[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_156":157,"_158":159},"routes/_app.x.$handle.$name",{"_96":95,"_32":45,"_104":86,"_27":105,"_13":14,"_106":-5,"_11":107,"_108":109,"_110":111,"_112":113,"_114":115,"_20":-5,"_116":-5,"_117":-5,"_118":25,"_119":120,"_121":58,"_122":-5,"_123":-5,"_124":125},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":25},"version",9,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","50479500-aa71-11f1-a17d-1607ee4eb77e","name","fileType","http","content","import { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\n/**\n * Nestadu — GoHighLevel proxy · Val Town HTTP val · revision B\n * ---------------------------------------------------------------------------\n * Holds the GoHighLevel Private Integration Token server-side and exposes only\n * the read-only lookups the proposal wizard needs. The token never reaches the\n * browser.\n *\n * SETUP (in the Val Town UI — never paste secrets into chat)\n * Environment Variables panel:\n * GHL_TOKEN the GoHighLevel Private Integration Token\n * APP_KEY a long random string you invent — the wizard's password\n *\n * In GoHighLevel: Settings -> Private Integrations.\n * The integration needs ALL THREE of these read-only scopes:\n * View Contacts (contacts.readonly)\n * View Opportunities (opportunities.readonly)\n * View Locations (locations.readonly)\n *\n * PAGES (password-protected — set BUILDER_PASSWORD, or it falls back to APP_KEY)\n * GET / sign in\n * GET /builder the proposal builder itself\n * GET /admin install a new build of the builder\n * GET /status plain-text setup check, no password needed\n *\n * ROUTES (signed in with the cookie, or ?key= from a local copy)\n * GET /api/health is it configured\n * GET /api/diag per-scope report — run this when something 401s\n * GET /api/shortlist everyone sitting in a proposal-ready stage\n * GET /api/search?q=smith contact search, min 2 characters\n * GET /api/contact?id= one contact, mapped to wizard fields\n *\n * PAGE ROUTE (no key needed — it is a page, not data)\n * GET /canibuild hosts the canibuild LeadConverter widget so the\n * wizard can show it in a panel. This val's hostname\n * is the one registered in canibuild under\n * Admin -> LeadConverter -> Host names.\n */\n\nconst GHL = \"https://services.leadconnectorhq.com\";\nconst GHL_VERSION = \"2021-07-28\";\n\nconst LOCATION_ID = \"yav08fn2AuJlBtYrYhXz\";\n\n/* canibuild LeadConverter. Client-side and domain-locked, so it is safe here. */\nconst CANIBUILD_TOKEN = \"910966c0-eea2-495d-a1b3-38bef333f1fe\";\nconst CANIBUILD_MOUNT = \"canibuild-widget\";\n\n/* The builder is a single big HTML file. Val files are capped at 80,000\n characters and cannot be binary, so it lives in blob storage instead,\n uploaded in pieces through /admin and streamed back out on /builder. */\nconst MANIFEST = \"builder:manifest\";\nconst PART_PREFIX = \"builder:part:\";\nconst partKey = (stamp: string, i: number) => PART_PREFIX + stamp + \":\" + i;\n\n/* Nestadu runs two pipelines side by side. Both are searched, because deals\n live in either one depending on when they were created. */\nconst PIPELINES = [\n {\n id: \"DoPZbLnGXIdA3J5HIW30\",\n name: \"ADU Sales Funnel.\",\n stages: [\n {\n id: \"dd4a378e-e0b8-4625-8884-3c89031ac99f\",\n name: \"Prepare / Send Proposal\",\n rank: 1,\n },\n {\n id: \"813f94ea-93e5-4007-9fb7-490b7d7b49fe\",\n name: \"FA Complete\",\n rank: 2,\n },\n {\n id: \"1c08e5d4-b193-4ed1-8188-a6994c168444\",\n name: \"FA Paid / In Process\",\n rank: 3,\n },\n ],\n },\n {\n id: \"ICCTadHj5CAE7YAAjAuW\",\n name: \"ADU Sales Funnel\",\n stages: [\n {\n id: \"ee8344f8-9d25-44ee-867b-9d8366b69374\",\n name: \"Needs Proposal\",\n rank: 1,\n },\n {\n id: \"f056e598-8c6f-4721-b55b-68d3afcedf25\",\n name: \"FA Complete / Proposal Sent\",\n rank: 2,\n },\n {\n id: \"5800591a-88bf-4391-b8c4-9e8c4fbf1ca8\",\n name: \"FA Paid / In Process\",\n rank: 3,\n },\n ],\n },\n];\n\n/* Contact custom fields, read straight from the account. */\nconst CUSTOM_FIELD_IDS: Record = {\n UmFyTerDQnYDq0HwmlWK: \"Model\",\n WFsTM8dyhBiP2DUsxHrS: \"ADU type\",\n CyXfycvxUPMCR2tvvnHa: \"Estimate\",\n Lta7pXtC6dFYiDb1Tgyb: \"Sloped backyard\",\n tn7aNZHkkZyJTSuXTJrt: \"To remove from backyard\",\n nwE9498SXXdN3sZ4ll3C: \"Interior finishes\",\n Ib1teAbkyisKdBLX94KG: \"Siding\",\n \"8Mk1xx68AsHED1YYNvBM\": \"Roof\",\n sHAZ2bHKuUToP69ePmpv: \"Solar\",\n};\n\n/* Which suggestions the wizard is allowed to click straight into a field. */\nconst FILLABLE = new Set([\"Model\", \"Estimate\"]);\n\n/* ===================== who is allowed in ===================== */\n/* This val must be public (the free plan allows no private vals), so the\n source is readable by anyone. Nothing secret lives here — the password and\n the GoHighLevel token are environment variables, and every page below is\n gated in code. The gate is a shared password, not real user accounts:\n it keeps the tool off the open web, nothing more. */\n\nconst COOKIE = \"nestadu_session\";\nconst SALT = \"nestadu-proposal-builder-v1\";\n\nasync function sessionValue(password: string) {\n const bytes = new TextEncoder().encode(SALT + \"|\" + password);\n const digest = await crypto.subtle.digest(\"SHA-256\", bytes);\n return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n}\n\nfunction cookieFrom(req: Request, name: string) {\n const raw = req.headers.get(\"Cookie\") || \"\";\n for (const part of raw.split(\";\")) {\n const [k, ...v] = part.trim().split(\"=\");\n if (k === name) return v.join(\"=\");\n }\n return \"\";\n}\n\n/* the builder password, falling back to the API key so there is only one\n thing to set up if that is all you want */\nfunction builderPassword() {\n return Deno.env.get(\"BUILDER_PASSWORD\") || Deno.env.get(\"APP_KEY\") || \"\";\n}\n\nasync function isSignedIn(req: Request) {\n const pw = builderPassword();\n if (!pw) return false;\n const got = cookieFrom(req, COOKIE);\n if (!got) return false;\n return got === (await sessionValue(pw));\n}\n\n/* pages redirect to the sign-in form; the API answers with JSON */\nconst redirect = (to: string, extra?: Record) =>\n new Response(null, {\n status: 302,\n headers: { Location: to, ...(extra || {}) },\n });\n\n/* ===================== sign-in page ===================== */\nconst LOGIN_PAGE = (msg: string) =>\n String.raw`\n\nNestadu — sign in\n\n\n`.replace(\n \"__MESSAGE__\",\n msg ? '

' + msg + \"

\" : \"\",\n );\n\n/* ===================== admin: upload the builder ===================== */\nconst ADMIN_PAGE = String.raw`\n\nNestadu — builder upload\n\n

nestadu

Builder upload

\n Open the builder Sign out

\n\n

What is installed

Checking…

Open the builder

\n\n

Install a new version

Drop the Nestadu_Proposal_Builder.html file here, or click to pick it.\n It replaces whatever is installed now. Nobody is interrupted — the next person to open the\n builder simply gets the new one.

\n Drop the builder file here\n or click to choose it — a single .html file\n \n

\n\n

\n\n`;\n\nconst CORS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n};\n\n/* ===================== canibuild widget host page ===================== */\n/* Served at /canibuild. The wizard shows this in a panel. Everything the\n widget sends back is forwarded up to the wizard with postMessage. */\n\nconst CANIBUILD_PAGE = String.raw`\n\n\n\nSite plan — canibuild\n\n\n

\n Address\n Design\n

\n \n \n

\n \n \n \n \n canibuild must allow \n \n \n Full canibuild ↗\n

\n\n

\n \n \n

Loading…

\n\n\n\n\n`\n .replaceAll(\"__MOUNT__\", CANIBUILD_MOUNT)\n .replaceAll(\"__TOKEN__\", CANIBUILD_TOKEN);\n\nconst json = (body: unknown, status = 200) =>\n new Response(JSON.stringify(body, null, 2), {\n status,\n headers: {\n \"Content-Type\": \"application/json; charset=utf-8\",\n \"Cache-Control\": \"no-store\",\n ...CORS,\n },\n });\n\nconst page = (html: string, status = 200) =>\n new Response(html, {\n status,\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n \"Cache-Control\": \"no-store\",\n },\n });\n\nconst NOTHING_INSTALLED = String.raw`\nNestadu — nothing installed yet\n\n

The builder is not installed yet

The password worked — there is just nothing here to open. Upload the\nNestadu_Proposal_Builder.html file and it will appear.

\nGo to the upload page

`;\n\nasync function ghl(path: string, token: string) {\n const res = await fetch(GHL + path, {\n headers: {\n Authorization: \"Bearer \" + token,\n Version: GHL_VERSION,\n Accept: \"application/json\",\n },\n });\n const text = await res.text();\n let data: any = null;\n try {\n data = text ? JSON.parse(text) : null;\n } catch {\n data = { raw: text.slice(0, 400) };\n }\n if (!res.ok) {\n /* Carry GoHighLevel's own wording through — it names the missing scope. */\n const said = data?.message ?? data?.error ?? data?.msg ?? \"\";\n const detail = Array.isArray(said) ? said.join(\"; \") : String(said || \"\");\n throw Object.assign(\n new Error(\n \"GoHighLevel returned \" + res.status + (detail ? \" — \" + detail : \"\"),\n ),\n { status: res.status, data, ghlMessage: detail },\n );\n }\n return data;\n}\n\n/* ---------- shape a GHL contact into the wizard's fields ---------- */\nfunction mapContact(c: any) {\n /* GoHighLevel stores contactName lowercased and the *Raw fields as typed,\n which are sometimes ALL CAPS. Rebuild a presentable name from whichever\n parts exist, then tidy the capitalisation. */\n const nice = (s: string) =>\n (s || \"\").replace(\n /[^\\s-]+/g,\n (w) =>\n /[a-z]/.test(w) &&\n /[A-Z]/.test(w.slice(1)) /* McBride, DeVries — leave alone */\n ? w\n : w.charAt(0).toUpperCase() + w.slice(1).toLowerCase(),\n );\n\n const first = nice(c.firstNameRaw || c.firstName || \"\");\n const last = nice(c.lastNameRaw || c.lastName || \"\");\n const joined = [first, last].filter(Boolean).join(\" \").trim();\n const full = joined || nice(c.contactName || \"\").trim();\n\n const suggestions: Array<\n { label: string; value: string; fillable: boolean }\n > = [];\n for (const f of c.customFields || []) {\n const label = CUSTOM_FIELD_IDS[f.id];\n const value = f.value == null ? \"\" : String(f.value).trim();\n if (!label || !value || value === \"...\") continue;\n suggestions.push({ label, value, fillable: FILLABLE.has(label) });\n }\n suggestions.sort((a, b) =>\n Number(b.fillable) - Number(a.fillable) || a.label.localeCompare(b.label)\n );\n\n const line1 = c.address1 || \"\";\n const cityState = [c.city, c.state].filter(Boolean).join(\", \");\n const siteAddress = [line1, cityState].filter(Boolean).join(\", \") +\n (c.postalCode ? \" \" + c.postalCode : \"\");\n\n return {\n id: c.id,\n display: full || c.email || c.phone || \"(no name)\",\n email: c.email || \"\",\n phone: c.phone || \"\",\n tags: c.tags || [],\n fields: {\n CLIENT_NAME: full,\n CLIENT_GREETING: first,\n SITE_ADDRESS: line1 ? siteAddress.trim() : \"\",\n JURISDICTION: c.city || \"\",\n },\n suggestions,\n hasAddress: Boolean(line1),\n };\n}\n\n/* ------------------------------- handler ------------------------------- */\nexport default async function (req: Request): Promise {\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: CORS });\n }\n\n const url = new URL(req.url);\n const path = url.pathname.replace(/\\/+$/, \"\") || \"/\";\n\n const token = Deno.env.get(\"GHL_TOKEN\");\n const appKey = Deno.env.get(\"APP_KEY\");\n const signed = await isSignedIn(req);\n\n if (path === \"/status\" || path === \"/api\") {\n return new Response(\n \"Nestadu proposal builder — revision C\\n\\n\" +\n \"GHL_TOKEN configured: \" + (token ? \"yes\" : \"NO\") + \"\\n\" +\n \"APP_KEY configured: \" + (appKey ? \"yes\" : \"NO\") + \"\\n\" +\n \"BUILDER_PASSWORD configured: \" +\n (Deno.env.get(\"BUILDER_PASSWORD\")\n ? \"yes\"\n : (appKey ? \"no — falling back to APP_KEY\" : \"NO\")) +\n \"\\n\\n\" +\n \"Pages: / (sign in) /builder /admin\\n\" +\n \"API: /api/health /api/diag /api/shortlist /api/search?q= /api/contact?id=\\n\" +\n \" /canibuild (the site plan widget page — open it to see this host name)\\n\\n\" +\n \"The API accepts either the sign-in cookie or ?key=.\\n\\n\" +\n \"If something returns 401, open /api/diag?key=... — it tests each\\n\" +\n \"permission separately and tells you which one is missing.\\n\",\n { headers: { \"Content-Type\": \"text/plain; charset=utf-8\", ...CORS } },\n );\n }\n\n /* ---- the canibuild widget host page (a page, so no key is required) ---- */\n if (path === \"/canibuild\") {\n return new Response(CANIBUILD_PAGE, {\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n \"Cache-Control\": \"no-store\",\n /* The wizard shows this page in a panel. \"*\" alone matches only network\n schemes, which would lock out a wizard opened as a local file, so the\n non-network schemes are listed explicitly. */\n \"Content-Security-Policy\":\n \"frame-ancestors * file: blob: filesystem: data:\",\n },\n });\n }\n\n try {\n /* ---- signing in and out ---- */\n if (path === \"/login\" && req.method === \"POST\") {\n const want = builderPassword();\n if (!want) {\n return page(\n LOGIN_PAGE(\n \"No password has been set on this site yet. Add BUILDER_PASSWORD \" +\n \"in the val's Environment Variables, then reload.\",\n ),\n 503,\n );\n }\n const form = await req.formData();\n if (String(form.get(\"password\") || \"\") !== want) {\n return page(LOGIN_PAGE(\"That password was not right.\"), 401);\n }\n return redirect(\"/builder\", {\n \"Set-Cookie\": COOKIE + \"=\" + (await sessionValue(want)) +\n \"; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=2592000\",\n });\n }\n\n if (path === \"/logout\") {\n return redirect(\"/\", { \"Set-Cookie\": COOKIE + \"=; Path=/; Max-Age=0\" });\n }\n\n if (path === \"/\") {\n return signed ? redirect(\"/builder\") : page(LOGIN_PAGE(\"\"));\n }\n\n /* ---- the builder itself, streamed out of blob storage ---- */\n if (path === \"/builder\") {\n if (!signed) return redirect(\"/\");\n const man = await blob.getJSON(MANIFEST) as any;\n if (!man || !man.parts) return page(NOTHING_INSTALLED, 200);\n\n let i = 0;\n const body = new ReadableStream({\n async pull(controller) {\n if (i >= man.parts) {\n controller.close();\n return;\n }\n try {\n const res = await blob.get(partKey(man.stamp, i));\n controller.enqueue(new Uint8Array(await res.arrayBuffer()));\n i++;\n } catch (e) {\n controller.error(\n new Error(\n \"Piece \" + i + \" of the builder is missing. Upload it again.\",\n ),\n );\n }\n },\n });\n return new Response(body, {\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n \"Cache-Control\": \"no-store\",\n },\n });\n }\n\n /* ---- installing a new builder ---- */\n if (path === \"/admin\") {\n if (!signed) return redirect(\"/\");\n return page(ADMIN_PAGE);\n }\n\n if (path === \"/admin/info\") {\n if (!signed) return json({ error: \"Not signed in.\" }, 401);\n const man = await blob.getJSON(MANIFEST) as any;\n return json(man ? { installed: true, ...man } : { installed: false });\n }\n\n if (path === \"/admin/upload\" && req.method === \"POST\") {\n if (!signed) return json({ error: \"Not signed in.\" }, 401);\n const stamp = url.searchParams.get(\"stamp\") || \"\";\n const i = Number(url.searchParams.get(\"i\"));\n if (!/^[a-z0-9]{1,16}$/.test(stamp)) {\n return json({ error: \"Bad upload id.\" }, 400);\n }\n if (!Number.isInteger(i) || i < 0 || i > 500) {\n return json({ error: \"Bad piece number.\" }, 400);\n }\n const buf = await req.arrayBuffer();\n if (buf.byteLength > 1024 * 1024) {\n return json({ error: \"That piece is too big.\" }, 413);\n }\n\n /* Starting a fresh upload: sweep away leftovers from any upload that was\n abandoned half way, so an interrupted attempt cannot fill the 10 MB of\n blob storage the free plan allows. The installed version is untouched. */\n if (i === 0) {\n const live = (await blob.getJSON(MANIFEST) as any)?.stamp;\n for (const entry of await blob.list(PART_PREFIX)) {\n const keep =\n (live && entry.key.startsWith(PART_PREFIX + live + \":\")) ||\n entry.key.startsWith(PART_PREFIX + stamp + \":\");\n if (!keep) {\n try {\n await blob.delete(entry.key);\n } catch { /* already gone */ }\n }\n }\n }\n\n await blob.set(partKey(stamp, i), buf);\n return json({ ok: true, i, bytes: buf.byteLength });\n }\n\n if (path === \"/admin/commit\" && req.method === \"POST\") {\n if (!signed) return json({ error: \"Not signed in.\" }, 401);\n const stamp = url.searchParams.get(\"stamp\") || \"\";\n const parts = Number(url.searchParams.get(\"parts\"));\n const size = Number(url.searchParams.get(\"size\")) || 0;\n const name = (url.searchParams.get(\"name\") || \"builder.html\").slice(\n 0,\n 120,\n );\n if (!/^[a-z0-9]{1,16}$/.test(stamp)) {\n return json({ error: \"Bad upload id.\" }, 400);\n }\n if (!Number.isInteger(parts) || parts < 1) {\n return json({ error: \"Bad piece count.\" }, 400);\n }\n\n const arrived = await blob.list(PART_PREFIX + stamp + \":\");\n if (arrived.length !== parts) {\n return json({\n error: \"Only \" + arrived.length + \" of \" + parts + \" pieces arrived.\",\n }, 400);\n }\n\n await blob.setJSON(MANIFEST, {\n stamp,\n parts,\n size,\n name,\n uploadedAt: new Date().toISOString(),\n });\n\n /* tidy away every piece that is not part of the version just installed */\n for (const entry of await blob.list(PART_PREFIX)) {\n if (!entry.key.startsWith(PART_PREFIX + stamp + \":\")) {\n try {\n await blob.delete(entry.key);\n } catch { /* already gone */ }\n }\n }\n return json({ ok: true, parts, size });\n }\n /* everything past here talks to GoHighLevel */\n if (!token || !appKey) {\n return json({\n error:\n \"Not configured. Set GHL_TOKEN and APP_KEY in the val's environment variables.\",\n }, 503);\n }\n if (!signed && url.searchParams.get(\"key\") !== appKey) {\n return json({ error: \"Not signed in, and no key was given.\" }, 401);\n }\n\n /* ---- health ---- */\n if (path === \"/api/health\") {\n const loc = await ghl(\"/locations/\" + LOCATION_ID, token);\n return json({\n ok: true,\n location: loc?.location?.name ?? null,\n locationId: LOCATION_ID,\n revision: \"B\",\n });\n }\n\n /* ---- diagnostics: which permissions does this token actually have? ---- */\n if (path === \"/api/diag\") {\n const probe = async (label: string, scope: string, p: string) => {\n try {\n await ghl(p, token);\n return { permission: label, scope, ok: true, note: \"working\" };\n } catch (e: any) {\n return {\n permission: label,\n scope,\n ok: false,\n status: e.status ?? null,\n note: e.status === 401 || e.status === 403\n ? 'MISSING — tick \"' + label +\n '\" on the Private Integration in GoHighLevel'\n : (e.ghlMessage || e.message),\n goHighLevelSaid: e.ghlMessage || null,\n };\n }\n };\n const first = PIPELINES[0];\n const checks = await Promise.all([\n probe(\n \"View Locations\",\n \"locations.readonly\",\n \"/locations/\" + LOCATION_ID,\n ),\n probe(\n \"View Contacts\",\n \"contacts.readonly\",\n \"/contacts/?\" +\n new URLSearchParams({ locationId: LOCATION_ID, limit: \"1\" }),\n ),\n probe(\n \"View Opportunities\",\n \"opportunities.readonly\",\n \"/opportunities/search?\" + new URLSearchParams({\n location_id: LOCATION_ID,\n pipeline_id: first.id,\n status: \"open\",\n limit: \"1\",\n }),\n ),\n ]);\n const missing = checks.filter((c) => !c.ok);\n return json({\n allGood: missing.length === 0,\n summary: missing.length === 0\n ? \"All three permissions are working. The wizard should be fully functional.\"\n : \"The token is missing \" + missing.length + \" permission\" +\n (missing.length === 1 ? \"\" : \"s\") +\n \": \" + missing.map((m) => m.permission).join(\", \") + \".\",\n checks,\n });\n }\n\n /* ---- the shortlist: who is ready for a proposal, across both pipelines ---- */\n if (path === \"/api/shortlist\") {\n const jobs: Array> = [];\n for (const pipe of PIPELINES) {\n for (const stage of pipe.stages) {\n const q = new URLSearchParams({\n location_id: LOCATION_ID,\n pipeline_id: pipe.id,\n pipeline_stage_id: stage.id,\n status: \"open\",\n limit: \"25\",\n });\n jobs.push(\n ghl(\"/opportunities/search?\" + q, token)\n .then((d: any) =>\n (d.opportunities || []).map((o: any) => ({\n opportunityId: o.id,\n contactId: o.contactId,\n display: o.contact?.name || o.name || \"(unnamed)\",\n email: o.contact?.email || \"\",\n phone: o.contact?.phone || \"\",\n stage: stage.name,\n pipeline: pipe.name,\n rank: stage.rank,\n updatedAt: o.updatedAt || o.lastStageChangeAt || \"\",\n }))\n ),\n );\n }\n }\n const batches = await Promise.all(jobs);\n\n const seen = new Set();\n const rows: any[] = [];\n for (const r of batches.flat()) {\n if (!r.contactId || seen.has(r.contactId)) continue;\n seen.add(r.contactId);\n rows.push(r);\n }\n rows.sort((a, b) =>\n a.rank - b.rank ||\n String(b.updatedAt).localeCompare(String(a.updatedAt))\n );\n\n return json({\n count: rows.length,\n contacts: rows,\n stagesSearched: PIPELINES.flatMap((p) => p.stages.map((s) => s.name)),\n });\n }\n\n /* ---- search ---- */\n if (path === \"/api/search\") {\n const q = (url.searchParams.get(\"q\") || \"\").trim();\n if (q.length < 2) return json({ count: 0, contacts: [] });\n const params = new URLSearchParams({\n locationId: LOCATION_ID,\n query: q,\n limit: \"25\",\n });\n const data = await ghl(\"/contacts/?\" + params, token);\n const rows = (data.contacts || []).map((c: any) => {\n const m = mapContact(c);\n return {\n contactId: c.id,\n display: m.display,\n email: m.email,\n phone: m.phone,\n hasAddress: m.hasAddress,\n };\n });\n return json({ count: rows.length, contacts: rows });\n }\n\n /* ---- one contact, mapped ---- */\n if (path === \"/api/contact\") {\n const id = url.searchParams.get(\"id\");\n if (!id) return json({ error: \"id is required\" }, 400);\n const data = await ghl(\"/contacts/\" + id, token);\n const c = data.contact || data;\n return json(mapContact(c));\n }\n\n return json({ error: \"Unknown route\", path }, 404);\n } catch (err: any) {\n return json(\n {\n error: err.message || String(err),\n status: err.status ?? null,\n hint: (err.status === 401 || err.status === 403)\n ? \"This looks like a missing permission on the Private Integration Token. \" +\n \"Open /api/diag?key= — it will name the one that is missing.\"\n : null,\n detail: err.data ?? null,\n },\n err.status && err.status < 500 ? err.status : 502,\n );\n }\n}","import { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\n/**\n * Nestadu — GoHighLevel proxy · Val Town HTTP val · revision B\n * ---------------------------------------------------------------------------\n * Holds the GoHighLevel Private Integration Token server-side and exposes only\n * the read-only lookups the proposal wizard needs. The token never reaches the\n * browser.\n *\n * SETUP (in the Val Town UI — never paste secrets into chat)\n * Environment Variables panel:\n * GHL_TOKEN the GoHighLevel Private Integration Token\n * APP_KEY a long random string you invent — the wizard's password\n *\n * In GoHighLevel: Settings -> Private Integrations.\n * The integration needs ALL THREE of these read-only scopes:\n * View Contacts (contacts.readonly)\n * View Opportunities (opportunities.readonly)\n * View Locations (locations.readonly)\n *\n * PAGES (password-protected — set BUILDER_PASSWORD, or it falls back to APP_KEY)\n * GET / sign in\n * GET /builder the proposal builder itself\n * GET /admin install a new build of the builder\n * GET /status plain-text setup check, no password needed\n *\n * ROUTES (signed in with the cookie, or ?key= from a local copy)\n * GET /api/health is it configured\n * GET /api/diag per-scope report — run this when something 401s\n * GET /api/shortlist everyone sitting in a proposal-ready stage\n * GET /api/search?q=smith contact search, min 2 characters\n * GET /api/contact?id= one contact, mapped to wizard fields\n *\n * PAGE ROUTE (no key needed — it is a page, not data)\n * GET /canibuild hosts the canibuild LeadConverter widget so the\n * wizard can show it in a panel. This val's hostname\n * is the one registered in canibuild under\n * Admin -> LeadConverter -> Host names.\n */\n\nconst GHL = \"https://services.leadconnectorhq.com\";\nconst GHL_VERSION = \"2021-07-28\";\n\nconst LOCATION_ID = \"yav08fn2AuJlBtYrYhXz\";\n\n/* canibuild LeadConverter. Client-side and domain-locked, so it is safe here. */\nconst CANIBUILD_TOKEN = \"910966c0-eea2-495d-a1b3-38bef333f1fe\";\nconst CANIBUILD_MOUNT = \"canibuild-widget\";\n\n/* The builder is a single big HTML file. Val files are capped at 80,000\n characters and cannot be binary, so it lives in blob storage instead,\n uploaded in pieces through /admin and streamed back out on /builder. */\nconst MANIFEST = \"builder:manifest\";\nconst PART_PREFIX = \"builder:part:\";\nconst partKey = (stamp: string, i: number) => PART_PREFIX + stamp + \":\" + i;\n\n/* Nestadu runs two pipelines side by side. Both are searched, because deals\n live in either one depending on when they were created. */\nconst PIPELINES = [\n {\n id: \"DoPZbLnGXIdA3J5HIW30\",\n name: \"ADU Sales Funnel.\",\n stages: [\n {\n id: \"dd4a378e-e0b8-4625-8884-3c89031ac99f\",\n name: \"Prepare / Send Proposal\",\n rank: 1,\n },\n {\n id: \"813f94ea-93e5-4007-9fb7-490b7d7b49fe\",\n name: \"FA Complete\",\n rank: 2,\n },\n {\n id: \"1c08e5d4-b193-4ed1-8188-a6994c168444\",\n name: \"FA Paid / In Process\",\n rank: 3,\n },\n ],\n },\n {\n id: \"ICCTadHj5CAE7YAAjAuW\",\n name: \"ADU Sales Funnel\",\n stages: [\n {\n id: \"ee8344f8-9d25-44ee-867b-9d8366b69374\",\n name: \"Needs Proposal\",\n rank: 1,\n },\n {\n id: \"f056e598-8c6f-4721-b55b-68d3afcedf25\",\n name: \"FA Complete / Proposal Sent\",\n rank: 2,\n },\n {\n id: \"5800591a-88bf-4391-b8c4-9e8c4fbf1ca8\",\n name: \"FA Paid / In Process\",\n rank: 3,\n },\n ],\n },\n];\n\n/* Contact custom fields, read straight from the account. */\nconst CUSTOM_FIELD_IDS: Record = {\n UmFyTerDQnYDq0HwmlWK: \"Model\",\n WFsTM8dyhBiP2DUsxHrS: \"ADU type\",\n CyXfycvxUPMCR2tvvnHa: \"Estimate\",\n Lta7pXtC6dFYiDb1Tgyb: \"Sloped backyard\",\n tn7aNZHkkZyJTSuXTJrt: \"To remove from backyard\",\n nwE9498SXXdN3sZ4ll3C: \"Interior finishes\",\n Ib1teAbkyisKdBLX94KG: \"Siding\",\n \"8Mk1xx68AsHED1YYNvBM\": \"Roof\",\n sHAZ2bHKuUToP69ePmpv: \"Solar\",\n};\n\n/* Which suggestions the wizard is allowed to click straight into a field. */\nconst FILLABLE = new Set([\"Model\", \"Estimate\"]);\n\n/* ===================== who is allowed in ===================== */\n/* This val must be public (the free plan allows no private vals), so the\n source is readable by anyone. Nothing secret lives here — the password and\n the GoHighLevel token are environment variables, and every page below is\n gated in code. The gate is a shared password, not real user accounts:\n it keeps the tool off the open web, nothing more. */\n\nconst COOKIE = \"nestadu_session\";\nconst SALT = \"nestadu-proposal-builder-v1\";\n\nasync function sessionValue(password: string) {\n const bytes = new TextEncoder().encode(SALT + \"|\" + password);\n const digest = await crypto.subtle.digest(\"SHA-256\", bytes);\n return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n}\n\nfunction cookieFrom(req: Request, name: string) {\n const raw = req.headers.get(\"Cookie\") || \"\";\n for (const part of raw.split(\";\")) {\n const [k, ...v] = part.trim().split(\"=\");\n if (k === name) return v.join(\"=\");\n }\n return \"\";\n}\n\n/* the builder password, falling back to the API key so there is only one\n thing to set up if that is all you want */\nfunction builderPassword() {\n return Deno.env.get(\"BUILDER_PASSWORD\") || Deno.env.get(\"APP_KEY\") || \"\";\n}\n\nasync function isSignedIn(req: Request) {\n const pw = builderPassword();\n if (!pw) return false;\n const got = cookieFrom(req, COOKIE);\n if (!got) return false;\n return got === (await sessionValue(pw));\n}\n\n/* pages redirect to the sign-in form; the API answers with JSON */\nconst redirect = (to: string, extra?: Record) =>\n new Response(null, {\n status: 302,\n headers: { Location: to, ...(extra || {}) },\n });\n\n/* ===================== sign-in page ===================== */\nconst LOGIN_PAGE = (msg: string) =>\n String.raw`\n\nNestadu — sign in\n\n\n`.replace(\n \"__MESSAGE__\",\n msg ? '

' + msg + \"

\" : \"\",\n );\n\n/* ===================== admin: upload the builder ===================== */\nconst ADMIN_PAGE = String.raw`\n\nNestadu — builder upload\n\n

nestadu

Builder upload

\n Open the builder Sign out

\n\n

What is installed

Checking…

Open the builder

\n\n

Install a new version

\n Drop the builder file here\n or click to choose it — a single .html file\n \n

\n\n

\n Address\n Design\n

\n \n \n \n

\n \n \n \n \n \n \n canibuild must allow \n \n \n Full canibuild ↗\n

\n\n

\n \n \n

Loading…

The builder is not installed yet

The password worked — there is just nothing here to open. Upload the\nNestadu_Proposal_Builder.html file and it will appear.

\nGo to the upload page

`;\n\nasync function ghl(path: string, token: string) {\n const res = await fetch(GHL + path, {\n headers: {\n Authorization: \"Bearer \" + token,\n Version: GHL_VERSION,\n Accept: \"application/json\",\n },\n });\n const text = await res.text();\n let data: any = null;\n try {\n data = text ? JSON.parse(text) : null;\n } catch {\n data = { raw: text.slice(0, 400) };\n }\n if (!res.ok) {\n /* Carry GoHighLevel's own wording through — it names the missing scope. */\n const said = data?.message ?? data?.error ?? data?.msg ?? \"\";\n const detail = Array.isArray(said) ? said.join(\"; \") : String(said || \"\");\n throw Object.assign(\n new Error(\n \"GoHighLevel returned \" + res.status + (detail ? \" — \" + detail : \"\"),\n ),\n { status: res.status, data, ghlMessage: detail },\n );\n }\n return data;\n}\n\n/* ---------- shape a GHL contact into the wizard's fields ---------- */\nfunction mapContact(c: any) {\n /* GoHighLevel stores contactName lowercased and the *Raw fields as typed,\n which are sometimes ALL CAPS. Rebuild a presentable name from whichever\n parts exist, then tidy the capitalisation. */\n const nice = (s: string) =>\n (s || \"\").replace(\n /[^\\s-]+/g,\n (w) =>\n /[a-z]/.test(w) &&\n /[A-Z]/.test(w.slice(1)) /* McBride, DeVries — leave alone */\n ? w\n : w.charAt(0).toUpperCase() + w.slice(1).toLowerCase(),\n );\n\n const first = nice(c.firstNameRaw || c.firstName || \"\");\n const last = nice(c.lastNameRaw || c.lastName || \"\");\n const joined = [first, last].filter(Boolean).join(\" \").trim();\n const full = joined || nice(c.contactName || \"\").trim();\n\n const suggestions: Array<\n { label: string; value: string; fillable: boolean }\n > = [];\n for (const f of c.customFields || []) {\n const label = CUSTOM_FIELD_IDS[f.id];\n const value = f.value == null ? \"\" : String(f.value).trim();\n if (!label || !value || value === \"...\") continue;\n suggestions.push({ label, value, fillable: FILLABLE.has(label) });\n }\n suggestions.sort((a, b) =>\n Number(b.fillable) - Number(a.fillable) || a.label.localeCompare(b.label)\n );\n\n const line1 = c.address1 || \"\";\n const cityState = [c.city, c.state].filter(Boolean).join(\", \");\n const siteAddress = [line1, cityState].filter(Boolean).join(\", \") +\n (c.postalCode ? \" \" + c.postalCode : \"\");\n\n return {\n id: c.id,\n display: full || c.email || c.phone || \"(no name)\",\n email: c.email || \"\",\n phone: c.phone || \"\",\n tags: c.tags || [],\n fields: {\n CLIENT_NAME: full,\n CLIENT_GREETING: first,\n SITE_ADDRESS: line1 ? siteAddress.trim() : \"\",\n JURISDICTION: c.city || \"\",\n },\n suggestions,\n hasAddress: Boolean(line1),\n };\n}\n\n/* ------------------------------- handler ------------------------------- */\nexport default async function (req: Request): Promise {\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: CORS });\n }\n\n const url = new URL(req.url);\n const path = url.pathname.replace(/\\/+$/, \"\") || \"/\";\n\n const token = Deno.env.get(\"GHL_TOKEN\");\n const appKey = Deno.env.get(\"APP_KEY\");\n const signed = await isSignedIn(req);\n\n if (path === \"/status\" || path === \"/api\") {\n return new Response(\n \"Nestadu proposal builder — revision C\\n\\n\" +\n \"GHL_TOKEN configured: \" + (token ? \"yes\" : \"NO\") + \"\\n\" +\n \"APP_KEY configured: \" + (appKey ? \"yes\" : \"NO\") + \"\\n\" +\n \"BUILDER_PASSWORD configured: \" +\n (Deno.env.get(\"BUILDER_PASSWORD\")\n ? \"yes\"\n : (appKey ? \"no — falling back to APP_KEY\" : \"NO\")) +\n \"\\n\\n\" +\n \"Pages: / (sign in) /builder /admin\\n\" +\n \"API: /api/health /api/diag /api/shortlist /api/search?q= /api/contact?id=\\n\" +\n \" /canibuild (the site plan widget page — open it to see this host name)\\n\\n\" +\n \"The API accepts either the sign-in cookie or ?key=.\\n\\n\" +\n \"If something returns 401, open /api/diag?key=... — it tests each\\n\" +\n \"permission separately and tells you which one is missing.\\n\",\n { headers: { \"Content-Type\": \"text/plain; charset=utf-8\", ...CORS } },\n );\n }\n\n /* ---- the canibuild widget host page (a page, so no key is required) ---- */\n if (path === \"/canibuild\") {\n return new Response(CANIBUILD_PAGE, {\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n \"Cache-Control\": \"no-store\",\n /* The wizard shows this page in a panel. \"*\" alone matches only network\n schemes, which would lock out a wizard opened as a local file, so the\n non-network schemes are listed explicitly. */\n \"Content-Security-Policy\":\n \"frame-ancestors * file: blob: filesystem: data:\",\n },\n });\n }\n\n try {\n /* ---- signing in and out ---- */\n if (path === \"/login\" && req.method === \"POST\") {\n const want = builderPassword();\n if (!want) {\n return page(\n LOGIN_PAGE(\n \"No password has been set on this site yet. Add BUILDER_PASSWORD \" +\n \"in the val's Environment Variables, then reload.\",\n ),\n 503,\n );\n }\n const form = await req.formData();\n if (String(form.get(\"password\") || \"\") !== want) {\n return page(LOGIN_PAGE(\"That password was not right.\"), 401);\n }\n return redirect(\"/builder\", {\n \"Set-Cookie\": COOKIE + \"=\" + (await sessionValue(want)) +\n \"; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=2592000\",\n });\n }\n\n if (path === \"/logout\") {\n return redirect(\"/\", { \"Set-Cookie\": COOKIE + \"=; Path=/; Max-Age=0\" });\n }\n\n if (path === \"/\") {\n return signed ? redirect(\"/builder\") : page(LOGIN_PAGE(\"\"));\n }\n\n /* ---- the builder itself, streamed out of blob storage ---- */\n if (path === \"/builder\") {\n if (!signed) return redirect(\"/\");\n const man = await blob.getJSON(MANIFEST) as any;\n if (!man || !man.parts) return page(NOTHING_INSTALLED, 200);\n\n let i = 0;\n const body = new ReadableStream({\n async pull(controller) {\n if (i >= man.parts) {\n controller.close();\n return;\n }\n try {\n const res = await blob.get(partKey(man.stamp, i));\n controller.enqueue(new Uint8Array(await res.arrayBuffer()));\n i++;\n } catch (e) {\n controller.error(\n new Error(\n \"Piece \" + i + \" of the builder is missing. Upload it again.\",\n ),\n );\n }\n },\n });\n return new Response(body, {\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n \"Cache-Control\": \"no-store\",\n },\n });\n }\n\n /* ---- installing a new builder ---- */\n if (path === \"/admin\") {\n if (!signed) return redirect(\"/\");\n return page(ADMIN_PAGE);\n }\n\n if (path === \"/admin/info\") {\n if (!signed) return json({ error: \"Not signed in.\" }, 401);\n const man = await blob.getJSON(MANIFEST) as any;\n return json(man ? { installed: true, ...man } : { installed: false });\n }\n\n if (path === \"/admin/upload\" && req.method === \"POST\") {\n if (!signed) return json({ error: \"Not signed in.\" }, 401);\n const stamp = url.searchParams.get(\"stamp\") || \"\";\n const i = Number(url.searchParams.get(\"i\"));\n if (!/^[a-z0-9]{1,16}$/.test(stamp)) {\n return json({ error: \"Bad upload id.\" }, 400);\n }\n if (!Number.isInteger(i) || i < 0 || i > 500) {\n return json({ error: \"Bad piece number.\" }, 400);\n }\n const buf = await req.arrayBuffer();\n if (buf.byteLength > 1024 * 1024) {\n return json({ error: \"That piece is too big.\" }, 413);\n }\n\n /* Starting a fresh upload: sweep away leftovers from any upload that was\n abandoned half way, so an interrupted attempt cannot fill the 10 MB of\n blob storage the free plan allows. The installed version is untouched. */\n if (i === 0) {\n const live = (await blob.getJSON(MANIFEST) as any)?.stamp;\n for (const entry of await blob.list(PART_PREFIX)) {\n const keep =\n (live && entry.key.startsWith(PART_PREFIX + live + \":\")) ||\n entry.key.startsWith(PART_PREFIX + stamp + \":\");\n if (!keep) {\n try {\n await blob.delete(entry.key);\n } catch { /* already gone */ }\n }\n }\n }\n\n await blob.set(partKey(stamp, i), buf);\n return json({ ok: true, i, bytes: buf.byteLength });\n }\n\n if (path === \"/admin/commit\" && req.method === \"POST\") {\n if (!signed) return json({ error: \"Not signed in.\" }, 401);\n const stamp = url.searchParams.get(\"stamp\") || \"\";\n const parts = Number(url.searchParams.get(\"parts\"));\n const size = Number(url.searchParams.get(\"size\")) || 0;\n const name = (url.searchParams.get(\"name\") || \"builder.html\").slice(\n 0,\n 120,\n );\n if (!/^[a-z0-9]{1,16}$/.test(stamp)) {\n return json({ error: \"Bad upload id.\" }, 400);\n }\n if (!Number.isInteger(parts) || parts < 1) {\n return json({ error: \"Bad piece count.\" }, 400);\n }\n\n const arrived = await blob.list(PART_PREFIX + stamp + \":\");\n if (arrived.length !== parts) {\n return json({\n error: \"Only \" + arrived.length + \" of \" + parts + \" pieces arrived.\",\n }, 400);\n }\n\n await blob.setJSON(MANIFEST, {\n stamp,\n parts,\n size,\n name,\n uploadedAt: new Date().toISOString(),\n });\n\n /* tidy away every piece that is not part of the version just installed */\n for (const entry of await blob.list(PART_PREFIX)) {\n if (!entry.key.startsWith(PART_PREFIX + stamp + \":\")) {\n try {\n await blob.delete(entry.key);\n } catch { /* already gone */ }\n }\n }\n return json({ ok: true, parts, size });\n }\n /* everything past here talks to GoHighLevel */\n if (!token || !appKey) {\n return json({\n error:\n \"Not configured. Set GHL_TOKEN and APP_KEY in the val's environment variables.\",\n }, 503);\n }\n if (!signed && url.searchParams.get(\"key\") !== appKey) {\n return json({ error: \"Not signed in, and no key was given.\" }, 401);\n }\n\n /* ---- health ---- */\n if (path === \"/api/health\") {\n const loc = await ghl(\"/locations/\" + LOCATION_ID, token);\n return json({\n ok: true,\n location: loc?.location?.name ?? null,\n locationId: LOCATION_ID,\n revision: \"B\",\n });\n }\n\n /* ---- diagnostics: which permissions does this token actually have? ---- */\n if (path === \"/api/diag\") {\n const probe = async (label: string, scope: string, p: string) => {\n try {\n await ghl(p, token);\n return { permission: label, scope, ok: true, note: \"working\" };\n } catch (e: any) {\n return {\n permission: label,\n scope,\n ok: false,\n status: e.status ?? null,\n note: e.status === 401 || e.status === 403\n ? 'MISSING — tick \"' + label +\n '\" on the Private Integration in GoHighLevel'\n : (e.ghlMessage || e.message),\n goHighLevelSaid: e.ghlMessage || null,\n };\n }\n };\n const first = PIPELINES[0];\n const checks = await Promise.all([\n probe(\n \"View Locations\",\n \"locations.readonly\",\n \"/locations/\" + LOCATION_ID,\n ),\n probe(\n \"View Contacts\",\n \"contacts.readonly\",\n \"/contacts/?\" +\n new URLSearchParams({ locationId: LOCATION_ID, limit: \"1\" }),\n ),\n probe(\n \"View Opportunities\",\n \"opportunities.readonly\",\n \"/opportunities/search?\" + new URLSearchParams({\n location_id: LOCATION_ID,\n pipeline_id: first.id,\n status: \"open\",\n limit: \"1\",\n }),\n ),\n ]);\n const missing = checks.filter((c) => !c.ok);\n return json({\n allGood: missing.length === 0,\n summary: missing.length === 0\n ? \"All three permissions are working. The wizard should be fully functional.\"\n : \"The token is missing \" + missing.length + \" permission\" +\n (missing.length === 1 ? \"\" : \"s\") +\n \": \" + missing.map((m) => m.permission).join(\", \") + \".\",\n checks,\n });\n }\n\n /* ---- the shortlist: who is ready for a proposal, across both pipelines ---- */\n if (path === \"/api/shortlist\") {\n const jobs: Array> = [];\n for (const pipe of PIPELINES) {\n for (const stage of pipe.stages) {\n const q = new URLSearchParams({\n location_id: LOCATION_ID,\n pipeline_id: pipe.id,\n pipeline_stage_id: stage.id,\n status: \"open\",\n limit: \"25\",\n });\n jobs.push(\n ghl(\"/opportunities/search?\" + q, token)\n .then((d: any) =>\n (d.opportunities || []).map((o: any) => ({\n opportunityId: o.id,\n contactId: o.contactId,\n display: o.contact?.name || o.name || \"(unnamed)\",\n email: o.contact?.email || \"\",\n phone: o.contact?.phone || \"\",\n stage: stage.name,\n pipeline: pipe.name,\n rank: stage.rank,\n updatedAt: o.updatedAt || o.lastStageChangeAt || \"\",\n }))\n ),\n );\n }\n }\n const batches = await Promise.all(jobs);\n\n const seen = new Set();\n const rows: any[] = [];\n for (const r of batches.flat()) {\n if (!r.contactId || seen.has(r.contactId)) continue;\n seen.add(r.contactId);\n rows.push(r);\n }\n rows.sort((a, b) =>\n a.rank - b.rank ||\n String(b.updatedAt).localeCompare(String(a.updatedAt))\n );\n\n return json({\n count: rows.length,\n contacts: rows,\n stagesSearched: PIPELINES.flatMap((p) => p.stages.map((s) => s.name)),\n });\n }\n\n /* ---- search ---- */\n if (path === \"/api/search\") {\n const q = (url.searchParams.get(\"q\") || \"\").trim();\n if (q.length < 2) return json({ count: 0, contacts: [] });\n const params = new URLSearchParams({\n locationId: LOCATION_ID,\n query: q,\n limit: \"25\",\n });\n const data = await ghl(\"/contacts/?\" + params, token);\n const rows = (data.contacts || []).map((c: any) => {\n const m = mapContact(c);\n return {\n contactId: c.id,\n display: m.display,\n email: m.email,\n phone: m.phone,\n hasAddress: m.hasAddress,\n };\n });\n return json({ count: rows.length, contacts: rows });\n }\n\n /* ---- one contact, mapped ---- */\n if (path === \"/api/contact\") {\n const id = url.searchParams.get(\"id\");\n if (!id) return json({ error: \"id is required\" }, 400);\n const data = await ghl(\"/contacts/\" + id, token);\n const c = data.contact || data;\n return json(mapContact(c));\n }\n\n return json({ error: \"Unknown route\", path }, 404);\n } catch (err: any) {\n return json(\n {\n error: err.message || String(err),\n status: err.status ?? null,\n hint: (err.status === 401 || err.status === 403)\n ? \"This looks like a missing permission on the Private Integration Token. \" +\n \"Open /api/diag?key= — it will name the one that is missing.\"\n : null,\n detail: err.data ?? null,\n },\n err.status && err.status < 500 ? err.status : 502,\n );\n }\n}","createdAt",["D",1788780123899],"branchVersion","branchId","8f900b71-dfa7-4938-9a60-ce72580183b4","id","ba85e382-46b2-4961-b853-5edeced77a1a","canibuild-widget-test",["D",1788753907578],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","canibuild LeadConverter widget test bench","imageUrl","8339612a-c709-4cad-8b1b-55c692a599e7","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019d9583-b608-762e-b5a4-65bc0440c781","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_96":95,"_103":99},"org",{"_96":95,"_97":-5,"_98":99,"_18":55,"_100":101,"_102":25},"branch",{"_13":85,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"isOwned",11,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","jcastillo47","handle","displayName","avatar","https://avatars.githubusercontent.com/u/273235611?v=4","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":152,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":153,"_80":154,"_82":155,"_84":25},"tree",[147],"files",[147],"counts",{"_135":62,"_136":137,"_138":62,"_139":140,"_141":142},"contents",[126],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":25,"_38":130,"_13":131,"_33":34,"_35":37,"_24":25,"_132":133,"_27":134},"15452a2b-cc4c-4194-ac73-e0b5ea2541fc","parentId","latest",["D",1788780123899],8,"label","nestadu-widget",[28],"pulls","branches",1,"forks","envVars",{"_143":145,"_146":62},"connections",{"_143":62,"_144":62},"count","unfilledCount",3,"emptyCount",{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":25,"_38":148,"_13":131,"_33":34,"_35":37,"_24":25,"_132":133,"_149":150,"_27":151},["D",1788780123899],"children",[],[28],["D",1788753907578],{"_96":95,"_103":99},{"_96":95,"_97":-5,"_98":99,"_18":55,"_100":101,"_102":25},{"_13":85,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"ctx",{"_78":-5,"_123":189,"_190":191,"_192":193,"_194":25,"_195":25,"_196":25,"_197":58,"_198":-5,"_199":-7,"_200":-7,"_201":62,"_202":25,"_203":25,"_204":-5,"_205":25,"_206":25,"_207":25,"_208":-5},"ENV",{"_160":161,"_162":163,"_164":86,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Proposal Builder

Builder upload

What is installed

Install a new version

What canibuild sends back

The builder is not installed yet

Proposal Builder

Builder upload

What is installed

Install a new version

What canibuild sends back

The builder is not installed yet

Diff · v9