New SpotSend access request

\n \n \n \n \n \n \n \n \n

Name	${\n escapeHtmlInline(row.full_name)\n }
Email	${escapeHtmlInline(row.email)}
Phone	${\n escapeHtmlInline(row.phone \|\| \"—\")\n }
Company	${\n escapeHtmlInline(row.company_name)\n }
Trade	${\n escapeHtmlInline(row.trade \|\| \"—\")\n }
Location	${\n escapeHtmlInline(\n [row.city, row.state].filter(Boolean).join(\", \") \|\| \"—\",\n )\n }
Why	${\n escapeHtmlInline(row.why \|\| \"—\").replace(/\\n/g, \" \")\n }

Source: ${\n escapeHtmlInline(row.source)\n } · IP: ${escapeHtmlInline(row.ip)}

\n `;\n await fetch(\"https://api.resend.com/emails\", {\n method: \"POST\",\n headers: {\n \"Authorization\": `Bearer ${RESEND_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n from: \"SpotSend \",\n to: [adminEmail],\n reply_to: row.email,\n subject:\n `[SpotSend] Access request: ${row.full_name} (${row.company_name})`,\n html,\n }),\n });\n } catch (e) {\n console.error(\"[request-access] Email failed (non-blocking):\", e);\n }\n }\n\n return new Response(JSON.stringify({ ok: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── STRIPE WEBHOOK ──\n if (target === \"stripe-webhook\") {\n const payload = await req.text();\n const sig = req.headers.get(\"stripe-signature\") || \"\";\n\n if (STRIPE_WEBHOOK && sig) {\n const parts = sig.split(\",\");\n const timestamp = parts.find((p) => p.startsWith(\"t=\"))?.slice(2) || \"\";\n const sigHash = parts.find((p) => p.startsWith(\"v1=\"))?.slice(3) || \"\";\n const signedPayload = `${timestamp}.${payload}`;\n const encoder = new TextEncoder();\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(STRIPE_WEBHOOK),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const mac = await crypto.subtle.sign(\n \"HMAC\",\n key,\n encoder.encode(signedPayload),\n );\n const expected = Array.from(new Uint8Array(mac))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n if (expected !== sigHash) {\n return new Response(\"Invalid signature\", {\n status: 400,\n headers: cors,\n });\n }\n }\n\n const event = JSON.parse(payload);\n const eventType = event.type as string;\n const data = event.data?.object as Record;\n\n if (\n eventType === \"customer.subscription.created\" ||\n eventType === \"customer.subscription.updated\"\n ) {\n const contractorId = (data?.metadata as Record)\n ?.contractorId;\n const status = data?.status as string;\n await updateContractorProfile(contractorId, {\n stripe_sub_id: data?.id as string,\n is_active: status === \"active\",\n plan: \"pro\",\n });\n }\n\n if (eventType === \"checkout.session.completed\") {\n const userId = data?.client_reference_id as string;\n const customerId = data?.customer as string;\n const contractorId =\n (data?.metadata as Record)?.contractorId || userId;\n if (contractorId) {\n await updateContractorProfile(contractorId, {\n stripe_customer_id: customerId,\n is_active: true,\n plan: \"pro\",\n });\n }\n }\n\n if (eventType === \"customer.subscription.deleted\") {\n const contractorId = (data?.metadata as Record)\n ?.contractorId;\n await updateContractorProfile(contractorId, {\n stripe_sub_id: data?.id as string,\n is_active: false,\n plan: \"cancelled\",\n });\n }\n\n if (eventType === \"invoice.payment_succeeded\") {\n const customerId = data?.customer as string;\n const contractorId = await getContractorByCustomer(customerId);\n if (contractorId) {\n await updateContractorProfile(contractorId, {\n is_active: true,\n plan: \"pro\",\n });\n }\n }\n\n if (eventType === \"invoice.payment_failed\") {\n const customerId = data?.customer as string;\n const contractorId = await getContractorByCustomer(customerId);\n if (contractorId) {\n await updateContractorProfile(contractorId, { is_active: false });\n }\n }\n\n return new Response(JSON.stringify({ received: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── LOB FILE UPLOAD ──\n if (target === \"lob-upload\") {\n const { image, filename } = await req.json();\n const binary = Uint8Array.from(atob(image), (c) => c.charCodeAt(0));\n const formData = new FormData();\n const blob = new Blob([binary], { type: \"image/jpeg\" });\n formData.append(\"file\", blob, filename || \"photo.jpg\");\n formData.append(\"description\", \"SpotSend postcard photo\");\n const res = await fetch(\"https://api.lob.com/v1/uploads\", {\n method: \"POST\",\n headers: { \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\") },\n body: formData,\n });\n const data = await res.json();\n const urlOut = data?.url || data?.signed_url || null;\n return new Response(JSON.stringify({ url: urlOut }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── LOB STATUS ──\n if (target === \"lob-status\") {\n const lobId = url.searchParams.get(\"lob_id\") || \"\";\n if (!lobId || !lobId.startsWith(\"psc_\")) {\n return new Response(\n JSON.stringify({ status: \"unknown\", error: \"Invalid lob_id\" }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n try {\n const res = await fetch(`https://api.lob.com/v1/postcards/${lobId}`, {\n headers: { \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\") },\n });\n if (!res.ok) {\n return new Response(\n JSON.stringify({\n status: \"unknown\",\n lob_status_code: res.status,\n }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n const data = await res.json();\n const events = data.tracking_events || [];\n // Normalize Lob's event name for lookup. Lob returns capitalized names like\n // \"Delivered\", \"In Local Area\", \"In Transit\". Our map keys are snake_case lowercase.\n // Without normalization, EVERY status returned \"in_transit\" (the default fallback)\n // because exact-string lookup always missed.\n const latestRaw = events[events.length - 1]?.name || \"\";\n const latest = latestRaw.toLowerCase().replace(/[\\s-]+/g, \"_\");\n const statusMap: Record = {\n \"mailed\": \"in_transit\",\n \"in_transit\": \"in_transit\",\n \"in_local_area\": \"in_local_area\",\n \"processed_for_delivery\": \"in_local_area\",\n \"out_for_delivery\": \"in_local_area\",\n \"re_routed\": \"in_transit\",\n \"rerouted\": \"in_transit\",\n \"returned_to_sender\": \"returned_to_sender\",\n \"delivered\": \"delivered\",\n \"failed\": \"failed\",\n \"rendered_failed\": \"failed\",\n };\n const status = statusMap[latest] ||\n (data.expected_delivery_date ? \"in_transit\" : \"processing\");\n return new Response(\n JSON.stringify({\n status,\n expected_delivery: data.expected_delivery_date || null,\n latest_event: latestRaw || null, // return original case for diagnostic display\n events_count: events.length,\n }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n } catch (e) {\n return new Response(\n JSON.stringify({ status: \"unknown\", error: String(e) }),\n {\n status: 200,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n }\n\n // ── IMAGE PROXY ──\n if (target === \"proxy-image\") {\n const imageUrl = url.searchParams.get(\"url\") || \"\";\n if (!imageUrl) {\n return new Response(\"No URL\", { status: 400, headers: cors });\n }\n try {\n const res = await fetch(imageUrl, {\n headers: { \"User-Agent\": \"SpotSend/1.0 Lob-Proxy\" },\n });\n const contentType = res.headers.get(\"content-type\") || \"image/jpeg\";\n const buffer = await res.arrayBuffer();\n return new Response(buffer, {\n status: 200,\n headers: {\n ...cors,\n \"Content-Type\": contentType,\n \"Cache-Control\": \"public, max-age=86400\",\n },\n });\n } catch (_e) {\n return new Response(\"Image fetch failed\", {\n status: 500,\n headers: cors,\n });\n }\n }\n\n // ── USPS EDDM ──\n if (target === \"usps\") {\n const zip = url.searchParams.get(\"zip\") || \"74105\";\n const res = await fetch(\n `https://gis.usps.com/arcgis/rest/services/EDDM/selectZIP/GPServer/routes/execute?f=json&env:outSR=4326&ZIP=${zip}&Rte_Box=R&UserName=EDDM`,\n );\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── PERMITS ──\n if (target === \"permits\") {\n const address = url.searchParams.get(\"address\") || \"\";\n const res = await fetch(\n \"https://tulsaok-energovweb.tylerhost.net/apps/selfservice/api/CSS/permit/search\",\n {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"Accept\": \"application/json\",\n \"Referer\":\n \"https://tulsaok-energovweb.tylerhost.net/apps/selfservice\",\n \"Origin\": \"https://tulsaok-energovweb.tylerhost.net\",\n },\n body: JSON.stringify({\n address,\n permitNumber: \"\",\n permitType: \"\",\n statusCode: \"\",\n dateFrom: \"\",\n dateTo: \"\",\n pageNumber: 1,\n pageSize: 10,\n sortBy: \"IssuedDate\",\n sortDesc: true,\n }),\n },\n );\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── LOB ADDRESS VERIFY ──\n if (target === \"lob-verify\") {\n const body = await req.text();\n const res = await fetch(\"https://api.lob.com/v1/us_verifications\", {\n method: \"POST\",\n headers: {\n \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\"),\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── CLOUDINARY UPLOAD ──\n if (target === \"cloudinary-upload\") {\n // Fail fast and clearly if Cloudinary env vars haven't been set.\n // Previous version had hardcoded fallbacks — anyone reading val.town code\n // could harvest the secret. Now: missing env vars = explicit 500.\n if (!CLOUDINARY_CLOUD || !CLOUDINARY_KEY || !CLOUDINARY_SECRET) {\n return new Response(\n JSON.stringify({\n error:\n \"Cloudinary not configured on server. Set CLOUDINARY_CLOUD_NAME, CLOUDINARY_API_KEY, and CLOUDINARY_API_SECRET as environment variables.\",\n }),\n {\n status: 500,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n const { image, filename } = await req.json();\n const binary = Uint8Array.from(atob(image), (c) => c.charCodeAt(0));\n const blob = new Blob([binary], { type: \"image/jpeg\" });\n\n const timestamp = Math.floor(Date.now() / 1000).toString();\n const paramStr = `timestamp=${timestamp}`;\n const encoder = new TextEncoder();\n const msgData = encoder.encode(paramStr + CLOUDINARY_SECRET);\n const hashBuffer = await crypto.subtle.digest(\"SHA-1\", msgData);\n const signature = Array.from(new Uint8Array(hashBuffer))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n\n const formData = new FormData();\n formData.append(\"file\", blob, filename || \"spot-photo.jpg\");\n formData.append(\"api_key\", CLOUDINARY_KEY);\n formData.append(\"timestamp\", timestamp);\n formData.append(\"signature\", signature);\n\n const uploadRes = await fetch(\n `https://api.cloudinary.com/v1_1/${CLOUDINARY_CLOUD}/image/upload`,\n { method: \"POST\", body: formData },\n );\n const uploadData = await uploadRes.json();\n const urlOut = uploadData?.secure_url || null;\n return new Response(JSON.stringify({ url: urlOut }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── IMGBB UPLOAD ──\n if (target === \"imgbb\") {\n const body = await req.json();\n const formData = new FormData();\n formData.append(\"key\", IMGBB_KEY);\n formData.append(\"image\", body.image as string);\n if (body.name) formData.append(\"name\", body.name as string);\n const res = await fetch(\"https://api.imgbb.com/1/upload\", {\n method: \"POST\",\n body: formData,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── ANTHROPIC ──\n if (target === \"anthropic\") {\n const body = await req.text();\n const res = await fetch(\"https://api.anthropic.com/v1/messages\", {\n method: \"POST\",\n headers: {\n \"x-api-key\": ANTHROPIC_KEY,\n \"anthropic-version\": \"2023-06-01\",\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND CALL ──\n if (target === \"bland-call\") {\n const body = await req.text();\n const res = await fetch(\"https://api.bland.ai/v1/calls\", {\n method: \"POST\",\n headers: {\n \"authorization\": BLAND_KEY,\n \"Content-Type\": \"application/json\",\n },\n body,\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND WEBHOOK (existing — outbound call completion) ──\n if (target === \"bland\") {\n const authHeader = req.headers.get(\"Authorization\") || \"\";\n if (authHeader !== \"Bearer spotsend-bland-2025\") {\n return new Response(JSON.stringify({ error: \"Unauthorized\" }), {\n status: 401,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n const body = await req.text();\n // Truncate aggressively — Bland webhooks contain full transcripts, phone numbers,\n // and customer data. Visible in val.town log dashboard otherwise.\n console.log(\"[bland-webhook] received\", body.length, \"bytes\");\n return new Response(JSON.stringify({ received: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND STATUS ──\n if (target === \"bland-status\") {\n const callId = url.searchParams.get(\"call_id\") || \"\";\n const res = await fetch(\"https://api.bland.ai/v1/calls/\" + callId, {\n headers: { \"authorization\": BLAND_KEY },\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // ── BLAND INBOX (NEW — inbound calls → SpotSend pipeline) ──\n // POST: Bland.AI hits this when a call hangs up. We store keyed by contractor.\n // GET ?contractor_id=X: SpotSend frontend polls every 60s. Returns + clears\n // pending calls so they don't replay.\n if (target === \"bland-inbox\") {\n if (req.method === \"POST\") {\n let payload: Record = {};\n try {\n payload = await req.json();\n } catch {\n return new Response(\n JSON.stringify({ ok: false, reason: \"invalid json\" }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // contractor_id can come from a few places depending on how you set up\n // the Bland phone number's metadata.\n const meta = (payload.metadata as Record) || {};\n const lead = (meta.lead as Record) || {};\n const contractorId = (lead.contractor_id as string) ||\n (meta.contractor_id as string) ||\n \"\";\n\n if (!contractorId) {\n return new Response(\n JSON.stringify({\n ok: false,\n reason: \"no contractor_id in metadata\",\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n const transcript = (payload.transcript as string) ||\n (payload.concatenated_transcript as string) || \"\";\n const callEntry = {\n phone: (payload.from as string) ||\n (payload.phone_number as string) || \"\",\n name: (meta.caller_name as string) ||\n (payload.summary_caller_name as string) || \"\",\n address: (meta.caller_address as string) || \"\",\n city: (meta.caller_city as string) || \"\",\n summary: (payload.summary as string) || transcript.slice(0, 500),\n ts: Date.now(),\n call_id: (payload.call_id as string) || (payload.id as string) || \"\",\n };\n\n const key = `bland_inbox_${contractorId}`;\n let inbox: unknown[] = [];\n try {\n inbox = (await blob.getJSON(key)) as unknown[] || [];\n if (!Array.isArray(inbox)) inbox = [];\n } catch {\n inbox = [];\n }\n inbox.unshift(callEntry);\n // Keep last 50 entries to bound storage\n inbox = inbox.slice(0, 50);\n await blob.setJSON(key, inbox);\n\n return new Response(JSON.stringify({ ok: true, stored: 1 }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n if (req.method === \"GET\") {\n const contractorId = url.searchParams.get(\"contractor_id\") || \"\";\n if (!contractorId) {\n return new Response(JSON.stringify({ calls: [] }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n const key = `bland_inbox_${contractorId}`;\n let inbox: unknown[] = [];\n try {\n inbox = (await blob.getJSON(key)) as unknown[] || [];\n if (!Array.isArray(inbox)) inbox = [];\n } catch {\n inbox = [];\n }\n\n // Clear after delivery so SpotSend doesn't see them twice\n if (inbox.length > 0) {\n try {\n await blob.setJSON(key, []);\n } catch { /* swallow — frontend dedupes by phone too */ }\n }\n\n return new Response(JSON.stringify({ calls: inbox }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n return new Response(\n JSON.stringify({ error: \"method not allowed\" }),\n {\n status: 405,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // ── NOAA HAIL / WIND / TORNADO OVERLAY (Field Map storm-chase mode) ──\n // GET ?days=60&state=OK&types=H,W,T&minHail=1.0&minWind=50\n // Source: Iowa State Mesonet's NWS Local Storm Reports (LSR) API. Free, no key.\n //\n // Params (all optional):\n // days 1-90 (default 60) — how many days back to fetch\n // state 2-letter state code (default OK)\n // types Comma-separated of H (hail), W (wind), T (tornado). Default: H,W,T\n // minHail Minimum hail size in inches (default 1.0). Filters hail events below threshold.\n // minWind Minimum wind speed in mph (default 50). Filters wind events below threshold.\n // Tornadoes are always included regardless of magnitude when type T is requested\n // (any tornado is significant for roofing damage).\n if (target === \"noaa-hail\") {\n const days = Math.min(\n Math.max(parseInt(url.searchParams.get(\"days\") || \"60\") || 60, 1),\n 90,\n );\n const state = (url.searchParams.get(\"state\") || \"OK\")\n .toUpperCase()\n .slice(0, 2);\n\n // Parse types — only H, W, T are valid LSR codes for our purposes\n const typesParam = (url.searchParams.get(\"types\") || \"H,W,T\")\n .toUpperCase();\n const validTypes = [\"H\", \"W\", \"T\"];\n const requestedTypes = typesParam\n .split(\",\")\n .map((t) => t.trim())\n .filter((t) => validTypes.includes(t));\n const types = requestedTypes.length > 0\n ? requestedTypes\n : [\"H\", \"W\", \"T\"];\n\n // Magnitude filters\n const minHail = parseFloat(url.searchParams.get(\"minHail\") || \"1.0\") ||\n 1.0;\n const minWind = parseFloat(url.searchParams.get(\"minWind\") || \"50\") || 50;\n\n const sts = new Date(Date.now() - days * 86400000)\n .toISOString()\n .split(\"T\")[0];\n const ets = new Date().toISOString().split(\"T\")[0];\n\n // Build LSR URL with multiple type params (LSR API accepts repeated type=X)\n const typeParams = types.map((t) => `type=${t}`).join(\"&\");\n const lsrUrl =\n `https://mesonet.agron.iastate.edu/geojson/lsr.geojson?sts=${sts}T00:00&ets=${ets}T23:59&${typeParams}&state=${state}`;\n\n try {\n const upstream = await fetch(lsrUrl);\n if (!upstream.ok) {\n return new Response(\n JSON.stringify({\n events: [],\n error: \"upstream_failed\",\n status: upstream.status,\n }),\n {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n const data = await upstream.json() as {\n features?: Array<{\n properties?: Record;\n geometry?: { coordinates?: number[] };\n }>;\n };\n\n // Map raw features → SpotSend event shape, AND apply magnitude filters\n // by event type. The LSR `type` field is a single letter (H/W/T/etc)\n // matching what we requested.\n const allEvents = (data.features || []).map((f) => {\n const props = f.properties || {};\n const coords = f.geometry?.coordinates || [];\n // LSR uses lowercase `type` for the single-letter code\n const rawType = String(props.type || \"\").toUpperCase();\n const magnitudeRaw = (props.magnitude as string | number) ||\n (props.MAG as string | number) || \"\";\n const magnitudeNum = parseFloat(String(magnitudeRaw)) || 0;\n return {\n lat: coords[1],\n lng: coords[0],\n magnitude: magnitudeRaw,\n magnitudeNum, // numeric for filtering; not sent to client\n rawType, // single-letter code for filtering; not sent\n date: (props.utc_valid as string) ||\n (props.valid as string) || \"\",\n type: (props.typetext as string) || (props.type as string) ||\n \"Storm\",\n city: (props.city as string) || \"\",\n };\n }).filter((e) => e.lat && e.lng);\n\n // Apply magnitude filters per type\n const filteredEvents = allEvents.filter((e) => {\n if (e.rawType === \"H\") return e.magnitudeNum >= minHail;\n if (e.rawType === \"W\") return e.magnitudeNum >= minWind;\n if (e.rawType === \"T\") return true; // any tornado is significant\n return true; // pass through unknown types\n }).map((e) => {\n // Strip the internal-only fields before returning to client\n const { magnitudeNum: _m, rawType: _t, ...rest } = e;\n return rest;\n });\n\n return new Response(\n JSON.stringify({\n events: filteredEvents,\n source: \"iastate_mesonet\",\n days,\n state,\n types,\n minHail,\n minWind,\n count: filteredEvents.length,\n unfiltered_count: allEvents.length,\n }),\n {\n headers: {\n \"Content-Type\": \"application/json\",\n \"Cache-Control\": \"public, max-age=900\",\n ...cors,\n },\n },\n );\n } catch (e) {\n return new Response(\n JSON.stringify({ events: [], error: String(e) }),\n {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n }\n\n // ─────────────────────────────────────────────\n // TWILIO CALL CAPTURE — Phase 1: provision, forward, log\n // ─────────────────────────────────────────────\n // Endpoints:\n // POST ?target=twilio-provision {contractorId, city, state, ownerName, personalPhone}\n // Buys a local Twilio number, configures voice webhook,\n // updates contractor_profiles. Returns {phoneNumber, phoneSid}.\n // POST ?target=twilio-release {contractorId}\n // Releases the contractor's Twilio number, clears DB columns.\n // POST ?target=twilio-voice Hit by Twilio when a call comes in to a SpotSend number.\n // Returns TwiML that s the contractor's personal phone.\n // POST ?target=twilio-call-status Hit by Twilio when the call completes. Logs to inbound_calls.\n\n const TWILIO_ACCOUNT_SID = Deno.env.get(\"TWILIO_ACCOUNT_SID\") || \"\";\n const TWILIO_AUTH_TOKEN = Deno.env.get(\"TWILIO_AUTH_TOKEN\") || \"\";\n const TWILIO_AUTH_HEADER = \"Basic \" +\n btoa(`${TWILIO_ACCOUNT_SID}:${TWILIO_AUTH_TOKEN}`);\n const PROXY_BASE_URL = `https://${\n req.headers.get(\"host\") ||\n \"joelmwood--caf3509a369b11f190f942b51c65c3df.web.val.run\"\n }`;\n\n if (target === \"twilio-provision\") {\n if (!TWILIO_ACCOUNT_SID || !TWILIO_AUTH_TOKEN) {\n return new Response(\n JSON.stringify({\n error: \"Twilio credentials not configured on server\",\n }),\n {\n status: 500,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n const { contractorId, city, state, personalPhone } = await req.json();\n if (!contractorId) {\n return new Response(JSON.stringify({ error: \"Missing contractorId\" }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n if (!personalPhone) {\n return new Response(\n JSON.stringify({\n error:\n \"Contractor has no personal phone — fill profile in Settings first\",\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n if (!city && !state) {\n return new Response(\n JSON.stringify({\n error:\n \"Need at least city or state on profile to find a local number\",\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // Step 1: Search for an available local number using Twilio's number lookup.\n // We pass inLocality and inRegion so Twilio finds any local number in the\n // contractor's city — handles cities with multiple area codes (Dallas 214/469/972).\n // VoiceEnabled=true ensures we only get numbers that can receive calls.\n const searchParams = new URLSearchParams({\n VoiceEnabled: \"true\",\n SmsEnabled: \"true\",\n });\n if (city) searchParams.set(\"InLocality\", city);\n if (state) searchParams.set(\"InRegion\", state);\n // Limit results — we only need one\n searchParams.set(\"PageSize\", \"5\");\n\n const searchUrl =\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/AvailablePhoneNumbers/US/Local.json?${searchParams}`;\n const searchRes = await fetch(searchUrl, {\n headers: { \"Authorization\": TWILIO_AUTH_HEADER },\n });\n\n if (!searchRes.ok) {\n const err = await searchRes.text();\n console.error(\n \"[twilio-provision] search failed:\",\n searchRes.status,\n err,\n );\n return new Response(\n JSON.stringify({\n error: \"Twilio search failed\",\n status: searchRes.status,\n detail: err,\n }),\n {\n status: 502,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n const searchData = await searchRes.json();\n const candidates = searchData?.available_phone_numbers || [];\n\n // Fallback: if no numbers in the contractor's locality, try just the region (state).\n // Some smaller cities have no available local inventory; state-level usually works.\n let chosenNumber = candidates[0]?.phone_number;\n if (!chosenNumber && city && state) {\n const fallbackParams = new URLSearchParams({\n VoiceEnabled: \"true\",\n SmsEnabled: \"true\",\n InRegion: state,\n PageSize: \"5\",\n });\n const fbRes = await fetch(\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/AvailablePhoneNumbers/US/Local.json?${fallbackParams}`,\n { headers: { \"Authorization\": TWILIO_AUTH_HEADER } },\n );\n if (fbRes.ok) {\n const fbData = await fbRes.json();\n chosenNumber = fbData?.available_phone_numbers?.[0]?.phone_number;\n }\n }\n\n if (!chosenNumber) {\n return new Response(\n JSON.stringify({\n error:\n \"No local Twilio numbers available — try again or contact support\",\n }),\n {\n status: 503,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // Step 2: Purchase the number with our voice + SMS webhooks + status callback wired up.\n // SmsUrl handles inbound text messages (homeowners can text the number, not just call).\n const voiceUrl =\n `${PROXY_BASE_URL}/?target=twilio-voice&contractor_id=${contractorId}`;\n const smsUrl =\n `${PROXY_BASE_URL}/?target=twilio-sms&contractor_id=${contractorId}`;\n const statusUrl =\n `${PROXY_BASE_URL}/?target=twilio-call-status&contractor_id=${contractorId}`;\n const purchaseBody = new URLSearchParams({\n PhoneNumber: chosenNumber,\n VoiceUrl: voiceUrl,\n VoiceMethod: \"POST\",\n SmsUrl: smsUrl,\n SmsMethod: \"POST\",\n StatusCallback: statusUrl,\n StatusCallbackMethod: \"POST\",\n FriendlyName: `SpotSend - ${contractorId.slice(0, 8)}`,\n });\n\n const purchaseRes = await fetch(\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/IncomingPhoneNumbers.json`,\n {\n method: \"POST\",\n headers: {\n \"Authorization\": TWILIO_AUTH_HEADER,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: purchaseBody,\n },\n );\n\n if (!purchaseRes.ok) {\n const err = await purchaseRes.text();\n console.error(\n \"[twilio-provision] purchase failed:\",\n purchaseRes.status,\n err,\n );\n return new Response(\n JSON.stringify({\n error: \"Twilio purchase failed\",\n status: purchaseRes.status,\n detail: err,\n }),\n {\n status: 502,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n const purchased = await purchaseRes.json();\n const phoneNumber = purchased.phone_number;\n const phoneSid = purchased.sid;\n\n // Step 3: Persist on contractor_profiles row.\n await updateContractorProfile(contractorId, {\n twilio_phone_number: phoneNumber,\n twilio_phone_sid: phoneSid,\n twilio_enabled: true,\n });\n\n console.log(\n `[twilio-provision] ${contractorId} → ${\n redactPhone(phoneNumber)\n } (${phoneSid})`,\n );\n return new Response(\n JSON.stringify({ ok: true, phoneNumber, phoneSid }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n if (target === \"twilio-release\") {\n const { contractorId } = await req.json();\n if (!contractorId) {\n return new Response(JSON.stringify({ error: \"Missing contractorId\" }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // Look up the SID from the contractor's profile.\n const lookupRes = await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?id=eq.${contractorId}&select=twilio_phone_sid,twilio_phone_number`,\n {\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n },\n },\n );\n const profileRows = await lookupRes.json();\n const phoneSid = profileRows?.[0]?.twilio_phone_sid;\n\n if (phoneSid) {\n // Release on Twilio. We don't fail hard if Twilio errors — clearing the DB\n // columns is more important so the contractor can re-enable. If a stuck SID\n // causes monthly billing, admin can clean up via Twilio dashboard.\n const releaseRes = await fetch(\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/IncomingPhoneNumbers/${phoneSid}.json`,\n {\n method: \"DELETE\",\n headers: { \"Authorization\": TWILIO_AUTH_HEADER },\n },\n );\n if (!releaseRes.ok) {\n console.error(\n \"[twilio-release] Twilio DELETE failed:\",\n releaseRes.status,\n await releaseRes.text(),\n );\n // Continue to clear DB anyway\n }\n }\n\n await updateContractorProfile(contractorId, {\n twilio_phone_number: null,\n twilio_phone_sid: null,\n twilio_enabled: false,\n });\n\n console.log(\n `[twilio-release] ${contractorId} → released ${phoneSid || \"(no sid)\"}`,\n );\n return new Response(JSON.stringify({ ok: true }), {\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n if (target === \"twilio-voice\") {\n // Twilio hits this when a call comes in to a SpotSend number.\n // We respond with TwiML that forwards the call to the contractor's personal phone.\n // If they don't answer in 25 seconds, the call is hung up (Phase 2 will route to voicemail).\n //\n // SECURITY: validate this is actually Twilio. Without validation anyone could\n // POST here and get a TwiML response with a real phone number in it (mild\n // info leak), or hammer this endpoint to enumerate contractor IDs.\n const voiceFormData = await req.formData();\n const isValidTwilio = await validateTwilioSignature(\n req,\n TWILIO_AUTH_TOKEN,\n voiceFormData,\n );\n if (!isValidTwilio) {\n console.warn(\"[twilio-voice] signature validation failed — rejecting\");\n return new Response(\n '',\n {\n status: 403,\n headers: { \"Content-Type\": \"text/xml\", ...cors },\n },\n );\n }\n const contractorId = url.searchParams.get(\"contractor_id\") || \"\";\n let personalPhone = \"\";\n let companyName = \"your contractor\";\n\n if (contractorId) {\n const lookupRes = await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?id=eq.${contractorId}&select=phone,company_name`,\n {\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n },\n },\n );\n const rows = await lookupRes.json();\n personalPhone = rows?.[0]?.phone || \"\";\n companyName = rows?.[0]?.company_name || companyName;\n }\n\n // Strip any non-digits and ensure E.164 format. Twilio Dial wants +1XXXXXXXXXX for US.\n const digitsOnly = personalPhone.replace(/\\D/g, \"\");\n const dialNumber = digitsOnly.length === 10\n ? `+1${digitsOnly}`\n : (digitsOnly.length === 11 ? `+${digitsOnly}` : \"\");\n\n let twiml: string;\n if (!dialNumber) {\n // No phone on profile — politely tell the caller to leave a message later.\n // (Voicemail is Phase 2; for now we just hang up gracefully.)\n twiml = `\n\n Sorry, ${companyName} can not take calls right now. Please try again later.\n \n`;\n } else {\n // Dial the contractor's personal phone with timeout + record + caller ID passthrough.\n // callerId=\"\" means \"use the original caller's number\" so the contractor's phone\n // shows the actual homeowner's number, not the Twilio number. record=\"record-from-answer\"\n // captures the conversation server-side for Phase 2 transcription.\n twiml = `\n\n \n ${dialNumber}\n \n`;\n }\n\n return new Response(twiml, {\n status: 200,\n headers: { \"Content-Type\": \"text/xml\", ...cors },\n });\n }\n\n if (target === \"twilio-call-status\") {\n // Twilio fires this when a call ends. We log the call to inbound_calls.\n // Form-encoded body, not JSON.\n const contractorId = url.searchParams.get(\"contractor_id\") || \"\";\n const formData = await req.formData();\n // SECURITY: reject anything not signed by Twilio. Without this, anyone could\n // POST fake call records into inbound_calls — vandalism + skewed metrics.\n const isValidTwilio = await validateTwilioSignature(\n req,\n TWILIO_AUTH_TOKEN,\n formData,\n );\n if (!isValidTwilio) {\n console.warn(\n \"[twilio-call-status] signature validation failed — rejecting\",\n );\n return new Response(\"\", { status: 403 });\n }\n const callSid = String(formData.get(\"CallSid\") || \"\");\n const fromNum = String(formData.get(\"From\") || \"\");\n const toNum = String(formData.get(\"To\") || \"\");\n const status = String(formData.get(\"CallStatus\") || \"\");\n const duration = parseInt(String(formData.get(\"CallDuration\") || \"0\")) ||\n 0;\n // \"completed\" with non-zero duration means contractor answered.\n // \"no-answer\", \"busy\", \"failed\", \"canceled\" mean the contractor missed it.\n const answered = status === \"completed\" && duration > 0;\n\n if (!contractorId || !callSid) {\n console.warn(\"[twilio-call-status] missing contractor_id or callSid\", {\n contractorId,\n callSid,\n });\n return new Response(\"\", { status: 200 });\n }\n\n // Insert into inbound_calls. Use upsert-by-twilio_sid to handle duplicate webhook fires.\n // PostgREST `Prefer: resolution=merge-duplicates` does upsert when there's a unique key.\n const insertRes = await fetch(`${SUPABASE_URL}/rest/v1/inbound_calls`, {\n method: \"POST\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal,resolution=merge-duplicates\",\n },\n body: JSON.stringify({\n user_id: contractorId,\n twilio_sid: callSid,\n from_number: fromNum,\n to_number: toNum,\n duration_sec: duration,\n answered,\n forward_status: status,\n }),\n });\n\n if (!insertRes.ok) {\n console.error(\n \"[twilio-call-status] insert failed:\",\n insertRes.status,\n await insertRes.text(),\n );\n } else {\n console.log(\n `[twilio-call-status] ${contractorId} ${\n redactPhone(fromNum)\n } → ${status} ${duration}s`,\n );\n }\n\n return new Response(\"\", { status: 200 });\n }\n\n // ── TWILIO INBOUND SMS ──\n // Twilio hits this when an SMS comes in to a SpotSend number. We:\n // 1) log it to inbound_messages\n // 2) forward the message body to the contractor's personal phone via Twilio SMS,\n // so they see it in their normal SMS app and can reply directly to the homeowner.\n // The contractor's reply goes from their personal number, not via Twilio — simpler\n // architecture, no session map needed. Two-way proxying can be added later if needed.\n //\n // Important: Twilio expects a TwiML response to inbound SMS even if we don't reply.\n // Returning empty tells Twilio \"we got it, don't auto-reply.\"\n if (target === \"twilio-sms\") {\n const contractorId = url.searchParams.get(\"contractor_id\") || \"\";\n const formData = await req.formData();\n // SECURITY: validate signature. Without it, anyone could POST fake inbound\n // SMS to inject records and trigger contractor's outgoing SMS forward\n // (which costs us money via Twilio Messaging fees).\n const isValidTwilio = await validateTwilioSignature(\n req,\n TWILIO_AUTH_TOKEN,\n formData,\n );\n if (!isValidTwilio) {\n console.warn(\"[twilio-sms] signature validation failed — rejecting\");\n return new Response(\n '',\n {\n status: 403,\n headers: { \"Content-Type\": \"text/xml\", ...cors },\n },\n );\n }\n const messageSid = String(formData.get(\"MessageSid\") || \"\");\n const fromNum = String(formData.get(\"From\") || \"\");\n const toNum = String(formData.get(\"To\") || \"\");\n const body = String(formData.get(\"Body\") || \"\");\n\n if (!contractorId || !messageSid) {\n console.warn(\"[twilio-sms] missing contractor_id or messageSid\", {\n contractorId,\n messageSid,\n });\n return new Response(\n '',\n {\n status: 200,\n headers: { \"Content-Type\": \"text/xml\", ...cors },\n },\n );\n }\n\n // Look up contractor's personal phone for forwarding.\n let personalPhone = \"\";\n try {\n const lookupRes = await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?id=eq.${contractorId}&select=phone`,\n {\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n },\n },\n );\n const rows = await lookupRes.json();\n personalPhone = rows?.[0]?.phone || \"\";\n } catch (e) {\n console.error(\"[twilio-sms] profile lookup failed:\", e);\n }\n\n // Forward the SMS to contractor's personal phone. Format: \"From (HHH) HHH-HHHH: \"\n // so the contractor sees who texted (since the from-number on the relayed SMS\n // will be the SpotSend number, not the homeowner's).\n let forwarded = false;\n let forwardError: string | null = null;\n const digitsOnly = personalPhone.replace(/\\D/g, \"\");\n const personalE164 = digitsOnly.length === 10\n ? `+1${digitsOnly}`\n : (digitsOnly.length === 11 ? `+${digitsOnly}` : \"\");\n\n if (personalE164) {\n // Build the forwarded message. Keep it short — SMS segments are 160 chars.\n // Strip non-digits from sender for display formatting.\n const senderD = fromNum.replace(/\\D/g, \"\");\n const senderDisplay = senderD.length === 11 && senderD.startsWith(\"1\")\n ? `(${senderD.slice(1, 4)}) ${senderD.slice(4, 7)}-${\n senderD.slice(7)\n }`\n : fromNum;\n // Truncate body if too long — leave room for the prefix.\n const PREFIX = `📱 From ${senderDisplay}: `;\n const MAX_BODY = 320 - PREFIX.length; // allow up to 2 segments\n const truncatedBody = body.length > MAX_BODY\n ? body.slice(0, MAX_BODY - 3) + \"...\"\n : body;\n const forwardBody = PREFIX + truncatedBody;\n\n try {\n const sendRes = await fetch(\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/Messages.json`,\n {\n method: \"POST\",\n headers: {\n \"Authorization\": TWILIO_AUTH_HEADER,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n From: toNum, // the SpotSend number\n To: personalE164,\n Body: forwardBody,\n }),\n },\n );\n if (sendRes.ok) {\n forwarded = true;\n } else {\n const errText = await sendRes.text();\n forwardError = `${sendRes.status}: ${errText.slice(0, 200)}`;\n console.error(\"[twilio-sms] forward failed:\", forwardError);\n }\n } catch (e) {\n forwardError = String(e).slice(0, 200);\n console.error(\"[twilio-sms] forward exception:\", e);\n }\n } else {\n forwardError = \"no personal phone on profile\";\n }\n\n // Log to inbound_messages. Upsert by twilio_sid prevents duplicates from webhook retries.\n const insertRes = await fetch(\n `${SUPABASE_URL}/rest/v1/inbound_messages`,\n {\n method: \"POST\",\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n \"Content-Type\": \"application/json\",\n \"Prefer\": \"return=minimal,resolution=merge-duplicates\",\n },\n body: JSON.stringify({\n user_id: contractorId,\n twilio_sid: messageSid,\n from_number: fromNum,\n to_number: toNum,\n body,\n forwarded,\n forward_error: forwardError,\n }),\n },\n );\n if (!insertRes.ok) {\n console.error(\n \"[twilio-sms] insert failed:\",\n insertRes.status,\n await insertRes.text(),\n );\n } else {\n console.log(\n `[twilio-sms] ${contractorId} ${redactPhone(fromNum)} → ${\n forwarded ? \"forwarded\" : \"not forwarded\"\n }: ${redactBody(body)}`,\n );\n }\n\n // Empty TwiML response — we're not auto-replying to the homeowner from here.\n return new Response('', {\n status: 200,\n headers: { \"Content-Type\": \"text/xml\", ...cors },\n });\n }\n\n // ── TWILIO RETROFIT (one-shot for existing numbers) ──\n // Numbers provisioned BEFORE the SMS handler was added don't have SmsUrl set.\n // This endpoint adds the missing webhook to an already-owned number without\n // releasing/re-buying. Call once per existing contractor that already has Twilio enabled.\n // POST {contractorId}\n if (target === \"twilio-update-webhooks\") {\n const { contractorId } = await req.json();\n if (!contractorId) {\n return new Response(JSON.stringify({ error: \"Missing contractorId\" }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n }\n\n // Get the SID from contractor_profiles\n const lookupRes = await fetch(\n `${SUPABASE_URL}/rest/v1/contractor_profiles?id=eq.${contractorId}&select=twilio_phone_sid,twilio_phone_number`,\n {\n headers: {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": `Bearer ${SUPABASE_KEY}`,\n },\n },\n );\n const rows = await lookupRes.json();\n const phoneSid = rows?.[0]?.twilio_phone_sid;\n const phoneNumber = rows?.[0]?.twilio_phone_number;\n\n if (!phoneSid) {\n return new Response(\n JSON.stringify({\n error: \"Contractor has no Twilio number — provision first\",\n }),\n {\n status: 400,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n // Update the number's webhooks to include SmsUrl. Twilio's API uses POST to update.\n const voiceUrl =\n `${PROXY_BASE_URL}/?target=twilio-voice&contractor_id=${contractorId}`;\n const smsUrl =\n `${PROXY_BASE_URL}/?target=twilio-sms&contractor_id=${contractorId}`;\n const statusUrl =\n `${PROXY_BASE_URL}/?target=twilio-call-status&contractor_id=${contractorId}`;\n\n const updateRes = await fetch(\n `https://api.twilio.com/2010-04-01/Accounts/${TWILIO_ACCOUNT_SID}/IncomingPhoneNumbers/${phoneSid}.json`,\n {\n method: \"POST\",\n headers: {\n \"Authorization\": TWILIO_AUTH_HEADER,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n VoiceUrl: voiceUrl,\n VoiceMethod: \"POST\",\n SmsUrl: smsUrl,\n SmsMethod: \"POST\",\n StatusCallback: statusUrl,\n StatusCallbackMethod: \"POST\",\n }),\n },\n );\n\n if (!updateRes.ok) {\n const err = await updateRes.text();\n return new Response(\n JSON.stringify({\n error: \"Twilio update failed\",\n status: updateRes.status,\n detail: err,\n }),\n {\n status: 502,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n },\n );\n }\n\n console.log(\n `[twilio-update-webhooks] ${contractorId} → updated ${\n redactPhone(phoneNumber)\n }`,\n );\n return new Response(\n JSON.stringify({\n ok: true,\n phoneNumber,\n phoneSid,\n updated: [\"VoiceUrl\", \"SmsUrl\", \"StatusCallback\"],\n }),\n { headers: { \"Content-Type\": \"application/json\", ...cors } },\n );\n }\n\n // ── LOB POSTCARDS (default) ──\n // Forwards the postcard create. App.jsx puts a stable idempotency string in\n // body.metadata.idempotency_key; we extract it and forward it as the actual\n // Lob `Idempotency-Key` HTTP header. Lob caches that key for 24h, so a\n // network-level retry (mid-tunnel signal loss in a contractor's truck) won't\n // create a second postcard and double-charge. The metadata field is left in\n // the body so it still shows up on the Lob dashboard as a label.\n const body = await req.text();\n let idempotencyKey = \"\";\n try {\n const parsed = JSON.parse(body);\n const k = parsed?.metadata?.idempotency_key;\n if (typeof k === \"string\" && k.length > 0 && k.length <= 256) {\n idempotencyKey = k;\n }\n } catch { /* not JSON or no metadata — fall through with no header */ }\n\n const lobHeaders: Record = {\n \"Authorization\": \"Basic \" + btoa(LOB_KEY + \":\"),\n \"Content-Type\": \"application/json\",\n };\n if (idempotencyKey) lobHeaders[\"Idempotency-Key\"] = idempotencyKey;\n\n const res = await fetch(\"https://api.lob.com/v1/postcards\", {\n method: \"POST\",\n headers: lobHeaders,\n body, // forward original unchanged\n });\n const data = await res.text();\n return new Response(data, {\n status: res.status,\n headers: { \"Content-Type\": \"application/json\", ...cors },\n });\n } catch (err) {\n return new Response(JSON.stringify({ error: (err as Error).message }), {\n status: 500,\n headers: {\n \"Content-Type\": \"application/json\",\n \"Access-Control-Allow-Origin\": \"*\",\n },\n });\n }\n}","deleted","label",[115],"pulls",1,"forks","envVars",{"_138":140,"_141":51},"connections",{"_138":51,"_139":51},"count","unfilledCount",10,"emptyCount",{"_20":114,"_13":115,"_116":117,"_118":-5,"_119":21,"_120":30,"_121":108,"_22":143,"_29":123,"_124":125,"_126":127,"_128":38,"_129":-5,"_144":145,"_90":146},["D",1777508515739],"children",[],[115],["D",1776017817773],["D",1789499469860],{"_11":12,"_88":84},{"_11":12,"_82":-5,"_83":84,"_44":45,"_85":86,"_87":38},{"_29":30,"_13":26,"_20":21,"_27":28,"_31":-5,"_32":-5,"_77":-5,"_78":-5,"_79":-5,"_80":14,"_81":12},"ctx",{"_70":-5,"_110":185,"_186":187,"_188":189,"_190":38,"_191":38,"_192":38,"_193":108,"_194":-5,"_195":-7,"_196":-7,"_197":51,"_198":38,"_199":38,"_200":-5,"_201":38,"_202":38,"_203":38,"_204":-5},"ENV",{"_156":157,"_158":159,"_160":26,"_161":162,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Branches1

Branches
1