[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_157":158,"_159":160},"routes/_app.x.$handle.$name",{"_97":96,"_32":45,"_105":87,"_27":100,"_13":14,"_106":-5,"_11":107,"_108":109,"_110":111,"_112":113,"_114":115,"_20":-5,"_116":-5,"_117":-5,"_118":25,"_119":120,"_121":122,"_123":-5,"_124":-5,"_125":126},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":-5,"_53":-5,"_18":54,"_55":-5,"_56":25,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":25},"version",7,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","caf3509a-369b-11f1-90f9-42b51c65c3df","name","fileType","http","content","export default async function (req: Request): Promise {\n const cors = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"POST, GET, OPTIONS\",\n \"Access-Control-Allow-Headers\":\n \"Content-Type, Authorization, x-api-key, anthropic-version\",\n };\n\n if (req.method === \"OPTIONS\") {\n return new Response(null, { headers: cors });\n }\n\n // ── KEYS FROM ENVIRONMENT ──\n const STRIPE_KEY = Deno.env.get(\"STRIPE_SECRET_KEY\") || \"\";\n const STRIPE_WEBHOOK = Deno.env.get(\"STRIPE_WEBHOOK_SECRET\") || \"\";\n const SUPABASE_URL = Deno.env.get(\"SUPABASE_URL\") ||\n \"https://pzbvvohedpgeiynqoujr.supabase.co\";\n const SUPABASE_KEY = Deno.env.get(\"SUPABASE_SERVICE_KEY\") || \"\";\n const ANTHROPIC_KEY = Deno.env.get(\"ANTHROPIC_API_KEY\") || \"\";\n const BLAND_KEY = Deno.env.get(\"BLAND_API_KEY\") || \"\";\n const LOB_KEY = Deno.env.get(\"LOB_API_KEY\") || \"\";\n const IMGBB_KEY = Deno.env.get(\"IMGBB_API_KEY\") || \"\";\n\n // ── STRIPE PRICE IDs ──\n const STRIPE_PRICES = {\n platform: \"price_1TLS1sE8Fzrv1kXN8ZyBhwot\",\n mailer: \"price_1TLS4eE8Fzrv1kXNjXmul7Ie\",\n spot_bid: \"price_1TLS62E8Fzrv1kXNsvLA5tT9\",\n };\n\n // ── SUPABASE HELPER: update contractor profile ──\n async function updateContractorProfile(\n contractorId: string,\n updates: Record,\n ) {\n if (!contractorId) return;\n await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?id=eq.${contractorId}`,\n {\n method: \"PATCH\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal\",\n },\n body: JSON.stringify(updates),\n },\n );\n }\n\n // ── SUPABASE HELPER: get contractor by Stripe customer ID ──\n async function getContractorByCustomer(\n stripeCustomerId: string,\n ): Promise {\n const res = await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?stripe_customer_id=eq.${stripeCustomerId}&select=id`,\n {\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n },\n },\n );\n const rows = await res.json();\n return rows?.[0]?.id || null;\n }\n\n // ── SUPABASE HELPER: log usage event ──\n async function logUsageEvent(\n userId: string,\n eventType: string,\n quantity: number,\n unitPrice: number,\n lobId?: string,\n ) {\n await fetch(`${SUPABASE_URL}/rest/v1/usage_events`, {\n method: \"POST\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal\",\n },\n body: JSON.stringify({\n user_id: userId,\n event_type: eventType,\n quantity,\n unit_price: unitPrice,\n total: quantity * unitPrice,\n lob_id: lobId || null,\n stripe_reported: false,\n }),\n });\n }\n\n try {\n const url = new URL(req.url);\n const target = url.searchParams.get(\"target\") || \"lob\";\n\n // ── STRIPE: HOSTED CHECKOUT SESSION ──\n if (target === \"stripe-checkout\") {\n const { email, userId, contractorId, successUrl, cancelUrl } = await req\n .json();\n\n // Find existing customer or create new one\n const searchRes = await fetch(\n `https://api.stripe.com/v1/customers/search?query=email:'${\n encodeURIComponent(email)\n }'`,\n { headers: { \"Authorization\": `Bearer ${STRIPE_KEY}` } },\n );\n const searchData = await searchRes.json();\n let customerId = searchData?.data?.[0]?.id;\n\n if (!customerId) {\n const customerRes = await fetch(\"https://api.stripe.com/v1/customers\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n email,\n \"metadata[contractorId]\": contractorId || userId,\n \"metadata[userId]\": userId,\n }),\n });\n const customer = await customerRes.json();\n customerId = customer.id;\n }\n\n // Create hosted checkout session\n const sessionRes = await fetch(\n \"https://api.stripe.com/v1/checkout/sessions\",\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n customer: customerId,\n mode: \"subscription\",\n \"line_items[0][price]\": STRIPE_PRICES.platform,\n \"line_items[1][price]\": STRIPE_PRICES.spot_bid,\n client_reference_id: userId,\n success_url: successUrl || \"https://spotsend.io?billing=success\",\n cancel_url: cancelUrl || \"https://spotsend.io?billing=cancel\",\n \"metadata[contractorId]\": contractorId || userId,\n \"metadata[userId]\": userId,\n }),\n },\n );\n const session = await sessionRes.json();\n\n return new Response(\n JSON.stringify({ url: session.url, sessionId: session.id }),\n {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // ── STRIPE: CREATE CUSTOMER + SUBSCRIPTION ──\n if (target === \"stripe-create-subscription\") {\n const { email, userId, contractorId } = await req.json();\n\n const customerRes = await fetch(\"https://api.stripe.com/v1/customers\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n email,\n \"metadata[contractorId]\": contractorId,\n \"metadata[userId]\": userId,\n }),\n });\n const customer = await customerRes.json();\n if (customer.error) {\n return new Response(JSON.stringify({ error: customer.error.message }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n const subRes = await fetch(\"https://api.stripe.com/v1/subscriptions\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n customer: customer.id,\n \"items[0][price]\": STRIPE_PRICES.platform,\n \"items[1][price]\": STRIPE_PRICES.mailer,\n \"items[2][price]\": STRIPE_PRICES.spot_bid,\n \"metadata[contractorId]\": contractorId,\n \"metadata[userId]\": userId,\n payment_behavior: \"default_incomplete\",\n \"expand[]\": \"latest_invoice.payment_intent\",\n }),\n });\n const subscription = await subRes.json();\n\n await updateContractorProfile(contractorId, {\n stripe_customer_id: customer.id,\n stripe_sub_id: subscription.id,\n is_active: false,\n });\n\n return new Response(\n JSON.stringify({\n customerId: customer.id,\n subscriptionId: subscription.id,\n clientSecret: subscription.latest_invoice?.payment_intent\n ?.client_secret,\n }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n // ── STRIPE: REPORT USAGE (metered billing) ──\n if (target === \"stripe-report-usage\") {\n const { subscriptionId, eventType, quantity, userId, lobId } = await req\n .json();\n\n const subRes = await fetch(\n `https://api.stripe.com/v1/subscriptions/${subscriptionId}`,\n { headers: { \"Authorization\": `Bearer ${STRIPE_KEY}` } },\n );\n const sub = await subRes.json();\n const items = sub.items?.data || [];\n\n const priceMap: Record = {\n mailer_sent: STRIPE_PRICES.mailer,\n spot_bid_sent: STRIPE_PRICES.spot_bid,\n };\n\n const targetPrice = priceMap[eventType];\n const item = items.find((i: Record) =>\n (i.price as Record)?.id === targetPrice\n );\n\n if (!item) {\n return new Response(\n JSON.stringify({ error: \"Subscription item not found\" }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n const usageRes = await fetch(\n `https://api.stripe.com/v1/subscription_items/${item.id}/usage_records`,\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n quantity: String(quantity),\n timestamp: String(Math.floor(Date.now() / 1000)),\n action: \"increment\",\n }),\n },\n );\n const usage = await usageRes.json();\n\n const unitPrice = eventType === \"spot_bid_sent\" ? 1.75 : 0.82;\n await logUsageEvent(userId, eventType, quantity, unitPrice, lobId);\n\n return new Response(JSON.stringify({ success: true, usage }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── STRIPE: BILLING PORTAL ──\n if (target === \"stripe-portal\") {\n const { customerId, returnUrl } = await req.json();\n const res = await fetch(\n \"https://api.stripe.com/v1/billing_portal/sessions\",\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n customer: customerId,\n return_url: returnUrl || \"https://spotsend.io\",\n }),\n },\n );\n const session = await res.json();\n return new Response(JSON.stringify({ url: session.url }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── STRIPE WEBHOOK ──\n if (target === \"stripe-webhook\") {\n const payload = await req.text();\n const sig = req.headers.get(\"stripe-signature\") || \"\";\n\n if (STRIPE_WEBHOOK && sig) {\n const parts = sig.split(\",\");\n const timestamp = parts.find((p) => p.startsWith(\"t=\"))?.slice(2) || \"\";\n const sigHash = parts.find((p) => p.startsWith(\"v1=\"))?.slice(3) || \"\";\n const signedPayload = `${timestamp}.${payload}`;\n const encoder = new TextEncoder();\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(STRIPE_WEBHOOK),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const mac = await crypto.subtle.sign(\n \"HMAC\",\n key,\n encoder.encode(signedPayload),\n );\n const expected = Array.from(new Uint8Array(mac))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n if (expected !== sigHash) {\n return new Response(\"Invalid signature\", {\n status: 400,\n headers: cors,\n });\n }\n }\n\n const event = JSON.parse(payload);\n const eventType = event.type as string;\n const data = event.data?.object as Record;\n\n if (\n eventType === \"customer.subscription.created\" ||\n eventType === \"customer.subscription.updated\"\n ) {\n const contractorId = (data?.metadata as Record)\n ?.contractorId;\n const status = data?.status as string;\n await updateContractorProfile(contractorId, {\n stripe_sub_id: data?.id as string,\n is_active: status === \"active\",\n plan: \"spotsend\",\n });\n }\n\n if (eventType === \"checkout.session.completed\") {\n const userId = data?.client_reference_id as string;\n const customerId = data?.customer as string;\n const contractorId =\n (data?.metadata as Record)?.contractorId || userId;\n if (contractorId) {\n await updateContractorProfile(contractorId, {\n stripe_customer_id: customerId,\n is_active: true,\n plan: \"spotsend\",\n });\n }\n }\n\n if (eventType === \"customer.subscription.deleted\") {\n const contractorId = (data?.metadata as Record)\n ?.contractorId;\n await updateContractorProfile(contractorId, {\n stripe_sub_id: data?.id as string,\n is_active: false,\n plan: \"cancelled\",\n });\n }\n\n if (eventType === \"invoice.payment_succeeded\") {\n const customerId = data?.customer as string;\n const contractorId = await getContractorByCustomer(customerId);\n if (contractorId) {\n await updateContractorProfile(contractorId, {\n is_active: true,\n plan: \"spotsend\",\n });\n }\n }\n\n if (eventType === \"invoice.payment_failed\") {\n const customerId = data?.customer as string;\n const contractorId = await getContractorByCustomer(customerId);\n if (contractorId) {\n await updateContractorProfile(contractorId, { is_active: false });\n }\n }\n\n if (eventType === \"invoice.created\") {\n console.log(\"Invoice created for customer:\", data?.customer);\n }\n\n if (eventType === \"invoice.sent\") {\n console.log(\"Invoice emailed to customer:\", data?.customer_email);\n }\n\n return new Response(JSON.stringify({ received: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── USPS EDDM ──\n if (target === \"usps\") {\n const zip = url.searchParams.get(\"zip\") || \"74105\";\n const res = await fetch(\n `https://gis.usps.com/arcgis/rest/services/EDDM/selectZIP/GPServer/routes/execute?f=json&env:outSR=4326&ZIP=${zip}&Rte_Box=R&UserName=EDDM`,\n );\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── PERMITS ──\n if (target === \"permits\") {\n const address = url.searchParams.get(\"address\") || \"\";\n const res = await fetch(\n \"https://tulsaok-energovweb.tylerhost.net/apps/selfservice/api/CSS/permit/search\",\n {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"Accept\": \"application/json\",\n \"Referer\":\n \"https://tulsaok-energovweb.tylerhost.net/apps/selfservice\",\n \"Origin\": \"https://tulsaok-energovweb.tylerhost.net\",\n },\n body: JSON.stringify({\n address,\n permitNumber: \"\",\n permitType: \"\",\n statusCode: \"\",\n dateFrom: \"\",\n dateTo: \"\",\n pageNumber: 1,\n pageSize: 10,\n sortBy: \"IssuedDate\",\n sortDesc: true,\n }),\n },\n );\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── LOB ADDRESS VERIFY ──\n if (target === \"lob-verify\") {\n const body = await req.text();\n const res = await fetch(\"https://api.lob.com/v1/us_verifications\", {\n method: \"POST\",\n headers: {\n \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\"),\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── IMGBB PHOTO UPLOAD ──\n if (target === \"imgbb\") {\n const body = await req.json();\n const formData = new FormData();\n formData.append(\"key\", IMGBB_KEY);\n formData.append(\"image\", body.image as string);\n if (body.name) formData.append(\"name\", body.name as string);\n const res = await fetch(\"https://api.imgbb.com/1/upload\", {\n method: \"POST\",\n body: formData,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── ANTHROPIC AI ──\n if (target === \"anthropic\") {\n const body = await req.text();\n const res = await fetch(\"https://api.anthropic.com/v1/messages\", {\n method: \"POST\",\n headers: {\n \"x-api-key\": ANTHROPIC_KEY,\n \"anthropic-version\": \"2023-06-01\",\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND AI CALL ──\n if (target === \"bland-call\") {\n const body = await req.text();\n const res = await fetch(\"https://api.bland.ai/v1/calls\", {\n method: \"POST\",\n headers: {\n \"authorization\": BLAND_KEY,\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND WEBHOOK ──\n if (target === \"bland\") {\n const authHeader = req.headers.get(\"Authorization\") || \"\";\n if (authHeader !== \"Bearer spotsend-bland-2025\") {\n return new Response(JSON.stringify({ error: \"Unauthorized\" }), {\n status: 401,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n const body = await req.text();\n console.log(\"Bland webhook received:\", body);\n return new Response(JSON.stringify({ received: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND STATUS ──\n if (target === \"bland-status\") {\n const callId = url.searchParams.get(\"call_id\") || \"\";\n const res = await fetch(\"https://api.bland.ai/v1/calls/\" + callId, {\n headers: { \"authorization\": BLAND_KEY },\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── LOB POSTCARDS (default) ──\n const body = await req.text();\n const res = await fetch(\"https://api.lob.com/v1/postcards\", {\n method: \"POST\",\n headers: {\n \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\"),\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n } catch (err) {\n return new Response(JSON.stringify({ error: (err as Error).message }), {\n status: 500,\n headers: {\n \"Content-Type\": \"application/json\",\n \"Access-Control-Allow-Origin\": \"*\",\n },\n });\n }\n}","export default async function (req: Request): Promise {\n const cors = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"POST, GET, OPTIONS\",\n \"Access-Control-Allow-Headers\":\n \"Content-Type, Authorization, x-api-key, anthropic-version\",\n };\n\n if (req.method === \"OPTIONS\") {\n return new Response(null, { headers: cors });\n }\n\n // ── KEYS FROM ENVIRONMENT ──\n const STRIPE_KEY = Deno.env.get(\"STRIPE_SECRET_KEY\") || \"\";\n const STRIPE_WEBHOOK = Deno.env.get(\"STRIPE_WEBHOOK_SECRET\") || \"\";\n const SUPABASE_URL = Deno.env.get(\"SUPABASE_URL\") ||\n \"https://pzbvvohedpgeiynqoujr.supabase.co\";\n const SUPABASE_KEY = Deno.env.get(\"SUPABASE_SERVICE_KEY\") || \"\";\n const ANTHROPIC_KEY = Deno.env.get(\"ANTHROPIC_API_KEY\") || \"\";\n const BLAND_KEY = Deno.env.get(\"BLAND_API_KEY\") || \"\";\n const LOB_KEY = Deno.env.get(\"LOB_API_KEY\") || \"\";\n const IMGBB_KEY = Deno.env.get(\"IMGBB_API_KEY\") || \"\";\n\n // ── STRIPE PRICE IDs ──\n const STRIPE_PRICES = {\n platform: \"price_1TLS1sE8Fzrv1kXN8ZyBhwot\",\n mailer: \"price_1TLS4eE8Fzrv1kXNjXmul7Ie\",\n spot_bid: \"price_1TLS62E8Fzrv1kXNsvLA5tT9\",\n };\n\n // ── SUPABASE HELPER: update contractor profile ──\n async function updateContractorProfile(\n contractorId: string,\n updates: Record,\n ) {\n if (!contractorId) return;\n await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?id=eq.${contractorId}`,\n {\n method: \"PATCH\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal\",\n },\n body: JSON.stringify(updates),\n },\n );\n }\n\n // ── SUPABASE HELPER: get contractor by Stripe customer ID ──\n async function getContractorByCustomer(\n stripeCustomerId: string,\n ): Promise {\n const res = await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?stripe_customer_id=eq.${stripeCustomerId}&select=id`,\n {\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n },\n },\n );\n const rows = await res.json();\n return rows?.[0]?.id || null;\n }\n\n // ── SUPABASE HELPER: log usage event ──\n async function logUsageEvent(\n userId: string,\n eventType: string,\n quantity: number,\n unitPrice: number,\n lobId?: string,\n ) {\n await fetch(`${SUPABASE_URL}/rest/v1/usage_events`, {\n method: \"POST\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal\",\n },\n body: JSON.stringify({\n user_id: userId,\n event_type: eventType,\n quantity,\n unit_price: unitPrice,\n total: quantity * unitPrice,\n lob_id: lobId || null,\n stripe_reported: false,\n }),\n });\n }\n\n try {\n const url = new URL(req.url);\n const target = url.searchParams.get(\"target\") || \"lob\";\n\n // ── STRIPE: HOSTED CHECKOUT SESSION ──\n if (target === \"stripe-checkout\") {\n const { email, userId, contractorId, successUrl, cancelUrl } = await req\n .json();\n\n // Find existing customer or create new one\n const searchRes = await fetch(\n `https://api.stripe.com/v1/customers/search?query=email:'${\n encodeURIComponent(email)\n }'`,\n { headers: { \"Authorization\": `Bearer ${STRIPE_KEY}` } },\n );\n const searchData = await searchRes.json();\n let customerId = searchData?.data?.[0]?.id;\n\n if (!customerId) {\n const customerRes = await fetch(\"https://api.stripe.com/v1/customers\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n email,\n \"metadata[contractorId]\": contractorId || userId,\n \"metadata[userId]\": userId,\n }),\n });\n const customer = await customerRes.json();\n customerId = customer.id;\n }\n\n // Create hosted checkout session\n const sessionRes = await fetch(\n \"https://api.stripe.com/v1/checkout/sessions\",\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n customer: customerId,\n mode: \"subscription\",\n \"line_items[0][price]\": STRIPE_PRICES.platform,\n \"line_items[1][price]\": STRIPE_PRICES.spot_bid,\n client_reference_id: userId,\n success_url: successUrl || \"https://spotsend.io?billing=success\",\n cancel_url: cancelUrl || \"https://spotsend.io?billing=cancel\",\n \"metadata[contractorId]\": contractorId || userId,\n \"metadata[userId]\": userId,\n }),\n },\n );\n const session = await sessionRes.json();\n\n return new Response(\n JSON.stringify({ url: session.url, sessionId: session.id }),\n {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // ── STRIPE: CREATE CUSTOMER + SUBSCRIPTION ──\n if (target === \"stripe-create-subscription\") {\n const { email, userId, contractorId } = await req.json();\n\n const customerRes = await fetch(\"https://api.stripe.com/v1/customers\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n email,\n \"metadata[contractorId]\": contractorId,\n \"metadata[userId]\": userId,\n }),\n });\n const customer = await customerRes.json();\n if (customer.error) {\n return new Response(JSON.stringify({ error: customer.error.message }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n const subRes = await fetch(\"https://api.stripe.com/v1/subscriptions\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n customer: customer.id,\n \"items[0][price]\": STRIPE_PRICES.platform,\n \"items[1][price]\": STRIPE_PRICES.mailer,\n \"items[2][price]\": STRIPE_PRICES.spot_bid,\n \"metadata[contractorId]\": contractorId,\n \"metadata[userId]\": userId,\n payment_behavior: \"default_incomplete\",\n \"expand[]\": \"latest_invoice.payment_intent\",\n }),\n });\n const subscription = await subRes.json();\n\n await updateContractorProfile(contractorId, {\n stripe_customer_id: customer.id,\n stripe_sub_id: subscription.id,\n is_active: false,\n });\n\n return new Response(\n JSON.stringify({\n customerId: customer.id,\n subscriptionId: subscription.id,\n clientSecret: subscription.latest_invoice?.payment_intent\n ?.client_secret,\n }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n // ── STRIPE: REPORT USAGE (metered billing) ──\n if (target === \"stripe-report-usage\") {\n const { subscriptionId, eventType, quantity, userId, lobId } = await req\n .json();\n\n const subRes = await fetch(\n `https://api.stripe.com/v1/subscriptions/${subscriptionId}`,\n { headers: { \"Authorization\": `Bearer ${STRIPE_KEY}` } },\n );\n const sub = await subRes.json();\n const items = sub.items?.data || [];\n\n const priceMap: Record = {\n mailer_sent: STRIPE_PRICES.mailer,\n spot_bid_sent: STRIPE_PRICES.spot_bid,\n };\n\n const targetPrice = priceMap[eventType];\n const item = items.find((i: Record) =>\n (i.price as Record)?.id === targetPrice\n );\n\n if (!item) {\n return new Response(\n JSON.stringify({ error: \"Subscription item not found\" }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n const usageRes = await fetch(\n `https://api.stripe.com/v1/subscription_items/${item.id}/usage_records`,\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n quantity: String(quantity),\n timestamp: String(Math.floor(Date.now() / 1000)),\n action: \"increment\",\n }),\n },\n );\n const usage = await usageRes.json();\n\n const unitPrice = eventType === \"spot_bid_sent\" ? 1.75 : 0.82;\n await logUsageEvent(userId, eventType, quantity, unitPrice, lobId);\n\n return new Response(JSON.stringify({ success: true, usage }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── STRIPE: BILLING PORTAL ──\n if (target === \"stripe-portal\") {\n const { customerId, returnUrl } = await req.json();\n const res = await fetch(\n \"https://api.stripe.com/v1/billing_portal/sessions\",\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${STRIPE_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n customer: customerId,\n return_url: returnUrl || \"https://spotsend.io\",\n }),\n },\n );\n const session = await res.json();\n return new Response(JSON.stringify({ url: session.url }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── STRIPE WEBHOOK ──\n if (target === \"stripe-webhook\") {\n const payload = await req.text();\n const sig = req.headers.get(\"stripe-signature\") || \"\";\n\n if (STRIPE_WEBHOOK && sig) {\n const parts = sig.split(\",\");\n const timestamp = parts.find((p) => p.startsWith(\"t=\"))?.slice(2) || \"\";\n const sigHash = parts.find((p) => p.startsWith(\"v1=\"))?.slice(3) || \"\";\n const signedPayload = `${timestamp}.${payload}`;\n const encoder = new TextEncoder();\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(STRIPE_WEBHOOK),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const mac = await crypto.subtle.sign(\n \"HMAC\",\n key,\n encoder.encode(signedPayload),\n );\n const expected = Array.from(new Uint8Array(mac))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n if (expected !== sigHash) {\n return new Response(\"Invalid signature\", {\n status: 400,\n headers: cors,\n });\n }\n }\n\n const event = JSON.parse(payload);\n const eventType = event.type as string;\n const data = event.data?.object as Record;\n\n if (\n eventType === \"customer.subscription.created\" ||\n eventType === \"customer.subscription.updated\"\n ) {\n const contractorId = (data?.metadata as Record)\n ?.contractorId;\n const status = data?.status as string;\n await updateContractorProfile(contractorId, {\n stripe_sub_id: data?.id as string,\n is_active: status === \"active\",\n plan: \"spotsend\",\n });\n }\n\n if (eventType === \"checkout.session.completed\") {\n const userId = data?.client_reference_id as string;\n const customerId = data?.customer as string;\n const contractorId =\n (data?.metadata as Record)?.contractorId || userId;\n if (contractorId) {\n await updateContractorProfile(contractorId, {\n stripe_customer_id: customerId,\n is_active: true,\n plan: \"spotsend\",\n });\n }\n }\n\n if (eventType === \"customer.subscription.deleted\") {\n const contractorId = (data?.metadata as Record)\n ?.contractorId;\n await updateContractorProfile(contractorId, {\n stripe_sub_id: data?.id as string,\n is_active: false,\n plan: \"cancelled\",\n });\n }\n\n if (eventType === \"invoice.payment_succeeded\") {\n const customerId = data?.customer as string;\n const contractorId = await getContractorByCustomer(customerId);\n if (contractorId) {\n await updateContractorProfile(contractorId, {\n is_active: true,\n plan: \"spotsend\",\n });\n }\n }\n\n if (eventType === \"invoice.payment_failed\") {\n const customerId = data?.customer as string;\n const contractorId = await getContractorByCustomer(customerId);\n if (contractorId) {\n await updateContractorProfile(contractorId, { is_active: false });\n }\n }\n\n if (eventType === \"invoice.created\") {\n console.log(\"Invoice created for customer:\", data?.customer);\n }\n\n if (eventType === \"invoice.sent\") {\n console.log(\"Invoice emailed to customer:\", data?.customer_email);\n }\n\n return new Response(JSON.stringify({ received: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── IMAGE PROXY (for Lob renderer to fetch external images) ──\n if (target === \"proxy-image\") {\n const imageUrl = url.searchParams.get(\"url\") || \"\";\n if (!imageUrl) {\n return new Response(\"No URL\", { status: 400, headers: cors });\n }\n try {\n const res = await fetch(imageUrl, {\n headers: { \"User-Agent\": \"SpotSend/1.0 Lob-Proxy\" },\n });\n const contentType = res.headers.get(\"content-type\") || \"image/jpeg\";\n const buffer = await res.arrayBuffer();\n return new Response(buffer, {\n status: 200,\n headers: {\n ...cors,\n \"Content-Type\": contentType,\n \"Cache-Control\": \"public, max-age=86400\",\n },\n });\n } catch (e) {\n return new Response(\"Image fetch failed\", {\n status: 500,\n headers: cors,\n });\n }\n }\n\n // ── USPS EDDM ──\n if (target === \"usps\") {\n const zip = url.searchParams.get(\"zip\") || \"74105\";\n const res = await fetch(\n `https://gis.usps.com/arcgis/rest/services/EDDM/selectZIP/GPServer/routes/execute?f=json&env:outSR=4326&ZIP=${zip}&Rte_Box=R&UserName=EDDM`,\n );\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── PERMITS ──\n if (target === \"permits\") {\n const address = url.searchParams.get(\"address\") || \"\";\n const res = await fetch(\n \"https://tulsaok-energovweb.tylerhost.net/apps/selfservice/api/CSS/permit/search\",\n {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"Accept\": \"application/json\",\n \"Referer\":\n \"https://tulsaok-energovweb.tylerhost.net/apps/selfservice\",\n \"Origin\": \"https://tulsaok-energovweb.tylerhost.net\",\n },\n body: JSON.stringify({\n address,\n permitNumber: \"\",\n permitType: \"\",\n statusCode: \"\",\n dateFrom: \"\",\n dateTo: \"\",\n pageNumber: 1,\n pageSize: 10,\n sortBy: \"IssuedDate\",\n sortDesc: true,\n }),\n },\n );\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── LOB ADDRESS VERIFY ──\n if (target === \"lob-verify\") {\n const body = await req.text();\n const res = await fetch(\"https://api.lob.com/v1/us_verifications\", {\n method: \"POST\",\n headers: {\n \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\"),\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── IMGBB PHOTO UPLOAD ──\n if (target === \"imgbb\") {\n const body = await req.json();\n const formData = new FormData();\n formData.append(\"key\", IMGBB_KEY);\n formData.append(\"image\", body.image as string);\n if (body.name) formData.append(\"name\", body.name as string);\n const res = await fetch(\"https://api.imgbb.com/1/upload\", {\n method: \"POST\",\n body: formData,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── ANTHROPIC AI ──\n if (target === \"anthropic\") {\n const body = await req.text();\n const res = await fetch(\"https://api.anthropic.com/v1/messages\", {\n method: \"POST\",\n headers: {\n \"x-api-key\": ANTHROPIC_KEY,\n \"anthropic-version\": \"2023-06-01\",\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND AI CALL ──\n if (target === \"bland-call\") {\n const body = await req.text();\n const res = await fetch(\"https://api.bland.ai/v1/calls\", {\n method: \"POST\",\n headers: {\n \"authorization\": BLAND_KEY,\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND WEBHOOK ──\n if (target === \"bland\") {\n const authHeader = req.headers.get(\"Authorization\") || \"\";\n if (authHeader !== \"Bearer spotsend-bland-2025\") {\n return new Response(JSON.stringify({ error: \"Unauthorized\" }), {\n status: 401,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n const body = await req.text();\n console.log(\"Bland webhook received:\", body);\n return new Response(JSON.stringify({ received: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND STATUS ──\n if (target === \"bland-status\") {\n const callId = url.searchParams.get(\"call_id\") || \"\";\n const res = await fetch(\"https://api.bland.ai/v1/calls/\" + callId, {\n headers: { \"authorization\": BLAND_KEY },\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── LOB POSTCARDS (default) ──\n const body = await req.text();\n const res = await fetch(\"https://api.lob.com/v1/postcards\", {\n method: \"POST\",\n headers: {\n \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\"),\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n } catch (err) {\n return new Response(JSON.stringify({ error: (err as Error).message }), {\n status: 500,\n headers: {\n \"Content-Type\": \"application/json\",\n \"Access-Control-Allow-Origin\": \"*\",\n },\n });\n }\n}","createdAt",["D",1776483962196],"branchVersion","branchId","caf0e148-369b-11f1-90f9-42b51c65c3df","id","caefca24-369b-11f1-90f9-42b51c65c3df","spotsend",["D",1776017817773],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","e62ec099-51e2-4bfb-9f8c-fec4e5c27de6","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019d6a29-db42-727b-8046-28bb6f362a0e","tursoName","caefca24369b11f190f942b51c65c3df","tursoHostname","caefca24369b11f190f942b51c65c3df-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789499469860],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_97":96,"_104":100},"org",{"_97":96,"_98":-5,"_99":100,"_18":54,"_101":102,"_103":25},"branch",{"_13":86,"_32":87,"_43":42,"_88":44,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":45,"_95":96},"isOwned",21,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","joelmwood","handle","displayName","avatar","","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":152,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":-5,"_53":-5,"_18":54,"_55":-5,"_56":25,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":153,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":154,"_81":155,"_83":156,"_85":25},"tree",[147],"files",[147],"counts",{"_135":60,"_136":137,"_138":60,"_139":140,"_141":142},"contents",[127],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":128,"_32":28,"_30":31,"_129":-5,"_41":42,"_40":14,"_130":25,"_38":131,"_13":132,"_33":34,"_35":37,"_24":25,"_133":-5,"_27":134},"1eadd3ae-3ad9-11f1-9c3b-42b51c65c3df","parentId","latest",["D",1776483962196],6,"label",[28],"pulls","branches",1,"forks","envVars",{"_143":145,"_146":60},"connections",{"_143":60,"_144":60},"count","unfilledCount",10,"emptyCount",{"_43":128,"_32":28,"_30":31,"_129":-5,"_41":42,"_40":14,"_130":25,"_38":148,"_13":132,"_33":34,"_35":37,"_24":25,"_133":-5,"_149":150,"_27":151},["D",1776483962196],"children",[],[28],["D",1776017817773],["D",1789499469860],{"_97":96,"_104":100},{"_97":96,"_98":-5,"_99":100,"_18":54,"_101":102,"_103":25},{"_13":86,"_32":87,"_43":42,"_88":44,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":45,"_95":96},"ctx",{"_79":-5,"_124":190,"_191":192,"_193":194,"_195":25,"_196":25,"_197":25,"_198":122,"_199":-5,"_200":-7,"_201":-7,"_202":60,"_203":25,"_204":25,"_205":-5,"_206":25,"_207":25,"_208":25,"_209":-5},"ENV",{"_161":162,"_163":164,"_165":87,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v7