[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_174":175,"_176":177},"routes/_app.x.$handle.$name",{"_100":99,"_32":45,"_109":90,"_27":110,"_13":14,"_111":-5,"_11":112,"_113":114,"_115":116,"_117":118,"_119":120,"_20":-5,"_121":-5,"_122":-5,"_123":25,"_124":125,"_126":59,"_127":-5,"_128":-5,"_129":130},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":25},"version",62,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","lib.ts","latestPath","fileId","10716ac4-6c0e-11f1-ac5f-1607ee4eb77e","name","fileType","script","content","// LeadPulse — shared helpers for the webhook-receiver val (imported by main.ts).\n// Split out to stay under Val.town's 80,000-char per-file limit.\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\n\n// GSM-7 character set (single-byte SMS alphabet) + the 2-byte extension chars.\nconst GSM_EXT = \"^{}\\\\[~]|€\";\nconst GSM_BASE = \"@£$¥èéùìòÇ\\nØø\\rÅåΔ_ΦΓΛΩΠΨΣΘΞ ÆæßÉ !\\\"#¤%&'()*+,-./0123456789:;<=>?¡ABCDEFGHIJKLMNOPQRSTUVWXYZÄÖÑÜ§¿abcdefghijklmnopqrstuvwxyzäöñüà\";\nconst GSM_CHARS = new Set((GSM_BASE + GSM_EXT).split(\"\"));\n\n// Convert text to a GSM-7-safe form so it stays cheap (1 segment / 160 chars)\n// instead of flipping to Unicode (1 segment / 70 chars). Maps smart punctuation\n// to plain equivalents and strips emojis / other non-GSM characters.\nexport function gsmify(text: string): string {\n if (!text) return text;\n let t = String(text)\n .replace(/[‘’‚′‵]/g, \"'\")\n .replace(/[“”„″]/g, '\"')\n .replace(/[–—―]/g, \"-\")\n .replace(/…/g, \"...\")\n .replace(/[ ]/g, \" \")\n .replace(/[•·]/g, \"-\")\n .replace(/™/g, \"(TM)\").replace(/®/g, \"(R)\").replace(/©/g, \"(C)\");\n t = Array.from(t).filter((ch) => GSM_CHARS.has(ch)).join(\"\");\n return t.replace(/[ \\t]{2,}/g, \" \").replace(/ +\\n/g, \"\\n\").trim();\n}\n\n// OpenAI model used for extraction, replies, opener suggestions.\nexport const AI_MODEL = \"gpt-4o-mini\"; // swap to \"gpt-4o\" for higher quality\n\n// Verify a Telnyx webhook's Ed25519 signature so only genuine Telnyx events are\n// processed. Telnyx signs `${timestamp}|${rawBody}` with its account key; the\n// portal gives the public key base64-encoded, as is the signature header.\n// Returns false (never throws) on any problem, so the caller can simply reject.\nexport async function verifyTelnyxSignature(\n publicKeyB64: string,\n signatureB64: string,\n timestamp: string,\n rawBody: string,\n): Promise {\n try {\n if (!publicKeyB64 || !signatureB64 || !timestamp) return false;\n const b64ToBytes = (b64: string) => Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));\n const key = await crypto.subtle.importKey(\n \"raw\", b64ToBytes(publicKeyB64), { name: \"Ed25519\" }, false, [\"verify\"],\n );\n const signed = new TextEncoder().encode(`${timestamp}|${rawBody}`);\n return await crypto.subtle.verify(\"Ed25519\", key, b64ToBytes(signatureB64), signed);\n } catch (e) {\n console.error(\"Telnyx sig verify error\", e);\n return false;\n }\n}\n\n// The Titan Mode automation roles the scraper can recommend, with a short\n// description so the model picks the best fits for a given business.\nexport const USE_CASE_CATALOG =\n \"- speed-to-lead: instantly reply to brand-new web/enquiry leads\\n\" +\n \"- reactivation: re-engage old / cold leads from their database\\n\" +\n \"- follow-up: chase leads who went quiet after first contact\\n\" +\n \"- reputation: ask happy customers for Google reviews\\n\" +\n \"- missed-call: auto text-back people whose calls were missed\";\n\n// Fetch a website and have the AI extract structured business data. Shared by\n// the single-agent builder (/api/agent/scrape) and Titan Mode (/api/hulk). Also\n// infers the target audience and the 2-3 automation use-cases the business needs\n// most (from USE_CASE_CATALOG).\nexport async function scrapeSite(rawUrl: string): Promise<{ ok: true; data: any } | { ok: false; error: string; status: number }> {\n let target = String(rawUrl || \"\").trim();\n if (!target) return { ok: false, error: \"url required\", status: 400 };\n if (!/^https?:\\/\\//i.test(target)) target = \"https://\" + target;\n const apiKey = Deno.env.get(\"OPENAI_API_KEY\");\n if (!apiKey) return { ok: false, error: \"OPENAI_API_KEY not set\", status: 400 };\n\n let pageText = \"\";\n try {\n const pageRes = await fetch(target, { headers: { \"User-Agent\": \"Mozilla/5.0 LeadPulseBot\" } });\n if (!pageRes.ok) return { ok: false, error: `Could not fetch site (HTTP ${pageRes.status})`, status: 400 };\n const html = await pageRes.text();\n pageText = html\n .replace(//gi, \" \")\n .replace(//gi, \" \")\n .replace(/<[^>]+>/g, \" \")\n .replace(/ /g, \" \").replace(/&/g, \"&\").replace(/&[a-z]+;/gi, \" \")\n .replace(/\\s+/g, \" \").trim().slice(0, 7000);\n } catch {\n return { ok: false, error: \"Could not reach that website.\", status: 400 };\n }\n if (pageText.length < 40) return { ok: false, error: \"That page had almost no readable text.\", status: 400 };\n\n try {\n const sys =\n \"You analyse a business website to set up SMS marketing automations. \" +\n \"Return ONLY JSON. Prefer SPECIFIC service categories (e.g. 'Residential solar installation', not 'home services'); \" +\n \"split vague umbrellas into specifics. Identify free/low-commitment lead magnets (e.g. 'Free energy audit') — these make the best reactivation hooks. \" +\n \"Recommend the single best offer to reactivate old leads, favouring a free hook if one exists. \" +\n \"Also infer the target_audience (who their customers are, e.g. 'homeowners 35-65 in the Midlands'). \" +\n \"And pick the 2-3 automation use-cases this business needs MOST, choosing each `role` from this list:\\n\" +\n USE_CASE_CATALOG +\n \"\\nReturn them best-fit first with a one short sentence `reason` each, specific to THIS business.\";\n const schema =\n '{\"business_name\":string,\"description\":string,\"services\":string[],\"lead_magnets\":string[],' +\n '\"faqs\":[{\"q\":string,\"a\":string}],\"contact\":{\"phone\":string,\"hours\":string,\"location\":string,\"booking_link\":string},' +\n '\"tone\":string,\"recommended_offer\":string,\"recommended_reason\":string,\"target_audience\":string,' +\n '\"recommended_use_cases\":[{\"role\":string,\"reason\":string}]}';\n const aiRes = await fetch(\"https://api.openai.com/v1/chat/completions\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", \"Authorization\": `Bearer ${apiKey}` },\n body: JSON.stringify({\n model: AI_MODEL,\n response_format: { type: \"json_object\" },\n messages: [\n { role: \"system\", content: `${sys}\\nJSON shape: ${schema}` },\n { role: \"user\", content: `Website text:\\n${pageText}` },\n ],\n }),\n });\n if (!aiRes.ok) return { ok: false, error: `AI extraction failed (HTTP ${aiRes.status})`, status: 400 };\n const data = await aiRes.json();\n const parsed = JSON.parse(data.choices?.[0]?.message?.content || \"{}\");\n return { ok: true, data: parsed };\n } catch (e) {\n console.error(\"scrape extract error\", e);\n return { ok: false, error: \"Could not analyse that site.\", status: 400 };\n }\n}\n\n// Turn the scrape's structured data into one plain-text knowledge blob that\n// every agent in the squad shares.\nexport function buildKnowledgeFromScrape(d: any): string {\n const parts: string[] = [];\n if (d?.description) parts.push(String(d.description));\n if (Array.isArray(d?.services) && d.services.length) parts.push(`Services: ${d.services.join(\", \")}.`);\n if (Array.isArray(d?.lead_magnets) && d.lead_magnets.length) parts.push(`Free / low-commitment offers: ${d.lead_magnets.join(\", \")}.`);\n const c = d?.contact || {};\n const contactBits = [c.hours && `Hours: ${c.hours}`, c.location && `Location: ${c.location}`, c.phone && `Phone: ${c.phone}`].filter(Boolean);\n if (contactBits.length) parts.push(contactBits.join(\" | \"));\n if (Array.isArray(d?.faqs) && d.faqs.length) {\n parts.push(\"FAQs:\\n\" + d.faqs.slice(0, 8).map((f: any) => `Q: ${f.q}\\nA: ${f.a}`).join(\"\\n\"));\n }\n return parts.join(\"\\n\").slice(0, 6000);\n}\n\n// ---- Hulk Mode -------------------------------------------------------------\n// One website scrape spawns this whole squad of role-specialised agents. They\n// all share the SAME knowledge base (from the scrape) but each has a distinct\n// job: goal, guardrails, and style dials. All roles are `channel: 'sms'` and\n// live immediately. (The `coming_soon` channel value is retained in the type\n// only for backward-compat with older agents already in the DB.)\n// `goalFor(offer)` bakes the focus offer in.\nexport const HULK_ROLES: Array<{\n role: string; label: string; emoji: string; channel: \"sms\" | \"coming_soon\";\n personality: string; persuasion: string; reply_length: number;\n goalFor: (offer: string) => string; guardrails: string;\n}> = [\n {\n role: \"speed-to-lead\", label: \"Speed to Lead\", emoji: \"⚡\", channel: \"sms\",\n personality: \"personable\", persuasion: \"balanced\", reply_length: 2,\n goalFor: (o) => `respond instantly to this brand-new enquiry, answer what they asked${o ? ` about ${o}` : \"\"}, quickly qualify them, and book a call or appointment while they're still hot`,\n guardrails: \"Reply fast and acknowledge their specific enquiry first. Ask one quick question at a time. Aim to lock in a time, not just chat.\",\n },\n {\n role: \"reactivation\", label: \"Database Reactivation\", emoji: \"🔁\", channel: \"sms\",\n personality: \"balanced\", persuasion: \"balanced\", reply_length: 3,\n goalFor: (o) => `re-engage this past/cold lead${o ? ` about ${o}` : \"\"} and, if they're still interested, set up a quick chat or booking`,\n guardrails: \"Open with a warm, low-pressure re-introduction. It's been a while, so don't assume they remember every detail.\",\n },\n {\n role: \"follow-up\", label: \"48-Hour Follow-Up\", emoji: \"⏱️\", channel: \"sms\",\n personality: \"personable\", persuasion: \"helpful\", reply_length: 2,\n goalFor: (o) => `gently follow up with this lead who went quiet, re-open the conversation${o ? ` about ${o}` : \"\"}, and move them toward booking`,\n guardrails: \"Be light and no-pressure — one friendly nudge, not a chase. Reference the earlier conversation so it feels personal.\",\n },\n {\n role: \"reputation\", label: \"48-Hour Reputation\", emoji: \"⭐\", channel: \"sms\",\n personality: \"personable\", persuasion: \"helpful\", reply_length: 2,\n goalFor: (_o) => \"thank a recent happy customer and invite them to leave a quick Google review, sharing the review link\",\n guardrails: \"Only ask for a review ONCE, never pressure. If the customer seems unhappy, do NOT push for a public review — apologise and offer to have the owner call them to put things right.\",\n },\n {\n role: \"missed-call\", label: \"Missed-Call Text-Back\", emoji: \"📞\", channel: \"sms\",\n personality: \"personable\", persuasion: \"balanced\", reply_length: 2,\n goalFor: (o) => `we just missed their call — text them back fast, apologise for missing them, find out what they needed${o ? ` (likely ${o})` : \"\"}, and book them in or get them an answer`,\n guardrails: \"Lead with a quick apology for missing the call. Keep it short and human. One question to find out what they needed.\",\n },\n];\n\n// --- Pure helpers (moved from main.ts to stay under Val.town's 80k file limit).\n// None touch the DB or any main.ts state, so they behave identically here.\nexport function cors(body: string | object, status = 200, contentType = \"application/json\") {\n const headers = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, Authorization\",\n \"Content-Type\": contentType === \"application/json\" ? \"application/json\" : contentType,\n };\n // 204/304 are \"no body\" statuses — Deno throws \"null body status cannot have\n // body\" if you pass even an empty string (the OPTIONS preflight uses 204).\n const noBody = status === 204 || status === 304;\n const bodyStr = noBody ? null : (typeof body === \"string\" ? body : JSON.stringify(body));\n return new Response(bodyStr, { status, headers });\n}\nexport function esc(s: string): string {\n return String(s).replace(/[&<>\"]/g, (c) => ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\" }[c]!));\n}\nexport function firstName(name: string | null): string {\n if (!name) return \"there\";\n return name.trim().split(/\\s+/)[0] || \"there\";\n}\n// Normalise UK numbers to E.164 (mirrors the frontend CSV parser).\nexport function normalizePhone(raw: string): string {\n let p = String(raw).replace(/[\\s()-]/g, \"\");\n if (p.startsWith(\"07\")) p = \"+44\" + p.slice(1);\n else if (p.startsWith(\"447\")) p = \"+\" + p;\n else if (p.startsWith(\"0\")) p = \"+44\" + p.slice(1);\n return p;\n}\nexport function applyTemplate(template: string, lead: { name: string | null; phone_number: string }): string {\n return (template || \"\")\n .replace(/\\{first_name\\}/gi, firstName(lead.name))\n .replace(/\\{name\\}/gi, lead.name || firstName(lead.name));\n}\nexport function domainOf(url: string): string {\n const raw = String(url || \"\").trim();\n if (!raw) return \"\";\n try {\n const u = new URL(/^https?:\\/\\//i.test(raw) ? raw : \"https://\" + raw);\n return u.hostname.replace(/^www\\./i, \"\").toLowerCase();\n } catch { return \"\"; }\n}\nexport function replyLenInstruction(n: number): string {\n if (n <= 1) return \"Reply in a single short sentence.\";\n if (n === 2) return \"Keep replies to 1-2 short sentences.\";\n return \"Replies can be 1-3 short sentences.\";\n}\nexport function replyMaxTokens(n: number): number { return n <= 1 ? 80 : n === 2 ? 160 : 300; }\n\n// Which channel a from-number sends through: 'gateway' (an Android phone via\n// sms-gate.app) or 'telnyx' (default). Read from the shared `numbers.channel`\n// column (added by the gateway-sms val). Any problem => 'telnyx' so sending\n// never breaks if the column/row is missing.\nasync function channelForNumber(from?: string | null): Promise {\n if (!from) return \"telnyx\";\n try {\n const r = await sqlite.execute({ sql: `SELECT channel FROM numbers WHERE phone_number = ?`, args: [from] });\n const row = (r.rows as any[])[0];\n return row && row[0] ? String(row[0]) : \"telnyx\";\n } catch {\n return \"telnyx\";\n }\n}\n\n// Send an SMS through the mobile gateway (sms-gate.app cloud → the phone's SIM).\n// Returns true on success. Never throws. Needs SMSGATE_USER/SMSGATE_PASS env.\nasync function sendViaGateway(to: string, text: string): Promise {\n const user = Deno.env.get(\"SMSGATE_USER\");\n const pass = Deno.env.get(\"SMSGATE_PASS\");\n if (!user || !pass) {\n console.error(\"sendViaGateway: missing SMSGATE_USER / SMSGATE_PASS\");\n return false;\n }\n try {\n const res = await fetch(\"https://api.sms-gate.app/3rdparty/v1/messages\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", \"Authorization\": \"Basic \" + btoa(`${user}:${pass}`) },\n body: JSON.stringify({ textMessage: { text: gsmify(text) }, phoneNumbers: [to] }),\n });\n if (!res.ok) {\n console.error(\"sms-gate send failed\", res.status, await res.text());\n return false;\n }\n return true;\n } catch (e) {\n console.error(\"sms-gate send error\", e);\n return false;\n }\n}\n\n// Send an SMS. Routes by the from-number's channel: gateway numbers go through\n// the phone (sms-gate.app), everything else through Telnyx v2. Returns true on\n// success. Never throws.\nexport async function sendSMS(to: string, text: string, from?: string | null): Promise {\n if (await channelForNumber(from) === \"gateway\") return sendViaGateway(to, text);\n const apiKey = Deno.env.get(\"TELNYX_API_KEY\");\n const fromNumber = from || Deno.env.get(\"TELNYX_FROM_NUMBER\");\n if (!apiKey || !fromNumber) {\n console.error(\"sendSMS: missing TELNYX_API_KEY or TELNYX_FROM_NUMBER\");\n return false;\n }\n try {\n const res = await fetch(\"https://api.telnyx.com/v2/messages\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", \"Authorization\": `Bearer ${apiKey}` },\n body: JSON.stringify({ from: fromNumber, to, text: gsmify(text) }),\n });\n if (!res.ok) {\n console.error(\"Telnyx send failed\", res.status, await res.text());\n return false;\n }\n return true;\n } catch (e) {\n console.error(\"Telnyx send error\", e);\n return false;\n }\n}\n\n// ---- AI agent config → system prompt -----------------------------------------\n// Default safety-net persona (used when a lead has no campaign/assigned agent),\n// the style dials, and the system-prompt assembler. All stateless — kept in\n// lib.ts so main.ts stays under Val.town's 80k/file limit.\nexport const PERSONA = {\n name: \"Alex\",\n businessName: \"\",\n goal: \"find out what they're looking for and, if it's a fit, set up a quick chat\",\n bookingLink: \"\",\n tone: \"Warm and professional\",\n};\n\n// Style dials map to plain-language instruction snippets (Sales-Wingman-style).\nexport const DIAL_PERSONALITY: Record = {\n personable: \"Be warm and friendly. Use their first name, show a little personality, a touch of light small talk.\",\n balanced: \"Be friendly but efficient.\",\n direct: \"Be concise and businesslike. Skip pleasantries and get to the point.\",\n};\nexport const DIAL_PERSUASION: Record = {\n helpful: \"Be consultative and low-pressure. Answer questions, build trust, and let them come to the booking naturally.\",\n balanced: \"Be helpful, but gently guide them toward booking.\",\n hard: \"Drive assertively toward the booking. Create gentle urgency, ask for the appointment directly, and handle objections head-on.\",\n};\n\nexport function buildAgentSystem(cfg: any): string {\n const agent = cfg?.agent_name || PERSONA.name;\n const business = cfg?.business_name || PERSONA.businessName;\n const goal = cfg?.goal || (cfg?.offer\n ? `find out if they're still interested in ${cfg.offer} and, if so, set up a quick chat or booking`\n : PERSONA.goal);\n const bizClause = business ? ` for ${business}` : \"\";\n const offer = cfg?.offer ? ` The specific offer to promote is: ${cfg.offer}.` : \"\";\n const booking = (cfg?.booking_link || PERSONA.bookingLink) ? ` Booking link (share when it helps): ${cfg?.booking_link || PERSONA.bookingLink}.` : \"\";\n const audience = cfg?.target_audience ? ` You're messaging ${cfg.target_audience} — match their tone and priorities.` : \"\";\n const personality = DIAL_PERSONALITY[cfg?.personality] || DIAL_PERSONALITY.balanced;\n const persuasion = DIAL_PERSUASION[cfg?.persuasion] || DIAL_PERSUASION.balanced;\n const lenInstr = replyLenInstruction(cfg?.reply_length || 3);\n const knowledge = cfg?.knowledge ? `\\n\\nBackground on the business (use when relevant; do not invent facts beyond this):\\n${cfg.knowledge}` : \"\";\n const guardrails = cfg?.guardrails ? `\\n\\nRules you MUST follow:\\n${cfg.guardrails}` : \"\";\n return (\n `You are ${agent}, an SMS assistant${bizClause}. Your goal is to ${goal}.${offer}${booking}${audience} ` +\n `${personality} ${persuasion} ${lenInstr} ` +\n `Write like a real person texting — natural, never robotic. ` +\n `Do not use emojis or special Unicode characters — plain text, straight quotes, simple punctuation (keeps SMS cheap). ` +\n `Some earlier messages may have been sent by a human colleague during a manual takeover — treat the whole thread as one continuous conversation.` +\n knowledge + guardrails\n );\n}\n\n// Minimal health/status page HTML (the React app is the real UI). Pure — kept\n// here so main.ts stays under Val.town's 80k/file limit.\nexport function healthPageHtml(clients: number, leads: number): string {\n return `LeadPulse\n\n

⚡ LeadPulse webhook-receiver

Live. ${clients} client(s), ${leads} lead(s). The dashboard is the React app; raw data at /log.json.

\n`;\n}\n","// LeadPulse — shared helpers for the webhook-receiver val (imported by main.ts).\n// Split out to stay under Val.town's 80,000-char per-file limit.\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\n\n// GSM-7 character set (single-byte SMS alphabet) + the 2-byte extension chars.\nconst GSM_EXT = \"^{}\\\\[~]|€\";\nconst GSM_BASE = \"@£$¥èéùìòÇ\\nØø\\rÅåΔ_ΦΓΛΩΠΨΣΘΞ ÆæßÉ !\\\"#¤%&'()*+,-./0123456789:;<=>?¡ABCDEFGHIJKLMNOPQRSTUVWXYZÄÖÑÜ§¿abcdefghijklmnopqrstuvwxyzäöñüà\";\nconst GSM_CHARS = new Set((GSM_BASE + GSM_EXT).split(\"\"));\n\n// Convert text to a GSM-7-safe form so it stays cheap (1 segment / 160 chars)\n// instead of flipping to Unicode (1 segment / 70 chars). Maps smart punctuation\n// to plain equivalents and strips emojis / other non-GSM characters.\nexport function gsmify(text: string): string {\n if (!text) return text;\n let t = String(text)\n .replace(/[‘’‚′‵]/g, \"'\")\n .replace(/[“”„″]/g, '\"')\n .replace(/[–—―]/g, \"-\")\n .replace(/…/g, \"...\")\n .replace(/[ ]/g, \" \")\n .replace(/[•·]/g, \"-\")\n .replace(/™/g, \"(TM)\").replace(/®/g, \"(R)\").replace(/©/g, \"(C)\");\n t = Array.from(t).filter((ch) => GSM_CHARS.has(ch)).join(\"\");\n return t.replace(/[ \\t]{2,}/g, \" \").replace(/ +\\n/g, \"\\n\").trim();\n}\n\n// OpenAI model used for extraction, replies, opener suggestions.\nexport const AI_MODEL = \"gpt-4o-mini\"; // swap to \"gpt-4o\" for higher quality\n\n// Verify a Telnyx webhook's Ed25519 signature so only genuine Telnyx events are\n// processed. Telnyx signs `${timestamp}|${rawBody}` with its account key; the\n// portal gives the public key base64-encoded, as is the signature header.\n// Returns false (never throws) on any problem, so the caller can simply reject.\nexport async function verifyTelnyxSignature(\n publicKeyB64: string,\n signatureB64: string,\n timestamp: string,\n rawBody: string,\n): Promise {\n try {\n if (!publicKeyB64 || !signatureB64 || !timestamp) return false;\n const b64ToBytes = (b64: string) => Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));\n const key = await crypto.subtle.importKey(\n \"raw\", b64ToBytes(publicKeyB64), { name: \"Ed25519\" }, false, [\"verify\"],\n );\n const signed = new TextEncoder().encode(`${timestamp}|${rawBody}`);\n return await crypto.subtle.verify(\"Ed25519\", key, b64ToBytes(signatureB64), signed);\n } catch (e) {\n console.error(\"Telnyx sig verify error\", e);\n return false;\n }\n}\n\n// The Titan Mode automation roles the scraper can recommend, with a short\n// description so the model picks the best fits for a given business.\nexport const USE_CASE_CATALOG =\n \"- speed-to-lead: instantly reply to brand-new web/enquiry leads\\n\" +\n \"- reactivation: re-engage old / cold leads from their database\\n\" +\n \"- follow-up: chase leads who went quiet after first contact\\n\" +\n \"- reputation: ask happy customers for Google reviews\\n\" +\n \"- missed-call: auto text-back people whose calls were missed\";\n\n// Fetch a website and have the AI extract structured business data. Shared by\n// the single-agent builder (/api/agent/scrape) and Titan Mode (/api/hulk). Also\n// infers the target audience and the 2-3 automation use-cases the business needs\n// most (from USE_CASE_CATALOG).\nexport async function scrapeSite(rawUrl: string): Promise<{ ok: true; data: any } | { ok: false; error: string; status: number }> {\n let target = String(rawUrl || \"\").trim();\n if (!target) return { ok: false, error: \"url required\", status: 400 };\n if (!/^https?:\\/\\//i.test(target)) target = \"https://\" + target;\n const apiKey = Deno.env.get(\"OPENAI_API_KEY\");\n if (!apiKey) return { ok: false, error: \"OPENAI_API_KEY not set\", status: 400 };\n\n let pageText = \"\";\n try {\n const pageRes = await fetch(target, { headers: { \"User-Agent\": \"Mozilla/5.0 LeadPulseBot\" } });\n if (!pageRes.ok) return { ok: false, error: `Could not fetch site (HTTP ${pageRes.status})`, status: 400 };\n const html = await pageRes.text();\n pageText = html\n .replace(//gi, \" \")\n .replace(//gi, \" \")\n .replace(/<[^>]+>/g, \" \")\n .replace(/ /g, \" \").replace(/&/g, \"&\").replace(/&[a-z]+;/gi, \" \")\n .replace(/\\s+/g, \" \").trim().slice(0, 7000);\n } catch {\n return { ok: false, error: \"Could not reach that website.\", status: 400 };\n }\n if (pageText.length < 40) return { ok: false, error: \"That page had almost no readable text.\", status: 400 };\n\n try {\n const sys =\n \"You analyse a business website to set up SMS marketing automations. \" +\n \"Return ONLY JSON. Prefer SPECIFIC service categories (e.g. 'Residential solar installation', not 'home services'); \" +\n \"split vague umbrellas into specifics. Identify free/low-commitment lead magnets (e.g. 'Free energy audit') — these make the best reactivation hooks. \" +\n \"Recommend the single best offer to reactivate old leads, favouring a free hook if one exists. \" +\n \"Also infer the target_audience (who their customers are, e.g. 'homeowners 35-65 in the Midlands'). \" +\n \"And pick the 2-3 automation use-cases this business needs MOST, choosing each `role` from this list:\\n\" +\n USE_CASE_CATALOG +\n \"\\nReturn them best-fit first with a one short sentence `reason` each, specific to THIS business.\";\n const schema =\n '{\"business_name\":string,\"description\":string,\"services\":string[],\"lead_magnets\":string[],' +\n '\"faqs\":[{\"q\":string,\"a\":string}],\"contact\":{\"phone\":string,\"hours\":string,\"location\":string,\"booking_link\":string},' +\n '\"tone\":string,\"recommended_offer\":string,\"recommended_reason\":string,\"target_audience\":string,' +\n '\"recommended_use_cases\":[{\"role\":string,\"reason\":string}]}';\n const aiRes = await fetch(\"https://api.openai.com/v1/chat/completions\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", \"Authorization\": `Bearer ${apiKey}` },\n body: JSON.stringify({\n model: AI_MODEL,\n response_format: { type: \"json_object\" },\n messages: [\n { role: \"system\", content: `${sys}\\nJSON shape: ${schema}` },\n { role: \"user\", content: `Website text:\\n${pageText}` },\n ],\n }),\n });\n if (!aiRes.ok) return { ok: false, error: `AI extraction failed (HTTP ${aiRes.status})`, status: 400 };\n const data = await aiRes.json();\n const parsed = JSON.parse(data.choices?.[0]?.message?.content || \"{}\");\n return { ok: true, data: parsed };\n } catch (e) {\n console.error(\"scrape extract error\", e);\n return { ok: false, error: \"Could not analyse that site.\", status: 400 };\n }\n}\n\n// Turn the scrape's structured data into one plain-text knowledge blob that\n// every agent in the squad shares.\nexport function buildKnowledgeFromScrape(d: any): string {\n const parts: string[] = [];\n if (d?.description) parts.push(String(d.description));\n if (Array.isArray(d?.services) && d.services.length) parts.push(`Services: ${d.services.join(\", \")}.`);\n if (Array.isArray(d?.lead_magnets) && d.lead_magnets.length) parts.push(`Free / low-commitment offers: ${d.lead_magnets.join(\", \")}.`);\n const c = d?.contact || {};\n const contactBits = [c.hours && `Hours: ${c.hours}`, c.location && `Location: ${c.location}`, c.phone && `Phone: ${c.phone}`].filter(Boolean);\n if (contactBits.length) parts.push(contactBits.join(\" | \"));\n if (Array.isArray(d?.faqs) && d.faqs.length) {\n parts.push(\"FAQs:\\n\" + d.faqs.slice(0, 8).map((f: any) => `Q: ${f.q}\\nA: ${f.a}`).join(\"\\n\"));\n }\n return parts.join(\"\\n\").slice(0, 6000);\n}\n\n// ---- Hulk Mode -------------------------------------------------------------\n// One website scrape spawns this whole squad of role-specialised agents. They\n// all share the SAME knowledge base (from the scrape) but each has a distinct\n// job: goal, guardrails, and style dials. All roles are `channel: 'sms'` and\n// live immediately. (The `coming_soon` channel value is retained in the type\n// only for backward-compat with older agents already in the DB.)\n// `goalFor(offer)` bakes the focus offer in.\nexport const HULK_ROLES: Array<{\n role: string; label: string; emoji: string; channel: \"sms\" | \"coming_soon\";\n personality: string; persuasion: string; reply_length: number;\n goalFor: (offer: string) => string; guardrails: string;\n}> = [\n {\n role: \"speed-to-lead\", label: \"Speed to Lead\", emoji: \"⚡\", channel: \"sms\",\n personality: \"personable\", persuasion: \"balanced\", reply_length: 2,\n goalFor: (o) => `respond instantly to this brand-new enquiry, answer what they asked${o ? ` about ${o}` : \"\"}, quickly qualify them, and book a call or appointment while they're still hot`,\n guardrails: \"Reply fast and acknowledge their specific enquiry first. Ask one quick question at a time. Aim to lock in a time, not just chat.\",\n },\n {\n role: \"reactivation\", label: \"Database Reactivation\", emoji: \"🔁\", channel: \"sms\",\n personality: \"balanced\", persuasion: \"balanced\", reply_length: 3,\n goalFor: (o) => `re-engage this past/cold lead${o ? ` about ${o}` : \"\"} and, if they're still interested, set up a quick chat or booking`,\n guardrails: \"Open with a warm, low-pressure re-introduction. It's been a while, so don't assume they remember every detail.\",\n },\n {\n role: \"follow-up\", label: \"48-Hour Follow-Up\", emoji: \"⏱️\", channel: \"sms\",\n personality: \"personable\", persuasion: \"helpful\", reply_length: 2,\n goalFor: (o) => `gently follow up with this lead who went quiet, re-open the conversation${o ? ` about ${o}` : \"\"}, and move them toward booking`,\n guardrails: \"Be light and no-pressure — one friendly nudge, not a chase. Reference the earlier conversation so it feels personal.\",\n },\n {\n role: \"reputation\", label: \"48-Hour Reputation\", emoji: \"⭐\", channel: \"sms\",\n personality: \"personable\", persuasion: \"helpful\", reply_length: 2,\n goalFor: (_o) => \"thank a recent happy customer and invite them to leave a quick Google review, sharing the review link\",\n guardrails: \"Only ask for a review ONCE, never pressure. If the customer seems unhappy, do NOT push for a public review — apologise and offer to have the owner call them to put things right.\",\n },\n {\n role: \"missed-call\", label: \"Missed-Call Text-Back\", emoji: \"📞\", channel: \"sms\",\n personality: \"personable\", persuasion: \"balanced\", reply_length: 2,\n goalFor: (o) => `we just missed their call — text them back fast, apologise for missing them, find out what they needed${o ? ` (likely ${o})` : \"\"}, and book them in or get them an answer`,\n guardrails: \"Lead with a quick apology for missing the call. Keep it short and human. One question to find out what they needed.\",\n },\n];\n\n// --- Pure helpers (moved from main.ts to stay under Val.town's 80k file limit).\n// None touch the DB or any main.ts state, so they behave identically here.\nexport function cors(body: string | object, status = 200, contentType = \"application/json\") {\n const headers = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, Authorization\",\n \"Content-Type\": contentType === \"application/json\" ? \"application/json\" : contentType,\n };\n // 204/304 are \"no body\" statuses — Deno throws \"null body status cannot have\n // body\" if you pass even an empty string (the OPTIONS preflight uses 204).\n const noBody = status === 204 || status === 304;\n const bodyStr = noBody ? null : (typeof body === \"string\" ? body : JSON.stringify(body));\n return new Response(bodyStr, { status, headers });\n}\nexport function esc(s: string): string {\n return String(s).replace(/[&<>\"]/g, (c) => ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\" }[c]!));\n}\nexport function firstName(name: string | null): string {\n if (!name) return \"there\";\n return name.trim().split(/\\s+/)[0] || \"there\";\n}\n// Normalise UK numbers to E.164 (mirrors the frontend CSV parser).\nexport function normalizePhone(raw: string): string {\n let p = String(raw).replace(/[\\s()-]/g, \"\");\n if (p.startsWith(\"07\")) p = \"+44\" + p.slice(1);\n else if (p.startsWith(\"447\")) p = \"+\" + p;\n else if (p.startsWith(\"0\")) p = \"+44\" + p.slice(1);\n return p;\n}\nexport function applyTemplate(template: string, lead: { name: string | null; phone_number: string }): string {\n return (template || \"\")\n .replace(/\\{first_name\\}/gi, firstName(lead.name))\n .replace(/\\{name\\}/gi, lead.name || firstName(lead.name));\n}\nexport function domainOf(url: string): string {\n const raw = String(url || \"\").trim();\n if (!raw) return \"\";\n try {\n const u = new URL(/^https?:\\/\\//i.test(raw) ? raw : \"https://\" + raw);\n return u.hostname.replace(/^www\\./i, \"\").toLowerCase();\n } catch { return \"\"; }\n}\nexport function replyLenInstruction(n: number): string {\n if (n <= 1) return \"Reply in a single short sentence.\";\n if (n === 2) return \"Keep replies to 1-2 short sentences.\";\n return \"Replies can be 1-3 short sentences.\";\n}\nexport function replyMaxTokens(n: number): number { return n <= 1 ? 80 : n === 2 ? 160 : 300; }\n\n// Which channel a from-number sends through: 'gateway' (an Android phone via\n// sms-gate.app) or 'telnyx' (default). Read from the shared `numbers.channel`\n// column (added by the gateway-sms val). Any problem => 'telnyx' so sending\n// never breaks if the column/row is missing.\nasync function channelForNumber(from?: string | null): Promise {\n if (!from) return \"telnyx\";\n try {\n const r = await sqlite.execute({ sql: `SELECT channel FROM numbers WHERE phone_number = ?`, args: [from] });\n const row = (r.rows as any[])[0];\n return row && row[0] ? String(row[0]) : \"telnyx\";\n } catch {\n return \"telnyx\";\n }\n}\n\n// Send an SMS through the mobile gateway (sms-gate.app cloud → the phone's SIM).\n// Returns true on success. Never throws. Needs SMSGATE_USER/SMSGATE_PASS env.\nasync function sendViaGateway(to: string, text: string): Promise {\n const user = Deno.env.get(\"SMSGATE_USER\");\n const pass = Deno.env.get(\"SMSGATE_PASS\");\n if (!user || !pass) {\n console.error(\"sendViaGateway: missing SMSGATE_USER / SMSGATE_PASS\");\n return false;\n }\n try {\n const res = await fetch(\"https://api.sms-gate.app/3rdparty/v1/messages\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", \"Authorization\": \"Basic \" + btoa(`${user}:${pass}`) },\n body: JSON.stringify({ textMessage: { text: gsmify(text) }, phoneNumbers: [to] }),\n });\n if (!res.ok) {\n console.error(\"sms-gate send failed\", res.status, await res.text());\n return false;\n }\n return true;\n } catch (e) {\n console.error(\"sms-gate send error\", e);\n return false;\n }\n}\n\n// Send an SMS. Routes by the from-number's channel: gateway numbers go through\n// the phone (sms-gate.app), everything else through Telnyx v2. Returns true on\n// success. Never throws.\nexport async function sendSMS(to: string, text: string, from?: string | null): Promise {\n if (await channelForNumber(from) === \"gateway\") return sendViaGateway(to, text);\n const apiKey = Deno.env.get(\"TELNYX_API_KEY\");\n const fromNumber = from || Deno.env.get(\"TELNYX_FROM_NUMBER\");\n if (!apiKey || !fromNumber) {\n console.error(\"sendSMS: missing TELNYX_API_KEY or TELNYX_FROM_NUMBER\");\n return false;\n }\n try {\n const res = await fetch(\"https://api.telnyx.com/v2/messages\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", \"Authorization\": `Bearer ${apiKey}` },\n body: JSON.stringify({ from: fromNumber, to, text: gsmify(text) }),\n });\n if (!res.ok) {\n console.error(\"Telnyx send failed\", res.status, await res.text());\n return false;\n }\n return true;\n } catch (e) {\n console.error(\"Telnyx send error\", e);\n return false;\n }\n}\n\n// ---- AI agent config → system prompt -----------------------------------------\n// Default safety-net persona (used when a lead has no campaign/assigned agent),\n// the style dials, and the system-prompt assembler. All stateless — kept in\n// lib.ts so main.ts stays under Val.town's 80k/file limit.\nexport const PERSONA = {\n name: \"Alex\",\n businessName: \"\",\n goal: \"find out what they're looking for and, if it's a fit, set up a quick chat\",\n bookingLink: \"\",\n tone: \"Warm and professional\",\n};\n\n// Style dials map to plain-language instruction snippets (Sales-Wingman-style).\nexport const DIAL_PERSONALITY: Record = {\n personable: \"Be warm and friendly. Use their first name, show a little personality, a touch of light small talk.\",\n balanced: \"Be friendly but efficient.\",\n direct: \"Be concise and businesslike. Skip pleasantries and get to the point.\",\n};\nexport const DIAL_PERSUASION: Record = {\n helpful: \"Be consultative and low-pressure. Answer questions, build trust, and let them come to the booking naturally.\",\n balanced: \"Be helpful, but gently guide them toward booking.\",\n hard: \"Drive assertively toward the booking. Create gentle urgency, ask for the appointment directly, and handle objections head-on.\",\n};\n\nexport function buildAgentSystem(cfg: any): string {\n const agent = cfg?.agent_name || PERSONA.name;\n const business = cfg?.business_name || PERSONA.businessName;\n const goal = cfg?.goal || (cfg?.offer\n ? `find out if they're still interested in ${cfg.offer} and, if so, set up a quick chat or booking`\n : PERSONA.goal);\n const bizClause = business ? ` for ${business}` : \"\";\n const offer = cfg?.offer ? ` The specific offer to promote is: ${cfg.offer}.` : \"\";\n const booking = (cfg?.booking_link || PERSONA.bookingLink) ? ` Booking link (share when it helps): ${cfg?.booking_link || PERSONA.bookingLink}.` : \"\";\n const audience = cfg?.target_audience ? ` You're messaging ${cfg.target_audience} — match their tone and priorities.` : \"\";\n const personality = DIAL_PERSONALITY[cfg?.personality] || DIAL_PERSONALITY.balanced;\n const persuasion = DIAL_PERSUASION[cfg?.persuasion] || DIAL_PERSUASION.balanced;\n const lenInstr = replyLenInstruction(cfg?.reply_length || 3);\n const knowledge = cfg?.knowledge ? `\\n\\nBackground on the business (use when relevant; do not invent facts beyond this):\\n${cfg.knowledge}` : \"\";\n const guardrails = cfg?.guardrails ? `\\n\\nRules you MUST follow:\\n${cfg.guardrails}` : \"\";\n return (\n `You are ${agent}, an SMS assistant${bizClause}. Your goal is to ${goal}.${offer}${booking}${audience} ` +\n `${personality} ${persuasion} ${lenInstr} ` +\n `Write like a real person texting — natural, never robotic. ` +\n `Do not use emojis or special Unicode characters — plain text, straight quotes, simple punctuation (keeps SMS cheap). ` +\n `Some earlier messages may have been sent by a human colleague during a manual takeover — treat the whole thread as one continuous conversation.` +\n knowledge + guardrails\n );\n}\n\n// Minimal health/status page HTML (the React app is the real UI). Pure — kept\n// here so main.ts stays under Val.town's 80k/file limit.\nexport function healthPageHtml(clients: number, leads: number): string {\n return `LeadPulse\n\n

⚡ LeadPulse webhook-receiver

Live. ${clients} client(s), ${leads} lead(s). The dashboard is the React app; raw data at /log.json.

\n`;\n}\n\n// ---- AI config resolvers (read the agents/campaigns tables) ------------------\n// Build an agent-config object straight from an agents-table row id (used by a\n// pinned conversation bot and the default inbound responder).\nexport async function getAgentConfigById(agentId: number | string | null): Promise {\n if (!agentId) return null;\n const r = await sqlite.execute({\n sql: `SELECT agent_name, business_name, knowledge, guardrails, booking_link, personality, persuasion, reply_length, offer, goal, target_audience FROM agents WHERE id = ?`,\n args: [agentId],\n });\n const a = (r.rows as any[])[0];\n if (!a) return null;\n return {\n agent_name: a[0], business_name: a[1], knowledge: a[2], guardrails: a[3], booking_link: a[4],\n personality: a[5], persuasion: a[6], reply_length: a[7], offer: a[8], goal: a[9], target_audience: a[10],\n };\n}\n\n// Resolve the effective agent config for a lead's campaign. If the campaign\n// references a reusable agent (agent_id), the agent provides the brain and the\n// campaign provides the offer/goal; otherwise the campaign's inline config is used.\nexport async function getCampaignConfig(clientId: number, name: string | null): Promise {\n if (!name) return null;\n const r = await sqlite.execute({\n sql: `SELECT agent_name, business_name, goal, offer, booking_link, knowledge, guardrails, personality, persuasion, reply_length, agent_id\n FROM campaigns WHERE client_id = ? AND name = ? ORDER BY created_at DESC LIMIT 1`,\n args: [clientId, name],\n });\n const row = (r.rows as any[])[0];\n if (!row) return null;\n const inline = {\n agent_name: row[0], business_name: row[1], goal: row[2], offer: row[3], booking_link: row[4],\n knowledge: row[5], guardrails: row[6], personality: row[7], persuasion: row[8], reply_length: row[9],\n };\n const agentId = row[10];\n if (agentId) {\n const ar = await sqlite.execute({\n sql: `SELECT agent_name, business_name, knowledge, guardrails, booking_link, personality, persuasion, reply_length, offer, target_audience FROM agents WHERE id = ?`,\n args: [agentId],\n });\n const a = (ar.rows as any[])[0];\n if (a) {\n return {\n agent_name: a[0], business_name: a[1], knowledge: a[2], guardrails: a[3],\n booking_link: inline.booking_link || a[4],\n personality: a[5], persuasion: a[6], reply_length: a[7],\n goal: inline.goal, offer: inline.offer || a[8], // campaign offer, else the agent's focus offer\n target_audience: a[9],\n };\n }\n }\n return inline;\n}\n","createdAt",["D",1782362803631],"branchVersion","branchId","2153c95d-e0a0-4211-bf1e-f95c1c9c4b28","id","10918686-b05f-4967-8604-c916ecee2841","webhook-receiver",["D",1781173254803],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Receive, log, and inspect incoming webhooks","imageUrl","479e4e9c-8457-43bf-9d25-06399436a4f4","pinnedFileId","4881354c-657f-11f1-90a5-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019eb632-84fe-70e4-9a7f-19a05e40a2f8","tursoName","10918686b05f49678604c916ecee2841","tursoHostname","10918686b05f49678604c916ecee2841-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789535451117],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_100":99,"_108":104},"org",{"_100":99,"_101":102,"_103":104,"_18":55,"_105":106,"_107":25},"branch",{"_13":89,"_32":90,"_43":42,"_91":44,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":45,"_98":99},"isOwned",69,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","jamesayres","handle","displayName","James Ayres","avatar","https://lh3.googleusercontent.com/a/ACg8ocJOBKkeJdcD8Vv48levfET0tNVodYvJRCFxAuAaNoagJBFNRYM=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":169,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":170,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":171,"_84":172,"_86":173,"_88":25},"tree",[160,161],"files",[160,161],"counts",{"_148":63,"_149":150,"_151":63,"_152":153,"_154":155},"contents",[131,132],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":144,"_32":28,"_30":31,"_135":-5,"_41":42,"_40":14,"_137":25,"_38":145,"_13":146,"_33":34,"_35":37,"_24":25,"_142":-5,"_27":147},{"_43":133,"_32":134,"_30":57,"_135":-5,"_41":42,"_40":136,"_137":25,"_38":138,"_13":139,"_33":140,"_35":141,"_24":25,"_142":-5,"_27":143},"8f27ee5d-b917-49da-a7ee-effeb7d1359d","main.ts","parentId",61,"latest",["D",1782338449444],48,"http","// LeadPulse — HTTP val (webhook-receiver). Deploy with `vt push`.\n// Env vars: TELNYX_API_KEY, TELNYX_FROM_NUMBER (E.164), OPENAI_API_KEY.\n// Shares the Val.town SQLite DB with the cron15mins val.\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { gsmify, AI_MODEL, scrapeSite, buildKnowledgeFromScrape, HULK_ROLES, verifyTelnyxSignature,\n cors, esc, firstName, normalizePhone, applyTemplate, domainOf, replyLenInstruction, replyMaxTokens, sendSMS,\n PERSONA, buildAgentSystem, healthPageHtml } from \"./lib.ts\";\n\n// Every row belongs to a client (subaccount). All pre-subaccount data migrates\n// under this Default client so nothing breaks; new clients get their own id.\nconst DEFAULT_CLIENT_ID = 1;\n\n// ---- AI persona (edit here to retune the assistant) -------------------------\n// (AI_MODEL + scrape/knowledge helpers now live in lib.ts.)\n// Neutral fallback used ONLY when a lead has no campaign agent configured.\n// PERSONA (the safety-net bot), the style dials, and buildAgentSystem now live in\n// lib.ts (stateless) — imported above — to keep main.ts under the 80k/file limit.\n\n// Exact-match opt-out keywords (PECR compliance). Matched against the whole\n// trimmed, upper-cased inbound message so conversational use of \"no\" etc. does\n// not accidentally opt someone out.\nconst STOP_KEYWORDS = new Set([\n \"STOP\", \"STOPALL\", \"UNSUBSCRIBE\", \"CANCEL\", \"END\", \"QUIT\", \"OPTOUT\", \"OPT OUT\", \"REMOVE\",\n]);\nconst OPT_OUT_CONFIRMATION = \"You've been removed from our list. Sorry to bother you!\";\n\n\n// ---- Schema -----------------------------------------------------------------\n// True if a column already exists on a table (used to make the one-time\n// primary-key recreates for `leads`/`settings` run exactly once).\nasync function columnExists(table: string, col: string): Promise {\n const r = await sqlite.execute(`PRAGMA table_info(${table})`);\n return (r.rows as any[]).some((row) => row[1] === col); // row[1] = column name\n}\n\n// Schema setup is idempotent but fires dozens of SQLite round-trips, so run it\n// only once per warm instance (Val.town reuses the module between requests).\n// A cold start re-runs it harmlessly.\nlet schemaReady = false;\nasync function ensureTables() {\n if (schemaReady) return;\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS leads (\n phone_number TEXT PRIMARY KEY,\n name TEXT,\n campaign TEXT,\n status TEXT DEFAULT 'active',\n created_at TEXT\n )\n `);\n // Additive migrations — safe to ignore if the column already exists.\n for (const ddl of [\n `ALTER TABLE leads ADD COLUMN name TEXT`,\n `ALTER TABLE leads ADD COLUMN mode TEXT DEFAULT 'ai'`, // 'ai' | 'manual'\n `ALTER TABLE leads ADD COLUMN opted_out INTEGER DEFAULT 0`, // 0 | 1\n `ALTER TABLE leads ADD COLUMN assigned_number TEXT`, // for future multi-number rotation\n `ALTER TABLE leads ADD COLUMN assigned_agent_id INTEGER`, // bot pinned to THIS conversation (overrides campaign/default)\n ]) {\n try { await sqlite.execute(ddl); } catch { /* column exists */ }\n }\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS messages (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n phone_number TEXT,\n direction TEXT,\n text TEXT,\n timestamp TEXT\n )\n `);\n // Which LeadPulse number this message went through (the `to` for inbound,\n // the `from` for outbound) — lets the UI split a thread by number.\n try { await sqlite.execute(`ALTER TABLE messages ADD COLUMN channel_number TEXT`); } catch { /* exists */ }\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS campaigns (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT,\n opening_message TEXT,\n status TEXT DEFAULT 'draft', -- draft | running | paused | terminated | completed\n from_number TEXT, -- null => use TELNYX_FROM_NUMBER (multi-number is post-MVP)\n created_at TEXT\n )\n `);\n // Per-campaign AI agent config (the bot's personality, knowledge, and style).\n for (const ddl of [\n `ALTER TABLE campaigns ADD COLUMN agent_name TEXT`,\n `ALTER TABLE campaigns ADD COLUMN business_name TEXT`,\n `ALTER TABLE campaigns ADD COLUMN goal TEXT`,\n `ALTER TABLE campaigns ADD COLUMN offer TEXT`,\n `ALTER TABLE campaigns ADD COLUMN booking_link TEXT`,\n `ALTER TABLE campaigns ADD COLUMN knowledge TEXT`,\n `ALTER TABLE campaigns ADD COLUMN guardrails TEXT`,\n `ALTER TABLE campaigns ADD COLUMN personality TEXT`, // personable | balanced | direct\n `ALTER TABLE campaigns ADD COLUMN persuasion TEXT`, // helpful | balanced | hard\n `ALTER TABLE campaigns ADD COLUMN reply_length INTEGER`, // 1 | 2 | 3 (sentences)\n `ALTER TABLE campaigns ADD COLUMN source_url TEXT`, // website the agent was built from\n `ALTER TABLE campaigns ADD COLUMN agent_id INTEGER`, // reusable agent from the Agents library\n `ALTER TABLE campaigns ADD COLUMN manual INTEGER DEFAULT 0`, // 1 = no AI agent; the operator replies by hand\n ]) { try { await sqlite.execute(ddl); } catch { /* exists */ } }\n\n // One row per lead per campaign => guarantees exactly one send per lead.\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS campaign_queue (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n campaign_id INTEGER,\n phone_number TEXT,\n status TEXT DEFAULT 'pending', -- pending | sent | failed | cancelled\n send_after TEXT, -- ISO timestamp; the cron sends once now >= send_after\n sent_at TEXT,\n UNIQUE(campaign_id, phone_number)\n )\n `);\n // The specific number this queued message sends from (multi-number support).\n try { await sqlite.execute(`ALTER TABLE campaign_queue ADD COLUMN send_number TEXT`); } catch { /* exists */ }\n\n // Sending numbers managed from the LeadPulse UI (no env-var juggling).\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS numbers (\n phone_number TEXT PRIMARY KEY,\n label TEXT,\n created_at TEXT\n )\n `);\n\n // Reusable AI agents (the \"brain\" — identity, knowledge, tone). Assigned to\n // campaigns; one agent ≈ one client, reused across many campaigns.\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS agents (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT,\n agent_name TEXT,\n business_name TEXT,\n knowledge TEXT,\n guardrails TEXT,\n booking_link TEXT,\n personality TEXT,\n persuasion TEXT,\n reply_length INTEGER,\n offers TEXT, -- JSON array of detected services/lead-magnets\n offer TEXT, -- the chosen focus offer the bot drives toward\n source_url TEXT,\n created_at TEXT\n )\n `);\n try { await sqlite.execute(`ALTER TABLE agents ADD COLUMN offer TEXT`); } catch { /* exists */ }\n // Titan Mode: an agent now has a ROLE (its job), a baked-in GOAL (so it works\n // standalone, not just via a campaign), and a CHANNEL. All Titan roles are\n // 'sms' now; 'coming_soon' is kept only for older agents already in the DB.\n for (const ddl of [\n `ALTER TABLE agents ADD COLUMN role TEXT`,\n `ALTER TABLE agents ADD COLUMN goal TEXT`,\n `ALTER TABLE agents ADD COLUMN channel TEXT DEFAULT 'sms'`,\n `ALTER TABLE agents ADD COLUMN hulk_group TEXT`, // groups the 6 agents from one scrape\n `ALTER TABLE agents ADD COLUMN target_audience TEXT`, // who the bot messages (powers openers)\n ]) { try { await sqlite.execute(ddl); } catch { /* exists */ } }\n\n // Simple key/value settings (e.g. which agent answers brand-new inbound leads).\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS settings (\n key TEXT PRIMARY KEY,\n value TEXT\n )\n `);\n\n // Folders group an agent squad. Auto-created per website (keyed by `domain`),\n // named after the business; `domain` is null for manually-created folders. A\n // business with several sites can have them moved into one folder by hand.\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS folders (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT,\n domain TEXT,\n created_at TEXT\n )\n `);\n try { await sqlite.execute(`ALTER TABLE agents ADD COLUMN folder_id INTEGER`); } catch { /* exists */ }\n\n // ---- Client subaccounts -----------------------------------------------------\n // Everything is scoped to a client. Existing data migrates under \"Default\".\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS clients (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT,\n created_at TEXT\n )\n `);\n const ccount = await sqlite.execute(`SELECT COUNT(*) FROM clients`);\n if (!((ccount.rows as any[])[0][0])) {\n await sqlite.execute({\n sql: `INSERT INTO clients (id, name, created_at) VALUES (?, 'Default', ?)`,\n args: [DEFAULT_CLIENT_ID, new Date().toISOString()],\n });\n }\n\n // `leads` PK: (phone_number) -> (client_id, phone_number) so the SAME phone can\n // be an independent lead under different clients. One-time table recreate.\n if (!(await columnExists(\"leads\", \"client_id\"))) {\n await sqlite.execute(`\n CREATE TABLE leads_new (\n client_id INTEGER NOT NULL DEFAULT ${DEFAULT_CLIENT_ID},\n phone_number TEXT,\n name TEXT,\n campaign TEXT,\n status TEXT DEFAULT 'active',\n created_at TEXT,\n mode TEXT DEFAULT 'ai',\n opted_out INTEGER DEFAULT 0,\n assigned_number TEXT,\n PRIMARY KEY (client_id, phone_number)\n )\n `);\n await sqlite.execute(`\n INSERT INTO leads_new (client_id, phone_number, name, campaign, status, created_at, mode, opted_out, assigned_number)\n SELECT ${DEFAULT_CLIENT_ID}, phone_number, name, campaign, status, created_at, mode, opted_out, assigned_number FROM leads\n `);\n await sqlite.execute(`DROP TABLE leads`);\n await sqlite.execute(`ALTER TABLE leads_new RENAME TO leads`);\n }\n\n // `settings` PK: (key) -> (client_id, key) so e.g. inbound_agent_id is per-client.\n if (!(await columnExists(\"settings\", \"client_id\"))) {\n await sqlite.execute(`\n CREATE TABLE settings_new (\n client_id INTEGER NOT NULL DEFAULT ${DEFAULT_CLIENT_ID},\n key TEXT,\n value TEXT,\n PRIMARY KEY (client_id, key)\n )\n `);\n await sqlite.execute(`INSERT INTO settings_new (client_id, key, value) SELECT ${DEFAULT_CLIENT_ID}, key, value FROM settings`);\n await sqlite.execute(`DROP TABLE settings`);\n await sqlite.execute(`ALTER TABLE settings_new RENAME TO settings`);\n }\n\n // Additive client_id everywhere else + a ONE-TIME backfill to Default. The\n // backfill runs only on the request that first adds the column (guarded by the\n // ALTER succeeding) — otherwise it would re-fire every request. That matters\n // most for `numbers`, where NULL = intentionally unassigned (the pool); a\n // repeated backfill would wrongly drag unassigned numbers back to Default.\n for (const t of [\"messages\", \"campaigns\", \"campaign_queue\", \"agents\", \"folders\", \"numbers\"]) {\n let added = false;\n try { await sqlite.execute(`ALTER TABLE ${t} ADD COLUMN client_id INTEGER`); added = true; } catch { /* exists */ }\n if (added) await sqlite.execute(`UPDATE ${t} SET client_id = ${DEFAULT_CLIENT_ID} WHERE client_id IS NULL`);\n }\n\n // Inbound that lands on a number not yet assigned to a client is parked here\n // (never lost) and surfaced in the Numbers tab.\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS unrouted_messages (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n phone_number TEXT,\n to_number TEXT,\n text TEXT,\n timestamp TEXT\n )\n `);\n\n schemaReady = true;\n}\n\n// ---- Helpers (many pure ones + sendSMS now in lib.ts) -----------------------\n\n// The Telnyx numbers available to send from. Set TELNYX_NUMBERS to a\n// comma-separated E.164 list (e.g. \"+4477...,+4478...\"); falls back to the\n// single TELNYX_FROM_NUMBER.\nfunction telnyxNumbers(): string[] {\n const raw = Deno.env.get(\"TELNYX_NUMBERS\") || Deno.env.get(\"TELNYX_FROM_NUMBER\") || \"\";\n return raw.split(\",\").map((s) => s.trim()).filter(Boolean);\n}\n\n// The effective list of sending numbers: the ones managed in the UI (numbers\n// table), or — if none have been added yet — the env-var fallback so nothing\n// breaks before the user adds any.\n// Sending numbers ASSIGNED to a given client. Falls back to the env list only\n// for the Default client (legacy) so existing single-workspace sends still work.\nasync function availableNumbersList(clientId: number): Promise {\n const r = await sqlite.execute({ sql: `SELECT phone_number FROM numbers WHERE client_id = ? ORDER BY created_at ASC`, args: [clientId] });\n const fromDb = (r.rows as any[]).map((row) => row[0]).filter(Boolean);\n if (fromDb.length) return fromDb;\n return clientId === DEFAULT_CLIENT_ID ? telnyxNumbers() : [];\n}\n\n\n\n\nasync function logMessage(clientId: number, phone: string, direction: string, text: string, channelNumber?: string | null) {\n // Store the GSM-safe text — that's what the lead actually received.\n await sqlite.execute({\n sql: `INSERT INTO messages (client_id, phone_number, direction, text, timestamp, channel_number) VALUES (?, ?, ?, ?, ?, ?)`,\n args: [clientId, phone, direction, gsmify(text), new Date().toISOString(), channelNumber ?? null],\n });\n}\n\nasync function getLead(clientId: number, phone: string): Promise {\n const r = await sqlite.execute({\n sql: `SELECT phone_number, name, campaign, status, created_at, mode, opted_out, assigned_number, assigned_agent_id FROM leads WHERE client_id = ? AND phone_number = ?`,\n args: [clientId, phone],\n });\n const row = (r.rows as any[])[0];\n if (!row) return null;\n return {\n phone_number: row[0], name: row[1], campaign: row[2], status: row[3],\n created_at: row[4], mode: row[5] || \"ai\", opted_out: row[6] ? 1 : 0,\n assigned_number: row[7] || null, assigned_agent_id: row[8] || null,\n };\n}\n\n// Resolve the client a request is acting on: `?client_id=` (GET) or body.client_id\n// (POST), defaulting to the Default client so legacy/untagged calls still work.\nfunction clientIdFromReq(url: URL, body?: any): number {\n const raw = (body && body.client_id != null) ? body.client_id : url.searchParams.get(\"client_id\");\n const n = Number(raw);\n return Number.isFinite(n) && n > 0 ? n : DEFAULT_CLIENT_ID;\n}\n\n// ---- Settings (key/value, per-client) ---------------------------------------\nasync function getSetting(clientId: number, key: string): Promise {\n const r = await sqlite.execute({ sql: `SELECT value FROM settings WHERE client_id = ? AND key = ?`, args: [clientId, key] });\n const row = (r.rows as any[])[0];\n return row ? row[0] : null;\n}\nasync function setSetting(clientId: number, key: string, value: string | null): Promise {\n await sqlite.execute({\n sql: `INSERT INTO settings (client_id, key, value) VALUES (?, ?, ?) ON CONFLICT(client_id, key) DO UPDATE SET value = excluded.value`,\n args: [clientId, key, value],\n });\n}\n\n// ---- Folders ----------------------------------------------------------------\n// Bare hostname (no scheme, no www) — the auto-folder key for a website.\n\n// Find (or create) the folder for a website, so every site's bots auto-group.\n// Returns null when there's no usable URL (the agent stays uncategorised).\nasync function ensureFolderForSite(clientId: number, url: string, business?: string | null): Promise {\n const domain = domainOf(url);\n if (!domain) return null;\n const r = await sqlite.execute({ sql: `SELECT id FROM folders WHERE client_id = ? AND domain = ?`, args: [clientId, domain] });\n const row = (r.rows as any[])[0];\n if (row) return Number(row[0]);\n const name = (business && String(business).trim()) || domain;\n const ins = await sqlite.execute({\n sql: `INSERT INTO folders (client_id, name, domain, created_at) VALUES (?, ?, ?, ?)`,\n args: [clientId, name, domain, new Date().toISOString()],\n });\n return Number(ins.lastInsertRowid);\n}\n\n\n// Build an agent-config object straight from an agents-table row id (used by the\n// default inbound responder, which has no campaign).\nasync function getAgentConfigById(agentId: number | string | null): Promise {\n if (!agentId) return null;\n const r = await sqlite.execute({\n sql: `SELECT agent_name, business_name, knowledge, guardrails, booking_link, personality, persuasion, reply_length, offer, goal, target_audience FROM agents WHERE id = ?`,\n args: [agentId],\n });\n const a = (r.rows as any[])[0];\n if (!a) return null;\n return {\n agent_name: a[0], business_name: a[1], knowledge: a[2], guardrails: a[3], booking_link: a[4],\n personality: a[5], persuasion: a[6], reply_length: a[7], offer: a[8], goal: a[9], target_audience: a[10],\n };\n}\n\n// Resolve the effective agent config for a lead's campaign. If the campaign\n// references a reusable agent (agent_id), the agent provides the brain and the\n// campaign provides the offer/goal; otherwise the campaign's inline config is\n// used (backward compatible).\nasync function getCampaignConfig(clientId: number, name: string | null): Promise {\n if (!name) return null;\n const r = await sqlite.execute({\n sql: `SELECT agent_name, business_name, goal, offer, booking_link, knowledge, guardrails, personality, persuasion, reply_length, agent_id\n FROM campaigns WHERE client_id = ? AND name = ? ORDER BY created_at DESC LIMIT 1`,\n args: [clientId, name],\n });\n const row = (r.rows as any[])[0];\n if (!row) return null;\n const inline = {\n agent_name: row[0], business_name: row[1], goal: row[2], offer: row[3], booking_link: row[4],\n knowledge: row[5], guardrails: row[6], personality: row[7], persuasion: row[8], reply_length: row[9],\n };\n const agentId = row[10];\n if (agentId) {\n const ar = await sqlite.execute({\n sql: `SELECT agent_name, business_name, knowledge, guardrails, booking_link, personality, persuasion, reply_length, offer, target_audience FROM agents WHERE id = ?`,\n args: [agentId],\n });\n const a = (ar.rows as any[])[0];\n if (a) {\n return {\n agent_name: a[0], business_name: a[1], knowledge: a[2], guardrails: a[3],\n booking_link: inline.booking_link || a[4],\n personality: a[5], persuasion: a[6], reply_length: a[7],\n goal: inline.goal, offer: inline.offer || a[8], // campaign offer, else the agent's focus offer\n target_audience: a[9],\n };\n }\n }\n return inline;\n}\n\n// Build the transcript and ask the AI for the next reply, using the lead's\n// campaign agent config (falls back to the default PERSONA if none).\nasync function generateAIReply(clientId: number, phone: string, lead?: any): Promise {\n const apiKey = Deno.env.get(\"OPENAI_API_KEY\");\n if (!apiKey) { console.error(\"generateAIReply: missing OPENAI_API_KEY\"); return null; }\n\n // Resolve the brain, most specific first: bot pinned to THIS conversation\n // (assigned_agent_id, set from the Messages view) → the lead's campaign agent →\n // this client's default inbound responder (inbound_agent_id) → neutral PERSONA.\n let cfg = await getAgentConfigById(lead?.assigned_agent_id ?? null);\n if (!cfg) cfg = await getCampaignConfig(clientId, lead?.campaign ?? null);\n if (!cfg) cfg = await getAgentConfigById(await getSetting(clientId, \"inbound_agent_id\"));\n const agentName = cfg?.agent_name || PERSONA.name;\n const system = buildAgentSystem(cfg);\n\n const r = await sqlite.execute({\n sql: `SELECT direction, text FROM messages WHERE client_id = ? AND phone_number = ? ORDER BY timestamp ASC`,\n args: [clientId, phone],\n });\n const transcript = (r.rows as any[])\n .map((m) => `${m[0] === \"inbound\" ? \"Lead\" : agentName}: ${m[1]}`)\n .join(\"\\n\");\n\n try {\n const res = await fetch(\"https://api.openai.com/v1/chat/completions\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", \"Authorization\": `Bearer ${apiKey}` },\n body: JSON.stringify({\n model: AI_MODEL,\n max_tokens: replyMaxTokens(cfg?.reply_length || 3),\n messages: [\n { role: \"system\", content: system },\n { role: \"user\", content: `Conversation so far:\\n${transcript}\\n\\nWrite only the next reply as ${agentName}. No quotes, no labels, just the message.` },\n ],\n }),\n });\n if (!res.ok) { console.error(\"OpenAI failed\", res.status, await res.text()); return null; }\n const data = await res.json();\n return data.choices?.[0]?.message?.content?.trim() || null;\n } catch (e) {\n console.error(\"OpenAI error\", e);\n return null;\n }\n}\n\n// ---- Health page ------------------------------------------------------------\n// Minimal status page — the React frontend is the real UI; use /log.json for a\n// full data dump. (Kept tiny to stay under Val.town's 80k-char per-file limit.)\nasync function renderPage(): Promise {\n const lc = await sqlite.execute(`SELECT COUNT(*) FROM leads`);\n const cc = await sqlite.execute(`SELECT COUNT(*) FROM clients`);\n return healthPageHtml((cc.rows as any[])[0][0], (lc.rows as any[])[0][0]);\n}\n\n// ---- Request handler --------------------------------------------------------\nexport default async function (req: Request): Promise {\n await ensureTables();\n const url = new URL(req.url);\n\n if (req.method === \"OPTIONS\") return cors(\"\", 204);\n\n // ---- Auth gate --------------------------------------------------------------\n // The dashboard API is protected by a shared secret (APP_SECRET env var) sent as\n // `Authorization: Bearer `. Covers every /api/* route plus the data dump\n // (/log.json) and the wipe (/clear). Deliberately NOT covered: the `/` health\n // page (aggregate counts only) and the Telnyx inbound webhook — Telnyx can't send\n // our secret, so that POST is left open here and verified by signature instead.\n const isProtected = url.pathname.startsWith(\"/api/\") || url.pathname === \"/log.json\" || url.pathname === \"/clear\";\n if (isProtected) {\n const secret = Deno.env.get(\"APP_SECRET\");\n if (!secret) return cors({ ok: false, error: \"Server auth not configured\" }, 503);\n const auth = req.headers.get(\"authorization\") || \"\";\n const token = auth.startsWith(\"Bearer \") ? auth.slice(7) : \"\";\n if (token !== secret) return cors({ ok: false, error: \"Unauthorized\" }, 401);\n }\n\n if (req.method === \"GET\" && url.pathname === \"/\") {\n return new Response(await renderPage(), { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } });\n }\n\n // --- Leads (enriched) ---\n if (req.method === \"GET\" && url.pathname === \"/api/leads\") {\n const clientId = clientIdFromReq(url);\n const leadsResult = await sqlite.execute({\n sql: `SELECT phone_number, name, campaign, status, created_at, mode, opted_out, assigned_number, assigned_agent_id FROM leads WHERE client_id = ? ORDER BY created_at DESC`,\n args: [clientId],\n });\n const rows = leadsResult.rows as any[];\n // Fetch ALL of this client's messages in ONE query and bucket by phone in\n // JS. The old code fired a separate message query PER lead via Promise.all\n // (1 + N queries — hundreds of concurrent SQLite ops per poll for a real\n // client), which overran Val.town's free-tier SQLite and caused the\n // intermittent 500s. Same response shape, ~600 queries -> 2.\n const msgsResult = await sqlite.execute({\n sql: `SELECT phone_number, direction, text, timestamp, channel_number FROM messages WHERE client_id = ? ORDER BY timestamp ASC`,\n args: [clientId],\n });\n const byPhone = new Map();\n for (const m of (msgsResult.rows as any[])) {\n const arr = byPhone.get(m[0]) || [];\n arr.push({ direction: m[1], text: m[2], timestamp: m[3], channel_number: m[4] || null });\n byPhone.set(m[0], arr);\n }\n const leads = rows.map((row) => {\n const phone = row[0];\n const messages = byPhone.get(phone) || [];\n const inbound = messages.filter((m) => m.direction === \"inbound\");\n return {\n phone_number: phone, name: row[1], campaign: row[2], status: row[3], created_at: row[4],\n mode: row[5] || \"ai\", opted_out: row[6] ? 1 : 0, assigned_number: row[7] || null,\n assigned_agent_id: row[8] || null,\n messages, reply_count: inbound.length,\n last_text: messages.length ? messages[messages.length - 1].text : null,\n last_message_at: messages.length ? messages[messages.length - 1].timestamp : row[4],\n };\n });\n return cors({ leads });\n }\n\n // --- Add / update / import leads ---\n if (req.method === \"POST\" && url.pathname === \"/api/lead\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const clientId = clientIdFromReq(url, body);\n const incoming = Array.isArray(body?.leads) ? body.leads : [body];\n const now = new Date().toISOString();\n // Dedupe within the payload (last wins) so a single multi-row upsert can't\n // conflict with itself, then write in chunks — one round-trip per chunk\n // instead of one per lead. A 5k-row CSV used to be 5k sequential queries.\n const byPhone = new Map();\n for (const lead of incoming) {\n const phone = lead?.phone_number ? normalizePhone(lead.phone_number) : \"\";\n if (!phone) continue;\n byPhone.set(phone, {\n phone,\n name: lead?.name ?? null,\n campaign: lead?.campaign ?? \"uncategorized\",\n assigned: lead?.assigned_number ?? null,\n });\n }\n const rows = [...byPhone.values()];\n // Val.town SQLite rejects any statement with >500 bound params. Each row\n // binds 6 (client_id, phone, name, campaign, created_at, assigned_number),\n // so cap the multi-row upsert at 80 rows/statement (80*6=480 < 500).\n const CHUNK = 80;\n for (let i = 0; i < rows.length; i += CHUNK) {\n const slice = rows.slice(i, i + CHUNK);\n const values = slice.map(() => `(?, ?, ?, ?, 'active', ?, ?)`).join(\",\");\n const args: any[] = [];\n for (const r of slice) args.push(clientId, r.phone, r.name, r.campaign, now, r.assigned);\n await sqlite.execute({\n sql: `INSERT INTO leads (client_id, phone_number, name, campaign, status, created_at, assigned_number)\n VALUES ${values}\n ON CONFLICT(client_id, phone_number) DO UPDATE SET\n name = excluded.name,\n campaign = excluded.campaign,\n assigned_number = COALESCE(excluded.assigned_number, leads.assigned_number)`,\n args,\n });\n }\n return cors({ ok: true, upserted: rows.length });\n }\n\n // --- Edit a lead's details (name, campaign, and/or phone number) ---\n // Changing the phone number migrates the lead's messages + campaign queue\n // rows too, since phone_number is the primary key that links them.\n if (req.method === \"POST\" && url.pathname === \"/api/lead/update\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const clientId = clientIdFromReq(url, body);\n const originalPhone = body?.original_phone;\n if (!originalPhone) return cors({ ok: false, error: \"original_phone required\" }, 400);\n const lead = await getLead(clientId, originalPhone);\n if (!lead) return cors({ ok: false, error: \"Lead not found\" }, 404);\n\n const name = body?.name ?? lead.name;\n const campaign = body?.campaign ?? lead.campaign;\n const assignedNumber = body?.assigned_number !== undefined ? (body.assigned_number || null) : lead.assigned_number;\n const newPhone = body?.phone_number ? normalizePhone(body.phone_number) : originalPhone;\n\n if (newPhone !== originalPhone) {\n const exists = await sqlite.execute({ sql: `SELECT 1 FROM leads WHERE client_id = ? AND phone_number = ?`, args: [clientId, newPhone] });\n if ((exists.rows as any[]).length) {\n return cors({ ok: false, error: \"That phone number already belongs to another lead.\" }, 409);\n }\n await sqlite.execute({\n sql: `UPDATE leads SET phone_number = ?, name = ?, campaign = ?, assigned_number = ? WHERE client_id = ? AND phone_number = ?`,\n args: [newPhone, name, campaign, assignedNumber, clientId, originalPhone],\n });\n await sqlite.execute({ sql: `UPDATE messages SET phone_number = ? WHERE client_id = ? AND phone_number = ?`, args: [newPhone, clientId, originalPhone] });\n await sqlite.execute({ sql: `UPDATE campaign_queue SET phone_number = ? WHERE client_id = ? AND phone_number = ?`, args: [newPhone, clientId, originalPhone] });\n } else {\n await sqlite.execute({\n sql: `UPDATE leads SET name = ?, campaign = ?, assigned_number = ? WHERE client_id = ? AND phone_number = ?`,\n args: [name, campaign, assignedNumber, clientId, originalPhone],\n });\n }\n return cors({ ok: true, phone_number: newPhone, name, campaign, assigned_number: assignedNumber });\n }\n\n // --- Delete one or more leads (and their messages + queue rows) ---\n if (req.method === \"POST\" && url.pathname === \"/api/lead/delete\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const clientId = clientIdFromReq(url, body);\n const phones = Array.isArray(body?.phone_numbers)\n ? body.phone_numbers\n : (body?.phone_number ? [body.phone_number] : []);\n const list = phones.map((p: string) => normalizePhone(p)).filter(Boolean);\n if (!list.length) return cors({ ok: false, error: \"phone_numbers required\" }, 400);\n // Delete in chunks with a single IN-clause per table — 3 round-trips per\n // chunk instead of 3 per lead. The old per-lead loop meant deleting 500\n // leads fired 1,500 sequential queries: slow, and if any one timed out the\n // whole request 500'd mid-way, leaving a partial (and confusing) delete.\n const CHUNK = 200;\n for (let i = 0; i < list.length; i += CHUNK) {\n const slice = list.slice(i, i + CHUNK);\n const ph = slice.map(() => \"?\").join(\",\");\n await sqlite.execute({ sql: `DELETE FROM messages WHERE client_id = ? AND phone_number IN (${ph})`, args: [clientId, ...slice] });\n await sqlite.execute({ sql: `DELETE FROM campaign_queue WHERE client_id = ? AND phone_number IN (${ph})`, args: [clientId, ...slice] });\n await sqlite.execute({ sql: `DELETE FROM leads WHERE client_id = ? AND phone_number IN (${ph})`, args: [clientId, ...slice] });\n }\n return cors({ ok: true, deleted: list.length });\n }\n\n // --- Assign one or more leads to a campaign (bulk tag) ---\n if (req.method === \"POST\" && url.pathname === \"/api/lead/assign\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const clientId = clientIdFromReq(url, body);\n const campaign = String(body?.campaign || \"\").trim();\n const phones = Array.isArray(body?.phone_numbers) ? body.phone_numbers : [];\n const list = phones.map((p: string) => normalizePhone(p)).filter(Boolean);\n if (!campaign || !list.length) return cors({ ok: false, error: \"campaign and phone_numbers required\" }, 400);\n const CHUNK = 200;\n for (let i = 0; i < list.length; i += CHUNK) {\n const slice = list.slice(i, i + CHUNK);\n const ph = slice.map(() => \"?\").join(\",\");\n await sqlite.execute({ sql: `UPDATE leads SET campaign = ? WHERE client_id = ? AND phone_number IN (${ph})`, args: [campaign, clientId, ...slice] });\n }\n return cors({ ok: true, updated: list.length, campaign });\n }\n\n // --- Manual takeover: flip a thread between AI and manual ---\n if (req.method === \"POST\" && url.pathname === \"/api/mode\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const clientId = clientIdFromReq(url, body);\n const { phone_number, mode } = body;\n if (!phone_number || ![\"ai\", \"manual\"].includes(mode)) {\n return cors({ ok: false, error: \"phone_number and mode ('ai'|'manual') required\" }, 400);\n }\n await sqlite.execute({ sql: `UPDATE leads SET mode = ? WHERE client_id = ? AND phone_number = ?`, args: [mode, clientId, phone_number] });\n return cors({ ok: true, phone_number, mode });\n }\n\n // --- Pin a specific bot to ONE conversation (overrides campaign/default bot in\n // generateAIReply); agent_id null/empty = unpin. ---\n if (req.method === \"POST\" && url.pathname === \"/api/lead/agent\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const clientId = clientIdFromReq(url, body);\n const { phone_number } = body;\n if (!phone_number) return cors({ ok: false, error: \"phone_number required\" }, 400);\n const agentId = (body.agent_id === null || body.agent_id === undefined || body.agent_id === \"\")\n ? null : Number(body.agent_id);\n // Guard: only allow pinning an agent that belongs to this client.\n if (agentId !== null) {\n const a = await sqlite.execute({ sql: `SELECT id FROM agents WHERE id = ? AND client_id = ?`, args: [agentId, clientId] });\n if (!(a.rows as any[])[0]) return cors({ ok: false, error: \"agent not found for this client\" }, 404);\n }\n await sqlite.execute({ sql: `UPDATE leads SET assigned_agent_id = ? WHERE client_id = ? AND phone_number = ?`, args: [agentId, clientId, phone_number] });\n return cors({ ok: true, phone_number, assigned_agent_id: agentId });\n }\n\n // --- Make the bot reply NOW to the thread as it stands (the normal auto-reply\n // only fires on a fresh inbound webhook; this is the on-demand hand-off). ---\n if (req.method === \"POST\" && url.pathname === \"/api/lead/ai-reply\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const clientId = clientIdFromReq(url, body);\n const { phone_number } = body;\n if (!phone_number) return cors({ ok: false, error: \"phone_number required\" }, 400);\n const lead = await getLead(clientId, phone_number);\n if (!lead) return cors({ ok: false, error: \"lead not found\" }, 404);\n if (lead.opted_out) return cors({ ok: false, error: \"lead has opted out\" }, 400);\n const reply = await generateAIReply(clientId, phone_number, lead);\n if (!reply) return cors({ ok: false, error: \"the bot did not produce a reply\" }, 502);\n // `from` override lets the gateway reply back out the same number it arrived on.\n const aiFrom = (body.from || null) || lead.assigned_number || Deno.env.get(\"TELNYX_FROM_NUMBER\") || null;\n const sent = await sendSMS(phone_number, reply, aiFrom);\n if (!sent) return cors({ ok: false, error: \"generated a reply but the SMS send failed\" }, 502);\n await logMessage(clientId, phone_number, \"ai\", reply, aiFrom);\n await sqlite.execute({\n sql: `UPDATE leads SET status = 'engaged' WHERE client_id = ? AND phone_number = ? AND status IN ('active','sent')`,\n args: [clientId, phone_number],\n });\n return cors({ ok: true, reply });\n }\n\n // --- Manual takeover: send a message as the human operator ---\n if (req.method === \"POST\" && url.pathname === \"/api/send\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const clientId = clientIdFromReq(url, body);\n const { phone_number, text } = body;\n if (!phone_number || !text?.trim()) return cors({ ok: false, error: \"phone_number and text required\" }, 400);\n const lead = await getLead(clientId, phone_number);\n const from = lead?.assigned_number || Deno.env.get(\"TELNYX_FROM_NUMBER\") || null;\n const ok = await sendSMS(phone_number, text.trim(), from);\n if (ok) {\n await logMessage(clientId, phone_number, \"manual\", text.trim(), from);\n // Record which number is handling this lead, if not already pinned.\n if (!lead?.assigned_number && from) {\n await sqlite.execute({ sql: `UPDATE leads SET assigned_number = ? WHERE client_id = ? AND phone_number = ?`, args: [from, clientId, phone_number] });\n }\n }\n return cors({ ok });\n }\n\n // --- Numbers: GLOBAL registry (above the client layer). Each number is either\n // unassigned (client_id null, sits in the pool) or assigned to one client. ---\n if (req.method === \"GET\" && url.pathname === \"/api/numbers\") {\n const r = await sqlite.execute(`SELECT phone_number, label, client_id, created_at FROM numbers ORDER BY created_at ASC`);\n const numbers = (r.rows as any[]).map((n) => ({ phone_number: n[0], label: n[1] || null, client_id: n[2] || null, created_at: n[3] }));\n return cors({ numbers });\n }\n\n // --- Add a number to the pool (optionally assigned to a client) ---\n if (req.method === \"POST\" && url.pathname === \"/api/number\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const phone = body?.phone_number ? normalizePhone(body.phone_number) : \"\";\n if (!phone) return cors({ ok: false, error: \"phone_number required\" }, 400);\n const assignTo = body?.client_id != null ? Number(body.client_id) : null; // null = unassigned pool\n await sqlite.execute({\n sql: `INSERT INTO numbers (phone_number, label, client_id, created_at) VALUES (?, ?, ?, ?)\n ON CONFLICT(phone_number) DO UPDATE SET label = excluded.label`,\n args: [phone, body?.label ?? null, assignTo, new Date().toISOString()],\n });\n const r = await sqlite.execute(`SELECT phone_number, label, client_id, created_at FROM numbers ORDER BY created_at ASC`);\n return cors({ ok: true, numbers: (r.rows as any[]).map((n) => ({ phone_number: n[0], label: n[1] || null, client_id: n[2] || null, created_at: n[3] })) });\n }\n\n // --- Assign / reassign / free a number (client_id null = back to the pool) ---\n if (req.method === \"POST\" && url.pathname === \"/api/number/assign\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const phone = body?.phone_number ? normalizePhone(body.phone_number) : \"\";\n if (!phone) return cors({ ok: false, error: \"phone_number required\" }, 400);\n const assignTo = body?.client_id != null ? Number(body.client_id) : null;\n await sqlite.execute({ sql: `UPDATE numbers SET client_id = ? WHERE phone_number = ?`, args: [assignTo, phone] });\n const r = await sqlite.execute(`SELECT phone_number, label, client_id, created_at FROM numbers ORDER BY created_at ASC`);\n return cors({ ok: true, numbers: (r.rows as any[]).map((n) => ({ phone_number: n[0], label: n[1] || null, client_id: n[2] || null, created_at: n[3] })) });\n }\n\n // --- Remove a number from the pool entirely ---\n if (req.method === \"POST\" && url.pathname === \"/api/number/delete\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const phone = body?.phone_number ? normalizePhone(body.phone_number) : \"\";\n if (!phone) return cors({ ok: false, error: \"phone_number required\" }, 400);\n await sqlite.execute({ sql: `DELETE FROM numbers WHERE phone_number = ?`, args: [phone] });\n const r = await sqlite.execute(`SELECT phone_number, label, client_id, created_at FROM numbers ORDER BY created_at ASC`);\n return cors({ ok: true, numbers: (r.rows as any[]).map((n) => ({ phone_number: n[0], label: n[1] || null, client_id: n[2] || null, created_at: n[3] })) });\n }\n\n // --- Unrouted inbound (texts that landed on an unassigned number) ---\n if (req.method === \"GET\" && url.pathname === \"/api/unrouted\") {\n const r = await sqlite.execute(`SELECT id, phone_number, to_number, text, timestamp FROM unrouted_messages ORDER BY timestamp DESC LIMIT 100`);\n const messages = (r.rows as any[]).map((m) => ({ id: m[0], phone_number: m[1], to_number: m[2], text: m[3], timestamp: m[4] }));\n return cors({ messages });\n }\n\n // --- Unrouted: dismiss (all, or one by id) ---\n if (req.method === \"POST\" && url.pathname === \"/api/unrouted/clear\") {\n let body: any = {};\n try { body = await req.json(); } catch { /* allow empty body = clear all */ }\n if (body?.id != null) await sqlite.execute({ sql: `DELETE FROM unrouted_messages WHERE id = ?`, args: [body.id] });\n else await sqlite.execute(`DELETE FROM unrouted_messages`);\n return cors({ ok: true });\n }\n\n // --- Clients: list ---\n if (req.method === \"GET\" && url.pathname === \"/api/clients\") {\n const r = await sqlite.execute(`SELECT id, name, created_at FROM clients ORDER BY id ASC`);\n const clients = (r.rows as any[]).map((c) => ({ id: c[0], name: c[1], created_at: c[2] }));\n return cors({ clients });\n }\n\n // --- Clients: create ---\n if (req.method === \"POST\" && url.pathname === \"/api/client\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const name = String(body?.name || \"\").trim();\n if (!name) return cors({ ok: false, error: \"name required\" }, 400);\n const ins = await sqlite.execute({ sql: `INSERT INTO clients (name, created_at) VALUES (?, ?)`, args: [name, new Date().toISOString()] });\n return cors({ ok: true, id: Number(ins.lastInsertRowid), name });\n }\n\n // --- Clients: rename ---\n if (req.method === \"POST\" && url.pathname === \"/api/client/rename\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const name = String(body?.name || \"\").trim();\n if (!body?.id || !name) return cors({ ok: false, error: \"id and name required\" }, 400);\n await sqlite.execute({ sql: `UPDATE clients SET name = ? WHERE id = ?`, args: [name, body.id] });\n return cors({ ok: true, id: body.id, name });\n }\n\n // --- Clients: delete (refuse if it still owns data; frees its numbers) ---\n if (req.method === \"POST\" && url.pathname === \"/api/client/delete\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const id = Number(body?.id);\n if (!id) return cors({ ok: false, error: \"id required\" }, 400);\n if (id === DEFAULT_CLIENT_ID) return cors({ ok: false, error: \"The Default client can't be deleted.\" }, 400);\n let owned = 0;\n for (const t of [\"leads\", \"campaigns\", \"agents\"]) {\n const r = await sqlite.execute({ sql: `SELECT COUNT(*) FROM ${t} WHERE client_id = ?`, args: [id] });\n owned += Number((r.rows as any[])[0][0]) || 0;\n }\n if (owned > 0) return cors({ ok: false, error: \"This client still has leads, campaigns or agents. Move or delete those first.\" }, 409);\n await sqlite.execute({ sql: `UPDATE numbers SET client_id = NULL WHERE client_id = ?`, args: [id] });\n await sqlite.execute({ sql: `DELETE FROM folders WHERE client_id = ?`, args: [id] });\n await sqlite.execute({ sql: `DELETE FROM settings WHERE client_id = ?`, args: [id] });\n await sqlite.execute({ sql: `DELETE FROM clients WHERE id = ?`, args: [id] });\n return cors({ ok: true });\n }\n\n // --- Campaigns: list with queue stats ---\n if (req.method === \"GET\" && url.pathname === \"/api/campaigns\") {\n const clientId = clientIdFromReq(url);\n const r = await sqlite.execute({\n sql: `SELECT id, name, opening_message, status, from_number, created_at,\n agent_name, business_name, goal, offer, booking_link, knowledge, guardrails, personality, persuasion, reply_length, source_url, agent_id, manual\n FROM campaigns WHERE client_id = ? ORDER BY created_at DESC`,\n args: [clientId],\n });\n const campaigns = await Promise.all((r.rows as any[]).map(async (c) => {\n const id = c[0];\n const stats = await sqlite.execute({\n sql: `SELECT\n COUNT(*) AS total,\n SUM(CASE WHEN status='sent' THEN 1 ELSE 0 END) AS sent,\n SUM(CASE WHEN status='pending' THEN 1 ELSE 0 END) AS pending\n FROM campaign_queue WHERE campaign_id = ?`,\n args: [id],\n });\n const s = (stats.rows as any[])[0];\n return {\n id, name: c[1], opening_message: c[2], status: c[3], from_number: c[4], created_at: c[5],\n agent_name: c[6], business_name: c[7], goal: c[8], offer: c[9], booking_link: c[10],\n knowledge: c[11], guardrails: c[12], personality: c[13], persuasion: c[14], reply_length: c[15], source_url: c[16], agent_id: c[17], manual: c[18] ? 1 : 0,\n total: s[0] || 0, sent: s[1] || 0, pending: s[2] || 0,\n };\n }));\n return cors({ campaigns });\n }\n\n // --- Campaigns: create ---\n if (req.method === \"POST\" && url.pathname === \"/api/campaign\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const { name, opening_message, from_number } = body;\n if (!name?.trim() || !opening_message?.trim()) {\n return cors({ ok: false, error: \"name and opening_message required\" }, 400);\n }\n // Accept either from_numbers (array) or a single from_number. Stored as a\n // comma-separated list; empty => use all available numbers at send time.\n const fromList = Array.isArray(body?.from_numbers)\n ? body.from_numbers.map((n: string) => String(n).trim()).filter(Boolean)\n : (from_number ? [String(from_number).trim()] : []);\n const fromStr = fromList.length ? fromList.join(\",\") : null;\n const clientId = clientIdFromReq(url, body);\n const a = body?.agent || {};\n const r = await sqlite.execute({\n sql: `INSERT INTO campaigns (client_id, name, opening_message, status, from_number, created_at,\n agent_name, business_name, goal, offer, booking_link, knowledge, guardrails, personality, persuasion, reply_length, source_url, agent_id, manual)\n VALUES (?, ?, ?, 'draft', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [clientId, name.trim(), opening_message.trim(), fromStr, new Date().toISOString(),\n a.agent_name ?? null, a.business_name ?? null, a.goal ?? null, a.offer ?? null, a.booking_link ?? null,\n a.knowledge ?? null, a.guardrails ?? null, a.personality ?? \"balanced\", a.persuasion ?? \"balanced\", a.reply_length ?? 3, a.source_url ?? null, body?.agent_id ?? null, body?.manual ? 1 : 0],\n });\n return cors({ ok: true, id: Number(r.lastInsertRowid) });\n }\n\n // --- Campaigns: update agent config + opening message ---\n if (req.method === \"POST\" && url.pathname === \"/api/campaign/update\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const id = body?.id;\n if (!id) return cors({ ok: false, error: \"id required\" }, 400);\n const clientId = clientIdFromReq(url, body);\n const a = body?.agent || {};\n await sqlite.execute({\n sql: `UPDATE campaigns SET\n opening_message = COALESCE(?, opening_message),\n agent_name = ?, business_name = ?, goal = ?, offer = ?, booking_link = ?,\n knowledge = ?, guardrails = ?, personality = ?, persuasion = ?, reply_length = ?, source_url = ?, agent_id = ?\n WHERE id = ? AND client_id = ?`,\n args: [\n body?.opening_message ?? null,\n a.agent_name ?? null, a.business_name ?? null, a.goal ?? null, a.offer ?? null, a.booking_link ?? null,\n a.knowledge ?? null, a.guardrails ?? null, a.personality ?? \"balanced\", a.persuasion ?? \"balanced\", a.reply_length ?? 3, a.source_url ?? null, body?.agent_id ?? null,\n id, clientId,\n ],\n });\n return cors({ ok: true, id });\n }\n\n // --- Agents library: list ---\n if (req.method === \"GET\" && url.pathname === \"/api/agents\") {\n const clientId = clientIdFromReq(url);\n const r = await sqlite.execute({\n sql: `SELECT id, name, agent_name, business_name, knowledge, guardrails, booking_link, personality, persuasion, reply_length, offers, offer, source_url, created_at, role, goal, channel, hulk_group, folder_id, target_audience\n FROM agents WHERE client_id = ? ORDER BY created_at DESC`,\n args: [clientId],\n });\n const agents = (r.rows as any[]).map((a) => {\n let offers: any = [];\n try { offers = a[10] ? JSON.parse(a[10]) : []; } catch { offers = []; }\n return {\n id: a[0], name: a[1], agent_name: a[2], business_name: a[3], knowledge: a[4], guardrails: a[5],\n booking_link: a[6], personality: a[7], persuasion: a[8], reply_length: a[9], offers, offer: a[11], source_url: a[12], created_at: a[13],\n role: a[14] || null, goal: a[15] || null, channel: a[16] || \"sms\", hulk_group: a[17] || null, folder_id: a[18] || null, target_audience: a[19] || null,\n };\n });\n return cors({ agents });\n }\n\n // --- Agents library: create or update (upsert by id) ---\n if (req.method === \"POST\" && url.pathname === \"/api/agent\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const clientId = clientIdFromReq(url, body);\n const f = body || {};\n if (!String(f.name || \"\").trim()) return cors({ ok: false, error: \"name required\" }, 400);\n const offersStr = Array.isArray(f.offers) ? JSON.stringify(f.offers) : (f.offers ?? null);\n if (f.id) {\n // role/goal/channel are preserved unless explicitly provided (COALESCE),\n // so editing a Hulk-generated agent in the standard editor keeps its job.\n await sqlite.execute({\n sql: `UPDATE agents SET name=?, agent_name=?, business_name=?, knowledge=?, guardrails=?, booking_link=?,\n personality=?, persuasion=?, reply_length=?, offers=?, offer=?, source_url=?, target_audience=?,\n role=COALESCE(?, role), goal=COALESCE(?, goal), channel=COALESCE(?, channel) WHERE id=? AND client_id=?`,\n args: [f.name, f.agent_name ?? null, f.business_name ?? null, f.knowledge ?? null, f.guardrails ?? null, f.booking_link ?? null,\n f.personality ?? \"balanced\", f.persuasion ?? \"balanced\", f.reply_length ?? 3, offersStr, f.offer ?? null, f.source_url ?? null, f.target_audience ?? null,\n f.role ?? null, f.goal ?? null, f.channel ?? null, f.id, clientId],\n });\n return cors({ ok: true, id: f.id });\n }\n // New agents auto-drop into their website's folder unless one is given.\n const folderId = f.folder_id != null ? f.folder_id : await ensureFolderForSite(clientId, f.source_url || \"\", f.business_name);\n const r = await sqlite.execute({\n sql: `INSERT INTO agents (client_id, name, agent_name, business_name, knowledge, guardrails, booking_link, personality, persuasion, reply_length, offers, offer, source_url, role, goal, channel, folder_id, target_audience, created_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [clientId, f.name, f.agent_name ?? null, f.business_name ?? null, f.knowledge ?? null, f.guardrails ?? null, f.booking_link ?? null,\n f.personality ?? \"balanced\", f.persuasion ?? \"balanced\", f.reply_length ?? 3, offersStr, f.offer ?? null, f.source_url ?? null,\n f.role ?? null, f.goal ?? null, f.channel ?? \"sms\", folderId, f.target_audience ?? null, new Date().toISOString()],\n });\n return cors({ ok: true, id: Number(r.lastInsertRowid), folder_id: folderId });\n }\n\n // --- Agents library: delete ---\n if (req.method === \"POST\" && url.pathname === \"/api/agent/delete\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n if (!body?.id) return cors({ ok: false, error: \"id required\" }, 400);\n const clientId = clientIdFromReq(url, body);\n await sqlite.execute({ sql: `DELETE FROM agents WHERE id = ? AND client_id = ?`, args: [body.id, clientId] });\n return cors({ ok: true });\n }\n\n // --- Folders: list (with live agent counts) ---\n if (req.method === \"GET\" && url.pathname === \"/api/folders\") {\n const clientId = clientIdFromReq(url);\n const r = await sqlite.execute({\n sql: `SELECT f.id, f.name, f.domain, f.created_at, COUNT(a.id) AS agent_count\n FROM folders f LEFT JOIN agents a ON a.folder_id = f.id\n WHERE f.client_id = ?\n GROUP BY f.id ORDER BY f.name COLLATE NOCASE ASC`,\n args: [clientId],\n });\n const folders = (r.rows as any[]).map((f) => ({ id: f[0], name: f[1], domain: f[2] || null, created_at: f[3], agent_count: f[4] || 0 }));\n return cors({ folders });\n }\n\n // --- Folders: create (manual) ---\n if (req.method === \"POST\" && url.pathname === \"/api/folder\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const clientId = clientIdFromReq(url, body);\n const name = String(body?.name || \"\").trim();\n if (!name) return cors({ ok: false, error: \"name required\" }, 400);\n const ins = await sqlite.execute({\n sql: `INSERT INTO folders (client_id, name, domain, created_at) VALUES (?, ?, NULL, ?)`,\n args: [clientId, name, new Date().toISOString()],\n });\n return cors({ ok: true, id: Number(ins.lastInsertRowid), name });\n }\n\n // --- Folders: rename ---\n if (req.method === \"POST\" && url.pathname === \"/api/folder/rename\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const clientId = clientIdFromReq(url, body);\n const name = String(body?.name || \"\").trim();\n if (!body?.id || !name) return cors({ ok: false, error: \"id and name required\" }, 400);\n await sqlite.execute({ sql: `UPDATE folders SET name = ? WHERE id = ? AND client_id = ?`, args: [name, body.id, clientId] });\n return cors({ ok: true, id: body.id, name });\n }\n\n // --- Folders: delete (agents fall back to uncategorised, not deleted) ---\n if (req.method === \"POST\" && url.pathname === \"/api/folder/delete\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n if (!body?.id) return cors({ ok: false, error: \"id required\" }, 400);\n const clientId = clientIdFromReq(url, body);\n await sqlite.execute({ sql: `UPDATE agents SET folder_id = NULL WHERE folder_id = ? AND client_id = ?`, args: [body.id, clientId] });\n await sqlite.execute({ sql: `DELETE FROM folders WHERE id = ? AND client_id = ?`, args: [body.id, clientId] });\n return cors({ ok: true });\n }\n\n // --- Agents: move one or more into a folder (folder_id null = uncategorised) ---\n if (req.method === \"POST\" && url.pathname === \"/api/agent/move\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const clientId = clientIdFromReq(url, body);\n const ids = Array.isArray(body?.ids) ? body.ids : (body?.id != null ? [body.id] : []);\n if (!ids.length) return cors({ ok: false, error: \"id or ids required\" }, 400);\n const folderId = body?.folder_id != null ? body.folder_id : null;\n for (const id of ids) {\n await sqlite.execute({ sql: `UPDATE agents SET folder_id = ? WHERE id = ? AND client_id = ?`, args: [folderId, id, clientId] });\n }\n return cors({ ok: true, moved: ids.length, folder_id: folderId });\n }\n\n // --- Agent: test chat (run the agent prompt vs a conversation; no SMS) ---\n if (req.method === \"POST\" && url.pathname === \"/api/agent/test\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const apiKey = Deno.env.get(\"OPENAI_API_KEY\");\n if (!apiKey) return cors({ ok: false, error: \"OPENAI_API_KEY not set\" }, 400);\n const cfg = { ...(body?.agent || {}), offer: body?.offer ?? (body?.agent?.offer ?? \"\"), goal: body?.goal ?? (body?.agent?.goal ?? \"\") };\n const agentName = cfg.agent_name || PERSONA.name;\n const msgs = Array.isArray(body?.messages) ? body.messages : [];\n const transcript = msgs.map((m: any) => `${m.role === \"lead\" ? \"Lead\" : agentName}: ${m.text}`).join(\"\\n\");\n try {\n const res = await fetch(\"https://api.openai.com/v1/chat/completions\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", \"Authorization\": `Bearer ${apiKey}` },\n body: JSON.stringify({\n model: AI_MODEL,\n max_tokens: replyMaxTokens(cfg.reply_length || 3),\n messages: [\n { role: \"system\", content: buildAgentSystem(cfg) },\n { role: \"user\", content: `Conversation so far:\\n${transcript}\\n\\nWrite only the next reply as ${agentName}. No quotes, no labels, just the message.` },\n ],\n }),\n });\n if (!res.ok) return cors({ ok: false, error: `OpenAI failed (HTTP ${res.status})` }, 400);\n const data = await res.json();\n return cors({ ok: true, reply: gsmify(data.choices?.[0]?.message?.content?.trim() || \"\") });\n } catch (e) {\n return cors({ ok: false, error: \"AI request failed.\" }, 400);\n }\n }\n\n // --- Agent: scrape a website and extract offer/knowledge (build-from-URL) ---\n if (req.method === \"POST\" && url.pathname === \"/api/agent/scrape\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const result = await scrapeSite(body?.url);\n if (!result.ok) return cors({ ok: false, error: result.error }, result.status);\n return cors({ ok: true, data: result.data });\n }\n\n // --- Agent: suggest 3 opening SMS messages (role + audience aware) ---\n if (req.method === \"POST\" && url.pathname === \"/api/agent/opener\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const apiKey = Deno.env.get(\"OPENAI_API_KEY\");\n if (!apiKey) return cors({ ok: false, error: \"OPENAI_API_KEY not set\" }, 400);\n const a = body?.agent || {};\n const cfg = {\n ...a,\n offer: body?.offer ?? a.offer ?? \"\",\n goal: body?.goal ?? a.goal ?? \"\",\n target_audience: body?.target_audience ?? a.target_audience ?? \"\",\n };\n const roleLabel = (HULK_ROLES.find((r) => r.role === (body?.role ?? a.role))?.label) || \"outreach\";\n const sys = buildAgentSystem(cfg) +\n `\\n\\nYou are writing the FIRST outreach SMS for a \"${roleLabel}\" automation — the very first text the contact receives. ` +\n `Produce exactly 3 distinct options. Keep each under 160 characters, plain GSM text, no emojis. ` +\n `Use {first_name} as the personalisation token where a name fits. Vary the angle (e.g. direct, curious, value-led). ` +\n `Return ONLY JSON: {\"variants\":[{\"text\":string,\"why\":string}],\"recommended_index\":number}.`;\n try {\n const res = await fetch(\"https://api.openai.com/v1/chat/completions\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", \"Authorization\": `Bearer ${apiKey}` },\n body: JSON.stringify({\n model: AI_MODEL,\n response_format: { type: \"json_object\" },\n messages: [\n { role: \"system\", content: sys },\n { role: \"user\", content: `Business: ${cfg.business_name || \"(unknown)\"}. Offer: ${cfg.offer || \"(none)\"}. Audience: ${cfg.target_audience || \"(general)\"}. Write the 3 openers.` },\n ],\n }),\n });\n if (!res.ok) return cors({ ok: false, error: `OpenAI failed (HTTP ${res.status})` }, 400);\n const data = await res.json();\n const parsed = JSON.parse(data.choices?.[0]?.message?.content || \"{}\");\n const variants = (Array.isArray(parsed.variants) ? parsed.variants : []).slice(0, 3)\n .map((v: any) => ({ text: gsmify(String(v?.text || \"\")), why: String(v?.why || \"\") }))\n .filter((v: any) => v.text);\n if (!variants.length) return cors({ ok: false, error: \"No openers returned.\" }, 400);\n let rec = Number(parsed.recommended_index);\n if (!Number.isInteger(rec) || rec < 0 || rec >= variants.length) rec = 0;\n return cors({ ok: true, variants, recommended_index: rec });\n } catch (e) {\n return cors({ ok: false, error: \"Opener request failed.\" }, 400);\n }\n }\n\n // --- Build ONE recommended bot from a scrape (single role — same templates as Titan) ---\n if (req.method === \"POST\" && url.pathname === \"/api/agent/build-role\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const clientId = clientIdFromReq(url, body);\n const r = HULK_ROLES.find((x) => x.role === String(body?.role || \"\").trim());\n if (!r) return cors({ ok: false, error: \"unknown role\" }, 400);\n // Reuse the scrape data the client already has; only re-scrape if not provided.\n let d = body?.data;\n if (!d) {\n const result = await scrapeSite(body?.url);\n if (!result.ok) return cors({ ok: false, error: result.error }, result.status);\n d = result.data;\n }\n d = d || {};\n const business = String(d.business_name || \"\").trim();\n const offer = String(d.recommended_offer || \"\").trim();\n const audience = String(d.target_audience || \"\").trim();\n const offers = [...(Array.isArray(d.services) ? d.services : []), ...(Array.isArray(d.lead_magnets) ? d.lead_magnets : [])];\n const bookingLink = d?.contact?.booking_link || \"\";\n let sourceUrl = String(body?.url || d.source_url || \"\").trim();\n if (sourceUrl && !/^https?:\\/\\//i.test(sourceUrl)) sourceUrl = \"https://\" + sourceUrl;\n const folderId = await ensureFolderForSite(clientId, sourceUrl, business);\n const libName = `${business || \"Agent\"} — ${r.label}`;\n const ins = await sqlite.execute({\n sql: `INSERT INTO agents (client_id, name, agent_name, business_name, knowledge, guardrails, booking_link, personality, persuasion, reply_length, offers, offer, source_url, role, goal, channel, folder_id, target_audience, created_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [clientId, libName, PERSONA.name || \"Alex\", business || null, buildKnowledgeFromScrape(d), r.guardrails, bookingLink || null,\n r.personality, r.persuasion, r.reply_length, JSON.stringify(offers), offer || null, sourceUrl || null,\n r.role, r.goalFor(offer), r.channel, folderId, audience || null, new Date().toISOString()],\n });\n const id = Number(ins.lastInsertRowid);\n if (r.role === \"speed-to-lead\" && !(await getSetting(clientId, \"inbound_agent_id\"))) {\n await setSetting(clientId, \"inbound_agent_id\", String(id));\n }\n return cors({ ok: true, id, role: r.role, label: r.label, name: libName, folder_id: folderId });\n }\n\n // --- Hulk Mode: one scrape spawns the whole squad of role-specialised agents ---\n if (req.method === \"POST\" && url.pathname === \"/api/hulk\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const clientId = clientIdFromReq(url, body);\n const result = await scrapeSite(body?.url);\n if (!result.ok) return cors({ ok: false, error: result.error }, result.status);\n const d = result.data || {};\n\n const business = String(d.business_name || \"\").trim();\n const knowledge = buildKnowledgeFromScrape(d);\n const offer = String(d.recommended_offer || \"\").trim();\n const audience = String(d.target_audience || \"\").trim();\n const recUseCases = Array.isArray(d.recommended_use_cases) ? d.recommended_use_cases : [];\n const bookingLink = d?.contact?.booking_link || \"\";\n const offers = [...(Array.isArray(d.services) ? d.services : []), ...(Array.isArray(d.lead_magnets) ? d.lead_magnets : [])];\n let sourceUrl = String(body?.url || \"\").trim();\n if (sourceUrl && !/^https?:\\/\\//i.test(sourceUrl)) sourceUrl = \"https://\" + sourceUrl;\n const groupId = `hulk_${Date.now()}`;\n const now = new Date().toISOString();\n const folderId = await ensureFolderForSite(clientId, sourceUrl, business);\n\n const created: any[] = [];\n let speedToLeadId: number | null = null;\n for (const r of HULK_ROLES) {\n const goal = r.goalFor(offer);\n const libName = `${business || \"Agent\"} — ${r.label}`;\n const ins = await sqlite.execute({\n sql: `INSERT INTO agents (client_id, name, agent_name, business_name, knowledge, guardrails, booking_link,\n personality, persuasion, reply_length, offers, offer, source_url, role, goal, channel, hulk_group, folder_id, target_audience, created_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [clientId, libName, PERSONA.name || \"Alex\", business || null, knowledge, r.guardrails, bookingLink || null,\n r.personality, r.persuasion, r.reply_length, JSON.stringify(offers), offer || null, sourceUrl || null,\n r.role, goal, r.channel, groupId, folderId, audience || null, now],\n });\n const id = Number(ins.lastInsertRowid);\n if (r.role === \"speed-to-lead\") speedToLeadId = id;\n created.push({ id, role: r.role, label: r.label, emoji: r.emoji, channel: r.channel, name: libName });\n }\n\n // Auto-wire Speed to Lead as this client's default responder for brand-new\n // inbound leads, unless one has already been chosen.\n if (speedToLeadId && !(await getSetting(clientId, \"inbound_agent_id\"))) {\n await setSetting(clientId, \"inbound_agent_id\", String(speedToLeadId));\n }\n\n return cors({ ok: true, group: groupId, business, offer, folder_id: folderId, target_audience: audience, recommended_use_cases: recUseCases, agents: created });\n }\n\n // --- Settings: read all for a client (e.g. which agent answers new inbound) ---\n if (req.method === \"GET\" && url.pathname === \"/api/settings\") {\n const clientId = clientIdFromReq(url);\n const r = await sqlite.execute({ sql: `SELECT key, value FROM settings WHERE client_id = ?`, args: [clientId] });\n const settings: Record = {};\n for (const row of (r.rows as any[])) settings[row[0]] = row[1];\n return cors({ settings });\n }\n\n // --- Settings: set one key for a client ---\n if (req.method === \"POST\" && url.pathname === \"/api/settings\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n if (!body?.key) return cors({ ok: false, error: \"key required\" }, 400);\n const clientId = clientIdFromReq(url, body);\n await setSetting(clientId, String(body.key), body.value == null ? null : String(body.value));\n return cors({ ok: true, key: body.key, value: body.value ?? null });\n }\n\n // --- Campaigns: start / resume (enqueues matching leads, sets running) ---\n if (req.method === \"POST\" && url.pathname === \"/api/campaign/start\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const id = body?.id;\n if (!id) return cors({ ok: false, error: \"id required\" }, 400);\n const clientId = clientIdFromReq(url, body);\n\n const cr = await sqlite.execute({ sql: `SELECT name, from_number, manual FROM campaigns WHERE id = ? AND client_id = ?`, args: [id, clientId] });\n const crow = (cr.rows as any[])[0];\n if (!crow) return cors({ ok: false, error: \"campaign not found\" }, 404);\n const campaignName = crow[0];\n const isManual = !!crow[2];\n\n // Manual campaigns are answered by hand: put their leads in 'manual' mode so\n // the inbound webhook skips the AI auto-reply (see the mode !== \"manual\"\n // gate). AI campaigns are left untouched, preserving existing behaviour.\n if (isManual) {\n await sqlite.execute({\n sql: `UPDATE leads SET mode = 'manual' WHERE client_id = ? AND campaign = ?`,\n args: [clientId, campaignName],\n });\n }\n\n // The pool of numbers this campaign sends from: the campaign's chosen\n // numbers, or all of this client's numbers if none were specified.\n const chosen = (crow[1] ? String(crow[1]).split(\",\").map((s: string) => s.trim()).filter(Boolean) : []);\n const pool = chosen.length ? chosen : await availableNumbersList(clientId);\n\n // Enqueue every non-opted-out lead tagged with this campaign that isn't\n // already queued. send_after is spaced randomly 30-120s apart so the cron\n // drip-feeds them. Each lead is round-robin assigned one number from the\n // pool, pinned on both the queue row (for sending) and the lead (so replies\n // come back on the same number). INSERT OR IGNORE makes resume idempotent.\n const leadsRes = await sqlite.execute({\n sql: `SELECT phone_number FROM leads WHERE client_id = ? AND campaign = ? AND opted_out = 0`,\n args: [clientId, campaignName],\n });\n let queued = 0;\n let cursor = Date.now();\n let i = 0;\n for (const lr of (leadsRes.rows as any[])) {\n cursor += (30 + Math.floor(Math.random() * 90)) * 1000; // +30..120s\n const sendNumber = pool.length ? pool[i % pool.length] : null;\n i++;\n const ins = await sqlite.execute({\n sql: `INSERT OR IGNORE INTO campaign_queue (client_id, campaign_id, phone_number, status, send_after, send_number)\n VALUES (?, ?, ?, 'pending', ?, ?)`,\n args: [clientId, id, lr[0], new Date(cursor).toISOString(), sendNumber],\n });\n if (ins.rowsAffected) {\n queued++;\n if (sendNumber) {\n await sqlite.execute({\n sql: `UPDATE leads SET assigned_number = ? WHERE client_id = ? AND phone_number = ?`,\n args: [sendNumber, clientId, lr[0]],\n });\n }\n }\n }\n await sqlite.execute({ sql: `UPDATE campaigns SET status = 'running' WHERE id = ? AND client_id = ?`, args: [id, clientId] });\n return cors({ ok: true, id, status: \"running\", newly_queued: queued });\n }\n\n // --- Campaigns: SEND NOW — fire the pending queue immediately, sequentially\n // (not a parallel flood), capped + time-budgeted. Cron covers leftovers.\n if (req.method === \"POST\" && url.pathname === \"/api/campaign/blast\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n const id = body?.id;\n if (!id) return cors({ ok: false, error: \"id required\" }, 400);\n const clientId = clientIdFromReq(url, body);\n const cap = Math.min(Math.max(1, Number(body?.limit) || 40), 80);\n const due = await sqlite.execute({\n sql: `SELECT q.id, q.phone_number, q.send_number, c.opening_message FROM campaign_queue q\n JOIN campaigns c ON c.id = q.campaign_id\n WHERE q.client_id = ? AND q.campaign_id = ? AND q.status = 'pending' AND c.status = 'running'\n ORDER BY q.send_after ASC LIMIT ?`,\n args: [clientId, id, cap],\n });\n const rows = due.rows as any[];\n const t0 = Date.now();\n let sent = 0, failed = 0;\n for (let i = 0; i < rows.length; i++) {\n if (Date.now() - t0 > 28000) break;\n const [qid, phone, sendNumber, opening] = rows[i];\n const lead = await getLead(clientId, phone);\n if (!lead || lead.opted_out) { await sqlite.execute({ sql: `UPDATE campaign_queue SET status='cancelled' WHERE id=?`, args: [qid] }); continue; }\n const from = sendNumber || lead.assigned_number || Deno.env.get(\"TELNYX_FROM_NUMBER\") || null;\n const text = gsmify(applyTemplate(opening || \"\", { name: lead.name, phone_number: phone }));\n if (await sendSMS(phone, text, from)) {\n await sqlite.execute({ sql: `UPDATE campaign_queue SET status='sent', sent_at=? WHERE id=?`, args: [new Date().toISOString(), qid] });\n await logMessage(clientId, phone, \"campaign\", text, from);\n await sqlite.execute({ sql: `UPDATE leads SET status='sent' WHERE client_id=? AND phone_number=? AND status='active'`, args: [clientId, phone] });\n sent++;\n } else {\n await sqlite.execute({ sql: `UPDATE campaign_queue SET status='failed' WHERE id=?`, args: [qid] });\n failed++;\n }\n if (i < rows.length - 1) await new Promise((r) => setTimeout(r, 220));\n }\n const rem = await sqlite.execute({ sql: `SELECT COUNT(*) FROM campaign_queue WHERE client_id=? AND campaign_id=? AND status='pending'`, args: [clientId, id] });\n return cors({ ok: true, sent, failed, remaining: Number((rem.rows as any[])[0][0]) });\n }\n\n // --- Campaigns: pause (keeps queue, cron skips it) ---\n if (req.method === \"POST\" && url.pathname === \"/api/campaign/pause\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n if (!body?.id) return cors({ ok: false, error: \"id required\" }, 400);\n const clientId = clientIdFromReq(url, body);\n await sqlite.execute({ sql: `UPDATE campaigns SET status = 'paused' WHERE id = ? AND client_id = ?`, args: [body.id, clientId] });\n return cors({ ok: true, id: body.id, status: \"paused\" });\n }\n\n // --- Campaigns: terminate (cancels remaining queue) ---\n if (req.method === \"POST\" && url.pathname === \"/api/campaign/terminate\") {\n let body: any = {};\n try { body = await req.json(); } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n if (!body?.id) return cors({ ok: false, error: \"id required\" }, 400);\n const clientId = clientIdFromReq(url, body);\n await sqlite.execute({\n sql: `UPDATE campaign_queue SET status = 'cancelled' WHERE campaign_id = ? AND client_id = ? AND status = 'pending'`,\n args: [body.id, clientId],\n });\n await sqlite.execute({ sql: `UPDATE campaigns SET status = 'terminated' WHERE id = ? AND client_id = ?`, args: [body.id, clientId] });\n return cors({ ok: true, id: body.id, status: \"terminated\" });\n }\n\n // --- Raw JSON dump ---\n if (req.method === \"GET\" && url.pathname === \"/log.json\") {\n const leads = await sqlite.execute(`SELECT * FROM leads`);\n const messages = await sqlite.execute(`SELECT * FROM messages`);\n const campaigns = await sqlite.execute(`SELECT * FROM campaigns`);\n const queue = await sqlite.execute(`SELECT * FROM campaign_queue`);\n return cors({ leads: leads.rows, messages: messages.rows, campaigns: campaigns.rows, queue: queue.rows });\n }\n\n // --- Wipe everything ---\n if (req.method === \"POST\" && url.pathname === \"/clear\") {\n await sqlite.execute(`DELETE FROM messages`);\n await sqlite.execute(`DELETE FROM leads`);\n await sqlite.execute(`DELETE FROM campaign_queue`);\n await sqlite.execute(`DELETE FROM campaigns`);\n return Response.redirect(url.origin + \"/\", 303);\n }\n\n // --- Telnyx inbound webhook (fallback for any other POST) ---\n // Read the RAW body (signature is over the exact bytes, not re-serialised JSON).\n const rawBody = await req.text();\n\n // Verify the Telnyx Ed25519 signature so forged events can't inject leads or\n // burn OpenAI/Telnyx credit via fake inbound. FAIL-OPEN when TELNYX_PUBLIC_KEY\n // is unset: setting the env var switches protection on; removing it is an\n // instant rollback (so a bad key can never silently swallow real inbound).\n const telnyxPublicKey = Deno.env.get(\"TELNYX_PUBLIC_KEY\");\n if (telnyxPublicKey) {\n const sig = req.headers.get(\"telnyx-signature-ed25519\") || \"\";\n const ts = req.headers.get(\"telnyx-timestamp\") || \"\";\n const fresh = !!ts && Math.abs(Date.now() / 1000 - Number(ts)) < 300; // 5-min replay window\n const valid = fresh && await verifyTelnyxSignature(telnyxPublicKey, sig, ts, rawBody);\n if (!valid) {\n console.error(\"Telnyx signature verification failed\", { fresh, hasSig: !!sig });\n return cors({ ok: false, error: \"Invalid signature\" }, 401);\n }\n }\n\n let payload: any = {};\n try { payload = rawBody ? JSON.parse(rawBody) : {}; } catch { return cors({ ok: false, error: \"Invalid JSON\" }, 400); }\n\n const eventType = payload?.data?.event_type;\n const messagePayload = payload?.data?.payload;\n\n if (eventType === \"message.received\" && messagePayload) {\n const fromNumber = messagePayload.from?.phone_number ?? \"unknown\";\n const toNumber = messagePayload.to?.[0]?.phone_number ?? null; // which of our numbers received it\n const text = messagePayload.text ?? \"\";\n const now = new Date().toISOString();\n\n // Route to the client that owns the RECEIVING number. A number explicitly\n // added but left unassigned (row exists, client_id NULL) parks the message\n // in unrouted_messages — we don't guess a client. A completely unknown\n // number (no row, e.g. a legacy env number) falls back to Default so live\n // inbound is never lost.\n let routedClientId: number | null = DEFAULT_CLIENT_ID;\n let numberKnown = false;\n if (toNumber) {\n const nr = await sqlite.execute({ sql: `SELECT client_id FROM numbers WHERE phone_number = ?`, args: [toNumber] });\n const nrow = (nr.rows as any[])[0];\n if (nrow) { numberKnown = true; routedClientId = nrow[0] != null ? Number(nrow[0]) : null; }\n }\n if (numberKnown && routedClientId == null) {\n await sqlite.execute({\n sql: `INSERT INTO unrouted_messages (phone_number, to_number, text, timestamp) VALUES (?, ?, ?, ?)`,\n args: [fromNumber, toNumber, text, now],\n });\n return cors({ ok: true, stored: true, unrouted: true });\n }\n const clientId = routedClientId ?? DEFAULT_CLIENT_ID;\n\n // Always capture the lead + inbound message first (never lose inbound data).\n await sqlite.execute({\n sql: `INSERT INTO leads (client_id, phone_number, name, campaign, status, created_at, assigned_number)\n VALUES (?, ?, ?, ?, 'active', ?, ?)\n ON CONFLICT(client_id, phone_number) DO NOTHING`,\n args: [clientId, fromNumber, null, \"uncategorized\", now, toNumber],\n });\n await sqlite.execute({\n sql: `INSERT INTO messages (client_id, phone_number, direction, text, timestamp, channel_number) VALUES (?, ?, 'inbound', ?, ?, ?)`,\n args: [clientId, fromNumber, text, now, toNumber],\n });\n\n // Everything below is best-effort — wrapped so a failure never breaks the\n // 200 OK that Telnyx needs.\n try {\n const lead = await getLead(clientId, fromNumber);\n\n // 1) Opt-out / STOP handling (compliance).\n if (STOP_KEYWORDS.has(text.trim().toUpperCase())) {\n await sqlite.execute({\n sql: `UPDATE leads SET opted_out = 1, status = 'opted_out' WHERE client_id = ? AND phone_number = ?`,\n args: [clientId, fromNumber],\n });\n // Cancel any pending campaign sends to this number.\n await sqlite.execute({\n sql: `UPDATE campaign_queue SET status = 'cancelled' WHERE client_id = ? AND phone_number = ? AND status = 'pending'`,\n args: [clientId, fromNumber],\n });\n const optFrom = lead?.assigned_number || toNumber || Deno.env.get(\"TELNYX_FROM_NUMBER\") || null;\n const sent = await sendSMS(fromNumber, OPT_OUT_CONFIRMATION, optFrom);\n if (sent) await logMessage(clientId, fromNumber, \"ai\", OPT_OUT_CONFIRMATION, optFrom);\n return cors({ ok: true, stored: true, opted_out: true });\n }\n\n // 2) AI auto-reply — only when AI is in control and the lead is engaged.\n if (lead && lead.mode !== \"manual\" && !lead.opted_out) {\n const reply = await generateAIReply(clientId, fromNumber, lead);\n if (reply) {\n const aiFrom = lead.assigned_number || toNumber || Deno.env.get(\"TELNYX_FROM_NUMBER\") || null;\n const sent = await sendSMS(fromNumber, reply, aiFrom);\n if (sent) {\n await logMessage(clientId, fromNumber, \"ai\", reply, aiFrom);\n await sqlite.execute({\n sql: `UPDATE leads SET status = 'engaged' WHERE client_id = ? AND phone_number = ? AND status IN ('active','sent')`,\n args: [clientId, fromNumber],\n });\n }\n }\n }\n } catch (e) {\n console.error(\"post-inbound processing error\", e);\n }\n\n return cors({ ok: true, stored: true });\n }\n\n return cors({ ok: true, ignored: true, eventType });\n}\n","label",[134],"27f0d761-d7f1-45c6-bbe0-3e54b8e583f7",["D",1782362803631],12,[28],"pulls","branches",1,"forks","envVars",{"_156":158,"_159":63},"connections",{"_156":63,"_157":63},"count","unfilledCount",7,"emptyCount",{"_43":144,"_32":28,"_30":31,"_135":-5,"_41":42,"_40":14,"_137":25,"_38":166,"_13":146,"_33":34,"_35":37,"_24":25,"_142":-5,"_163":167,"_27":168},{"_43":133,"_32":134,"_30":57,"_135":-5,"_41":42,"_40":136,"_137":25,"_38":162,"_13":139,"_33":140,"_35":141,"_24":25,"_142":-5,"_163":164,"_27":165},["D",1782338449444],"children",[],[134],["D",1782362803631],[],[28],["D",1781173254803],["D",1789535451117],{"_100":99,"_108":104},{"_100":99,"_101":102,"_103":104,"_18":55,"_105":106,"_107":25},{"_13":89,"_32":90,"_43":42,"_91":44,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":45,"_98":99},"ctx",{"_82":-5,"_128":207,"_208":209,"_210":211,"_212":25,"_213":25,"_214":25,"_215":59,"_216":-5,"_217":-7,"_218":-7,"_219":63,"_220":25,"_221":25,"_222":-5,"_223":25,"_224":25,"_225":25,"_226":-5},"ENV",{"_178":179,"_180":181,"_182":90,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194,"_195":196,"_197":198,"_199":200,"_201":202,"_203":204,"_205":206},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v62