[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_157":158,"_159":160},"routes/_app.x.$handle.$name",{"_97":96,"_32":45,"_105":87,"_27":100,"_13":14,"_106":-5,"_11":107,"_108":109,"_110":111,"_112":113,"_114":115,"_20":-5,"_116":-5,"_117":-5,"_118":25,"_119":120,"_121":122,"_123":-5,"_124":-5,"_125":126},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":-5,"_53":-5,"_18":54,"_55":-5,"_56":25,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":25},"version",19,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","caf3509a-369b-11f1-90f9-42b51c65c3df","name","fileType","http","content","import { blob } from \"https://esm.town/v/std/blob\";\n\nexport default async function (req: Request): Promise {\n const cors = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"POST, GET, OPTIONS\",\n \"Access-Control-Allow-Headers\":\n \"Content-Type, Authorization, x-api-key, anthropic-version\",\n };\n\n if (req.method === \"OPTIONS\") {\n return new Response(null, { headers: cors });\n }\n\n // ── KEYS FROM ENVIRONMENT ──\n const STRIPE_KEY = Deno.env.get(\"STRIPE_SECRET_KEY\") || \"\";\n const STRIPE_WEBHOOK = Deno.env.get(\"STRIPE_WEBHOOK_SECRET\") || \"\";\n const SUPABASE_URL = Deno.env.get(\"SUPABASE_URL\") ||\n \"https://pzbvvohedpgeiynqoujr.supabase.co\";\n const SUPABASE_KEY = Deno.env.get(\"SUPABASE_SERVICE_KEY\") || \"\";\n const ANTHROPIC_KEY = Deno.env.get(\"ANTHROPIC_API_KEY\") || \"\";\n const BLAND_KEY = Deno.env.get(\"BLAND_API_KEY\") || \"\";\n const LOB_KEY = Deno.env.get(\"LOB_API_KEY\") || \"\";\n const IMGBB_KEY = Deno.env.get(\"IMGBB_API_KEY\") || \"\";\n const CLOUDINARY_CLOUD = Deno.env.get(\"CLOUDINARY_CLOUD_NAME\") || \"dux8cgved\";\n const CLOUDINARY_KEY = Deno.env.get(\"CLOUDINARY_API_KEY\") ||\n \"132548556953169\";\n const CLOUDINARY_SECRET = Deno.env.get(\"CLOUDINARY_API_SECRET\") ||\n \"rOT7bs828mPHUaRU0LcFS3o3-O8\";\n\n // ── STRIPE PRICE IDs ──\n const STRIPE_PRICES = {\n platform: \"price_1TLS1sE8Fzrv1kXN8ZyBhwot\",\n mailer: \"price_1TLS4eE8Fzrv1kXNjXmul7Ie\",\n spot_bid: \"price_1TLS62E8Fzrv1kXNsvLA5tT9\",\n bulk_tagged: \"price_1TOPSxE8Fzrv1kXNj9VwfCIN\",\n };\n\n async function updateContractorProfile(\n contractorId: string,\n updates: Record,\n ) {\n if (!contractorId) return;\n await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?id=eq.${contractorId}`,\n {\n method: \"PATCH\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal\",\n },\n body: JSON.stringify(updates),\n },\n );\n }\n\n async function getContractorByCustomer(\n stripeCustomerId: string,\n ): Promise {\n const res = await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?stripe_customer_id=eq.${stripeCustomerId}&select=id`,\n {\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n },\n },\n );\n const rows = await res.json();\n return rows?.[0]?.id || null;\n }\n\n // ── USAGE EVENT LOGGING ──\n // `stripeReported` reflects whether the Stripe usage_records POST actually\n // succeeded. When false, the row is a reconciliation candidate (Lob shipped\n // but Stripe wasn't billed). Previously this was hardcoded false on every\n // insert, which made the field useless for sweeps. Default kept false so\n // call sites that don't pass it (e.g. grandfathered/no-sub paths) stay safe.\n async function logUsageEvent(\n userId: string,\n eventType: string,\n quantity: number,\n unitPrice: number,\n lobId?: string,\n stripeReported: boolean = false,\n ) {\n await fetch(`${SUPABASE_URL}/rest/v1/usage_events`, {\n method: \"POST\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal\",\n },\n body: JSON.stringify({\n user_id: userId,\n event_type: eventType,\n quantity,\n unit_price: unitPrice,\n total: quantity * unitPrice,\n lob_id: lobId || null,\n stripe_reported: stripeReported,\n }),\n });\n }\n\n // Unit price lookup per event\n function unitPriceFor(eventType: string): number {\n if (eventType === \"spot_bid_sent\") return 1.75;\n if (eventType === \"bulk_tagged_sent\") return 1.25;\n if (eventType === \"mailer_sent\") return 0.95;\n return 0;\n }\n\n try {\n const url = new URL(req.url);\n const target = url.searchParams.get(\"target\") || \"lob\";\n\n // ── STRIPE: HOSTED CHECKOUT SESSION ──\n if (target === \"stripe-checkout\") {\n const { email, userId, contractorId, successUrl, cancelUrl } = await req\n .json();\n\n const searchRes = await fetch(\n `https://api.stripe.com/v1/customers/search?query=email:'${\n encodeURIComponent(email)\n }'`,\n { headers: { \"Authorization\": `Bearer ${STRIPE_KEY}` } },\n );\n const searchData = await searchRes.json();\n let customerId = searchData?.data?.[0]?.id;\n\n if (!customerId) {\n const customerRes = await fetch(\"https://api.stripe.com/v1/customers\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n email,\n \"metadata[contractorId]\": contractorId || userId,\n \"metadata[userId]\": userId,\n }),\n });\n const customer = await customerRes.json();\n customerId = customer.id;\n }\n\n const sessionRes = await fetch(\n \"https://api.stripe.com/v1/checkout/sessions\",\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n customer: customerId,\n mode: \"subscription\",\n \"line_items[0][price]\": STRIPE_PRICES.platform,\n \"line_items[1][price]\": STRIPE_PRICES.spot_bid,\n \"line_items[2][price]\": STRIPE_PRICES.mailer,\n \"line_items[3][price]\": STRIPE_PRICES.bulk_tagged,\n client_reference_id: userId,\n success_url: successUrl || \"https://spotsend.io?billing=success\",\n cancel_url: cancelUrl || \"https://spotsend.io?billing=cancel\",\n \"metadata[contractorId]\": contractorId || userId,\n \"metadata[userId]\": userId,\n }),\n },\n );\n const session = await sessionRes.json();\n\n return new Response(\n JSON.stringify({ url: session.url, sessionId: session.id }),\n {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // ── STRIPE: CREATE CUSTOMER + SUBSCRIPTION ──\n if (target === \"stripe-create-subscription\") {\n const { email, userId, contractorId } = await req.json();\n\n const customerRes = await fetch(\"https://api.stripe.com/v1/customers\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n email,\n \"metadata[contractorId]\": contractorId,\n \"metadata[userId]\": userId,\n }),\n });\n const customer = await customerRes.json();\n if (customer.error) {\n return new Response(JSON.stringify({ error: customer.error.message }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n const subRes = await fetch(\"https://api.stripe.com/v1/subscriptions\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n customer: customer.id,\n \"items[0][price]\": STRIPE_PRICES.platform,\n \"items[1][price]\": STRIPE_PRICES.mailer,\n \"items[2][price]\": STRIPE_PRICES.spot_bid,\n \"items[3][price]\": STRIPE_PRICES.bulk_tagged,\n \"metadata[contractorId]\": contractorId,\n \"metadata[userId]\": userId,\n payment_behavior: \"default_incomplete\",\n \"expand[]\": \"latest_invoice.payment_intent\",\n }),\n });\n const subscription = await subRes.json();\n\n await updateContractorProfile(contractorId, {\n stripe_customer_id: customer.id,\n stripe_sub_id: subscription.id,\n is_active: false,\n });\n\n return new Response(\n JSON.stringify({\n customerId: customer.id,\n subscriptionId: subscription.id,\n clientSecret: subscription.latest_invoice?.payment_intent\n ?.client_secret,\n }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n // ── STRIPE: REPORT USAGE (metered billing) ──\n // Now supports three event types + graceful skip for grandfathered accounts.\n // Logs usage_events with stripe_reported reflecting whether Stripe actually\n // accepted the report (was hardcoded false before, breaking reconciliation).\n if (target === \"stripe-report-usage\") {\n const { subscriptionId, eventType, quantity, userId, lobId } = await req\n .json();\n\n const priceMap: Record = {\n mailer_sent: STRIPE_PRICES.mailer,\n spot_bid_sent: STRIPE_PRICES.spot_bid,\n bulk_tagged_sent: STRIPE_PRICES.bulk_tagged,\n };\n\n const targetPrice = priceMap[eventType];\n const unitPrice = unitPriceFor(eventType);\n\n if (!targetPrice) {\n return new Response(\n JSON.stringify({\n error: `Unknown event_type: ${eventType}`,\n known: Object.keys(priceMap),\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // No subscription → grandfathered/trial; log and skip Stripe\n if (!subscriptionId) {\n await logUsageEvent(\n userId,\n eventType,\n quantity,\n unitPrice,\n lobId,\n false,\n );\n return new Response(\n JSON.stringify({\n success: true,\n skipped_stripe: true,\n reason: \"no subscription (grandfathered or trial)\",\n }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n const subRes = await fetch(\n `https://api.stripe.com/v1/subscriptions/${subscriptionId}`,\n { headers: { \"Authorization\": `Bearer ${STRIPE_KEY}` } },\n );\n const sub = await subRes.json();\n const items = sub.items?.data || [];\n\n const item = items.find((i: Record) =>\n (i.price as Record)?.id === targetPrice\n );\n\n if (!item) {\n // Subscription exists but missing this line item — log and skip\n await logUsageEvent(\n userId,\n eventType,\n quantity,\n unitPrice,\n lobId,\n false,\n );\n return new Response(\n JSON.stringify({\n success: true,\n skipped_stripe: true,\n reason: \"subscription missing price item\",\n expected_price: targetPrice,\n }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n const usageRes = await fetch(\n `https://api.stripe.com/v1/subscription_items/${item.id}/usage_records`,\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n quantity: String(quantity),\n timestamp: String(Math.floor(Date.now() / 1000)),\n action: \"increment\",\n }),\n },\n );\n const usage = await usageRes.json();\n const stripeOk = usageRes.ok;\n\n // Log with the *actual* outcome — true means Stripe accepted it, false\n // means we have a usage_events row to reconcile later.\n await logUsageEvent(\n userId,\n eventType,\n quantity,\n unitPrice,\n lobId,\n stripeOk,\n );\n\n // Surface failures to the caller instead of always returning success:true.\n // Front-end can now show a real error toast or queue a retry.\n if (!stripeOk) {\n return new Response(\n JSON.stringify({\n success: false,\n stripe_status: usageRes.status,\n stripe_error: usage?.error?.message ||\n \"Stripe usage_records failed\",\n usage,\n }),\n {\n status: 502,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n return new Response(JSON.stringify({ success: true, usage }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── STRIPE: BILLING PORTAL ──\n if (target === \"stripe-portal\") {\n const { customerId, returnUrl } = await req.json();\n const res = await fetch(\n \"https://api.stripe.com/v1/billing_portal/sessions\",\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n customer: customerId,\n return_url: returnUrl || \"https://spotsend.io\",\n }),\n },\n );\n const session = await res.json();\n return new Response(JSON.stringify({ url: session.url }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── REQUEST ACCESS — public landing page form submission ──\n if (target === \"request-access\") {\n if (req.method !== \"POST\") {\n return new Response(JSON.stringify({ error: \"POST only\" }), {\n status: 405,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n let body: Record = {};\n try {\n body = await req.json();\n } catch {\n body = {};\n }\n\n const fullName = String(body.full_name || \"\").trim();\n const email = String(body.email || \"\").trim().toLowerCase();\n const companyName = String(body.company_name || \"\").trim();\n\n if (!fullName || !email || !companyName) {\n return new Response(\n JSON.stringify({ error: \"Missing required fields\" }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n if (!/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {\n return new Response(JSON.stringify({ error: \"Invalid email\" }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // Honeypot — bots fill this hidden field, real humans don't\n if (body.website && String(body.website).length > 0) {\n return new Response(JSON.stringify({ ok: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n const userAgent = req.headers.get(\"user-agent\") || \"\";\n const ipHeader = req.headers.get(\"x-forwarded-for\") || \"\";\n const ip = ipHeader.split(\",\")[0]?.trim() || \"\";\n\n const row = {\n full_name: fullName.slice(0, 200),\n email: email.slice(0, 200),\n phone: body.phone ? String(body.phone).trim().slice(0, 40) : null,\n company_name: companyName.slice(0, 200),\n trade: body.trade ? String(body.trade).trim().slice(0, 60) : null,\n city: body.city ? String(body.city).trim().slice(0, 100) : null,\n state: body.state ? String(body.state).trim().slice(0, 4) : null,\n why: body.why ? String(body.why).trim().slice(0, 1000) : null,\n source: body.source\n ? String(body.source).trim().slice(0, 60)\n : \"landing\",\n user_agent: userAgent.slice(0, 300),\n ip: ip.slice(0, 60),\n };\n\n const insertRes = await fetch(`${SUPABASE_URL}/rest/v1/access_requests`, {\n method: \"POST\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal\",\n },\n body: JSON.stringify(row),\n });\n\n if (!insertRes.ok) {\n const err = await insertRes.text();\n console.error(\n \"[request-access] Supabase insert failed:\",\n insertRes.status,\n err,\n );\n return new Response(\n JSON.stringify({ error: \"Couldn't save request — try again\" }),\n {\n status: 500,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // Email admin via Resend (best-effort — failure here doesn't fail the whole request)\n const RESEND_KEY = Deno.env.get(\"RESEND_API_KEY\");\n if (RESEND_KEY) {\n try {\n const adminEmail = \"joelmwood@gmail.com\";\n const escapeHtmlInline = (s: string): string =>\n String(s || \"\").replace(\n /[&<>\"']/g,\n (\n c,\n ) => ({\n \"&\": \"&\",\n \"<\": \"<\",\n \">\": \">\",\n '\"': \""\",\n \"'\": \"'\",\n }[c]!),\n );\n const html = `\n

New SpotSend access request

\n \n \n \n \n \n \n \n \n

Name	${\n escapeHtmlInline(row.full_name)\n }
Email	${escapeHtmlInline(row.email)}
Phone	${\n escapeHtmlInline(row.phone \|\| \"—\")\n }
Company	${\n escapeHtmlInline(row.company_name)\n }
Trade	${\n escapeHtmlInline(row.trade \|\| \"—\")\n }
Location	${\n escapeHtmlInline(\n [row.city, row.state].filter(Boolean).join(\", \") \|\| \"—\",\n )\n }
Why	${\n escapeHtmlInline(row.why \|\| \"—\").replace(/\\n/g, \" \")\n }

Source: ${\n escapeHtmlInline(row.source)\n } · IP: ${escapeHtmlInline(row.ip)}

\n `;\n await fetch(\"https://api.resend.com/emails\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${RESEND_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n from: \"SpotSend \",\n to: [adminEmail],\n reply_to: row.email,\n subject:\n `[SpotSend] Access request: ${row.full_name} (${row.company_name})`,\n html,\n }),\n });\n } catch (e) {\n console.error(\"[request-access] Email failed (non-blocking):\", e);\n }\n }\n\n return new Response(JSON.stringify({ ok: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── STRIPE WEBHOOK ──\n if (target === \"stripe-webhook\") {\n const payload = await req.text();\n const sig = req.headers.get(\"stripe-signature\") || \"\";\n\n if (STRIPE_WEBHOOK && sig) {\n const parts = sig.split(\",\");\n const timestamp = parts.find((p) => p.startsWith(\"t=\"))?.slice(2) || \"\";\n const sigHash = parts.find((p) => p.startsWith(\"v1=\"))?.slice(3) || \"\";\n const signedPayload = `${timestamp}.${payload}`;\n const encoder = new TextEncoder();\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(STRIPE_WEBHOOK),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const mac = await crypto.subtle.sign(\n \"HMAC\",\n key,\n encoder.encode(signedPayload),\n );\n const expected = Array.from(new Uint8Array(mac))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n if (expected !== sigHash) {\n return new Response(\"Invalid signature\", {\n status: 400,\n headers: cors,\n });\n }\n }\n\n const event = JSON.parse(payload);\n const eventType = event.type as string;\n const data = event.data?.object as Record;\n\n if (\n eventType === \"customer.subscription.created\" ||\n eventType === \"customer.subscription.updated\"\n ) {\n const contractorId = (data?.metadata as Record)\n ?.contractorId;\n const status = data?.status as string;\n await updateContractorProfile(contractorId, {\n stripe_sub_id: data?.id as string,\n is_active: status === \"active\",\n plan: \"pro\",\n });\n }\n\n if (eventType === \"checkout.session.completed\") {\n const userId = data?.client_reference_id as string;\n const customerId = data?.customer as string;\n const contractorId =\n (data?.metadata as Record)?.contractorId || userId;\n if (contractorId) {\n await updateContractorProfile(contractorId, {\n stripe_customer_id: customerId,\n is_active: true,\n plan: \"pro\",\n });\n }\n }\n\n if (eventType === \"customer.subscription.deleted\") {\n const contractorId = (data?.metadata as Record)\n ?.contractorId;\n await updateContractorProfile(contractorId, {\n stripe_sub_id: data?.id as string,\n is_active: false,\n plan: \"cancelled\",\n });\n }\n\n if (eventType === \"invoice.payment_succeeded\") {\n const customerId = data?.customer as string;\n const contractorId = await getContractorByCustomer(customerId);\n if (contractorId) {\n await updateContractorProfile(contractorId, {\n is_active: true,\n plan: \"pro\",\n });\n }\n }\n\n if (eventType === \"invoice.payment_failed\") {\n const customerId = data?.customer as string;\n const contractorId = await getContractorByCustomer(customerId);\n if (contractorId) {\n await updateContractorProfile(contractorId, { is_active: false });\n }\n }\n\n return new Response(JSON.stringify({ received: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── LOB FILE UPLOAD ──\n if (target === \"lob-upload\") {\n const { image, filename } = await req.json();\n const binary = Uint8Array.from(atob(image), (c) => c.charCodeAt(0));\n const formData = new FormData();\n const blob = new Blob([binary], { type: \"image/jpeg\" });\n formData.append(\"file\", blob, filename || \"photo.jpg\");\n formData.append(\"description\", \"SpotSend postcard photo\");\n const res = await fetch(\"https://api.lob.com/v1/uploads\", {\n method: \"POST\",\n headers: { \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\") },\n body: formData,\n });\n const data = await res.json();\n const urlOut = data?.url || data?.signed_url || null;\n return new Response(JSON.stringify({ url: urlOut }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── LOB STATUS ──\n if (target === \"lob-status\") {\n const lobId = url.searchParams.get(\"lob_id\") || \"\";\n if (!lobId || !lobId.startsWith(\"psc_\")) {\n return new Response(\n JSON.stringify({ status: \"unknown\", error: \"Invalid lob_id\" }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n try {\n const res = await fetch(`https://api.lob.com/v1/postcards/${lobId}`, {\n headers: { \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\") },\n });\n if (!res.ok) {\n return new Response(\n JSON.stringify({\n status: \"unknown\",\n lob_status_code: res.status,\n }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n const data = await res.json();\n const events = data.tracking_events || [];\n // Normalize Lob's event name for lookup. Lob returns capitalized names like\n // \"Delivered\", \"In Local Area\", \"In Transit\". Our map keys are snake_case lowercase.\n // Without normalization, EVERY status returned \"in_transit\" (the default fallback)\n // because exact-string lookup always missed.\n const latestRaw = events[events.length - 1]?.name || \"\";\n const latest = latestRaw.toLowerCase().replace(/[\\s-]+/g, \"_\");\n const statusMap: Record = {\n \"mailed\": \"in_transit\",\n \"in_transit\": \"in_transit\",\n \"in_local_area\": \"in_local_area\",\n \"processed_for_delivery\": \"in_local_area\",\n \"out_for_delivery\": \"in_local_area\",\n \"re_routed\": \"in_transit\",\n \"rerouted\": \"in_transit\",\n \"returned_to_sender\": \"returned_to_sender\",\n \"delivered\": \"delivered\",\n \"failed\": \"failed\",\n \"rendered_failed\": \"failed\",\n };\n const status = statusMap[latest] ||\n (data.expected_delivery_date ? \"in_transit\" : \"processing\");\n return new Response(\n JSON.stringify({\n status,\n expected_delivery: data.expected_delivery_date || null,\n latest_event: latestRaw || null, // return original case for diagnostic display\n events_count: events.length,\n }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n } catch (e) {\n return new Response(\n JSON.stringify({ status: \"unknown\", error: String(e) }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n }\n\n // ── IMAGE PROXY ──\n if (target === \"proxy-image\") {\n const imageUrl = url.searchParams.get(\"url\") || \"\";\n if (!imageUrl) {\n return new Response(\"No URL\", { status: 400, headers: cors });\n }\n try {\n const res = await fetch(imageUrl, {\n headers: { \"User-Agent\": \"SpotSend/1.0 Lob-Proxy\" },\n });\n const contentType = res.headers.get(\"content-type\") || \"image/jpeg\";\n const buffer = await res.arrayBuffer();\n return new Response(buffer, {\n status: 200,\n headers: {\n ...cors,\n \"Content-Type\": contentType,\n \"Cache-Control\": \"public, max-age=86400\",\n },\n });\n } catch (_e) {\n return new Response(\"Image fetch failed\", {\n status: 500,\n headers: cors,\n });\n }\n }\n\n // ── USPS EDDM ──\n if (target === \"usps\") {\n const zip = url.searchParams.get(\"zip\") || \"74105\";\n const res = await fetch(\n `https://gis.usps.com/arcgis/rest/services/EDDM/selectZIP/GPServer/routes/execute?f=json&env:outSR=4326&ZIP=${zip}&Rte_Box=R&UserName=EDDM`,\n );\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── PERMITS ──\n if (target === \"permits\") {\n const address = url.searchParams.get(\"address\") || \"\";\n const res = await fetch(\n \"https://tulsaok-energovweb.tylerhost.net/apps/selfservice/api/CSS/permit/search\",\n {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"Accept\": \"application/json\",\n \"Referer\":\n \"https://tulsaok-energovweb.tylerhost.net/apps/selfservice\",\n \"Origin\": \"https://tulsaok-energovweb.tylerhost.net\",\n },\n body: JSON.stringify({\n address,\n permitNumber: \"\",\n permitType: \"\",\n statusCode: \"\",\n dateFrom: \"\",\n dateTo: \"\",\n pageNumber: 1,\n pageSize: 10,\n sortBy: \"IssuedDate\",\n sortDesc: true,\n }),\n },\n );\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── LOB ADDRESS VERIFY ──\n if (target === \"lob-verify\") {\n const body = await req.text();\n const res = await fetch(\"https://api.lob.com/v1/us_verifications\", {\n method: \"POST\",\n headers: {\n \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\"),\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── CLOUDINARY UPLOAD ──\n if (target === \"cloudinary-upload\") {\n const { image, filename } = await req.json();\n const binary = Uint8Array.from(atob(image), (c) => c.charCodeAt(0));\n const blob = new Blob([binary], { type: \"image/jpeg\" });\n\n const timestamp = Math.floor(Date.now() / 1000).toString();\n const paramStr = `timestamp=${timestamp}`;\n const encoder = new TextEncoder();\n const msgData = encoder.encode(paramStr + CLOUDINARY_SECRET);\n const hashBuffer = await crypto.subtle.digest(\"SHA-1\", msgData);\n const signature = Array.from(new Uint8Array(hashBuffer))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n\n const formData = new FormData();\n formData.append(\"file\", blob, filename || \"spot-photo.jpg\");\n formData.append(\"api_key\", CLOUDINARY_KEY);\n formData.append(\"timestamp\", timestamp);\n formData.append(\"signature\", signature);\n\n const uploadRes = await fetch(\n `https://api.cloudinary.com/v1_1/${CLOUDINARY_CLOUD}/image/upload`,\n { method: \"POST\", body: formData },\n );\n const uploadData = await uploadRes.json();\n const urlOut = uploadData?.secure_url || null;\n return new Response(JSON.stringify({ url: urlOut }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── IMGBB UPLOAD ──\n if (target === \"imgbb\") {\n const body = await req.json();\n const formData = new FormData();\n formData.append(\"key\", IMGBB_KEY);\n formData.append(\"image\", body.image as string);\n if (body.name) formData.append(\"name\", body.name as string);\n const res = await fetch(\"https://api.imgbb.com/1/upload\", {\n method: \"POST\",\n body: formData,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── ANTHROPIC ──\n if (target === \"anthropic\") {\n const body = await req.text();\n const res = await fetch(\"https://api.anthropic.com/v1/messages\", {\n method: \"POST\",\n headers: {\n \"x-api-key\": ANTHROPIC_KEY,\n \"anthropic-version\": \"2023-06-01\",\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND CALL ──\n if (target === \"bland-call\") {\n const body = await req.text();\n const res = await fetch(\"https://api.bland.ai/v1/calls\", {\n method: \"POST\",\n headers: {\n \"authorization\": BLAND_KEY,\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND WEBHOOK (existing — outbound call completion) ──\n if (target === \"bland\") {\n const authHeader = req.headers.get(\"Authorization\") || \"\";\n if (authHeader !== \"Bearer spotsend-bland-2025\") {\n return new Response(JSON.stringify({ error: \"Unauthorized\" }), {\n status: 401,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n const body = await req.text();\n console.log(\"Bland webhook received:\", body);\n return new Response(JSON.stringify({ received: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND STATUS ──\n if (target === \"bland-status\") {\n const callId = url.searchParams.get(\"call_id\") || \"\";\n const res = await fetch(\"https://api.bland.ai/v1/calls/\" + callId, {\n headers: { \"authorization\": BLAND_KEY },\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND INBOX (NEW — inbound calls → SpotSend pipeline) ──\n // POST: Bland.AI hits this when a call hangs up. We store keyed by contractor.\n // GET ?contractor_id=X: SpotSend frontend polls every 60s. Returns + clears\n // pending calls so they don't replay.\n if (target === \"bland-inbox\") {\n if (req.method === \"POST\") {\n let payload: Record = {};\n try {\n payload = await req.json();\n } catch {\n return new Response(\n JSON.stringify({ ok: false, reason: \"invalid json\" }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // contractor_id can come from a few places depending on how you set up\n // the Bland phone number's metadata.\n const meta = (payload.metadata as Record) || {};\n const lead = (meta.lead as Record) || {};\n const contractorId = (lead.contractor_id as string) ||\n (meta.contractor_id as string) ||\n \"\";\n\n if (!contractorId) {\n return new Response(\n JSON.stringify({\n ok: false,\n reason: \"no contractor_id in metadata\",\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n const transcript = (payload.transcript as string) ||\n (payload.concatenated_transcript as string) || \"\";\n const callEntry = {\n phone: (payload.from as string) ||\n (payload.phone_number as string) || \"\",\n name: (meta.caller_name as string) ||\n (payload.summary_caller_name as string) || \"\",\n address: (meta.caller_address as string) || \"\",\n city: (meta.caller_city as string) || \"\",\n summary: (payload.summary as string) || transcript.slice(0, 500),\n ts: Date.now(),\n call_id: (payload.call_id as string) || (payload.id as string) || \"\",\n };\n\n const key = `bland_inbox_${contractorId}`;\n let inbox: unknown[] = [];\n try {\n inbox = (await blob.getJSON(key)) as unknown[] || [];\n if (!Array.isArray(inbox)) inbox = [];\n } catch {\n inbox = [];\n }\n inbox.unshift(callEntry);\n // Keep last 50 entries to bound storage\n inbox = inbox.slice(0, 50);\n await blob.setJSON(key, inbox);\n\n return new Response(JSON.stringify({ ok: true, stored: 1 }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n if (req.method === \"GET\") {\n const contractorId = url.searchParams.get(\"contractor_id\") || \"\";\n if (!contractorId) {\n return new Response(JSON.stringify({ calls: [] }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n const key = `bland_inbox_${contractorId}`;\n let inbox: unknown[] = [];\n try {\n inbox = (await blob.getJSON(key)) as unknown[] || [];\n if (!Array.isArray(inbox)) inbox = [];\n } catch {\n inbox = [];\n }\n\n // Clear after delivery so SpotSend doesn't see them twice\n if (inbox.length > 0) {\n try {\n await blob.setJSON(key, []);\n } catch { /* swallow — frontend dedupes by phone too */ }\n }\n\n return new Response(JSON.stringify({ calls: inbox }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n return new Response(\n JSON.stringify({ error: \"method not allowed\" }),\n {\n status: 405,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // ── NOAA HAIL / WIND / TORNADO OVERLAY (Field Map storm-chase mode) ──\n // GET ?days=60&state=OK&types=H,W,T&minHail=1.0&minWind=50\n // Source: Iowa State Mesonet's NWS Local Storm Reports (LSR) API. Free, no key.\n //\n // Params (all optional):\n // days 1-90 (default 60) — how many days back to fetch\n // state 2-letter state code (default OK)\n // types Comma-separated of H (hail), W (wind), T (tornado). Default: H,W,T\n // minHail Minimum hail size in inches (default 1.0). Filters hail events below threshold.\n // minWind Minimum wind speed in mph (default 50). Filters wind events below threshold.\n // Tornadoes are always included regardless of magnitude when type T is requested\n // (any tornado is significant for roofing damage).\n if (target === \"noaa-hail\") {\n const days = Math.min(\n Math.max(parseInt(url.searchParams.get(\"days\") || \"60\") || 60, 1),\n 90,\n );\n const state = (url.searchParams.get(\"state\") || \"OK\")\n .toUpperCase()\n .slice(0, 2);\n\n // Parse types — only H, W, T are valid LSR codes for our purposes\n const typesParam = (url.searchParams.get(\"types\") || \"H,W,T\")\n .toUpperCase();\n const validTypes = [\"H\", \"W\", \"T\"];\n const requestedTypes = typesParam\n .split(\",\")\n .map((t) => t.trim())\n .filter((t) => validTypes.includes(t));\n const types = requestedTypes.length > 0\n ? requestedTypes\n : [\"H\", \"W\", \"T\"];\n\n // Magnitude filters\n const minHail = parseFloat(url.searchParams.get(\"minHail\") || \"1.0\") ||\n 1.0;\n const minWind = parseFloat(url.searchParams.get(\"minWind\") || \"50\") || 50;\n\n const sts = new Date(Date.now() - days * 86400000)\n .toISOString()\n .split(\"T\")[0];\n const ets = new Date().toISOString().split(\"T\")[0];\n\n // Build LSR URL with multiple type params (LSR API accepts repeated type=X)\n const typeParams = types.map((t) => `type=${t}`).join(\"&\");\n const lsrUrl =\n `https://mesonet.agron.iastate.edu/geojson/lsr.geojson?sts=${sts}T00:00&ets=${ets}T23:59&${typeParams}&state=${state}`;\n\n try {\n const upstream = await fetch(lsrUrl);\n if (!upstream.ok) {\n return new Response(\n JSON.stringify({\n events: [],\n error: \"upstream_failed\",\n status: upstream.status,\n }),\n {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n const data = await upstream.json() as {\n features?: Array<{\n properties?: Record;\n geometry?: { coordinates?: number[] };\n }>;\n };\n\n // Map raw features → SpotSend event shape, AND apply magnitude filters\n // by event type. The LSR `type` field is a single letter (H/W/T/etc)\n // matching what we requested.\n const allEvents = (data.features || []).map((f) => {\n const props = f.properties || {};\n const coords = f.geometry?.coordinates || [];\n // LSR uses lowercase `type` for the single-letter code\n const rawType = String(props.type || \"\").toUpperCase();\n const magnitudeRaw = (props.magnitude as string | number) ||\n (props.MAG as string | number) || \"\";\n const magnitudeNum = parseFloat(String(magnitudeRaw)) || 0;\n return {\n lat: coords[1],\n lng: coords[0],\n magnitude: magnitudeRaw,\n magnitudeNum, // numeric for filtering; not sent to client\n rawType, // single-letter code for filtering; not sent\n date: (props.utc_valid as string) ||\n (props.valid as string) || \"\",\n type: (props.typetext as string) || (props.type as string) ||\n \"Storm\",\n city: (props.city as string) || \"\",\n };\n }).filter((e) => e.lat && e.lng);\n\n // Apply magnitude filters per type\n const filteredEvents = allEvents.filter((e) => {\n if (e.rawType === \"H\") return e.magnitudeNum >= minHail;\n if (e.rawType === \"W\") return e.magnitudeNum >= minWind;\n if (e.rawType === \"T\") return true; // any tornado is significant\n return true; // pass through unknown types\n }).map((e) => {\n // Strip the internal-only fields before returning to client\n const { magnitudeNum: _m, rawType: _t, ...rest } = e;\n return rest;\n });\n\n return new Response(\n JSON.stringify({\n events: filteredEvents,\n source: \"iastate_mesonet\",\n days,\n state,\n types,\n minHail,\n minWind,\n count: filteredEvents.length,\n unfiltered_count: allEvents.length,\n }),\n {\n headers: {\n \"Content-Type\": \"application/json\",\n \"Cache-Control\": \"public, max-age=900\",\n ...cors,\n },\n },\n );\n } catch (e) {\n return new Response(\n JSON.stringify({ events: [], error: String(e) }),\n {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n }\n\n // ── LOB POSTCARDS (default) ──\n // Forwards the postcard create. App.jsx puts a stable idempotency string in\n // body.metadata.idempotency_key; we extract it and forward it as the actual\n // Lob `Idempotency-Key` HTTP header. Lob caches that key for 24h, so a\n // network-level retry (mid-tunnel signal loss in a contractor's truck) won't\n // create a second postcard and double-charge. The metadata field is left in\n // the body so it still shows up on the Lob dashboard as a label.\n const body = await req.text();\n let idempotencyKey = \"\";\n try {\n const parsed = JSON.parse(body);\n const k = parsed?.metadata?.idempotency_key;\n if (typeof k === \"string\" && k.length > 0 && k.length <= 256) {\n idempotencyKey = k;\n }\n } catch { /* not JSON or no metadata — fall through with no header */ }\n\n const lobHeaders: Record = {\n \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\"),\n \"Content-Type\": \"application/json\",\n };\n if (idempotencyKey) lobHeaders[\"Idempotency-Key\"] = idempotencyKey;\n\n const res = await fetch(\"https://api.lob.com/v1/postcards\", {\n method: \"POST\",\n headers: lobHeaders,\n body, // forward original unchanged\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n } catch (err) {\n return new Response(JSON.stringify({ error: (err as Error).message }), {\n status: 500,\n headers: {\n \"Content-Type\": \"application/json\",\n \"Access-Control-Allow-Origin\": \"*\",\n },\n });\n }\n}","import { blob } from \"https://esm.town/v/std/blob\";\n\nexport default async function (req: Request): Promise {\n const cors = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"POST, GET, OPTIONS\",\n \"Access-Control-Allow-Headers\":\n \"Content-Type, Authorization, x-api-key, anthropic-version\",\n };\n\n if (req.method === \"OPTIONS\") {\n return new Response(null, { headers: cors });\n }\n\n // ── KEYS FROM ENVIRONMENT ──\n const STRIPE_KEY = Deno.env.get(\"STRIPE_SECRET_KEY\") || \"\";\n const STRIPE_WEBHOOK = Deno.env.get(\"STRIPE_WEBHOOK_SECRET\") || \"\";\n const SUPABASE_URL = Deno.env.get(\"SUPABASE_URL\") ||\n \"https://pzbvvohedpgeiynqoujr.supabase.co\";\n const SUPABASE_KEY = Deno.env.get(\"SUPABASE_SERVICE_KEY\") || \"\";\n const ANTHROPIC_KEY = Deno.env.get(\"ANTHROPIC_API_KEY\") || \"\";\n const BLAND_KEY = Deno.env.get(\"BLAND_API_KEY\") || \"\";\n const LOB_KEY = Deno.env.get(\"LOB_API_KEY\") || \"\";\n const IMGBB_KEY = Deno.env.get(\"IMGBB_API_KEY\") || \"\";\n const CLOUDINARY_CLOUD = Deno.env.get(\"CLOUDINARY_CLOUD_NAME\") || \"dux8cgved\";\n const CLOUDINARY_KEY = Deno.env.get(\"CLOUDINARY_API_KEY\") ||\n \"132548556953169\";\n const CLOUDINARY_SECRET = Deno.env.get(\"CLOUDINARY_API_SECRET\") ||\n \"rOT7bs828mPHUaRU0LcFS3o3-O8\";\n\n // ── STRIPE PRICE IDs ──\n const STRIPE_PRICES = {\n platform: \"price_1TLS1sE8Fzrv1kXN8ZyBhwot\",\n mailer: \"price_1TLS4eE8Fzrv1kXNjXmul7Ie\",\n spot_bid: \"price_1TLS62E8Fzrv1kXNsvLA5tT9\",\n bulk_tagged: \"price_1TOPSxE8Fzrv1kXNj9VwfCIN\",\n };\n\n async function updateContractorProfile(\n contractorId: string,\n updates: Record,\n ) {\n if (!contractorId) return;\n await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?id=eq.${contractorId}`,\n {\n method: \"PATCH\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal\",\n },\n body: JSON.stringify(updates),\n },\n );\n }\n\n async function getContractorByCustomer(\n stripeCustomerId: string,\n ): Promise {\n const res = await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?stripe_customer_id=eq.${stripeCustomerId}&select=id`,\n {\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n },\n },\n );\n const rows = await res.json();\n return rows?.[0]?.id || null;\n }\n\n // ── USAGE EVENT LOGGING ──\n // `stripeReported` reflects whether the Stripe usage_records POST actually\n // succeeded. When false, the row is a reconciliation candidate (Lob shipped\n // but Stripe wasn't billed). Previously this was hardcoded false on every\n // insert, which made the field useless for sweeps. Default kept false so\n // call sites that don't pass it (e.g. grandfathered/no-sub paths) stay safe.\n async function logUsageEvent(\n userId: string,\n eventType: string,\n quantity: number,\n unitPrice: number,\n lobId?: string,\n stripeReported: boolean = false,\n ) {\n await fetch(`${SUPABASE_URL}/rest/v1/usage_events`, {\n method: \"POST\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal\",\n },\n body: JSON.stringify({\n user_id: userId,\n event_type: eventType,\n quantity,\n unit_price: unitPrice,\n total: quantity * unitPrice,\n lob_id: lobId || null,\n stripe_reported: stripeReported,\n }),\n });\n }\n\n // Unit price lookup per event\n function unitPriceFor(eventType: string): number {\n if (eventType === \"spot_bid_sent\") return 1.75;\n if (eventType === \"bulk_tagged_sent\") return 1.25;\n if (eventType === \"mailer_sent\") return 0.95;\n return 0;\n }\n\n try {\n const url = new URL(req.url);\n const target = url.searchParams.get(\"target\") || \"lob\";\n\n // ── STRIPE: HOSTED CHECKOUT SESSION ──\n if (target === \"stripe-checkout\") {\n const { email, userId, contractorId, successUrl, cancelUrl } = await req\n .json();\n\n const searchRes = await fetch(\n `https://api.stripe.com/v1/customers/search?query=email:'${\n encodeURIComponent(email)\n }'`,\n { headers: { \"Authorization\": `Bearer ${STRIPE_KEY}` } },\n );\n const searchData = await searchRes.json();\n let customerId = searchData?.data?.[0]?.id;\n\n if (!customerId) {\n const customerRes = await fetch(\"https://api.stripe.com/v1/customers\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n email,\n \"metadata[contractorId]\": contractorId || userId,\n \"metadata[userId]\": userId,\n }),\n });\n const customer = await customerRes.json();\n customerId = customer.id;\n }\n\n const sessionRes = await fetch(\n \"https://api.stripe.com/v1/checkout/sessions\",\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n customer: customerId,\n mode: \"subscription\",\n \"line_items[0][price]\": STRIPE_PRICES.platform,\n \"line_items[1][price]\": STRIPE_PRICES.spot_bid,\n \"line_items[2][price]\": STRIPE_PRICES.mailer,\n \"line_items[3][price]\": STRIPE_PRICES.bulk_tagged,\n client_reference_id: userId,\n success_url: successUrl || \"https://spotsend.io?billing=success\",\n cancel_url: cancelUrl || \"https://spotsend.io?billing=cancel\",\n \"metadata[contractorId]\": contractorId || userId,\n \"metadata[userId]\": userId,\n }),\n },\n );\n const session = await sessionRes.json();\n\n return new Response(\n JSON.stringify({ url: session.url, sessionId: session.id }),\n {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // ── STRIPE: CREATE CUSTOMER + SUBSCRIPTION ──\n if (target === \"stripe-create-subscription\") {\n const { email, userId, contractorId } = await req.json();\n\n const customerRes = await fetch(\"https://api.stripe.com/v1/customers\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n email,\n \"metadata[contractorId]\": contractorId,\n \"metadata[userId]\": userId,\n }),\n });\n const customer = await customerRes.json();\n if (customer.error) {\n return new Response(JSON.stringify({ error: customer.error.message }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n const subRes = await fetch(\"https://api.stripe.com/v1/subscriptions\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n customer: customer.id,\n \"items[0][price]\": STRIPE_PRICES.platform,\n \"items[1][price]\": STRIPE_PRICES.mailer,\n \"items[2][price]\": STRIPE_PRICES.spot_bid,\n \"items[3][price]\": STRIPE_PRICES.bulk_tagged,\n \"metadata[contractorId]\": contractorId,\n \"metadata[userId]\": userId,\n payment_behavior: \"default_incomplete\",\n \"expand[]\": \"latest_invoice.payment_intent\",\n }),\n });\n const subscription = await subRes.json();\n\n await updateContractorProfile(contractorId, {\n stripe_customer_id: customer.id,\n stripe_sub_id: subscription.id,\n is_active: false,\n });\n\n return new Response(\n JSON.stringify({\n customerId: customer.id,\n subscriptionId: subscription.id,\n clientSecret: subscription.latest_invoice?.payment_intent\n ?.client_secret,\n }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n // ── STRIPE: REPORT USAGE (metered billing) ──\n // Now supports three event types + graceful skip for grandfathered accounts.\n // Logs usage_events with stripe_reported reflecting whether Stripe actually\n // accepted the report (was hardcoded false before, breaking reconciliation).\n if (target === \"stripe-report-usage\") {\n const { subscriptionId, eventType, quantity, userId, lobId } = await req\n .json();\n\n const priceMap: Record = {\n mailer_sent: STRIPE_PRICES.mailer,\n spot_bid_sent: STRIPE_PRICES.spot_bid,\n bulk_tagged_sent: STRIPE_PRICES.bulk_tagged,\n };\n\n const targetPrice = priceMap[eventType];\n const unitPrice = unitPriceFor(eventType);\n\n if (!targetPrice) {\n return new Response(\n JSON.stringify({\n error: `Unknown event_type: ${eventType}`,\n known: Object.keys(priceMap),\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // No subscription → grandfathered/trial; log and skip Stripe\n if (!subscriptionId) {\n await logUsageEvent(\n userId,\n eventType,\n quantity,\n unitPrice,\n lobId,\n false,\n );\n return new Response(\n JSON.stringify({\n success: true,\n skipped_stripe: true,\n reason: \"no subscription (grandfathered or trial)\",\n }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n const subRes = await fetch(\n `https://api.stripe.com/v1/subscriptions/${subscriptionId}`,\n { headers: { \"Authorization\": `Bearer ${STRIPE_KEY}` } },\n );\n const sub = await subRes.json();\n const items = sub.items?.data || [];\n\n const item = items.find((i: Record) =>\n (i.price as Record)?.id === targetPrice\n );\n\n if (!item) {\n // Subscription exists but missing this line item — log and skip\n await logUsageEvent(\n userId,\n eventType,\n quantity,\n unitPrice,\n lobId,\n false,\n );\n return new Response(\n JSON.stringify({\n success: true,\n skipped_stripe: true,\n reason: \"subscription missing price item\",\n expected_price: targetPrice,\n }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n const usageRes = await fetch(\n `https://api.stripe.com/v1/subscription_items/${item.id}/usage_records`,\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n quantity: String(quantity),\n timestamp: String(Math.floor(Date.now() / 1000)),\n action: \"increment\",\n }),\n },\n );\n const usage = await usageRes.json();\n const stripeOk = usageRes.ok;\n\n // Log with the *actual* outcome — true means Stripe accepted it, false\n // means we have a usage_events row to reconcile later.\n await logUsageEvent(\n userId,\n eventType,\n quantity,\n unitPrice,\n lobId,\n stripeOk,\n );\n\n // Surface failures to the caller instead of always returning success:true.\n // Front-end can now show a real error toast or queue a retry.\n if (!stripeOk) {\n return new Response(\n JSON.stringify({\n success: false,\n stripe_status: usageRes.status,\n stripe_error: usage?.error?.message ||\n \"Stripe usage_records failed\",\n usage,\n }),\n {\n status: 502,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n return new Response(JSON.stringify({ success: true, usage }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── STRIPE: BILLING PORTAL ──\n if (target === \"stripe-portal\") {\n const { customerId, returnUrl } = await req.json();\n const res = await fetch(\n \"https://api.stripe.com/v1/billing_portal/sessions\",\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n customer: customerId,\n return_url: returnUrl || \"https://spotsend.io\",\n }),\n },\n );\n const session = await res.json();\n return new Response(JSON.stringify({ url: session.url }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── REQUEST ACCESS — public landing page form submission ──\n if (target === \"request-access\") {\n if (req.method !== \"POST\") {\n return new Response(JSON.stringify({ error: \"POST only\" }), {\n status: 405,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n let body: Record = {};\n try {\n body = await req.json();\n } catch {\n body = {};\n }\n\n const fullName = String(body.full_name || \"\").trim();\n const email = String(body.email || \"\").trim().toLowerCase();\n const companyName = String(body.company_name || \"\").trim();\n\n if (!fullName || !email || !companyName) {\n return new Response(\n JSON.stringify({ error: \"Missing required fields\" }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n if (!/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {\n return new Response(JSON.stringify({ error: \"Invalid email\" }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // Honeypot — bots fill this hidden field, real humans don't\n if (body.website && String(body.website).length > 0) {\n return new Response(JSON.stringify({ ok: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n const userAgent = req.headers.get(\"user-agent\") || \"\";\n const ipHeader = req.headers.get(\"x-forwarded-for\") || \"\";\n const ip = ipHeader.split(\",\")[0]?.trim() || \"\";\n\n const row = {\n full_name: fullName.slice(0, 200),\n email: email.slice(0, 200),\n phone: body.phone ? String(body.phone).trim().slice(0, 40) : null,\n company_name: companyName.slice(0, 200),\n trade: body.trade ? String(body.trade).trim().slice(0, 60) : null,\n city: body.city ? String(body.city).trim().slice(0, 100) : null,\n state: body.state ? String(body.state).trim().slice(0, 4) : null,\n why: body.why ? String(body.why).trim().slice(0, 1000) : null,\n source: body.source\n ? String(body.source).trim().slice(0, 60)\n : \"landing\",\n user_agent: userAgent.slice(0, 300),\n ip: ip.slice(0, 60),\n };\n\n const insertRes = await fetch(`${SUPABASE_URL}/rest/v1/access_requests`, {\n method: \"POST\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal\",\n },\n body: JSON.stringify(row),\n });\n\n if (!insertRes.ok) {\n const err = await insertRes.text();\n console.error(\n \"[request-access] Supabase insert failed:\",\n insertRes.status,\n err,\n );\n return new Response(\n JSON.stringify({ error: \"Couldn't save request — try again\" }),\n {\n status: 500,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // Email admin via Resend (best-effort — failure here doesn't fail the whole request)\n const RESEND_KEY = Deno.env.get(\"RESEND_API_KEY\");\n if (RESEND_KEY) {\n try {\n const adminEmail = \"joelmwood@gmail.com\";\n const escapeHtmlInline = (s: string): string =>\n String(s || \"\").replace(\n /[&<>\"']/g,\n (\n c,\n ) => ({\n \"&\": \"&\",\n \"<\": \"<\",\n \">\": \">\",\n '\"': \""\",\n \"'\": \"'\",\n }[c]!),\n );\n const html = `\n

New SpotSend access request

\n \n \n \n \n \n \n \n \n

Name	${\n escapeHtmlInline(row.full_name)\n }
Email	${escapeHtmlInline(row.email)}
Phone	${\n escapeHtmlInline(row.phone \|\| \"—\")\n }
Company	${\n escapeHtmlInline(row.company_name)\n }
Trade	${\n escapeHtmlInline(row.trade \|\| \"—\")\n }
Location	${\n escapeHtmlInline(\n [row.city, row.state].filter(Boolean).join(\", \") \|\| \"—\",\n )\n }
Why	${\n escapeHtmlInline(row.why \|\| \"—\").replace(/\\n/g, \" \")\n }

Source: ${\n escapeHtmlInline(row.source)\n } · IP: ${escapeHtmlInline(row.ip)}

\n `;\n await fetch(\"https://api.resend.com/emails\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${RESEND_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n from: \"SpotSend \",\n to: [adminEmail],\n reply_to: row.email,\n subject:\n `[SpotSend] Access request: ${row.full_name} (${row.company_name})`,\n html,\n }),\n });\n } catch (e) {\n console.error(\"[request-access] Email failed (non-blocking):\", e);\n }\n }\n\n return new Response(JSON.stringify({ ok: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── STRIPE WEBHOOK ──\n if (target === \"stripe-webhook\") {\n const payload = await req.text();\n const sig = req.headers.get(\"stripe-signature\") || \"\";\n\n if (STRIPE_WEBHOOK && sig) {\n const parts = sig.split(\",\");\n const timestamp = parts.find((p) => p.startsWith(\"t=\"))?.slice(2) || \"\";\n const sigHash = parts.find((p) => p.startsWith(\"v1=\"))?.slice(3) || \"\";\n const signedPayload = `${timestamp}.${payload}`;\n const encoder = new TextEncoder();\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(STRIPE_WEBHOOK),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const mac = await crypto.subtle.sign(\n \"HMAC\",\n key,\n encoder.encode(signedPayload),\n );\n const expected = Array.from(new Uint8Array(mac))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n if (expected !== sigHash) {\n return new Response(\"Invalid signature\", {\n status: 400,\n headers: cors,\n });\n }\n }\n\n const event = JSON.parse(payload);\n const eventType = event.type as string;\n const data = event.data?.object as Record;\n\n if (\n eventType === \"customer.subscription.created\" ||\n eventType === \"customer.subscription.updated\"\n ) {\n const contractorId = (data?.metadata as Record)\n ?.contractorId;\n const status = data?.status as string;\n await updateContractorProfile(contractorId, {\n stripe_sub_id: data?.id as string,\n is_active: status === \"active\",\n plan: \"pro\",\n });\n }\n\n if (eventType === \"checkout.session.completed\") {\n const userId = data?.client_reference_id as string;\n const customerId = data?.customer as string;\n const contractorId =\n (data?.metadata as Record)?.contractorId || userId;\n if (contractorId) {\n await updateContractorProfile(contractorId, {\n stripe_customer_id: customerId,\n is_active: true,\n plan: \"pro\",\n });\n }\n }\n\n if (eventType === \"customer.subscription.deleted\") {\n const contractorId = (data?.metadata as Record)\n ?.contractorId;\n await updateContractorProfile(contractorId, {\n stripe_sub_id: data?.id as string,\n is_active: false,\n plan: \"cancelled\",\n });\n }\n\n if (eventType === \"invoice.payment_succeeded\") {\n const customerId = data?.customer as string;\n const contractorId = await getContractorByCustomer(customerId);\n if (contractorId) {\n await updateContractorProfile(contractorId, {\n is_active: true,\n plan: \"pro\",\n });\n }\n }\n\n if (eventType === \"invoice.payment_failed\") {\n const customerId = data?.customer as string;\n const contractorId = await getContractorByCustomer(customerId);\n if (contractorId) {\n await updateContractorProfile(contractorId, { is_active: false });\n }\n }\n\n return new Response(JSON.stringify({ received: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── LOB FILE UPLOAD ──\n if (target === \"lob-upload\") {\n const { image, filename } = await req.json();\n const binary = Uint8Array.from(atob(image), (c) => c.charCodeAt(0));\n const formData = new FormData();\n const blob = new Blob([binary], { type: \"image/jpeg\" });\n formData.append(\"file\", blob, filename || \"photo.jpg\");\n formData.append(\"description\", \"SpotSend postcard photo\");\n const res = await fetch(\"https://api.lob.com/v1/uploads\", {\n method: \"POST\",\n headers: { \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\") },\n body: formData,\n });\n const data = await res.json();\n const urlOut = data?.url || data?.signed_url || null;\n return new Response(JSON.stringify({ url: urlOut }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── LOB STATUS ──\n if (target === \"lob-status\") {\n const lobId = url.searchParams.get(\"lob_id\") || \"\";\n if (!lobId || !lobId.startsWith(\"psc_\")) {\n return new Response(\n JSON.stringify({ status: \"unknown\", error: \"Invalid lob_id\" }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n try {\n const res = await fetch(`https://api.lob.com/v1/postcards/${lobId}`, {\n headers: { \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\") },\n });\n if (!res.ok) {\n return new Response(\n JSON.stringify({\n status: \"unknown\",\n lob_status_code: res.status,\n }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n const data = await res.json();\n const events = data.tracking_events || [];\n // Normalize Lob's event name for lookup. Lob returns capitalized names like\n // \"Delivered\", \"In Local Area\", \"In Transit\". Our map keys are snake_case lowercase.\n // Without normalization, EVERY status returned \"in_transit\" (the default fallback)\n // because exact-string lookup always missed.\n const latestRaw = events[events.length - 1]?.name || \"\";\n const latest = latestRaw.toLowerCase().replace(/[\\s-]+/g, \"_\");\n const statusMap: Record = {\n \"mailed\": \"in_transit\",\n \"in_transit\": \"in_transit\",\n \"in_local_area\": \"in_local_area\",\n \"processed_for_delivery\": \"in_local_area\",\n \"out_for_delivery\": \"in_local_area\",\n \"re_routed\": \"in_transit\",\n \"rerouted\": \"in_transit\",\n \"returned_to_sender\": \"returned_to_sender\",\n \"delivered\": \"delivered\",\n \"failed\": \"failed\",\n \"rendered_failed\": \"failed\",\n };\n const status = statusMap[latest] ||\n (data.expected_delivery_date ? \"in_transit\" : \"processing\");\n return new Response(\n JSON.stringify({\n status,\n expected_delivery: data.expected_delivery_date || null,\n latest_event: latestRaw || null, // return original case for diagnostic display\n events_count: events.length,\n }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n } catch (e) {\n return new Response(\n JSON.stringify({ status: \"unknown\", error: String(e) }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n }\n\n // ── IMAGE PROXY ──\n if (target === \"proxy-image\") {\n const imageUrl = url.searchParams.get(\"url\") || \"\";\n if (!imageUrl) {\n return new Response(\"No URL\", { status: 400, headers: cors });\n }\n try {\n const res = await fetch(imageUrl, {\n headers: { \"User-Agent\": \"SpotSend/1.0 Lob-Proxy\" },\n });\n const contentType = res.headers.get(\"content-type\") || \"image/jpeg\";\n const buffer = await res.arrayBuffer();\n return new Response(buffer, {\n status: 200,\n headers: {\n ...cors,\n \"Content-Type\": contentType,\n \"Cache-Control\": \"public, max-age=86400\",\n },\n });\n } catch (_e) {\n return new Response(\"Image fetch failed\", {\n status: 500,\n headers: cors,\n });\n }\n }\n\n // ── USPS EDDM ──\n if (target === \"usps\") {\n const zip = url.searchParams.get(\"zip\") || \"74105\";\n const res = await fetch(\n `https://gis.usps.com/arcgis/rest/services/EDDM/selectZIP/GPServer/routes/execute?f=json&env:outSR=4326&ZIP=${zip}&Rte_Box=R&UserName=EDDM`,\n );\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── PERMITS ──\n if (target === \"permits\") {\n const address = url.searchParams.get(\"address\") || \"\";\n const res = await fetch(\n \"https://tulsaok-energovweb.tylerhost.net/apps/selfservice/api/CSS/permit/search\",\n {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"Accept\": \"application/json\",\n \"Referer\":\n \"https://tulsaok-energovweb.tylerhost.net/apps/selfservice\",\n \"Origin\": \"https://tulsaok-energovweb.tylerhost.net\",\n },\n body: JSON.stringify({\n address,\n permitNumber: \"\",\n permitType: \"\",\n statusCode: \"\",\n dateFrom: \"\",\n dateTo: \"\",\n pageNumber: 1,\n pageSize: 10,\n sortBy: \"IssuedDate\",\n sortDesc: true,\n }),\n },\n );\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── LOB ADDRESS VERIFY ──\n if (target === \"lob-verify\") {\n const body = await req.text();\n const res = await fetch(\"https://api.lob.com/v1/us_verifications\", {\n method: \"POST\",\n headers: {\n \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\"),\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── CLOUDINARY UPLOAD ──\n if (target === \"cloudinary-upload\") {\n const { image, filename } = await req.json();\n const binary = Uint8Array.from(atob(image), (c) => c.charCodeAt(0));\n const blob = new Blob([binary], { type: \"image/jpeg\" });\n\n const timestamp = Math.floor(Date.now() / 1000).toString();\n const paramStr = `timestamp=${timestamp}`;\n const encoder = new TextEncoder();\n const msgData = encoder.encode(paramStr + CLOUDINARY_SECRET);\n const hashBuffer = await crypto.subtle.digest(\"SHA-1\", msgData);\n const signature = Array.from(new Uint8Array(hashBuffer))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n\n const formData = new FormData();\n formData.append(\"file\", blob, filename || \"spot-photo.jpg\");\n formData.append(\"api_key\", CLOUDINARY_KEY);\n formData.append(\"timestamp\", timestamp);\n formData.append(\"signature\", signature);\n\n const uploadRes = await fetch(\n `https://api.cloudinary.com/v1_1/${CLOUDINARY_CLOUD}/image/upload`,\n { method: \"POST\", body: formData },\n );\n const uploadData = await uploadRes.json();\n const urlOut = uploadData?.secure_url || null;\n return new Response(JSON.stringify({ url: urlOut }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── IMGBB UPLOAD ──\n if (target === \"imgbb\") {\n const body = await req.json();\n const formData = new FormData();\n formData.append(\"key\", IMGBB_KEY);\n formData.append(\"image\", body.image as string);\n if (body.name) formData.append(\"name\", body.name as string);\n const res = await fetch(\"https://api.imgbb.com/1/upload\", {\n method: \"POST\",\n body: formData,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── ANTHROPIC ──\n if (target === \"anthropic\") {\n const body = await req.text();\n const res = await fetch(\"https://api.anthropic.com/v1/messages\", {\n method: \"POST\",\n headers: {\n \"x-api-key\": ANTHROPIC_KEY,\n \"anthropic-version\": \"2023-06-01\",\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND CALL ──\n if (target === \"bland-call\") {\n const body = await req.text();\n const res = await fetch(\"https://api.bland.ai/v1/calls\", {\n method: \"POST\",\n headers: {\n \"authorization\": BLAND_KEY,\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND WEBHOOK (existing — outbound call completion) ──\n if (target === \"bland\") {\n const authHeader = req.headers.get(\"Authorization\") || \"\";\n if (authHeader !== \"Bearer spotsend-bland-2025\") {\n return new Response(JSON.stringify({ error: \"Unauthorized\" }), {\n status: 401,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n const body = await req.text();\n console.log(\"Bland webhook received:\", body);\n return new Response(JSON.stringify({ received: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND STATUS ──\n if (target === \"bland-status\") {\n const callId = url.searchParams.get(\"call_id\") || \"\";\n const res = await fetch(\"https://api.bland.ai/v1/calls/\" + callId, {\n headers: { \"authorization\": BLAND_KEY },\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND INBOX (NEW — inbound calls → SpotSend pipeline) ──\n // POST: Bland.AI hits this when a call hangs up. We store keyed by contractor.\n // GET ?contractor_id=X: SpotSend frontend polls every 60s. Returns + clears\n // pending calls so they don't replay.\n if (target === \"bland-inbox\") {\n if (req.method === \"POST\") {\n let payload: Record = {};\n try {\n payload = await req.json();\n } catch {\n return new Response(\n JSON.stringify({ ok: false, reason: \"invalid json\" }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // contractor_id can come from a few places depending on how you set up\n // the Bland phone number's metadata.\n const meta = (payload.metadata as Record) || {};\n const lead = (meta.lead as Record) || {};\n const contractorId = (lead.contractor_id as string) ||\n (meta.contractor_id as string) ||\n \"\";\n\n if (!contractorId) {\n return new Response(\n JSON.stringify({\n ok: false,\n reason: \"no contractor_id in metadata\",\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n const transcript = (payload.transcript as string) ||\n (payload.concatenated_transcript as string) || \"\";\n const callEntry = {\n phone: (payload.from as string) ||\n (payload.phone_number as string) || \"\",\n name: (meta.caller_name as string) ||\n (payload.summary_caller_name as string) || \"\",\n address: (meta.caller_address as string) || \"\",\n city: (meta.caller_city as string) || \"\",\n summary: (payload.summary as string) || transcript.slice(0, 500),\n ts: Date.now(),\n call_id: (payload.call_id as string) || (payload.id as string) || \"\",\n };\n\n const key = `bland_inbox_${contractorId}`;\n let inbox: unknown[] = [];\n try {\n inbox = (await blob.getJSON(key)) as unknown[] || [];\n if (!Array.isArray(inbox)) inbox = [];\n } catch {\n inbox = [];\n }\n inbox.unshift(callEntry);\n // Keep last 50 entries to bound storage\n inbox = inbox.slice(0, 50);\n await blob.setJSON(key, inbox);\n\n return new Response(JSON.stringify({ ok: true, stored: 1 }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n if (req.method === \"GET\") {\n const contractorId = url.searchParams.get(\"contractor_id\") || \"\";\n if (!contractorId) {\n return new Response(JSON.stringify({ calls: [] }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n const key = `bland_inbox_${contractorId}`;\n let inbox: unknown[] = [];\n try {\n inbox = (await blob.getJSON(key)) as unknown[] || [];\n if (!Array.isArray(inbox)) inbox = [];\n } catch {\n inbox = [];\n }\n\n // Clear after delivery so SpotSend doesn't see them twice\n if (inbox.length > 0) {\n try {\n await blob.setJSON(key, []);\n } catch { /* swallow — frontend dedupes by phone too */ }\n }\n\n return new Response(JSON.stringify({ calls: inbox }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n return new Response(\n JSON.stringify({ error: \"method not allowed\" }),\n {\n status: 405,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // ── NOAA HAIL / WIND / TORNADO OVERLAY (Field Map storm-chase mode) ──\n // GET ?days=60&state=OK&types=H,W,T&minHail=1.0&minWind=50\n // Source: Iowa State Mesonet's NWS Local Storm Reports (LSR) API. Free, no key.\n //\n // Params (all optional):\n // days 1-90 (default 60) — how many days back to fetch\n // state 2-letter state code (default OK)\n // types Comma-separated of H (hail), W (wind), T (tornado). Default: H,W,T\n // minHail Minimum hail size in inches (default 1.0). Filters hail events below threshold.\n // minWind Minimum wind speed in mph (default 50). Filters wind events below threshold.\n // Tornadoes are always included regardless of magnitude when type T is requested\n // (any tornado is significant for roofing damage).\n if (target === \"noaa-hail\") {\n const days = Math.min(\n Math.max(parseInt(url.searchParams.get(\"days\") || \"60\") || 60, 1),\n 90,\n );\n const state = (url.searchParams.get(\"state\") || \"OK\")\n .toUpperCase()\n .slice(0, 2);\n\n // Parse types — only H, W, T are valid LSR codes for our purposes\n const typesParam = (url.searchParams.get(\"types\") || \"H,W,T\")\n .toUpperCase();\n const validTypes = [\"H\", \"W\", \"T\"];\n const requestedTypes = typesParam\n .split(\",\")\n .map((t) => t.trim())\n .filter((t) => validTypes.includes(t));\n const types = requestedTypes.length > 0\n ? requestedTypes\n : [\"H\", \"W\", \"T\"];\n\n // Magnitude filters\n const minHail = parseFloat(url.searchParams.get(\"minHail\") || \"1.0\") ||\n 1.0;\n const minWind = parseFloat(url.searchParams.get(\"minWind\") || \"50\") || 50;\n\n const sts = new Date(Date.now() - days * 86400000)\n .toISOString()\n .split(\"T\")[0];\n const ets = new Date().toISOString().split(\"T\")[0];\n\n // Build LSR URL with multiple type params (LSR API accepts repeated type=X)\n const typeParams = types.map((t) => `type=${t}`).join(\"&\");\n const lsrUrl =\n `https://mesonet.agron.iastate.edu/geojson/lsr.geojson?sts=${sts}T00:00&ets=${ets}T23:59&${typeParams}&state=${state}`;\n\n try {\n const upstream = await fetch(lsrUrl);\n if (!upstream.ok) {\n return new Response(\n JSON.stringify({\n events: [],\n error: \"upstream_failed\",\n status: upstream.status,\n }),\n {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n const data = await upstream.json() as {\n features?: Array<{\n properties?: Record;\n geometry?: { coordinates?: number[] };\n }>;\n };\n\n // Map raw features → SpotSend event shape, AND apply magnitude filters\n // by event type. The LSR `type` field is a single letter (H/W/T/etc)\n // matching what we requested.\n const allEvents = (data.features || []).map((f) => {\n const props = f.properties || {};\n const coords = f.geometry?.coordinates || [];\n // LSR uses lowercase `type` for the single-letter code\n const rawType = String(props.type || \"\").toUpperCase();\n const magnitudeRaw = (props.magnitude as string | number) ||\n (props.MAG as string | number) || \"\";\n const magnitudeNum = parseFloat(String(magnitudeRaw)) || 0;\n return {\n lat: coords[1],\n lng: coords[0],\n magnitude: magnitudeRaw,\n magnitudeNum, // numeric for filtering; not sent to client\n rawType, // single-letter code for filtering; not sent\n date: (props.utc_valid as string) ||\n (props.valid as string) || \"\",\n type: (props.typetext as string) || (props.type as string) ||\n \"Storm\",\n city: (props.city as string) || \"\",\n };\n }).filter((e) => e.lat && e.lng);\n\n // Apply magnitude filters per type\n const filteredEvents = allEvents.filter((e) => {\n if (e.rawType === \"H\") return e.magnitudeNum >= minHail;\n if (e.rawType === \"W\") return e.magnitudeNum >= minWind;\n if (e.rawType === \"T\") return true; // any tornado is significant\n return true; // pass through unknown types\n }).map((e) => {\n // Strip the internal-only fields before returning to client\n const { magnitudeNum: _m, rawType: _t, ...rest } = e;\n return rest;\n });\n\n return new Response(\n JSON.stringify({\n events: filteredEvents,\n source: \"iastate_mesonet\",\n days,\n state,\n types,\n minHail,\n minWind,\n count: filteredEvents.length,\n unfiltered_count: allEvents.length,\n }),\n {\n headers: {\n \"Content-Type\": \"application/json\",\n \"Cache-Control\": \"public, max-age=900\",\n ...cors,\n },\n },\n );\n } catch (e) {\n return new Response(\n JSON.stringify({ events: [], error: String(e) }),\n {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n }\n\n // ─────────────────────────────────────────────\n // TWILIO CALL CAPTURE — Phase 1: provision, forward, log\n // ─────────────────────────────────────────────\n // Endpoints:\n // POST ?target=twilio-provision {contractorId, city, state, ownerName, personalPhone}\n // Buys a local Twilio number, configures voice webhook,\n // updates contractor_profiles. Returns {phoneNumber, phoneSid}.\n // POST ?target=twilio-release {contractorId}\n // Releases the contractor's Twilio number, clears DB columns.\n // POST ?target=twilio-voice Hit by Twilio when a call comes in to a SpotSend number.\n // Returns TwiML that s the contractor's personal phone.\n // POST ?target=twilio-call-status Hit by Twilio when the call completes. Logs to inbound_calls.\n\n const TWILIO_ACCOUNT_SID = Deno.env.get(\"TWILIO_ACCOUNT_SID\") || \"\";\n const TWILIO_AUTH_TOKEN = Deno.env.get(\"TWILIO_AUTH_TOKEN\") || \"\";\n const TWILIO_AUTH_HEADER = \"Basic \" +\n btoa(`${TWILIO_ACCOUNT_SID}:${TWILIO_AUTH_TOKEN}`);\n const PROXY_BASE_URL = `https://${\n req.headers.get(\"host\") ||\n \"joelmwood--caf3509a369b11f190f942b51c65c3df.web.val.run\"\n }`;\n\n if (target === \"twilio-provision\") {\n if (!TWILIO_ACCOUNT_SID || !TWILIO_AUTH_TOKEN) {\n return new Response(\n JSON.stringify({\n error: \"Twilio credentials not configured on server\",\n }),\n {\n status: 500,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n const { contractorId, city, state, personalPhone } = await req.json();\n if (!contractorId) {\n return new Response(JSON.stringify({ error: \"Missing contractorId\" }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n if (!personalPhone) {\n return new Response(\n JSON.stringify({\n error:\n \"Contractor has no personal phone — fill profile in Settings first\",\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n if (!city && !state) {\n return new Response(\n JSON.stringify({\n error:\n \"Need at least city or state on profile to find a local number\",\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // Step 1: Search for an available local number using Twilio's number lookup.\n // We pass inLocality and inRegion so Twilio finds any local number in the\n // contractor's city — handles cities with multiple area codes (Dallas 214/469/972).\n // VoiceEnabled=true ensures we only get numbers that can receive calls.\n const searchParams = new URLSearchParams({\n VoiceEnabled: \"true\",\n SmsEnabled: \"true\",\n });\n if (city) searchParams.set(\"InLocality\", city);\n if (state) searchParams.set(\"InRegion\", state);\n // Limit results — we only need one\n searchParams.set(\"PageSize\", \"5\");\n\n const searchUrl =\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/AvailablePhoneNumbers/US/Local.json?${searchParams}`;\n const searchRes = await fetch(searchUrl, {\n headers: { \"Authorization\": TWILIO_AUTH_HEADER },\n });\n\n if (!searchRes.ok) {\n const err = await searchRes.text();\n console.error(\n \"[twilio-provision] search failed:\",\n searchRes.status,\n err,\n );\n return new Response(\n JSON.stringify({\n error: \"Twilio search failed\",\n status: searchRes.status,\n detail: err,\n }),\n {\n status: 502,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n const searchData = await searchRes.json();\n const candidates = searchData?.available_phone_numbers || [];\n\n // Fallback: if no numbers in the contractor's locality, try just the region (state).\n // Some smaller cities have no available local inventory; state-level usually works.\n let chosenNumber = candidates[0]?.phone_number;\n if (!chosenNumber && city && state) {\n const fallbackParams = new URLSearchParams({\n VoiceEnabled: \"true\",\n SmsEnabled: \"true\",\n InRegion: state,\n PageSize: \"5\",\n });\n const fbRes = await fetch(\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/AvailablePhoneNumbers/US/Local.json?${fallbackParams}`,\n { headers: { \"Authorization\": TWILIO_AUTH_HEADER } },\n );\n if (fbRes.ok) {\n const fbData = await fbRes.json();\n chosenNumber = fbData?.available_phone_numbers?.[0]?.phone_number;\n }\n }\n\n if (!chosenNumber) {\n return new Response(\n JSON.stringify({\n error:\n \"No local Twilio numbers available — try again or contact support\",\n }),\n {\n status: 503,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // Step 2: Purchase the number with our voice webhook + status callback wired up.\n const voiceUrl =\n `${PROXY_BASE_URL}/?target=twilio-voice&contractor_id=${contractorId}`;\n const statusUrl =\n `${PROXY_BASE_URL}/?target=twilio-call-status&contractor_id=${contractorId}`;\n const purchaseBody = new URLSearchParams({\n PhoneNumber: chosenNumber,\n VoiceUrl: voiceUrl,\n VoiceMethod: \"POST\",\n StatusCallback: statusUrl,\n StatusCallbackMethod: \"POST\",\n FriendlyName: `SpotSend - ${contractorId.slice(0, 8)}`,\n });\n\n const purchaseRes = await fetch(\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/IncomingPhoneNumbers.json`,\n {\n method: \"POST\",\n headers: {\n \"Authorization\": TWILIO_AUTH_HEADER,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: purchaseBody,\n },\n );\n\n if (!purchaseRes.ok) {\n const err = await purchaseRes.text();\n console.error(\n \"[twilio-provision] purchase failed:\",\n purchaseRes.status,\n err,\n );\n return new Response(\n JSON.stringify({\n error: \"Twilio purchase failed\",\n status: purchaseRes.status,\n detail: err,\n }),\n {\n status: 502,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n const purchased = await purchaseRes.json();\n const phoneNumber = purchased.phone_number;\n const phoneSid = purchased.sid;\n\n // Step 3: Persist on contractor_profiles row.\n await updateContractorProfile(contractorId, {\n twilio_phone_number: phoneNumber,\n twilio_phone_sid: phoneSid,\n twilio_enabled: true,\n });\n\n console.log(\n `[twilio-provision] ${contractorId} → ${phoneNumber} (${phoneSid})`,\n );\n return new Response(\n JSON.stringify({ ok: true, phoneNumber, phoneSid }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n if (target === \"twilio-release\") {\n const { contractorId } = await req.json();\n if (!contractorId) {\n return new Response(JSON.stringify({ error: \"Missing contractorId\" }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // Look up the SID from the contractor's profile.\n const lookupRes = await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?id=eq.${contractorId}&select=twilio_phone_sid,twilio_phone_number`,\n {\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n },\n },\n );\n const profileRows = await lookupRes.json();\n const phoneSid = profileRows?.[0]?.twilio_phone_sid;\n\n if (phoneSid) {\n // Release on Twilio. We don't fail hard if Twilio errors — clearing the DB\n // columns is more important so the contractor can re-enable. If a stuck SID\n // causes monthly billing, admin can clean up via Twilio dashboard.\n const releaseRes = await fetch(\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/IncomingPhoneNumbers/${phoneSid}.json`,\n {\n method: \"DELETE\",\n headers: { \"Authorization\": TWILIO_AUTH_HEADER },\n },\n );\n if (!releaseRes.ok) {\n console.error(\n \"[twilio-release] Twilio DELETE failed:\",\n releaseRes.status,\n await releaseRes.text(),\n );\n // Continue to clear DB anyway\n }\n }\n\n await updateContractorProfile(contractorId, {\n twilio_phone_number: null,\n twilio_phone_sid: null,\n twilio_enabled: false,\n });\n\n console.log(\n `[twilio-release] ${contractorId} → released ${phoneSid || \"(no sid)\"}`,\n );\n return new Response(JSON.stringify({ ok: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n if (target === \"twilio-voice\") {\n // Twilio hits this when a call comes in to a SpotSend number.\n // We respond with TwiML that forwards the call to the contractor's personal phone.\n // If they don't answer in 25 seconds, the call is hung up (Phase 2 will route to voicemail).\n const contractorId = url.searchParams.get(\"contractor_id\") || \"\";\n let personalPhone = \"\";\n let companyName = \"your contractor\";\n\n if (contractorId) {\n const lookupRes = await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?id=eq.${contractorId}&select=phone,company_name`,\n {\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n },\n },\n );\n const rows = await lookupRes.json();\n personalPhone = rows?.[0]?.phone || \"\";\n companyName = rows?.[0]?.company_name || companyName;\n }\n\n // Strip any non-digits and ensure E.164 format. Twilio Dial wants +1XXXXXXXXXX for US.\n const digitsOnly = personalPhone.replace(/\\D/g, \"\");\n const dialNumber = digitsOnly.length === 10\n ? `+1${digitsOnly}`\n : (digitsOnly.length === 11 ? `+${digitsOnly}` : \"\");\n\n let twiml: string;\n if (!dialNumber) {\n // No phone on profile — politely tell the caller to leave a message later.\n // (Voicemail is Phase 2; for now we just hang up gracefully.)\n twiml = `\n\n Sorry, ${companyName} can not take calls right now. Please try again later.\n \n`;\n } else {\n // Dial the contractor's personal phone with timeout + record + caller ID passthrough.\n // callerId=\"\" means \"use the original caller's number\" so the contractor's phone\n // shows the actual homeowner's number, not the Twilio number. record=\"record-from-answer\"\n // captures the conversation server-side for Phase 2 transcription.\n twiml = `\n\n \n ${dialNumber}\n \n`;\n }\n\n return new Response(twiml, {\n status: 200,\n headers: { \"Content-Type\": \"text/xml\", ...cors },\n });\n }\n\n if (target === \"twilio-call-status\") {\n // Twilio fires this when a call ends. We log the call to inbound_calls.\n // Form-encoded body, not JSON.\n const contractorId = url.searchParams.get(\"contractor_id\") || \"\";\n const formData = await req.formData();\n const callSid = String(formData.get(\"CallSid\") || \"\");\n const fromNum = String(formData.get(\"From\") || \"\");\n const toNum = String(formData.get(\"To\") || \"\");\n const status = String(formData.get(\"CallStatus\") || \"\");\n const duration = parseInt(String(formData.get(\"CallDuration\") || \"0\")) ||\n 0;\n // \"completed\" with non-zero duration means contractor answered.\n // \"no-answer\", \"busy\", \"failed\", \"canceled\" mean the contractor missed it.\n const answered = status === \"completed\" && duration > 0;\n\n if (!contractorId || !callSid) {\n console.warn(\"[twilio-call-status] missing contractor_id or callSid\", {\n contractorId,\n callSid,\n });\n return new Response(\"\", { status: 200 });\n }\n\n // Insert into inbound_calls. Use upsert-by-twilio_sid to handle duplicate webhook fires.\n // PostgREST `Prefer: resolution=merge-duplicates` does upsert when there's a unique key.\n const insertRes = await fetch(`${SUPABASE_URL}/rest/v1/inbound_calls`, {\n method: \"POST\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal,resolution=merge-duplicates\",\n },\n body: JSON.stringify({\n user_id: contractorId,\n twilio_sid: callSid,\n from_number: fromNum,\n to_number: toNum,\n duration_sec: duration,\n answered,\n forward_status: status,\n }),\n });\n\n if (!insertRes.ok) {\n console.error(\n \"[twilio-call-status] insert failed:\",\n insertRes.status,\n await insertRes.text(),\n );\n } else {\n console.log(\n `[twilio-call-status] ${contractorId} ${fromNum} → ${status} ${duration}s`,\n );\n }\n\n return new Response(\"\", { status: 200 });\n }\n\n // ── LOB POSTCARDS (default) ──\n // Forwards the postcard create. App.jsx puts a stable idempotency string in\n // body.metadata.idempotency_key; we extract it and forward it as the actual\n // Lob `Idempotency-Key` HTTP header. Lob caches that key for 24h, so a\n // network-level retry (mid-tunnel signal loss in a contractor's truck) won't\n // create a second postcard and double-charge. The metadata field is left in\n // the body so it still shows up on the Lob dashboard as a label.\n const body = await req.text();\n let idempotencyKey = \"\";\n try {\n const parsed = JSON.parse(body);\n const k = parsed?.metadata?.idempotency_key;\n if (typeof k === \"string\" && k.length > 0 && k.length <= 256) {\n idempotencyKey = k;\n }\n } catch { /* not JSON or no metadata — fall through with no header */ }\n\n const lobHeaders: Record = {\n \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\"),\n \"Content-Type\": \"application/json\",\n };\n if (idempotencyKey) lobHeaders[\"Idempotency-Key\"] = idempotencyKey;\n\n const res = await fetch(\"https://api.lob.com/v1/postcards\", {\n method: \"POST\",\n headers: lobHeaders,\n body, // forward original unchanged\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n } catch (err) {\n return new Response(JSON.stringify({ error: (err as Error).message }), {\n status: 500,\n headers: {\n \"Content-Type\": \"application/json\",\n \"Access-Control-Allow-Origin\": \"*\",\n },\n });\n }\n}","createdAt",["D",1777494830390],"branchVersion","branchId","caf0e148-369b-11f1-90f9-42b51c65c3df","id","caefca24-369b-11f1-90f9-42b51c65c3df","spotsend",["D",1776017817773],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","e62ec099-51e2-4bfb-9f8c-fec4e5c27de6","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019d6a29-db42-727b-8046-28bb6f362a0e","tursoName","caefca24369b11f190f942b51c65c3df","tursoHostname","caefca24369b11f190f942b51c65c3df-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789499469860],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_97":96,"_104":100},"org",{"_97":96,"_98":-5,"_99":100,"_18":54,"_101":102,"_103":25},"branch",{"_13":86,"_32":87,"_43":42,"_88":44,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":45,"_95":96},"isOwned",21,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","joelmwood","handle","displayName","avatar","","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":152,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":-5,"_53":-5,"_18":54,"_55":-5,"_56":25,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":153,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":154,"_81":155,"_83":156,"_85":25},"tree",[147],"files",[147],"counts",{"_135":60,"_136":137,"_138":60,"_139":140,"_141":142},"contents",[127],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":128,"_32":28,"_30":31,"_129":-5,"_41":42,"_40":14,"_130":25,"_38":131,"_13":132,"_33":34,"_35":37,"_24":25,"_133":-5,"_27":134},"bb1405f8-440a-11f1-949e-42b51c65c3df","parentId","latest",["D",1777494830390],18,"label",[28],"pulls","branches",1,"forks","envVars",{"_143":145,"_146":60},"connections",{"_143":60,"_144":60},"count","unfilledCount",10,"emptyCount",{"_43":128,"_32":28,"_30":31,"_129":-5,"_41":42,"_40":14,"_130":25,"_38":148,"_13":132,"_33":34,"_35":37,"_24":25,"_133":-5,"_149":150,"_27":151},["D",1777494830390],"children",[],[28],["D",1776017817773],["D",1789499469860],{"_97":96,"_104":100},{"_97":96,"_98":-5,"_99":100,"_18":54,"_101":102,"_103":25},{"_13":86,"_32":87,"_43":42,"_88":44,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":45,"_95":96},"ctx",{"_79":-5,"_124":190,"_191":192,"_193":194,"_195":25,"_196":25,"_197":25,"_198":122,"_199":-5,"_200":-7,"_201":-7,"_202":60,"_203":25,"_204":25,"_205":-5,"_206":25,"_207":25,"_208":25,"_209":-5},"ENV",{"_161":162,"_163":164,"_165":87,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v19