142],[],[162],["D",1787763126296],[],[27],["D",1787694504963],[],[173],["D",1787686491713],["D",1789438866375],{"_98":97,"_106":102},{"_98":97,"_99":100,"_101":102,"_18":53,"_103":104,"_105":24},{"_13":87,"_31":88,"_41":40,"_89":42,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":43,"_96":97},"ctx",{"_80":-5,"_126":254,"_255":256,"_257":258,"_259":24,"_260":24,"_261":24,"_262":57,"_263":-5,"_264":-7,"_265":-7,"_266":61,"_267":24,"_268":24,"_269":-5,"_270":24,"_271":24,"_272":24,"_273":-5},"ENV",{"_225":226,"_227":228,"_229":88,"_230":231,"_232":233,"_234":235,"_236":237,"_238":239,"_240":241,"_242":243,"_244":245,"_246":247,"_248":249,"_250":251,"_252":253},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v28