`, favicon, and body of `Root()` to\nmatch your app's existing `index.html`, and stamp anything else your shell\nreferences directly (images, css) with `immutableFileUrl()`.\n\n1. Create `frontend/root.tsx`:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>React Hono Val Town Starter

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_270":271,"_272":273},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_202":-5,"_20":203,"_22":204,"_205":206,"_207":208,"_26":209,"_24":210,"_211":-5,"_212":-5,"_213":60,"_214":215,"_216":57,"_217":-5,"_218":-5,"_219":220},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","gerardroy","name","parkave-clinic-backend","branchName","main","version","path","warm.ts","project",{"_33":144,"_13":14,"_45":145,"_146":-5,"_147":60,"_148":149,"_150":149,"_151":152,"_153":-5,"_154":155,"_156":66,"_157":57,"_158":-5,"_159":-5,"_160":43,"_161":162,"_163":164,"_165":166,"_167":168,"_169":-5,"_170":171,"_172":171,"_173":174,"_175":174,"_176":174,"_177":171,"_178":171,"_179":180,"_181":182,"_183":184,"_185":60},"tree",[51,52,53,54,55],"file",{"_33":34,"_35":36,"_37":38,"_13":19,"_39":40,"_41":42,"_17":43,"_44":-5,"_45":46,"_47":48,"_49":-5,"_18":50},"contents",[],"upstream","pull","ahead","behind","envVars","id","7703f30f-bf2b-4a7f-b164-5ed9cc36807c","branchId","62138252-5ca6-4385-8bb0-fa358d8b5ae2","fileId","b3543ebe-b192-11f1-8fc8-1607ee4eb77e","content","/**\n * Keep-warm cron. Val Town isolates go cold after idle, and the first tool call on a\n * demo then pays the start-up cost on top of the round trip. This pings the HTTP val's\n * lightest routes on a schedule so the isolate, the module graph and the seeded data\n * are already resident when a real call arrives.\n *\n * Schedule is set on the file (interval settings); every 5 minutes is enough on\n * Val Town's current idle window. Pair it with warm.sh right before a demo for the\n * belt-and-braces version.\n */\nconst BASE = \"https://gerardroy--01a0a371d2207530921c233c3ba43b0c.web.val.run\";\n\nexport default async function (interval: Interval) {\n const t0 = Date.now();\n const results: Record = {};\n // /warm touches the module; one real tool round trip exercises the adapter path too.\n const r1 = await fetch(`${BASE}/warm`);\n results.warm = r1.status;\n const r2 = await fetch(`${BASE}/vapi`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ message: { toolCallList: [\n { id: \"warm\", function: { name: \"find_slots\", arguments: \"{}\" } } ] } }),\n });\n results.vapi = r2.status;\n results.ms = Date.now() - t0;\n console.log(\"keep-warm\", JSON.stringify(results));\n}\n","fileType","interval",0,"parentId","createdAt",["D",1789537905685],"branchVersion",11,"label",[19],{"_33":89,"_13":90,"_37":91,"_44":-5,"_35":36,"_47":77,"_56":57,"_45":92,"_17":43,"_41":93,"_39":-5,"_59":60,"_49":-5,"_61":94,"_18":95},{"_33":82,"_13":83,"_37":84,"_44":-5,"_35":36,"_47":77,"_56":57,"_45":85,"_17":43,"_41":24,"_39":86,"_59":60,"_49":-5,"_61":87,"_18":88},{"_33":74,"_13":75,"_37":76,"_44":-5,"_35":36,"_47":77,"_56":57,"_45":78,"_17":43,"_41":24,"_39":79,"_59":60,"_49":-5,"_61":80,"_18":81},{"_33":64,"_13":65,"_37":66,"_44":-5,"_35":36,"_47":67,"_56":57,"_45":68,"_17":69,"_41":70,"_39":71,"_59":60,"_49":-5,"_61":72,"_18":73},{"_33":34,"_13":19,"_37":38,"_44":-5,"_35":36,"_47":48,"_56":57,"_45":58,"_17":43,"_41":42,"_39":40,"_59":60,"_49":-5,"_61":62,"_18":63},"latest",true,["D",1789537905685],"deleted",false,"children",[],[19],"66fbfa94-7105-49b6-9ce9-9b819ca33b0e","index.ts","01a0a371-d220-7530-921c-233c3ba43b0c",23,["D",1789544213835],21,"http","/**\n * Mock clinic EHR/PM backend for the Vapi patient-access voice agent.\n *\n * Seeded to mirror the demo data observed on Phreesia's public VoiceAI demo line\n * (+1 929-255-3132, \"Park Avenue Clinic\") across 13 research calls on 2026-09-14,\n * so the two agents can be demoed against the same facts.\n *\n * The point of this backend is the finding from those calls: Phreesia's demo\n * resolves ONLY scheduling. Billing, test results, records, referrals, prior\n * auth and appointment lookup all collapse to \"I can take a message.\"\n * Every endpoint here RESOLVES instead of deferring.\n *\n * Every response carries an `instruction` field written for the model, not the\n * caller. The agent is told (in its prompt) never to read those aloud.\n */\nimport { Hono } from \"npm:hono\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst app = new Hono();\napp.onError((err) => Promise.reject(err));\n\n// ---------------------------------------------------------------- seed data\nconst LOCATIONS = [\n { id: \"downtown\", name: \"Downtown office\", address: \"1010 Main Street, Chicago, Illinois 60601\" },\n { id: \"northside\", name: \"North Side Clinic\", address: \"3498 Jefferson Street, Chicago, Illinois 60614\" },\n { id: \"westloop\", name: \"West Loop Center\", address: \"200 Lake Street, Chicago, Illinois 60661\" },\n];\n\nconst PROVIDERS = [\n { id: \"covington\", name: \"Doctor Josh Covington\", specialty: \"Internal medicine\", acceptingNew: true, locations: [\"downtown\", \"westloop\"] },\n { id: \"cunningham\", name: \"Doctor Jason Cunningham\", specialty: \"Family medicine\", acceptingNew: false, locations: [\"downtown\"] },\n { id: \"hart\", name: \"Doctor Amelia Hart\", specialty: \"Family medicine\", acceptingNew: true, locations: [\"downtown\", \"northside\"] },\n];\n\n// One seeded patient. dob is the verification factor.\nconst PATIENTS: Record = {\n \"jordan-avery\": {\n patientId: \"jordan-avery\",\n firstName: \"Jordan\", lastName: \"Avery\",\n dob: \"1980-01-12\",\n phone: \"+13125550142\",\n usualProvider: \"covington\",\n usualLocation: \"downtown\",\n balanceCents: 4285,\n balanceDetail: \"Office visit on August 3rd 2026, after insurance. Patient responsibility toward deductible.\",\n insurance: { payer: \"Blue Cross Blue Shield PPO\", memberId: \"XZG884210277\", deductibleMetCents: 61500, deductibleTotalCents: 150000, copayCents: 3000 },\n appointments: [\n { id: \"apt-8841\", when: \"2026-09-22T14:30:00-05:00\", spoken: \"Tuesday September 22nd at 2:30 in the afternoon\",\n providerId: \"covington\", locationId: \"downtown\", type: \"Follow-up visit\", status: \"scheduled\" },\n ],\n medications: [\n { name: \"lisinopril\", strength: \"10 mg\", sig: \"once daily\", refillsLeft: 2, prescriberId: \"covington\",\n pharmacy: \"CVS on Main Street, Chicago\", lastFilled: \"2026-08-14\", controlled: false },\n { name: \"atorvastatin\", strength: \"20 mg\", sig: \"once daily at bedtime\", refillsLeft: 0, prescriberId: \"covington\",\n pharmacy: \"CVS on Main Street, Chicago\", lastFilled: \"2026-06-02\", controlled: false },\n ],\n results: [\n { id: \"lab-3321\", panel: \"Lipid panel\", collected: \"2026-09-08\", status: \"ready_released\",\n releasedToPatient: true, summary: \"Reviewed by Doctor Covington and released. No action needed.\", abnormal: false },\n { id: \"lab-3322\", panel: \"Basic metabolic panel\", collected: \"2026-09-11\", status: \"pending_provider_review\",\n releasedToPatient: false, summary: null, abnormal: null },\n ],\n referrals: [\n { id: \"ref-114\", specialty: \"Orthopedics\", status: \"authorized\", authNumber: \"A-77213\",\n note: \"Authorized through December 31st 2026. Six visits.\" },\n ],\n priorAuths: [\n { id: \"pa-556\", medication: \"atorvastatin 20 mg\", status: \"approved\", decidedOn: \"2026-08-20\" },\n { id: \"pa-557\", medication: \"semaglutide\", status: \"pending_payer\", submittedOn: \"2026-09-05\",\n note: \"Submitted to Blue Cross on September 5th. Payer decision typically ten to fourteen business days.\" },\n ],\n },\n};\n\n// Slots the scheduler can offer. Kept small and deterministic for demos.\nconst SLOTS = [\n { id: \"s1\", spoken: \"Tuesday September 15th at 1 in the afternoon\", iso: \"2026-09-15T13:00:00-05:00\", providerId: \"covington\", locationId: \"downtown\", partOfDay: \"afternoon\" },\n { id: \"s2\", spoken: \"Tuesday September 15th at 3:30 in the afternoon\", iso: \"2026-09-15T15:30:00-05:00\", providerId: \"hart\", locationId: \"downtown\", partOfDay: \"afternoon\" },\n { id: \"s3\", spoken: \"Wednesday September 16th at 9:15 in the morning\", iso: \"2026-09-16T09:15:00-05:00\", providerId: \"covington\", locationId: \"downtown\", partOfDay: \"morning\" },\n { id: \"s4\", spoken: \"Wednesday September 16th at 1 in the afternoon\", iso: \"2026-09-16T13:00:00-05:00\", providerId: \"covington\", locationId: \"downtown\", partOfDay: \"afternoon\" },\n { id: \"s5\", spoken: \"Thursday September 17th at 8:30 in the morning\", iso: \"2026-09-17T08:30:00-05:00\", providerId: \"hart\", locationId: \"northside\", partOfDay: \"morning\" },\n { id: \"s6\", spoken: \"Thursday September 17th at 5:45 in the evening\", iso: \"2026-09-17T17:45:00-05:00\", providerId: \"hart\", locationId: \"downtown\", partOfDay: \"evening\" },\n // Deeper bench so the v2 reserve survives two or three refusals without a re-query.\n { id: \"s7\", spoken: \"Thursday September 17th at 2 in the afternoon\", iso: \"2026-09-17T14:00:00-05:00\", providerId: \"covington\", locationId: \"downtown\", partOfDay: \"afternoon\" },\n { id: \"s8\", spoken: \"Friday September 18th at 9 in the morning\", iso: \"2026-09-18T09:00:00-05:00\", providerId: \"covington\", locationId: \"downtown\", partOfDay: \"morning\" },\n { id: \"s9\", spoken: \"Friday September 18th at 3 in the afternoon\", iso: \"2026-09-18T15:00:00-05:00\", providerId: \"hart\", locationId: \"westloop\", partOfDay: \"afternoon\" },\n { id: \"s10\", spoken: \"Friday September 18th at 6 in the evening\", iso: \"2026-09-18T18:00:00-05:00\", providerId: \"cunningham\", locationId: \"downtown\", partOfDay: \"evening\" },\n { id: \"s11\", spoken: \"Monday September 21st at 8 in the morning\", iso: \"2026-09-21T08:00:00-05:00\", providerId: \"hart\", locationId: \"northside\", partOfDay: \"morning\" },\n { id: \"s12\", spoken: \"Monday September 21st at 4:15 in the afternoon\", iso: \"2026-09-21T16:15:00-05:00\", providerId: \"covington\", locationId: \"downtown\", partOfDay: \"afternoon\" },\n { id: \"s13\", spoken: \"Tuesday September 22nd at 11 in the morning\", iso: \"2026-09-22T11:00:00-05:00\", providerId: \"cunningham\", locationId: \"downtown\", partOfDay: \"morning\" },\n { id: \"s14\", spoken: \"Wednesday September 23rd at 5:30 in the evening\", iso: \"2026-09-23T17:30:00-05:00\", providerId: \"hart\", locationId: \"downtown\", partOfDay: \"evening\" },\n];\n\nconst writes: any[] = []; // audit of everything the agent changed\nconst providerName = (id: string) => PROVIDERS.find(p => p.id === id)?.name ?? \"the provider\";\nconst locationName = (id: string) => LOCATIONS.find(l => l.id === id)?.address ?? \"the clinic\";\n/**\n * Money is returned already spoken, never as \"$42.85\".\n *\n * A written amount has to survive the model, the chunker and the TTS, and it loses\n * somewhere on most of those paths: the decimal point splits the sentence mid-amount,\n * and a formatPlan regex doing the conversion silently turned $42.85 into \"$42.80\" in\n * a voice test. This is the one place in the pipeline that is deterministic, so the\n * conversion happens here and nothing downstream has to be trusted with it.\n */\nconst ONES = [\"zero\",\"one\",\"two\",\"three\",\"four\",\"five\",\"six\",\"seven\",\"eight\",\"nine\",\"ten\",\n \"eleven\",\"twelve\",\"thirteen\",\"fourteen\",\"fifteen\",\"sixteen\",\"seventeen\",\"eighteen\",\"nineteen\"];\nconst TENS = [\"\",\"\",\"twenty\",\"thirty\",\"forty\",\"fifty\",\"sixty\",\"seventy\",\"eighty\",\"ninety\"];\nfunction words(n: number): string {\n if (n < 20) return ONES[n];\n if (n < 100) return TENS[Math.floor(n / 10)] + (n % 10 ? \" \" + ONES[n % 10] : \"\");\n if (n < 1000) return ONES[Math.floor(n / 100)] + \" hundred\" + (n % 100 ? \" \" + words(n % 100) : \"\");\n return words(Math.floor(n / 1000)) + \" thousand\" + (n % 1000 ? \" \" + words(n % 1000) : \"\");\n}\nconst money = (c: number) => {\n const d = Math.floor(c / 100), cents = c % 100;\n const dollars = `${words(d)} dollar${d === 1 ? \"\" : \"s\"}`;\n return cents ? `${dollars} and ${words(cents)} cent${cents === 1 ? \"\" : \"s\"}` : dollars;\n};\n\n/**\n * Calls that have passed text-code (OTP) verification, keyed by Vapi call id.\n * A verified call's tools skip the spoken date-of-birth check. In-memory on purpose:\n * it is scoped to one live call and dies with the isolate.\n */\n/**\n * Per-call state (verified flag, pending text code, wrong-DOB strikes, booking idempotency)\n * lives in Val Town blob storage, not module memory. Module memory dies on every redeploy\n * (the warm cron included) and is not guaranteed to be the same isolate between two\n * requests, either of which would silently un-verify a caller mid-call. Entries are small,\n * keyed by call id, and expire by timestamp.\n */\nconst STATE_TTL_MS = 30 * 60 * 1000;\nconst skey = (ns: string, id: string) => `pac:${ns}:${id}`;\nasync function stGet(ns: string, id: string): Promise {\n if (!id) return undefined;\n const v = (await blob.getJSON(skey(ns, id))) as T | undefined;\n if (v && v.at && Date.now() - v.at > STATE_TTL_MS) { await stDel(ns, id); return undefined; }\n return v;\n}\nasync function stSet(ns: string, id: string, val: unknown) { if (id) await blob.setJSON(skey(ns, id), val); }\nasync function stDel(ns: string, id: string) { if (!id) return; try { await blob.delete(skey(ns, id)); } catch { /* absent */ } }\ntype Verified = { patientId: string; at: number };\ntype Otp = { code: string; patientId: string; attempts: number; at: number };\ntype Strikes = { n: number; at: number };\n\n/** Caller-ID lookup. Which chart does this phone number belong to, if any. */\nfunction patientByPhone(num?: string | null) {\n if (!num) return null;\n const digits = String(num).replace(/\\D/g, \"\").slice(-10);\n return Object.values(PATIENTS).find((p: any) => String(p.phone).replace(/\\D/g, \"\").slice(-10) === digits) ?? null;\n}\n\n/**\n * Accept a date of birth however the model happened to write it and return ISO, or null.\n * Handles \"1980-01-12\", \"01/12/1980\", \"1-12-80\", \"January 12th, 1980\", \"Jan 12 1980\",\n * \"12 January 1980\". A strict string compare here made the agent ask a caller to\n * \"confirm your date of birth in YYYY-MM-DD format\", which is the tool's problem leaking\n * into the conversation, so the server does the normalising.\n */\nconst MONTHS: Record = { jan:1,feb:2,mar:3,apr:4,may:5,jun:6,jul:7,aug:8,sep:9,sept:9,oct:10,nov:11,dec:12 };\nfunction normalizeDob(raw: unknown): string | null {\n if (raw == null) return null;\n const s = String(raw).trim().toLowerCase().replace(/(\\d+)(st|nd|rd|th)\\b/g, \"$1\").replace(/,/g, \" \");\n let m = s.match(/^(\\d{4})-(\\d{1,2})-(\\d{1,2})$/);\n if (m) return `${m[1]}-${m[2].padStart(2, \"0\")}-${m[3].padStart(2, \"0\")}`;\n m = s.match(/^(\\d{1,2})[\\/\\-.](\\d{1,2})[\\/\\-.](\\d{2,4})$/); // US month/day/year\n if (m) { const y = m[3].length === 2 ? (Number(m[3]) > 30 ? \"19\" : \"20\") + m[3] : m[3];\n return `${y}-${m[1].padStart(2, \"0\")}-${m[2].padStart(2, \"0\")}`; }\n m = s.match(/^([a-z]+)\\.?\\s+(\\d{1,2})\\s+(\\d{4})$/); // january 12 1980\n if (m && (MONTHS[m[1].slice(0, 4)] ?? MONTHS[m[1].slice(0, 3)])) { // parens: `&&` and `??` cannot mix bare\n const mo = MONTHS[m[1].slice(0, 4)] ?? MONTHS[m[1].slice(0, 3)];\n return `${m[3]}-${String(mo).padStart(2, \"0\")}-${m[2].padStart(2, \"0\")}`; }\n m = s.match(/^(\\d{1,2})\\s+([a-z]+)\\.?\\s+(\\d{4})$/); // 12 january 1980\n if (m && (MONTHS[m[2].slice(0, 4)] ?? MONTHS[m[2].slice(0, 3)])) {\n const mo = MONTHS[m[2].slice(0, 4)] ?? MONTHS[m[2].slice(0, 3)];\n return `${m[3]}-${String(mo).padStart(2, \"0\")}-${m[1].padStart(2, \"0\")}`; }\n return null;\n}\n\n\n/**\n * Verification gate. The record decides, never the caller's claim.\n *\n * Three distinct outcomes, because the model treated them as one and it cost real calls:\n * - no dob supplied -> needs_dob, explicitly NOT a strike (the model had been calling\n * tools before asking, then counting the refusal as attempt one)\n * - dob supplied, wrong -> strike; the server says how many are left and only tells the\n * model to transfer on the second real miss\n * - dob supplied, right -> verified, and the CALL is marked verified so no later tool on\n * this call needs a date of birth (verify once)\n */\nasync function verify(body: any) {\n const cid = body?.call_id ? String(body.call_id) : \"\";\n const v = await stGet(\"verified\", cid);\n if (v) return { ok: true as const, p: PATIENTS[v.patientId] };\n const p = PATIENTS[body?.patient_id ?? \"jordan-avery\"];\n if (!p) return { ok: false as const, res: { verified: false, instruction: \"No record matched. Ask for the date of birth again, or offer to take a message for the front desk.\" } };\n const raw = body?.dob;\n if (raw == null || String(raw).trim() === \"\") {\n return { ok: false as const, res: { verified: false, needs_dob: true,\n instruction: \"No date of birth was supplied, so nothing was checked and this is NOT a failed attempt. Ask the caller for their date of birth in one plain question, then call this tool again with what they say.\" } };\n }\n // A caller who says \"January 12th\" with no year gets the year invented by the model (a live\n // call sent 2026-01-12 and struck the caller out). No four-digit year, or a year within the\n // last five, is treated as \"ask for the year\", never as a wrong date.\n const iso = normalizeDob(raw);\n const yr = iso ? Number(iso.slice(0, 4)) : NaN;\n if (!iso || !/\\d{4}/.test(String(raw)) || yr > new Date().getFullYear() - 5) {\n return { ok: false as const, res: { verified: false, needs_dob: true, needs_year: true,\n instruction: \"That date of birth is missing its year, or the year is not plausible for a patient. Nothing was checked and this is NOT a failed attempt. Ask them for the full date of birth including the year, and never supply a year yourself.\" } };\n }\n if (normalizeDob(raw) !== p.dob) {\n const n = ((await stGet(\"strikes\", cid))?.n ?? 0) + 1;\n await stSet(\"strikes\", cid, { n, at: Date.now() });\n if (n >= 2) return { ok: false as const, res: { verified: false, attempts_left: 0,\n instruction: \"That is the second date of birth that has not matched. Do not ask again and never say what is on file. Say you will put them through to the front desk, and call the transfer tool in the same turn.\" } };\n return { ok: false as const, res: { verified: false, attempts_left: 1,\n instruction: \"That date of birth does not match the record. Do NOT reveal any account detail and never say what the correct date is. Ask them to say their date of birth once more, then CALL THIS TOOL AGAIN with exactly what they say. It has not failed until that second call comes back unverified.\" } };\n }\n await stSet(\"verified\", cid, { patientId: p.patientId, at: Date.now() });\n return { ok: true as const, p };\n}\n\n// ---------------------------------------------------------------- endpoints\n/**\n * One read endpoint for every \"tell me about X\" question, dispatched on topic.\n * Folding five lookups into one tool keeps the agent's tool list short, which\n * matters because the model re-reads every tool description on every turn.\n */\napp.post(\"/lookup\", async (c) => {\n const b = await c.req.json();\n const v = await verify(b);\n if (!v.ok) return c.json(v.res);\n const p = v.p;\n switch (b?.topic) {\n case \"appointments\": {\n const list = p.appointments.filter((a: any) => a.status === \"scheduled\").map((a: any) => ({\n id: a.id, spoken: a.spoken, type: a.type, provider: providerName(a.providerId), location: locationName(a.locationId) }));\n return c.json({ topic: \"appointments\", count: list.length, appointments: list,\n instruction: list.length\n ? `Give the day, time and provider in ONE sentence. This is a real lookup, so be specific.`\n : `Nothing scheduled. Offer to book something.` });\n }\n case \"balance\":\n return c.json({ topic: \"balance\", balance: money(p.balanceCents), detail: p.balanceDetail,\n instruction: `Say the amount and what it is for in ONE sentence, then offer to text a payment link or set up a plan.` });\n case \"insurance\": {\n const i = p.insurance;\n return c.json({ topic: \"insurance\", payer: i.payer, member_id_last4: i.memberId.slice(-4), copay: money(i.copayCents),\n deductible_met: money(i.deductibleMetCents), deductible_total: money(i.deductibleTotalCents),\n instruction: `Answer only what they asked. Never read the full member id aloud, last four only. Do not predict whether a future service will be covered, that is the payer's decision: offer to have benefits check it.` });\n }\n case \"results\": {\n const released = p.results.filter((r: any) => r.releasedToPatient)\n .map((r: any) => ({ panel: r.panel, collected: r.collected, summary: r.summary }));\n const pending = p.results.filter((r: any) => !r.releasedToPatient)\n .map((r: any) => ({ panel: r.panel, collected: r.collected, status: r.status }));\n return c.json({ topic: \"results\", released, pending,\n instruction: `You may say a released result is back and read the clinician's released summary word for word. You may NOT interpret a value, give a number a meaning, or say whether anything is good or bad. For anything pending review, say only that it has not been released yet. If they push for interpretation, offer a nurse call back instead.` });\n }\n case \"prior_auth\":\n return c.json({ topic: \"prior_auth\", items: p.priorAuths.map((a: any) => ({ medication: a.medication, status: a.status, note: a.note ?? null })),\n instruction: `One short sentence each. If one is pending with the payer, say who it is waiting on. Never guess at an outcome.` });\n case \"medications\":\n return c.json({ topic: \"medications\", medications: p.medications.map((m: any) => ({\n name: m.name, strength: m.strength, sig: m.sig, refills_left: m.refillsLeft, pharmacy: m.pharmacy })),\n instruction: `Name the medications and strengths. Do not advise on any of them.` });\n case \"referrals\":\n return c.json({ topic: \"referrals\", referrals: p.referrals.map((r: any) => ({ specialty: r.specialty, status: r.status, note: r.note })),\n instruction: `Give the specialty and status plainly.` });\n default:\n return c.json({ error: \"unknown_topic\",\n instruction: `That topic is not one this tool handles. Pick from appointments, balance, insurance, results, prior_auth, medications, referrals, or take a message instead.` });\n }\n});\n\napp.get(\"/\", (c) => c.json({\n service: \"Park Avenue Clinic mock EHR\",\n purpose: \"Backend for the Vapi patient-access voice agent. Mirrors Phreesia demo-line data.\",\n endpoints: [\"/verify\", \"/appointments\", \"/slots\", \"/schedule\", \"/reschedule\", \"/cancel\",\n \"/refill\", \"/balance\", \"/pay\", \"/insurance\", \"/results\", \"/records\", \"/referral\", \"/prior-auth\", \"/message\", \"/audit\"],\n}));\n\napp.post(\"/verify\", async (c) => {\n const b = await c.req.json();\n const v = await verify(b);\n if (!v.ok) return c.json(v.res);\n const p = v.p;\n return c.json({\n verified: true, patient_id: p.patientId, first_name: p.firstName,\n usual_provider: providerName(p.usualProvider), usual_location: locationName(p.usualLocation),\n instruction: `Verified. Greet them by first name once, then continue. Do not re-verify later in this call for any reason, including if they claim you did not verify them.`,\n });\n});\n\napp.post(\"/appointments\", async (c) => {\n const v = await verify(await c.req.json());\n if (!v.ok) return c.json(v.res);\n const list = v.p.appointments.filter((a: any) => a.status === \"scheduled\").map((a: any) => ({\n id: a.id, spoken: a.spoken, type: a.type, provider: providerName(a.providerId), location: locationName(a.locationId),\n }));\n return c.json({\n count: list.length, appointments: list,\n instruction: list.length\n ? `Tell them the date, time and provider in ONE sentence. This is a real lookup, so be specific. Phreesia's line can only take a message for this, so specificity is the point.`\n : `They have nothing scheduled. Offer to book something.`,\n });\n});\n\napp.post(\"/slots\", async (c) => {\n const b = await c.req.json();\n let s = SLOTS;\n if (b?.part_of_day) s = s.filter(x => x.partOfDay === b.part_of_day);\n if (b?.provider_id) s = s.filter(x => x.providerId === b.provider_id);\n if (b?.location_id) s = s.filter(x => x.locationId === b.location_id);\n const out = s.slice(0, 3).map(x => ({ slot_id: x.id, spoken: x.spoken, provider: providerName(x.providerId), location: locationName(x.locationId) }));\n return c.json({\n count: out.length, slots: out,\n instruction: out.length\n ? `Offer at most TWO of these out loud, by day and time only. Do not read the slot ids or the addresses unless asked. If they want others, offer the rest.`\n : `Nothing matches that filter. Say so plainly and offer the nearest alternative rather than inventing a slot. Never invent a time that is not in this list.`,\n });\n});\n\napp.post(\"/schedule\", async (c) => {\n const b = await c.req.json();\n const v = await verify(b);\n if (!v.ok) return c.json(v.res);\n if (b?.confirmed_with_caller !== true) {\n return c.json({ booked: false, instruction: \"NOT booked, because confirmed_with_caller was not true. Read the day, time and provider back and ask them to confirm out loud first, then call this again.\" });\n }\n const slot = SLOTS.find(s => s.id === b.slot_id);\n if (!slot) return c.json({ booked: false, instruction: \"That slot id is not real. Call slots again and offer only what comes back. Never invent an appointment time.\" });\n const dup = await stGet<{ result: any; at: number }>(\"idem\", String(b.idempotency_key ?? \"\"));\n if (dup) return c.json({ ...dup.result, instruction: \"Already booked earlier in this call under the same request. Do NOT book a second one. Just confirm the existing booking.\" });\n const result = { booked: true, confirmation: \"PAC-\" + slot.id.toUpperCase() + \"-8841\", spoken: slot.spoken,\n provider: providerName(slot.providerId), location: locationName(slot.locationId) };\n writes.push({ kind: \"schedule\", idempotency_key: b.idempotency_key, at: new Date().toISOString(), result });\n return c.json({ ...result, instruction: `Booked. Confirm the day, time and provider in one sentence. Offer a text confirmation. Then ask whether there is anything else, do NOT end the call on your own.` });\n});\n\napp.post(\"/reschedule\", async (c) => {\n const b = await c.req.json();\n const v = await verify(b);\n if (!v.ok) return c.json(v.res);\n if (b?.confirmed_with_caller !== true) return c.json({ rescheduled: false, instruction: \"NOT rescheduled. Confirm the new day and time out loud with them first.\" });\n const slot = SLOTS.find(s => s.id === b.slot_id);\n if (!slot) return c.json({ rescheduled: false, instruction: \"Unknown slot. Offer only slots returned by the slots tool.\" });\n writes.push({ kind: \"reschedule\", at: new Date().toISOString(), to: slot.id });\n return c.json({ rescheduled: true, spoken: slot.spoken, provider: providerName(slot.providerId),\n instruction: `Moved. Say the new day and time once. Their old appointment is released. Then ask if there is anything else.` });\n});\n\napp.post(\"/cancel\", async (c) => {\n const b = await c.req.json();\n const v = await verify(b);\n if (!v.ok) return c.json(v.res);\n if (b?.confirmed_with_caller !== true) {\n return c.json({ cancelled: false, instruction: \"NOT cancelled. Cancelling is hard to undo, so ask them plainly to confirm they want it cancelled, and offer rescheduling instead. Then call again.\" });\n }\n writes.push({ kind: \"cancel\", at: new Date().toISOString(), appointment_id: b.appointment_id });\n return c.json({ cancelled: true, fee: null,\n instruction: `Cancelled, no fee since it is more than 24 hours out. Offer to rebook now. Do NOT end the call just because the task finished, ask if there is anything else first.` });\n});\n\napp.post(\"/refill\", async (c) => {\n const b = await c.req.json();\n const v = await verify(b);\n if (!v.ok) return c.json(v.res);\n const med = v.p.medications.find((m: any) => m.name.toLowerCase() === String(b?.medication ?? \"\").toLowerCase());\n if (!med) {\n return c.json({ found: false, on_file: v.p.medications.map((m: any) => `${m.name} ${m.strength}`),\n instruction: `That medication is not on their chart. Tell them what IS on file and ask which one they meant. Phreesia's line cannot see the chart at all, so naming their actual medications is the differentiator here.` });\n }\n if (b?.confirmed_with_caller !== true) {\n return c.json({ found: true, medication: `${med.name} ${med.strength}`, refills_left: med.refillsLeft, pharmacy: med.pharmacy,\n instruction: `Do not send it yet. Tell them the strength, how many refills are left and which pharmacy it goes to, then ask if they want it sent. Call again with confirmed_with_caller true once they say yes.` });\n }\n if (med.refillsLeft <= 0) {\n writes.push({ kind: \"refill_request_to_prescriber\", at: new Date().toISOString(), med: med.name });\n return c.json({ sent: false, needs_prescriber: true, prescriber: providerName(med.prescriberId),\n instruction: `No refills left, so this needs the prescriber. Say that plainly, say you have sent the request to ${providerName(med.prescriberId)}, and that the pharmacy usually hears back within two business days. Do not promise a specific time.` });\n }\n writes.push({ kind: \"refill\", at: new Date().toISOString(), med: med.name, to: b.pharmacy ?? med.pharmacy });\n return c.json({ sent: true, medication: `${med.name} ${med.strength}`, pharmacy: b.pharmacy ?? med.pharmacy, refills_left_after: med.refillsLeft - 1,\n instruction: `Sent to the pharmacy. Say which pharmacy and that it is usually ready in about two hours. Then ask if there is anything else.` });\n});\n\napp.post(\"/balance\", async (c) => {\n const v = await verify(await c.req.json());\n if (!v.ok) return c.json(v.res);\n const p = v.p;\n return c.json({ balance: money(p.balanceCents), detail: p.balanceDetail,\n instruction: `Say the amount and what it is for in ONE sentence. Then offer to take payment or set up a plan. Phreesia's demo can only take a message about a balance, so actually quoting it is the whole point.` });\n});\n\napp.post(\"/pay\", async (c) => {\n const b = await c.req.json();\n const v = await verify(b);\n if (!v.ok) return c.json(v.res);\n if (b?.confirmed_with_caller !== true) return c.json({ paid: false, instruction: \"Not charged. Say the amount out loud and ask them to confirm before you take payment.\" });\n return c.json({ paid: false, secure_link_sent: true, amount: money(v.p.balanceCents),\n instruction: `Do NOT collect a card number by voice, and never ask for one. Tell them you have texted a secure payment link to the number on file and it is good for 24 hours. This is deliberate: reading card digits into a recorded call is a PCI problem.` });\n});\n\napp.post(\"/insurance\", async (c) => {\n const v = await verify(await c.req.json());\n if (!v.ok) return c.json(v.res);\n const i = v.p.insurance;\n return c.json({ payer: i.payer, member_id_last4: i.memberId.slice(-4), copay: money(i.copayCents),\n deductible_met: money(i.deductibleMetCents), deductible_total: money(i.deductibleTotalCents),\n instruction: `Answer only what they asked. Give the payer name and the copay plainly. Never read the full member id aloud, last four only. Do not predict whether a future service will be covered, that is the payer's call, offer to have benefits check it.` });\n});\n\napp.post(\"/results\", async (c) => {\n const v = await verify(await c.req.json());\n if (!v.ok) return c.json(v.res);\n const released = v.p.results.filter((r: any) => r.releasedToPatient);\n const pending = v.p.results.filter((r: any) => !r.releasedToPatient);\n return c.json({\n released: released.map((r: any) => ({ panel: r.panel, collected: r.collected, summary: r.summary, abnormal: r.abnormal })),\n pending: pending.map((r: any) => ({ panel: r.panel, collected: r.collected, status: r.status })),\n instruction: `You may say that a released result is back and read the clinician's released summary. You may NOT interpret any value, give a number a meaning, or say whether something is good or bad. For anything still pending provider review, say only that it has not been released yet and the provider reviews it first. If they push for interpretation, offer a nurse call back. This boundary is the point: reading unreleased results aloud would be a real compliance failure.`,\n });\n});\n\napp.post(\"/records\", async (c) => {\n const b = await c.req.json();\n const v = await verify(b);\n if (!v.ok) return c.json(v.res);\n writes.push({ kind: \"records_request\", at: new Date().toISOString(), to: b?.send_to });\n return c.json({ submitted: true, turnaround: \"five to seven business days\", fee: \"no fee for transfers to another provider\",\n esign_sent: true,\n instruction: `Started. Tell them you have texted a release form to sign, that transfers to another provider are free, and that it takes five to seven business days. Do not promise faster.` });\n});\n\napp.post(\"/referral\", async (c) => {\n const b = await c.req.json();\n const v = await verify(b);\n if (!v.ok) return c.json(v.res);\n const existing = v.p.referrals.find((r: any) => r.specialty.toLowerCase() === String(b?.specialty ?? \"\").toLowerCase());\n if (existing) {\n return c.json({ existing: true, specialty: existing.specialty, status: existing.status, note: existing.note,\n instruction: `They already have this referral and it is authorized. Tell them so and read the note. Do not create a duplicate. Phreesia's line takes a message here, so knowing the status outright is the differentiator.` });\n }\n writes.push({ kind: \"referral\", at: new Date().toISOString(), specialty: b?.specialty });\n return c.json({ created: true, specialty: b?.specialty, routed_to: providerName(v.p.usualProvider),\n instruction: `Started a referral request and routed it to their PCP for sign off. Say it usually takes two to three business days and they will get a call from the specialist's office.` });\n});\n\napp.post(\"/prior-auth\", async (c) => {\n const v = await verify(await c.req.json());\n if (!v.ok) return c.json(v.res);\n return c.json({ items: v.p.priorAuths.map((a: any) => ({ medication: a.medication, status: a.status, note: a.note ?? null })),\n instruction: `Give the status of each in one short sentence each. If one is pending with the payer, say who it is waiting on. Never guess at an approval outcome.` });\n});\n\napp.post(\"/message\", async (c) => {\n const b = await c.req.json();\n writes.push({ kind: \"message\", at: new Date().toISOString(), topic: b?.topic, body: b?.body });\n return c.json({ taken: true, routed_to: b?.topic === \"clinical\" ? \"the nursing team\" : \"the front desk\",\n instruction: `Taken. Say who it went to and that they respond within one business day. A message is your LAST resort here, not your first move: if a tool could have answered this, use the tool instead.` });\n});\n\napp.get(\"/audit\", (c) => c.json({ count: writes.length, writes }));\n\n// ------------------------------------------- pre-call lookup (assistant-request)\n/**\n * Vapi hits this BEFORE the assistant picks up an inbound call (phone number\n * `server.url`). We look the caller's number up and hand back the chart as\n * template variables, so the greeting can use their first name and the agent\n * knows the chart without a tool round trip on turn one.\n *\n * What is pulled for every caller (empty strings when the number is unknown):\n * firstName, lastName, dobSpoken, dobIso, phoneLast4, usualProvider,\n * usualLocation, medications (spoken list), nextAppointment, balance,\n * insurancePayer, knownCaller (\"true\"/\"false\")\n *\n * The assistant to answer with is chosen from the phone number's own metadata\n * field `assistantId` if present; otherwise ASSISTANT_DEFAULT.\n */\n// The pre-call lookup line (815-940-9450) answers with v2: caller-ID greeting + text code.\n// v1 (Patient Access, Phreesia-shaped) has its own plain number with no lookup.\nconst ASSISTANT_DEFAULT = \"9c00f26a-e5d6-4224-b54e-25ca2966e038\"; // v2\nconst spokenDob = (iso: string) => {\n const [y, m, d] = iso.split(\"-\").map(Number);\n const months = [\"January\",\"February\",\"March\",\"April\",\"May\",\"June\",\"July\",\"August\",\"September\",\"October\",\"November\",\"December\"];\n const ord = (n: number) => n + (n % 10 === 1 && n !== 11 ? \"st\" : n % 10 === 2 && n !== 12 ? \"nd\" : n % 10 === 3 && n !== 13 ? \"rd\" : \"th\");\n return `${months[m - 1]} ${ord(d)}, ${y}`;\n};\nfunction chartVariables(p: any | null) {\n if (!p) return { knownCaller: \"false\", firstName: \"\", lastName: \"\", dobSpoken: \"\", dobIso: \"\", phoneLast4: \"\",\n usualProvider: \"\", usualLocation: \"\", medications: \"\", nextAppointment: \"\", balance: \"\", insurancePayer: \"\" };\n const next = p.appointments.find((a: any) => a.status === \"scheduled\");\n return {\n knownCaller: \"true\",\n firstName: p.firstName, lastName: p.lastName,\n dobSpoken: spokenDob(p.dob), dobIso: p.dob,\n phoneLast4: String(p.phone).slice(-4),\n usualProvider: providerName(p.usualProvider), usualLocation: locationName(p.usualLocation),\n medications: p.medications.map((m: any) => `${m.name} ${m.strength}`).join(\", \"),\n nextAppointment: next ? `${next.spoken} with ${providerName(next.providerId)}` : \"none scheduled\",\n balance: money(p.balanceCents),\n insurancePayer: p.insurance.payer,\n };\n}\napp.post(\"/assistant-request\", async (c) => {\n let payload: any = {};\n try { payload = await c.req.json(); } catch { /* empty */ }\n const msg = payload?.message ?? payload;\n if (msg?.type && msg.type !== \"assistant-request\") return c.json({}); // ignore other webhooks\n const number = msg?.customer?.number ?? msg?.call?.customer?.number ?? null;\n // DEMO SHAPE: every caller resolves to the seeded patient, so any phone that dials the\n // line hears \"Is this Jordan?\" and gets Jordan's chart. In a real deployment an unknown\n // number would get the empty variable set and the fallback greeting instead.\n const p = patientByPhone(number) ?? PATIENTS[\"jordan-avery\"];\n const assistantId = msg?.phoneNumber?.metadata?.assistantId ?? ASSISTANT_DEFAULT;\n writes.push({ kind: \"assistant-request\", at: new Date().toISOString(), number, matched: p?.patientId ?? null });\n return c.json({ assistantId, assistantOverrides: { variableValues: chartVariables(p) } });\n});\n// Same variables for a web call or a test, by number, without going through Vapi.\napp.get(\"/lookup-by-phone\", (c) => c.json(chartVariables(patientByPhone(c.req.query(\"number\")))));\n\n// --------------------------------------------------- text-code (OTP) verification\nconst TWILIO_SID = Deno.env.get(\"TWILIO_ACCOUNT_SID\");\nconst TWILIO_TOKEN = Deno.env.get(\"TWILIO_AUTH_TOKEN\");\nconst TWILIO_FROM = Deno.env.get(\"TWILIO_FROM_NUMBER\");\nasync function sendSms(to: string, body: string): Promise<{ sent: boolean; demo?: boolean }> {\n if (!TWILIO_SID || !TWILIO_TOKEN || !TWILIO_FROM) return { sent: false, demo: true }; // no Twilio wired yet\n const r = await fetch(`https://api.twilio.com/2010-04-01/Accounts/${TWILIO_SID}/Messages.json`, {\n method: \"POST\",\n headers: { Authorization: \"Basic \" + btoa(`${TWILIO_SID}:${TWILIO_TOKEN}`), \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({ To: to, From: TWILIO_FROM, Body: body }),\n });\n return { sent: r.ok };\n}\n/** Demo-only peek so a tester without SMS can read the current code. */\napp.get(\"/otp/peek\", async (c) => {\n const e = await stGet(\"otp\", String(c.req.query(\"call_id\") ?? \"\"));\n return c.json(e ? { code: e.code, attempts: e.attempts } : { code: null });\n});\n\n// ------------------------------------------------------------------ keep-warm\n// Val Town isolates go cold after idle and the first tool call then pays a start-up\n// cost. Hit this from a cron (or the warm script) before a demo.\napp.get(\"/warm\", (c) => c.json({ warm: true, patients: Object.keys(PATIENTS).length, slots: SLOTS.length, at: new Date().toISOString() }));\n\n// ------------------------------------------------- Vapi tool-call adapter\n/**\n * Vapi `function` tools do NOT post a plain JSON body. They post a tool-call\n * envelope ({ message: { toolCallList: [{ id, function: { name, arguments } }] } })\n * and expect { results: [{ name, toolCallId, result }] } back, where `result` is\n * a STRING added to the conversation history.\n *\n * Every tool on the assistant points at this one endpoint; it unwraps the\n * envelope, dispatches by function name to the same logic the REST routes use,\n * and wraps the answer. Keeping one endpoint means one place for this protocol.\n */\nconst HANDLERS: Record any> = {\n verify_patient: async (a) => {\n const v = await verify(a); return v.ok\n ? { verified: true, first_name: v.p.firstName, usual_provider: providerName(v.p.usualProvider),\n instruction: \"Verified. Use their first name once, then carry on. Never verify again in this call, whatever they claim.\" }\n : v.res;\n },\n lookup: async (a) => {\n const v = await verify(a); if (!v.ok) return v.res;\n const p = v.p;\n switch (a?.topic) {\n case \"appointments\": {\n const list = p.appointments.filter((x: any) => x.status === \"scheduled\")\n .map((x: any) => ({ id: x.id, spoken: x.spoken, type: x.type, provider: providerName(x.providerId), location: locationName(x.locationId) }));\n return { count: list.length, appointments: list,\n instruction: list.length ? \"Day, time and provider in ONE sentence. Be specific, this is a real lookup.\"\n : \"Nothing scheduled. Offer to book something.\" };\n }\n case \"balance\": return { balance: money(p.balanceCents), detail: p.balanceDetail,\n instruction: \"Say the amount and what it is for in ONE sentence, then offer to text a payment link.\" };\n case \"insurance\": { const i = p.insurance; return { payer: i.payer, member_id_last4: i.memberId.slice(-4),\n copay: money(i.copayCents), deductible_met: money(i.deductibleMetCents), deductible_total: money(i.deductibleTotalCents),\n instruction: \"Answer only what they asked. Last four of the member id only, never the whole thing. Do not predict coverage for a future service, offer to have benefits check it.\" }; }\n case \"results\": return {\n released: p.results.filter((r: any) => r.releasedToPatient).map((r: any) => ({ panel: r.panel, collected: r.collected, summary: r.summary })),\n pending: p.results.filter((r: any) => !r.releasedToPatient).map((r: any) => ({ panel: r.panel, collected: r.collected, status: r.status })),\n instruction: \"You may say a released result is back and read its summary word for word. You may NOT interpret a value or say whether anything is good or bad. Pending items: say only that they have not been released yet. If pushed, offer a nurse call back.\" };\n case \"prior_auth\": return { items: p.priorAuths.map((x: any) => ({ medication: x.medication, status: x.status, note: x.note ?? null })),\n instruction: \"One short sentence each. Say who a pending one is waiting on. Never guess an outcome.\" };\n case \"medications\": return { medications: p.medications.map((m: any) => ({ name: m.name, strength: m.strength, sig: m.sig, refills_left: m.refillsLeft, pharmacy: m.pharmacy })),\n instruction: \"Name the medications and strengths. Do not advise on any of them.\" };\n case \"referrals\": return { referrals: p.referrals.map((r: any) => ({ specialty: r.specialty, status: r.status, note: r.note })),\n instruction: \"Specialty and status, plainly.\" };\n default: return { error: \"unknown_topic\", instruction: \"Not a topic this tool handles. Pick appointments, balance, insurance, results, prior_auth, medications or referrals.\" };\n }\n },\n /**\n * v2 scheduling: over-fetch, hand back a small offer set plus a DIVERSE reserve.\n *\n * The reserve is bucketed by day, not just sliced off the top. Offering the caller\n * Tuesday 1pm and then, when they say no, Tuesday 3:30pm is nearly useless: someone\n * who rejects a day usually rejects the whole day. So the next pair comes from a\n * different day, which is what makes a single query survive two or three rejections\n * without another round trip.\n */\n find_slots: (a) => {\n let s = SLOTS;\n if (a?.part_of_day) s = s.filter(x => x.partOfDay === a.part_of_day);\n if (a?.provider_id) s = s.filter(x => x.providerId === a.provider_id);\n if (a?.location_id) s = s.filter(x => x.locationId === a.location_id);\n if (!s.length) {\n return { count: 0, offer_now: [], hold_back: [],\n instruction: \"Nothing matches that filter. Say so plainly, say what you DO have nearest to it, \"\n + \"and never invent a time. Call this again only if they give you a genuinely different constraint.\" };\n }\n const fmt = (x: any) => ({ slot_id: x.id, spoken: x.spoken, day: x.spoken.split(\" at \")[0],\n part_of_day: x.partOfDay, provider: providerName(x.providerId),\n location: locationName(x.locationId) });\n // Group by day, then take at most one per day for the offer set so the two options\n // the caller hears are genuinely different choices rather than near-duplicates.\n const byDay: Record = {};\n for (const x of s) (byDay[x.spoken.split(\" at \")[0]] ||= []).push(x);\n const days = Object.keys(byDay);\n const offer = days.slice(0, 2).map(d => fmt(byDay[d][0]));\n const reserve: any[] = [];\n days.slice(2).forEach(d => reserve.push(...byDay[d].map(fmt))); // other days first\n days.slice(0, 2).forEach(d => reserve.push(...byDay[d].slice(1).map(fmt))); // then same-day extras\n return {\n count: s.length, offer_now: offer, hold_back: reserve,\n instruction:\n \"Offer ONLY the two in offer_now, by day and time, in one sentence, and name the provider once \"\n + \"rather than asking separately whether the provider is acceptable. \"\n + (reserve.length\n ? `If they turn both down, do NOT call this tool again: offer the next options from hold_back, which are on different days. You have ${reserve.length} more in reserve, so you can absorb two or three refusals without another lookup.`\n : \"There is nothing in reserve, so if they turn these down, ask what would work and call this again with that constraint.\")\n + \" If the caller already said yes to a specific one of these, that IS their consent to book it: \"\n + \"book it and tell them it is done. Do not ask a second time whether to go ahead.\",\n };\n },\n book_appointment: async (a) => {\n const v = await verify(a); if (!v.ok) return v.res;\n if (a?.confirmed_with_caller !== true) return { booked: false, instruction: \"NOT booked. Read the day, time and provider back and get a spoken yes, then call again.\" };\n const slot = SLOTS.find(s => s.id === a.slot_id);\n if (!slot) return { booked: false, instruction: \"That slot id is not real. Call find_slots and offer only what comes back.\" };\n const dup = await stGet<{ result: any; at: number }>(\"idem\", String(a.idempotency_key ?? \"\"));\n if (dup) return { ...dup.result, instruction: \"Already booked earlier under this same request. Do NOT book a second one, just confirm the existing booking.\" };\n const result = { booked: true, confirmation: \"PAC-\" + String(slot.id).toUpperCase() + \"-8841\", spoken: slot.spoken, provider: providerName(slot.providerId), location: locationName(slot.locationId) };\n writes.push({ kind: \"schedule\", idempotency_key: a.idempotency_key, at: new Date().toISOString(), result });\n await stSet(\"idem\", String(a.idempotency_key ?? \"\"), { result, at: Date.now() });\n return { ...result, instruction: \"Booked. Confirm day, time and provider in one sentence, offer a text confirmation, then ask if there is anything else. Do NOT end the call here.\" };\n },\n reschedule_appointment: async (a) => {\n const v = await verify(a); if (!v.ok) return v.res;\n if (a?.confirmed_with_caller !== true) return { rescheduled: false, instruction: \"NOT rescheduled. Confirm the new day and time out loud first.\" };\n const slot = SLOTS.find(s => s.id === a.slot_id);\n if (!slot) return { rescheduled: false, instruction: \"Unknown slot. Offer only slots find_slots returned.\" };\n writes.push({ kind: \"reschedule\", at: new Date().toISOString(), to: slot.id });\n return { rescheduled: true, spoken: slot.spoken, provider: providerName(slot.providerId),\n instruction: \"Moved. Say the new day and time once. The old one is released, so do not also cancel it. Then ask if there is anything else.\" };\n },\n cancel_appointment: async (a) => {\n const v = await verify(a); if (!v.ok) return v.res;\n if (a?.confirmed_with_caller !== true) return { cancelled: false, instruction: \"NOT cancelled. Ask plainly whether they want it cancelled and offer to move it instead, then call again.\" };\n writes.push({ kind: \"cancel\", at: new Date().toISOString(), appointment_id: a.appointment_id });\n return { cancelled: true, fee: null, instruction: \"Cancelled, no fee at this notice. Offer to rebook, then ask if there is anything else. Do NOT end the call because the task finished.\" };\n },\n request_refill: async (a) => {\n const v = await verify(a); if (!v.ok) return v.res;\n const med = v.p.medications.find((m: any) => m.name.toLowerCase() === String(a?.medication ?? \"\").toLowerCase());\n if (!med) return { found: false, on_file: v.p.medications.map((m: any) => `${m.name} ${m.strength}`),\n instruction: \"Not on their chart. Read back what IS on file and ask which they meant. Do not guess.\" };\n if (a?.confirmed_with_caller !== true) return { found: true, medication: `${med.name} ${med.strength}`, refills_left: med.refillsLeft, pharmacy: med.pharmacy,\n instruction: \"Do not send yet. Tell them the strength, refills left and which pharmacy, then ask if they want it sent. Call again with confirmed_with_caller true once they say yes.\" };\n if (med.refillsLeft <= 0) { writes.push({ kind: \"refill_to_prescriber\", at: new Date().toISOString(), med: med.name });\n return { sent: false, needs_prescriber: true, prescriber: providerName(med.prescriberId),\n instruction: `No refills left, so it goes to ${providerName(med.prescriberId)} to authorise. Say that plainly and that the pharmacy usually hears within two business days. Do not promise a time.` }; }\n writes.push({ kind: \"refill\", at: new Date().toISOString(), med: med.name, to: a.pharmacy ?? med.pharmacy });\n return { sent: true, medication: `${med.name} ${med.strength}`, pharmacy: a.pharmacy ?? med.pharmacy,\n instruction: \"Sent. Say which pharmacy and that it is usually ready in about two hours, then ask if there is anything else.\" };\n },\n send_payment_link: async (a) => {\n const v = await verify(a); if (!v.ok) return v.res;\n if (a?.confirmed_with_caller !== true) return { sent: false, instruction: \"Not sent. Say the amount out loud and get a yes first.\" };\n return { secure_link_sent: true, amount: money(v.p.balanceCents),\n instruction: \"Say you have texted a secure link to the number on file, good for 24 hours. NEVER ask for a card number and never accept digits read aloud.\" };\n },\n request_records: async (a) => {\n const v = await verify(a); if (!v.ok) return v.res;\n writes.push({ kind: \"records_request\", at: new Date().toISOString(), to: a?.send_to });\n return { submitted: true, turnaround: \"five to seven business days\", fee: \"no fee for transfers to another provider\", esign_sent: true,\n instruction: \"Started. Say a release form has been texted to sign, transfers to another provider are free, and it takes five to seven business days. Do not promise faster.\" };\n },\n request_referral: async (a) => {\n const v = await verify(a); if (!v.ok) return v.res;\n const existing = v.p.referrals.find((r: any) => r.specialty.toLowerCase() === String(a?.specialty ?? \"\").toLowerCase());\n if (existing) return { existing: true, specialty: existing.specialty, status: existing.status, note: existing.note,\n instruction: \"They already have this one and it is authorized. Tell them the status and the note. Do NOT create a duplicate.\" };\n writes.push({ kind: \"referral\", at: new Date().toISOString(), specialty: a?.specialty });\n return { created: true, specialty: a?.specialty, routed_to: providerName(v.p.usualProvider),\n instruction: \"Started and routed to their PCP to sign off. Two to three business days, then the specialist's office calls them.\" };\n },\n /**\n * OTP step 1. Generates a six-digit code for THIS call and texts it to the number\n * the call came from. The code never enters the model: it is stored server-side\n * and only compared server-side in verify_code.\n */\n send_verification_code: async (a) => {\n // DEMO SHAPE: every caller is the seeded patient, and the code goes to the phone the\n // caller is actually holding. Production would text the number ON FILE, never the\n // caller-supplied one, because the whole point is proving they hold the chart's phone.\n const p = patientByPhone(a?.customer_number) ?? PATIENTS[\"jordan-avery\"];\n const to = a?.customer_number || p.phone;\n if (!to) return { sent: false, unknown_number: true,\n instruction: \"There is no number to text a code to. Ask for their date of birth instead and verify the old way.\" };\n // DEMO MODE: until Twilio is wired (env vars set), nobody can receive a text, so the\n // code is a fixed 482913. Simulation testers are told it, and a live tester can use it\n // without SMS. The moment TWILIO_AUTH_TOKEN exists this becomes a random six digits\n // and the only way to learn it is the text.\n const code = TWILIO_TOKEN ? String(Math.floor(100000 + Math.random() * 900000)) : \"482913\";\n await stSet(\"otp\", String(a?.call_id ?? \"\"), { code, patientId: p.patientId, attempts: 0, at: Date.now() });\n const r = await sendSms(to, `Park Avenue Clinic: your verification code is ${code}. It expires in 10 minutes.`);\n writes.push({ kind: \"otp_sent\", at: new Date().toISOString(), to, demo: !!r.demo, call_id: a?.call_id });\n const last4 = String(to).replace(/\\D/g, \"\").slice(-4);\n const where = last4 ? `the number ending ${last4}` : \"your phone\";\n return { sent: true, demo_mode: !!r.demo, to_last4: last4,\n instruction: `A six digit code has been texted to ${where}. Ask them to read it back when it arrives. Do not guess or suggest digits. If it has not arrived after a minute, offer to send it once more.` };\n },\n /** OTP step 2. Server-side compare. Three wrong tries and the call falls back to a person. */\n verify_code: async (a) => {\n const cid = String(a?.call_id ?? \"\");\n const e = await stGet(\"otp\", cid);\n if (!e) return { verified: false, no_code_sent: true, instruction: \"No code has been sent on this call yet. Send one first.\" };\n if (Date.now() - e.at > 10 * 60 * 1000) { await stDel(\"otp\", cid);\n return { verified: false, expired: true, instruction: \"That code has expired. Offer to send a fresh one.\" }; }\n const given = String(a?.code ?? \"\").replace(/\\D/g, \"\");\n if (given === e.code) {\n await stSet(\"verified\", cid, { patientId: e.patientId, at: Date.now() }); await stDel(\"otp\", cid);\n const p = PATIENTS[e.patientId];\n return { verified: true, first_name: p.firstName,\n instruction: \"Verified. Say so in a few words, then in the SAME turn call the tool for whatever they rang about. Never describe a result you have not fetched. Do not ask for a date of birth at any point in this call.\" };\n }\n e.attempts += 1;\n await stSet(\"otp\", cid, e);\n if (e.attempts >= 3) { await stDel(\"otp\", cid);\n return { verified: false, locked: true, instruction: \"Third wrong code. Do not send another. Say you will put them through to the front desk, and call the transfer tool in the same turn.\" }; }\n return { verified: false, attempts_left: 3 - e.attempts,\n instruction: `That code did not match. A wrong code usually means a misheard digit rather than an undelivered text, so ask them to read it once more, slowly. ${3 - e.attempts} attempt(s) left.` };\n },\n take_message: (a) => {\n writes.push({ kind: \"message\", at: new Date().toISOString(), topic: a?.topic, body: a?.body });\n return { taken: true, routed_to: a?.topic === \"clinical\" ? \"the nursing team\" : \"the front desk\",\n instruction: \"Taken. Say who it went to and that they respond within one business day.\" };\n },\n};\n\napp.post(\"/vapi\", async (c) => {\n let payload: any = {};\n try { payload = await c.req.json(); } catch { /* empty body */ }\n const calls = payload?.message?.toolCallList ?? payload?.toolCallList ?? [];\n // Handlers may be async (the OTP sender awaits Twilio). Without the await, an async\n // handler's Promise stringifies to \"{}\" and the model gets an empty result.\n const results = await Promise.all(calls.map(async (tc: any) => {\n const name = tc?.function?.name ?? tc?.name;\n let args = tc?.function?.arguments ?? {};\n if (typeof args === \"string\") { try { args = JSON.parse(args); } catch { args = {}; } }\n const fn = HANDLERS[name];\n let out: any;\n try {\n out = fn\n ? await fn(args)\n : { error: \"unknown_tool\", instruction: \"That tool does not exist. Use one of the tools you were given.\" };\n } catch (e) {\n out = { error: \"handler_failed\", instruction: \"Something went wrong on the clinic system. Tell the caller it did not go through and offer to try once more or put them through to the front desk.\" };\n console.error(\"handler\", name, String(e));\n }\n // `result` must be a STRING; Vapi adds it to the conversation history verbatim.\n return { name, toolCallId: tc?.id, result: JSON.stringify(out) };\n }));\n return c.json({ results });\n});\n\nexport default app.fetch;\n",[],[65],"9787af19-5cdc-4899-8399-ad0ccd105ba1","README.md","01a0a371-d220-7530-921c-1c2f2df526b6",1,["D",1789448540653],"# React + Hono Starter\n\nA minimal starter template for building client-side React apps with a Hono\nbackend on Val Town. Click **Remix** to get your own copy.\n\n## Picking a starter\n\n| Starter | When to pick it |\n| --- | --- |\n| [`basic-html-starter`](https://www.val.town/x/templates/basic-html-starter) | Static HTML pages. Sprinkle of vanilla JS. No server-side rendering. |\n| [`hono-jsx-starter`](https://www.val.town/x/templates/hono-jsx-starter) | Dynamic server-rendered HTML with JSX. API routes. No React, no SPA. |\n| **[`react-hono-starter`](https://www.val.town/x/templates/react-hono-starter)** *(you're here)* | Client-side React SPA with a Hono API backend. |\n\n**Want to build UI?** Start writing React components in\n[`frontend/components/`](/frontend/components/). Import them into `App.tsx` and\nyou're good to go. Styling is [Twind](https://twind.style/) — just use Tailwind\nutility classes, zero config.\n\n**Want to add an API?** Add routes in [`index.ts`](/index.ts) (there's a\ncommented-out example). Fetch them from your React components.\n\n## Architecture\n\n```mermaid\ngraph LR\n Browser -->|\"GET /\"| Hono[\"index.ts
(Hono server)\"]\n Hono -->|serves| HTML[\"root.tsx\"]\n HTML -->|loads| Entry[\"index.tsx\"]\n Entry -->|renders| App[\"App.tsx\"]\n App -->|renders| Counter[\"Counter.tsx\"]\n```\n\n## File structure\n\n```\nindex.ts ← Hono backend (serves frontend + API routes)\nfrontend/\n root.tsx ← HTML shell (stamps immutable asset URLs)\n index.tsx ← React entrypoint (mounts )\n favicon.svg ← App icon\n components/\n App.tsx ← Root component (layout + view source link)\n Counter.tsx ← Example component with state\n```\n\n## How it works\n\n1. **`index.ts`** is the HTTP entrypoint — a Hono server that serves the\n frontend and any API routes you add.\n2. **`frontend/root.tsx`** is the HTML shell — it loads Twind and stamps\n immutable asset URLs for the favicon and React entrypoint.\n3. **`frontend/index.tsx`** mounts the React app.\n4. **`frontend/components/App.tsx`** is the root layout — add new components\n alongside it.\n5. **`frontend/components/Counter.tsx`** is an example stateful component —\n replace it with your own!\n\n## Next steps\n\n- Add API routes in `index.ts`\n- Add new components in `frontend/components/`\n- Add a SQLite database — see the\n [React Hono Example](https://www.val.town/x/stevekrouse/reactHonoExample) for\n a full-stack example with database, queries, and shared types\n\nTemplate updates and upgrade paths for existing remixes: [CHANGELOG.md](/CHANGELOG.md)\n",[],[75],"9482f420-fb7d-4cb4-be4a-92d57fe9ff8d","CHANGELOG.md","01a0a371-d220-7530-921c-1835a0ea39f8",["D",1789448540653],"# Changelog\n\n## 2026-07-30 — Immutable asset caching\n\nFrontend files are now served at version-addressed URLs\n(`/__immutable/45/frontend/index.tsx`) with\n`Cache-Control: public, max-age=31536000, immutable`, so repeat visits load the\nwhole client graph from the browser cache — roughly 3× faster (~665ms → ~157ms\nmeasured). Publishing your val bumps its version, which changes every URL, so\ncaches invalidate automatically. Old-version URLs return 404 after a publish\n(like Next.js build assets); a reload picks up the new version.\n\nWhat changed in the template:\n\n- `frontend/index.html` → [`frontend/root.tsx`](/frontend/root.tsx): the HTML\n shell is now JSX and stamps asset URLs with `immutableFileUrl()`\n- [`index.ts`](/index.ts): serves `Root()` at `/`, and one\n `app.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path))` route\n serves all frontend files\n\n### Upgrading an existing remix\n\nYour copy of this template doesn't update automatically. Two options:\n\n**Minimal (most of the benefit):** point both routes at `serveImmutableFile` —\nyour existing bare URLs redirect into versioned space, the new route serves\nthem, and the whole module graph gets cached (costs one redirect per page view):\n\n```ts\nimport { serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\n\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/frontend/**/*\", (c) => serveImmutableFile(c.req.path)); // was serveFile\n```\n\n**Full upgrade (also removes the redirect):** three self-contained steps —\nno other files needed. Adjust the ``, favicon, and body of `Root()` to\nmatch your app's existing `index.html`, and stamp anything else your shell\nreferences directly (images, css) with `immutableFileUrl()`.\n\n1. Create `frontend/root.tsx`:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>React Hono Val Town Starter\n