' + msg + \"

\" : \"\",\n );\n\n/* ===================== admin: upload the builder ===================== */\nconst ADMIN_PAGE = String.raw`\n\nNestadu — builder upload\n\n

nestadu

Builder upload

\n Open the builder Sign out

\n\n

What is installed

Checking…

Open the builder

\n\n

Install a new version

Drop the Nestadu_Proposal_Builder.html file here, or click to pick it.\n It replaces whatever is installed now. Nobody is interrupted — the next person to open the\n builder simply gets the new one.

\n Drop the builder file here\n or click to choose it — a single .html file\n \n

\n\n

\n\n`;\n\nconst CORS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n};\n\n/* ===================== canibuild widget host page ===================== */\n/* Served at /canibuild. The wizard shows this in a panel. Everything the\n widget sends back is forwarded up to the wizard with postMessage. */\n\nconst CANIBUILD_PAGE = String.raw`\n\n\n\nSite plan — canibuild\n\n\n

\n Address\n Design\n \n \n\n \n \n canibuild must allow \n \n \n Full canibuild ↗\n

\n\n

\n \n \n

Loading…

\n\n\n\n\n`\n .replaceAll(\"__MOUNT__\", CANIBUILD_MOUNT)\n .replaceAll(\"__TOKEN__\", CANIBUILD_TOKEN);\n\nconst json = (body: unknown, status = 200) =>\n new Response(JSON.stringify(body, null, 2), {\n status,\n headers: {\n \"Content-Type\": \"application/json; charset=utf-8\",\n \"Cache-Control\": \"no-store\",\n ...CORS,\n },\n });\n\nconst page = (html: string, status = 200) =>\n new Response(html, {\n status,\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n \"Cache-Control\": \"no-store\",\n },\n });\n\nconst NOTHING_INSTALLED = String.raw`\nNestadu — nothing installed yet\n\n

The builder is not installed yet

The password worked — there is just nothing here to open. Upload the\nNestadu_Proposal_Builder.html file and it will appear.

\nGo to the upload page

`;\n\nasync function ghl(path: string, token: string) {\n const res = await fetch(GHL + path, {\n headers: {\n Authorization: \"Bearer \" + token,\n Version: GHL_VERSION,\n Accept: \"application/json\",\n },\n });\n const text = await res.text();\n let data: any = null;\n try {\n data = text ? JSON.parse(text) : null;\n } catch {\n data = { raw: text.slice(0, 400) };\n }\n if (!res.ok) {\n /* Carry GoHighLevel's own wording through — it names the missing scope. */\n const said = data?.message ?? data?.error ?? data?.msg ?? \"\";\n const detail = Array.isArray(said) ? said.join(\"; \") : String(said || \"\");\n throw Object.assign(\n new Error(\n \"GoHighLevel returned \" + res.status + (detail ? \" — \" + detail : \"\"),\n ),\n { status: res.status, data, ghlMessage: detail },\n );\n }\n return data;\n}\n\n/* ---------- shape a GHL contact into the wizard's fields ---------- */\nfunction mapContact(c: any) {\n /* GoHighLevel stores contactName lowercased and the *Raw fields as typed,\n which are sometimes ALL CAPS. Rebuild a presentable name from whichever\n parts exist, then tidy the capitalisation. */\n const nice = (s: string) =>\n (s || \"\").replace(\n /[^\\s-]+/g,\n (w) =>\n /[a-z]/.test(w) &&\n /[A-Z]/.test(w.slice(1)) /* McBride, DeVries — leave alone */\n ? w\n : w.charAt(0).toUpperCase() + w.slice(1).toLowerCase(),\n );\n\n const first = nice(c.firstNameRaw || c.firstName || \"\");\n const last = nice(c.lastNameRaw || c.lastName || \"\");\n const joined = [first, last].filter(Boolean).join(\" \").trim();\n const full = joined || nice(c.contactName || \"\").trim();\n\n const suggestions: Array<\n { label: string; value: string; fillable: boolean }\n > = [];\n for (const f of c.customFields || []) {\n const label = CUSTOM_FIELD_IDS[f.id];\n const value = f.value == null ? \"\" : String(f.value).trim();\n if (!label || !value || value === \"...\") continue;\n suggestions.push({ label, value, fillable: FILLABLE.has(label) });\n }\n suggestions.sort((a, b) =>\n Number(b.fillable) - Number(a.fillable) || a.label.localeCompare(b.label)\n );\n\n const line1 = c.address1 || \"\";\n const cityState = [c.city, c.state].filter(Boolean).join(\", \");\n const siteAddress = [line1, cityState].filter(Boolean).join(\", \") +\n (c.postalCode ? \" \" + c.postalCode : \"\");\n\n return {\n id: c.id,\n display: full || c.email || c.phone || \"(no name)\",\n email: c.email || \"\",\n phone: c.phone || \"\",\n tags: c.tags || [],\n fields: {\n CLIENT_NAME: full,\n CLIENT_GREETING: first,\n SITE_ADDRESS: line1 ? siteAddress.trim() : \"\",\n JURISDICTION: c.city || \"\",\n },\n suggestions,\n hasAddress: Boolean(line1),\n };\n}\n\n/* ------------------------------- handler ------------------------------- */\nexport default async function (req: Request): Promise {\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: CORS });\n }\n\n const url = new URL(req.url);\n const path = url.pathname.replace(/\\/+$/, \"\") || \"/\";\n\n const token = Deno.env.get(\"GHL_TOKEN\");\n const appKey = Deno.env.get(\"APP_KEY\");\n const signed = await isSignedIn(req);\n\n if (path === \"/status\" || path === \"/api\") {\n return new Response(\n \"Nestadu proposal builder — revision C\\n\\n\" +\n \"GHL_TOKEN configured: \" + (token ? \"yes\" : \"NO\") + \"\\n\" +\n \"APP_KEY configured: \" + (appKey ? \"yes\" : \"NO\") + \"\\n\" +\n \"BUILDER_PASSWORD configured: \" +\n (Deno.env.get(\"BUILDER_PASSWORD\")\n ? \"yes\"\n : (appKey ? \"no — falling back to APP_KEY\" : \"NO\")) +\n \"\\n\\n\" +\n \"Pages: / (sign in) /builder /admin\\n\" +\n \"API: /api/health /api/diag /api/shortlist /api/search?q= /api/contact?id=\\n\" +\n \" /canibuild (the site plan widget page — open it to see this host name)\\n\\n\" +\n \"The API accepts either the sign-in cookie or ?key=.\\n\\n\" +\n \"If something returns 401, open /api/diag?key=... — it tests each\\n\" +\n \"permission separately and tells you which one is missing.\\n\",\n { headers: { \"Content-Type\": \"text/plain; charset=utf-8\", ...CORS } },\n );\n }\n\n /* ---- the canibuild widget host page (a page, so no key is required) ---- */\n if (path === \"/canibuild\") {\n return new Response(CANIBUILD_PAGE, {\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n \"Cache-Control\": \"no-store\",\n /* The wizard shows this page in a panel. \"*\" alone matches only network\n schemes, which would lock out a wizard opened as a local file, so the\n non-network schemes are listed explicitly. */\n \"Content-Security-Policy\":\n \"frame-ancestors * file: blob: filesystem: data:\",\n },\n });\n }\n\n try {\n /* ---- signing in and out ---- */\n if (path === \"/login\" && req.method === \"POST\") {\n const want = builderPassword();\n if (!want) {\n return page(\n LOGIN_PAGE(\n \"No password has been set on this site yet. Add BUILDER_PASSWORD \" +\n \"in the val's Environment Variables, then reload.\",\n ),\n 503,\n );\n }\n const form = await req.formData();\n if (String(form.get(\"password\") || \"\") !== want) {\n return page(LOGIN_PAGE(\"That password was not right.\"), 401);\n }\n return redirect(\"/builder\", {\n \"Set-Cookie\": COOKIE + \"=\" + (await sessionValue(want)) +\n \"; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=2592000\",\n });\n }\n\n if (path === \"/logout\") {\n return redirect(\"/\", { \"Set-Cookie\": COOKIE + \"=; Path=/; Max-Age=0\" });\n }\n\n if (path === \"/\") {\n return signed ? redirect(\"/builder\") : page(LOGIN_PAGE(\"\"));\n }\n\n /* ---- the builder itself, streamed out of blob storage ---- */\n if (path === \"/builder\") {\n if (!signed) return redirect(\"/\");\n const man = await blob.getJSON(MANIFEST) as any;\n if (!man || !man.parts) return page(NOTHING_INSTALLED, 200);\n\n let i = 0;\n const body = new ReadableStream({\n async pull(controller) {\n if (i >= man.parts) {\n controller.close();\n return;\n }\n try {\n const res = await blob.get(partKey(man.stamp, i));\n controller.enqueue(new Uint8Array(await res.arrayBuffer()));\n i++;\n } catch (e) {\n controller.error(\n new Error(\n \"Piece \" + i + \" of the builder is missing. Upload it again.\",\n ),\n );\n }\n },\n });\n return new Response(body, {\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n \"Cache-Control\": \"no-store\",\n },\n });\n }\n\n /* ---- installing a new builder ---- */\n if (path === \"/admin\") {\n if (!signed) return redirect(\"/\");\n return page(ADMIN_PAGE);\n }\n\n if (path === \"/admin/info\") {\n if (!signed) return json({ error: \"Not signed in.\" }, 401);\n const man = await blob.getJSON(MANIFEST) as any;\n return json(man ? { installed: true, ...man } : { installed: false });\n }\n\n if (path === \"/admin/upload\" && req.method === \"POST\") {\n if (!signed) return json({ error: \"Not signed in.\" }, 401);\n const stamp = url.searchParams.get(\"stamp\") || \"\";\n const i = Number(url.searchParams.get(\"i\"));\n if (!/^[a-z0-9]{1,16}$/.test(stamp)) {\n return json({ error: \"Bad upload id.\" }, 400);\n }\n if (!Number.isInteger(i) || i < 0 || i > 500) {\n return json({ error: \"Bad piece number.\" }, 400);\n }\n const buf = await req.arrayBuffer();\n if (buf.byteLength > 1024 * 1024) {\n return json({ error: \"That piece is too big.\" }, 413);\n }\n\n /* Starting a fresh upload: sweep away leftovers from any upload that was\n abandoned half way, so an interrupted attempt cannot fill the 10 MB of\n blob storage the free plan allows. The installed version is untouched. */\n if (i === 0) {\n const live = (await blob.getJSON(MANIFEST) as any)?.stamp;\n for (const entry of await blob.list(PART_PREFIX)) {\n const keep =\n (live && entry.key.startsWith(PART_PREFIX + live + \":\")) ||\n entry.key.startsWith(PART_PREFIX + stamp + \":\");\n if (!keep) {\n try {\n await blob.delete(entry.key);\n } catch { /* already gone */ }\n }\n }\n }\n\n await blob.set(partKey(stamp, i), buf);\n return json({ ok: true, i, bytes: buf.byteLength });\n }\n\n if (path === \"/admin/commit\" && req.method === \"POST\") {\n if (!signed) return json({ error: \"Not signed in.\" }, 401);\n const stamp = url.searchParams.get(\"stamp\") || \"\";\n const parts = Number(url.searchParams.get(\"parts\"));\n const size = Number(url.searchParams.get(\"size\")) || 0;\n const name = (url.searchParams.get(\"name\") || \"builder.html\").slice(\n 0,\n 120,\n );\n if (!/^[a-z0-9]{1,16}$/.test(stamp)) {\n return json({ error: \"Bad upload id.\" }, 400);\n }\n if (!Number.isInteger(parts) || parts < 1) {\n return json({ error: \"Bad piece count.\" }, 400);\n }\n\n const arrived = await blob.list(PART_PREFIX + stamp + \":\");\n if (arrived.length !== parts) {\n return json({\n error: \"Only \" + arrived.length + \" of \" + parts + \" pieces arrived.\",\n }, 400);\n }\n\n await blob.setJSON(MANIFEST, {\n stamp,\n parts,\n size,\n name,\n uploadedAt: new Date().toISOString(),\n });\n\n /* tidy away every piece that is not part of the version just installed */\n for (const entry of await blob.list(PART_PREFIX)) {\n if (!entry.key.startsWith(PART_PREFIX + stamp + \":\")) {\n try {\n await blob.delete(entry.key);\n } catch { /* already gone */ }\n }\n }\n return json({ ok: true, parts, size });\n }\n /* everything past here talks to GoHighLevel */\n if (!token || !appKey) {\n return json({\n error:\n \"Not configured. Set GHL_TOKEN and APP_KEY in the val's environment variables.\",\n }, 503);\n }\n if (!signed && url.searchParams.get(\"key\") !== appKey) {\n return json({ error: \"Not signed in, and no key was given.\" }, 401);\n }\n\n /* ---- health ---- */\n if (path === \"/api/health\") {\n const loc = await ghl(\"/locations/\" + LOCATION_ID, token);\n return json({\n ok: true,\n location: loc?.location?.name ?? null,\n locationId: LOCATION_ID,\n revision: \"B\",\n });\n }\n\n /* ---- diagnostics: which permissions does this token actually have? ---- */\n if (path === \"/api/diag\") {\n const probe = async (label: string, scope: string, p: string) => {\n try {\n await ghl(p, token);\n return { permission: label, scope, ok: true, note: \"working\" };\n } catch (e: any) {\n return {\n permission: label,\n scope,\n ok: false,\n status: e.status ?? null,\n note: e.status === 401 || e.status === 403\n ? 'MISSING — tick \"' + label +\n '\" on the Private Integration in GoHighLevel'\n : (e.ghlMessage || e.message),\n goHighLevelSaid: e.ghlMessage || null,\n };\n }\n };\n const first = PIPELINES[0];\n const checks = await Promise.all([\n probe(\n \"View Locations\",\n \"locations.readonly\",\n \"/locations/\" + LOCATION_ID,\n ),\n probe(\n \"View Contacts\",\n \"contacts.readonly\",\n \"/contacts/?\" +\n new URLSearchParams({ locationId: LOCATION_ID, limit: \"1\" }),\n ),\n probe(\n \"View Opportunities\",\n \"opportunities.readonly\",\n \"/opportunities/search?\" + new URLSearchParams({\n location_id: LOCATION_ID,\n pipeline_id: first.id,\n status: \"open\",\n limit: \"1\",\n }),\n ),\n ]);\n const missing = checks.filter((c) => !c.ok);\n return json({\n allGood: missing.length === 0,\n summary: missing.length === 0\n ? \"All three permissions are working. The wizard should be fully functional.\"\n : \"The token is missing \" + missing.length + \" permission\" +\n (missing.length === 1 ? \"\" : \"s\") +\n \": \" + missing.map((m) => m.permission).join(\", \") + \".\",\n checks,\n });\n }\n\n /* ---- the shortlist: who is ready for a proposal, across both pipelines ---- */\n if (path === \"/api/shortlist\") {\n const jobs: Array> = [];\n for (const pipe of PIPELINES) {\n for (const stage of pipe.stages) {\n const q = new URLSearchParams({\n location_id: LOCATION_ID,\n pipeline_id: pipe.id,\n pipeline_stage_id: stage.id,\n status: \"open\",\n limit: \"25\",\n });\n jobs.push(\n ghl(\"/opportunities/search?\" + q, token)\n .then((d: any) =>\n (d.opportunities || []).map((o: any) => ({\n opportunityId: o.id,\n contactId: o.contactId,\n display: o.contact?.name || o.name || \"(unnamed)\",\n email: o.contact?.email || \"\",\n phone: o.contact?.phone || \"\",\n stage: stage.name,\n pipeline: pipe.name,\n rank: stage.rank,\n updatedAt: o.updatedAt || o.lastStageChangeAt || \"\",\n }))\n ),\n );\n }\n }\n const batches = await Promise.all(jobs);\n\n const seen = new Set();\n const rows: any[] = [];\n for (const r of batches.flat()) {\n if (!r.contactId || seen.has(r.contactId)) continue;\n seen.add(r.contactId);\n rows.push(r);\n }\n rows.sort((a, b) =>\n a.rank - b.rank ||\n String(b.updatedAt).localeCompare(String(a.updatedAt))\n );\n\n return json({\n count: rows.length,\n contacts: rows,\n stagesSearched: PIPELINES.flatMap((p) => p.stages.map((s) => s.name)),\n });\n }\n\n /* ---- search ---- */\n if (path === \"/api/search\") {\n const q = (url.searchParams.get(\"q\") || \"\").trim();\n if (q.length < 2) return json({ count: 0, contacts: [] });\n const params = new URLSearchParams({\n locationId: LOCATION_ID,\n query: q,\n limit: \"25\",\n });\n const data = await ghl(\"/contacts/?\" + params, token);\n const rows = (data.contacts || []).map((c: any) => {\n const m = mapContact(c);\n return {\n contactId: c.id,\n display: m.display,\n email: m.email,\n phone: m.phone,\n hasAddress: m.hasAddress,\n };\n });\n return json({ count: rows.length, contacts: rows });\n }\n\n /* ---- one contact, mapped ---- */\n if (path === \"/api/contact\") {\n const id = url.searchParams.get(\"id\");\n if (!id) return json({ error: \"id is required\" }, 400);\n const data = await ghl(\"/contacts/\" + id, token);\n const c = data.contact || data;\n return json(mapContact(c));\n }\n\n return json({ error: \"Unknown route\", path }, 404);\n } catch (err: any) {\n return json(\n {\n error: err.message || String(err),\n status: err.status ?? null,\n hint: (err.status === 401 || err.status === 403)\n ? \"This looks like a missing permission on the Private Integration Token. \" +\n \"Open /api/diag?key= — it will name the one that is missing.\"\n : null,\n detail: err.data ?? null,\n },\n err.status && err.status < 500 ? err.status : 502,\n );\n }\n}","deleted","label","nestadu-widget",[109],"pulls","branches",1,"forks","envVars",{"_133":135,"_136":42},"connections",{"_133":42,"_134":42},"count","unfilledCount",3,"emptyCount",{"_18":108,"_20":109,"_110":36,"_111":-5,"_112":68,"_113":66,"_114":38,"_22":138,"_65":116,"_117":118,"_119":120,"_121":26,"_122":123,"_139":140,"_85":141},["D",1788781666791],"children",[],[109],["D",1788753907578],{"_16":17,"_83":79},{"_16":17,"_77":-5,"_78":79,"_33":34,"_80":81,"_82":26},{"_65":66,"_20":67,"_18":68,"_69":19,"_70":-5,"_71":-5,"_72":-5,"_73":-5,"_74":-5,"_75":21,"_76":17},"ctx",{"_58":-5,"_104":179,"_180":181,"_182":183,"_184":26,"_185":26,"_186":26,"_187":38,"_188":-5,"_189":-7,"_190":-7,"_191":42,"_192":26,"_193":26,"_194":-5,"_195":26,"_196":26,"_197":26,"_198":-5},"ENV",{"_150":151,"_152":153,"_154":67,"_155":156,"_157":158,"_159":160,"_161":162,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Proposal Builder

Builder upload

What is installed

Install a new version

What canibuild sends back

The builder is not installed yet