[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_194":195,"_196":197},"routes/_app.x.$handle.$name",{"_92":91,"_31":42,"_100":82,"_26":101,"_13":14,"_102":-5,"_11":103,"_104":105,"_106":107,"_108":109,"_110":111,"_20":-5,"_112":-5,"_113":-5,"_114":24,"_115":116,"_117":118,"_119":-5,"_120":-5,"_121":122},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_40":41,"_31":42,"_35":43,"_44":-5,"_45":24,"_46":47,"_48":47,"_49":50,"_51":-5,"_18":52,"_53":-5,"_54":24,"_55":-5,"_56":-5,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":66,"_67":66,"_68":69,"_70":69,"_71":69,"_72":66,"_73":66,"_74":75,"_76":77,"_78":79,"_80":24},"version",9,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":20,"_33":34,"_35":36,"_37":14,"_38":39,"_23":24},"previous","deleted",false,"deletedHere","path","README.md","latestPath","fileId","9e6bc4a6-7991-11f1-8aa8-1607ee4eb77e","name","fileType","content","# cal-attio\n\nFree, self-hosted **Cal.com → Attio** booking sync. When someone books, reschedules, cancels, or no-shows a meeting, this val:\n\n1. verifies the webhook signature (HMAC-SHA256, fails closed),\n2. finds or creates the Attio **person** by attendee email,\n3. writes the booking to a **Bookings list** parented to People — one entry per booking, keyed on the Cal.com booking UID, so lifecycle events update the same entry instead of duplicating it.\n\nNo database. Attio is the store. Terminal statuses (`cancelled` / `completed` / `no_show`) never regress to `confirmed`, so Cal.com's unordered webhook retries can't resurrect a dead booking.\n\n## Use it yourself\n\nFull setup guide, Attio schema script, tests, and a Cloudflare Workers variant live in the GitHub repo: **[miqcie/cal-attio-sync](https://github.com/miqcie/cal-attio-sync)**\n\nShort version — remix this val, then:\n\n1. Run `scripts/setup-attio.ts` from the repo to create the Bookings list in your Attio workspace.\n2. Set two environment variables on your val (left sidebar): `ATTIO_API_KEY` and `CAL_WEBHOOK_SECRET` (any random string).\n3. In Cal.com (Settings → Developer → Webhooks) point a webhook at this val's HTTP endpoint with that secret, and enable the `BOOKING_CREATED`, `BOOKING_RESCHEDULED`, `BOOKING_CANCELLED`, `BOOKING_NO_SHOW_UPDATED`, and `MEETING_ENDED` triggers.\n\nBook a test meeting; the booking appears in Attio within seconds, linked to the attendee's person record.\n\n## Files\n\n- `main.ts` — HTTP entry (thin wrapper)\n- `src/core.ts` — signature verification, payload normalization, event → status routing\n- `src/attio.ts` — minimal Attio v2 client (query + PATCH/POST; deliberately not the assert endpoint, which matches on parent and would overwrite a repeat booker's earlier booking)\n\nMIT licensed.\n","createdAt",["D",1783380175973],"branchVersion","branchId","3813b537-00d6-49ad-8dc8-45aa8e174181","id","6e760029-3884-49b4-b564-873895aaed16","cal-attio",["D",1783374967355],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Cal.com + Attio sync","imageUrl","2ec4cce0-4d2a-11f0-babe-cd8177b6b491","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",1,"orgId","eed9ac8a-c8ea-4d9e-a39f-ed0984426885","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_92":91,"_99":95},"org",{"_92":91,"_93":-5,"_94":95,"_18":52,"_96":97,"_98":24},"branch",{"_13":81,"_31":82,"_40":39,"_83":41,"_84":-5,"_85":-5,"_86":-5,"_87":-5,"_88":-5,"_89":42,"_90":91},"isOwned",10,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","miqcie","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yeWphTXZFeXFJWTNOMkt6WXdZNWRkbElNdzMifQ","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_40":41,"_31":42,"_35":190,"_44":-5,"_45":24,"_46":47,"_48":47,"_49":50,"_51":-5,"_18":52,"_53":-5,"_54":24,"_55":-5,"_56":-5,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":66,"_67":66,"_68":69,"_70":69,"_71":69,"_72":66,"_73":66,"_74":191,"_76":192,"_78":193,"_80":24},"tree",[158,161,162],"files",[158,159,160,161,162],"counts",{"_148":140,"_149":58,"_150":140,"_151":152,"_153":154},"contents",[123,124,125],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_40":142,"_31":143,"_29":144,"_129":-5,"_38":39,"_37":133,"_131":118,"_35":145,"_13":140,"_32":146,"_33":-5,"_23":24,"_136":-5,"_26":147},{"_40":138,"_31":27,"_29":30,"_129":-5,"_38":39,"_37":14,"_131":24,"_35":139,"_13":140,"_32":20,"_33":34,"_23":24,"_136":-5,"_26":141},{"_40":126,"_31":127,"_29":128,"_129":-5,"_38":39,"_37":130,"_131":118,"_35":132,"_13":133,"_32":134,"_33":135,"_23":24,"_136":-5,"_26":137},"fc10ace9-8f0f-4a7f-9e31-4748c57e7182","main.ts","7dd3b5f2-7985-11f1-848a-1607ee4eb77e","parentId",6,"latest",["D",1783375694999],2,"http","// Val.town HTTP entry. Set ATTIO_API_KEY and CAL_WEBHOOK_SECRET in the val's environment variables.\nimport { handleRequest } from \"./src/core.ts\";\n\nexport default async function (req: Request): Promise {\n return handleRequest(req, {\n ATTIO_API_KEY: Deno.env.get(\"ATTIO_API_KEY\") ?? \"\",\n CAL_WEBHOOK_SECRET: Deno.env.get(\"CAL_WEBHOOK_SECRET\") ?? \"\",\n });\n}\n","label",[127],"5567d26e-386c-4dc4-8a8e-0ca277422479",["D",1783380175973],0,[27],"f7e2a644-c4b1-4111-a31d-ea2b01b23930","src","2ad3e14a-7987-11f1-aeed-1607ee4eb77e",["D",1783375687006],"directory",[143],"pulls","branches","forks","envVars",{"_155":133,"_157":140},"connections",{"_155":140,"_156":140},"count","unfilledCount","emptyCount",{"_40":142,"_31":143,"_29":144,"_129":-5,"_38":39,"_37":133,"_131":118,"_35":187,"_13":140,"_32":146,"_33":-5,"_23":24,"_136":-5,"_164":188,"_26":189},{"_40":179,"_31":180,"_29":181,"_129":144,"_38":39,"_37":182,"_131":118,"_35":183,"_13":133,"_32":175,"_33":184,"_23":24,"_136":-5,"_164":185,"_26":186},{"_40":170,"_31":171,"_29":172,"_129":144,"_38":39,"_37":173,"_131":118,"_35":174,"_13":140,"_32":175,"_33":176,"_23":24,"_136":-5,"_164":177,"_26":178},{"_40":138,"_31":27,"_29":30,"_129":-5,"_38":39,"_37":14,"_131":24,"_35":167,"_13":140,"_32":20,"_33":34,"_23":24,"_136":-5,"_164":168,"_26":169},{"_40":126,"_31":127,"_29":128,"_129":-5,"_38":39,"_37":130,"_131":118,"_35":163,"_13":133,"_32":134,"_33":135,"_23":24,"_136":-5,"_164":165,"_26":166},["D",1783375694999],"children",[],[127],["D",1783380175973],[],[27],"37876997-1d74-4552-bf72-7736d2c770ea","core.ts","2b531974-7987-11f1-aeed-1607ee4eb77e",4,["D",1783375687892],"script","// Platform-agnostic Cal.com → Attio webhook handler.\n// Entry points (Val.town main.tsx, Cloudflare worker.ts) just call handleRequest().\n\nimport { assertBooking, assertPerson, getBookingStatus, type BookingValues } from \"./attio.ts\";\n\nexport interface Env {\n ATTIO_API_KEY: string;\n CAL_WEBHOOK_SECRET: string;\n}\n\nconst STATUS_BY_EVENT: Record = {\n BOOKING_CREATED: \"confirmed\",\n BOOKING_RESCHEDULED: \"confirmed\", // the new booking is the active one; the old uid gets cancelled below\n BOOKING_CANCELLED: \"cancelled\",\n MEETING_ENDED: \"completed\",\n // BOOKING_NO_SHOW_UPDATED handled specially (payload says who no-showed)\n};\n\n// Terminal states never regress to \"confirmed\" — webhook deliveries are unordered and retried.\nconst TERMINAL = new Set([\"cancelled\", \"completed\", \"no_show\"]);\n\n/** Timing-safe HMAC-SHA256 verification of Cal.com's X-Cal-Signature-256 header. Fails closed on a missing secret. */\nexport async function verifySignature(\n secret: string,\n rawBody: string,\n signature: string | null,\n): Promise {\n if (!secret || !signature || !/^[0-9a-f]{64}$/i.test(signature)) return false;\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"verify\"],\n );\n const sigBytes = Uint8Array.from(\n signature.match(/../g)!.map((h) => parseInt(h, 16)),\n );\n return crypto.subtle.verify(\"HMAC\", key, sigBytes, new TextEncoder().encode(rawBody));\n}\n\ninterface Attendee {\n email: string;\n name?: string;\n noShow?: boolean;\n}\n\ninterface NormalizedBooking {\n uid: string;\n title?: string;\n startTime?: string;\n endTime?: string;\n attendees: Attendee[];\n organizerEmail?: string;\n location?: string;\n cancellationReason?: string;\n formResponses?: string;\n rescheduleUid?: string;\n}\n\n/**\n * Cal.com uses a nested payload for BOOKING_* events but a flat one for\n * MEETING_STARTED/MEETING_ENDED (booking fields at top level).\n */\nexport function normalizePayload(body: any): NormalizedBooking | null {\n const p = body?.payload;\n if (!p) return null;\n const uid = p.uid ?? p.bookingUid ?? p.bookingId?.toString();\n if (!uid) return null;\n const attendees: Attendee[] = (p.attendees ?? [])\n .filter((a: any) => a?.email)\n .map((a: any) => ({ email: a.email, name: a.name, noShow: a.noShow }));\n const responses = p.responses ?? p.userFieldsResponses;\n return {\n uid,\n title: p.title ?? p.eventTitle,\n startTime: p.startTime,\n endTime: p.endTime,\n attendees,\n organizerEmail: p.organizer?.email,\n location: p.location,\n cancellationReason: p.cancellationReason,\n formResponses: responses ? JSON.stringify(responses) : undefined,\n rescheduleUid: p.rescheduleUid,\n };\n}\n\nexport async function handleWebhook(body: any, env: Env): Promise {\n const event: string = body?.triggerEvent;\n const booking = normalizePayload(body);\n if (!event || !booking) return \"ignored: no event or booking uid\";\n\n let status = STATUS_BY_EVENT[event];\n if (event === \"BOOKING_NO_SHOW_UPDATED\") {\n // Payload carries per-attendee noShow flags; without a positive flag, don't guess a status.\n if (!booking.attendees.some((a) => a.noShow)) return \"ignored: no-show update without noShow flag\";\n status = \"no_show\";\n }\n if (!status) return `ignored: unhandled event ${event}`;\n\n // Unordered/retried deliveries must not resurrect a finished booking\n // (e.g. a retried BOOKING_CREATED landing after BOOKING_CANCELLED).\n if (status === \"confirmed\") {\n const current = await getBookingStatus(env.ATTIO_API_KEY, booking.uid);\n if (current && TERMINAL.has(current)) {\n return `ignored: ${booking.uid} already ${current}`;\n }\n }\n\n // Assert person records for all attendees; link the first as the booking's attendee.\n let firstPersonId: string | undefined;\n for (const [i, a] of booking.attendees.entries()) {\n const id = await assertPerson(env.ATTIO_API_KEY, a);\n if (i === 0) firstPersonId = id;\n }\n\n const values: BookingValues = {\n booking_uid: booking.uid,\n title: booking.title,\n starts_at: booking.startTime,\n ends_at: booking.endTime,\n status,\n attendee: firstPersonId,\n organizer_email: booking.organizerEmail,\n location: booking.location,\n cancellation_reason: booking.cancellationReason,\n form_responses: booking.formResponses,\n };\n await assertBooking(env.ATTIO_API_KEY, values);\n\n // A reschedule that minted a new uid leaves the old booking dangling — mark it cancelled.\n if (event === \"BOOKING_RESCHEDULED\" && booking.rescheduleUid && booking.rescheduleUid !== booking.uid) {\n await assertBooking(env.ATTIO_API_KEY, {\n booking_uid: booking.rescheduleUid,\n status: \"cancelled\",\n cancellation_reason: `rescheduled to ${booking.uid}`,\n });\n }\n\n return `ok: ${event} → ${booking.uid} (${status})`;\n}\n\n/** Full HTTP handler: verify signature, parse, sync. Shared by all entry points. */\nexport async function handleRequest(req: Request, env: Env): Promise {\n if (req.method !== \"POST\") return new Response(\"cal-attio-sync\", { status: 200 });\n const rawBody = await req.text();\n const ok = await verifySignature(\n env.CAL_WEBHOOK_SECRET,\n rawBody,\n req.headers.get(\"x-cal-signature-256\"),\n );\n if (!ok) return new Response(\"invalid signature\", { status: 401 });\n\n let body: any;\n try {\n body = JSON.parse(rawBody);\n } catch {\n return new Response(\"bad json\", { status: 400 });\n }\n\n try {\n const result = await handleWebhook(body, env);\n console.log(result);\n return new Response(result, { status: 200 });\n } catch (e) {\n // Non-2xx makes Cal.com retry the delivery — desired for transient Attio failures.\n console.error(e);\n return new Response(String(e), { status: 500 });\n }\n}\n",[],[143,171],"4b556ab3-d9f8-494a-ac8a-2eeeacc2c2a1","attio.ts","2b662e56-7987-11f1-800c-1607ee4eb77e",8,["D",1783379554894],"// Minimal Attio v2 API client using Web-standard fetch (runs on Val.town, Workers, Bun).\n\nconst BASE = \"https://api.attio.com/v2\";\n\nexport class AttioError extends Error {\n constructor(public status: number, body: string) {\n super(`Attio ${status}: ${body}`);\n }\n}\n\nasync function attio(apiKey: string, method: string, path: string, body?: unknown) {\n const res = await fetch(`${BASE}${path}`, {\n method,\n headers: {\n authorization: `Bearer ${apiKey}`,\n \"content-type\": \"application/json\",\n },\n body: body === undefined ? undefined : JSON.stringify(body),\n });\n const text = await res.text();\n if (!res.ok) throw new AttioError(res.status, text);\n return text ? JSON.parse(text) : null;\n}\n\n/** Find-or-create a person by email. Returns the person's record_id. */\nexport async function assertPerson(\n apiKey: string,\n attendee: { email: string; name?: string },\n): Promise {\n const values: Record = { email_addresses: [attendee.email] };\n if (attendee.name) {\n // Attio's people.name is a personal-name type: structured, not a bare string.\n const [first, ...rest] = attendee.name.trim().split(/\\s+/);\n values.name = [{\n first_name: first,\n last_name: rest.join(\" \") || undefined,\n full_name: attendee.name,\n }];\n }\n const res = await attio(\n apiKey,\n \"PUT\",\n \"/objects/people/records?matching_attribute=email_addresses\",\n { data: { values } },\n );\n return res.data.id.record_id;\n}\n\nexport interface BookingValues {\n booking_uid: string;\n title?: string;\n starts_at?: string;\n ends_at?: string;\n status?: string;\n attendee?: string; // person record_id — becomes the list entry's parent record\n organizer_email?: string;\n location?: string;\n cancellation_reason?: string;\n form_responses?: string;\n}\n\n/**\n * Idempotent upsert of a booking, stored as an entry in the \"bookings\" list\n * (parented to People — Attio's free plan doesn't allow custom objects).\n *\n * Deliberately NOT Attio's assert endpoint: PUT /lists/{list}/entries matches\n * on the PARENT record regardless of matching_attribute, so a person's second\n * booking would overwrite their first. Instead: query by booking_uid, then\n * PATCH the match or POST a fresh entry. Retries stay idempotent via the\n * query, and booking_uid's uniqueness constraint backstops the rare race.\n */\nexport async function assertBooking(apiKey: string, booking: BookingValues) {\n const { attendee, ...rest } = booking;\n const entry_values: Record = Object.fromEntries(\n // != null drops both null and undefined — Cal.com sends explicit nulls (e.g. cancellationReason).\n Object.entries(rest).filter(([, v]) => v != null && v !== \"\"),\n );\n const existing = await findBookingEntry(apiKey, booking.booking_uid);\n if (existing) {\n return attio(apiKey, \"PATCH\", `/lists/bookings/entries/${existing.entryId}`, {\n data: { entry_values },\n });\n }\n // A list entry needs a parent record; without an attendee there's nothing to create.\n if (!attendee) return null;\n return attio(apiKey, \"POST\", \"/lists/bookings/entries\", {\n data: { parent_record_id: attendee, parent_object: \"people\", entry_values },\n });\n}\n\nasync function findBookingEntry(\n apiKey: string,\n bookingUid: string,\n): Promise<{ entryId: string; status: string | null } | null> {\n const res = await attio(apiKey, \"POST\", \"/lists/bookings/entries/query\", {\n filter: { booking_uid: bookingUid },\n limit: 1,\n });\n const entry = res?.data?.[0];\n if (!entry) return null;\n return {\n entryId: entry.id.entry_id,\n status: entry.entry_values?.status?.[0]?.option?.title ?? null,\n };\n}\n\n/** Current status of a booking entry, or null if it doesn't exist. */\nexport async function getBookingStatus(apiKey: string, bookingUid: string): Promise {\n return (await findBookingEntry(apiKey, bookingUid))?.status ?? null;\n}\n\n// --- setup helpers (used by scripts/setup-attio.ts) ---\n\nexport async function createList(apiKey: string) {\n return attio(apiKey, \"POST\", \"/lists\", {\n data: {\n name: \"Bookings\",\n api_slug: \"bookings\",\n parent_object: \"people\",\n workspace_access: \"full-access\",\n workspace_member_access: [],\n },\n });\n}\n\nexport async function createAttribute(apiKey: string, attr: Record) {\n return attio(apiKey, \"POST\", \"/lists/bookings/attributes\", { data: attr });\n}\n\nexport async function createSelectOption(apiKey: string, attribute: string, title: string) {\n return attio(apiKey, \"POST\", `/lists/bookings/attributes/${attribute}/options`, {\n data: { title },\n });\n}\n\nexport async function getList(apiKey: string): Promise {\n try {\n return await attio(apiKey, \"GET\", \"/lists/bookings\");\n } catch (e) {\n if (e instanceof AttioError && e.status === 404) return null;\n throw e;\n }\n}\n",[],[143,180],["D",1783375687006],[159,160],[143],["D",1783374967355],{"_92":91,"_99":95},{"_92":91,"_93":-5,"_94":95,"_18":52,"_96":97,"_98":24},{"_13":81,"_31":82,"_40":39,"_83":41,"_84":-5,"_85":-5,"_86":-5,"_87":-5,"_88":-5,"_89":42,"_90":91},"ctx",{"_74":-5,"_120":227,"_228":229,"_230":231,"_232":24,"_233":24,"_234":24,"_235":118,"_236":-5,"_237":-7,"_238":-7,"_239":140,"_240":24,"_241":24,"_242":-5,"_243":24,"_244":24,"_245":24,"_246":-5},"ENV",{"_198":199,"_200":201,"_202":82,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224,"_225":226},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v9