[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_156":157,"_158":159},"routes/_app.x.$handle.$name",{"_96":95,"_32":45,"_104":86,"_27":99,"_13":14,"_105":-5,"_11":106,"_107":108,"_109":110,"_111":112,"_113":114,"_20":-5,"_115":-5,"_116":-5,"_117":25,"_118":119,"_120":121,"_122":-5,"_123":-5,"_124":125},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":-5,"_53":-5,"_18":54,"_55":-5,"_56":25,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":25},"version",21,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","caf3509a-369b-11f1-90f9-42b51c65c3df","name","fileType","http","content","import { blob } from \"https://esm.town/v/std/blob\";\n\nexport default async function (req: Request): Promise {\n const cors = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"POST, GET, OPTIONS\",\n \"Access-Control-Allow-Headers\":\n \"Content-Type, Authorization, x-api-key, anthropic-version\",\n };\n\n if (req.method === \"OPTIONS\") {\n return new Response(null, { headers: cors });\n }\n\n // ── KEYS FROM ENVIRONMENT ──\n const STRIPE_KEY = Deno.env.get(\"STRIPE_SECRET_KEY\") || \"\";\n const STRIPE_WEBHOOK = Deno.env.get(\"STRIPE_WEBHOOK_SECRET\") || \"\";\n const SUPABASE_URL = Deno.env.get(\"SUPABASE_URL\") ||\n \"https://pzbvvohedpgeiynqoujr.supabase.co\";\n const SUPABASE_KEY = Deno.env.get(\"SUPABASE_SERVICE_KEY\") || \"\";\n const ANTHROPIC_KEY = Deno.env.get(\"ANTHROPIC_API_KEY\") || \"\";\n const BLAND_KEY = Deno.env.get(\"BLAND_API_KEY\") || \"\";\n const LOB_KEY = Deno.env.get(\"LOB_API_KEY\") || \"\";\n const IMGBB_KEY = Deno.env.get(\"IMGBB_API_KEY\") || \"\";\n const CLOUDINARY_CLOUD = Deno.env.get(\"CLOUDINARY_CLOUD_NAME\") || \"dux8cgved\";\n const CLOUDINARY_KEY = Deno.env.get(\"CLOUDINARY_API_KEY\") ||\n \"132548556953169\";\n const CLOUDINARY_SECRET = Deno.env.get(\"CLOUDINARY_API_SECRET\") ||\n \"rOT7bs828mPHUaRU0LcFS3o3-O8\";\n\n // ── STRIPE PRICE IDs ──\n const STRIPE_PRICES = {\n platform: \"price_1TLS1sE8Fzrv1kXN8ZyBhwot\",\n mailer: \"price_1TLS4eE8Fzrv1kXNjXmul7Ie\",\n spot_bid: \"price_1TLS62E8Fzrv1kXNsvLA5tT9\",\n bulk_tagged: \"price_1TOPSxE8Fzrv1kXNj9VwfCIN\",\n };\n\n async function updateContractorProfile(\n contractorId: string,\n updates: Record,\n ) {\n if (!contractorId) return;\n await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?id=eq.${contractorId}`,\n {\n method: \"PATCH\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal\",\n },\n body: JSON.stringify(updates),\n },\n );\n }\n\n async function getContractorByCustomer(\n stripeCustomerId: string,\n ): Promise {\n const res = await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?stripe_customer_id=eq.${stripeCustomerId}&select=id`,\n {\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n },\n },\n );\n const rows = await res.json();\n return rows?.[0]?.id || null;\n }\n\n // ── USAGE EVENT LOGGING ──\n // `stripeReported` reflects whether the Stripe usage_records POST actually\n // succeeded. When false, the row is a reconciliation candidate (Lob shipped\n // but Stripe wasn't billed). Previously this was hardcoded false on every\n // insert, which made the field useless for sweeps. Default kept false so\n // call sites that don't pass it (e.g. grandfathered/no-sub paths) stay safe.\n async function logUsageEvent(\n userId: string,\n eventType: string,\n quantity: number,\n unitPrice: number,\n lobId?: string,\n stripeReported: boolean = false,\n ) {\n await fetch(`${SUPABASE_URL}/rest/v1/usage_events`, {\n method: \"POST\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal\",\n },\n body: JSON.stringify({\n user_id: userId,\n event_type: eventType,\n quantity,\n unit_price: unitPrice,\n total: quantity * unitPrice,\n lob_id: lobId || null,\n stripe_reported: stripeReported,\n }),\n });\n }\n\n // Unit price lookup per event\n function unitPriceFor(eventType: string): number {\n if (eventType === \"spot_bid_sent\") return 1.75;\n if (eventType === \"bulk_tagged_sent\") return 1.25;\n if (eventType === \"mailer_sent\") return 0.95;\n return 0;\n }\n\n try {\n const url = new URL(req.url);\n const target = url.searchParams.get(\"target\") || \"lob\";\n\n // ── STRIPE: HOSTED CHECKOUT SESSION ──\n if (target === \"stripe-checkout\") {\n const { email, userId, contractorId, successUrl, cancelUrl } = await req\n .json();\n\n const searchRes = await fetch(\n `https://api.stripe.com/v1/customers/search?query=email:'${\n encodeURIComponent(email)\n }'`,\n { headers: { \"Authorization\": `Bearer ${STRIPE_KEY}` } },\n );\n const searchData = await searchRes.json();\n let customerId = searchData?.data?.[0]?.id;\n\n if (!customerId) {\n const customerRes = await fetch(\"https://api.stripe.com/v1/customers\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n email,\n \"metadata[contractorId]\": contractorId || userId,\n \"metadata[userId]\": userId,\n }),\n });\n const customer = await customerRes.json();\n customerId = customer.id;\n }\n\n const sessionRes = await fetch(\n \"https://api.stripe.com/v1/checkout/sessions\",\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n customer: customerId,\n mode: \"subscription\",\n \"line_items[0][price]\": STRIPE_PRICES.platform,\n \"line_items[1][price]\": STRIPE_PRICES.spot_bid,\n \"line_items[2][price]\": STRIPE_PRICES.mailer,\n \"line_items[3][price]\": STRIPE_PRICES.bulk_tagged,\n client_reference_id: userId,\n success_url: successUrl || \"https://spotsend.io?billing=success\",\n cancel_url: cancelUrl || \"https://spotsend.io?billing=cancel\",\n \"metadata[contractorId]\": contractorId || userId,\n \"metadata[userId]\": userId,\n }),\n },\n );\n const session = await sessionRes.json();\n\n return new Response(\n JSON.stringify({ url: session.url, sessionId: session.id }),\n {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // ── STRIPE: CREATE CUSTOMER + SUBSCRIPTION ──\n if (target === \"stripe-create-subscription\") {\n const { email, userId, contractorId } = await req.json();\n\n const customerRes = await fetch(\"https://api.stripe.com/v1/customers\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n email,\n \"metadata[contractorId]\": contractorId,\n \"metadata[userId]\": userId,\n }),\n });\n const customer = await customerRes.json();\n if (customer.error) {\n return new Response(JSON.stringify({ error: customer.error.message }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n const subRes = await fetch(\"https://api.stripe.com/v1/subscriptions\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n customer: customer.id,\n \"items[0][price]\": STRIPE_PRICES.platform,\n \"items[1][price]\": STRIPE_PRICES.mailer,\n \"items[2][price]\": STRIPE_PRICES.spot_bid,\n \"items[3][price]\": STRIPE_PRICES.bulk_tagged,\n \"metadata[contractorId]\": contractorId,\n \"metadata[userId]\": userId,\n payment_behavior: \"default_incomplete\",\n \"expand[]\": \"latest_invoice.payment_intent\",\n }),\n });\n const subscription = await subRes.json();\n\n await updateContractorProfile(contractorId, {\n stripe_customer_id: customer.id,\n stripe_sub_id: subscription.id,\n is_active: false,\n });\n\n return new Response(\n JSON.stringify({\n customerId: customer.id,\n subscriptionId: subscription.id,\n clientSecret: subscription.latest_invoice?.payment_intent\n ?.client_secret,\n }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n // ── STRIPE: REPORT USAGE (metered billing) ──\n // Now supports three event types + graceful skip for grandfathered accounts.\n // Logs usage_events with stripe_reported reflecting whether Stripe actually\n // accepted the report (was hardcoded false before, breaking reconciliation).\n if (target === \"stripe-report-usage\") {\n const { subscriptionId, eventType, quantity, userId, lobId } = await req\n .json();\n\n const priceMap: Record = {\n mailer_sent: STRIPE_PRICES.mailer,\n spot_bid_sent: STRIPE_PRICES.spot_bid,\n bulk_tagged_sent: STRIPE_PRICES.bulk_tagged,\n };\n\n const targetPrice = priceMap[eventType];\n const unitPrice = unitPriceFor(eventType);\n\n if (!targetPrice) {\n return new Response(\n JSON.stringify({\n error: `Unknown event_type: ${eventType}`,\n known: Object.keys(priceMap),\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // No subscription → grandfathered/trial; log and skip Stripe\n if (!subscriptionId) {\n await logUsageEvent(\n userId,\n eventType,\n quantity,\n unitPrice,\n lobId,\n false,\n );\n return new Response(\n JSON.stringify({\n success: true,\n skipped_stripe: true,\n reason: \"no subscription (grandfathered or trial)\",\n }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n const subRes = await fetch(\n `https://api.stripe.com/v1/subscriptions/${subscriptionId}`,\n { headers: { \"Authorization\": `Bearer ${STRIPE_KEY}` } },\n );\n const sub = await subRes.json();\n const items = sub.items?.data || [];\n\n const item = items.find((i: Record) =>\n (i.price as Record)?.id === targetPrice\n );\n\n if (!item) {\n // Subscription exists but missing this line item — log and skip\n await logUsageEvent(\n userId,\n eventType,\n quantity,\n unitPrice,\n lobId,\n false,\n );\n return new Response(\n JSON.stringify({\n success: true,\n skipped_stripe: true,\n reason: \"subscription missing price item\",\n expected_price: targetPrice,\n }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n const usageRes = await fetch(\n `https://api.stripe.com/v1/subscription_items/${item.id}/usage_records`,\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n quantity: String(quantity),\n timestamp: String(Math.floor(Date.now() / 1000)),\n action: \"increment\",\n }),\n },\n );\n const usage = await usageRes.json();\n const stripeOk = usageRes.ok;\n\n // Log with the *actual* outcome — true means Stripe accepted it, false\n // means we have a usage_events row to reconcile later.\n await logUsageEvent(\n userId,\n eventType,\n quantity,\n unitPrice,\n lobId,\n stripeOk,\n );\n\n // Surface failures to the caller instead of always returning success:true.\n // Front-end can now show a real error toast or queue a retry.\n if (!stripeOk) {\n return new Response(\n JSON.stringify({\n success: false,\n stripe_status: usageRes.status,\n stripe_error: usage?.error?.message ||\n \"Stripe usage_records failed\",\n usage,\n }),\n {\n status: 502,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n return new Response(JSON.stringify({ success: true, usage }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── STRIPE: BILLING PORTAL ──\n if (target === \"stripe-portal\") {\n const { customerId, returnUrl } = await req.json();\n const res = await fetch(\n \"https://api.stripe.com/v1/billing_portal/sessions\",\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n customer: customerId,\n return_url: returnUrl || \"https://spotsend.io\",\n }),\n },\n );\n const session = await res.json();\n return new Response(JSON.stringify({ url: session.url }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── REQUEST ACCESS — public landing page form submission ──\n if (target === \"request-access\") {\n if (req.method !== \"POST\") {\n return new Response(JSON.stringify({ error: \"POST only\" }), {\n status: 405,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n let body: Record = {};\n try {\n body = await req.json();\n } catch {\n body = {};\n }\n\n const fullName = String(body.full_name || \"\").trim();\n const email = String(body.email || \"\").trim().toLowerCase();\n const companyName = String(body.company_name || \"\").trim();\n\n if (!fullName || !email || !companyName) {\n return new Response(\n JSON.stringify({ error: \"Missing required fields\" }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n if (!/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {\n return new Response(JSON.stringify({ error: \"Invalid email\" }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // Honeypot — bots fill this hidden field, real humans don't\n if (body.website && String(body.website).length > 0) {\n return new Response(JSON.stringify({ ok: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n const userAgent = req.headers.get(\"user-agent\") || \"\";\n const ipHeader = req.headers.get(\"x-forwarded-for\") || \"\";\n const ip = ipHeader.split(\",\")[0]?.trim() || \"\";\n\n const row = {\n full_name: fullName.slice(0, 200),\n email: email.slice(0, 200),\n phone: body.phone ? String(body.phone).trim().slice(0, 40) : null,\n company_name: companyName.slice(0, 200),\n trade: body.trade ? String(body.trade).trim().slice(0, 60) : null,\n city: body.city ? String(body.city).trim().slice(0, 100) : null,\n state: body.state ? String(body.state).trim().slice(0, 4) : null,\n why: body.why ? String(body.why).trim().slice(0, 1000) : null,\n source: body.source\n ? String(body.source).trim().slice(0, 60)\n : \"landing\",\n user_agent: userAgent.slice(0, 300),\n ip: ip.slice(0, 60),\n };\n\n const insertRes = await fetch(`${SUPABASE_URL}/rest/v1/access_requests`, {\n method: \"POST\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal\",\n },\n body: JSON.stringify(row),\n });\n\n if (!insertRes.ok) {\n const err = await insertRes.text();\n console.error(\n \"[request-access] Supabase insert failed:\",\n insertRes.status,\n err,\n );\n return new Response(\n JSON.stringify({ error: \"Couldn't save request — try again\" }),\n {\n status: 500,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // Email admin via Resend (best-effort — failure here doesn't fail the whole request)\n const RESEND_KEY = Deno.env.get(\"RESEND_API_KEY\");\n if (RESEND_KEY) {\n try {\n const adminEmail = \"joelmwood@gmail.com\";\n const escapeHtmlInline = (s: string): string =>\n String(s || \"\").replace(\n /[&<>\"']/g,\n (\n c,\n ) => ({\n \"&\": \"&\",\n \"<\": \"<\",\n \">\": \">\",\n '\"': \""\",\n \"'\": \"'\",\n }[c]!),\n );\n const html = `\n

New SpotSend access request

\n \n \n \n \n \n \n \n \n

Name	${\n escapeHtmlInline(row.full_name)\n }
Email	${escapeHtmlInline(row.email)}
Phone	${\n escapeHtmlInline(row.phone \|\| \"—\")\n }
Company	${\n escapeHtmlInline(row.company_name)\n }
Trade	${\n escapeHtmlInline(row.trade \|\| \"—\")\n }
Location	${\n escapeHtmlInline(\n [row.city, row.state].filter(Boolean).join(\", \") \|\| \"—\",\n )\n }
Why	${\n escapeHtmlInline(row.why \|\| \"—\").replace(/\\n/g, \" \")\n }

Source: ${\n escapeHtmlInline(row.source)\n } · IP: ${escapeHtmlInline(row.ip)}

\n `;\n await fetch(\"https://api.resend.com/emails\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${RESEND_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n from: \"SpotSend \",\n to: [adminEmail],\n reply_to: row.email,\n subject:\n `[SpotSend] Access request: ${row.full_name} (${row.company_name})`,\n html,\n }),\n });\n } catch (e) {\n console.error(\"[request-access] Email failed (non-blocking):\", e);\n }\n }\n\n return new Response(JSON.stringify({ ok: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── STRIPE WEBHOOK ──\n if (target === \"stripe-webhook\") {\n const payload = await req.text();\n const sig = req.headers.get(\"stripe-signature\") || \"\";\n\n if (STRIPE_WEBHOOK && sig) {\n const parts = sig.split(\",\");\n const timestamp = parts.find((p) => p.startsWith(\"t=\"))?.slice(2) || \"\";\n const sigHash = parts.find((p) => p.startsWith(\"v1=\"))?.slice(3) || \"\";\n const signedPayload = `${timestamp}.${payload}`;\n const encoder = new TextEncoder();\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(STRIPE_WEBHOOK),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const mac = await crypto.subtle.sign(\n \"HMAC\",\n key,\n encoder.encode(signedPayload),\n );\n const expected = Array.from(new Uint8Array(mac))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n if (expected !== sigHash) {\n return new Response(\"Invalid signature\", {\n status: 400,\n headers: cors,\n });\n }\n }\n\n const event = JSON.parse(payload);\n const eventType = event.type as string;\n const data = event.data?.object as Record;\n\n if (\n eventType === \"customer.subscription.created\" ||\n eventType === \"customer.subscription.updated\"\n ) {\n const contractorId = (data?.metadata as Record)\n ?.contractorId;\n const status = data?.status as string;\n await updateContractorProfile(contractorId, {\n stripe_sub_id: data?.id as string,\n is_active: status === \"active\",\n plan: \"pro\",\n });\n }\n\n if (eventType === \"checkout.session.completed\") {\n const userId = data?.client_reference_id as string;\n const customerId = data?.customer as string;\n const contractorId =\n (data?.metadata as Record)?.contractorId || userId;\n if (contractorId) {\n await updateContractorProfile(contractorId, {\n stripe_customer_id: customerId,\n is_active: true,\n plan: \"pro\",\n });\n }\n }\n\n if (eventType === \"customer.subscription.deleted\") {\n const contractorId = (data?.metadata as Record)\n ?.contractorId;\n await updateContractorProfile(contractorId, {\n stripe_sub_id: data?.id as string,\n is_active: false,\n plan: \"cancelled\",\n });\n }\n\n if (eventType === \"invoice.payment_succeeded\") {\n const customerId = data?.customer as string;\n const contractorId = await getContractorByCustomer(customerId);\n if (contractorId) {\n await updateContractorProfile(contractorId, {\n is_active: true,\n plan: \"pro\",\n });\n }\n }\n\n if (eventType === \"invoice.payment_failed\") {\n const customerId = data?.customer as string;\n const contractorId = await getContractorByCustomer(customerId);\n if (contractorId) {\n await updateContractorProfile(contractorId, { is_active: false });\n }\n }\n\n return new Response(JSON.stringify({ received: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── LOB FILE UPLOAD ──\n if (target === \"lob-upload\") {\n const { image, filename } = await req.json();\n const binary = Uint8Array.from(atob(image), (c) => c.charCodeAt(0));\n const formData = new FormData();\n const blob = new Blob([binary], { type: \"image/jpeg\" });\n formData.append(\"file\", blob, filename || \"photo.jpg\");\n formData.append(\"description\", \"SpotSend postcard photo\");\n const res = await fetch(\"https://api.lob.com/v1/uploads\", {\n method: \"POST\",\n headers: { \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\") },\n body: formData,\n });\n const data = await res.json();\n const urlOut = data?.url || data?.signed_url || null;\n return new Response(JSON.stringify({ url: urlOut }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── LOB STATUS ──\n if (target === \"lob-status\") {\n const lobId = url.searchParams.get(\"lob_id\") || \"\";\n if (!lobId || !lobId.startsWith(\"psc_\")) {\n return new Response(\n JSON.stringify({ status: \"unknown\", error: \"Invalid lob_id\" }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n try {\n const res = await fetch(`https://api.lob.com/v1/postcards/${lobId}`, {\n headers: { \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\") },\n });\n if (!res.ok) {\n return new Response(\n JSON.stringify({\n status: \"unknown\",\n lob_status_code: res.status,\n }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n const data = await res.json();\n const events = data.tracking_events || [];\n // Normalize Lob's event name for lookup. Lob returns capitalized names like\n // \"Delivered\", \"In Local Area\", \"In Transit\". Our map keys are snake_case lowercase.\n // Without normalization, EVERY status returned \"in_transit\" (the default fallback)\n // because exact-string lookup always missed.\n const latestRaw = events[events.length - 1]?.name || \"\";\n const latest = latestRaw.toLowerCase().replace(/[\\s-]+/g, \"_\");\n const statusMap: Record = {\n \"mailed\": \"in_transit\",\n \"in_transit\": \"in_transit\",\n \"in_local_area\": \"in_local_area\",\n \"processed_for_delivery\": \"in_local_area\",\n \"out_for_delivery\": \"in_local_area\",\n \"re_routed\": \"in_transit\",\n \"rerouted\": \"in_transit\",\n \"returned_to_sender\": \"returned_to_sender\",\n \"delivered\": \"delivered\",\n \"failed\": \"failed\",\n \"rendered_failed\": \"failed\",\n };\n const status = statusMap[latest] ||\n (data.expected_delivery_date ? \"in_transit\" : \"processing\");\n return new Response(\n JSON.stringify({\n status,\n expected_delivery: data.expected_delivery_date || null,\n latest_event: latestRaw || null, // return original case for diagnostic display\n events_count: events.length,\n }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n } catch (e) {\n return new Response(\n JSON.stringify({ status: \"unknown\", error: String(e) }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n }\n\n // ── IMAGE PROXY ──\n if (target === \"proxy-image\") {\n const imageUrl = url.searchParams.get(\"url\") || \"\";\n if (!imageUrl) {\n return new Response(\"No URL\", { status: 400, headers: cors });\n }\n try {\n const res = await fetch(imageUrl, {\n headers: { \"User-Agent\": \"SpotSend/1.0 Lob-Proxy\" },\n });\n const contentType = res.headers.get(\"content-type\") || \"image/jpeg\";\n const buffer = await res.arrayBuffer();\n return new Response(buffer, {\n status: 200,\n headers: {\n ...cors,\n \"Content-Type\": contentType,\n \"Cache-Control\": \"public, max-age=86400\",\n },\n });\n } catch (_e) {\n return new Response(\"Image fetch failed\", {\n status: 500,\n headers: cors,\n });\n }\n }\n\n // ── USPS EDDM ──\n if (target === \"usps\") {\n const zip = url.searchParams.get(\"zip\") || \"74105\";\n const res = await fetch(\n `https://gis.usps.com/arcgis/rest/services/EDDM/selectZIP/GPServer/routes/execute?f=json&env:outSR=4326&ZIP=${zip}&Rte_Box=R&UserName=EDDM`,\n );\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── PERMITS ──\n if (target === \"permits\") {\n const address = url.searchParams.get(\"address\") || \"\";\n const res = await fetch(\n \"https://tulsaok-energovweb.tylerhost.net/apps/selfservice/api/CSS/permit/search\",\n {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"Accept\": \"application/json\",\n \"Referer\":\n \"https://tulsaok-energovweb.tylerhost.net/apps/selfservice\",\n \"Origin\": \"https://tulsaok-energovweb.tylerhost.net\",\n },\n body: JSON.stringify({\n address,\n permitNumber: \"\",\n permitType: \"\",\n statusCode: \"\",\n dateFrom: \"\",\n dateTo: \"\",\n pageNumber: 1,\n pageSize: 10,\n sortBy: \"IssuedDate\",\n sortDesc: true,\n }),\n },\n );\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── LOB ADDRESS VERIFY ──\n if (target === \"lob-verify\") {\n const body = await req.text();\n const res = await fetch(\"https://api.lob.com/v1/us_verifications\", {\n method: \"POST\",\n headers: {\n \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\"),\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── CLOUDINARY UPLOAD ──\n if (target === \"cloudinary-upload\") {\n const { image, filename } = await req.json();\n const binary = Uint8Array.from(atob(image), (c) => c.charCodeAt(0));\n const blob = new Blob([binary], { type: \"image/jpeg\" });\n\n const timestamp = Math.floor(Date.now() / 1000).toString();\n const paramStr = `timestamp=${timestamp}`;\n const encoder = new TextEncoder();\n const msgData = encoder.encode(paramStr + CLOUDINARY_SECRET);\n const hashBuffer = await crypto.subtle.digest(\"SHA-1\", msgData);\n const signature = Array.from(new Uint8Array(hashBuffer))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n\n const formData = new FormData();\n formData.append(\"file\", blob, filename || \"spot-photo.jpg\");\n formData.append(\"api_key\", CLOUDINARY_KEY);\n formData.append(\"timestamp\", timestamp);\n formData.append(\"signature\", signature);\n\n const uploadRes = await fetch(\n `https://api.cloudinary.com/v1_1/${CLOUDINARY_CLOUD}/image/upload`,\n { method: \"POST\", body: formData },\n );\n const uploadData = await uploadRes.json();\n const urlOut = uploadData?.secure_url || null;\n return new Response(JSON.stringify({ url: urlOut }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── IMGBB UPLOAD ──\n if (target === \"imgbb\") {\n const body = await req.json();\n const formData = new FormData();\n formData.append(\"key\", IMGBB_KEY);\n formData.append(\"image\", body.image as string);\n if (body.name) formData.append(\"name\", body.name as string);\n const res = await fetch(\"https://api.imgbb.com/1/upload\", {\n method: \"POST\",\n body: formData,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── ANTHROPIC ──\n if (target === \"anthropic\") {\n const body = await req.text();\n const res = await fetch(\"https://api.anthropic.com/v1/messages\", {\n method: \"POST\",\n headers: {\n \"x-api-key\": ANTHROPIC_KEY,\n \"anthropic-version\": \"2023-06-01\",\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND CALL ──\n if (target === \"bland-call\") {\n const body = await req.text();\n const res = await fetch(\"https://api.bland.ai/v1/calls\", {\n method: \"POST\",\n headers: {\n \"authorization\": BLAND_KEY,\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND WEBHOOK (existing — outbound call completion) ──\n if (target === \"bland\") {\n const authHeader = req.headers.get(\"Authorization\") || \"\";\n if (authHeader !== \"Bearer spotsend-bland-2025\") {\n return new Response(JSON.stringify({ error: \"Unauthorized\" }), {\n status: 401,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n const body = await req.text();\n console.log(\"Bland webhook received:\", body);\n return new Response(JSON.stringify({ received: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND STATUS ──\n if (target === \"bland-status\") {\n const callId = url.searchParams.get(\"call_id\") || \"\";\n const res = await fetch(\"https://api.bland.ai/v1/calls/\" + callId, {\n headers: { \"authorization\": BLAND_KEY },\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND INBOX (NEW — inbound calls → SpotSend pipeline) ──\n // POST: Bland.AI hits this when a call hangs up. We store keyed by contractor.\n // GET ?contractor_id=X: SpotSend frontend polls every 60s. Returns + clears\n // pending calls so they don't replay.\n if (target === \"bland-inbox\") {\n if (req.method === \"POST\") {\n let payload: Record = {};\n try {\n payload = await req.json();\n } catch {\n return new Response(\n JSON.stringify({ ok: false, reason: \"invalid json\" }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // contractor_id can come from a few places depending on how you set up\n // the Bland phone number's metadata.\n const meta = (payload.metadata as Record) || {};\n const lead = (meta.lead as Record) || {};\n const contractorId = (lead.contractor_id as string) ||\n (meta.contractor_id as string) ||\n \"\";\n\n if (!contractorId) {\n return new Response(\n JSON.stringify({\n ok: false,\n reason: \"no contractor_id in metadata\",\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n const transcript = (payload.transcript as string) ||\n (payload.concatenated_transcript as string) || \"\";\n const callEntry = {\n phone: (payload.from as string) ||\n (payload.phone_number as string) || \"\",\n name: (meta.caller_name as string) ||\n (payload.summary_caller_name as string) || \"\",\n address: (meta.caller_address as string) || \"\",\n city: (meta.caller_city as string) || \"\",\n summary: (payload.summary as string) || transcript.slice(0, 500),\n ts: Date.now(),\n call_id: (payload.call_id as string) || (payload.id as string) || \"\",\n };\n\n const key = `bland_inbox_${contractorId}`;\n let inbox: unknown[] = [];\n try {\n inbox = (await blob.getJSON(key)) as unknown[] || [];\n if (!Array.isArray(inbox)) inbox = [];\n } catch {\n inbox = [];\n }\n inbox.unshift(callEntry);\n // Keep last 50 entries to bound storage\n inbox = inbox.slice(0, 50);\n await blob.setJSON(key, inbox);\n\n return new Response(JSON.stringify({ ok: true, stored: 1 }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n if (req.method === \"GET\") {\n const contractorId = url.searchParams.get(\"contractor_id\") || \"\";\n if (!contractorId) {\n return new Response(JSON.stringify({ calls: [] }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n const key = `bland_inbox_${contractorId}`;\n let inbox: unknown[] = [];\n try {\n inbox = (await blob.getJSON(key)) as unknown[] || [];\n if (!Array.isArray(inbox)) inbox = [];\n } catch {\n inbox = [];\n }\n\n // Clear after delivery so SpotSend doesn't see them twice\n if (inbox.length > 0) {\n try {\n await blob.setJSON(key, []);\n } catch { /* swallow — frontend dedupes by phone too */ }\n }\n\n return new Response(JSON.stringify({ calls: inbox }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n return new Response(\n JSON.stringify({ error: \"method not allowed\" }),\n {\n status: 405,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // ── NOAA HAIL / WIND / TORNADO OVERLAY (Field Map storm-chase mode) ──\n // GET ?days=60&state=OK&types=H,W,T&minHail=1.0&minWind=50\n // Source: Iowa State Mesonet's NWS Local Storm Reports (LSR) API. Free, no key.\n //\n // Params (all optional):\n // days 1-90 (default 60) — how many days back to fetch\n // state 2-letter state code (default OK)\n // types Comma-separated of H (hail), W (wind), T (tornado). Default: H,W,T\n // minHail Minimum hail size in inches (default 1.0). Filters hail events below threshold.\n // minWind Minimum wind speed in mph (default 50). Filters wind events below threshold.\n // Tornadoes are always included regardless of magnitude when type T is requested\n // (any tornado is significant for roofing damage).\n if (target === \"noaa-hail\") {\n const days = Math.min(\n Math.max(parseInt(url.searchParams.get(\"days\") || \"60\") || 60, 1),\n 90,\n );\n const state = (url.searchParams.get(\"state\") || \"OK\")\n .toUpperCase()\n .slice(0, 2);\n\n // Parse types — only H, W, T are valid LSR codes for our purposes\n const typesParam = (url.searchParams.get(\"types\") || \"H,W,T\")\n .toUpperCase();\n const validTypes = [\"H\", \"W\", \"T\"];\n const requestedTypes = typesParam\n .split(\",\")\n .map((t) => t.trim())\n .filter((t) => validTypes.includes(t));\n const types = requestedTypes.length > 0\n ? requestedTypes\n : [\"H\", \"W\", \"T\"];\n\n // Magnitude filters\n const minHail = parseFloat(url.searchParams.get(\"minHail\") || \"1.0\") ||\n 1.0;\n const minWind = parseFloat(url.searchParams.get(\"minWind\") || \"50\") || 50;\n\n const sts = new Date(Date.now() - days * 86400000)\n .toISOString()\n .split(\"T\")[0];\n const ets = new Date().toISOString().split(\"T\")[0];\n\n // Build LSR URL with multiple type params (LSR API accepts repeated type=X)\n const typeParams = types.map((t) => `type=${t}`).join(\"&\");\n const lsrUrl =\n `https://mesonet.agron.iastate.edu/geojson/lsr.geojson?sts=${sts}T00:00&ets=${ets}T23:59&${typeParams}&state=${state}`;\n\n try {\n const upstream = await fetch(lsrUrl);\n if (!upstream.ok) {\n return new Response(\n JSON.stringify({\n events: [],\n error: \"upstream_failed\",\n status: upstream.status,\n }),\n {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n const data = await upstream.json() as {\n features?: Array<{\n properties?: Record;\n geometry?: { coordinates?: number[] };\n }>;\n };\n\n // Map raw features → SpotSend event shape, AND apply magnitude filters\n // by event type. The LSR `type` field is a single letter (H/W/T/etc)\n // matching what we requested.\n const allEvents = (data.features || []).map((f) => {\n const props = f.properties || {};\n const coords = f.geometry?.coordinates || [];\n // LSR uses lowercase `type` for the single-letter code\n const rawType = String(props.type || \"\").toUpperCase();\n const magnitudeRaw = (props.magnitude as string | number) ||\n (props.MAG as string | number) || \"\";\n const magnitudeNum = parseFloat(String(magnitudeRaw)) || 0;\n return {\n lat: coords[1],\n lng: coords[0],\n magnitude: magnitudeRaw,\n magnitudeNum, // numeric for filtering; not sent to client\n rawType, // single-letter code for filtering; not sent\n date: (props.utc_valid as string) ||\n (props.valid as string) || \"\",\n type: (props.typetext as string) || (props.type as string) ||\n \"Storm\",\n city: (props.city as string) || \"\",\n };\n }).filter((e) => e.lat && e.lng);\n\n // Apply magnitude filters per type\n const filteredEvents = allEvents.filter((e) => {\n if (e.rawType === \"H\") return e.magnitudeNum >= minHail;\n if (e.rawType === \"W\") return e.magnitudeNum >= minWind;\n if (e.rawType === \"T\") return true; // any tornado is significant\n return true; // pass through unknown types\n }).map((e) => {\n // Strip the internal-only fields before returning to client\n const { magnitudeNum: _m, rawType: _t, ...rest } = e;\n return rest;\n });\n\n return new Response(\n JSON.stringify({\n events: filteredEvents,\n source: \"iastate_mesonet\",\n days,\n state,\n types,\n minHail,\n minWind,\n count: filteredEvents.length,\n unfiltered_count: allEvents.length,\n }),\n {\n headers: {\n \"Content-Type\": \"application/json\",\n \"Cache-Control\": \"public, max-age=900\",\n ...cors,\n },\n },\n );\n } catch (e) {\n return new Response(\n JSON.stringify({ events: [], error: String(e) }),\n {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n }\n\n // ─────────────────────────────────────────────\n // TWILIO CALL CAPTURE — Phase 1: provision, forward, log\n // ─────────────────────────────────────────────\n // Endpoints:\n // POST ?target=twilio-provision {contractorId, city, state, ownerName, personalPhone}\n // Buys a local Twilio number, configures voice webhook,\n // updates contractor_profiles. Returns {phoneNumber, phoneSid}.\n // POST ?target=twilio-release {contractorId}\n // Releases the contractor's Twilio number, clears DB columns.\n // POST ?target=twilio-voice Hit by Twilio when a call comes in to a SpotSend number.\n // Returns TwiML that s the contractor's personal phone.\n // POST ?target=twilio-call-status Hit by Twilio when the call completes. Logs to inbound_calls.\n\n const TWILIO_ACCOUNT_SID = Deno.env.get(\"TWILIO_ACCOUNT_SID\") || \"\";\n const TWILIO_AUTH_TOKEN = Deno.env.get(\"TWILIO_AUTH_TOKEN\") || \"\";\n const TWILIO_AUTH_HEADER = \"Basic \" +\n btoa(`${TWILIO_ACCOUNT_SID}:${TWILIO_AUTH_TOKEN}`);\n const PROXY_BASE_URL = `https://${\n req.headers.get(\"host\") ||\n \"joelmwood--caf3509a369b11f190f942b51c65c3df.web.val.run\"\n }`;\n\n if (target === \"twilio-provision\") {\n if (!TWILIO_ACCOUNT_SID || !TWILIO_AUTH_TOKEN) {\n return new Response(\n JSON.stringify({\n error: \"Twilio credentials not configured on server\",\n }),\n {\n status: 500,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n const { contractorId, city, state, personalPhone } = await req.json();\n if (!contractorId) {\n return new Response(JSON.stringify({ error: \"Missing contractorId\" }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n if (!personalPhone) {\n return new Response(\n JSON.stringify({\n error:\n \"Contractor has no personal phone — fill profile in Settings first\",\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n if (!city && !state) {\n return new Response(\n JSON.stringify({\n error:\n \"Need at least city or state on profile to find a local number\",\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // Step 1: Search for an available local number using Twilio's number lookup.\n // We pass inLocality and inRegion so Twilio finds any local number in the\n // contractor's city — handles cities with multiple area codes (Dallas 214/469/972).\n // VoiceEnabled=true ensures we only get numbers that can receive calls.\n const searchParams = new URLSearchParams({\n VoiceEnabled: \"true\",\n SmsEnabled: \"true\",\n });\n if (city) searchParams.set(\"InLocality\", city);\n if (state) searchParams.set(\"InRegion\", state);\n // Limit results — we only need one\n searchParams.set(\"PageSize\", \"5\");\n\n const searchUrl =\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/AvailablePhoneNumbers/US/Local.json?${searchParams}`;\n const searchRes = await fetch(searchUrl, {\n headers: { \"Authorization\": TWILIO_AUTH_HEADER },\n });\n\n if (!searchRes.ok) {\n const err = await searchRes.text();\n console.error(\n \"[twilio-provision] search failed:\",\n searchRes.status,\n err,\n );\n return new Response(\n JSON.stringify({\n error: \"Twilio search failed\",\n status: searchRes.status,\n detail: err,\n }),\n {\n status: 502,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n const searchData = await searchRes.json();\n const candidates = searchData?.available_phone_numbers || [];\n\n // Fallback: if no numbers in the contractor's locality, try just the region (state).\n // Some smaller cities have no available local inventory; state-level usually works.\n let chosenNumber = candidates[0]?.phone_number;\n if (!chosenNumber && city && state) {\n const fallbackParams = new URLSearchParams({\n VoiceEnabled: \"true\",\n SmsEnabled: \"true\",\n InRegion: state,\n PageSize: \"5\",\n });\n const fbRes = await fetch(\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/AvailablePhoneNumbers/US/Local.json?${fallbackParams}`,\n { headers: { \"Authorization\": TWILIO_AUTH_HEADER } },\n );\n if (fbRes.ok) {\n const fbData = await fbRes.json();\n chosenNumber = fbData?.available_phone_numbers?.[0]?.phone_number;\n }\n }\n\n if (!chosenNumber) {\n return new Response(\n JSON.stringify({\n error:\n \"No local Twilio numbers available — try again or contact support\",\n }),\n {\n status: 503,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // Step 2: Purchase the number with our voice + SMS webhooks + status callback wired up.\n // SmsUrl handles inbound text messages (homeowners can text the number, not just call).\n const voiceUrl =\n `${PROXY_BASE_URL}/?target=twilio-voice&contractor_id=${contractorId}`;\n const smsUrl =\n `${PROXY_BASE_URL}/?target=twilio-sms&contractor_id=${contractorId}`;\n const statusUrl =\n `${PROXY_BASE_URL}/?target=twilio-call-status&contractor_id=${contractorId}`;\n const purchaseBody = new URLSearchParams({\n PhoneNumber: chosenNumber,\n VoiceUrl: voiceUrl,\n VoiceMethod: \"POST\",\n SmsUrl: smsUrl,\n SmsMethod: \"POST\",\n StatusCallback: statusUrl,\n StatusCallbackMethod: \"POST\",\n FriendlyName: `SpotSend - ${contractorId.slice(0, 8)}`,\n });\n\n const purchaseRes = await fetch(\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/IncomingPhoneNumbers.json`,\n {\n method: \"POST\",\n headers: {\n \"Authorization\": TWILIO_AUTH_HEADER,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: purchaseBody,\n },\n );\n\n if (!purchaseRes.ok) {\n const err = await purchaseRes.text();\n console.error(\n \"[twilio-provision] purchase failed:\",\n purchaseRes.status,\n err,\n );\n return new Response(\n JSON.stringify({\n error: \"Twilio purchase failed\",\n status: purchaseRes.status,\n detail: err,\n }),\n {\n status: 502,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n const purchased = await purchaseRes.json();\n const phoneNumber = purchased.phone_number;\n const phoneSid = purchased.sid;\n\n // Step 3: Persist on contractor_profiles row.\n await updateContractorProfile(contractorId, {\n twilio_phone_number: phoneNumber,\n twilio_phone_sid: phoneSid,\n twilio_enabled: true,\n });\n\n console.log(\n `[twilio-provision] ${contractorId} → ${phoneNumber} (${phoneSid})`,\n );\n return new Response(\n JSON.stringify({ ok: true, phoneNumber, phoneSid }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n if (target === \"twilio-release\") {\n const { contractorId } = await req.json();\n if (!contractorId) {\n return new Response(JSON.stringify({ error: \"Missing contractorId\" }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // Look up the SID from the contractor's profile.\n const lookupRes = await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?id=eq.${contractorId}&select=twilio_phone_sid,twilio_phone_number`,\n {\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n },\n },\n );\n const profileRows = await lookupRes.json();\n const phoneSid = profileRows?.[0]?.twilio_phone_sid;\n\n if (phoneSid) {\n // Release on Twilio. We don't fail hard if Twilio errors — clearing the DB\n // columns is more important so the contractor can re-enable. If a stuck SID\n // causes monthly billing, admin can clean up via Twilio dashboard.\n const releaseRes = await fetch(\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/IncomingPhoneNumbers/${phoneSid}.json`,\n {\n method: \"DELETE\",\n headers: { \"Authorization\": TWILIO_AUTH_HEADER },\n },\n );\n if (!releaseRes.ok) {\n console.error(\n \"[twilio-release] Twilio DELETE failed:\",\n releaseRes.status,\n await releaseRes.text(),\n );\n // Continue to clear DB anyway\n }\n }\n\n await updateContractorProfile(contractorId, {\n twilio_phone_number: null,\n twilio_phone_sid: null,\n twilio_enabled: false,\n });\n\n console.log(\n `[twilio-release] ${contractorId} → released ${phoneSid || \"(no sid)\"}`,\n );\n return new Response(JSON.stringify({ ok: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n if (target === \"twilio-voice\") {\n // Twilio hits this when a call comes in to a SpotSend number.\n // We respond with TwiML that forwards the call to the contractor's personal phone.\n // If they don't answer in 25 seconds, the call is hung up (Phase 2 will route to voicemail).\n const contractorId = url.searchParams.get(\"contractor_id\") || \"\";\n let personalPhone = \"\";\n let companyName = \"your contractor\";\n\n if (contractorId) {\n const lookupRes = await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?id=eq.${contractorId}&select=phone,company_name`,\n {\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n },\n },\n );\n const rows = await lookupRes.json();\n personalPhone = rows?.[0]?.phone || \"\";\n companyName = rows?.[0]?.company_name || companyName;\n }\n\n // Strip any non-digits and ensure E.164 format. Twilio Dial wants +1XXXXXXXXXX for US.\n const digitsOnly = personalPhone.replace(/\\D/g, \"\");\n const dialNumber = digitsOnly.length === 10\n ? `+1${digitsOnly}`\n : (digitsOnly.length === 11 ? `+${digitsOnly}` : \"\");\n\n let twiml: string;\n if (!dialNumber) {\n // No phone on profile — politely tell the caller to leave a message later.\n // (Voicemail is Phase 2; for now we just hang up gracefully.)\n twiml = `\n\n Sorry, ${companyName} can not take calls right now. Please try again later.\n \n`;\n } else {\n // Dial the contractor's personal phone with timeout + record + caller ID passthrough.\n // callerId=\"\" means \"use the original caller's number\" so the contractor's phone\n // shows the actual homeowner's number, not the Twilio number. record=\"record-from-answer\"\n // captures the conversation server-side for Phase 2 transcription.\n twiml = `\n\n \n ${dialNumber}\n \n`;\n }\n\n return new Response(twiml, {\n status: 200,\n headers: { \"Content-Type\": \"text/xml\", ...cors },\n });\n }\n\n if (target === \"twilio-call-status\") {\n // Twilio fires this when a call ends. We log the call to inbound_calls.\n // Form-encoded body, not JSON.\n const contractorId = url.searchParams.get(\"contractor_id\") || \"\";\n const formData = await req.formData();\n const callSid = String(formData.get(\"CallSid\") || \"\");\n const fromNum = String(formData.get(\"From\") || \"\");\n const toNum = String(formData.get(\"To\") || \"\");\n const status = String(formData.get(\"CallStatus\") || \"\");\n const duration = parseInt(String(formData.get(\"CallDuration\") || \"0\")) ||\n 0;\n // \"completed\" with non-zero duration means contractor answered.\n // \"no-answer\", \"busy\", \"failed\", \"canceled\" mean the contractor missed it.\n const answered = status === \"completed\" && duration > 0;\n\n if (!contractorId || !callSid) {\n console.warn(\"[twilio-call-status] missing contractor_id or callSid\", {\n contractorId,\n callSid,\n });\n return new Response(\"\", { status: 200 });\n }\n\n // Insert into inbound_calls. Use upsert-by-twilio_sid to handle duplicate webhook fires.\n // PostgREST `Prefer: resolution=merge-duplicates` does upsert when there's a unique key.\n const insertRes = await fetch(`${SUPABASE_URL}/rest/v1/inbound_calls`, {\n method: \"POST\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal,resolution=merge-duplicates\",\n },\n body: JSON.stringify({\n user_id: contractorId,\n twilio_sid: callSid,\n from_number: fromNum,\n to_number: toNum,\n duration_sec: duration,\n answered,\n forward_status: status,\n }),\n });\n\n if (!insertRes.ok) {\n console.error(\n \"[twilio-call-status] insert failed:\",\n insertRes.status,\n await insertRes.text(),\n );\n } else {\n console.log(\n `[twilio-call-status] ${contractorId} ${fromNum} → ${status} ${duration}s`,\n );\n }\n\n return new Response(\"\", { status: 200 });\n }\n\n // ── TWILIO INBOUND SMS ──\n // Twilio hits this when an SMS comes in to a SpotSend number. We:\n // 1) log it to inbound_messages\n // 2) forward the message body to the contractor's personal phone via Twilio SMS,\n // so they see it in their normal SMS app and can reply directly to the homeowner.\n // The contractor's reply goes from their personal number, not via Twilio — simpler\n // architecture, no session map needed. Two-way proxying can be added later if needed.\n //\n // Important: Twilio expects a TwiML response to inbound SMS even if we don't reply.\n // Returning empty tells Twilio \"we got it, don't auto-reply.\"\n if (target === \"twilio-sms\") {\n const contractorId = url.searchParams.get(\"contractor_id\") || \"\";\n const formData = await req.formData();\n const messageSid = String(formData.get(\"MessageSid\") || \"\");\n const fromNum = String(formData.get(\"From\") || \"\");\n const toNum = String(formData.get(\"To\") || \"\");\n const body = String(formData.get(\"Body\") || \"\");\n\n if (!contractorId || !messageSid) {\n console.warn(\"[twilio-sms] missing contractor_id or messageSid\", {\n contractorId,\n messageSid,\n });\n return new Response(\n '',\n {\n status: 200,\n headers: { \"Content-Type\": \"text/xml\", ...cors },\n },\n );\n }\n\n // Look up contractor's personal phone for forwarding.\n let personalPhone = \"\";\n try {\n const lookupRes = await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?id=eq.${contractorId}&select=phone`,\n {\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n },\n },\n );\n const rows = await lookupRes.json();\n personalPhone = rows?.[0]?.phone || \"\";\n } catch (e) {\n console.error(\"[twilio-sms] profile lookup failed:\", e);\n }\n\n // Forward the SMS to contractor's personal phone. Format: \"From (HHH) HHH-HHHH: \"\n // so the contractor sees who texted (since the from-number on the relayed SMS\n // will be the SpotSend number, not the homeowner's).\n let forwarded = false;\n let forwardError: string | null = null;\n const digitsOnly = personalPhone.replace(/\\D/g, \"\");\n const personalE164 = digitsOnly.length === 10\n ? `+1${digitsOnly}`\n : (digitsOnly.length === 11 ? `+${digitsOnly}` : \"\");\n\n if (personalE164) {\n // Build the forwarded message. Keep it short — SMS segments are 160 chars.\n // Strip non-digits from sender for display formatting.\n const senderD = fromNum.replace(/\\D/g, \"\");\n const senderDisplay = senderD.length === 11 && senderD.startsWith(\"1\")\n ? `(${senderD.slice(1, 4)}) ${senderD.slice(4, 7)}-${\n senderD.slice(7)\n }`\n : fromNum;\n // Truncate body if too long — leave room for the prefix.\n const PREFIX = `📱 From ${senderDisplay}: `;\n const MAX_BODY = 320 - PREFIX.length; // allow up to 2 segments\n const truncatedBody = body.length > MAX_BODY\n ? body.slice(0, MAX_BODY - 3) + \"...\"\n : body;\n const forwardBody = PREFIX + truncatedBody;\n\n try {\n const sendRes = await fetch(\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/Messages.json`,\n {\n method: \"POST\",\n headers: {\n \"Authorization\": TWILIO_AUTH_HEADER,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n From: toNum, // the SpotSend number\n To: personalE164,\n Body: forwardBody,\n }),\n },\n );\n if (sendRes.ok) {\n forwarded = true;\n } else {\n const errText = await sendRes.text();\n forwardError = `${sendRes.status}: ${errText.slice(0, 200)}`;\n console.error(\"[twilio-sms] forward failed:\", forwardError);\n }\n } catch (e) {\n forwardError = String(e).slice(0, 200);\n console.error(\"[twilio-sms] forward exception:\", e);\n }\n } else {\n forwardError = \"no personal phone on profile\";\n }\n\n // Log to inbound_messages. Upsert by twilio_sid prevents duplicates from webhook retries.\n const insertRes = await fetch(\n `${SUPABASE_URL}/rest/v1/inbound_messages`,\n {\n method: \"POST\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal,resolution=merge-duplicates\",\n },\n body: JSON.stringify({\n user_id: contractorId,\n twilio_sid: messageSid,\n from_number: fromNum,\n to_number: toNum,\n body,\n forwarded,\n forward_error: forwardError,\n }),\n },\n );\n if (!insertRes.ok) {\n console.error(\n \"[twilio-sms] insert failed:\",\n insertRes.status,\n await insertRes.text(),\n );\n } else {\n console.log(\n `[twilio-sms] ${contractorId} ${fromNum} → ${\n forwarded ? \"forwarded\" : \"not forwarded\"\n }: ${body.slice(0, 60)}`,\n );\n }\n\n // Empty TwiML response — we're not auto-replying to the homeowner from here.\n return new Response('', {\n status: 200,\n headers: { \"Content-Type\": \"text/xml\", ...cors },\n });\n }\n\n // ── TWILIO RETROFIT (one-shot for existing numbers) ──\n // Numbers provisioned BEFORE the SMS handler was added don't have SmsUrl set.\n // This endpoint adds the missing webhook to an already-owned number without\n // releasing/re-buying. Call once per existing contractor that already has Twilio enabled.\n // POST {contractorId}\n if (target === \"twilio-update-webhooks\") {\n const { contractorId } = await req.json();\n if (!contractorId) {\n return new Response(JSON.stringify({ error: \"Missing contractorId\" }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // Get the SID from contractor_profiles\n const lookupRes = await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?id=eq.${contractorId}&select=twilio_phone_sid,twilio_phone_number`,\n {\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n },\n },\n );\n const rows = await lookupRes.json();\n const phoneSid = rows?.[0]?.twilio_phone_sid;\n const phoneNumber = rows?.[0]?.twilio_phone_number;\n\n if (!phoneSid) {\n return new Response(\n JSON.stringify({\n error: \"Contractor has no Twilio number — provision first\",\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // Update the number's webhooks to include SmsUrl. Twilio's API uses POST to update.\n const voiceUrl =\n `${PROXY_BASE_URL}/?target=twilio-voice&contractor_id=${contractorId}`;\n const smsUrl =\n `${PROXY_BASE_URL}/?target=twilio-sms&contractor_id=${contractorId}`;\n const statusUrl =\n `${PROXY_BASE_URL}/?target=twilio-call-status&contractor_id=${contractorId}`;\n\n const updateRes = await fetch(\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/IncomingPhoneNumbers/${phoneSid}.json`,\n {\n method: \"POST\",\n headers: {\n \"Authorization\": TWILIO_AUTH_HEADER,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n VoiceUrl: voiceUrl,\n VoiceMethod: \"POST\",\n SmsUrl: smsUrl,\n SmsMethod: \"POST\",\n StatusCallback: statusUrl,\n StatusCallbackMethod: \"POST\",\n }),\n },\n );\n\n if (!updateRes.ok) {\n const err = await updateRes.text();\n return new Response(\n JSON.stringify({\n error: \"Twilio update failed\",\n status: updateRes.status,\n detail: err,\n }),\n {\n status: 502,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n console.log(\n `[twilio-update-webhooks] ${contractorId} → updated ${phoneNumber}`,\n );\n return new Response(\n JSON.stringify({\n ok: true,\n phoneNumber,\n phoneSid,\n updated: [\"VoiceUrl\", \"SmsUrl\", \"StatusCallback\"],\n }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n // ── LOB POSTCARDS (default) ──\n // Forwards the postcard create. App.jsx puts a stable idempotency string in\n // body.metadata.idempotency_key; we extract it and forward it as the actual\n // Lob `Idempotency-Key` HTTP header. Lob caches that key for 24h, so a\n // network-level retry (mid-tunnel signal loss in a contractor's truck) won't\n // create a second postcard and double-charge. The metadata field is left in\n // the body so it still shows up on the Lob dashboard as a label.\n const body = await req.text();\n let idempotencyKey = \"\";\n try {\n const parsed = JSON.parse(body);\n const k = parsed?.metadata?.idempotency_key;\n if (typeof k === \"string\" && k.length > 0 && k.length <= 256) {\n idempotencyKey = k;\n }\n } catch { /* not JSON or no metadata — fall through with no header */ }\n\n const lobHeaders: Record = {\n \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\"),\n \"Content-Type\": \"application/json\",\n };\n if (idempotencyKey) lobHeaders[\"Idempotency-Key\"] = idempotencyKey;\n\n const res = await fetch(\"https://api.lob.com/v1/postcards\", {\n method: \"POST\",\n headers: lobHeaders,\n body, // forward original unchanged\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n } catch (err) {\n return new Response(JSON.stringify({ error: (err as Error).message }), {\n status: 500,\n headers: {\n \"Content-Type\": \"application/json\",\n \"Access-Control-Allow-Origin\": \"*\",\n },\n });\n }\n}","import { blob } from \"https://esm.town/v/std/blob\";\n\n// ── RATE LIMITING ──\n// In-memory per-IP counter, sliding 60-second window. Survives between requests\n// because module-scoped state persists for the lifetime of the val instance.\n// Bucket structure: ip → { count, windowStart }. Cleared lazily when the\n// window rolls over. Not cluster-safe (val.town can spawn multiple instances)\n// but good enough to block scrapers and accidental floods. Real DDoS protection\n// is upstream (CDN/WAF) anyway.\nconst rateLimits = new Map();\nconst RATE_WINDOW_MS = 60_000; // 1 minute\n\n// Endpoint tier → requests per IP per minute. Webhooks excluded entirely\n// because Twilio/Stripe send legitimate burst traffic and we validate signatures\n// where applicable. Anonymous endpoints (request-access, anthropic, lob-verify)\n// get tight limits; user-authenticated endpoints get moderate limits.\nconst RATE_LIMITS: Record = {\n // Tight (anonymous, expensive)\n \"request-access\": 5, // landing form submissions; abuse = inbox spam\n \"anthropic\": 30, // AI calls cost real money per request\n \"lob-verify\": 30, // address verification has per-call Lob cost\n \"proxy-image\": 60, // cheap but not free\n // Moderate (authenticated user actions)\n \"stripe-checkout\": 30,\n \"stripe-create-subscription\": 10,\n \"stripe-portal\": 30,\n \"stripe-report-usage\": 60,\n \"lob-upload\": 30,\n \"lob-status\": 60,\n \"cloudinary-upload\": 30,\n \"imgbb\": 30,\n \"usps\": 30,\n \"permits\": 30,\n \"noaa-hail\": 30,\n \"bland-call\": 10,\n \"bland\": 30,\n \"bland-status\": 60,\n \"bland-inbox\": 60,\n \"twilio-provision\": 5, // expensive (buys a number)\n \"twilio-release\": 10,\n \"twilio-update-webhooks\": 10,\n // No limit (webhooks — Twilio/Stripe send legit bursts):\n // stripe-webhook, twilio-voice, twilio-call-status, twilio-sms\n};\n\n// Returns null if request should pass, or a Response object if it should be blocked.\nfunction checkRateLimit(ip: string, target: string): Response | null {\n const limit = RATE_LIMITS[target];\n if (!limit) return null; // unknown or whitelisted endpoint\n const now = Date.now();\n const key = `${ip}:${target}`;\n const bucket = rateLimits.get(key);\n if (!bucket || now - bucket.windowStart >= RATE_WINDOW_MS) {\n rateLimits.set(key, { count: 1, windowStart: now });\n return null;\n }\n bucket.count++;\n if (bucket.count > limit) {\n const retryAfter = Math.ceil(\n (RATE_WINDOW_MS - (now - bucket.windowStart)) / 1000,\n );\n return new Response(\n JSON.stringify({\n error: \"Rate limit exceeded. Try again later.\",\n retryAfter,\n }),\n {\n status: 429,\n headers: {\n \"Content-Type\": \"application/json\",\n \"Retry-After\": String(retryAfter),\n \"Access-Control-Allow-Origin\": \"*\",\n },\n },\n );\n }\n return null;\n}\n\n// Lazy cleanup so the Map doesn't grow forever. Run on every request — cheap.\nfunction cleanupRateLimits() {\n const now = Date.now();\n if (rateLimits.size < 1000) return; // only sweep when it gets big\n for (const [key, bucket] of rateLimits.entries()) {\n if (now - bucket.windowStart >= RATE_WINDOW_MS * 2) {\n rateLimits.delete(key);\n }\n }\n}\n\n// ── PII REDACTION FOR LOGS ──\n// Used before any console.log that touches a phone number, address, or message body.\n// Logs are visible in val.town's dashboard — anyone with that access (or shoulder-\n// surfers) sees PII otherwise. Mask middle digits of phones, truncate bodies, etc.\nfunction redactPhone(p: string): string {\n if (!p) return p;\n const d = p.replace(/\\D/g, \"\");\n if (d.length === 11 && d.startsWith(\"1\")) {\n return `+1${d.slice(1, 4)}***${d.slice(7)}`;\n }\n if (d.length === 10) return `${d.slice(0, 3)}***${d.slice(6)}`;\n return \"***\";\n}\nfunction redactBody(s: string, max = 40): string {\n if (!s) return s;\n return s.length > max ? s.slice(0, max) + \"…\" : s;\n}\n\n// ── TWILIO WEBHOOK SIGNATURE VALIDATION ──\n// Twilio signs every webhook with X-Twilio-Signature, computed as\n// HMAC-SHA1(authToken, fullUrl + sortedFormParams).\n// Without validation, anyone could POST fake call/SMS events to our webhook URLs\n// and inject fake records into the database. With validation, only Twilio's\n// signed requests are accepted.\nasync function validateTwilioSignature(\n req: Request,\n authToken: string,\n formData: FormData,\n): Promise {\n const sig = req.headers.get(\"X-Twilio-Signature\");\n if (!sig || !authToken) return false;\n // Reconstruct the URL Twilio used — they hash the exact URL they sent the\n // request to, including query params.\n const fullUrl = req.url;\n // Sort form params alphabetically and concatenate key+value pairs.\n const params: string[] = [];\n formData.forEach((v, k) => params.push(`${k}${v}`));\n params.sort();\n const dataToSign = fullUrl + params.join(\"\");\n // HMAC-SHA1 with the authToken as the key\n const enc = new TextEncoder();\n const keyData = enc.encode(authToken);\n const cryptoKey = await crypto.subtle.importKey(\n \"raw\",\n keyData,\n { name: \"HMAC\", hash: \"SHA-1\" },\n false,\n [\"sign\"],\n );\n const sigBuf = await crypto.subtle.sign(\n \"HMAC\",\n cryptoKey,\n enc.encode(dataToSign),\n );\n // Twilio sends the signature as base64\n const expectedSig = btoa(String.fromCharCode(...new Uint8Array(sigBuf)));\n return sig === expectedSig;\n}\n\nexport default async function (req: Request): Promise {\n const cors = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"POST, GET, OPTIONS\",\n \"Access-Control-Allow-Headers\":\n \"Content-Type, Authorization, x-api-key, anthropic-version\",\n };\n\n if (req.method === \"OPTIONS\") {\n return new Response(null, { headers: cors });\n }\n\n // ── KEYS FROM ENVIRONMENT ──\n // CRITICAL: never hardcode secrets as fallbacks. If an env var is missing, fail\n // explicitly at the relevant endpoint rather than silently using a leaked value.\n // (A previous version had Cloudinary credentials hardcoded as a fallback. Anyone\n // viewing val.town code could read them. That has been removed; if Cloudinary\n // env vars aren't set, the cloudinary-upload endpoint returns 500 with a clear error.)\n const STRIPE_KEY = Deno.env.get(\"STRIPE_SECRET_KEY\") || \"\";\n const STRIPE_WEBHOOK = Deno.env.get(\"STRIPE_WEBHOOK_SECRET\") || \"\";\n const SUPABASE_URL = Deno.env.get(\"SUPABASE_URL\") ||\n \"https://pzbvvohedpgeiynqoujr.supabase.co\";\n const SUPABASE_KEY = Deno.env.get(\"SUPABASE_SERVICE_KEY\") || \"\";\n const ANTHROPIC_KEY = Deno.env.get(\"ANTHROPIC_API_KEY\") || \"\";\n const BLAND_KEY = Deno.env.get(\"BLAND_API_KEY\") || \"\";\n const LOB_KEY = Deno.env.get(\"LOB_API_KEY\") || \"\";\n const IMGBB_KEY = Deno.env.get(\"IMGBB_API_KEY\") || \"\";\n const CLOUDINARY_CLOUD = Deno.env.get(\"CLOUDINARY_CLOUD_NAME\") || \"\";\n const CLOUDINARY_KEY = Deno.env.get(\"CLOUDINARY_API_KEY\") || \"\";\n const CLOUDINARY_SECRET = Deno.env.get(\"CLOUDINARY_API_SECRET\") || \"\";\n\n // ── STRIPE PRICE IDs ──\n const STRIPE_PRICES = {\n platform: \"price_1TLS1sE8Fzrv1kXN8ZyBhwot\",\n mailer: \"price_1TLS4eE8Fzrv1kXNjXmul7Ie\",\n spot_bid: \"price_1TLS62E8Fzrv1kXNsvLA5tT9\",\n bulk_tagged: \"price_1TOPSxE8Fzrv1kXNj9VwfCIN\",\n };\n\n async function updateContractorProfile(\n contractorId: string,\n updates: Record,\n ) {\n if (!contractorId) return;\n await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?id=eq.${contractorId}`,\n {\n method: \"PATCH\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal\",\n },\n body: JSON.stringify(updates),\n },\n );\n }\n\n async function getContractorByCustomer(\n stripeCustomerId: string,\n ): Promise {\n const res = await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?stripe_customer_id=eq.${stripeCustomerId}&select=id`,\n {\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n },\n },\n );\n const rows = await res.json();\n return rows?.[0]?.id || null;\n }\n\n // ── USAGE EVENT LOGGING ──\n // `stripeReported` reflects whether the Stripe usage_records POST actually\n // succeeded. When false, the row is a reconciliation candidate (Lob shipped\n // but Stripe wasn't billed). Previously this was hardcoded false on every\n // insert, which made the field useless for sweeps. Default kept false so\n // call sites that don't pass it (e.g. grandfathered/no-sub paths) stay safe.\n async function logUsageEvent(\n userId: string,\n eventType: string,\n quantity: number,\n unitPrice: number,\n lobId?: string,\n stripeReported: boolean = false,\n ) {\n await fetch(`${SUPABASE_URL}/rest/v1/usage_events`, {\n method: \"POST\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal\",\n },\n body: JSON.stringify({\n user_id: userId,\n event_type: eventType,\n quantity,\n unit_price: unitPrice,\n total: quantity * unitPrice,\n lob_id: lobId || null,\n stripe_reported: stripeReported,\n }),\n });\n }\n\n // Unit price lookup per event\n function unitPriceFor(eventType: string): number {\n if (eventType === \"spot_bid_sent\") return 1.75;\n if (eventType === \"bulk_tagged_sent\") return 1.25;\n if (eventType === \"mailer_sent\") return 0.95;\n return 0;\n }\n\n try {\n const url = new URL(req.url);\n const target = url.searchParams.get(\"target\") || \"lob\";\n\n // ── RATE LIMITING ──\n // Block flooders before any work happens. Webhooks (Twilio, Stripe) bypass —\n // their sources are validated by signature, and they may legitimately burst.\n cleanupRateLimits();\n const clientIp =\n req.headers.get(\"x-forwarded-for\")?.split(\",\")[0]?.trim() ||\n req.headers.get(\"cf-connecting-ip\") ||\n \"unknown\";\n const rateLimitBlock = checkRateLimit(clientIp, target);\n if (rateLimitBlock) return rateLimitBlock;\n\n // ── STRIPE: HOSTED CHECKOUT SESSION ──\n if (target === \"stripe-checkout\") {\n const { email, userId, contractorId, successUrl, cancelUrl } = await req\n .json();\n\n const searchRes = await fetch(\n `https://api.stripe.com/v1/customers/search?query=email:'${\n encodeURIComponent(email)\n }'`,\n { headers: { \"Authorization\": `Bearer ${STRIPE_KEY}` } },\n );\n const searchData = await searchRes.json();\n let customerId = searchData?.data?.[0]?.id;\n\n if (!customerId) {\n const customerRes = await fetch(\"https://api.stripe.com/v1/customers\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n email,\n \"metadata[contractorId]\": contractorId || userId,\n \"metadata[userId]\": userId,\n }),\n });\n const customer = await customerRes.json();\n customerId = customer.id;\n }\n\n const sessionRes = await fetch(\n \"https://api.stripe.com/v1/checkout/sessions\",\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n customer: customerId,\n mode: \"subscription\",\n \"line_items[0][price]\": STRIPE_PRICES.platform,\n \"line_items[1][price]\": STRIPE_PRICES.spot_bid,\n \"line_items[2][price]\": STRIPE_PRICES.mailer,\n \"line_items[3][price]\": STRIPE_PRICES.bulk_tagged,\n client_reference_id: userId,\n success_url: successUrl || \"https://spotsend.io?billing=success\",\n cancel_url: cancelUrl || \"https://spotsend.io?billing=cancel\",\n \"metadata[contractorId]\": contractorId || userId,\n \"metadata[userId]\": userId,\n }),\n },\n );\n const session = await sessionRes.json();\n\n return new Response(\n JSON.stringify({ url: session.url, sessionId: session.id }),\n {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // ── STRIPE: CREATE CUSTOMER + SUBSCRIPTION ──\n if (target === \"stripe-create-subscription\") {\n const { email, userId, contractorId } = await req.json();\n\n const customerRes = await fetch(\"https://api.stripe.com/v1/customers\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n email,\n \"metadata[contractorId]\": contractorId,\n \"metadata[userId]\": userId,\n }),\n });\n const customer = await customerRes.json();\n if (customer.error) {\n return new Response(JSON.stringify({ error: customer.error.message }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n const subRes = await fetch(\"https://api.stripe.com/v1/subscriptions\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n customer: customer.id,\n \"items[0][price]\": STRIPE_PRICES.platform,\n \"items[1][price]\": STRIPE_PRICES.mailer,\n \"items[2][price]\": STRIPE_PRICES.spot_bid,\n \"items[3][price]\": STRIPE_PRICES.bulk_tagged,\n \"metadata[contractorId]\": contractorId,\n \"metadata[userId]\": userId,\n payment_behavior: \"default_incomplete\",\n \"expand[]\": \"latest_invoice.payment_intent\",\n }),\n });\n const subscription = await subRes.json();\n\n await updateContractorProfile(contractorId, {\n stripe_customer_id: customer.id,\n stripe_sub_id: subscription.id,\n is_active: false,\n });\n\n return new Response(\n JSON.stringify({\n customerId: customer.id,\n subscriptionId: subscription.id,\n clientSecret: subscription.latest_invoice?.payment_intent\n ?.client_secret,\n }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n // ── STRIPE: REPORT USAGE (metered billing) ──\n // Now supports three event types + graceful skip for grandfathered accounts.\n // Logs usage_events with stripe_reported reflecting whether Stripe actually\n // accepted the report (was hardcoded false before, breaking reconciliation).\n if (target === \"stripe-report-usage\") {\n const { subscriptionId, eventType, quantity, userId, lobId } = await req\n .json();\n\n const priceMap: Record = {\n mailer_sent: STRIPE_PRICES.mailer,\n spot_bid_sent: STRIPE_PRICES.spot_bid,\n bulk_tagged_sent: STRIPE_PRICES.bulk_tagged,\n };\n\n const targetPrice = priceMap[eventType];\n const unitPrice = unitPriceFor(eventType);\n\n if (!targetPrice) {\n return new Response(\n JSON.stringify({\n error: `Unknown event_type: ${eventType}`,\n known: Object.keys(priceMap),\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // No subscription → grandfathered/trial; log and skip Stripe\n if (!subscriptionId) {\n await logUsageEvent(\n userId,\n eventType,\n quantity,\n unitPrice,\n lobId,\n false,\n );\n return new Response(\n JSON.stringify({\n success: true,\n skipped_stripe: true,\n reason: \"no subscription (grandfathered or trial)\",\n }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n const subRes = await fetch(\n `https://api.stripe.com/v1/subscriptions/${subscriptionId}`,\n { headers: { \"Authorization\": `Bearer ${STRIPE_KEY}` } },\n );\n const sub = await subRes.json();\n const items = sub.items?.data || [];\n\n const item = items.find((i: Record) =>\n (i.price as Record)?.id === targetPrice\n );\n\n if (!item) {\n // Subscription exists but missing this line item — log and skip\n await logUsageEvent(\n userId,\n eventType,\n quantity,\n unitPrice,\n lobId,\n false,\n );\n return new Response(\n JSON.stringify({\n success: true,\n skipped_stripe: true,\n reason: \"subscription missing price item\",\n expected_price: targetPrice,\n }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n const usageRes = await fetch(\n `https://api.stripe.com/v1/subscription_items/${item.id}/usage_records`,\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n quantity: String(quantity),\n timestamp: String(Math.floor(Date.now() / 1000)),\n action: \"increment\",\n }),\n },\n );\n const usage = await usageRes.json();\n const stripeOk = usageRes.ok;\n\n // Log with the *actual* outcome — true means Stripe accepted it, false\n // means we have a usage_events row to reconcile later.\n await logUsageEvent(\n userId,\n eventType,\n quantity,\n unitPrice,\n lobId,\n stripeOk,\n );\n\n // Surface failures to the caller instead of always returning success:true.\n // Front-end can now show a real error toast or queue a retry.\n if (!stripeOk) {\n return new Response(\n JSON.stringify({\n success: false,\n stripe_status: usageRes.status,\n stripe_error: usage?.error?.message ||\n \"Stripe usage_records failed\",\n usage,\n }),\n {\n status: 502,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n return new Response(JSON.stringify({ success: true, usage }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── STRIPE: BILLING PORTAL ──\n if (target === \"stripe-portal\") {\n const { customerId, returnUrl } = await req.json();\n const res = await fetch(\n \"https://api.stripe.com/v1/billing_portal/sessions\",\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n customer: customerId,\n return_url: returnUrl || \"https://spotsend.io\",\n }),\n },\n );\n const session = await res.json();\n return new Response(JSON.stringify({ url: session.url }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── REQUEST ACCESS — public landing page form submission ──\n if (target === \"request-access\") {\n if (req.method !== \"POST\") {\n return new Response(JSON.stringify({ error: \"POST only\" }), {\n status: 405,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n let body: Record = {};\n try {\n body = await req.json();\n } catch {\n body = {};\n }\n\n const fullName = String(body.full_name || \"\").trim();\n const email = String(body.email || \"\").trim().toLowerCase();\n const companyName = String(body.company_name || \"\").trim();\n\n if (!fullName || !email || !companyName) {\n return new Response(\n JSON.stringify({ error: \"Missing required fields\" }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n if (!/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {\n return new Response(JSON.stringify({ error: \"Invalid email\" }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // Honeypot — bots fill this hidden field, real humans don't\n if (body.website && String(body.website).length > 0) {\n return new Response(JSON.stringify({ ok: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n const userAgent = req.headers.get(\"user-agent\") || \"\";\n const ipHeader = req.headers.get(\"x-forwarded-for\") || \"\";\n const ip = ipHeader.split(\",\")[0]?.trim() || \"\";\n\n const row = {\n full_name: fullName.slice(0, 200),\n email: email.slice(0, 200),\n phone: body.phone ? String(body.phone).trim().slice(0, 40) : null,\n company_name: companyName.slice(0, 200),\n trade: body.trade ? String(body.trade).trim().slice(0, 60) : null,\n city: body.city ? String(body.city).trim().slice(0, 100) : null,\n state: body.state ? String(body.state).trim().slice(0, 4) : null,\n why: body.why ? String(body.why).trim().slice(0, 1000) : null,\n source: body.source\n ? String(body.source).trim().slice(0, 60)\n : \"landing\",\n user_agent: userAgent.slice(0, 300),\n ip: ip.slice(0, 60),\n };\n\n const insertRes = await fetch(`${SUPABASE_URL}/rest/v1/access_requests`, {\n method: \"POST\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal\",\n },\n body: JSON.stringify(row),\n });\n\n if (!insertRes.ok) {\n const err = await insertRes.text();\n console.error(\n \"[request-access] Supabase insert failed:\",\n insertRes.status,\n err,\n );\n return new Response(\n JSON.stringify({ error: \"Couldn't save request — try again\" }),\n {\n status: 500,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // Email admin via Resend (best-effort — failure here doesn't fail the whole request)\n const RESEND_KEY = Deno.env.get(\"RESEND_API_KEY\");\n if (RESEND_KEY) {\n try {\n const adminEmail = \"joelmwood@gmail.com\";\n const escapeHtmlInline = (s: string): string =>\n String(s || \"\").replace(\n /[&<>\"']/g,\n (\n c,\n ) => ({\n \"&\": \"&\",\n \"<\": \"<\",\n \">\": \">\",\n '\"': \""\",\n \"'\": \"'\",\n }[c]!),\n );\n const html = `\n

New SpotSend access request

\n \n \n \n \n \n \n \n \n

Name	${\n escapeHtmlInline(row.full_name)\n }
Email	${escapeHtmlInline(row.email)}
Phone	${\n escapeHtmlInline(row.phone \|\| \"—\")\n }
Company	${\n escapeHtmlInline(row.company_name)\n }
Trade	${\n escapeHtmlInline(row.trade \|\| \"—\")\n }
Location	${\n escapeHtmlInline(\n [row.city, row.state].filter(Boolean).join(\", \") \|\| \"—\",\n )\n }
Why	${\n escapeHtmlInline(row.why \|\| \"—\").replace(/\\n/g, \" \")\n }

Source: ${\n escapeHtmlInline(row.source)\n } · IP: ${escapeHtmlInline(row.ip)}

\n `;\n await fetch(\"https://api.resend.com/emails\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${RESEND_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n from: \"SpotSend \",\n to: [adminEmail],\n reply_to: row.email,\n subject:\n `[SpotSend] Access request: ${row.full_name} (${row.company_name})`,\n html,\n }),\n });\n } catch (e) {\n console.error(\"[request-access] Email failed (non-blocking):\", e);\n }\n }\n\n return new Response(JSON.stringify({ ok: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── STRIPE WEBHOOK ──\n if (target === \"stripe-webhook\") {\n const payload = await req.text();\n const sig = req.headers.get(\"stripe-signature\") || \"\";\n\n if (STRIPE_WEBHOOK && sig) {\n const parts = sig.split(\",\");\n const timestamp = parts.find((p) => p.startsWith(\"t=\"))?.slice(2) || \"\";\n const sigHash = parts.find((p) => p.startsWith(\"v1=\"))?.slice(3) || \"\";\n const signedPayload = `${timestamp}.${payload}`;\n const encoder = new TextEncoder();\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(STRIPE_WEBHOOK),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const mac = await crypto.subtle.sign(\n \"HMAC\",\n key,\n encoder.encode(signedPayload),\n );\n const expected = Array.from(new Uint8Array(mac))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n if (expected !== sigHash) {\n return new Response(\"Invalid signature\", {\n status: 400,\n headers: cors,\n });\n }\n }\n\n const event = JSON.parse(payload);\n const eventType = event.type as string;\n const data = event.data?.object as Record;\n\n if (\n eventType === \"customer.subscription.created\" ||\n eventType === \"customer.subscription.updated\"\n ) {\n const contractorId = (data?.metadata as Record)\n ?.contractorId;\n const status = data?.status as string;\n await updateContractorProfile(contractorId, {\n stripe_sub_id: data?.id as string,\n is_active: status === \"active\",\n plan: \"pro\",\n });\n }\n\n if (eventType === \"checkout.session.completed\") {\n const userId = data?.client_reference_id as string;\n const customerId = data?.customer as string;\n const contractorId =\n (data?.metadata as Record)?.contractorId || userId;\n if (contractorId) {\n await updateContractorProfile(contractorId, {\n stripe_customer_id: customerId,\n is_active: true,\n plan: \"pro\",\n });\n }\n }\n\n if (eventType === \"customer.subscription.deleted\") {\n const contractorId = (data?.metadata as Record)\n ?.contractorId;\n await updateContractorProfile(contractorId, {\n stripe_sub_id: data?.id as string,\n is_active: false,\n plan: \"cancelled\",\n });\n }\n\n if (eventType === \"invoice.payment_succeeded\") {\n const customerId = data?.customer as string;\n const contractorId = await getContractorByCustomer(customerId);\n if (contractorId) {\n await updateContractorProfile(contractorId, {\n is_active: true,\n plan: \"pro\",\n });\n }\n }\n\n if (eventType === \"invoice.payment_failed\") {\n const customerId = data?.customer as string;\n const contractorId = await getContractorByCustomer(customerId);\n if (contractorId) {\n await updateContractorProfile(contractorId, { is_active: false });\n }\n }\n\n return new Response(JSON.stringify({ received: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── LOB FILE UPLOAD ──\n if (target === \"lob-upload\") {\n const { image, filename } = await req.json();\n const binary = Uint8Array.from(atob(image), (c) => c.charCodeAt(0));\n const formData = new FormData();\n const blob = new Blob([binary], { type: \"image/jpeg\" });\n formData.append(\"file\", blob, filename || \"photo.jpg\");\n formData.append(\"description\", \"SpotSend postcard photo\");\n const res = await fetch(\"https://api.lob.com/v1/uploads\", {\n method: \"POST\",\n headers: { \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\") },\n body: formData,\n });\n const data = await res.json();\n const urlOut = data?.url || data?.signed_url || null;\n return new Response(JSON.stringify({ url: urlOut }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── LOB STATUS ──\n if (target === \"lob-status\") {\n const lobId = url.searchParams.get(\"lob_id\") || \"\";\n if (!lobId || !lobId.startsWith(\"psc_\")) {\n return new Response(\n JSON.stringify({ status: \"unknown\", error: \"Invalid lob_id\" }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n try {\n const res = await fetch(`https://api.lob.com/v1/postcards/${lobId}`, {\n headers: { \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\") },\n });\n if (!res.ok) {\n return new Response(\n JSON.stringify({\n status: \"unknown\",\n lob_status_code: res.status,\n }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n const data = await res.json();\n const events = data.tracking_events || [];\n // Normalize Lob's event name for lookup. Lob returns capitalized names like\n // \"Delivered\", \"In Local Area\", \"In Transit\". Our map keys are snake_case lowercase.\n // Without normalization, EVERY status returned \"in_transit\" (the default fallback)\n // because exact-string lookup always missed.\n const latestRaw = events[events.length - 1]?.name || \"\";\n const latest = latestRaw.toLowerCase().replace(/[\\s-]+/g, \"_\");\n const statusMap: Record = {\n \"mailed\": \"in_transit\",\n \"in_transit\": \"in_transit\",\n \"in_local_area\": \"in_local_area\",\n \"processed_for_delivery\": \"in_local_area\",\n \"out_for_delivery\": \"in_local_area\",\n \"re_routed\": \"in_transit\",\n \"rerouted\": \"in_transit\",\n \"returned_to_sender\": \"returned_to_sender\",\n \"delivered\": \"delivered\",\n \"failed\": \"failed\",\n \"rendered_failed\": \"failed\",\n };\n const status = statusMap[latest] ||\n (data.expected_delivery_date ? \"in_transit\" : \"processing\");\n return new Response(\n JSON.stringify({\n status,\n expected_delivery: data.expected_delivery_date || null,\n latest_event: latestRaw || null, // return original case for diagnostic display\n events_count: events.length,\n }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n } catch (e) {\n return new Response(\n JSON.stringify({ status: \"unknown\", error: String(e) }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n }\n\n // ── IMAGE PROXY ──\n if (target === \"proxy-image\") {\n const imageUrl = url.searchParams.get(\"url\") || \"\";\n if (!imageUrl) {\n return new Response(\"No URL\", { status: 400, headers: cors });\n }\n try {\n const res = await fetch(imageUrl, {\n headers: { \"User-Agent\": \"SpotSend/1.0 Lob-Proxy\" },\n });\n const contentType = res.headers.get(\"content-type\") || \"image/jpeg\";\n const buffer = await res.arrayBuffer();\n return new Response(buffer, {\n status: 200,\n headers: {\n ...cors,\n \"Content-Type\": contentType,\n \"Cache-Control\": \"public, max-age=86400\",\n },\n });\n } catch (_e) {\n return new Response(\"Image fetch failed\", {\n status: 500,\n headers: cors,\n });\n }\n }\n\n // ── USPS EDDM ──\n if (target === \"usps\") {\n const zip = url.searchParams.get(\"zip\") || \"74105\";\n const res = await fetch(\n `https://gis.usps.com/arcgis/rest/services/EDDM/selectZIP/GPServer/routes/execute?f=json&env:outSR=4326&ZIP=${zip}&Rte_Box=R&UserName=EDDM`,\n );\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── PERMITS ──\n if (target === \"permits\") {\n const address = url.searchParams.get(\"address\") || \"\";\n const res = await fetch(\n \"https://tulsaok-energovweb.tylerhost.net/apps/selfservice/api/CSS/permit/search\",\n {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"Accept\": \"application/json\",\n \"Referer\":\n \"https://tulsaok-energovweb.tylerhost.net/apps/selfservice\",\n \"Origin\": \"https://tulsaok-energovweb.tylerhost.net\",\n },\n body: JSON.stringify({\n address,\n permitNumber: \"\",\n permitType: \"\",\n statusCode: \"\",\n dateFrom: \"\",\n dateTo: \"\",\n pageNumber: 1,\n pageSize: 10,\n sortBy: \"IssuedDate\",\n sortDesc: true,\n }),\n },\n );\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── LOB ADDRESS VERIFY ──\n if (target === \"lob-verify\") {\n const body = await req.text();\n const res = await fetch(\"https://api.lob.com/v1/us_verifications\", {\n method: \"POST\",\n headers: {\n \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\"),\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── CLOUDINARY UPLOAD ──\n if (target === \"cloudinary-upload\") {\n // Fail fast and clearly if Cloudinary env vars haven't been set.\n // Previous version had hardcoded fallbacks — anyone reading val.town code\n // could harvest the secret. Now: missing env vars = explicit 500.\n if (!CLOUDINARY_CLOUD || !CLOUDINARY_KEY || !CLOUDINARY_SECRET) {\n return new Response(\n JSON.stringify({\n error:\n \"Cloudinary not configured on server. Set CLOUDINARY_CLOUD_NAME, CLOUDINARY_API_KEY, and CLOUDINARY_API_SECRET as environment variables.\",\n }),\n {\n status: 500,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n const { image, filename } = await req.json();\n const binary = Uint8Array.from(atob(image), (c) => c.charCodeAt(0));\n const blob = new Blob([binary], { type: \"image/jpeg\" });\n\n const timestamp = Math.floor(Date.now() / 1000).toString();\n const paramStr = `timestamp=${timestamp}`;\n const encoder = new TextEncoder();\n const msgData = encoder.encode(paramStr + CLOUDINARY_SECRET);\n const hashBuffer = await crypto.subtle.digest(\"SHA-1\", msgData);\n const signature = Array.from(new Uint8Array(hashBuffer))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n\n const formData = new FormData();\n formData.append(\"file\", blob, filename || \"spot-photo.jpg\");\n formData.append(\"api_key\", CLOUDINARY_KEY);\n formData.append(\"timestamp\", timestamp);\n formData.append(\"signature\", signature);\n\n const uploadRes = await fetch(\n `https://api.cloudinary.com/v1_1/${CLOUDINARY_CLOUD}/image/upload`,\n { method: \"POST\", body: formData },\n );\n const uploadData = await uploadRes.json();\n const urlOut = uploadData?.secure_url || null;\n return new Response(JSON.stringify({ url: urlOut }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── IMGBB UPLOAD ──\n if (target === \"imgbb\") {\n const body = await req.json();\n const formData = new FormData();\n formData.append(\"key\", IMGBB_KEY);\n formData.append(\"image\", body.image as string);\n if (body.name) formData.append(\"name\", body.name as string);\n const res = await fetch(\"https://api.imgbb.com/1/upload\", {\n method: \"POST\",\n body: formData,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── ANTHROPIC ──\n if (target === \"anthropic\") {\n const body = await req.text();\n const res = await fetch(\"https://api.anthropic.com/v1/messages\", {\n method: \"POST\",\n headers: {\n \"x-api-key\": ANTHROPIC_KEY,\n \"anthropic-version\": \"2023-06-01\",\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND CALL ──\n if (target === \"bland-call\") {\n const body = await req.text();\n const res = await fetch(\"https://api.bland.ai/v1/calls\", {\n method: \"POST\",\n headers: {\n \"authorization\": BLAND_KEY,\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND WEBHOOK (existing — outbound call completion) ──\n if (target === \"bland\") {\n const authHeader = req.headers.get(\"Authorization\") || \"\";\n if (authHeader !== \"Bearer spotsend-bland-2025\") {\n return new Response(JSON.stringify({ error: \"Unauthorized\" }), {\n status: 401,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n const body = await req.text();\n // Truncate aggressively — Bland webhooks contain full transcripts, phone numbers,\n // and customer data. Visible in val.town log dashboard otherwise.\n console.log(\"[bland-webhook] received\", body.length, \"bytes\");\n return new Response(JSON.stringify({ received: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND STATUS ──\n if (target === \"bland-status\") {\n const callId = url.searchParams.get(\"call_id\") || \"\";\n const res = await fetch(\"https://api.bland.ai/v1/calls/\" + callId, {\n headers: { \"authorization\": BLAND_KEY },\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND INBOX (NEW — inbound calls → SpotSend pipeline) ──\n // POST: Bland.AI hits this when a call hangs up. We store keyed by contractor.\n // GET ?contractor_id=X: SpotSend frontend polls every 60s. Returns + clears\n // pending calls so they don't replay.\n if (target === \"bland-inbox\") {\n if (req.method === \"POST\") {\n let payload: Record = {};\n try {\n payload = await req.json();\n } catch {\n return new Response(\n JSON.stringify({ ok: false, reason: \"invalid json\" }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // contractor_id can come from a few places depending on how you set up\n // the Bland phone number's metadata.\n const meta = (payload.metadata as Record) || {};\n const lead = (meta.lead as Record) || {};\n const contractorId = (lead.contractor_id as string) ||\n (meta.contractor_id as string) ||\n \"\";\n\n if (!contractorId) {\n return new Response(\n JSON.stringify({\n ok: false,\n reason: \"no contractor_id in metadata\",\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n const transcript = (payload.transcript as string) ||\n (payload.concatenated_transcript as string) || \"\";\n const callEntry = {\n phone: (payload.from as string) ||\n (payload.phone_number as string) || \"\",\n name: (meta.caller_name as string) ||\n (payload.summary_caller_name as string) || \"\",\n address: (meta.caller_address as string) || \"\",\n city: (meta.caller_city as string) || \"\",\n summary: (payload.summary as string) || transcript.slice(0, 500),\n ts: Date.now(),\n call_id: (payload.call_id as string) || (payload.id as string) || \"\",\n };\n\n const key = `bland_inbox_${contractorId}`;\n let inbox: unknown[] = [];\n try {\n inbox = (await blob.getJSON(key)) as unknown[] || [];\n if (!Array.isArray(inbox)) inbox = [];\n } catch {\n inbox = [];\n }\n inbox.unshift(callEntry);\n // Keep last 50 entries to bound storage\n inbox = inbox.slice(0, 50);\n await blob.setJSON(key, inbox);\n\n return new Response(JSON.stringify({ ok: true, stored: 1 }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n if (req.method === \"GET\") {\n const contractorId = url.searchParams.get(\"contractor_id\") || \"\";\n if (!contractorId) {\n return new Response(JSON.stringify({ calls: [] }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n const key = `bland_inbox_${contractorId}`;\n let inbox: unknown[] = [];\n try {\n inbox = (await blob.getJSON(key)) as unknown[] || [];\n if (!Array.isArray(inbox)) inbox = [];\n } catch {\n inbox = [];\n }\n\n // Clear after delivery so SpotSend doesn't see them twice\n if (inbox.length > 0) {\n try {\n await blob.setJSON(key, []);\n } catch { /* swallow — frontend dedupes by phone too */ }\n }\n\n return new Response(JSON.stringify({ calls: inbox }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n return new Response(\n JSON.stringify({ error: \"method not allowed\" }),\n {\n status: 405,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // ── NOAA HAIL / WIND / TORNADO OVERLAY (Field Map storm-chase mode) ──\n // GET ?days=60&state=OK&types=H,W,T&minHail=1.0&minWind=50\n // Source: Iowa State Mesonet's NWS Local Storm Reports (LSR) API. Free, no key.\n //\n // Params (all optional):\n // days 1-90 (default 60) — how many days back to fetch\n // state 2-letter state code (default OK)\n // types Comma-separated of H (hail), W (wind), T (tornado). Default: H,W,T\n // minHail Minimum hail size in inches (default 1.0). Filters hail events below threshold.\n // minWind Minimum wind speed in mph (default 50). Filters wind events below threshold.\n // Tornadoes are always included regardless of magnitude when type T is requested\n // (any tornado is significant for roofing damage).\n if (target === \"noaa-hail\") {\n const days = Math.min(\n Math.max(parseInt(url.searchParams.get(\"days\") || \"60\") || 60, 1),\n 90,\n );\n const state = (url.searchParams.get(\"state\") || \"OK\")\n .toUpperCase()\n .slice(0, 2);\n\n // Parse types — only H, W, T are valid LSR codes for our purposes\n const typesParam = (url.searchParams.get(\"types\") || \"H,W,T\")\n .toUpperCase();\n const validTypes = [\"H\", \"W\", \"T\"];\n const requestedTypes = typesParam\n .split(\",\")\n .map((t) => t.trim())\n .filter((t) => validTypes.includes(t));\n const types = requestedTypes.length > 0\n ? requestedTypes\n : [\"H\", \"W\", \"T\"];\n\n // Magnitude filters\n const minHail = parseFloat(url.searchParams.get(\"minHail\") || \"1.0\") ||\n 1.0;\n const minWind = parseFloat(url.searchParams.get(\"minWind\") || \"50\") || 50;\n\n const sts = new Date(Date.now() - days * 86400000)\n .toISOString()\n .split(\"T\")[0];\n const ets = new Date().toISOString().split(\"T\")[0];\n\n // Build LSR URL with multiple type params (LSR API accepts repeated type=X)\n const typeParams = types.map((t) => `type=${t}`).join(\"&\");\n const lsrUrl =\n `https://mesonet.agron.iastate.edu/geojson/lsr.geojson?sts=${sts}T00:00&ets=${ets}T23:59&${typeParams}&state=${state}`;\n\n try {\n const upstream = await fetch(lsrUrl);\n if (!upstream.ok) {\n return new Response(\n JSON.stringify({\n events: [],\n error: \"upstream_failed\",\n status: upstream.status,\n }),\n {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n const data = await upstream.json() as {\n features?: Array<{\n properties?: Record;\n geometry?: { coordinates?: number[] };\n }>;\n };\n\n // Map raw features → SpotSend event shape, AND apply magnitude filters\n // by event type. The LSR `type` field is a single letter (H/W/T/etc)\n // matching what we requested.\n const allEvents = (data.features || []).map((f) => {\n const props = f.properties || {};\n const coords = f.geometry?.coordinates || [];\n // LSR uses lowercase `type` for the single-letter code\n const rawType = String(props.type || \"\").toUpperCase();\n const magnitudeRaw = (props.magnitude as string | number) ||\n (props.MAG as string | number) || \"\";\n const magnitudeNum = parseFloat(String(magnitudeRaw)) || 0;\n return {\n lat: coords[1],\n lng: coords[0],\n magnitude: magnitudeRaw,\n magnitudeNum, // numeric for filtering; not sent to client\n rawType, // single-letter code for filtering; not sent\n date: (props.utc_valid as string) ||\n (props.valid as string) || \"\",\n type: (props.typetext as string) || (props.type as string) ||\n \"Storm\",\n city: (props.city as string) || \"\",\n };\n }).filter((e) => e.lat && e.lng);\n\n // Apply magnitude filters per type\n const filteredEvents = allEvents.filter((e) => {\n if (e.rawType === \"H\") return e.magnitudeNum >= minHail;\n if (e.rawType === \"W\") return e.magnitudeNum >= minWind;\n if (e.rawType === \"T\") return true; // any tornado is significant\n return true; // pass through unknown types\n }).map((e) => {\n // Strip the internal-only fields before returning to client\n const { magnitudeNum: _m, rawType: _t, ...rest } = e;\n return rest;\n });\n\n return new Response(\n JSON.stringify({\n events: filteredEvents,\n source: \"iastate_mesonet\",\n days,\n state,\n types,\n minHail,\n minWind,\n count: filteredEvents.length,\n unfiltered_count: allEvents.length,\n }),\n {\n headers: {\n \"Content-Type\": \"application/json\",\n \"Cache-Control\": \"public, max-age=900\",\n ...cors,\n },\n },\n );\n } catch (e) {\n return new Response(\n JSON.stringify({ events: [], error: String(e) }),\n {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n }\n\n // ─────────────────────────────────────────────\n // TWILIO CALL CAPTURE — Phase 1: provision, forward, log\n // ─────────────────────────────────────────────\n // Endpoints:\n // POST ?target=twilio-provision {contractorId, city, state, ownerName, personalPhone}\n // Buys a local Twilio number, configures voice webhook,\n // updates contractor_profiles. Returns {phoneNumber, phoneSid}.\n // POST ?target=twilio-release {contractorId}\n // Releases the contractor's Twilio number, clears DB columns.\n // POST ?target=twilio-voice Hit by Twilio when a call comes in to a SpotSend number.\n // Returns TwiML that s the contractor's personal phone.\n // POST ?target=twilio-call-status Hit by Twilio when the call completes. Logs to inbound_calls.\n\n const TWILIO_ACCOUNT_SID = Deno.env.get(\"TWILIO_ACCOUNT_SID\") || \"\";\n const TWILIO_AUTH_TOKEN = Deno.env.get(\"TWILIO_AUTH_TOKEN\") || \"\";\n const TWILIO_AUTH_HEADER = \"Basic \" +\n btoa(`${TWILIO_ACCOUNT_SID}:${TWILIO_AUTH_TOKEN}`);\n const PROXY_BASE_URL = `https://${\n req.headers.get(\"host\") ||\n \"joelmwood--caf3509a369b11f190f942b51c65c3df.web.val.run\"\n }`;\n\n if (target === \"twilio-provision\") {\n if (!TWILIO_ACCOUNT_SID || !TWILIO_AUTH_TOKEN) {\n return new Response(\n JSON.stringify({\n error: \"Twilio credentials not configured on server\",\n }),\n {\n status: 500,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n const { contractorId, city, state, personalPhone } = await req.json();\n if (!contractorId) {\n return new Response(JSON.stringify({ error: \"Missing contractorId\" }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n if (!personalPhone) {\n return new Response(\n JSON.stringify({\n error:\n \"Contractor has no personal phone — fill profile in Settings first\",\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n if (!city && !state) {\n return new Response(\n JSON.stringify({\n error:\n \"Need at least city or state on profile to find a local number\",\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // Step 1: Search for an available local number using Twilio's number lookup.\n // We pass inLocality and inRegion so Twilio finds any local number in the\n // contractor's city — handles cities with multiple area codes (Dallas 214/469/972).\n // VoiceEnabled=true ensures we only get numbers that can receive calls.\n const searchParams = new URLSearchParams({\n VoiceEnabled: \"true\",\n SmsEnabled: \"true\",\n });\n if (city) searchParams.set(\"InLocality\", city);\n if (state) searchParams.set(\"InRegion\", state);\n // Limit results — we only need one\n searchParams.set(\"PageSize\", \"5\");\n\n const searchUrl =\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/AvailablePhoneNumbers/US/Local.json?${searchParams}`;\n const searchRes = await fetch(searchUrl, {\n headers: { \"Authorization\": TWILIO_AUTH_HEADER },\n });\n\n if (!searchRes.ok) {\n const err = await searchRes.text();\n console.error(\n \"[twilio-provision] search failed:\",\n searchRes.status,\n err,\n );\n return new Response(\n JSON.stringify({\n error: \"Twilio search failed\",\n status: searchRes.status,\n detail: err,\n }),\n {\n status: 502,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n const searchData = await searchRes.json();\n const candidates = searchData?.available_phone_numbers || [];\n\n // Fallback: if no numbers in the contractor's locality, try just the region (state).\n // Some smaller cities have no available local inventory; state-level usually works.\n let chosenNumber = candidates[0]?.phone_number;\n if (!chosenNumber && city && state) {\n const fallbackParams = new URLSearchParams({\n VoiceEnabled: \"true\",\n SmsEnabled: \"true\",\n InRegion: state,\n PageSize: \"5\",\n });\n const fbRes = await fetch(\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/AvailablePhoneNumbers/US/Local.json?${fallbackParams}`,\n { headers: { \"Authorization\": TWILIO_AUTH_HEADER } },\n );\n if (fbRes.ok) {\n const fbData = await fbRes.json();\n chosenNumber = fbData?.available_phone_numbers?.[0]?.phone_number;\n }\n }\n\n if (!chosenNumber) {\n return new Response(\n JSON.stringify({\n error:\n \"No local Twilio numbers available — try again or contact support\",\n }),\n {\n status: 503,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // Step 2: Purchase the number with our voice + SMS webhooks + status callback wired up.\n // SmsUrl handles inbound text messages (homeowners can text the number, not just call).\n const voiceUrl =\n `${PROXY_BASE_URL}/?target=twilio-voice&contractor_id=${contractorId}`;\n const smsUrl =\n `${PROXY_BASE_URL}/?target=twilio-sms&contractor_id=${contractorId}`;\n const statusUrl =\n `${PROXY_BASE_URL}/?target=twilio-call-status&contractor_id=${contractorId}`;\n const purchaseBody = new URLSearchParams({\n PhoneNumber: chosenNumber,\n VoiceUrl: voiceUrl,\n VoiceMethod: \"POST\",\n SmsUrl: smsUrl,\n SmsMethod: \"POST\",\n StatusCallback: statusUrl,\n StatusCallbackMethod: \"POST\",\n FriendlyName: `SpotSend - ${contractorId.slice(0, 8)}`,\n });\n\n const purchaseRes = await fetch(\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/IncomingPhoneNumbers.json`,\n {\n method: \"POST\",\n headers: {\n \"Authorization\": TWILIO_AUTH_HEADER,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: purchaseBody,\n },\n );\n\n if (!purchaseRes.ok) {\n const err = await purchaseRes.text();\n console.error(\n \"[twilio-provision] purchase failed:\",\n purchaseRes.status,\n err,\n );\n return new Response(\n JSON.stringify({\n error: \"Twilio purchase failed\",\n status: purchaseRes.status,\n detail: err,\n }),\n {\n status: 502,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n const purchased = await purchaseRes.json();\n const phoneNumber = purchased.phone_number;\n const phoneSid = purchased.sid;\n\n // Step 3: Persist on contractor_profiles row.\n await updateContractorProfile(contractorId, {\n twilio_phone_number: phoneNumber,\n twilio_phone_sid: phoneSid,\n twilio_enabled: true,\n });\n\n console.log(\n `[twilio-provision] ${contractorId} → ${\n redactPhone(phoneNumber)\n } (${phoneSid})`,\n );\n return new Response(\n JSON.stringify({ ok: true, phoneNumber, phoneSid }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n if (target === \"twilio-release\") {\n const { contractorId } = await req.json();\n if (!contractorId) {\n return new Response(JSON.stringify({ error: \"Missing contractorId\" }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // Look up the SID from the contractor's profile.\n const lookupRes = await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?id=eq.${contractorId}&select=twilio_phone_sid,twilio_phone_number`,\n {\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n },\n },\n );\n const profileRows = await lookupRes.json();\n const phoneSid = profileRows?.[0]?.twilio_phone_sid;\n\n if (phoneSid) {\n // Release on Twilio. We don't fail hard if Twilio errors — clearing the DB\n // columns is more important so the contractor can re-enable. If a stuck SID\n // causes monthly billing, admin can clean up via Twilio dashboard.\n const releaseRes = await fetch(\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/IncomingPhoneNumbers/${phoneSid}.json`,\n {\n method: \"DELETE\",\n headers: { \"Authorization\": TWILIO_AUTH_HEADER },\n },\n );\n if (!releaseRes.ok) {\n console.error(\n \"[twilio-release] Twilio DELETE failed:\",\n releaseRes.status,\n await releaseRes.text(),\n );\n // Continue to clear DB anyway\n }\n }\n\n await updateContractorProfile(contractorId, {\n twilio_phone_number: null,\n twilio_phone_sid: null,\n twilio_enabled: false,\n });\n\n console.log(\n `[twilio-release] ${contractorId} → released ${phoneSid || \"(no sid)\"}`,\n );\n return new Response(JSON.stringify({ ok: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n if (target === \"twilio-voice\") {\n // Twilio hits this when a call comes in to a SpotSend number.\n // We respond with TwiML that forwards the call to the contractor's personal phone.\n // If they don't answer in 25 seconds, the call is hung up (Phase 2 will route to voicemail).\n //\n // SECURITY: validate this is actually Twilio. Without validation anyone could\n // POST here and get a TwiML response with a real phone number in it (mild\n // info leak), or hammer this endpoint to enumerate contractor IDs.\n const voiceFormData = await req.formData();\n const isValidTwilio = await validateTwilioSignature(\n req,\n TWILIO_AUTH_TOKEN,\n voiceFormData,\n );\n if (!isValidTwilio) {\n console.warn(\"[twilio-voice] signature validation failed — rejecting\");\n return new Response(\n '',\n {\n status: 403,\n headers: { \"Content-Type\": \"text/xml\", ...cors },\n },\n );\n }\n const contractorId = url.searchParams.get(\"contractor_id\") || \"\";\n let personalPhone = \"\";\n let companyName = \"your contractor\";\n\n if (contractorId) {\n const lookupRes = await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?id=eq.${contractorId}&select=phone,company_name`,\n {\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n },\n },\n );\n const rows = await lookupRes.json();\n personalPhone = rows?.[0]?.phone || \"\";\n companyName = rows?.[0]?.company_name || companyName;\n }\n\n // Strip any non-digits and ensure E.164 format. Twilio Dial wants +1XXXXXXXXXX for US.\n const digitsOnly = personalPhone.replace(/\\D/g, \"\");\n const dialNumber = digitsOnly.length === 10\n ? `+1${digitsOnly}`\n : (digitsOnly.length === 11 ? `+${digitsOnly}` : \"\");\n\n let twiml: string;\n if (!dialNumber) {\n // No phone on profile — politely tell the caller to leave a message later.\n // (Voicemail is Phase 2; for now we just hang up gracefully.)\n twiml = `\n\n Sorry, ${companyName} can not take calls right now. Please try again later.\n \n`;\n } else {\n // Dial the contractor's personal phone with timeout + record + caller ID passthrough.\n // callerId=\"\" means \"use the original caller's number\" so the contractor's phone\n // shows the actual homeowner's number, not the Twilio number. record=\"record-from-answer\"\n // captures the conversation server-side for Phase 2 transcription.\n twiml = `\n\n \n ${dialNumber}\n \n`;\n }\n\n return new Response(twiml, {\n status: 200,\n headers: { \"Content-Type\": \"text/xml\", ...cors },\n });\n }\n\n if (target === \"twilio-call-status\") {\n // Twilio fires this when a call ends. We log the call to inbound_calls.\n // Form-encoded body, not JSON.\n const contractorId = url.searchParams.get(\"contractor_id\") || \"\";\n const formData = await req.formData();\n // SECURITY: reject anything not signed by Twilio. Without this, anyone could\n // POST fake call records into inbound_calls — vandalism + skewed metrics.\n const isValidTwilio = await validateTwilioSignature(\n req,\n TWILIO_AUTH_TOKEN,\n formData,\n );\n if (!isValidTwilio) {\n console.warn(\n \"[twilio-call-status] signature validation failed — rejecting\",\n );\n return new Response(\"\", { status: 403 });\n }\n const callSid = String(formData.get(\"CallSid\") || \"\");\n const fromNum = String(formData.get(\"From\") || \"\");\n const toNum = String(formData.get(\"To\") || \"\");\n const status = String(formData.get(\"CallStatus\") || \"\");\n const duration = parseInt(String(formData.get(\"CallDuration\") || \"0\")) ||\n 0;\n // \"completed\" with non-zero duration means contractor answered.\n // \"no-answer\", \"busy\", \"failed\", \"canceled\" mean the contractor missed it.\n const answered = status === \"completed\" && duration > 0;\n\n if (!contractorId || !callSid) {\n console.warn(\"[twilio-call-status] missing contractor_id or callSid\", {\n contractorId,\n callSid,\n });\n return new Response(\"\", { status: 200 });\n }\n\n // Insert into inbound_calls. Use upsert-by-twilio_sid to handle duplicate webhook fires.\n // PostgREST `Prefer: resolution=merge-duplicates` does upsert when there's a unique key.\n const insertRes = await fetch(`${SUPABASE_URL}/rest/v1/inbound_calls`, {\n method: \"POST\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal,resolution=merge-duplicates\",\n },\n body: JSON.stringify({\n user_id: contractorId,\n twilio_sid: callSid,\n from_number: fromNum,\n to_number: toNum,\n duration_sec: duration,\n answered,\n forward_status: status,\n }),\n });\n\n if (!insertRes.ok) {\n console.error(\n \"[twilio-call-status] insert failed:\",\n insertRes.status,\n await insertRes.text(),\n );\n } else {\n console.log(\n `[twilio-call-status] ${contractorId} ${\n redactPhone(fromNum)\n } → ${status} ${duration}s`,\n );\n }\n\n return new Response(\"\", { status: 200 });\n }\n\n // ── TWILIO INBOUND SMS ──\n // Twilio hits this when an SMS comes in to a SpotSend number. We:\n // 1) log it to inbound_messages\n // 2) forward the message body to the contractor's personal phone via Twilio SMS,\n // so they see it in their normal SMS app and can reply directly to the homeowner.\n // The contractor's reply goes from their personal number, not via Twilio — simpler\n // architecture, no session map needed. Two-way proxying can be added later if needed.\n //\n // Important: Twilio expects a TwiML response to inbound SMS even if we don't reply.\n // Returning empty tells Twilio \"we got it, don't auto-reply.\"\n if (target === \"twilio-sms\") {\n const contractorId = url.searchParams.get(\"contractor_id\") || \"\";\n const formData = await req.formData();\n // SECURITY: validate signature. Without it, anyone could POST fake inbound\n // SMS to inject records and trigger contractor's outgoing SMS forward\n // (which costs us money via Twilio Messaging fees).\n const isValidTwilio = await validateTwilioSignature(\n req,\n TWILIO_AUTH_TOKEN,\n formData,\n );\n if (!isValidTwilio) {\n console.warn(\"[twilio-sms] signature validation failed — rejecting\");\n return new Response(\n '',\n {\n status: 403,\n headers: { \"Content-Type\": \"text/xml\", ...cors },\n },\n );\n }\n const messageSid = String(formData.get(\"MessageSid\") || \"\");\n const fromNum = String(formData.get(\"From\") || \"\");\n const toNum = String(formData.get(\"To\") || \"\");\n const body = String(formData.get(\"Body\") || \"\");\n\n if (!contractorId || !messageSid) {\n console.warn(\"[twilio-sms] missing contractor_id or messageSid\", {\n contractorId,\n messageSid,\n });\n return new Response(\n '',\n {\n status: 200,\n headers: { \"Content-Type\": \"text/xml\", ...cors },\n },\n );\n }\n\n // Look up contractor's personal phone for forwarding.\n let personalPhone = \"\";\n try {\n const lookupRes = await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?id=eq.${contractorId}&select=phone`,\n {\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n },\n },\n );\n const rows = await lookupRes.json();\n personalPhone = rows?.[0]?.phone || \"\";\n } catch (e) {\n console.error(\"[twilio-sms] profile lookup failed:\", e);\n }\n\n // Forward the SMS to contractor's personal phone. Format: \"From (HHH) HHH-HHHH: \"\n // so the contractor sees who texted (since the from-number on the relayed SMS\n // will be the SpotSend number, not the homeowner's).\n let forwarded = false;\n let forwardError: string | null = null;\n const digitsOnly = personalPhone.replace(/\\D/g, \"\");\n const personalE164 = digitsOnly.length === 10\n ? `+1${digitsOnly}`\n : (digitsOnly.length === 11 ? `+${digitsOnly}` : \"\");\n\n if (personalE164) {\n // Build the forwarded message. Keep it short — SMS segments are 160 chars.\n // Strip non-digits from sender for display formatting.\n const senderD = fromNum.replace(/\\D/g, \"\");\n const senderDisplay = senderD.length === 11 && senderD.startsWith(\"1\")\n ? `(${senderD.slice(1, 4)}) ${senderD.slice(4, 7)}-${\n senderD.slice(7)\n }`\n : fromNum;\n // Truncate body if too long — leave room for the prefix.\n const PREFIX = `📱 From ${senderDisplay}: `;\n const MAX_BODY = 320 - PREFIX.length; // allow up to 2 segments\n const truncatedBody = body.length > MAX_BODY\n ? body.slice(0, MAX_BODY - 3) + \"...\"\n : body;\n const forwardBody = PREFIX + truncatedBody;\n\n try {\n const sendRes = await fetch(\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/Messages.json`,\n {\n method: \"POST\",\n headers: {\n \"Authorization\": TWILIO_AUTH_HEADER,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n From: toNum, // the SpotSend number\n To: personalE164,\n Body: forwardBody,\n }),\n },\n );\n if (sendRes.ok) {\n forwarded = true;\n } else {\n const errText = await sendRes.text();\n forwardError = `${sendRes.status}: ${errText.slice(0, 200)}`;\n console.error(\"[twilio-sms] forward failed:\", forwardError);\n }\n } catch (e) {\n forwardError = String(e).slice(0, 200);\n console.error(\"[twilio-sms] forward exception:\", e);\n }\n } else {\n forwardError = \"no personal phone on profile\";\n }\n\n // Log to inbound_messages. Upsert by twilio_sid prevents duplicates from webhook retries.\n const insertRes = await fetch(\n `${SUPABASE_URL}/rest/v1/inbound_messages`,\n {\n method: \"POST\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal,resolution=merge-duplicates\",\n },\n body: JSON.stringify({\n user_id: contractorId,\n twilio_sid: messageSid,\n from_number: fromNum,\n to_number: toNum,\n body,\n forwarded,\n forward_error: forwardError,\n }),\n },\n );\n if (!insertRes.ok) {\n console.error(\n \"[twilio-sms] insert failed:\",\n insertRes.status,\n await insertRes.text(),\n );\n } else {\n console.log(\n `[twilio-sms] ${contractorId} ${redactPhone(fromNum)} → ${\n forwarded ? \"forwarded\" : \"not forwarded\"\n }: ${redactBody(body)}`,\n );\n }\n\n // Empty TwiML response — we're not auto-replying to the homeowner from here.\n return new Response('', {\n status: 200,\n headers: { \"Content-Type\": \"text/xml\", ...cors },\n });\n }\n\n // ── TWILIO RETROFIT (one-shot for existing numbers) ──\n // Numbers provisioned BEFORE the SMS handler was added don't have SmsUrl set.\n // This endpoint adds the missing webhook to an already-owned number without\n // releasing/re-buying. Call once per existing contractor that already has Twilio enabled.\n // POST {contractorId}\n if (target === \"twilio-update-webhooks\") {\n const { contractorId } = await req.json();\n if (!contractorId) {\n return new Response(JSON.stringify({ error: \"Missing contractorId\" }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // Get the SID from contractor_profiles\n const lookupRes = await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?id=eq.${contractorId}&select=twilio_phone_sid,twilio_phone_number`,\n {\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n },\n },\n );\n const rows = await lookupRes.json();\n const phoneSid = rows?.[0]?.twilio_phone_sid;\n const phoneNumber = rows?.[0]?.twilio_phone_number;\n\n if (!phoneSid) {\n return new Response(\n JSON.stringify({\n error: \"Contractor has no Twilio number — provision first\",\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // Update the number's webhooks to include SmsUrl. Twilio's API uses POST to update.\n const voiceUrl =\n `${PROXY_BASE_URL}/?target=twilio-voice&contractor_id=${contractorId}`;\n const smsUrl =\n `${PROXY_BASE_URL}/?target=twilio-sms&contractor_id=${contractorId}`;\n const statusUrl =\n `${PROXY_BASE_URL}/?target=twilio-call-status&contractor_id=${contractorId}`;\n\n const updateRes = await fetch(\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/IncomingPhoneNumbers/${phoneSid}.json`,\n {\n method: \"POST\",\n headers: {\n \"Authorization\": TWILIO_AUTH_HEADER,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n VoiceUrl: voiceUrl,\n VoiceMethod: \"POST\",\n SmsUrl: smsUrl,\n SmsMethod: \"POST\",\n StatusCallback: statusUrl,\n StatusCallbackMethod: \"POST\",\n }),\n },\n );\n\n if (!updateRes.ok) {\n const err = await updateRes.text();\n return new Response(\n JSON.stringify({\n error: \"Twilio update failed\",\n status: updateRes.status,\n detail: err,\n }),\n {\n status: 502,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n console.log(\n `[twilio-update-webhooks] ${contractorId} → updated ${\n redactPhone(phoneNumber)\n }`,\n );\n return new Response(\n JSON.stringify({\n ok: true,\n phoneNumber,\n phoneSid,\n updated: [\"VoiceUrl\", \"SmsUrl\", \"StatusCallback\"],\n }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n // ── LOB POSTCARDS (default) ──\n // Forwards the postcard create. App.jsx puts a stable idempotency string in\n // body.metadata.idempotency_key; we extract it and forward it as the actual\n // Lob `Idempotency-Key` HTTP header. Lob caches that key for 24h, so a\n // network-level retry (mid-tunnel signal loss in a contractor's truck) won't\n // create a second postcard and double-charge. The metadata field is left in\n // the body so it still shows up on the Lob dashboard as a label.\n const body = await req.text();\n let idempotencyKey = \"\";\n try {\n const parsed = JSON.parse(body);\n const k = parsed?.metadata?.idempotency_key;\n if (typeof k === \"string\" && k.length > 0 && k.length <= 256) {\n idempotencyKey = k;\n }\n } catch { /* not JSON or no metadata — fall through with no header */ }\n\n const lobHeaders: Record = {\n \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\"),\n \"Content-Type\": \"application/json\",\n };\n if (idempotencyKey) lobHeaders[\"Idempotency-Key\"] = idempotencyKey;\n\n const res = await fetch(\"https://api.lob.com/v1/postcards\", {\n method: \"POST\",\n headers: lobHeaders,\n body, // forward original unchanged\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n } catch (err) {\n return new Response(JSON.stringify({ error: (err as Error).message }), {\n status: 500,\n headers: {\n \"Content-Type\": \"application/json\",\n \"Access-Control-Allow-Origin\": \"*\",\n },\n });\n }\n}","createdAt",["D",1777508515739],"branchVersion","branchId","caf0e148-369b-11f1-90f9-42b51c65c3df","id","caefca24-369b-11f1-90f9-42b51c65c3df","spotsend",["D",1776017817773],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","e62ec099-51e2-4bfb-9f8c-fec4e5c27de6","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019d6a29-db42-727b-8046-28bb6f362a0e","tursoName","caefca24369b11f190f942b51c65c3df","tursoHostname","caefca24369b11f190f942b51c65c3df-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789499469860],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_96":95,"_103":99},"org",{"_96":95,"_97":-5,"_98":99,"_18":54,"_100":101,"_102":25},"branch",{"_13":14,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","joelmwood","handle","displayName","avatar","","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":151,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":-5,"_53":-5,"_18":54,"_55":-5,"_56":25,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":152,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":153,"_81":154,"_83":155,"_85":25},"tree",[146],"files",[146],"counts",{"_134":60,"_135":136,"_137":60,"_138":139,"_140":141},"contents",[126],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":121,"_38":130,"_13":131,"_33":34,"_35":37,"_24":25,"_132":-5,"_27":133},"982cf174-442a-11f1-bbe9-42b51c65c3df","parentId","latest",["D",1777508515739],20,"label",[28],"pulls","branches",1,"forks","envVars",{"_142":144,"_145":60},"connections",{"_142":60,"_143":60},"count","unfilledCount",10,"emptyCount",{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":121,"_38":147,"_13":131,"_33":34,"_35":37,"_24":25,"_132":-5,"_148":149,"_27":150},["D",1777508515739],"children",[],[28],["D",1776017817773],["D",1789499469860],{"_96":95,"_103":99},{"_96":95,"_97":-5,"_98":99,"_18":54,"_100":101,"_102":25},{"_13":14,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"ctx",{"_79":-5,"_123":189,"_190":191,"_192":193,"_194":25,"_195":25,"_196":25,"_197":121,"_198":-5,"_199":-7,"_200":-7,"_201":60,"_202":25,"_203":25,"_204":-5,"_205":25,"_206":25,"_207":25,"_208":-5},"ENV",{"_160":161,"_162":163,"_164":86,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v21