[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_197":198,"_199":200},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_149":-5,"_20":150,"_22":151,"_152":153,"_154":155,"_26":156,"_24":157,"_158":-5,"_159":-5,"_160":52,"_161":162,"_163":43,"_164":-5,"_165":-5,"_166":167},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","odeik","name","form-handler-infinitepay-sqlite-resend","branchName","main","version","path","db.ts","project",{"_33":91,"_13":14,"_44":92,"_93":-5,"_94":52,"_95":96,"_97":96,"_98":99,"_100":-5,"_101":102,"_103":71,"_104":43,"_105":-5,"_106":-5,"_107":108,"_109":110,"_111":112,"_113":114,"_115":116,"_117":-5,"_118":119,"_120":119,"_121":122,"_123":122,"_124":122,"_125":119,"_126":119,"_127":128,"_129":130,"_131":132,"_133":52},"tree",[55,56,57,58],"file",{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_18":54},"contents",[],"upstream","pull","ahead","behind","envVars","id","948ad8f5-7602-4111-adec-207c0adefdd3","fileId","0fc96a8c-afb0-11f1-a2b2-1607ee4eb77e","parentId","branchId","1b502c53-2456-4abd-b47d-8024fbca1832","branchVersion",24,"latest",true,"createdAt",["D",1789334266671],5,"fileType","script","content","/**\n * SQLite helpers for the InfinitePay checkout.\n *\n * The schema lives in ./schema.sql and nowhere else — run it once by hand in the\n * Val Town SQLite console. This file deliberately does not create tables: doing\n * that on cold start meant five DDL writes before any request could be served,\n * and a second copy of the DDL to keep in sync. A missing table now surfaces as\n * a fast \"no such table\" error rather than a hang.\n */\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n/** A book priced for a specific quantity. */\nexport interface Bundle {\n book_slug: string;\n title: string;\n units: number;\n /** Per copy at this quantity: the bundle discount if one exists, else the base. */\n unit_price_cents: number;\n /** True when a bundle_discounts row applied. */\n discounted: boolean;\n}\n\nexport interface Order {\n order_nsu: string;\n created_at: string;\n book_slug: string;\n quantity: number;\n amount_cents: number;\n customer_name: string;\n customer_email: string;\n customer_phone: string | null;\n dedicatoria: string | null;\n cep: string | null;\n street: string | null;\n neighborhood: string | null;\n number: string | null;\n complement: string | null;\n city: string | null;\n state: string | null;\n referral: string | null;\n checkout_url: string | null;\n status: \"pending\" | \"paid\";\n paid_at: string | null;\n paid_amount_cents: number | null;\n installments: number | null;\n capture_method: string | null;\n transaction_nsu: string | null;\n invoice_slug: string | null;\n receipt_url: string | null;\n seller_email_sent_at: string | null;\n buyer_email_sent_at: string | null;\n}\n\n/** std/sqlite returns rows as arrays plus a `columns` list; zip them up. */\nfunction toObjects(result: { columns: string[]; rows: unknown[][] }): T[] {\n return result.rows.map((row) => {\n const obj: Record = {};\n result.columns.forEach((col, i) => (obj[col] = row[i]));\n return obj as T;\n });\n}\n\nasync function query(sql: string, args: unknown[] = []): Promise {\n const result = await sqlite.execute({ sql, args });\n return toObjects(result as { columns: string[]; rows: unknown[][] });\n}\n\nasync function run(sql: string, args: unknown[] = []): Promise {\n await sqlite.execute({ sql, args });\n}\n\n/** Smallest possible round trip, for the health check's ?db=1 probe. */\nexport async function selectOne(): Promise {\n await run(`SELECT 1`);\n}\n\n/* ----------------------------------------------------------------- catalog */\n\n/**\n * Price `units` copies of a book.\n *\n * bundle_discounts is an override, not a catalogue: a quantity with no row\n * there is still sellable at the product's base price. The LEFT JOIN is what\n * makes that work — COALESCE picks the discount when one exists.\n */\nexport async function getBundle(\n bookSlug: string,\n units: number,\n): Promise {\n const rows = await query(\n `SELECT p.book_slug,\n p.title,\n ? AS units,\n COALESCE(d.unit_price_cents, p.unit_price_cents) AS unit_price_cents,\n d.unit_price_cents IS NOT NULL AS discounted\n FROM products p\n LEFT JOIN bundle_discounts d\n ON d.book_slug = p.book_slug AND d.units = ? AND d.active = 1\n WHERE p.book_slug = ? AND p.active = 1\n LIMIT 1`,\n [units, units, bookSlug],\n );\n const row = rows[0];\n return row ? { ...row, discounted: Boolean(row.discounted) } : null;\n}\n\n/* ------------------------------------------------------------------ orders */\n\nexport async function insertOrder(order: {\n order_nsu: string;\n book_slug: string;\n quantity: number;\n amount_cents: number;\n customer_name: string;\n customer_email: string;\n customer_phone: string | null;\n dedicatoria: string | null;\n cep: string | null;\n street: string | null;\n neighborhood: string | null;\n number: string | null;\n complement: string | null;\n city: string | null;\n state: string | null;\n referral: string | null;\n}): Promise {\n await run(\n `INSERT INTO orders (\n order_nsu, book_slug, quantity, amount_cents,\n customer_name, customer_email, customer_phone, dedicatoria,\n cep, street, neighborhood, number, complement, city, state, referral\n ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,\n [\n order.order_nsu,\n order.book_slug,\n order.quantity,\n order.amount_cents,\n order.customer_name,\n order.customer_email,\n order.customer_phone,\n order.dedicatoria,\n order.cep,\n order.street,\n order.neighborhood,\n order.number,\n order.complement,\n order.city,\n order.state,\n order.referral,\n ],\n );\n}\n\nexport async function setCheckoutUrl(\n orderNsu: string,\n url: string,\n): Promise {\n await run(`UPDATE orders SET checkout_url = ? WHERE order_nsu = ?`, [\n url,\n orderNsu,\n ]);\n}\n\nexport async function getOrder(orderNsu: string): Promise {\n const rows = await query(\n `SELECT * FROM orders WHERE order_nsu = ? LIMIT 1`,\n [orderNsu],\n );\n return rows[0] ?? null;\n}\n\n/**\n * Move an order to `paid`. The `status = 'pending'` guard makes this idempotent:\n * a replayed webhook updates zero rows, so no duplicate email is ever queued.\n */\nexport async function markPaid(orderNsu: string, payment: {\n paid_amount_cents: number | null;\n installments: number | null;\n capture_method: string | null;\n transaction_nsu: string | null;\n invoice_slug: string | null;\n receipt_url: string | null;\n}): Promise {\n await run(\n `UPDATE orders\n SET status = 'paid',\n paid_at = datetime('now'),\n paid_amount_cents = ?,\n installments = ?,\n capture_method = ?,\n transaction_nsu = ?,\n invoice_slug = ?,\n receipt_url = ?\n WHERE order_nsu = ? AND status = 'pending'`,\n [\n payment.paid_amount_cents,\n payment.installments,\n payment.capture_method,\n payment.transaction_nsu,\n payment.invoice_slug,\n payment.receipt_url,\n orderNsu,\n ],\n );\n}\n\n/** Paid orders still waiting on one of the two notification emails. */\nexport function ordersNeedingEmail(\n column: \"seller_email_sent_at\" | \"buyer_email_sent_at\",\n limit = 10,\n): Promise {\n return query(\n `SELECT * FROM orders\n WHERE status = 'paid' AND ${column} IS NULL\n ORDER BY paid_at ASC\n LIMIT ?`,\n [limit],\n );\n}\n\nexport async function markEmailSent(\n orderNsu: string,\n column: \"seller_email_sent_at\" | \"buyer_email_sent_at\",\n): Promise {\n await run(\n `UPDATE orders SET ${column} = datetime('now') WHERE order_nsu = ?`,\n [orderNsu],\n );\n}","deleted",false,"label",[19],{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":88,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_66":89,"_18":90},{"_33":79,"_13":80,"_35":81,"_37":-5,"_38":39,"_40":82,"_42":43,"_44":83,"_17":84,"_47":48,"_49":85,"_51":52,"_53":-5,"_66":86,"_18":87},{"_33":69,"_13":70,"_35":71,"_37":-5,"_38":39,"_40":72,"_42":43,"_44":73,"_17":74,"_47":75,"_49":76,"_51":52,"_53":-5,"_66":77,"_18":78},{"_33":59,"_13":60,"_35":61,"_37":-5,"_38":39,"_40":62,"_42":43,"_44":63,"_17":46,"_47":64,"_49":65,"_51":52,"_53":-5,"_66":67,"_18":68},"c21b2c90-b77c-4205-8c60-a823c6313722","notify.ts","8aae0de8-afb0-11f1-ac66-1607ee4eb77e",28,["D",1789336843202],"interval","/**\n * InfinitePay checkout — notification cron val. Schedule: every minute.\n *\n * Kept out of the webhook handler on purpose. The webhook has a ~1s budget and\n * a non-200 makes InfinitePay redeliver, so doing mail there would mean a slow\n * SMTP call could trigger a duplicate payment notification. Here, a failed send\n * simply leaves the timestamp NULL and the next tick retries it.\n *\n * Both emails go through Resend:\n * 1. email the seller (SELLER_EMAIL_TO) every newly paid order\n * 2. email the buyer a shipping confirmation via a Resend template\n *\n * Resend is used for the seller too (not std/email) so the notification can\n * reach any address — std/email can only reach the val owner. Everything is a\n * no-op until RESEND_API_KEY and RESEND_EMAIL_FROM are set, so the system is\n * fully functional before the sending domain is verified — buyers still get\n * InfinitePay's own receipt in the meantime.\n */\nimport { Resend } from \"npm:resend@6\";\nimport { markEmailSent, type Order, ordersNeedingEmail } from \"./db.ts\";\n\nexport default async function () {\n await sendSellerEmails();\n await sendBuyerEmails();\n}\n\n/**\n * Shared Resend client. Constructed here rather than at module scope so the\n * val still loads (and the seller email still works) when Resend is not\n * configured yet. Returns null until RESEND_API_KEY and RESEND_EMAIL_FROM are\n * both set, which makes the whole cron a no-op while the domain is unverified.\n */\nfunction resendMaybe(): { client: Resend; from: string } | null {\n const apiKey = Deno.env.get(\"RESEND_API_KEY\");\n const from = Deno.env.get(\"RESEND_EMAIL_FROM\");\n if (!apiKey || !from) return null;\n return { client: new Resend(apiKey), from };\n}\n\n/* ------------------------------------------------------------------ seller */\n\n/**\n * Sends the seller a plain-text order notice via Resend to SELLER_EMAIL_TO, so\n * it isn't tied to the val owner's account address.\n */\nasync function sendSellerEmails() {\n const resend = resendMaybe();\n if (!resend) return;\n // The address the seller notification goes to. Until it is set, skip rather\n // than fail — misconfiguring it means emails going to the wrong inbox, so\n // absence is treated as \"not configured yet\".\n const to = Deno.env.get(\"SELLER_EMAIL_TO\");\n if (!to) return;\n\n for (const order of await ordersNeedingEmail(\"seller_email_sent_at\")) {\n try {\n // Resend reports failures in `error` instead of throwing, so a bad key or\n // an unverified domain is easy to miss — check it explicitly.\n const { data, error } = await resend.client.emails.send({\n from: resend.from,\n to,\n subject: `Novo pedido pago — ${order.book_slug} (${\n brl(order.paid_amount_cents ?? order.amount_cents)\n })`,\n text: sellerEmailText(order),\n });\n\n if (error) {\n console.error(\"seller email failed\", order.order_nsu, error);\n continue; // leave the timestamp NULL; the next tick retries\n }\n\n console.log(\"seller email sent\", order.order_nsu, data?.id);\n await markEmailSent(order.order_nsu, \"seller_email_sent_at\");\n } catch (error) {\n console.error(\"seller email threw\", order.order_nsu, error);\n }\n }\n}\n\nfunction sellerEmailText(order: Order): string {\n return [\n `Pedido: ${order.order_nsu}`,\n `Livro: ${order.book_slug} — ${order.quantity} exemplar(es)`,\n `Valor pago: ${brl(order.paid_amount_cents ?? order.amount_cents)}`,\n `Pagamento: ${order.capture_method ?? \"-\"}${\n order.installments ? ` em ${order.installments}x` : \"\"\n }`,\n order.receipt_url ? `Comprovante: ${order.receipt_url}` : null,\n \"\",\n \"COMPRADOR\",\n `Nome: ${order.customer_name}`,\n `Email: ${order.customer_email}`,\n order.customer_phone ? `Telefone: ${order.customer_phone}` : null,\n \"\",\n \"ENTREGA\",\n `${order.street ?? \"\"}, ${order.number ?? \"\"}${\n order.complement ? ` — ${order.complement}` : \"\"\n }`,\n `${order.neighborhood ?? \"\"}`,\n `${order.city ?? \"\"} — ${order.state ?? \"\"}`,\n `CEP: ${order.cep ?? \"-\"}`,\n \"\",\n \"DEDICATÓRIA\",\n order.dedicatoria?.trim() || \"(sem dedicatória)\",\n order.referral ? `\\nReferral: ${order.referral}` : null,\n \"\",\n `transaction_nsu: ${order.transaction_nsu ?? \"-\"}`,\n `invoice_slug: ${order.invoice_slug ?? \"-\"}`,\n ].filter((line) => line !== null).join(\"\\n\");\n}\n\n/* ------------------------------------------------------------------- buyer */\n\n/**\n * The buyer's shipping confirmation, sent via a Resend template.\n *\n * The body lives in a Resend template rather than here, so Dayanne can edit the\n * copy in the dashboard without a redeploy. This code only supplies the two\n * variables the template references — see valtown/README.md for the contract.\n */\nasync function sendBuyerEmails() {\n const resend = resendMaybe();\n if (!resend) return;\n\n const templateId = Deno.env.get(\"RESEND_TEMPLATE_ID\") ?? \"order-confirmation\";\n\n for (const order of await ordersNeedingEmail(\"buyer_email_sent_at\")) {\n try {\n // Resend reports failures in `error` instead of throwing, so a bad key,\n // an unverified domain or an unpublished template is easy to miss —\n // check it explicitly.\n const { data, error } = await resend.client.emails.send({\n from: resend.from,\n to: [order.customer_email],\n // No subject/html/text: the published template owns all three.\n template: {\n id: templateId,\n variables: buyerTemplateVariables(order),\n },\n });\n\n if (error) {\n console.error(\n \"resend failed\",\n order.order_nsu,\n error,\n `(template \"${templateId}\" — is it published, and does it reference only RECIPIENT_NAME and ADDRESS?)`,\n );\n continue; // leave the timestamp NULL; the next tick retries\n }\n\n console.log(\"buyer email sent\", order.order_nsu, data?.id);\n await markEmailSent(order.order_nsu, \"buyer_email_sent_at\");\n } catch (error) {\n console.error(\"buyer email threw\", order.order_nsu, error);\n }\n }\n}\n\n/**\n * The two variables the published Resend template references.\n *\n * The template renders them with {{{triple braces}}}, i.e. unescaped, so every\n * segment is escaped here. `complement` in particular is free text typed by the\n * buyer and must never reach the email as raw HTML.\n *\n * Both keys are always present: Resend rejects the whole send with a validation\n * error if the template references a variable the call did not supply, so an\n * empty string is correct where a missing key is not.\n */\nfunction buyerTemplateVariables(order: Order): Record {\n const streetLine = [order.street, order.number].filter(Boolean).join(\", \") +\n (order.complement ? ` — ${order.complement}` : \"\");\n\n const cityLine = [order.city, order.state].filter(Boolean).join(\" — \");\n\n const address = [\n streetLine,\n order.neighborhood,\n cityLine,\n formatCep(order.cep),\n ]\n .map((line) => (line ?? \"\").trim())\n .filter((line) => line !== \"\")\n .map(escapeHtml)\n .join(\"
\");\n\n return {\n // Labelled \"Destinatario\" in the template, so the full name, not just the first.\n RECIPIENT_NAME: escapeHtml(order.customer_name),\n ADDRESS: address,\n };\n}\n\n/** Stored as 8 digits; shown the way Brazilians write it. */\nfunction formatCep(cep: string | null): string {\n if (!cep) return \"\";\n const digits = cep.replace(/\\D/g, \"\");\n return digits.length === 8\n ? `CEP ${digits.slice(0, 5)}-${digits.slice(5)}`\n : `CEP ${cep}`;\n}\n\nfunction escapeHtml(value: string): string {\n return String(value ?? \"\").replace(/[&<>\"']/g, (char) => ({\n \"&\": \"&\",\n \"<\": \"<\",\n \">\": \">\",\n '\"': \""\",\n \"'\": \"'\",\n }[char] as string));\n}\n\nfunction brl(cents: number): string {\n return (cents / 100).toLocaleString(\"pt-BR\", {\n style: \"currency\",\n currency: \"BRL\",\n });\n}\n","children",[],[60],"19652b39-5847-418b-869a-d53df5548ffe","main.ts","1df4ed5a-af99-11f1-b5cd-1607ee4eb77e",26,["D",1789334276046],9,"http","/**\n * InfinitePay checkout — HTTP val.\n *\n * Routes\n * GET / health check — touches no database\n * POST /link create a checkout link for an order\n * POST /webhook InfinitePay payment notification\n * OPTIONS * CORS preflight\n *\n * SECURITY NOTE. On Val Town's free plan this source is world-readable, so\n * assume an attacker knows every route and payload shape below. Nothing here\n * relies on secrecy of the code:\n * - prices come from `bundle_discounts`, never from the request body, so a\n * tampered payload cannot buy a book for R$1;\n * - /webhook is a public, unauthenticated endpoint. InfinitePay signs nothing,\n * so its payload is treated as a hint and verified against their own\n * payment_check endpoint before an order is ever marked paid. That check is\n * the whole security boundary: a forged notification cannot fabricate a\n * payment, and it is the reason no shared secret is needed here.\n * Every configurable value is an env var — see README.md.\n */\nimport {\n getBundle,\n getOrder,\n insertOrder,\n markPaid,\n setCheckoutUrl,\n} from \"./db.ts\";\nimport { createLink, paymentCheck } from \"./infinitepay.ts\";\nimport { selectOne } from \"./db.ts\";\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const path = url.pathname.replace(/\\/+$/, \"\") || \"/\";\n\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: corsHeaders(req) });\n }\n\n try {\n // Touches nothing: no database, no env vars. If this responds but /link\n // hangs, the problem is SQLite, not the val.\n if (req.method === \"GET\" && path === \"/\") {\n const health: Record = {\n ok: true,\n service: \"checkout\",\n routes: [\"POST /link\", \"POST /webhook\"],\n };\n // ?db=1 adds one trivial read. Opt-in so the plain health check stays\n // answerable even when SQLite is the thing that is broken.\n if (url.searchParams.has(\"db\")) health.db = await probeDb();\n return json(req, health);\n }\n\n if (req.method === \"POST\" && path === \"/link\") return await handleLink(req);\n if (req.method === \"POST\" && path === \"/webhook\") {\n return await handleWebhook(req);\n }\n\n return json(req, { error: \"not_found\" }, 404);\n } catch (error) {\n console.error(\"Unhandled error\", error);\n return json(req, { error: \"internal_error\" }, 500);\n }\n}\n\n/* -------------------------------------------------------------- POST /link */\n\nasync function handleLink(req: Request): Promise {\n const origin = req.headers.get(\"Origin\");\n if (origin && !isAllowedOrigin(origin)) {\n return json(req, { error: \"forbidden_origin\" }, 403);\n }\n\n let body: Record;\n try {\n body = await req.json();\n } catch {\n return json(req, { error: \"invalid_json\" }, 400);\n }\n\n const bookSlug = str(body.book, 64);\n const units = Number(body.quantity);\n\n if (!bookSlug || !Number.isInteger(units) || units < 1) {\n return json(req, { error: \"invalid_product\" }, 400);\n }\n\n // The price is resolved here and nowhere else. Anything price-shaped in the\n // request body is ignored on purpose.\n const bundle = await getBundle(bookSlug, units);\n if (!bundle) return json(req, { error: \"unknown_product\" }, 404);\n\n const amountCents = bundle.units * bundle.unit_price_cents;\n\n const name = str(body.name, 120);\n const email = str(body.email, 160);\n if (!name || !email || !isEmail(email)) {\n return json(req, { error: \"invalid_customer\" }, 400);\n }\n\n // Both URLs come from the request rather than configuration.\n //\n // The val's own origin is where InfinitePay must POST the payment\n // notification. Taking it from the incoming request means it cannot drift out\n // of sync with wherever this val actually lives.\n const valOrigin = new URL(req.url).origin;\n\n // The buyer goes back to the origin they checked out on — already validated\n // against ALLOWED_ORIGINS above, so it cannot be steered somewhere else. This\n // also keeps www and apex visitors on the host they started from, and sends a\n // local dev checkout back to localhost rather than production.\n const siteOrigin = origin ?? allowedOrigins()[0];\n if (!siteOrigin) {\n console.error(\"ALLOWED_ORIGINS is empty; cannot build a redirect_url\");\n return json(req, { error: \"misconfigured\" }, 500);\n }\n\n const orderNsu = crypto.randomUUID();\n\n const order = {\n order_nsu: orderNsu,\n book_slug: bundle.book_slug,\n quantity: bundle.units,\n amount_cents: amountCents,\n customer_name: name,\n customer_email: email,\n customer_phone: normalisePhone(str(body.phone, 32)),\n dedicatoria: str(body.dedicatoria, 500),\n cep: digits(str(body.cep, 20)),\n street: str(body.street, 200),\n neighborhood: str(body.neighborhood, 120),\n number: str(body.number, 20),\n complement: str(body.complement, 120),\n city: str(body.city, 120),\n state: str(body.state, 8),\n referral: str(body.referral, 80),\n };\n\n // Written before the API call so a failed or slow InfinitePay response still\n // leaves us with the buyer's shipping address.\n await insertOrder(order);\n\n const checkoutUrl = await createLink({\n order_nsu: orderNsu,\n // InfinitePay multiplies price by quantity, so this is the unit price and\n // the line total comes to bundle.units * bundle.unit_price_cents.\n items: [{\n quantity: bundle.units,\n price: bundle.unit_price_cents,\n description: bundle.title,\n }],\n redirect_url: `${siteOrigin}/pedido-confirmado/`,\n webhook_url: `${valOrigin}/webhook`,\n customer: {\n name: order.customer_name,\n email: order.customer_email,\n phone_number: order.customer_phone ?? undefined,\n },\n address: {\n cep: order.cep ?? undefined,\n street: order.street ?? undefined,\n neighborhood: order.neighborhood ?? undefined,\n number: order.number ?? undefined,\n complement: order.complement ?? undefined,\n },\n });\n\n await setCheckoutUrl(orderNsu, checkoutUrl);\n\n // Logged so a wrong derivation is obvious on the first order rather than when\n // a payment silently fails to register.\n console.log(\"order created\", orderNsu, {\n book: bundle.book_slug,\n units: bundle.units,\n unitPrice: bundle.unit_price_cents,\n discounted: bundle.discounted,\n total: amountCents,\n valOrigin,\n siteOrigin,\n });\n\n return json(req, {\n checkout_url: checkoutUrl,\n order_nsu: orderNsu,\n amount_cents: amountCents,\n });\n}\n\n/* ----------------------------------------------------------- POST /webhook */\n\nasync function handleWebhook(req: Request): Promise {\n const raw = await req.text();\n\n // Every branch below acks with 200 and says why: a 400 would make InfinitePay\n // redeliver, which is only wanted for genuinely transient failures. The\n // reasons go to Val Town's request logs rather than a table of our own.\n let body: Record;\n try {\n body = JSON.parse(raw);\n } catch {\n console.warn(\"webhook ignored: body is not JSON\", raw.slice(0, 500));\n return new Response(\"OK\", { status: 200 });\n }\n\n const orderNsu = str(body.order_nsu, 64);\n const transactionNsu = str(body.transaction_nsu, 120);\n const slug = str(body.invoice_slug, 120) ?? str(body.slug, 120);\n\n if (!orderNsu) {\n console.warn(\n \"webhook ignored: no order_nsu in the body\",\n raw.slice(0, 500),\n );\n return new Response(\"OK\", { status: 200 });\n }\n\n const order = await getOrder(orderNsu);\n if (!order) {\n console.warn(\"webhook ignored: unknown order\", orderNsu);\n return new Response(\"OK\", { status: 200 });\n }\n\n if (order.status === \"paid\") {\n // Idempotency: InfinitePay retries, and we ack retries without re-emailing.\n console.log(\"webhook ignored: order already paid\", orderNsu);\n return new Response(\"OK\", { status: 200 });\n }\n\n if (!transactionNsu || !slug) {\n console.warn(\n \"webhook ignored: no transaction_nsu or slug to verify with\",\n orderNsu,\n );\n return new Response(\"OK\", { status: 200 });\n }\n\n // The body is only a hint, and this endpoint is public — anyone can POST to\n // it. This call is the sole reason a forged notification cannot fabricate a\n // payment. Never mark an order paid on the strength of the body alone.\n const check = await paymentCheck({\n order_nsu: orderNsu,\n transaction_nsu: transactionNsu,\n slug,\n });\n\n const paidAmount = Number(check.paid_amount ?? check.amount ?? 0);\n\n if (!check.success || !check.paid || paidAmount < order.amount_cents) {\n // Either the notification was forged, or the amount does not cover the\n // catalog price. Both leave the order pending.\n console.warn(\n \"webhook rejected: payment_check did not confirm\",\n orderNsu,\n {\n success: check.success,\n paid: check.paid,\n paidAmount,\n expected: order.amount_cents,\n },\n );\n return new Response(\"OK\", { status: 200 });\n }\n\n await markPaid(orderNsu, {\n paid_amount_cents: paidAmount,\n installments: numOrNull(check.installments ?? body.installments),\n capture_method: check.capture_method ?? str(body.capture_method, 40),\n transaction_nsu: transactionNsu,\n invoice_slug: slug,\n receipt_url: str(body.receipt_url, 500),\n });\n\n // Emails are sent by the notify cron val so this stays inside the ~1s budget\n // the docs ask for, and so a mail failure can be retried without a redelivery.\n console.log(\"webhook verified paid\", orderNsu);\n return new Response(\"OK\", { status: 200 });\n}\n\n/**\n * One cheap read, with a deadline. Without the race a stalled SQLite would hang\n * the health check to Val Town's 1m request timeout, which is the failure this\n * endpoint exists to diagnose.\n */\nasync function probeDb(): Promise {\n try {\n return await Promise.race([\n selectOne().then(() => \"ok\"),\n new Promise((resolve) =>\n setTimeout(() => resolve(\"timeout after 5s\"), 5000)\n ),\n ]);\n } catch (error) {\n return `error: ${error instanceof Error ? error.message : String(error)}`;\n }\n}\n\n/* ------------------------------------------------------------------ helpers */\n\nfunction allowedOrigins(): string[] {\n return (Deno.env.get(\"ALLOWED_ORIGINS\") ?? \"\")\n .split(\",\")\n .map((o) => o.trim())\n .filter(Boolean);\n}\n\nfunction isAllowedOrigin(origin: string): boolean {\n return allowedOrigins().includes(origin);\n}\n\n/** Reflect the origin when it is allowed; never `*` — this endpoint writes. */\nfunction corsHeaders(req: Request): Record {\n const origin = req.headers.get(\"Origin\");\n const headers: Record = {\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n \"Access-Control-Max-Age\": \"86400\",\n Vary: \"Origin\",\n };\n if (origin && isAllowedOrigin(origin)) {\n headers[\"Access-Control-Allow-Origin\"] = origin;\n }\n return headers;\n}\n\nfunction json(req: Request, body: unknown, status = 200): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders(req) },\n });\n}\n\nfunction str(value: unknown, maxLength: number): string | null {\n if (typeof value !== \"string\") return null;\n const trimmed = value.trim().slice(0, maxLength);\n return trimmed === \"\" ? null : trimmed;\n}\n\nfunction digits(value: string | null): string | null {\n if (!value) return null;\n const only = value.replace(/\\D/g, \"\");\n return only === \"\" ? null : only;\n}\n\nfunction numOrNull(value: unknown): number | null {\n const n = Number(value);\n return Number.isFinite(n) ? n : null;\n}\n\nfunction isEmail(value: string): boolean {\n return /^[^\\s@]+@[^\\s@]+\\.[^\\s@]{2,}$/.test(value);\n}\n\n/** InfinitePay wants E.164; Brazilian numbers arrive as 11 digits at most. */\nfunction normalisePhone(value: string | null): string | null {\n const only = digits(value);\n if (!only) return null;\n if (only.length < 10 || only.length > 13) return null;\n return only.startsWith(\"55\") ? `+${only}` : `+55${only}`;\n}",[],[70],"cb302c49-9a3a-48e4-84f2-004a908c4471","infinitepay.ts","77d00cda-afb0-11f1-b1ef-1607ee4eb77e",13,["D",1789330810626],2,"/**\n * Thin wrappers over the two InfinitePay Checkout endpoints we use.\n *\n * Nothing here is configured by a literal: the handle comes from an env var,\n * because this val's source is publicly readable on Val Town's free plan.\n */\n\nconst API = \"https://api.checkout.infinitepay.io\";\n\nexport interface LinkItem {\n quantity: number;\n price: number; // CENTAVOS\n description: string;\n}\n\nexport interface CreateLinkInput {\n order_nsu: string;\n items: LinkItem[];\n redirect_url: string;\n webhook_url: string;\n customer?: { name?: string; email?: string; phone_number?: string };\n address?: {\n cep?: string;\n street?: string;\n neighborhood?: string;\n number?: string;\n complement?: string;\n };\n}\n\nexport async function createLink(input: CreateLinkInput): Promise {\n const handle = requireEnv(\"INFINITEPAY_HANDLE\");\n\n const payload: Record = {\n handle,\n items: input.items,\n order_nsu: input.order_nsu,\n redirect_url: input.redirect_url,\n webhook_url: input.webhook_url,\n };\n\n // Blank fields arrive as `undefined` — str() maps \"\" to null and the caller\n // maps null to undefined — and JSON.stringify omits undefined properties, so\n // nothing blank reaches InfinitePay on its own. The only case needing a guard\n // is an object whose every field is blank, which would serialize as {}.\n if (input.customer && Object.values(input.customer).some(Boolean)) {\n payload.customer = input.customer;\n }\n\n if (input.address && Object.values(input.address).some(Boolean)) {\n payload.address = input.address;\n }\n\n const response = await fetch(`${API}/links`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", Accept: \"application/json\" },\n body: JSON.stringify(payload),\n });\n\n if (!response.ok) {\n // Read as text, not JSON: a 4xx body names the offending field and is worth\n // logging verbatim even when it is not valid JSON.\n console.error(\n \"InfinitePay /links failed\",\n response.status,\n await response.text(),\n );\n throw new Error(`InfinitePay returned ${response.status}`);\n }\n\n // { \"url\": \"https://checkout.infinitepay.com.br/...\" }\n const body = await response.json() as { url?: unknown };\n\n // Still checked: a malformed response must fail here rather than send the\n // buyer to `undefined`.\n if (typeof body.url !== \"string\" || !body.url.startsWith(\"http\")) {\n console.error(\n \"InfinitePay /links had no url in the response\",\n JSON.stringify(body),\n );\n throw new Error(\"InfinitePay response contained no checkout URL\");\n }\n\n return body.url;\n}\n\nexport interface PaymentCheckResult {\n success: boolean;\n paid: boolean;\n amount?: number;\n paid_amount?: number;\n installments?: number;\n capture_method?: string;\n}\n\n/**\n * The webhook carries no signature, so this is what actually establishes that a\n * payment happened. Never trust a webhook body without calling this first.\n */\nexport async function paymentCheck(args: {\n order_nsu: string;\n transaction_nsu: string;\n slug: string;\n}): Promise {\n const handle = requireEnv(\"INFINITEPAY_HANDLE\");\n\n const response = await fetch(`${API}/payment_check`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", Accept: \"application/json\" },\n body: JSON.stringify({ handle, ...args }),\n });\n\n if (!response.ok) {\n console.error(\n \"InfinitePay /payment_check failed\",\n response.status,\n await response.text(),\n );\n return { success: false, paid: false };\n }\n\n return (await response.json()) as PaymentCheckResult;\n}\n\nexport function requireEnv(name: string): string {\n const value = Deno.env.get(name);\n if (!value) throw new Error(`Missing required env var: ${name}`);\n return value;\n}",[],[80],["D",1789334266671],[],[19],"639ca8a8-1138-4d2c-8f90-70d7c3fd0872",["D",1789320759226],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Handles a web form, and sends a Resend confirmation email.","imageUrl","userId","019c60b1-a4d0-7731-935c-3d10ad61d034","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019c60b1-a4d0-7731-935c-42775a719a84","tursoName","639ca8a811384d2c8f9070d7c3fd0872","tursoHostname","639ca8a811384d2c8f9070d7c3fd0872-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789494690166],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_148":144},"org",{"_11":12,"_142":-5,"_143":144,"_101":102,"_145":146,"_147":52},"branch",{"_17":62,"_13":16,"_33":39,"_134":91,"_135":-5,"_136":-5,"_137":-5,"_138":-5,"_139":-5,"_140":14,"_141":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18zOWhXUmxoUktmbGZNZFRQWnhlYWJFeWpGSjAifQ","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":91,"_13":14,"_44":192,"_93":-5,"_94":52,"_95":96,"_97":96,"_98":99,"_100":-5,"_101":102,"_103":71,"_104":43,"_105":-5,"_106":-5,"_107":108,"_109":110,"_111":112,"_113":114,"_115":193,"_117":-5,"_118":119,"_120":119,"_121":122,"_123":122,"_124":122,"_125":119,"_126":119,"_127":194,"_129":195,"_131":196,"_133":52},[180,181,182,183],"files",[180,181,182,183],"counts",{"_169":108,"_170":171,"_172":108,"_32":173,"_174":175},[],{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_18":168},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},[19],"pulls","branches",1,"forks",{"_176":178,"_179":108},"connections",{"_176":108,"_177":108},"count","unfilledCount",6,"emptyCount",{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":88,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_66":190,"_18":191},{"_33":79,"_13":80,"_35":81,"_37":-5,"_38":39,"_40":82,"_42":43,"_44":83,"_17":84,"_47":48,"_49":85,"_51":52,"_53":-5,"_66":188,"_18":189},{"_33":69,"_13":70,"_35":71,"_37":-5,"_38":39,"_40":72,"_42":43,"_44":73,"_17":74,"_47":75,"_49":76,"_51":52,"_53":-5,"_66":186,"_18":187},{"_33":59,"_13":60,"_35":61,"_37":-5,"_38":39,"_40":62,"_42":43,"_44":63,"_17":46,"_47":64,"_49":65,"_51":52,"_53":-5,"_66":184,"_18":185},[],[60],[],[70],[],[80],[],[19],["D",1789320759226],["D",1789494690166],{"_11":12,"_148":144},{"_11":12,"_142":-5,"_143":144,"_101":102,"_145":146,"_147":52},{"_17":62,"_13":16,"_33":39,"_134":91,"_135":-5,"_136":-5,"_137":-5,"_138":-5,"_139":-5,"_140":14,"_141":12},"ctx",{"_127":-5,"_165":230,"_231":232,"_233":234,"_235":52,"_236":52,"_237":52,"_238":43,"_239":-5,"_240":-7,"_241":-7,"_242":108,"_243":52,"_244":52,"_245":-5,"_246":52,"_247":52,"_248":52,"_249":-5},"ENV",{"_201":202,"_203":204,"_205":16,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215,"_216":217,"_218":219,"_220":221,"_222":223,"_224":225,"_226":227,"_228":229},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]