[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_158":159,"_160":161},"routes/_app.x.$handle.$name",{"_97":96,"_32":45,"_106":87,"_27":53,"_13":14,"_107":-5,"_11":108,"_109":110,"_111":112,"_113":114,"_115":116,"_20":-5,"_117":-5,"_118":-5,"_119":25,"_120":121,"_122":123,"_124":-5,"_125":-5,"_126":127},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":25},"version",24,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","41ace24c-7e21-11f1-8c9d-1607ee4eb77e","name","fileType","http","content","// THE DOGS SPOT — Square to GHL Revenue Bridge (M2) + Facebook CAPI (M3) v3.10\n// v3.9 (31 Jul 2026): SQUARE_ACCESS_TOKEN now falls back to blob \"m2_sq_token\" ({t:\"...\"}) when the\n// env var is unset — env vars are UI-only on val.town and were the last blocker on POS matching.\n// Same-priority env var still wins if ever set. No other behaviour change.\n// v3.5 (25 Jul 2026 — the \"GHL createOpp 400\" retry storm + POS attribution):\n// - ROOT CAUSE of the 400: this GHL location has \"Allow duplicate opportunity\" OFF, so a contact\n// may hold exactly ONE opportunity. reconcile() only looked for opps already in the Won-Paid\n// STAGE; any paying customer who existed as a lead first (i.e. almost all of them) looked like\n// \"no opp\" -> POST /opportunities/ -> 400 OPPORTUNITY_NO_DUPLICATE -> throw -> 500 -> Square\n// retried the same event forever. Verified live 25 Jul against contact 4aPkmorlrd6OdZx8gkgu.\n// - reconcile() now reads ALL opps for the contact in the pipeline and only ever adopts/edits one\n// it owns (Won-Paid stage, or the OPP_NAME marker). If the only opp is the CLIENT'S own, it is\n// left completely untouched — its monetaryValue is Kim's sale figure, not our Square balance —\n// and the revenue is journaled as REVENUE-ON-CLIENT-OPP instead. No more hijacking, no retries.\n// - ghlCreateOpp() surfaces GHL's response body instead of a bare status code.\n// - Merges the v3.4 POS path that was written 15 Jul but never deployed (see below).\n// v3.4 (walk-in POS capture, written 15 Jul, DEPLOYED 25 Jul with v3.5): when a payment has no buyer\n// email/phone but DOES carry a Square customer_id (the register attached a customer at checkout),\n// resolve that customer via the Square Customers API, then match the GHL contact. GATED on\n// SQUARE_ACCESS_TOKEN — unset = exact v3.3 behaviour. NO-MATCH rows now record hadCustomerId +\n// sqTokenSet so the review distinguishes \"no identity at all\" from \"had one, couldn't resolve\".\n// v3.3 (revenue-capture fixes, post-live-audit 15 Jul — real payments were logging NO-MATCH):\n// - payment.created/updated now matches by email OR phone (was email-only), and falls back to the\n// invoice-linked contact (PAY_CONTACT) so invoice payments book to the right person.\n// - invoice.payment_made now actually BOOKS revenue (v3.2 linked the contact but never added the amount).\n// It links the payment->contact, then applies any pending payment/refund for that payment id.\n// - Symmetric \"pending payment\" stash: a payment that arrives before its invoice link is held and booked\n// the moment invoice.payment_made supplies the contact (mirrors the existing pending-refund logic).\n// - NO-MATCH rows now record hadEmail/hadPhone + amount so the weekly review is actionable and we can\n// quantify unmatched revenue. No contact is auto-created (avoids polluting the CRM with duplicates).\n// v3.2 hardening (kept): admin-guarded ?dump/?captest/?wipe (fail-closed, constant-time); GHL calls throw\n// on failure -> 500 so Square retries; event marked seen only after success; reconcile() touches only the\n// Won-Paid STAGE; phone normalized to E.164; action_source \"other\"; errors journaled without the fetch URL.\nimport { blob } from \"https://esm.town/v/std/blob\";\n\nconst NOTIFICATION_URL =\n \"https://amir5--41ace24c7e2111f18c9d1607ee4eb77e.web.val.run\";\nconst SQUARE_SIGNATURE_KEY = Deno.env.get(\"SQUARE_SIGNATURE_KEY\") ?? \"\";\nconst SQUARE_ACCESS_TOKEN = (Deno.env.get(\"SQUARE_ACCESS_TOKEN\")\n || (await blob.getJSON(\"m2_sq_token\").catch(() => null))?.t\n || \"\") as string; // v3.9: env var OR blob m2_sq_token fallback (val.town env-var UI unreachable from sessions; blob written 31 Jul via API). v3.4: optional; enables POS customer_id -> email/phone resolution\nconst SQUARE_API = \"https://connect.squareup.com/v2\";\nconst SQUARE_VERSION = \"2025-01-23\";\nconst GHL_TOKEN = Deno.env.get(\"GHL_TOKEN\") ?? \"\";\nconst ADMIN_SECRET = Deno.env.get(\"ADMIN_SECRET\") || GHL_TOKEN; // read-only routes; falls back to GHL_TOKEN\n// v3.6 — the GHL_TOKEN fallback is acceptable for the read-only journal dump (no raw PII in it),\n// but NOT for the two routes that cause real-world side effects. Until a dedicated ADMIN_SECRET\n// exists, ?wipe (deletes every m2_ blob: journal + all ledgers + all dedup/pending state) and\n// ?captest (fires a live Purchase event into the client's Facebook dataset) are DISABLED outright.\n// Anyone holding the GHL token can no longer destroy the bridge's memory or pollute her ad data.\nconst ADMIN_SECRET_DEDICATED = Deno.env.get(\"ADMIN_SECRET\") ?? \"\";\nconst adminStrictOk = (p: string | null) =>\n !!ADMIN_SECRET_DEDICATED && !!p && ctEq(p, ADMIN_SECRET_DEDICATED);\nconst GHL_LOCATION_ID = \"BQHJ19uohldYe3eqA0bl\";\nconst GHL_PIPELINE_ID = \"FXt1UpCVBufbF0v3pfyf\";\nconst GHL_WON_PAID_STAGE_ID = \"ae173310-f8b1-4399-acb7-ef1fc03d3697\";\nconst GHL_BASE = \"https://services.leadconnectorhq.com\";\nconst GHL_HEADERS = () => ({\n Authorization: `Bearer ${GHL_TOKEN}`,\n Version: \"2021-07-28\",\n \"Content-Type\": \"application/json\",\n});\nconst OPP_NAME = \"Square Paid (auto)\"; // bridge-created opp name marker\n\n// M3 — Facebook Conversions API (dataset for The Dogs Spot)\nconst FB_CAPI_TOKEN = Deno.env.get(\"FB_CAPI_TOKEN\") ?? \"\";\nconst FB_DATASET_ID = \"3838731049764356\";\nconst FB_API_VERSION = \"v21.0\";\n\nconst JOURNAL_KEY = \"m2_bridge_journal\";\nconst INBOUND_KEY = \"m2_last_inbound\";\nconst DEDUP_EVENT = \"m2_dedup_event:\";\nconst LEDGER = \"m2_ledger:\";\nconst PAY_CONTACT = \"m2_pay_contact:\";\nconst PENDING_PAY = \"m2_pending_pay:\"; // payment arrived before we could link a contact\nconst PENDING_REFUND = \"m2_pending_refund:\";\n\n// constant-time string compare (used for all admin-guard checks)\nfunction ctEq(a: string, b: string): boolean {\n if (!a || !b || a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\nfunction adminOk(param: string | null): boolean {\n return !!ADMIN_SECRET && !!param && ctEq(param, ADMIN_SECRET);\n}\n\n// v3.7 — the journal is read-modify-written in full on EVERY event, so unbounded growth costs\n// both storage and per-request time. A single retry storm already put 465 junk rows in it.\n// Hard cap at JOURNAL_MAX; oldest rows fall off. Anything needing permanent retention lives in\n// the per-contact ledgers, not here.\nconst JOURNAL_MAX = 1500;\nasync function journal(row: Record) {\n const j = (await blob.getJSON(JOURNAL_KEY).catch(() => null)) ?? [];\n j.push({ ts: new Date().toISOString(), ...row });\n await blob.setJSON(JOURNAL_KEY, j.slice(-JOURNAL_MAX));\n}\nasync function seen(key: string): Promise {\n const v = await blob.getJSON(key).catch(() => null);\n return v !== null && v !== undefined;\n}\nasync function getBlob(key: string): Promise {\n return (await blob.getJSON(key).catch(() => null)) as T | null;\n}\nasync function remember(key: string, val: unknown = true) {\n await blob.setJSON(key, val);\n}\n\nasync function sha256Hex(input: string): Promise {\n const data = new TextEncoder().encode(input.trim().toLowerCase());\n const buf = await crypto.subtle.digest(\"SHA-256\", data);\n return Array.from(new Uint8Array(buf)).map((b) =>\n b.toString(16).padStart(2, \"0\")\n ).join(\"\");\n}\n// US phone -> E.164 digits (prepend country code 1 for bare 10-digit numbers)\nfunction normPhone(phone: string): string {\n let d = phone.replace(/[^0-9]/g, \"\");\n if (d.length === 10) d = \"1\" + d;\n return d;\n}\n\n// v3.4 — resolve a Square customer_id -> {email, phone} via the Customers API. No-op without a token.\n// This is the POS path: a walk-in payment carries no buyer email/phone, only the customer the\n// register attached at checkout. Without this, every such payment logs NO-MATCH and its revenue\n// never reaches GHL.\nasync function fetchSquareCustomer(\n customerId: string,\n): Promise<{ email?: string; phone?: string }> {\n if (!SQUARE_ACCESS_TOKEN || !customerId) return {};\n try {\n const r = await fetch(\n `${SQUARE_API}/customers/${encodeURIComponent(customerId)}`,\n {\n headers: {\n Authorization: `Bearer ${SQUARE_ACCESS_TOKEN}`,\n \"Square-Version\": SQUARE_VERSION,\n },\n },\n );\n if (!r.ok) {\n await journal({ kind: \"SQ-CUST-ERR\", note: `status ${r.status}` });\n return {};\n }\n const d = await r.json().catch(() => ({}));\n const c = d?.customer ?? {};\n return {\n email: c.email_address || undefined,\n phone: c.phone_number || undefined,\n };\n } catch {\n await journal({ kind: \"SQ-CUST-ERR\", note: \"fetch failed\" });\n return {};\n }\n}\n\nasync function squareSigOk(\n rawBody: string,\n headerSig: string,\n): Promise {\n if (!headerSig || !SQUARE_SIGNATURE_KEY) return false;\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(SQUARE_SIGNATURE_KEY),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const mac = await crypto.subtle.sign(\n \"HMAC\",\n key,\n new TextEncoder().encode(NOTIFICATION_URL + rawBody),\n );\n const computed = btoa(String.fromCharCode(...new Uint8Array(mac)));\n return ctEq(computed, headerSig);\n}\n\n// M3 — send a Purchase event to the Facebook dataset. No-op if the token isn't set.\nasync function sendCapiPurchase(\n email: string | undefined,\n phone: string | undefined,\n amount: number,\n eventId: string,\n testEventCode?: string,\n): Promise {\n if (!FB_CAPI_TOKEN) {\n await journal({ kind: \"CAPI-SKIP\", note: \"no FB_CAPI_TOKEN\", eventId });\n return null;\n }\n try {\n const user_data: Record = {};\n if (email) user_data.em = [await sha256Hex(email)];\n if (phone) user_data.ph = [await sha256Hex(normPhone(phone))];\n if (!user_data.em && !user_data.ph) {\n await journal({ kind: \"CAPI-NO-PII\", eventId });\n return { error: \"no PII\" };\n }\n const payload: any = {\n data: [{\n event_name: \"Purchase\",\n event_time: Math.floor(Date.now() / 1000),\n action_source: \"other\",\n event_id: `purchase_${eventId}`,\n user_data,\n custom_data: { currency: \"USD\", value: Number(amount.toFixed(2)) },\n }],\n };\n if (testEventCode) payload.test_event_code = testEventCode;\n const r = await fetch(\n `https://graph.facebook.com/${FB_API_VERSION}/${FB_DATASET_ID}/events?access_token=${\n encodeURIComponent(FB_CAPI_TOKEN)\n }`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(payload),\n },\n );\n const d = await r.json().catch(() => ({}));\n // journal only safe fields (never the request URL / token)\n await journal({\n kind: r.ok ? \"CAPI-PURCHASE\" : \"CAPI-ERROR\",\n eventId,\n amount,\n test: !!testEventCode,\n resp: d?.events_received ?? d?.error?.message ?? \"unknown\",\n });\n return d;\n } catch (e) {\n await journal({ kind: \"CAPI-ERROR\", eventId, error: \"fetch failed\" });\n return { error: \"fetch failed\" };\n }\n}\n\n// GHL helpers — every call checks r.ok and THROWS on failure so the webhook returns 500 (Square retries).\nasync function ghlFindContact(\n email?: string,\n phone?: string,\n): Promise {\n for (const [param, val] of [[\"email\", email], [\"number\", phone]] as const) {\n if (!val) continue;\n const r = await fetch(\n `${GHL_BASE}/contacts/search/duplicate?locationId=${GHL_LOCATION_ID}&${param}=${\n encodeURIComponent(val)\n }`,\n { headers: GHL_HEADERS() },\n );\n if (r.ok) {\n const d = await r.json().catch(() => ({}));\n const id = d?.contact?.id ?? d?.id ?? null;\n if (id) return id;\n } else if (r.status >= 500 || r.status === 429 || r.status === 401) {\n throw new Error(`GHL find ${r.status}`);\n }\n }\n return null;\n}\n// v3.5 — every opp this contact has in the bridge pipeline, ANY stage. Needed to tell a\n// bridge-created opp from one of Kim's own before deciding to create.\nasync function ghlPipelineOpps(\n contactId: string,\n): Promise<{ id: string; name: string; stage: string; value: number }[]> {\n const r = await fetch(\n `${GHL_BASE}/opportunities/search?location_id=${GHL_LOCATION_ID}&contact_id=${contactId}&pipeline_id=${GHL_PIPELINE_ID}`,\n { headers: GHL_HEADERS() },\n );\n if (!r.ok) throw new Error(`GHL oppsearch ${r.status}`);\n const d = await r.json().catch(() => ({}));\n return (d?.opportunities ?? []).map((o: any) => ({\n id: o.id,\n name: o.name ?? \"\",\n stage: o.pipelineStageId ?? \"\",\n value: Number(o.monetaryValue ?? 0),\n }));\n}\n// only Won-Paid-stage opps (never touch a human's opp in another stage)\nasync function ghlWonPaidOpps(\n contactId: string,\n): Promise<{ id: string; value: number }[]> {\n const r = await fetch(\n `${GHL_BASE}/opportunities/search?location_id=${GHL_LOCATION_ID}&contact_id=${contactId}&pipeline_id=${GHL_PIPELINE_ID}`,\n { headers: GHL_HEADERS() },\n );\n if (!r.ok) throw new Error(`GHL oppsearch ${r.status}`);\n const d = await r.json().catch(() => ({}));\n // Won-Paid STAGE is bridge-exclusive, so filtering by stage finds existing bridge opps\n // (any name) while never touching a human's opp in another stage.\n return (d?.opportunities ?? [])\n .filter((o: any) => o.pipelineStageId === GHL_WON_PAID_STAGE_ID)\n .map((o: any) => ({ id: o.id, value: Number(o.monetaryValue ?? 0) }));\n}\n// v3.5 — returns {id} on success, {duplicate} when GHL refuses because the contact already owns\n// an opportunity, {err} otherwise. v3.3 threw a bare \"GHL createOpp 400\" that hid the reason.\nasync function ghlCreateOpp(\n contactId: string,\n value: number,\n): Promise<{ id?: string; duplicate?: string; err?: string }> {\n const r = await fetch(`${GHL_BASE}/opportunities/`, {\n method: \"POST\",\n headers: GHL_HEADERS(),\n body: JSON.stringify({\n pipelineId: GHL_PIPELINE_ID,\n locationId: GHL_LOCATION_ID,\n name: OPP_NAME,\n pipelineStageId: GHL_WON_PAID_STAGE_ID,\n status: \"won\",\n contactId,\n monetaryValue: value,\n }),\n });\n const d = await r.json().catch(() => ({}));\n if (!r.ok) {\n // \"Allow duplicate opportunity\" is OFF on this location: a contact may hold only one\n // opportunity. GHL hands back the existing id. This is the NORMAL case for any paying\n // customer who was a lead first -- it used to throw -> 500 -> Square retried forever.\n if (d?.code === \"OPPORTUNITY_NO_DUPLICATE\" && d?.meta?.existingId) {\n return { duplicate: d.meta.existingId };\n }\n return {\n err: `GHL createOpp ${r.status} ${JSON.stringify(d).slice(0, 200)}`,\n };\n }\n const id = d?.opportunity?.id ?? d?.id;\n return id ? { id } : { err: \"GHL createOpp no id\" };\n}\nasync function ghlSetOppValue(oppId: string, value: number) {\n const r = await fetch(`${GHL_BASE}/opportunities/${oppId}`, {\n method: \"PUT\",\n headers: GHL_HEADERS(),\n body: JSON.stringify({\n pipelineStageId: GHL_WON_PAID_STAGE_ID,\n status: \"won\",\n monetaryValue: value,\n }),\n });\n if (!r.ok) throw new Error(`GHL setOpp ${r.status}`);\n}\nasync function ghlDeleteOpp(oppId: string) {\n const r = await fetch(`${GHL_BASE}/opportunities/${oppId}`, {\n method: \"DELETE\",\n headers: GHL_HEADERS(),\n });\n if (!r.ok && r.status !== 404) throw new Error(`GHL delOpp ${r.status}`);\n}\nasync function ghlNote(contactId: string, body: string) {\n await fetch(`${GHL_BASE}/contacts/${contactId}/notes`, {\n method: \"POST\",\n headers: GHL_HEADERS(),\n body: JSON.stringify({ body }),\n });\n}\n\ntype Ledger = {\n payments: Record;\n refunds: Record;\n oppId: string | null;\n name?: string;\n};\nconst sum = (o: Record) =>\n Object.values(o).reduce((a, b) => a + b, 0);\n\nasync function reconcile(\n contactId: string,\n): Promise<{ oppId: string | null; value: number }> {\n const ledger = (await getBlob(LEDGER + contactId)) ??\n { payments: {}, refunds: {}, oppId: null };\n const value = Math.round((sum(ledger.payments) - sum(ledger.refunds)) * 100) /\n 100;\n const v = Math.max(0, value);\n const all = await ghlPipelineOpps(contactId);\n // ours = Won-Paid stage (bridge-exclusive by agreement) or carrying the bridge name marker\n const mine = all.filter((o) =>\n o.stage === GHL_WON_PAID_STAGE_ID || o.name === OPP_NAME\n );\n let keep = (ledger.oppId &&\n mine.find((o) => o.id === ledger.oppId)?.id) || mine[0]?.id || null;\n for (const o of mine) if (o.id !== keep) await ghlDeleteOpp(o.id);\n if (keep) {\n await ghlSetOppValue(keep, v);\n ledger.oppId = keep;\n await remember(LEDGER + contactId, ledger);\n return { oppId: keep, value: v };\n }\n\n const created = await ghlCreateOpp(contactId, v);\n if (created.id) {\n ledger.oppId = created.id;\n await remember(LEDGER + contactId, ledger);\n return { oppId: created.id, value: v };\n }\n if (created.err) throw new Error(created.err);\n\n // v3.5 — the contact already owns an opportunity the bridge did NOT create: a real lead or\n // customer record of Kim's. Do NOT hijack it and do NOT overwrite its monetaryValue -- that\n // number is her sale, not our Square balance. Book the revenue in the ledger + contact note +\n // journal and return cleanly so Square stops retrying the event.\n ledger.oppId = null;\n await remember(LEDGER + contactId, ledger);\n await journal({\n kind: \"REVENUE-ON-CLIENT-OPP\",\n contactId,\n amount: v,\n note: `existing opp ${created.duplicate} left untouched`,\n });\n return { oppId: null, value: v };\n}\nasync function addPayment(\n contactId: string,\n paymentId: string,\n amount: number,\n email?: string,\n phone?: string,\n) {\n if (!paymentId) {\n await journal({ kind: \"BAD-PAYMENT\", note: \"missing payment id\" });\n return;\n }\n const ledger = (await getBlob(LEDGER + contactId)) ??\n { payments: {}, refunds: {}, oppId: null };\n if (paymentId in ledger.payments && ledger.payments[paymentId] === amount) {\n await journal({ kind: \"PAY-DUP\", contactId, id: paymentId });\n await reconcile(contactId);\n return;\n }\n ledger.payments[paymentId] = amount; // also handles amount-changed updates\n await remember(LEDGER + contactId, ledger);\n await remember(PAY_CONTACT + paymentId, contactId);\n const { value } = await reconcile(contactId);\n await ghlNote(\n contactId,\n `[Square] +$${amount.toFixed(2)} payment ${paymentId} (balance $${\n value.toFixed(2)\n })`,\n );\n await journal({\n kind: \"PAYMENT\",\n contactId,\n amount,\n note: `payment ${paymentId}`,\n });\n await sendCapiPurchase(email, phone, amount, paymentId); // M3\n await applyPendingRefund(contactId, paymentId);\n}\nasync function addRefund(contactId: string, refundId: string, amount: number) {\n if (!refundId) {\n await journal({ kind: \"BAD-REFUND\" });\n return;\n }\n const ledger = (await getBlob(LEDGER + contactId)) ??\n { payments: {}, refunds: {}, oppId: null };\n if (refundId in ledger.refunds) {\n await journal({ kind: \"REFUND-DUP\", contactId, id: refundId });\n return;\n }\n ledger.refunds[refundId] = amount;\n await remember(LEDGER + contactId, ledger);\n const { value } = await reconcile(contactId);\n await ghlNote(\n contactId,\n `[Square] Refund -$${amount.toFixed(2)} ${refundId} (balance $${\n value.toFixed(2)\n })`,\n );\n await journal({\n kind: \"REFUND\",\n contactId,\n amount,\n note: `refund ${refundId}`,\n });\n}\n// apply a refund that arrived BEFORE its payment (stashed as pending), once the payment links a contact\nasync function applyPendingRefund(contactId: string, paymentId: string) {\n const pend = await getBlob<{ rid: string; amt: number }>(\n PENDING_REFUND + paymentId,\n );\n if (pend) {\n await blob.delete(PENDING_REFUND + paymentId);\n await journal({ kind: \"REFUND-PENDING-APPLIED\", contactId, id: pend.rid });\n await addRefund(contactId, pend.rid, pend.amt);\n }\n}\n// apply a payment that arrived BEFORE we could link a contact (e.g. POS/checkout payment with no email,\n// later linked by its invoice.payment_made). Books the real amount from the original payment event.\nasync function applyPendingPayment(\n contactId: string,\n paymentId: string,\n email?: string,\n phone?: string,\n) {\n const pend = await getBlob<{ amt: number; email?: string; phone?: string }>(\n PENDING_PAY + paymentId,\n );\n if (pend) {\n await blob.delete(PENDING_PAY + paymentId);\n await journal({\n kind: \"PENDING-PAY-APPLIED\",\n contactId,\n id: paymentId,\n amount: pend.amt,\n });\n // prefer the payment's own PII; fall back to the invoice recipient's so CAPI still gets identity\n await addPayment(\n contactId,\n paymentId,\n pend.amt,\n pend.email || email,\n pend.phone || phone,\n );\n }\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n // v3.8 — inbound heartbeat. Recorded BEFORE signature verification or parsing, so that\n // \"Square stopped delivering\" becomes distinguishable from \"Square delivered and we\n // discarded it\". Until now the journal only recorded events the code chose to act on,\n // which meant a disabled or expired webhook subscription was indistinguishable from a\n // genuinely quiet trading day — the failure mode was total silence with no alarm.\n if (req.method === \"POST\") {\n try {\n const prev = await blob.getJSON<{ n?: number }>(INBOUND_KEY).catch(() => null);\n await blob.setJSON(INBOUND_KEY, {\n ts: new Date().toISOString(),\n n: (prev?.n ?? 0) + 1,\n });\n } catch { /* never let bookkeeping break delivery */ }\n }\n\n // Health check (no data) — safe to be public\n if (req.method === \"GET\" && !url.search) {\n return new Response(\"M2/M3 bridge up (v3.8).\");\n }\n\n // Journal — now REQUIRES admin secret (was a public PII leak in earlier versions)\n if (req.method === \"GET\" && url.searchParams.get(\"dump\") === \"1\") {\n if (!adminOk(url.searchParams.get(\"admin\"))) {\n return new Response(\"forbidden\", { status: 403 });\n }\n return Response.json(\n (await blob.getJSON(JOURNAL_KEY).catch(() => null)) ?? [],\n );\n }\n // v3.10 (11 Aug 2026) — READ ONLY PAYMENT LOOKUP. Added so Kim's team can identify the 29\n // unmatched July payments. The journal only ever recorded amount and time; Square holds the\n // receipt, the card's last four and the line items. The token to ask Square is already in this\n // runtime and reachable from nowhere else, which is the only reason this route exists here.\n //\n // GET ?lookup=&admin=\n // It performs GET on Square's Payments and Orders APIs and nothing else. There is no write verb\n // in this branch, it touches no blob, and it journals nothing, so it cannot alter the bridge's\n // memory or Kim's data. Ninety ids per call is the cap, to keep one request bounded.\n if (req.method === \"GET\" && url.searchParams.get(\"lookup\")) {\n if (!adminOk(url.searchParams.get(\"admin\"))) {\n return new Response(\"forbidden\", { status: 403 });\n }\n if (!SQUARE_ACCESS_TOKEN) {\n return Response.json({ error: \"SQUARE_ACCESS_TOKEN not set in this runtime\" }, { status: 503 });\n }\n const ids = String(url.searchParams.get(\"lookup\")).split(\",\").map((x) => x.trim()).filter(Boolean).slice(0, 90);\n const sqGet = async (path: string) => {\n const r = await fetch(`${SQUARE_API}${path}`, {\n headers: { Authorization: `Bearer ${SQUARE_ACCESS_TOKEN}`, \"Square-Version\": SQUARE_VERSION },\n });\n if (!r.ok) return { _error: r.status } as any;\n return await r.json();\n };\n const out: any[] = [];\n for (const id of ids) {\n const pay = await sqGet(`/payments/${encodeURIComponent(id)}`);\n const p = pay?.payment ?? null;\n let order: any = null;\n if (p?.order_id) order = (await sqGet(`/orders/${encodeURIComponent(p.order_id)}`))?.order ?? null;\n out.push({\n id,\n error: pay?._error ?? null,\n created_at: p?.created_at ?? null,\n amount: p?.amount_money?.amount != null ? p.amount_money.amount / 100 : null,\n status: p?.status ?? null,\n source_type: p?.source_type ?? null,\n card_brand: p?.card_details?.card?.card_brand ?? null,\n last_4: p?.card_details?.card?.last_4 ?? null,\n cardholder_name: p?.card_details?.card?.cardholder_name ?? null,\n entry_method: p?.card_details?.entry_method ?? null,\n receipt_number: p?.receipt_number ?? null,\n receipt_url: p?.receipt_url ?? null,\n note: p?.note ?? null,\n customer_id: p?.customer_id ?? null,\n location_id: p?.location_id ?? null,\n device_name: p?.device_details?.device_name ?? null,\n team_member_id: p?.team_member_id ?? null,\n order_id: p?.order_id ?? null,\n line_items: (order?.line_items ?? []).map((li: any) => ({\n name: li?.name ?? null,\n quantity: li?.quantity ?? null,\n total: li?.total_money?.amount != null ? li.total_money.amount / 100 : null,\n variation: li?.variation_name ?? null,\n catalog_object_id: li?.catalog_object_id ?? null,\n })),\n order_customer_id: order?.customer_id ?? null,\n // v3.10a: resolve the Square customer too. Every one of the 29 unmatched July payments\n // carries a customer_id, so these buyers are NOT anonymous. Square knows who they are and\n // the bridge simply failed to carry it across. Read only, one GET per customer.\n square_customer: await (async () => {\n const cid = p?.customer_id ?? order?.customer_id ?? null;\n if (!cid) return null;\n const c = (await sqGet(`/customers/${encodeURIComponent(String(cid))}`))?.customer ?? null;\n if (!c) return null;\n return {\n given_name: c.given_name ?? null, family_name: c.family_name ?? null,\n email_address: c.email_address ?? null, phone_number: c.phone_number ?? null,\n company_name: c.company_name ?? null, nickname: c.nickname ?? null,\n reference_id: c.reference_id ?? null, note: c.note ?? null,\n created_at: c.created_at ?? null,\n };\n })(),\n fulfillments: (order?.fulfillments ?? []).map((f: any) => f?.pickup_details?.recipient ?? null).filter(Boolean),\n });\n }\n return Response.json({ asked: ids.length, results: out });\n }\n\n // v3.10b — READ ONLY CATALOG. Kim asked that payment links be built from the \"New Training\n // Prices\" category in Square and its Upgrades subcategory, because the product prices in her CRM\n // are stale. This lists the catalog so those prices can be read rather than retyped. GETs only.\n if (req.method === \"GET\" && url.searchParams.get(\"catalog\") === \"1\") {\n if (!adminOk(url.searchParams.get(\"admin\"))) return new Response(\"forbidden\", { status: 403 });\n if (!SQUARE_ACCESS_TOKEN) return Response.json({ error: \"no square token\" }, { status: 503 });\n const sqGet2 = async (path: string) => {\n const r = await fetch(`${SQUARE_API}${path}`, {\n headers: { Authorization: `Bearer ${SQUARE_ACCESS_TOKEN}`, \"Square-Version\": SQUARE_VERSION },\n });\n return r.ok ? await r.json() : { _error: r.status };\n };\n const cats = await sqGet2(\"/catalog/list?types=CATEGORY\");\n const items = await sqGet2(\"/catalog/list?types=ITEM\");\n const catName = new Map();\n for (const c of cats?.objects ?? []) catName.set(c.id, c?.category_data?.name ?? \"\");\n const out = (items?.objects ?? []).map((it: any) => ({\n item: it?.item_data?.name ?? null,\n category: catName.get(it?.item_data?.category_id ?? it?.item_data?.categories?.[0]?.id ?? \"\") ?? null,\n variations: (it?.item_data?.variations ?? []).map((v: any) => ({\n name: v?.item_variation_data?.name ?? null,\n price: v?.item_variation_data?.price_money?.amount != null ? v.item_variation_data.price_money.amount / 100 : null,\n })),\n }));\n return Response.json({ categories: [...catName.values()].filter(Boolean).sort(), items: out });\n }\n\n // v3.5 — env presence check (admin, booleans only, never values). Answers \"is the POS path armed?\"\n if (req.method === \"GET\" && url.searchParams.get(\"envcheck\") === \"1\") {\n if (!adminOk(url.searchParams.get(\"admin\"))) {\n return new Response(\"forbidden\", { status: 403 });\n }\n return Response.json({\n version: \"3.9\",\n SQUARE_SIGNATURE_KEY: !!SQUARE_SIGNATURE_KEY,\n SQUARE_ACCESS_TOKEN: !!SQUARE_ACCESS_TOKEN,\n GHL_TOKEN: !!GHL_TOKEN,\n lastInbound: (await blob.getJSON(INBOUND_KEY).catch(() => null)) ?? \"never\",\n ADMIN_SECRET_dedicated: !!ADMIN_SECRET_DEDICATED,\n destructive_routes_enabled: !!ADMIN_SECRET_DEDICATED,\n FB_CAPI_TOKEN: !!FB_CAPI_TOKEN,\n });\n }\n // CAPI self-test (admin) — fires one Purchase; use &code= to keep it in Test Events\n if (req.method === \"GET\" && url.searchParams.has(\"captest\")) {\n if (!adminStrictOk(url.searchParams.get(\"captest\"))) {\n return new Response(\"forbidden: ?captest requires a dedicated ADMIN_SECRET\", { status: 403 });\n }\n const code = url.searchParams.get(\"code\") || undefined;\n const resp = await sendCapiPurchase(\n \"captest@thedogsspotga.com\",\n \"+19125550123\",\n 1.00,\n \"captest_\" + Date.now(),\n code,\n );\n return Response.json({\n sent: true,\n hasToken: !!FB_CAPI_TOKEN,\n dataset: FB_DATASET_ID,\n testEventCode: code ?? null,\n meta: resp,\n });\n }\n // Wipe (admin) — POST only, fail-closed\n if (req.method === \"POST\" && url.searchParams.get(\"wipe\") === \"1\") {\n if (!adminStrictOk(url.searchParams.get(\"admin\"))) {\n return new Response(\"forbidden: ?wipe requires a dedicated ADMIN_SECRET\", { status: 403 });\n }\n const keys = await blob.list(\"m2_\");\n let n = 0;\n for (const k of keys) {\n await blob.delete((k as any).key);\n n++;\n }\n return new Response(\"wiped \" + n);\n }\n if (req.method !== \"POST\") return new Response(\"M2/M3 bridge up (v3.7).\");\n\n const raw = await req.text();\n const sig = req.headers.get(\"x-square-hmacsha256-signature\") ?? \"\";\n if (!(await squareSigOk(raw, sig))) {\n await journal({ kind: \"BAD-SIG\" });\n return new Response(\"bad sig\", { status: 401 });\n }\n\n let evt: any;\n try {\n evt = JSON.parse(raw);\n } catch {\n return new Response(\"bad json\", { status: 400 });\n }\n const eventId = evt?.event_id;\n if (eventId && await seen(DEDUP_EVENT + eventId)) {\n await journal({ kind: \"DUPLICATE-SKIP\" });\n return new Response(\"dup\");\n }\n\n const type = evt?.type as string;\n const obj = evt?.data?.object ?? {};\n try {\n if (type === \"payment.updated\" || type === \"payment.created\") {\n const p = obj.payment ?? {};\n if (p.status === \"COMPLETED\") {\n const amt = (p.amount_money?.amount ?? 0) / 100;\n let email = p.buyer_email_address || undefined;\n let phone = p.buyer_phone_number || undefined; // usually absent on POS, defensive\n // 1) match by email OR phone; 2) else use the contact an invoice already linked to this payment id\n let cid = await ghlFindContact(email, phone);\n if (!cid) cid = await getBlob(PAY_CONTACT + p.id);\n // 3) v3.4/v3.5 — POS: the register attached a customer at checkout but the payment object\n // carries no email/phone. Resolve the Square customer, then match the GHL contact.\n if (!cid && p.customer_id && SQUARE_ACCESS_TOKEN) {\n const sc = await fetchSquareCustomer(p.customer_id);\n email = email || sc.email;\n phone = phone || sc.phone;\n if (sc.email || sc.phone) cid = await ghlFindContact(sc.email, sc.phone);\n }\n if (cid) await addPayment(cid, p.id, amt, email, phone);\n else {\n // hold the amount so invoice.payment_made can book it the moment it supplies a contact\n await remember(PENDING_PAY + p.id, { amt, email, phone });\n await journal({\n kind: \"NO-MATCH\",\n note: `payment ${p.id}`,\n amount: amt,\n hadEmail: !!email,\n hadPhone: !!phone,\n hadCustomerId: !!p.customer_id,\n sqTokenSet: !!SQUARE_ACCESS_TOKEN,\n });\n }\n }\n } else if (type === \"invoice.payment_made\") {\n const inv = obj.invoice ?? {};\n const r = inv.primary_recipient ?? {};\n const email = r.email_address || undefined;\n const phone = r.phone_number || undefined;\n const payId = obj?.payment?.id;\n const cid = await ghlFindContact(email, phone);\n if (cid) {\n if (payId) {\n await remember(PAY_CONTACT + payId, cid);\n await applyPendingRefund(cid, payId);\n await applyPendingPayment(cid, payId, email, phone); // books the payment amount if it already arrived\n }\n await reconcile(cid);\n await journal({\n kind: \"INVOICE-LINKED\",\n note: `invoice ${inv.id}`,\n contactId: cid,\n });\n } else {\n // no contact to book to — the payment stays on the review list (rich NO-MATCH)\n await journal({\n kind: \"NO-MATCH\",\n note: `invoice ${inv.id}`,\n hadEmail: !!email,\n hadPhone: !!phone,\n });\n }\n } else if (type === \"invoice.refunded\") {\n const inv = obj.invoice ?? {};\n const r = inv.primary_recipient ?? {};\n const cid = await ghlFindContact(r.email_address, r.phone_number);\n const amt = (obj?.refund?.amount_money?.amount ?? 0) / 100;\n const rid = obj?.refund?.id ?? `inv-${inv.id}`;\n if (cid) await addRefund(cid, rid, amt);\n else {await journal({\n kind: \"REFUND-NO-MATCH\",\n note: `invoice-refund ${inv.id}`,\n });}\n } else if (type === \"refund.updated\" || type === \"refund.created\") {\n const rf = obj.refund ?? {};\n if (rf.status === \"COMPLETED\") {\n const cid = rf.payment_id\n ? await getBlob(PAY_CONTACT + rf.payment_id)\n : null;\n const amt = (rf.amount_money?.amount ?? 0) / 100;\n if (cid) await addRefund(cid, rf.id, amt);\n else {\n await remember(PENDING_REFUND + (rf.payment_id ?? rf.id), {\n rid: rf.id,\n amt,\n });\n await journal({\n kind: \"REFUND-PENDING\",\n amount: amt,\n note: `refund ${rf.id}`,\n });\n }\n }\n } else {\n await journal({ kind: \"IGNORED\", type });\n }\n } catch (e) {\n await journal({ kind: \"ERROR\", type, error: String(e).slice(0, 120) });\n return new Response(\"retry\", { status: 500 }); // Square will retry; event NOT marked seen\n }\n\n if (eventId) await remember(DEDUP_EVENT + eventId); // mark seen only after success\n return new Response(\"EVENT_RECEIVED\");\n}","// THE DOGS SPOT — Square to GHL Revenue Bridge (M2) + Facebook CAPI (M3) v3.11\n// v3.11 (12 Aug 2026): ONE new route, ?history=..&admin= , strictly READ ONLY.\n// The CRM stopped recording payment amounts on 19 Feb 2026 and the journal below only begins on\n// 13 Jul 2026, so 144 days of takings existed nowhere we could see. Square has them. This route\n// walks GET /v2/payments (begin_time, end_time, sort_order=ASC, location_id, cursor to\n// exhaustion) plus GET /v2/refunds for the same window, and returns a summary and the rows.\n// It writes nothing anywhere: no blob, no journal(), no GoHighLevel, no verb but GET. Admin\n// guarded fail-closed, and a missing or malformed range 400s instead of pulling everything.\n// v3.9 (31 Jul 2026): SQUARE_ACCESS_TOKEN now falls back to blob \"m2_sq_token\" ({t:\"...\"}) when the\n// env var is unset — env vars are UI-only on val.town and were the last blocker on POS matching.\n// Same-priority env var still wins if ever set. No other behaviour change.\n// v3.5 (25 Jul 2026 — the \"GHL createOpp 400\" retry storm + POS attribution):\n// - ROOT CAUSE of the 400: this GHL location has \"Allow duplicate opportunity\" OFF, so a contact\n// may hold exactly ONE opportunity. reconcile() only looked for opps already in the Won-Paid\n// STAGE; any paying customer who existed as a lead first (i.e. almost all of them) looked like\n// \"no opp\" -> POST /opportunities/ -> 400 OPPORTUNITY_NO_DUPLICATE -> throw -> 500 -> Square\n// retried the same event forever. Verified live 25 Jul against contact 4aPkmorlrd6OdZx8gkgu.\n// - reconcile() now reads ALL opps for the contact in the pipeline and only ever adopts/edits one\n// it owns (Won-Paid stage, or the OPP_NAME marker). If the only opp is the CLIENT'S own, it is\n// left completely untouched — its monetaryValue is Kim's sale figure, not our Square balance —\n// and the revenue is journaled as REVENUE-ON-CLIENT-OPP instead. No more hijacking, no retries.\n// - ghlCreateOpp() surfaces GHL's response body instead of a bare status code.\n// - Merges the v3.4 POS path that was written 15 Jul but never deployed (see below).\n// v3.4 (walk-in POS capture, written 15 Jul, DEPLOYED 25 Jul with v3.5): when a payment has no buyer\n// email/phone but DOES carry a Square customer_id (the register attached a customer at checkout),\n// resolve that customer via the Square Customers API, then match the GHL contact. GATED on\n// SQUARE_ACCESS_TOKEN — unset = exact v3.3 behaviour. NO-MATCH rows now record hadCustomerId +\n// sqTokenSet so the review distinguishes \"no identity at all\" from \"had one, couldn't resolve\".\n// v3.3 (revenue-capture fixes, post-live-audit 15 Jul — real payments were logging NO-MATCH):\n// - payment.created/updated now matches by email OR phone (was email-only), and falls back to the\n// invoice-linked contact (PAY_CONTACT) so invoice payments book to the right person.\n// - invoice.payment_made now actually BOOKS revenue (v3.2 linked the contact but never added the amount).\n// It links the payment->contact, then applies any pending payment/refund for that payment id.\n// - Symmetric \"pending payment\" stash: a payment that arrives before its invoice link is held and booked\n// the moment invoice.payment_made supplies the contact (mirrors the existing pending-refund logic).\n// - NO-MATCH rows now record hadEmail/hadPhone + amount so the weekly review is actionable and we can\n// quantify unmatched revenue. No contact is auto-created (avoids polluting the CRM with duplicates).\n// v3.2 hardening (kept): admin-guarded ?dump/?captest/?wipe (fail-closed, constant-time); GHL calls throw\n// on failure -> 500 so Square retries; event marked seen only after success; reconcile() touches only the\n// Won-Paid STAGE; phone normalized to E.164; action_source \"other\"; errors journaled without the fetch URL.\nimport { blob } from \"https://esm.town/v/std/blob\";\n\nconst NOTIFICATION_URL =\n \"https://amir5--41ace24c7e2111f18c9d1607ee4eb77e.web.val.run\";\nconst SQUARE_SIGNATURE_KEY = Deno.env.get(\"SQUARE_SIGNATURE_KEY\") ?? \"\";\nconst SQUARE_ACCESS_TOKEN = (Deno.env.get(\"SQUARE_ACCESS_TOKEN\")\n || (await blob.getJSON(\"m2_sq_token\").catch(() => null))?.t\n || \"\") as string; // v3.9: env var OR blob m2_sq_token fallback (val.town env-var UI unreachable from sessions; blob written 31 Jul via API). v3.4: optional; enables POS customer_id -> email/phone resolution\nconst SQUARE_API = \"https://connect.squareup.com/v2\";\nconst SQUARE_VERSION = \"2025-01-23\";\nconst SQUARE_LOCATION_ID = \"C17329AKF4AKM\"; // v3.11: the one trading location, default filter for ?history\nconst GHL_TOKEN = Deno.env.get(\"GHL_TOKEN\") ?? \"\";\nconst ADMIN_SECRET = Deno.env.get(\"ADMIN_SECRET\") || GHL_TOKEN; // read-only routes; falls back to GHL_TOKEN\n// v3.6 — the GHL_TOKEN fallback is acceptable for the read-only journal dump (no raw PII in it),\n// but NOT for the two routes that cause real-world side effects. Until a dedicated ADMIN_SECRET\n// exists, ?wipe (deletes every m2_ blob: journal + all ledgers + all dedup/pending state) and\n// ?captest (fires a live Purchase event into the client's Facebook dataset) are DISABLED outright.\n// Anyone holding the GHL token can no longer destroy the bridge's memory or pollute her ad data.\nconst ADMIN_SECRET_DEDICATED = Deno.env.get(\"ADMIN_SECRET\") ?? \"\";\nconst adminStrictOk = (p: string | null) =>\n !!ADMIN_SECRET_DEDICATED && !!p && ctEq(p, ADMIN_SECRET_DEDICATED);\nconst GHL_LOCATION_ID = \"BQHJ19uohldYe3eqA0bl\";\nconst GHL_PIPELINE_ID = \"FXt1UpCVBufbF0v3pfyf\";\nconst GHL_WON_PAID_STAGE_ID = \"ae173310-f8b1-4399-acb7-ef1fc03d3697\";\nconst GHL_BASE = \"https://services.leadconnectorhq.com\";\nconst GHL_HEADERS = () => ({\n Authorization: `Bearer ${GHL_TOKEN}`,\n Version: \"2021-07-28\",\n \"Content-Type\": \"application/json\",\n});\nconst OPP_NAME = \"Square Paid (auto)\"; // bridge-created opp name marker\n\n// M3 — Facebook Conversions API (dataset for The Dogs Spot)\nconst FB_CAPI_TOKEN = Deno.env.get(\"FB_CAPI_TOKEN\") ?? \"\";\nconst FB_DATASET_ID = \"3838731049764356\";\nconst FB_API_VERSION = \"v21.0\";\n\nconst JOURNAL_KEY = \"m2_bridge_journal\";\nconst INBOUND_KEY = \"m2_last_inbound\";\nconst DEDUP_EVENT = \"m2_dedup_event:\";\nconst LEDGER = \"m2_ledger:\";\nconst PAY_CONTACT = \"m2_pay_contact:\";\nconst PENDING_PAY = \"m2_pending_pay:\"; // payment arrived before we could link a contact\nconst PENDING_REFUND = \"m2_pending_refund:\";\n\n// constant-time string compare (used for all admin-guard checks)\nfunction ctEq(a: string, b: string): boolean {\n if (!a || !b || a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\nfunction adminOk(param: string | null): boolean {\n return !!ADMIN_SECRET && !!param && ctEq(param, ADMIN_SECRET);\n}\n\n// v3.7 — the journal is read-modify-written in full on EVERY event, so unbounded growth costs\n// both storage and per-request time. A single retry storm already put 465 junk rows in it.\n// Hard cap at JOURNAL_MAX; oldest rows fall off. Anything needing permanent retention lives in\n// the per-contact ledgers, not here.\nconst JOURNAL_MAX = 1500;\nasync function journal(row: Record) {\n const j = (await blob.getJSON(JOURNAL_KEY).catch(() => null)) ?? [];\n j.push({ ts: new Date().toISOString(), ...row });\n await blob.setJSON(JOURNAL_KEY, j.slice(-JOURNAL_MAX));\n}\nasync function seen(key: string): Promise {\n const v = await blob.getJSON(key).catch(() => null);\n return v !== null && v !== undefined;\n}\nasync function getBlob(key: string): Promise {\n return (await blob.getJSON(key).catch(() => null)) as T | null;\n}\nasync function remember(key: string, val: unknown = true) {\n await blob.setJSON(key, val);\n}\n\nasync function sha256Hex(input: string): Promise {\n const data = new TextEncoder().encode(input.trim().toLowerCase());\n const buf = await crypto.subtle.digest(\"SHA-256\", data);\n return Array.from(new Uint8Array(buf)).map((b) =>\n b.toString(16).padStart(2, \"0\")\n ).join(\"\");\n}\n// US phone -> E.164 digits (prepend country code 1 for bare 10-digit numbers)\nfunction normPhone(phone: string): string {\n let d = phone.replace(/[^0-9]/g, \"\");\n if (d.length === 10) d = \"1\" + d;\n return d;\n}\n\n// v3.4 — resolve a Square customer_id -> {email, phone} via the Customers API. No-op without a token.\n// This is the POS path: a walk-in payment carries no buyer email/phone, only the customer the\n// register attached at checkout. Without this, every such payment logs NO-MATCH and its revenue\n// never reaches GHL.\nasync function fetchSquareCustomer(\n customerId: string,\n): Promise<{ email?: string; phone?: string }> {\n if (!SQUARE_ACCESS_TOKEN || !customerId) return {};\n try {\n const r = await fetch(\n `${SQUARE_API}/customers/${encodeURIComponent(customerId)}`,\n {\n headers: {\n Authorization: `Bearer ${SQUARE_ACCESS_TOKEN}`,\n \"Square-Version\": SQUARE_VERSION,\n },\n },\n );\n if (!r.ok) {\n await journal({ kind: \"SQ-CUST-ERR\", note: `status ${r.status}` });\n return {};\n }\n const d = await r.json().catch(() => ({}));\n const c = d?.customer ?? {};\n return {\n email: c.email_address || undefined,\n phone: c.phone_number || undefined,\n };\n } catch {\n await journal({ kind: \"SQ-CUST-ERR\", note: \"fetch failed\" });\n return {};\n }\n}\n\nasync function squareSigOk(\n rawBody: string,\n headerSig: string,\n): Promise {\n if (!headerSig || !SQUARE_SIGNATURE_KEY) return false;\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(SQUARE_SIGNATURE_KEY),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const mac = await crypto.subtle.sign(\n \"HMAC\",\n key,\n new TextEncoder().encode(NOTIFICATION_URL + rawBody),\n );\n const computed = btoa(String.fromCharCode(...new Uint8Array(mac)));\n return ctEq(computed, headerSig);\n}\n\n// M3 — send a Purchase event to the Facebook dataset. No-op if the token isn't set.\nasync function sendCapiPurchase(\n email: string | undefined,\n phone: string | undefined,\n amount: number,\n eventId: string,\n testEventCode?: string,\n): Promise {\n if (!FB_CAPI_TOKEN) {\n await journal({ kind: \"CAPI-SKIP\", note: \"no FB_CAPI_TOKEN\", eventId });\n return null;\n }\n try {\n const user_data: Record = {};\n if (email) user_data.em = [await sha256Hex(email)];\n if (phone) user_data.ph = [await sha256Hex(normPhone(phone))];\n if (!user_data.em && !user_data.ph) {\n await journal({ kind: \"CAPI-NO-PII\", eventId });\n return { error: \"no PII\" };\n }\n const payload: any = {\n data: [{\n event_name: \"Purchase\",\n event_time: Math.floor(Date.now() / 1000),\n action_source: \"other\",\n event_id: `purchase_${eventId}`,\n user_data,\n custom_data: { currency: \"USD\", value: Number(amount.toFixed(2)) },\n }],\n };\n if (testEventCode) payload.test_event_code = testEventCode;\n const r = await fetch(\n `https://graph.facebook.com/${FB_API_VERSION}/${FB_DATASET_ID}/events?access_token=${\n encodeURIComponent(FB_CAPI_TOKEN)\n }`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(payload),\n },\n );\n const d = await r.json().catch(() => ({}));\n // journal only safe fields (never the request URL / token)\n await journal({\n kind: r.ok ? \"CAPI-PURCHASE\" : \"CAPI-ERROR\",\n eventId,\n amount,\n test: !!testEventCode,\n resp: d?.events_received ?? d?.error?.message ?? \"unknown\",\n });\n return d;\n } catch (e) {\n await journal({ kind: \"CAPI-ERROR\", eventId, error: \"fetch failed\" });\n return { error: \"fetch failed\" };\n }\n}\n\n// GHL helpers — every call checks r.ok and THROWS on failure so the webhook returns 500 (Square retries).\nasync function ghlFindContact(\n email?: string,\n phone?: string,\n): Promise {\n for (const [param, val] of [[\"email\", email], [\"number\", phone]] as const) {\n if (!val) continue;\n const r = await fetch(\n `${GHL_BASE}/contacts/search/duplicate?locationId=${GHL_LOCATION_ID}&${param}=${\n encodeURIComponent(val)\n }`,\n { headers: GHL_HEADERS() },\n );\n if (r.ok) {\n const d = await r.json().catch(() => ({}));\n const id = d?.contact?.id ?? d?.id ?? null;\n if (id) return id;\n } else if (r.status >= 500 || r.status === 429 || r.status === 401) {\n throw new Error(`GHL find ${r.status}`);\n }\n }\n return null;\n}\n// v3.5 — every opp this contact has in the bridge pipeline, ANY stage. Needed to tell a\n// bridge-created opp from one of Kim's own before deciding to create.\nasync function ghlPipelineOpps(\n contactId: string,\n): Promise<{ id: string; name: string; stage: string; value: number }[]> {\n const r = await fetch(\n `${GHL_BASE}/opportunities/search?location_id=${GHL_LOCATION_ID}&contact_id=${contactId}&pipeline_id=${GHL_PIPELINE_ID}`,\n { headers: GHL_HEADERS() },\n );\n if (!r.ok) throw new Error(`GHL oppsearch ${r.status}`);\n const d = await r.json().catch(() => ({}));\n return (d?.opportunities ?? []).map((o: any) => ({\n id: o.id,\n name: o.name ?? \"\",\n stage: o.pipelineStageId ?? \"\",\n value: Number(o.monetaryValue ?? 0),\n }));\n}\n// only Won-Paid-stage opps (never touch a human's opp in another stage)\nasync function ghlWonPaidOpps(\n contactId: string,\n): Promise<{ id: string; value: number }[]> {\n const r = await fetch(\n `${GHL_BASE}/opportunities/search?location_id=${GHL_LOCATION_ID}&contact_id=${contactId}&pipeline_id=${GHL_PIPELINE_ID}`,\n { headers: GHL_HEADERS() },\n );\n if (!r.ok) throw new Error(`GHL oppsearch ${r.status}`);\n const d = await r.json().catch(() => ({}));\n // Won-Paid STAGE is bridge-exclusive, so filtering by stage finds existing bridge opps\n // (any name) while never touching a human's opp in another stage.\n return (d?.opportunities ?? [])\n .filter((o: any) => o.pipelineStageId === GHL_WON_PAID_STAGE_ID)\n .map((o: any) => ({ id: o.id, value: Number(o.monetaryValue ?? 0) }));\n}\n// v3.5 — returns {id} on success, {duplicate} when GHL refuses because the contact already owns\n// an opportunity, {err} otherwise. v3.3 threw a bare \"GHL createOpp 400\" that hid the reason.\nasync function ghlCreateOpp(\n contactId: string,\n value: number,\n): Promise<{ id?: string; duplicate?: string; err?: string }> {\n const r = await fetch(`${GHL_BASE}/opportunities/`, {\n method: \"POST\",\n headers: GHL_HEADERS(),\n body: JSON.stringify({\n pipelineId: GHL_PIPELINE_ID,\n locationId: GHL_LOCATION_ID,\n name: OPP_NAME,\n pipelineStageId: GHL_WON_PAID_STAGE_ID,\n status: \"won\",\n contactId,\n monetaryValue: value,\n }),\n });\n const d = await r.json().catch(() => ({}));\n if (!r.ok) {\n // \"Allow duplicate opportunity\" is OFF on this location: a contact may hold only one\n // opportunity. GHL hands back the existing id. This is the NORMAL case for any paying\n // customer who was a lead first -- it used to throw -> 500 -> Square retried forever.\n if (d?.code === \"OPPORTUNITY_NO_DUPLICATE\" && d?.meta?.existingId) {\n return { duplicate: d.meta.existingId };\n }\n return {\n err: `GHL createOpp ${r.status} ${JSON.stringify(d).slice(0, 200)}`,\n };\n }\n const id = d?.opportunity?.id ?? d?.id;\n return id ? { id } : { err: \"GHL createOpp no id\" };\n}\nasync function ghlSetOppValue(oppId: string, value: number) {\n const r = await fetch(`${GHL_BASE}/opportunities/${oppId}`, {\n method: \"PUT\",\n headers: GHL_HEADERS(),\n body: JSON.stringify({\n pipelineStageId: GHL_WON_PAID_STAGE_ID,\n status: \"won\",\n monetaryValue: value,\n }),\n });\n if (!r.ok) throw new Error(`GHL setOpp ${r.status}`);\n}\nasync function ghlDeleteOpp(oppId: string) {\n const r = await fetch(`${GHL_BASE}/opportunities/${oppId}`, {\n method: \"DELETE\",\n headers: GHL_HEADERS(),\n });\n if (!r.ok && r.status !== 404) throw new Error(`GHL delOpp ${r.status}`);\n}\nasync function ghlNote(contactId: string, body: string) {\n await fetch(`${GHL_BASE}/contacts/${contactId}/notes`, {\n method: \"POST\",\n headers: GHL_HEADERS(),\n body: JSON.stringify({ body }),\n });\n}\n\ntype Ledger = {\n payments: Record;\n refunds: Record;\n oppId: string | null;\n name?: string;\n};\nconst sum = (o: Record) =>\n Object.values(o).reduce((a, b) => a + b, 0);\n\nasync function reconcile(\n contactId: string,\n): Promise<{ oppId: string | null; value: number }> {\n const ledger = (await getBlob(LEDGER + contactId)) ??\n { payments: {}, refunds: {}, oppId: null };\n const value = Math.round((sum(ledger.payments) - sum(ledger.refunds)) * 100) /\n 100;\n const v = Math.max(0, value);\n const all = await ghlPipelineOpps(contactId);\n // ours = Won-Paid stage (bridge-exclusive by agreement) or carrying the bridge name marker\n const mine = all.filter((o) =>\n o.stage === GHL_WON_PAID_STAGE_ID || o.name === OPP_NAME\n );\n let keep = (ledger.oppId &&\n mine.find((o) => o.id === ledger.oppId)?.id) || mine[0]?.id || null;\n for (const o of mine) if (o.id !== keep) await ghlDeleteOpp(o.id);\n if (keep) {\n await ghlSetOppValue(keep, v);\n ledger.oppId = keep;\n await remember(LEDGER + contactId, ledger);\n return { oppId: keep, value: v };\n }\n\n const created = await ghlCreateOpp(contactId, v);\n if (created.id) {\n ledger.oppId = created.id;\n await remember(LEDGER + contactId, ledger);\n return { oppId: created.id, value: v };\n }\n if (created.err) throw new Error(created.err);\n\n // v3.5 — the contact already owns an opportunity the bridge did NOT create: a real lead or\n // customer record of Kim's. Do NOT hijack it and do NOT overwrite its monetaryValue -- that\n // number is her sale, not our Square balance. Book the revenue in the ledger + contact note +\n // journal and return cleanly so Square stops retrying the event.\n ledger.oppId = null;\n await remember(LEDGER + contactId, ledger);\n await journal({\n kind: \"REVENUE-ON-CLIENT-OPP\",\n contactId,\n amount: v,\n note: `existing opp ${created.duplicate} left untouched`,\n });\n return { oppId: null, value: v };\n}\nasync function addPayment(\n contactId: string,\n paymentId: string,\n amount: number,\n email?: string,\n phone?: string,\n) {\n if (!paymentId) {\n await journal({ kind: \"BAD-PAYMENT\", note: \"missing payment id\" });\n return;\n }\n const ledger = (await getBlob(LEDGER + contactId)) ??\n { payments: {}, refunds: {}, oppId: null };\n if (paymentId in ledger.payments && ledger.payments[paymentId] === amount) {\n await journal({ kind: \"PAY-DUP\", contactId, id: paymentId });\n await reconcile(contactId);\n return;\n }\n ledger.payments[paymentId] = amount; // also handles amount-changed updates\n await remember(LEDGER + contactId, ledger);\n await remember(PAY_CONTACT + paymentId, contactId);\n const { value } = await reconcile(contactId);\n await ghlNote(\n contactId,\n `[Square] +$${amount.toFixed(2)} payment ${paymentId} (balance $${\n value.toFixed(2)\n })`,\n );\n await journal({\n kind: \"PAYMENT\",\n contactId,\n amount,\n note: `payment ${paymentId}`,\n });\n await sendCapiPurchase(email, phone, amount, paymentId); // M3\n await applyPendingRefund(contactId, paymentId);\n}\nasync function addRefund(contactId: string, refundId: string, amount: number) {\n if (!refundId) {\n await journal({ kind: \"BAD-REFUND\" });\n return;\n }\n const ledger = (await getBlob(LEDGER + contactId)) ??\n { payments: {}, refunds: {}, oppId: null };\n if (refundId in ledger.refunds) {\n await journal({ kind: \"REFUND-DUP\", contactId, id: refundId });\n return;\n }\n ledger.refunds[refundId] = amount;\n await remember(LEDGER + contactId, ledger);\n const { value } = await reconcile(contactId);\n await ghlNote(\n contactId,\n `[Square] Refund -$${amount.toFixed(2)} ${refundId} (balance $${\n value.toFixed(2)\n })`,\n );\n await journal({\n kind: \"REFUND\",\n contactId,\n amount,\n note: `refund ${refundId}`,\n });\n}\n// apply a refund that arrived BEFORE its payment (stashed as pending), once the payment links a contact\nasync function applyPendingRefund(contactId: string, paymentId: string) {\n const pend = await getBlob<{ rid: string; amt: number }>(\n PENDING_REFUND + paymentId,\n );\n if (pend) {\n await blob.delete(PENDING_REFUND + paymentId);\n await journal({ kind: \"REFUND-PENDING-APPLIED\", contactId, id: pend.rid });\n await addRefund(contactId, pend.rid, pend.amt);\n }\n}\n// apply a payment that arrived BEFORE we could link a contact (e.g. POS/checkout payment with no email,\n// later linked by its invoice.payment_made). Books the real amount from the original payment event.\nasync function applyPendingPayment(\n contactId: string,\n paymentId: string,\n email?: string,\n phone?: string,\n) {\n const pend = await getBlob<{ amt: number; email?: string; phone?: string }>(\n PENDING_PAY + paymentId,\n );\n if (pend) {\n await blob.delete(PENDING_PAY + paymentId);\n await journal({\n kind: \"PENDING-PAY-APPLIED\",\n contactId,\n id: paymentId,\n amount: pend.amt,\n });\n // prefer the payment's own PII; fall back to the invoice recipient's so CAPI still gets identity\n await addPayment(\n contactId,\n paymentId,\n pend.amt,\n pend.email || email,\n pend.phone || phone,\n );\n }\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n // v3.8 — inbound heartbeat. Recorded BEFORE signature verification or parsing, so that\n // \"Square stopped delivering\" becomes distinguishable from \"Square delivered and we\n // discarded it\". Until now the journal only recorded events the code chose to act on,\n // which meant a disabled or expired webhook subscription was indistinguishable from a\n // genuinely quiet trading day — the failure mode was total silence with no alarm.\n if (req.method === \"POST\") {\n try {\n const prev = await blob.getJSON<{ n?: number }>(INBOUND_KEY).catch(() => null);\n await blob.setJSON(INBOUND_KEY, {\n ts: new Date().toISOString(),\n n: (prev?.n ?? 0) + 1,\n });\n } catch { /* never let bookkeeping break delivery */ }\n }\n\n // Health check (no data) — safe to be public\n if (req.method === \"GET\" && !url.search) {\n return new Response(\"M2/M3 bridge up (v3.8).\");\n }\n\n // Journal — now REQUIRES admin secret (was a public PII leak in earlier versions)\n if (req.method === \"GET\" && url.searchParams.get(\"dump\") === \"1\") {\n if (!adminOk(url.searchParams.get(\"admin\"))) {\n return new Response(\"forbidden\", { status: 403 });\n }\n return Response.json(\n (await blob.getJSON(JOURNAL_KEY).catch(() => null)) ?? [],\n );\n }\n // v3.10 (11 Aug 2026) — READ ONLY PAYMENT LOOKUP. Added so Kim's team can identify the 29\n // unmatched July payments. The journal only ever recorded amount and time; Square holds the\n // receipt, the card's last four and the line items. The token to ask Square is already in this\n // runtime and reachable from nowhere else, which is the only reason this route exists here.\n //\n // GET ?lookup=&admin=\n // It performs GET on Square's Payments and Orders APIs and nothing else. There is no write verb\n // in this branch, it touches no blob, and it journals nothing, so it cannot alter the bridge's\n // memory or Kim's data. Ninety ids per call is the cap, to keep one request bounded.\n if (req.method === \"GET\" && url.searchParams.get(\"lookup\")) {\n if (!adminOk(url.searchParams.get(\"admin\"))) {\n return new Response(\"forbidden\", { status: 403 });\n }\n if (!SQUARE_ACCESS_TOKEN) {\n return Response.json({ error: \"SQUARE_ACCESS_TOKEN not set in this runtime\" }, { status: 503 });\n }\n const ids = String(url.searchParams.get(\"lookup\")).split(\",\").map((x) => x.trim()).filter(Boolean).slice(0, 90);\n const sqGet = async (path: string) => {\n const r = await fetch(`${SQUARE_API}${path}`, {\n headers: { Authorization: `Bearer ${SQUARE_ACCESS_TOKEN}`, \"Square-Version\": SQUARE_VERSION },\n });\n if (!r.ok) return { _error: r.status } as any;\n return await r.json();\n };\n const out: any[] = [];\n for (const id of ids) {\n const pay = await sqGet(`/payments/${encodeURIComponent(id)}`);\n const p = pay?.payment ?? null;\n let order: any = null;\n if (p?.order_id) order = (await sqGet(`/orders/${encodeURIComponent(p.order_id)}`))?.order ?? null;\n out.push({\n id,\n error: pay?._error ?? null,\n created_at: p?.created_at ?? null,\n amount: p?.amount_money?.amount != null ? p.amount_money.amount / 100 : null,\n status: p?.status ?? null,\n source_type: p?.source_type ?? null,\n card_brand: p?.card_details?.card?.card_brand ?? null,\n last_4: p?.card_details?.card?.last_4 ?? null,\n cardholder_name: p?.card_details?.card?.cardholder_name ?? null,\n entry_method: p?.card_details?.entry_method ?? null,\n receipt_number: p?.receipt_number ?? null,\n receipt_url: p?.receipt_url ?? null,\n note: p?.note ?? null,\n customer_id: p?.customer_id ?? null,\n location_id: p?.location_id ?? null,\n device_name: p?.device_details?.device_name ?? null,\n team_member_id: p?.team_member_id ?? null,\n order_id: p?.order_id ?? null,\n line_items: (order?.line_items ?? []).map((li: any) => ({\n name: li?.name ?? null,\n quantity: li?.quantity ?? null,\n total: li?.total_money?.amount != null ? li.total_money.amount / 100 : null,\n variation: li?.variation_name ?? null,\n catalog_object_id: li?.catalog_object_id ?? null,\n })),\n order_customer_id: order?.customer_id ?? null,\n // v3.10a: resolve the Square customer too. Every one of the 29 unmatched July payments\n // carries a customer_id, so these buyers are NOT anonymous. Square knows who they are and\n // the bridge simply failed to carry it across. Read only, one GET per customer.\n square_customer: await (async () => {\n const cid = p?.customer_id ?? order?.customer_id ?? null;\n if (!cid) return null;\n const c = (await sqGet(`/customers/${encodeURIComponent(String(cid))}`))?.customer ?? null;\n if (!c) return null;\n return {\n given_name: c.given_name ?? null, family_name: c.family_name ?? null,\n email_address: c.email_address ?? null, phone_number: c.phone_number ?? null,\n company_name: c.company_name ?? null, nickname: c.nickname ?? null,\n reference_id: c.reference_id ?? null, note: c.note ?? null,\n created_at: c.created_at ?? null,\n };\n })(),\n fulfillments: (order?.fulfillments ?? []).map((f: any) => f?.pickup_details?.recipient ?? null).filter(Boolean),\n });\n }\n return Response.json({ asked: ids.length, results: out });\n }\n\n // v3.10b — READ ONLY CATALOG. Kim asked that payment links be built from the \"New Training\n // Prices\" category in Square and its Upgrades subcategory, because the product prices in her CRM\n // are stale. This lists the catalog so those prices can be read rather than retyped. GETs only.\n if (req.method === \"GET\" && url.searchParams.get(\"catalog\") === \"1\") {\n if (!adminOk(url.searchParams.get(\"admin\"))) return new Response(\"forbidden\", { status: 403 });\n if (!SQUARE_ACCESS_TOKEN) return Response.json({ error: \"no square token\" }, { status: 503 });\n const sqGet2 = async (path: string) => {\n const r = await fetch(`${SQUARE_API}${path}`, {\n headers: { Authorization: `Bearer ${SQUARE_ACCESS_TOKEN}`, \"Square-Version\": SQUARE_VERSION },\n });\n return r.ok ? await r.json() : { _error: r.status };\n };\n const cats = await sqGet2(\"/catalog/list?types=CATEGORY\");\n const items = await sqGet2(\"/catalog/list?types=ITEM\");\n const catName = new Map();\n for (const c of cats?.objects ?? []) catName.set(c.id, c?.category_data?.name ?? \"\");\n const out = (items?.objects ?? []).map((it: any) => ({\n item: it?.item_data?.name ?? null,\n category: catName.get(it?.item_data?.category_id ?? it?.item_data?.categories?.[0]?.id ?? \"\") ?? null,\n variations: (it?.item_data?.variations ?? []).map((v: any) => ({\n name: v?.item_variation_data?.name ?? null,\n price: v?.item_variation_data?.price_money?.amount != null ? v.item_variation_data.price_money.amount / 100 : null,\n })),\n }));\n return Response.json({ categories: [...catName.values()].filter(Boolean).sort(), items: out });\n }\n\n // v3.11 (12 Aug 2026) — READ ONLY PAYMENT HISTORY.\n // The CRM stopped recording payment amounts on 19 Feb 2026 and this bridge's own journal only\n // starts on 13 Jul 2026, so the 144 days between them are unmeasured. Square still holds them,\n // and the token that can ask Square is already in this runtime and reachable from nowhere else.\n // This route asks Square directly so nobody has to hand-export a CSV from the dashboard.\n //\n // GET ?history=..&admin=\n // optional &cursor= resume a walk this route reported as incomplete\n // optional &refunds=0 skip the refunds leg (it is on by default, first page only)\n // optional &location=all drop the location filter (default is the one live location)\n //\n // READ ONLY, and provably so: the only network calls in this branch are GET on Square's\n // /v2/payments and /v2/refunds list endpoints. It never calls journal(), never touches blob\n // (no read, no write), never calls GoHighLevel, creates nothing, and contains no HTTP verb\n // other than GET. It is fail-closed behind the same constant-time adminOk() guard as ?dump,\n // ?lookup and ?catalog. A missing or malformed range is refused with a 400 rather than being\n // treated as \"give me everything\", and the span is capped so one call cannot walk years.\n if (req.method === \"GET\" && url.searchParams.has(\"history\")) {\n if (!adminOk(url.searchParams.get(\"admin\"))) {\n return new Response(\"forbidden\", { status: 403 });\n }\n if (!SQUARE_ACCESS_TOKEN) {\n return Response.json({ error: \"SQUARE_ACCESS_TOKEN not set in this runtime\" }, { status: 503 });\n }\n // --- range guard. Nothing below runs until the range is two real dates in the right order. ---\n const rangeRaw = String(url.searchParams.get(\"history\") ?? \"\").trim();\n const ends = rangeRaw.split(\"..\");\n if (ends.length !== 2 || !ends[0].trim() || !ends[1].trim()) {\n return Response.json({\n error: \"range required, as ?history=..\",\n example: \"?history=2026-02-19T05:00:00Z..2026-07-13T04:00:00Z&admin=\",\n got: rangeRaw,\n }, { status: 400 });\n }\n const beginD = new Date(ends[0].trim());\n const endD = new Date(ends[1].trim());\n if (isNaN(beginD.getTime()) || isNaN(endD.getTime())) {\n return Response.json({\n error: \"both ends of the range must parse as ISO 8601\",\n begin: ends[0].trim(), end: ends[1].trim(),\n }, { status: 400 });\n }\n if (beginD.getTime() >= endD.getTime()) {\n return Response.json({ error: \"start must be strictly before end\", begin: beginD.toISOString(), end: endD.toISOString() }, { status: 400 });\n }\n const SPAN_MAX_DAYS = 400; // Square serves about a year; refuse anything that pretends to want more\n const spanDays = (endD.getTime() - beginD.getTime()) / 86_400_000;\n if (spanDays > SPAN_MAX_DAYS) {\n return Response.json({ error: `range too wide: ${Math.round(spanDays)} days, cap is ${SPAN_MAX_DAYS}` }, { status: 400 });\n }\n const begin_time = beginD.toISOString();\n const end_time = endD.toISOString();\n const locParam = (url.searchParams.get(\"location\") ?? \"\").trim();\n const locationId = locParam === \"all\" ? \"\" : (locParam || SQUARE_LOCATION_ID);\n\n const sqGet3 = async (path: string) => {\n const r = await fetch(`${SQUARE_API}${path}`, {\n headers: { Authorization: `Bearer ${SQUARE_ACCESS_TOKEN}`, \"Square-Version\": SQUARE_VERSION },\n });\n if (!r.ok) return { _error: r.status, _body: (await r.text()).slice(0, 600) } as any;\n return await r.json();\n };\n\n // --- payments walk. Stop condition is Square withholding a cursor, never an empty page:\n // a page with zero rows and a cursor still has more behind it. ---\n const PAGE_MAX = 40; // 40 x 100 = 4,000 payments in one request\n const TIME_BUDGET_MS = 25_000; // leave room to answer before the platform gives up on us\n const started = Date.now();\n const payments: any[] = [];\n let cursor = (url.searchParams.get(\"cursor\") ?? \"\").trim();\n let pages = 0;\n let apiError: any = null;\n let emptyPages = 0;\n while (pages < PAGE_MAX) {\n const q = new URLSearchParams({ begin_time, end_time, sort_order: \"ASC\", limit: \"100\" });\n if (locationId) q.set(\"location_id\", locationId);\n if (cursor) q.set(\"cursor\", cursor);\n const d = await sqGet3(`/payments?${q.toString()}`);\n pages++;\n if (d?._error) { apiError = { status: d._error, body: d._body ?? null, at_page: pages }; break; }\n const batch = d?.payments ?? [];\n if (!batch.length) emptyPages++;\n for (const p of batch) {\n payments.push({\n id: p?.id ?? null,\n created_at: p?.created_at ?? null,\n amount: p?.amount_money?.amount != null ? p.amount_money.amount / 100 : null,\n amount_cents: p?.amount_money?.amount ?? 0,\n tip_cents: p?.tip_money?.amount ?? 0,\n total_cents: p?.total_money?.amount ?? 0,\n refunded_cents: p?.refunded_money?.amount ?? 0,\n fee_cents: (p?.processing_fee ?? []).reduce((s: number, f: any) => s + (f?.amount_money?.amount ?? 0), 0),\n currency: p?.amount_money?.currency ?? null,\n status: p?.status ?? null,\n source_type: p?.source_type ?? null,\n card_brand: p?.card_details?.card?.card_brand ?? null,\n last_4: p?.card_details?.card?.last_4 ?? null,\n entry_method: p?.card_details?.entry_method ?? null,\n customer_id: p?.customer_id ?? null,\n order_id: p?.order_id ?? null,\n location_id: p?.location_id ?? null,\n receipt_number: p?.receipt_number ?? null,\n note: p?.note ?? null,\n });\n }\n cursor = d?.cursor ?? \"\";\n if (!cursor) break;\n if (Date.now() - started > TIME_BUDGET_MS) break;\n }\n\n // --- refunds walk, same window. Two views of a refund are useful and they are not the same\n // view: refunded_cents on a payment attributes the money back to the month of the SALE, this\n // list attributes it to the month the refund was ISSUED. Only on the first request of a walk. ---\n const wantRefunds = url.searchParams.get(\"refunds\") !== \"0\" && !(url.searchParams.get(\"cursor\") ?? \"\").trim();\n const refunds: any[] = [];\n let refundPages = 0;\n let refundCursor = \"\";\n let refundError: any = null;\n if (wantRefunds) {\n while (refundPages < 20) {\n const q = new URLSearchParams({ begin_time, end_time, sort_order: \"ASC\", limit: \"100\" });\n if (locationId) q.set(\"location_id\", locationId);\n if (refundCursor) q.set(\"cursor\", refundCursor);\n const d = await sqGet3(`/refunds?${q.toString()}`);\n refundPages++;\n if (d?._error) { refundError = { status: d._error, body: d._body ?? null, at_page: refundPages }; break; }\n for (const rf of d?.refunds ?? []) {\n refunds.push({\n id: rf?.id ?? null,\n created_at: rf?.created_at ?? null,\n amount: rf?.amount_money?.amount != null ? rf.amount_money.amount / 100 : null,\n amount_cents: rf?.amount_money?.amount ?? 0,\n status: rf?.status ?? null,\n payment_id: rf?.payment_id ?? null,\n order_id: rf?.order_id ?? null,\n reason: rf?.reason ?? null,\n location_id: rf?.location_id ?? null,\n });\n }\n refundCursor = d?.cursor ?? \"\";\n if (!refundCursor) break;\n }\n }\n\n // --- summary. Gross is total_money (what the customer actually paid, tip included); amount\n // and tip are also given separately so nobody has to guess which one a number is. ---\n const sum = (arr: any[], k: string) => arr.reduce((s: number, r: any) => s + (r[k] ?? 0), 0);\n const done = payments.filter((p) => p.status === \"COMPLETED\");\n const byStatus: Record = {};\n for (const p of payments) byStatus[p.status ?? \"null\"] = (byStatus[p.status ?? \"null\"] ?? 0) + 1;\n const by_month_utc: Record = {};\n for (const p of done) {\n const m = String(p.created_at ?? \"\").slice(0, 7) || \"unknown\";\n const b = by_month_utc[m] ?? (by_month_utc[m] = { payments: 0, gross_cents: 0, refunded_cents: 0, net_cents: 0 });\n b.payments++;\n b.gross_cents += p.total_cents;\n b.refunded_cents += p.refunded_cents;\n b.net_cents = b.gross_cents - b.refunded_cents;\n }\n return Response.json({\n route: \"history\",\n read_only: true,\n version: \"3.11\",\n query: {\n endpoint: `${SQUARE_API}/payments`,\n begin_time,\n end_time,\n sort_order: \"ASC\",\n location_id: locationId || \"(all locations)\",\n limit: 100,\n },\n pages,\n empty_pages: emptyPages,\n complete: !cursor && !apiError,\n next_cursor: cursor || null,\n square_error: apiError,\n count: payments.length,\n summary: {\n completed: done.length,\n not_completed: payments.length - done.length,\n by_status: byStatus,\n completed_amount_cents: sum(done, \"amount_cents\"),\n completed_tip_cents: sum(done, \"tip_cents\"),\n completed_gross_cents: sum(done, \"total_cents\"),\n completed_refunded_cents: sum(done, \"refunded_cents\"),\n completed_net_cents: sum(done, \"total_cents\") - sum(done, \"refunded_cents\"),\n completed_fee_cents: sum(done, \"fee_cents\"),\n },\n by_month_utc,\n refunds: { requested: wantRefunds, pages: refundPages, count: refunds.length, error: refundError, total_cents: sum(refunds, \"amount_cents\"), rows: refunds },\n payments,\n });\n }\n\n // v3.5 — env presence check (admin, booleans only, never values). Answers \"is the POS path armed?\"\n if (req.method === \"GET\" && url.searchParams.get(\"envcheck\") === \"1\") {\n if (!adminOk(url.searchParams.get(\"admin\"))) {\n return new Response(\"forbidden\", { status: 403 });\n }\n return Response.json({\n version: \"3.9\",\n SQUARE_SIGNATURE_KEY: !!SQUARE_SIGNATURE_KEY,\n SQUARE_ACCESS_TOKEN: !!SQUARE_ACCESS_TOKEN,\n GHL_TOKEN: !!GHL_TOKEN,\n lastInbound: (await blob.getJSON(INBOUND_KEY).catch(() => null)) ?? \"never\",\n ADMIN_SECRET_dedicated: !!ADMIN_SECRET_DEDICATED,\n destructive_routes_enabled: !!ADMIN_SECRET_DEDICATED,\n FB_CAPI_TOKEN: !!FB_CAPI_TOKEN,\n });\n }\n // CAPI self-test (admin) — fires one Purchase; use &code= to keep it in Test Events\n if (req.method === \"GET\" && url.searchParams.has(\"captest\")) {\n if (!adminStrictOk(url.searchParams.get(\"captest\"))) {\n return new Response(\"forbidden: ?captest requires a dedicated ADMIN_SECRET\", { status: 403 });\n }\n const code = url.searchParams.get(\"code\") || undefined;\n const resp = await sendCapiPurchase(\n \"captest@thedogsspotga.com\",\n \"+19125550123\",\n 1.00,\n \"captest_\" + Date.now(),\n code,\n );\n return Response.json({\n sent: true,\n hasToken: !!FB_CAPI_TOKEN,\n dataset: FB_DATASET_ID,\n testEventCode: code ?? null,\n meta: resp,\n });\n }\n // Wipe (admin) — POST only, fail-closed\n if (req.method === \"POST\" && url.searchParams.get(\"wipe\") === \"1\") {\n if (!adminStrictOk(url.searchParams.get(\"admin\"))) {\n return new Response(\"forbidden: ?wipe requires a dedicated ADMIN_SECRET\", { status: 403 });\n }\n const keys = await blob.list(\"m2_\");\n let n = 0;\n for (const k of keys) {\n await blob.delete((k as any).key);\n n++;\n }\n return new Response(\"wiped \" + n);\n }\n if (req.method !== \"POST\") return new Response(\"M2/M3 bridge up (v3.7).\");\n\n const raw = await req.text();\n const sig = req.headers.get(\"x-square-hmacsha256-signature\") ?? \"\";\n if (!(await squareSigOk(raw, sig))) {\n await journal({ kind: \"BAD-SIG\" });\n return new Response(\"bad sig\", { status: 401 });\n }\n\n let evt: any;\n try {\n evt = JSON.parse(raw);\n } catch {\n return new Response(\"bad json\", { status: 400 });\n }\n const eventId = evt?.event_id;\n if (eventId && await seen(DEDUP_EVENT + eventId)) {\n await journal({ kind: \"DUPLICATE-SKIP\" });\n return new Response(\"dup\");\n }\n\n const type = evt?.type as string;\n const obj = evt?.data?.object ?? {};\n try {\n if (type === \"payment.updated\" || type === \"payment.created\") {\n const p = obj.payment ?? {};\n if (p.status === \"COMPLETED\") {\n const amt = (p.amount_money?.amount ?? 0) / 100;\n let email = p.buyer_email_address || undefined;\n let phone = p.buyer_phone_number || undefined; // usually absent on POS, defensive\n // 1) match by email OR phone; 2) else use the contact an invoice already linked to this payment id\n let cid = await ghlFindContact(email, phone);\n if (!cid) cid = await getBlob(PAY_CONTACT + p.id);\n // 3) v3.4/v3.5 — POS: the register attached a customer at checkout but the payment object\n // carries no email/phone. Resolve the Square customer, then match the GHL contact.\n if (!cid && p.customer_id && SQUARE_ACCESS_TOKEN) {\n const sc = await fetchSquareCustomer(p.customer_id);\n email = email || sc.email;\n phone = phone || sc.phone;\n if (sc.email || sc.phone) cid = await ghlFindContact(sc.email, sc.phone);\n }\n if (cid) await addPayment(cid, p.id, amt, email, phone);\n else {\n // hold the amount so invoice.payment_made can book it the moment it supplies a contact\n await remember(PENDING_PAY + p.id, { amt, email, phone });\n await journal({\n kind: \"NO-MATCH\",\n note: `payment ${p.id}`,\n amount: amt,\n hadEmail: !!email,\n hadPhone: !!phone,\n hadCustomerId: !!p.customer_id,\n sqTokenSet: !!SQUARE_ACCESS_TOKEN,\n });\n }\n }\n } else if (type === \"invoice.payment_made\") {\n const inv = obj.invoice ?? {};\n const r = inv.primary_recipient ?? {};\n const email = r.email_address || undefined;\n const phone = r.phone_number || undefined;\n const payId = obj?.payment?.id;\n const cid = await ghlFindContact(email, phone);\n if (cid) {\n if (payId) {\n await remember(PAY_CONTACT + payId, cid);\n await applyPendingRefund(cid, payId);\n await applyPendingPayment(cid, payId, email, phone); // books the payment amount if it already arrived\n }\n await reconcile(cid);\n await journal({\n kind: \"INVOICE-LINKED\",\n note: `invoice ${inv.id}`,\n contactId: cid,\n });\n } else {\n // no contact to book to — the payment stays on the review list (rich NO-MATCH)\n await journal({\n kind: \"NO-MATCH\",\n note: `invoice ${inv.id}`,\n hadEmail: !!email,\n hadPhone: !!phone,\n });\n }\n } else if (type === \"invoice.refunded\") {\n const inv = obj.invoice ?? {};\n const r = inv.primary_recipient ?? {};\n const cid = await ghlFindContact(r.email_address, r.phone_number);\n const amt = (obj?.refund?.amount_money?.amount ?? 0) / 100;\n const rid = obj?.refund?.id ?? `inv-${inv.id}`;\n if (cid) await addRefund(cid, rid, amt);\n else {await journal({\n kind: \"REFUND-NO-MATCH\",\n note: `invoice-refund ${inv.id}`,\n });}\n } else if (type === \"refund.updated\" || type === \"refund.created\") {\n const rf = obj.refund ?? {};\n if (rf.status === \"COMPLETED\") {\n const cid = rf.payment_id\n ? await getBlob(PAY_CONTACT + rf.payment_id)\n : null;\n const amt = (rf.amount_money?.amount ?? 0) / 100;\n if (cid) await addRefund(cid, rf.id, amt);\n else {\n await remember(PENDING_REFUND + (rf.payment_id ?? rf.id), {\n rid: rf.id,\n amt,\n });\n await journal({\n kind: \"REFUND-PENDING\",\n amount: amt,\n note: `refund ${rf.id}`,\n });\n }\n }\n } else {\n await journal({ kind: \"IGNORED\", type });\n }\n } catch (e) {\n await journal({ kind: \"ERROR\", type, error: String(e).slice(0, 120) });\n return new Response(\"retry\", { status: 500 }); // Square will retry; event NOT marked seen\n }\n\n if (eventId) await remember(DEDUP_EVENT + eventId); // mark seen only after success\n return new Response(\"EVENT_RECEIVED\");\n}","createdAt",["D",1786563099562],"branchVersion","branchId","519c4181-5961-4e23-998f-34eb9ca0fd9b","id","29b95261-feff-47f1-9a81-1efec1642b61","dogsspot_m2_bridge",["D",1783881672579],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","d26e64e6-cd39-4be1-b5b4-1de11cc555f8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f56fd-bd59-724f-8163-80ffcf8235dd","tursoName","29b95261feff47f19a811efec1642b61","tursoHostname","29b95261feff47f19a811efec1642b61-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789516253896],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_97":96,"_105":101},"org",{"_97":96,"_98":99,"_100":101,"_18":55,"_102":103,"_104":25},"branch",{"_13":14,"_32":87,"_43":42,"_88":44,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":45,"_95":96},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","amir5","handle","displayName","Amir","avatar","https://lh3.googleusercontent.com/a/ACg8ocILk3bwhcvrzozUWm7gxlKoBm7ZGtsgIkesW3ysOOsJ1rSQuA=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":153,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":154,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":155,"_82":156,"_84":157,"_86":25},"tree",[148],"files",[148],"counts",{"_136":61,"_137":138,"_139":61,"_140":141,"_142":143},"contents",[128],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":129,"_32":28,"_30":31,"_130":-5,"_41":42,"_40":14,"_131":123,"_38":132,"_13":133,"_33":34,"_35":37,"_24":25,"_134":-5,"_27":135},"7a46c170-3420-4c05-bd6a-f8e16c21099c","parentId","latest",["D",1786563099562],23,"label",[28],"pulls","branches",1,"forks","envVars",{"_144":146,"_147":61},"connections",{"_144":61,"_145":61},"count","unfilledCount",5,"emptyCount",{"_43":129,"_32":28,"_30":31,"_130":-5,"_41":42,"_40":14,"_131":123,"_38":149,"_13":133,"_33":34,"_35":37,"_24":25,"_134":-5,"_150":151,"_27":152},["D",1786563099562],"children",[],[28],["D",1783881672579],["D",1789516253896],{"_97":96,"_105":101},{"_97":96,"_98":99,"_100":101,"_18":55,"_102":103,"_104":25},{"_13":14,"_32":87,"_43":42,"_88":44,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":45,"_95":96},"ctx",{"_80":-5,"_125":191,"_192":193,"_194":195,"_196":25,"_197":25,"_198":25,"_199":123,"_200":-5,"_201":-7,"_202":-7,"_203":61,"_204":25,"_205":25,"_206":-5,"_207":25,"_208":25,"_209":25,"_210":-5},"ENV",{"_162":163,"_164":165,"_166":87,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v24