[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_195":196,"_197":198},"routes/_app.x.$handle.$name",{"_99":98,"_32":44,"_107":89,"_26":36,"_13":14,"_108":-5,"_11":109,"_110":111,"_112":113,"_114":115,"_116":117,"_20":-5,"_118":-5,"_119":-5,"_120":24,"_121":122,"_123":58,"_124":-5,"_125":-5,"_126":127},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_32":44,"_37":45,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":24},"version",14,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":29},"file",{"_30":31,"_32":27,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_23":24},"previous","deleted",false,"deletedHere","path","new-file-7791.ts","latestPath","notify.ts","fileId","8aae0de8-afb0-11f1-ac66-1607ee4eb77e","name","fileType","script","content","","createdAt",["D",1789330820082],"branchVersion","branchId","1b502c53-2456-4abd-b47d-8024fbca1832","id","639ca8a8-1138-4d2c-8f90-70d7c3fd0872","form-handler-infinitepay-sqlite-resend",["D",1789320759226],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Handles a web form, and sends a Resend confirmation email.","imageUrl","019c60b1-a4d0-7731-935c-3d10ad61d034","pinnedFileId","1df4ed5a-af99-11f1-b5cd-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019c60b1-a4d0-7731-935c-42775a719a84","tursoName","639ca8a811384d2c8f9070d7c3fd0872","tursoHostname","639ca8a811384d2c8f9070d7c3fd0872-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789494690166],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_106":102},"org",{"_99":98,"_100":-5,"_101":102,"_18":54,"_103":104,"_105":24},"branch",{"_13":88,"_32":89,"_42":41,"_90":43,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":44,"_97":98},"isOwned",28,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","odeik","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18zOWhXUmxoUktmbGZNZFRQWnhlYWJFeWpGSjAifQ","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_42":43,"_32":44,"_37":190,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":191,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":192,"_83":193,"_85":194,"_87":24},"tree",[173,174,175,176],"files",[173,174,175,176],"counts",{"_161":62,"_162":163,"_164":62,"_165":166,"_167":168},"contents",[128,129,130,131],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_42":154,"_32":155,"_30":156,"_133":-5,"_40":41,"_39":157,"_134":24,"_37":158,"_13":151,"_33":34,"_35":159,"_23":24,"_136":-5,"_26":160},{"_42":146,"_32":147,"_30":148,"_133":-5,"_40":41,"_39":149,"_134":58,"_37":150,"_13":151,"_33":34,"_35":152,"_23":24,"_136":-5,"_26":153},{"_42":138,"_32":139,"_30":56,"_133":-5,"_40":41,"_39":140,"_134":24,"_37":141,"_13":142,"_33":143,"_35":144,"_23":24,"_136":-5,"_26":145},{"_42":132,"_32":27,"_30":31,"_133":-5,"_40":41,"_39":14,"_134":24,"_37":135,"_13":62,"_33":34,"_35":36,"_23":24,"_136":-5,"_26":137},"f0edad7e-9e60-40e0-8a32-af49aa9b1e43","parentId","latest",["D",1789330820082],"label",[27],"a7948146-0dd0-4816-acef-8dd31cdb7798","main.ts",10,["D",1789330779056],3,"http","import {\n ensureSchema,\n getBundle,\n getOrder,\n insertOrder,\n markPaid,\n setCheckoutUrl,\n} from \"./db.ts\";\nimport { createLink, paymentCheck } from \"./infinitepay.ts\";\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const path = url.pathname.replace(/\\/+$/, \"\") || \"/\";\n\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: corsHeaders(req) });\n }\n\n try {\n await ensureSchema();\n\n if (req.method === \"POST\" && path === \"/link\") return await handleLink(req);\n if (req.method === \"POST\" && path === \"/webhook\") return await handleWebhook(req);\n\n return json(req, { error: \"not_found\" }, 404);\n } catch (error) {\n console.error(\"Unhandled error\", error);\n return json(req, { error: \"internal_error\" }, 500);\n }\n}\n\n/* -------------------------------------------------------------- POST /link */\n\nasync function handleLink(req: Request): Promise {\n const origin = req.headers.get(\"Origin\");\n if (origin && !isAllowedOrigin(origin)) {\n return json(req, { error: \"forbidden_origin\" }, 403);\n }\n\n let body: Record;\n try {\n body = await req.json();\n } catch {\n return json(req, { error: \"invalid_json\" }, 400);\n }\n\n const bookSlug = str(body.book, 64);\n const units = Number(body.quantity);\n\n if (!bookSlug || !Number.isInteger(units) || units < 1) {\n return json(req, { error: \"invalid_product\" }, 400);\n }\n\n // The price is resolved here and nowhere else. Anything price-shaped in the\n // request body is ignored on purpose.\n const bundle = await getBundle(bookSlug, units);\n if (!bundle) return json(req, { error: \"unknown_product\" }, 404);\n\n const amountCents = bundle.units * bundle.unit_price_cents;\n\n const name = str(body.name, 120);\n const email = str(body.email, 160);\n if (!name || !email || !isEmail(email)) {\n return json(req, { error: \"invalid_customer\" }, 400);\n }\n\n // Both URLs come from the request rather than configuration.\n //\n // The val's own origin is where InfinitePay must POST the payment\n // notification. Taking it from the incoming request means it cannot drift out\n // of sync with wherever this val actually lives.\n const valOrigin = new URL(req.url).origin;\n\n // The buyer goes back to the origin they checked out on — already validated\n // against ALLOWED_ORIGINS above, so it cannot be steered somewhere else. This\n // also keeps www and apex visitors on the host they started from, and sends a\n // local dev checkout back to localhost rather than production.\n const siteOrigin = origin ?? allowedOrigins()[0];\n if (!siteOrigin) {\n console.error(\"ALLOWED_ORIGINS is empty; cannot build a redirect_url\");\n return json(req, { error: \"misconfigured\" }, 500);\n }\n\n const orderNsu = crypto.randomUUID();\n\n const order = {\n order_nsu: orderNsu,\n book_slug: bundle.book_slug,\n quantity: bundle.units,\n amount_cents: amountCents,\n customer_name: name,\n customer_email: email,\n customer_phone: normalisePhone(str(body.phone, 32)),\n dedicatoria: str(body.dedicatoria, 500),\n cep: digits(str(body.cep, 20)),\n street: str(body.street, 200),\n neighborhood: str(body.neighborhood, 120),\n number: str(body.number, 20),\n complement: str(body.complement, 120),\n city: str(body.city, 120),\n state: str(body.state, 8),\n referral: str(body.referral, 80),\n };\n\n // Written before the API call so a failed or slow InfinitePay response still\n // leaves us with the buyer's shipping address.\n await insertOrder(order);\n\n const checkoutUrl = await createLink({\n order_nsu: orderNsu,\n // InfinitePay multiplies price by quantity, so this is the unit price and\n // the line total comes to bundle.units * bundle.unit_price_cents.\n items: [{\n quantity: bundle.units,\n price: bundle.unit_price_cents,\n description: bundle.title,\n }],\n redirect_url: `${siteOrigin}/pedido-confirmado/`,\n webhook_url: `${valOrigin}/webhook`,\n customer: {\n name: order.customer_name,\n email: order.customer_email,\n phone_number: order.customer_phone ?? undefined,\n },\n address: {\n cep: order.cep ?? undefined,\n street: order.street ?? undefined,\n neighborhood: order.neighborhood ?? undefined,\n number: order.number ?? undefined,\n complement: order.complement ?? undefined,\n },\n });\n\n await setCheckoutUrl(orderNsu, checkoutUrl);\n\n // Logged so a wrong derivation is obvious on the first order rather than when\n // a payment silently fails to register.\n console.log(\"order created\", orderNsu, {\n book: bundle.book_slug,\n units: bundle.units,\n unitPrice: bundle.unit_price_cents,\n discounted: bundle.discounted,\n total: amountCents,\n valOrigin,\n siteOrigin,\n });\n\n return json(req, {\n checkout_url: checkoutUrl,\n order_nsu: orderNsu,\n amount_cents: amountCents,\n });\n}\n\n/* ----------------------------------------------------------- POST /webhook */\n\nasync function handleWebhook(req: Request): Promise {\n const raw = await req.text();\n\n // Every branch below acks with 200 and says why: a 400 would make InfinitePay\n // redeliver, which is only wanted for genuinely transient failures. The\n // reasons go to Val Town's request logs rather than a table of our own.\n let body: Record;\n try {\n body = JSON.parse(raw);\n } catch {\n console.warn(\"webhook ignored: body is not JSON\", raw.slice(0, 500));\n return new Response(\"OK\", { status: 200 });\n }\n\n const orderNsu = str(body.order_nsu, 64);\n const transactionNsu = str(body.transaction_nsu, 120);\n const slug = str(body.invoice_slug, 120) ?? str(body.slug, 120);\n\n if (!orderNsu) {\n console.warn(\"webhook ignored: no order_nsu in the body\", raw.slice(0, 500));\n return new Response(\"OK\", { status: 200 });\n }\n\n const order = await getOrder(orderNsu);\n if (!order) {\n console.warn(\"webhook ignored: unknown order\", orderNsu);\n return new Response(\"OK\", { status: 200 });\n }\n\n if (order.status === \"paid\") {\n // Idempotency: InfinitePay retries, and we ack retries without re-emailing.\n console.log(\"webhook ignored: order already paid\", orderNsu);\n return new Response(\"OK\", { status: 200 });\n }\n\n if (!transactionNsu || !slug) {\n console.warn(\"webhook ignored: no transaction_nsu or slug to verify with\", orderNsu);\n return new Response(\"OK\", { status: 200 });\n }\n\n // The body is only a hint, and this endpoint is public — anyone can POST to\n // it. This call is the sole reason a forged notification cannot fabricate a\n // payment. Never mark an order paid on the strength of the body alone.\n const check = await paymentCheck({\n order_nsu: orderNsu,\n transaction_nsu: transactionNsu,\n slug,\n });\n\n const paidAmount = Number(check.paid_amount ?? check.amount ?? 0);\n\n if (!check.success || !check.paid || paidAmount < order.amount_cents) {\n // Either the notification was forged, or the amount does not cover the\n // catalog price. Both leave the order pending.\n console.warn(\n \"webhook rejected: payment_check did not confirm\",\n orderNsu,\n { success: check.success, paid: check.paid, paidAmount, expected: order.amount_cents },\n );\n return new Response(\"OK\", { status: 200 });\n }\n\n await markPaid(orderNsu, {\n paid_amount_cents: paidAmount,\n installments: numOrNull(check.installments ?? body.installments),\n capture_method: check.capture_method ?? str(body.capture_method, 40),\n transaction_nsu: transactionNsu,\n invoice_slug: slug,\n receipt_url: str(body.receipt_url, 500),\n });\n\n // Emails are sent by the notify cron val so this stays inside the ~1s budget\n // the docs ask for, and so a mail failure can be retried without a redelivery.\n console.log(\"webhook verified paid\", orderNsu);\n return new Response(\"OK\", { status: 200 });\n}\n\n/* ------------------------------------------------------------------ helpers */\n\nfunction allowedOrigins(): string[] {\n return (Deno.env.get(\"ALLOWED_ORIGINS\") ?? \"\")\n .split(\",\")\n .map((o) => o.trim())\n .filter(Boolean);\n}\n\nfunction isAllowedOrigin(origin: string): boolean {\n return allowedOrigins().includes(origin);\n}\n\n/** Reflect the origin when it is allowed; never `*` — this endpoint writes. */\nfunction corsHeaders(req: Request): Record {\n const origin = req.headers.get(\"Origin\");\n const headers: Record = {\n \"Access-Control-Allow-Methods\": \"POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n \"Access-Control-Max-Age\": \"86400\",\n Vary: \"Origin\",\n };\n if (origin && isAllowedOrigin(origin)) {\n headers[\"Access-Control-Allow-Origin\"] = origin;\n }\n return headers;\n}\n\nfunction json(req: Request, body: unknown, status = 200): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders(req) },\n });\n}\n\nfunction str(value: unknown, maxLength: number): string | null {\n if (typeof value !== \"string\") return null;\n const trimmed = value.trim().slice(0, maxLength);\n return trimmed === \"\" ? null : trimmed;\n}\n\nfunction digits(value: string | null): string | null {\n if (!value) return null;\n const only = value.replace(/\\D/g, \"\");\n return only === \"\" ? null : only;\n}\n\nfunction numOrNull(value: unknown): number | null {\n const n = Number(value);\n return Number.isFinite(n) ? n : null;\n}\n\nfunction isEmail(value: string): boolean {\n return /^[^\\s@]+@[^\\s@]+\\.[^\\s@]{2,}$/.test(value);\n}\n\n/** InfinitePay wants E.164; Brazilian numbers arrive as 11 digits at most. */\nfunction normalisePhone(value: string | null): string | null {\n const only = digits(value);\n if (!only) return null;\n if (only.length < 10 || only.length > 13) return null;\n return only.startsWith(\"55\") ? `+${only}` : `+55${only}`;\n}",[139],"cb302c49-9a3a-48e4-84f2-004a908c4471","infinitepay.ts","77d00cda-afb0-11f1-b1ef-1607ee4eb77e",13,["D",1789330810626],2,"/**\n * Thin wrappers over the two InfinitePay Checkout endpoints we use.\n *\n * Nothing here is configured by a literal: the handle comes from an env var,\n * because this val's source is publicly readable on Val Town's free plan.\n */\n\nconst API = \"https://api.checkout.infinitepay.io\";\n\nexport interface LinkItem {\n quantity: number;\n price: number; // CENTAVOS\n description: string;\n}\n\nexport interface CreateLinkInput {\n order_nsu: string;\n items: LinkItem[];\n redirect_url: string;\n webhook_url: string;\n customer?: { name?: string; email?: string; phone_number?: string };\n address?: {\n cep?: string;\n street?: string;\n neighborhood?: string;\n number?: string;\n complement?: string;\n };\n}\n\nexport async function createLink(input: CreateLinkInput): Promise {\n const handle = requireEnv(\"INFINITEPAY_HANDLE\");\n\n const payload: Record = {\n handle,\n items: input.items,\n order_nsu: input.order_nsu,\n redirect_url: input.redirect_url,\n webhook_url: input.webhook_url,\n };\n\n // Blank fields arrive as `undefined` — str() maps \"\" to null and the caller\n // maps null to undefined — and JSON.stringify omits undefined properties, so\n // nothing blank reaches InfinitePay on its own. The only case needing a guard\n // is an object whose every field is blank, which would serialize as {}.\n if (input.customer && Object.values(input.customer).some(Boolean)) {\n payload.customer = input.customer;\n }\n\n if (input.address && Object.values(input.address).some(Boolean)) {\n payload.address = input.address;\n }\n\n const response = await fetch(`${API}/links`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", Accept: \"application/json\" },\n body: JSON.stringify(payload),\n });\n\n if (!response.ok) {\n // Read as text, not JSON: a 4xx body names the offending field and is worth\n // logging verbatim even when it is not valid JSON.\n console.error(\n \"InfinitePay /links failed\",\n response.status,\n await response.text(),\n );\n throw new Error(`InfinitePay returned ${response.status}`);\n }\n\n // { \"url\": \"https://checkout.infinitepay.com.br/...\" }\n const body = await response.json() as { url?: unknown };\n\n // Still checked: a malformed response must fail here rather than send the\n // buyer to `undefined`.\n if (typeof body.url !== \"string\" || !body.url.startsWith(\"http\")) {\n console.error(\n \"InfinitePay /links had no url in the response\",\n JSON.stringify(body),\n );\n throw new Error(\"InfinitePay response contained no checkout URL\");\n }\n\n return body.url;\n}\n\nexport interface PaymentCheckResult {\n success: boolean;\n paid: boolean;\n amount?: number;\n paid_amount?: number;\n installments?: number;\n capture_method?: string;\n}\n\n/**\n * The webhook carries no signature, so this is what actually establishes that a\n * payment happened. Never trust a webhook body without calling this first.\n */\nexport async function paymentCheck(args: {\n order_nsu: string;\n transaction_nsu: string;\n slug: string;\n}): Promise {\n const handle = requireEnv(\"INFINITEPAY_HANDLE\");\n\n const response = await fetch(`${API}/payment_check`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", Accept: \"application/json\" },\n body: JSON.stringify({ handle, ...args }),\n });\n\n if (!response.ok) {\n console.error(\n \"InfinitePay /payment_check failed\",\n response.status,\n await response.text(),\n );\n return { success: false, paid: false };\n }\n\n return (await response.json()) as PaymentCheckResult;\n}\n\nexport function requireEnv(name: string): string {\n const value = Deno.env.get(name);\n if (!value) throw new Error(`Missing required env var: ${name}`);\n return value;\n}",[147],"08c60f5a-d50e-4fc2-bc41-0a2703344592","db.ts","0fc96a8c-afb0-11f1-a2b2-1607ee4eb77e",9,["D",1789330703476],"/**\n * SQLite helpers for the InfinitePay checkout.\n *\n * The table definitions live in ./schema.sql, which you run once by hand in the\n * Val Town SQLite console. ensureSchema() below re-creates the *tables* on cold\n * start so a fresh deploy can never 500 on a missing table — but it deliberately\n * does NOT seed the catalog, because the val must never overwrite prices you have\n * edited in the console.\n */\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\n\nexport interface Bundle {\n book_slug: string;\n title: string;\n units: number;\n /** Per copy at this quantity: the bundle discount if one exists, else the base. */\n unit_price_cents: number;\n /** True when a bundle_discounts row applied. */\n discounted: boolean;\n}\n\nexport interface Order {\n order_nsu: string;\n created_at: string;\n book_slug: string;\n quantity: number;\n amount_cents: number;\n customer_name: string;\n customer_email: string;\n customer_phone: string | null;\n dedicatoria: string | null;\n cep: string | null;\n street: string | null;\n neighborhood: string | null;\n number: string | null;\n complement: string | null;\n city: string | null;\n state: string | null;\n referral: string | null;\n checkout_url: string | null;\n status: \"pending\" | \"paid\";\n paid_at: string | null;\n paid_amount_cents: number | null;\n installments: number | null;\n capture_method: string | null;\n transaction_nsu: string | null;\n invoice_slug: string | null;\n receipt_url: string | null;\n seller_email_sent_at: string | null;\n buyer_email_sent_at: string | null;\n}\n\n/** std/sqlite returns rows as arrays plus a `columns` list; zip them up. */\nfunction toObjects(result: { columns: string[]; rows: unknown[][] }): T[] {\n return result.rows.map((row) => {\n const obj: Record = {};\n result.columns.forEach((col, i) => (obj[col] = row[i]));\n return obj as T;\n });\n}\n\nasync function query(sql: string, args: unknown[] = []): Promise {\n const result = await sqlite.execute({ sql, args });\n return toObjects(result as { columns: string[]; rows: unknown[][] });\n}\n\nasync function run(sql: string, args: unknown[] = []): Promise {\n await sqlite.execute({ sql, args });\n}\n\n/* ------------------------------------------------------------------ schema */\n\nlet schemaReady: Promise | null = null;\n\n/** Idempotent; memoised so it costs one round trip per cold start. */\nexport function ensureSchema(): Promise {\n schemaReady ??= (async () => {\n await run(`CREATE TABLE IF NOT EXISTS products (\n book_slug TEXT PRIMARY KEY,\n title TEXT NOT NULL,\n unit_price_cents INTEGER NOT NULL CHECK (unit_price_cents > 0),\n active INTEGER NOT NULL DEFAULT 1,\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n updated_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`);\n await run(`CREATE TABLE IF NOT EXISTS bundle_discounts (\n book_slug TEXT NOT NULL REFERENCES products (book_slug),\n units INTEGER NOT NULL CHECK (units > 0),\n unit_price_cents INTEGER NOT NULL CHECK (unit_price_cents > 0),\n active INTEGER NOT NULL DEFAULT 1,\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n updated_at TEXT NOT NULL DEFAULT (datetime('now')),\n PRIMARY KEY (book_slug, units)\n )`);\n await run(`CREATE TABLE IF NOT EXISTS orders (\n order_nsu TEXT PRIMARY KEY,\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n book_slug TEXT NOT NULL,\n quantity INTEGER NOT NULL,\n amount_cents INTEGER NOT NULL,\n customer_name TEXT NOT NULL,\n customer_email TEXT NOT NULL,\n customer_phone TEXT,\n dedicatoria TEXT,\n cep TEXT, street TEXT, neighborhood TEXT, number TEXT,\n complement TEXT, city TEXT, state TEXT,\n referral TEXT,\n checkout_url TEXT,\n status TEXT NOT NULL DEFAULT 'pending',\n paid_at TEXT, paid_amount_cents INTEGER, installments INTEGER,\n capture_method TEXT, transaction_nsu TEXT, invoice_slug TEXT, receipt_url TEXT,\n seller_email_sent_at TEXT, buyer_email_sent_at TEXT\n )`);\n await run(\n `CREATE INDEX IF NOT EXISTS orders_status ON orders (status, created_at)`,\n );\n await run(\n `CREATE INDEX IF NOT EXISTS orders_pending ON orders (status, seller_email_sent_at)`,\n );\n })();\n return schemaReady;\n}\n\n/* ----------------------------------------------------------------- catalog */\n\n/**\n * Price `units` copies of a book.\n *\n * bundle_discounts is an override, not a catalogue: a quantity with no row\n * there is still sellable at the product's base price. The LEFT JOIN is what\n * makes that work — COALESCE picks the discount when one exists.\n */\nexport async function getBundle(\n bookSlug: string,\n units: number,\n): Promise {\n const rows = await query(\n `SELECT p.book_slug,\n p.title,\n ? AS units,\n COALESCE(d.unit_price_cents, p.unit_price_cents) AS unit_price_cents,\n d.unit_price_cents IS NOT NULL AS discounted\n FROM products p\n LEFT JOIN bundle_discounts d\n ON d.book_slug = p.book_slug AND d.units = ? AND d.active = 1\n WHERE p.book_slug = ? AND p.active = 1\n LIMIT 1`,\n [units, units, bookSlug],\n );\n const row = rows[0];\n return row ? { ...row, discounted: Boolean(row.discounted) } : null;\n}\n\n/* ------------------------------------------------------------------ orders */\n\nexport async function insertOrder(order: {\n order_nsu: string;\n book_slug: string;\n quantity: number;\n amount_cents: number;\n customer_name: string;\n customer_email: string;\n customer_phone: string | null;\n dedicatoria: string | null;\n cep: string | null;\n street: string | null;\n neighborhood: string | null;\n number: string | null;\n complement: string | null;\n city: string | null;\n state: string | null;\n referral: string | null;\n}): Promise {\n await run(\n `INSERT INTO orders (\n order_nsu, book_slug, quantity, amount_cents,\n customer_name, customer_email, customer_phone, dedicatoria,\n cep, street, neighborhood, number, complement, city, state, referral\n ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,\n [\n order.order_nsu,\n order.book_slug,\n order.quantity,\n order.amount_cents,\n order.customer_name,\n order.customer_email,\n order.customer_phone,\n order.dedicatoria,\n order.cep,\n order.street,\n order.neighborhood,\n order.number,\n order.complement,\n order.city,\n order.state,\n order.referral,\n ],\n );\n}\n\nexport async function setCheckoutUrl(\n orderNsu: string,\n url: string,\n): Promise {\n await run(`UPDATE orders SET checkout_url = ? WHERE order_nsu = ?`, [\n url,\n orderNsu,\n ]);\n}\n\nexport async function getOrder(orderNsu: string): Promise {\n const rows = await query(\n `SELECT * FROM orders WHERE order_nsu = ? LIMIT 1`,\n [orderNsu],\n );\n return rows[0] ?? null;\n}\n\n/**\n * Move an order to `paid`. The `status = 'pending'` guard makes this idempotent:\n * a replayed webhook updates zero rows, so no duplicate email is ever queued.\n */\nexport async function markPaid(orderNsu: string, payment: {\n paid_amount_cents: number | null;\n installments: number | null;\n capture_method: string | null;\n transaction_nsu: string | null;\n invoice_slug: string | null;\n receipt_url: string | null;\n}): Promise {\n await run(\n `UPDATE orders\n SET status = 'paid',\n paid_at = datetime('now'),\n paid_amount_cents = ?,\n installments = ?,\n capture_method = ?,\n transaction_nsu = ?,\n invoice_slug = ?,\n receipt_url = ?\n WHERE order_nsu = ? AND status = 'pending'`,\n [\n payment.paid_amount_cents,\n payment.installments,\n payment.capture_method,\n payment.transaction_nsu,\n payment.invoice_slug,\n payment.receipt_url,\n orderNsu,\n ],\n );\n}\n\n/** Paid orders still waiting on one of the two notification emails. */\nexport async function ordersNeedingEmail(\n column: \"seller_email_sent_at\" | \"buyer_email_sent_at\",\n limit = 10,\n) {\n return query(\n `SELECT * FROM orders\n WHERE status = 'paid' AND ${column} IS NULL\n ORDER BY paid_at ASC\n LIMIT ?`,\n [limit],\n );\n}\n\nexport async function markEmailSent(\n orderNsu: string,\n column: \"seller_email_sent_at\" | \"buyer_email_sent_at\",\n): Promise {\n await run(\n `UPDATE orders SET ${column} = datetime('now') WHERE order_nsu = ?`,\n [orderNsu],\n );\n}",[155],"pulls","branches",1,"forks","envVars",{"_169":171,"_172":62},"connections",{"_169":62,"_170":62},"count","unfilledCount",6,"emptyCount",{"_42":154,"_32":155,"_30":156,"_133":-5,"_40":41,"_39":157,"_134":24,"_37":187,"_13":151,"_33":34,"_35":159,"_23":24,"_136":-5,"_178":188,"_26":189},{"_42":146,"_32":147,"_30":148,"_133":-5,"_40":41,"_39":149,"_134":58,"_37":184,"_13":151,"_33":34,"_35":152,"_23":24,"_136":-5,"_178":185,"_26":186},{"_42":138,"_32":139,"_30":56,"_133":-5,"_40":41,"_39":140,"_134":24,"_37":181,"_13":142,"_33":143,"_35":144,"_23":24,"_136":-5,"_178":182,"_26":183},{"_42":132,"_32":27,"_30":31,"_133":-5,"_40":41,"_39":14,"_134":24,"_37":177,"_13":62,"_33":34,"_35":36,"_23":24,"_136":-5,"_178":179,"_26":180},["D",1789330820082],"children",[],[27],["D",1789330779056],[],[139],["D",1789330810626],[],[147],["D",1789330703476],[],[155],["D",1789320759226],["D",1789494690166],{"_99":98,"_106":102},{"_99":98,"_100":-5,"_101":102,"_18":54,"_103":104,"_105":24},{"_13":88,"_32":89,"_42":41,"_90":43,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":44,"_97":98},"ctx",{"_81":-5,"_125":228,"_229":230,"_231":232,"_233":24,"_234":24,"_235":24,"_236":58,"_237":-5,"_238":-7,"_239":-7,"_240":62,"_241":24,"_242":24,"_243":-5,"_244":24,"_245":24,"_246":24,"_247":-5},"ENV",{"_199":200,"_201":202,"_203":89,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215,"_216":217,"_218":219,"_220":221,"_222":223,"_224":225,"_226":227},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v14