[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_151":152,"_153":154},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_114":-5,"_20":115,"_22":116,"_117":118,"_119":120,"_25":121,"_24":-5,"_122":-5,"_123":-5,"_124":53,"_125":126,"_127":44,"_128":-5,"_129":-5,"_130":131},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","goodmaidcleaning","name","booking","branchName","main","version","path","","project",{"_33":61,"_13":14,"_45":62,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":37,"_73":44,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":94,"_95":96,"_97":98,"_99":53},"tree",[56],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":55},"id","ba3b89c7-255f-4110-a28d-53a05d51ff07","main.ts","fileId","ff4c00a8-abf8-11f1-941b-1607ee4eb77e","parentId","branchId","83d2718d-a70c-4c30-87d3-49b00a03d15a","branchVersion",27,"latest",true,"createdAt",["D",1789321957376],5,"fileType","http","content","/**\n * Good Maid Cleaning — Jobber booking relay\n * --------------------------------------------------\n * This one file does four jobs:\n * 1. Lets you connect this to Jobber (visit the address once, click \"Connect\")\n * 2. Receives real bookings from your website and creates them in Jobber\n * 3. Has a couple of \"peek at Jobber's rules\" links Henry can visit and send\n * back to Claude, so the exact field names can be locked in with zero guessing.\n * 4. NEW — receives Jobber's own webhook the moment YOU close, cancel, or\n * remove a job directly in Jobber, and automatically cancels the\n * matching booking and emails the customer — all without you touching\n * the website. It tells Henry whether the 24-hour window was met, but\n * the refund itself is always a manual step, same as everywhere else\n * in this system. See the big comment above handleJobberWebhook()\n * below for exactly how this works and the one real wrinkle in\n * Jobber's own product it has to work around.\n *\n * You should not need to understand this file. Paste it in, then follow\n * the checklist page step by step. For the webhook piece specifically,\n * there's ALSO a one-time step in Jobber's own Developer Center (turning\n * the webhook on and telling Jobber this address) — that's in the\n * checklist too, it isn't something pasting this file in does for you.\n */\n\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\n// ───────────────────────── Your Jobber app credentials ─────────────────────────\nconst CLIENT_ID = \"7021f6fd-bacd-427f-b06f-a03ffddca337\";\nconst CLIENT_SECRET =\n \"98a4b35e67bb87363dbd30ec9570b06357ca0043d40d8b185cc45849f6ff9a8e\";\n\n// Your booking/payment relay val — this file calls it server-to-server the\n// moment a job gets closed/cancelled/removed in Jobber. Same URL your\n// website's checkout already POSTs to.\nconst BOOKING_ENGINE_URL =\n \"https://goodmaidcleaning--542d956eaaf011f1bf781607ee4eb77e.web.val.run\";\n\nconst JOBBER_AUTH_URL = \"https://api.getjobber.com/api/oauth/authorize\";\nconst JOBBER_TOKEN_URL = \"https://api.getjobber.com/api/oauth/token\";\nconst JOBBER_GRAPHQL_URL = \"https://api.getjobber.com/api/graphql\";\nconst JOBBER_API_VERSION = \"2025-04-16\"; // newest published version as of this writing\n\nconst TOKENS_KEY = \"jobber_tokens\";\n\n// ───────────────────────── small helpers ─────────────────────────\n\nfunction baseUrl(req: Request) {\n const u = new URL(req.url);\n // Must exactly match the redirect URL you pasted into Jobber's Developer Center.\n return `${u.protocol}//${u.host}${u.pathname}`;\n}\n\nasync function saveTokens(tokens: Record) {\n await blob.setJSON(TOKENS_KEY, { ...tokens, saved_at: Date.now() });\n}\n\nasync function getTokens() {\n return await blob.getJSON(TOKENS_KEY);\n}\n\nasync function exchangeCodeForTokens(code: string, redirectUri: string) {\n const res = await fetch(JOBBER_TOKEN_URL, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n client_id: CLIENT_ID,\n client_secret: CLIENT_SECRET,\n grant_type: \"authorization_code\",\n code,\n redirect_uri: redirectUri,\n }),\n });\n const data = await res.json();\n if (!res.ok || data.error) {\n console.log(\"Token exchange failed:\", JSON.stringify(data));\n throw new Error(\n data.error_description || data.error || \"Token exchange failed\",\n );\n }\n return data;\n}\n\nasync function refreshTokens(refreshToken: string) {\n const res = await fetch(JOBBER_TOKEN_URL, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n client_id: CLIENT_ID,\n client_secret: CLIENT_SECRET,\n grant_type: \"refresh_token\",\n refresh_token: refreshToken,\n }),\n });\n const data = await res.json();\n if (!res.ok || data.error) {\n console.log(\"Token refresh failed:\", JSON.stringify(data));\n throw new Error(\n data.error_description || data.error || \"Token refresh failed\",\n );\n }\n return data;\n}\n\n// Returns a good-to-use access token, refreshing it first if it's stale.\n// (Refresh tokens rotate — a new refresh token comes back every time, and we\n// save it, since the old one stops working after one use.)\nasync function getValidAccessToken() {\n const tokens = await getTokens();\n if (!tokens) return null;\n const ageMs = Date.now() - tokens.saved_at;\n const expiresInMs = (tokens.expires_in || 3600) * 1000;\n if (ageMs > expiresInMs - 60_000) {\n const fresh = await refreshTokens(tokens.refresh_token);\n await saveTokens(fresh);\n return fresh.access_token;\n }\n return tokens.access_token;\n}\n\nasync function jobberGraphQL(\n accessToken: string,\n query: string,\n variables: Record,\n) {\n const res = await fetch(JOBBER_GRAPHQL_URL, {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${accessToken}`,\n \"Content-Type\": \"application/json\",\n \"X-JOBBER-GRAPHQL-VERSION\": JOBBER_API_VERSION,\n },\n body: JSON.stringify({ query, variables }),\n });\n const data = await res.json();\n console.log(\"Jobber response:\", JSON.stringify(data));\n return data;\n}\n\nfunction page(message: string, connectUrl?: string) {\n return new Response(\n `\n

Good Maid Cleaning — Jobber Connector

${message}

\n ${\n connectUrl\n ? `

Connect to Jobber

`\n : \"\"\n }\n `,\n { headers: { \"Content-Type\": \"text/html\" } },\n );\n}\n\n// A tiny \"look up Jobber's exact rules\" helper. Visit, e.g.:\n// ?schema=JobCreateInput\n// ?schema=ClientCreateInput\n// while connected, and it shows Jobber's own field list as JSON.\nasync function schemaLookup(accessToken: string, typeName: string) {\n const query = `\n query($name: String!) {\n __type(name: $name) {\n name\n kind\n description\n inputFields {\n name\n type { name kind ofType { name kind ofType { name kind } } }\n }\n fields {\n name\n type { name kind ofType { name kind ofType { name kind } } }\n }\n enumValues {\n name\n }\n }\n }\n `;\n return await jobberGraphQL(accessToken, query, { name: typeName });\n}\n\n// Looks up the exact arguments a specific mutation expects, e.g.:\n// ?mutation=jobCreate\nasync function mutationLookup(accessToken: string, fieldName: string) {\n const query = `\n query {\n __type(name: \"Mutation\") {\n fields {\n name\n args {\n name\n type { name kind ofType { name kind ofType { name kind } } }\n }\n }\n }\n }\n `;\n const result = await jobberGraphQL(accessToken, query, {});\n const fields: any[] = result?.data?.__type?.fields || [];\n const match = fields.find((f) =>\n f.name.toLowerCase() === fieldName.toLowerCase()\n );\n return match ||\n {\n error: `No mutation named \"${fieldName}\" found`,\n allMutationNames: fields.map((f) => f.name),\n };\n}\n\n// Same idea as mutationLookup, but for top-level read queries, e.g.:\n// ?query=clients\nasync function queryLookup(accessToken: string, fieldName: string) {\n const query = `\n query {\n __type(name: \"Query\") {\n fields {\n name\n args {\n name\n type { name kind ofType { name kind ofType { name kind } } }\n }\n }\n }\n }\n `;\n const result = await jobberGraphQL(accessToken, query, {});\n const fields: any[] = result?.data?.__type?.fields || [];\n const match = fields.find((f) =>\n f.name.toLowerCase() === fieldName.toLowerCase()\n );\n return match ||\n {\n error: `No query named \"${fieldName}\" found`,\n allQueryNames: fields.map((f) => f.name),\n };\n}\n\n// ───────────────── first-clean discount + cancellation ─────────────────\n// These two are called by the payment relay (server-to-server, not by the\n// browser directly) so the Jobber OAuth token never has to leave this file.\n\n// Best-effort: is there already a Jobber client whose email or phone\n// matches what was just typed into checkout? Confirmed against Jobber's\n// real Client schema (via ?schema=Client) on 2026-09-09 — the old version\n// of this function asked for fields called \"emails\" and \"phones\" that\n// don't actually exist on Client (only the singular \"email\" / \"phone\"\n// scalars do), so *every* lookup was throwing and falling back to\n// isReturning:true, blocking the discount for everyone. Address matching\n// was dropped since the real field name for street address was never\n// confirmed — email + phone are the reliable signals anyway. If this\n// still throws, the caller treats any error as \"assume returning\n// customer, no discount\" rather than letting it block checkout.\nasync function findMatchingClient(\n accessToken: string,\n email?: string,\n phone?: string,\n address?: string,\n) {\n const terms = [email, phone].filter(Boolean) as string[];\n for (const term of terms) {\n const query = `\n query($term: String!) {\n clients(searchTerm: $term, first: 5) {\n nodes {\n id\n email\n phone\n }\n }\n }\n `;\n const result = await jobberGraphQL(accessToken, query, { term });\n if (result.errors?.length) {\n throw new Error(result.errors.map((e: any) => e.message).join(\"; \"));\n }\n const nodes: any[] = result?.data?.clients?.nodes || [];\n for (const c of nodes) {\n const emailHit = email &&\n (c.email || \"\").toLowerCase() === email.toLowerCase();\n const phoneHit = phone &&\n (c.phone || \"\").replace(/\\D/g, \"\") === phone.replace(/\\D/g, \"\");\n if (emailHit || phoneHit) return true;\n }\n }\n return false;\n}\n\n// Job cancellation via Jobber's \"jobClose\" mutation. Confirmed against\n// Jobber's real schema on 2026-09-09 (via ?mutation=jobClose and\n// ?schema=JobCloseInput/IncompleteVisitDecisionEnum) — the old version of\n// this function called jobClose(jobId: $id) with no \"input\" argument at\n// all, but jobClose actually *requires* input: JobCloseInput!, so every\n// real cancellation attempt was throwing a GraphQL validation error before\n// it ever reached Jobber. It was silently falling through to the \"email\n// Henry to cancel by hand\" safety net every single time.\n//\n// JobCloseInput requires modifyIncompleteVisitsBy, one of two values:\n// DESTROY_ALL — wipes out ALL visits, including past/completed ones\n// COMPLETE_PAST_DESTROY_FUTURE — keeps a record of visits that already\n// happened, only removes the upcoming ones\n// COMPLETE_PAST_DESTROY_FUTURE is the right choice here: it preserves the\n// history of any cleanings that already took place (important for a\n// recurring plan someone cancels partway through) and only clears out the\n// visits that haven't happened yet.\n//\n// If this throws, the caller still refunds the customer and emails you to\n// remove the job from your calendar by hand, so a cleaner never shows up to\n// a cancelled job.\nasync function cancelJobberJob(accessToken: string, jobberJobId: string) {\n const mutation = `\n mutation($id: EncodedId!, $input: JobCloseInput!) {\n jobClose(jobId: $id, input: $input) {\n job { id }\n userErrors { message }\n }\n }\n `;\n const result = await jobberGraphQL(accessToken, mutation, {\n id: jobberJobId,\n input: { modifyIncompleteVisitsBy: \"COMPLETE_PAST_DESTROY_FUTURE\" },\n });\n if (result.errors?.length) {\n throw new Error(result.errors.map((e: any) => e.message).join(\"; \"));\n }\n const userErrors = result?.data?.jobClose?.userErrors;\n if (userErrors?.length) {\n throw new Error(userErrors.map((e: any) => e.message).join(\"; \"));\n }\n return true;\n}\n\n// ───────────────── webhook: a job was closed, cancelled, or removed in Jobber ─────────────────\n// Jobber calls THIS address itself the moment you close/cancel/remove a job\n// directly in Jobber — nothing on the website or from the customer starts\n// this. Confirmed against Jobber's own developer docs on 2026-09-13:\n// - Every webhook POST carries a signature header,\n// X-Jobber-Hmac-SHA256 — an HMAC-SHA256 of the exact raw request body,\n// keyed with this app's own client secret, base64-encoded. That's\n// checked FIRST, before anything in the body is trusted at all, since\n// this address is public on the internet and anyone could try posting\n// a fake \"cancel\" here otherwise.\n// - The payload shape is always\n// { data: { webHookEvent: { topic, appId, accountId, itemId, occurredAt } } }\n// \"itemId\" is the Jobber job's own id, same EncodedId format already\n// used everywhere else in this file.\n//\n// One thing Jobber's own product does NOT cleanly separate: there is no\n// dedicated \"job cancelled\" action. Cancelling a job and marking an\n// ordinary job finished are the exact same \"Close Job\" button in Jobber\n// (confirmed against Jobber's own help docs on What if a Job Gets\n// Canceled) — so the webhook topic alone can't tell you which one just\n// happened. This code tells them apart itself, with a hard rule: NEVER\n// guess in the direction that could auto-refund a real, completed job.\n// - A DESTROYED job (removed outright, not just closed) is treated as a\n// cancellation with no further check needed — a destroyed job can't be\n// \"completed.\"\n// - A CLOSED job gets looked up in Jobber (job + its visits). If any\n// visit on it was actually marked complete, that's real work\n// delivered — treated as an ordinary finished job, nothing happens.\n// If it closed with no completed visit at all, that's a confident\n// cancellation signal (removed/never-done visit) — proceed.\n// - If the lookup itself fails (Jobber's API didn't answer, token\n// issue, etc.) this is graded \"uncertain\" — NOT auto-cancelled and\n// NOT auto-refunded. The booking relay just emails Henry to check by\n// hand. Silence is the safe failure mode here, not a guess.\nconst JOB_CLOSE_TOPICS = [\"JOB_CLOSE\", \"JOB_CLOSED\"];\nconst JOB_DESTROY_TOPICS = [\n \"JOB_DESTROY\",\n \"JOB_DELETE\",\n \"JOB_DELETED\",\n \"JOB_REMOVE\",\n \"JOB_REMOVED\",\n];\n\nasync function verifyJobberSignature(\n rawBody: string,\n signatureHeader: string,\n): Promise {\n if (!CLIENT_SECRET || !signatureHeader) return false;\n try {\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(CLIENT_SECRET),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const sigBuffer = await crypto.subtle.sign(\n \"HMAC\",\n key,\n new TextEncoder().encode(rawBody),\n );\n const bytes = new Uint8Array(sigBuffer);\n let binary = \"\";\n for (let i = 0; i < bytes.length; i++) {\n binary += String.fromCharCode(bytes[i]);\n }\n const computed = btoa(binary);\n if (computed.length !== signatureHeader.length) return false;\n // Constant-time-ish comparison — no early-exit on the first mismatch.\n let diff = 0;\n for (let i = 0; i < computed.length; i++) {\n diff |= computed.charCodeAt(i) ^ signatureHeader.charCodeAt(i);\n }\n return diff === 0;\n } catch (err: any) {\n console.log(\"Signature verification threw:\", err.message || String(err));\n return false;\n }\n}\n\nasync function fetchJobWithVisits(accessToken: string, jobberJobId: string) {\n const query = `\n query($id: EncodedId!) {\n job(id: $id) {\n id\n jobStatus\n visits(first: 50) {\n nodes { id status startAt completedAt }\n }\n }\n }\n `;\n const result = await jobberGraphQL(accessToken, query, { id: jobberJobId });\n if (result.errors?.length) {\n throw new Error(result.errors.map((e: any) => e.message).join(\"; \"));\n }\n return result?.data?.job || null;\n}\n\n// True only when Jobber itself shows real completed work on this job.\nfunction jobHasCompletedVisit(job: any): boolean {\n const visits: any[] = job?.visits?.nodes || [];\n return visits.some((v) =>\n (v.status || \"\").toUpperCase() === \"COMPLETE\" || !!v.completedAt\n );\n}\n\nasync function notifyBookingEngine(\n jobberJobId: string,\n certainty: \"completed\" | \"cancelled\" | \"uncertain\",\n) {\n const res = await fetch(BOOKING_ENGINE_URL, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ action: \"jobberJobClosed\", jobberJobId, certainty }),\n });\n return await res.json().catch(() => ({}));\n}\n\nasync function handleJobberWebhook(\n rawBody: string,\n signatureHeader: string,\n): Promise {\n const ok = await verifyJobberSignature(rawBody, signatureHeader);\n if (!ok) {\n console.log(\"Webhook signature did not verify — ignoring request.\");\n return new Response(\"Invalid signature\", { status: 401 });\n }\n\n let payload: any;\n try {\n payload = JSON.parse(rawBody);\n } catch {\n return new Response(\"Bad JSON\", { status: 400 });\n }\n const event = payload?.data?.webHookEvent;\n const topic = String(event?.topic || \"\").toUpperCase();\n const itemId = event?.itemId;\n console.log(\"Jobber webhook received:\", topic, itemId);\n\n // Always answer 200 once the signature is good — Jobber retries\n // non-2xx responses, and nothing below should ever need a retry.\n const ack = (extra: Record = {}) =>\n Response.json({ received: true, topic, ...extra });\n\n const isCloseTopic = JOB_CLOSE_TOPICS.includes(topic) ||\n (topic.startsWith(\"JOB_\") && topic.includes(\"CLOSE\"));\n const isDestroyTopic = JOB_DESTROY_TOPICS.includes(topic) ||\n (topic.startsWith(\"JOB_\") &&\n (topic.includes(\"DESTROY\") || topic.includes(\"DELETE\") ||\n topic.includes(\"REMOV\")));\n\n if (!isCloseTopic && !isDestroyTopic) return ack({ ignored: true }); // some other event topic — nothing to do\n if (!itemId) return ack({ ignored: true, reason: \"no itemId on event\" });\n\n try {\n let certainty: \"completed\" | \"cancelled\" | \"uncertain\" = \"uncertain\";\n if (isDestroyTopic) {\n certainty = \"cancelled\"; // a destroyed job can't be \"completed\" — no lookup needed\n } else {\n const accessToken = await getValidAccessToken();\n if (accessToken) {\n try {\n const job = await fetchJobWithVisits(accessToken, itemId);\n certainty = jobHasCompletedVisit(job) ? \"completed\" : \"cancelled\";\n } catch (err: any) {\n console.log(\n \"fetchJobWithVisits failed — grading uncertain:\",\n err.message || String(err),\n );\n certainty = \"uncertain\";\n }\n }\n }\n const result = await notifyBookingEngine(itemId, certainty);\n return ack({ forwarded: true, certainty, result });\n } catch (err: any) {\n console.log(\"Webhook handling error:\", err.message || String(err));\n return ack({ error: err.message || String(err) });\n }\n}\n\n// A tiny \"peek at the exact webhook topic names\" helper, same idea as the\n// schema/mutation lookups above — visit `?webhooktopics=1` once while\n// connected to see Jobber's own real list of topic names, so the guesses\n// baked into JOB_CLOSE_TOPICS/JOB_DESTROY_TOPICS above can be checked\n// against the real thing instead of trusted blindly. If any real topic\n// name doesn't already contain \"CLOSE\"/\"DESTROY\"/\"DELETE\"/\"REMOV\" the way\n// this code expects, send the list back to Claude to adjust the match.\nasync function webhookTopicsLookup(accessToken: string) {\n const query = `\n query {\n __type(name: \"WebHookTopicEnum\") {\n enumValues { name }\n }\n }\n `;\n const result = await jobberGraphQL(accessToken, query, {});\n const values: any[] = result?.data?.__type?.enumValues || [];\n return {\n allTopics: values.map((v: any) => v.name),\n jobTopics: values.map((v: any) => v.name).filter((n: string) =>\n n.startsWith(\"JOB_\")\n ),\n };\n}\n\n// ───────────────────────── the actual handler ─────────────────────────\n\n// Lets your website (or a quick test page) call this address from a browser.\nconst CORS_HEADERS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"POST, GET, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n};\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const redirectUri = baseUrl(req);\n\n // Browsers send this automatically before a real POST — just say \"go ahead\"\n if (req.method === \"OPTIONS\") {\n return new Response(null, { headers: CORS_HEADERS });\n }\n\n // Jobber sending you back after you click \"Allow Access\"\n const code = url.searchParams.get(\"code\");\n if (req.method === \"GET\" && code) {\n try {\n const tokens = await exchangeCodeForTokens(code, redirectUri);\n await saveTokens(tokens);\n return page(\n \"✅ Connected to Jobber! You can close this tab — bookings from your website will now be sent here automatically.\",\n );\n } catch (err: any) {\n return page(\n \"❌ Something went wrong connecting to Jobber: \" + err.message +\n \"

Screenshot this and send it to Claude.\",\n );\n }\n }\n\n // Peek at Jobber's exact field names for a given input type\n const schemaType = url.searchParams.get(\"schema\");\n if (req.method === \"GET\" && schemaType) {\n const accessToken = await getValidAccessToken();\n if (!accessToken) {\n return page(\n \"Not connected to Jobber yet — connect first.\",\n `${JOBBER_AUTH_URL}?response_type=code&client_id=${CLIENT_ID}&redirect_uri=${\n encodeURIComponent(redirectUri)\n }&state=setup`,\n );\n }\n const result = await schemaLookup(accessToken, schemaType);\n return Response.json(result);\n }\n\n // Peek at the exact arguments a mutation expects\n const mutationName = url.searchParams.get(\"mutation\");\n if (req.method === \"GET\" && mutationName) {\n const accessToken = await getValidAccessToken();\n if (!accessToken) {\n return page(\n \"Not connected to Jobber yet — connect first.\",\n `${JOBBER_AUTH_URL}?response_type=code&client_id=${CLIENT_ID}&redirect_uri=${\n encodeURIComponent(redirectUri)\n }&state=setup`,\n );\n }\n const result = await mutationLookup(accessToken, mutationName);\n return Response.json(result);\n }\n\n // Peek at the exact arguments a read query expects (e.g. ?query=clients)\n const queryName = url.searchParams.get(\"query\");\n if (req.method === \"GET\" && queryName) {\n const accessToken = await getValidAccessToken();\n if (!accessToken) {\n return page(\n \"Not connected to Jobber yet — connect first.\",\n `${JOBBER_AUTH_URL}?response_type=code&client_id=${CLIENT_ID}&redirect_uri=${\n encodeURIComponent(redirectUri)\n }&state=setup`,\n );\n }\n const result = await queryLookup(accessToken, queryName);\n return Response.json(result);\n }\n\n // Peek at Jobber's real webhook topic names (see webhookTopicsLookup above)\n if (req.method === \"GET\" && url.searchParams.has(\"webhooktopics\")) {\n const accessToken = await getValidAccessToken();\n if (!accessToken) {\n return page(\n \"Not connected to Jobber yet — connect first.\",\n `${JOBBER_AUTH_URL}?response_type=code&client_id=${CLIENT_ID}&redirect_uri=${\n encodeURIComponent(redirectUri)\n }&state=setup`,\n );\n }\n const result = await webhookTopicsLookup(accessToken);\n return Response.json(result);\n }\n\n // Plain visit with no code — show connect button or \"already connected\"\n if (req.method === \"GET\") {\n const authUrl =\n `${JOBBER_AUTH_URL}?response_type=code&client_id=${CLIENT_ID}&redirect_uri=${\n encodeURIComponent(redirectUri)\n }&state=setup`;\n const tokens = await getTokens();\n if (tokens && !url.searchParams.has(\"reconnect\")) {\n return page(\n \"✅ Already connected to Jobber. Bookings from your website are sent here automatically.

Just changed your app's scopes/permissions in Jobber's Developer Center? Click here to reconnect and pick those changes up.',\n );\n }\n return page(\n 'Click the button, then click \"Allow Access\" on Jobber\\'s page.',\n authUrl,\n );\n }\n\n // A real booking coming in from the website — OR Jobber's own webhook\n // telling us a job was closed/cancelled/removed. Told apart by the\n // signature header only Jobber's real webhook requests carry; a normal\n // booking POST from the site never has this header.\n if (req.method === \"POST\") {\n const signatureHeader = req.headers.get(\"x-jobber-hmac-sha256\");\n if (signatureHeader) {\n const rawBody = await req.text();\n return await handleJobberWebhook(rawBody, signatureHeader);\n }\n\n const json = (data: any, status = 200) =>\n Response.json(data, { status, headers: CORS_HEADERS });\n try {\n const booking = await req.json();\n\n // These two actions are called by the payment relay, server-to-server\n // — not by the customer's browser — so they're handled first, before\n // the default \"create a booking\" behavior below.\n if (booking.action === \"checkClient\") {\n try {\n const accessToken = await getValidAccessToken();\n if (!accessToken) {\n return json({\n isReturning: false,\n error: \"Not connected to Jobber\",\n });\n }\n const isReturning = await findMatchingClient(\n accessToken,\n booking.email,\n booking.phone,\n booking.address,\n );\n return json({ isReturning });\n } catch (err: any) {\n console.log(\n \"checkClient failed, defaulting to isReturning:true (no discount):\",\n err.message || String(err),\n );\n return json({ isReturning: true, error: err.message || String(err) });\n }\n }\n if (booking.action === \"cancelJob\") {\n try {\n const accessToken = await getValidAccessToken();\n if (!accessToken) {\n return json({ ok: false, error: \"Not connected to Jobber\" }, 400);\n }\n await cancelJobberJob(accessToken, booking.jobberJobId);\n return json({ ok: true });\n } catch (err: any) {\n console.log(\"cancelJob failed:\", err.message || String(err));\n return json({ ok: false, error: err.message || String(err) }, 400);\n }\n }\n\n console.log(\"Incoming booking:\", JSON.stringify(booking));\n\n const accessToken = await getValidAccessToken();\n if (!accessToken) {\n return json(\n {\n ok: false,\n error:\n \"Not connected to Jobber yet. Visit this address in a browser once and click Connect.\",\n },\n 400,\n );\n }\n\n if (!booking.address) {\n return json({\n ok: false,\n error:\n \"Booking is missing a service address — Jobber needs one to create a job.\",\n }, 400);\n }\n\n // 1) Create the client record, along with a \"property\" (Jobber's name\n // for a service address) at the same time.\n const clientMutation = `\n mutation($input: ClientCreateInput!) {\n clientCreate(input: $input) {\n client {\n id\n firstName\n lastName\n properties { id }\n jobberWebUri\n }\n userErrors { message path }\n }\n }\n `;\n const clientInput: Record = {\n firstName: booking.firstName || \"\",\n lastName: booking.lastName || \"\",\n properties: [\n {\n address: {\n street1: booking.address.street || \"\",\n city: booking.address.city || \"\",\n province: booking.address.province || \"\",\n postalCode: booking.address.postalCode || \"\",\n country: booking.address.country || \"Canada\",\n },\n },\n ],\n };\n if (booking.email) {\n clientInput.emails = [{\n description: \"MAIN\",\n primary: true,\n address: booking.email,\n }];\n }\n if (booking.phone) {\n clientInput.phones = [{\n description: \"MAIN\",\n primary: true,\n number: booking.phone,\n }];\n }\n\n const clientResult = await jobberGraphQL(accessToken, clientMutation, {\n input: clientInput,\n });\n const clientTopErrors = clientResult.errors;\n const clientUserErrors = clientResult?.data?.clientCreate?.userErrors;\n if (clientTopErrors?.length || clientUserErrors?.length) {\n return json(\n {\n ok: false,\n step: \"clientCreate\",\n error: clientTopErrors || clientUserErrors,\n },\n 400,\n );\n }\n const client = clientResult.data.clientCreate.client;\n const clientId = client.id;\n const propertyId = client.properties?.[0]?.id;\n if (!propertyId) {\n return json({\n ok: false,\n step: \"clientCreate\",\n error:\n \"Client was created but no property/address came back with it.\",\n clientId,\n }, 400);\n }\n\n // 2) Create the job at that property — now with a real scheduled visit\n // and a real priced line item, instead of stuffing the date/time/price\n // into a plain-text note. This is what makes the job show up already\n // scheduled on your calendar, instead of sitting in \"Action Required\".\n const instructionsParts = [\n // The site's own booking reference (e.g. \"GM-AB3XZ9\") — same one on\n // the confirmation email, cancel link, and admin tool — goes first\n // so this job can always be matched back to a booking on the site.\n booking.reference && `Booking ref: ${booking.reference}`,\n booking.notes,\n booking.scheduledDate && `Requested date: ${booking.scheduledDate}`,\n booking.scheduledTime && `Requested time: ${booking.scheduledTime}`,\n ].filter(Boolean);\n\n // Roughly how long the crew will be on site, estimated from the quoted\n // price rather than a flat guess — bigger/pricier jobs get more time on\n // the calendar. $45/hour is a placeholder assumed crew rate; change\n // just this one number if the real rate is different.\n const ASSUMED_HOURLY_RATE = 45;\n const MIN_JOB_HOURS = 1;\n const MAX_JOB_HOURS = 6;\n function estimateJobHours(price?: number) {\n if (!price) return 2; // no price given — fall back to a plain 2-hour guess\n const raw = price / ASSUMED_HOURLY_RATE;\n const clamped = Math.min(MAX_JOB_HOURS, Math.max(MIN_JOB_HOURS, raw));\n return Math.round(clamped * 4) / 4; // nearest 15 minutes\n }\n\n // Converts a time like \"10:00 AM\" into 24-hour \"10:00:00\", and returns\n // an end time `durationHours` later.\n function parseTimeRange(\n timeStr: string | undefined,\n durationHours: number,\n ) {\n if (!timeStr) return null;\n const m = /^(\\d{1,2}):(\\d{2})\\s*(AM|PM)?$/i.exec(timeStr.trim());\n if (!m) return null;\n let hour = parseInt(m[1], 10);\n let minute = parseInt(m[2], 10);\n const ampm = (m[3] || \"\").toUpperCase();\n if (ampm === \"PM\" && hour !== 12) hour += 12;\n if (ampm === \"AM\" && hour === 12) hour = 0;\n const pad = (n: number) => String(n).padStart(2, \"0\");\n const start = `${pad(hour)}:${pad(minute)}:00`;\n const totalStartMin = hour * 60 + minute;\n const totalEndMin = totalStartMin + Math.round(durationHours * 60);\n const endHour = Math.floor(totalEndMin / 60) % 24;\n const endMinute = totalEndMin % 60;\n const end = `${pad(endHour)}:${pad(endMinute)}:00`;\n return { start, end };\n }\n const jobHours = estimateJobHours(booking.quotedPrice);\n const timeRange = parseTimeRange(booking.scheduledTime, jobHours);\n\n const jobMutation = `\n mutation($input: JobCreateAttributes!) {\n jobCreate(input: $input) {\n job { id jobNumber }\n userErrors { message path }\n }\n }\n `;\n // Repeat customers (weekly/biweekly/monthly) get a real recurring\n // schedule instead of a single one-off visit — Jobber takes a standard\n // calendar \"RRULE\" string for this.\n // Jobber requires the \"RRULE:\" prefix on these — leaving it off is\n // what caused the first attempt to fail with a scheduling.recurrence error.\n const RECURRENCE_RULES: Record = {\n weekly: \"RRULE:FREQ=WEEKLY;INTERVAL=1\",\n biweekly: \"RRULE:FREQ=WEEKLY;INTERVAL=2\",\n monthly: \"RRULE:FREQ=MONTHLY;INTERVAL=1\",\n };\n const isRecurring = !!booking.recurring &&\n RECURRENCE_RULES[booking.frequency];\n\n const jobInput: Record = {\n propertyId,\n title: booking.serviceType || \"Cleaning\",\n instructions: instructionsParts.join(\"\\n\"),\n // One-off cleanings are invoiced once the job's marked done. Recurring\n // cleanings bill per visit instead, since the job itself never \"ends\" —\n // Jobber requires invoicingType: VISIT_BASED to go with PER_VISIT.\n invoicing: isRecurring\n ? { invoicingType: \"VISIT_BASED\", invoicingSchedule: \"PER_VISIT\" }\n : {\n invoicingType: \"FIXED_PRICE\",\n invoicingSchedule: \"ON_COMPLETION\",\n },\n };\n if (isRecurring) {\n // Jobber requires an explicit duration whenever recurrence is set,\n // since each repeat instance needs to know how long the visit runs.\n jobInput.arrivalWindow = {\n durationInMinutes: Math.round(jobHours * 60),\n };\n }\n if (booking.quotedPrice) {\n jobInput.lineItems = [\n {\n name: booking.serviceType || \"Cleaning\",\n unitPrice: booking.quotedPrice,\n quantity: 1,\n saveToProductsAndServices: false,\n },\n ];\n }\n if (booking.scheduledDate) {\n jobInput.timeframe = { startAt: booking.scheduledDate };\n // A recurring job needs an overall duration too, separate from each\n // visit's length — this is the length of the ongoing plan itself.\n // Using 1 year as a placeholder \"runs indefinitely until cancelled\"\n // window; customers can cancel/pause anytime per the site's copy.\n if (isRecurring) {\n jobInput.timeframe.durationValue = 1;\n jobInput.timeframe.durationUnits = \"YEARS\";\n }\n }\n if (timeRange) {\n jobInput.scheduling = {\n createVisits: true,\n notifyTeam: false,\n startTime: timeRange.start,\n endTime: timeRange.end,\n ...(isRecurring\n ? { recurrence: RECURRENCE_RULES[booking.frequency] }\n : {}),\n };\n }\n\n const jobResult = await jobberGraphQL(accessToken, jobMutation, {\n input: jobInput,\n });\n const jobTopErrors = jobResult.errors;\n const jobUserErrors = jobResult?.data?.jobCreate?.userErrors;\n if (jobTopErrors?.length || jobUserErrors?.length) {\n return json(\n {\n ok: false,\n step: \"jobCreate\",\n error: jobTopErrors || jobUserErrors,\n clientId,\n propertyId,\n },\n 400,\n );\n }\n\n return json({\n ok: true,\n clientId,\n propertyId,\n job: jobResult.data.jobCreate.job,\n // Link to the customer's own Jobber account page — once Jobber\n // Payments + Wallet is turned on, this is where they add their card.\n clientPortalUrl: client.jobberWebUri || null,\n });\n } catch (err: any) {\n console.log(\"Booking handler error:\", err.message || String(err));\n return json({ ok: false, error: err.message || String(err) }, 500);\n }\n }\n\n return page(\"Nothing to see here.\");\n}","deleted",false,"label",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":59,"_18":60},["D",1789321957376],"children",[],[35],"98d33484-67a1-4e15-b5e2-908bdd4db21c",["D",1788638314493],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","2cd2bd26-9686-4dcd-a759-914e239335a0","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a07323-8ac8-72a9-899a-bc2445c41a3d","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_113":19},"org",{"_11":12,"_108":19,"_109":19,"_70":71,"_110":111,"_112":53},"branch",{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":61,"_13":14,"_45":147,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":37,"_73":44,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":148,"_95":149,"_97":150,"_99":53},[144],"files",[144],"counts",{"_134":77,"_135":136,"_137":77,"_31":138,"_139":140},[132],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":133},[35],"pulls","branches",1,"forks",{"_141":77,"_143":77},"connections",{"_141":77,"_142":77},"count","unfilledCount","emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":145,"_18":146},[],[35],["D",1788638314493],{"_11":12,"_113":19},{"_11":12,"_108":19,"_109":19,"_70":71,"_110":111,"_112":53},{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"ctx",{"_93":-5,"_129":184,"_185":186,"_187":188,"_189":53,"_190":53,"_191":53,"_192":44,"_193":-5,"_194":-7,"_195":-7,"_196":77,"_197":53,"_198":53,"_199":-5,"_200":53,"_201":53,"_202":53,"_203":-5},"ENV",{"_155":156,"_157":158,"_159":16,"_160":161,"_162":163,"_164":165,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]