[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_156":157,"_158":159},"routes/_app.x.$handle.$name",{"_96":95,"_32":45,"_105":86,"_27":53,"_13":14,"_106":-5,"_11":107,"_108":109,"_110":111,"_112":113,"_114":115,"_20":-5,"_116":-5,"_117":-5,"_118":25,"_119":120,"_121":58,"_122":-5,"_123":-5,"_124":125},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":25},"version",42,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","0c92d832-aa6d-11f1-b23f-1607ee4eb77e","name","fileType","http","content","// -----------------------------------------------------------------------------\n// val: timporello/GoogleApps -> https://alatmsmoonai.val.run/\n//\n// Three roles, routed by URL path:\n//\n// POST / MoonAI Custom Integration -> Google Apps Script (/exec)\n// redirect-follow proxy; unwraps MoonAI's {inputs:{...}} body.\n// Handles: ping / sp_check / find_cargo / route_deal / ...\n//\n// POST /inbound SendPulse WhatsApp bot webhook (\"incoming message\")\n// -> MoonAI API channel inbound\n// POST core.mooonai.com/api/v1/channels/api/messages\n// (thread_id = client phone digits)\n//\n// POST /outbound MoonAI API channel outgoing webhook (agent replies)\n// -> SendPulse WhatsApp send\n// POST api.sendpulse.com/whatsapp/contacts/sendByPhone\n//\n// Env vars:\n// APPS_SCRIPT_URL https://script.google.com/macros/s/.../exec (no query)\n// SHARED_SECRET token appended to the Apps Script call\n// MOONAI_API_KEY X-API-Key for the MoonAI API channel (agent 6739)\n// SP_CLIENT_ID SendPulse OAuth client id\n// SP_CLIENT_SECRET SendPulse OAuth client secret\n// SP_BOT_ID SendPulse internal bot id for WhatsApp 77757088880\n// -----------------------------------------------------------------------------\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\n\nconst MOONAI_INBOUND = \"https://core.mooonai.com/api/v1/channels/api/messages\";\nconst SP_API = \"https://api.sendpulse.com\";\nconst SOURCE = \"wa\";\n\n// Served at /privacy — the privacy-policy URL for the \"SendPulse Helper\"\n// Chrome extension's Web Store listing. Public, no token: reviewers and\n// users must be able to open it directly.\nconst PRIVACY_HTML = `\n\nSendPulse Helper — политика конфиденциальности\n\n\n

SendPulse Helper — политика конфиденциальности

Личное расширение Chrome для собственного удобства в работе с SendPulse.\nНе распространяется публично.

\n\n

Что делает расширение

Голосовые сообщения. Кнопка в открытом чате SendPulse записывает\nголосовое через микрофон браузера и вкладывает файл в стандартное поле\nзагрузки вложений на той же странице — пользователь сам нажимает\n«Отправить». Запись никуда не передаётся и не сохраняется расширением; она\nсуществует только в памяти вкладки браузера до момента прикрепления.

Поиск чата по номеру телефона. Номер телефона, который пользователь\nвводит в поле поиска, отправляется на личный сервер поиска для нахождения\nсоответствующего чата в SendPulse. Сервер возвращает ссылку на найденный\nчат.

\n\n

Какие данные обрабатываются

Единственные данные, которые расширение передаёт за пределы страницы —\nномер телефона, введённый в поиске. Он используется исключительно для поиска\nчата и может кратковременно присутствовать в технических логах сервера (для\nотладки), но не передаётся третьим лицам, не продаётся, не используется для\nрекламы, аналитики или профилирования.

\n\n

Что расширение не делает

Не собирает историю переписки, не читает содержимое чатов, не отслеживает\nдействия за пределами страниц login.sendpulse.com, не\nустанавливает сторонние библиотеки или трекеры.

\n\n

Контакты

По вопросам — timporello@gmail.com

\n`;\n\nfunction j(data: unknown, status = 200): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: {\n \"Content-Type\": \"application/json; charset=utf-8\",\n \"Access-Control-Allow-Origin\": \"*\",\n },\n });\n}\n\n// -- inbound message -> phone map (val.town SQLite, survives isolate recycling) --\n// MoonAI's API channel exposes NO phone to function calls (no system param, and\n// the sender name is not in the model's context). So route_deal always arrives\n// with phone:\"\". We recover it three ways, in order:\n// 1. exact match of the payload's `first_message` against a relayed message\n// 2. fuzzy (substring / shared 20-char prefix) — the agent often trims or\n// concatenates the client's messages\n// 3. the phone of the most recent /inbound within 60s — route_deal reliably\n// fires ~5-10s after the message that triggered it\nconst INBOUND_MSG_TTL = 30 * 60 * 1000;\nconst LAST_INBOUND_WINDOW = 60 * 1000;\nconst LAST_KEY = \"__last_inbound__\";\nlet msgTableReady: Promise | null = null;\nfunction ensureMsgTable(): Promise {\n if (!msgTableReady) {\n msgTableReady = sqlite\n .execute(\n \"CREATE TABLE IF NOT EXISTS msg_phone (k TEXT PRIMARY KEY, phone TEXT NOT NULL, ts INTEGER NOT NULL)\",\n )\n .then(() => {})\n .catch((e) => {\n console.log(\"msg_phone table init failed\", String(e));\n msgTableReady = null;\n });\n }\n return msgTableReady ?? Promise.resolve();\n}\nfunction normMsg(s: string): string {\n return String(s || \"\").toLowerCase().replace(/\\s+/g, \" \").trim().slice(\n 0,\n 240,\n );\n}\nasync function rememberInbound(text: string, phone: string): Promise {\n const k = normMsg(text);\n const digits = String(phone || \"\").replace(/[^\\d]/g, \"\");\n if (digits.length < 10) return;\n const now = Date.now();\n try {\n await ensureMsgTable();\n const rows = [{ k: LAST_KEY, p: digits, t: now }];\n if (k.length >= 4) rows.push({ k, p: digits, t: now });\n for (const row of rows) {\n await sqlite.execute({\n sql: \"INSERT INTO msg_phone (k, phone, ts) VALUES (:k, :p, :t) \" +\n \"ON CONFLICT(k) DO UPDATE SET phone = :p, ts = :t\",\n args: row,\n });\n }\n await sqlite.execute({\n sql: \"DELETE FROM msg_phone WHERE ts < :cut\",\n args: { cut: now - INBOUND_MSG_TTL },\n });\n } catch (e) {\n console.log(\"rememberInbound failed\", String(e));\n }\n}\n// A first_message that is basically just a greeting is not a reliable key —\n// go straight to the \"most recent inbound\" fallback for those.\nfunction isGreetingOnly(nk: string): boolean {\n const s = nk.replace(/[^a-zа-яёЀ-ӿ ]/gi, \"\").trim();\n return s.length < 14 ||\n /^(салем|сәлем|сәлеметсіз бе|саламатсыз ба|привет|здравствуйте|здрасте|добрый день|добрый вечер|доброе утро|hi|hello|assalam|ассалам)/i\n .test(s);\n}\nasync function phoneForMessage(text: string): Promise {\n const nk = normMsg(text);\n const now = Date.now();\n const weakKey = isGreetingOnly(nk);\n try {\n await ensureMsgTable();\n // 1. exact\n if (!weakKey && nk.length >= 12) {\n const r = await sqlite.execute({\n sql:\n \"SELECT phone FROM msg_phone WHERE k = :k AND ts > :cut ORDER BY ts DESC LIMIT 1\",\n args: { k: nk, cut: now - INBOUND_MSG_TTL },\n });\n if (r.rows && r.rows[0]) return String((r.rows[0] as unknown[])[0] || \"\");\n }\n // 2. fuzzy against recent relayed messages\n if (!weakKey && nk.length >= 14) {\n const r = await sqlite.execute({\n sql:\n \"SELECT k, phone FROM msg_phone WHERE ts > :cut AND k != :last ORDER BY ts DESC LIMIT 60\",\n args: { cut: now - INBOUND_MSG_TTL, last: LAST_KEY },\n });\n for (const row of (r.rows || []) as unknown[][]) {\n const rk = String(row[0] || \"\");\n if (\n rk.length >= 8 &&\n (nk.includes(rk) || rk.includes(nk) ||\n nk.slice(0, 20) === rk.slice(0, 20))\n ) {\n return String(row[1] || \"\");\n }\n }\n }\n // 3. most recent inbound within the window\n const r = await sqlite.execute({\n sql: \"SELECT phone FROM msg_phone WHERE k = :last AND ts > :cut LIMIT 1\",\n args: { last: LAST_KEY, cut: now - LAST_INBOUND_WINDOW },\n });\n if (r.rows && r.rows[0]) return String((r.rows[0] as unknown[])[0] || \"\");\n return \"\";\n } catch (e) {\n console.log(\"phoneForMessage failed\", String(e));\n return \"\";\n }\n}\n\n// -- manager takeover: bot goes quiet once a human operator WRITES in the chat --\n// Opening the chat (a flow \"open_chat\" action, or an operator just viewing it) is\n// NOT a takeover — the bot keeps talking until a human actually sends a message.\n// SendPulse fires `outgoing_message` for every send; a human operator's message\n// carries `sent_by: {id,...}` (an object) / channel \"ma\", our relay's sends are\n// `sent_by: null`, channel \"api\". Rolling window: each operator message refreshes\n// it; after MGR_PAUSE_MS of silence the bot may reply again.\nconst MGR_PAUSE_MS = (Number(Deno.env.get(\"MGR_PAUSE_MINUTES\")) || 120) * 60 *\n 1000;\nlet mgrTableReady: Promise | null = null;\nfunction ensureMgrTable(): Promise {\n if (!mgrTableReady) {\n mgrTableReady = sqlite\n .execute(\n \"CREATE TABLE IF NOT EXISTS mgr_active (thread TEXT PRIMARY KEY, ts INTEGER NOT NULL)\",\n )\n .then(() => {})\n .catch((e) => {\n console.log(\"mgr_active init failed\", String(e));\n mgrTableReady = null;\n });\n }\n return mgrTableReady ?? Promise.resolve();\n}\nasync function markManagerActive(thread: string): Promise {\n const t = String(thread || \"\").replace(/[^\\d]/g, \"\");\n if (t.length < 10) return;\n try {\n await ensureMgrTable();\n await sqlite.execute({\n sql: \"INSERT INTO mgr_active (thread, ts) VALUES (:t, :n) \" +\n \"ON CONFLICT(thread) DO UPDATE SET ts = :n\",\n args: { t, n: Date.now() },\n });\n } catch (e) {\n console.log(\"markManagerActive failed\", String(e));\n }\n}\nasync function isManagerActive(thread: string): Promise {\n const t = String(thread || \"\").replace(/[^\\d]/g, \"\");\n if (t.length < 10) return false;\n try {\n await ensureMgrTable();\n const r = await sqlite.execute({\n sql: \"SELECT ts FROM mgr_active WHERE thread = :t\",\n args: { t },\n });\n const ts = r.rows && r.rows[0] ? Number((r.rows[0] as unknown[])[0]) : 0;\n if (!ts) return false;\n if (Date.now() - ts > MGR_PAUSE_MS) {\n await sqlite.execute({\n sql: \"DELETE FROM mgr_active WHERE thread = :t\",\n args: { t },\n });\n return false;\n }\n return true;\n } catch (e) {\n console.log(\"isManagerActive failed\", String(e));\n return false;\n }\n}\n\n// -- conversation reset: a per-phone salt appended to the MoonAI thread_id so a\n// reset phone starts a brand-new MoonAI conversation with no old context. Set by\n// POST /reset (token-gated). thread_id format: \"[__]|\";\n// handleOutbound strips \"|\" to recover the phone.\nlet saltTableReady: Promise | null = null;\nfunction ensureSaltTable(): Promise {\n if (!saltTableReady) {\n saltTableReady = sqlite\n .execute(\n \"CREATE TABLE IF NOT EXISTS thread_salt (phone TEXT PRIMARY KEY, salt TEXT NOT NULL, ts INTEGER NOT NULL)\",\n )\n .then(() => {})\n .catch((e) => {\n console.log(\"thread_salt init failed\", String(e));\n saltTableReady = null;\n });\n }\n return saltTableReady ?? Promise.resolve();\n}\nasync function saltFor(phone: string): Promise {\n const p = String(phone || \"\").replace(/[^\\d]/g, \"\");\n if (p.length < 10) return \"\";\n try {\n await ensureSaltTable();\n const r = await sqlite.execute({\n sql: \"SELECT salt FROM thread_salt WHERE phone = :p\",\n args: { p },\n });\n if (r.rows && r.rows[0]) return String((r.rows[0] as unknown[])[0] || \"\");\n } catch (_e) { /* ignore */ }\n return \"\";\n}\n\n// -- SendPulse OAuth (module-level cache) --------------------------------------\nlet spTok = \"\";\nlet spTokExp = 0;\nasync function spToken(): Promise {\n if (spTok && Date.now() < spTokExp) return spTok;\n const r = await fetch(SP_API + \"/oauth/access_token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n grant_type: \"client_credentials\",\n client_id: Deno.env.get(\"SP_CLIENT_ID\"),\n client_secret: Deno.env.get(\"SP_CLIENT_SECRET\"),\n }),\n });\n const d = await r.json().catch(() => ({}));\n spTok = d.access_token || \"\";\n spTokExp = Date.now() +\n Math.max(0, (Number(d.expires_in) || 3600) - 120) * 1000;\n if (!spTok) {\n throw new Error(\"sp_oauth_failed: \" + JSON.stringify(d).slice(0, 300));\n }\n return spTok;\n}\n\n// -- /inbound : SendPulse bot webhook -> MoonAI API channel ---------------------\nasync function handleInbound(body: string): Promise {\n const key = Deno.env.get(\"MOONAI_API_KEY\");\n if (!key) return j({ ok: false, error: \"no_moonai_key\" }, 500);\n\n let events: any;\n try {\n events = JSON.parse(body || \"[]\");\n } catch {\n return j({ ok: false, error: \"bad_json\" }, 400);\n }\n if (!Array.isArray(events)) events = [events];\n\n const results: any[] = [];\n for (const ev of events) {\n const title = ev?.title || ev?.event || \"\";\n\n // Manager takeover: a human operator SENT a message in this chat. Just opening\n // the chat is not a takeover — the bot keeps replying until a human writes.\n if (title === \"outgoing_message\" || title === \"open_chat\") {\n const om = ev?.info?.message ?? ev?.message ?? {};\n const sentBy = om?.sent_by ?? ev?.info?.sent_by ?? ev?.sent_by ?? null;\n const chan = String(\n om?.channel ?? ev?.info?.channel ?? ev?.channel ?? \"\",\n );\n const human = title === \"outgoing_message\" && (\n (sentBy && typeof sentBy === \"object\") ||\n (typeof sentBy === \"number\" && sentBy > 0) ||\n chan === \"ma\"\n );\n const c = ev?.contact || {};\n const ph = String(\n c?.channel_data?.phone ?? c?.phone ?? c?.username ?? om?.to ??\n om?.from ?? \"\",\n ).replace(/[^\\d]/g, \"\");\n console.log(\n \"INBOUND\",\n title,\n JSON.stringify({ human, chan, by: sentBy && (sentBy.id ?? sentBy), ph })\n .slice(0, 200),\n );\n if (human && ph) {\n await markManagerActive(ph);\n const mtext = om?.data?.text?.body ?? om?.text?.body ??\n om?.data?.text ?? om?.text ?? \"\";\n if (mtext) {\n try {\n await fetch(MOONAI_INBOUND, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", \"X-API-Key\": key },\n body: JSON.stringify({\n thread_id: ph,\n source: SOURCE,\n from_type: \"operator\",\n from_name: \"Менеджер\",\n message_type: \"text\",\n data: { text: String(mtext) },\n }),\n });\n } catch (_e) { /* proxy-side mute is the real guarantee */ }\n }\n }\n results.push({ handled: title, managerActive: !!(human && ph) });\n continue;\n }\n\n if (title !== \"incoming_message\" && title !== \"message\") {\n results.push({ skipped: title || \"no_title\" });\n continue;\n }\n\n const msg = ev?.info?.message?.channel_data?.message || {};\n const contact = ev?.contact || {};\n const phone = String(\n msg?.from ?? contact?.phone ?? contact?.username ?? \"\",\n ).replace(/[^\\d]/g, \"\");\n\n // Every genuine client inbound (media included) gets a throwaway \"Входящие\"\n // tracking card — see ensureInboxCard — so nothing the bot handles silently\n // (or can't handle at all) ever goes fully untracked. MUST be awaited, not\n // fire-and-forget: val.town does not keep a background promise alive after\n // the HTTP response is sent, so an un-awaited multi-call chain here gets cut\n // off mid-flight (confirmed live 2026-09-11 — only some of the 5 pipeline\n // cards were created, sometimes none). ensureInboxCard self-throttles to\n // once/phone/day, so this only costs real time on the first message of the\n // day for a given phone; every later message that day returns almost\n // instantly.\n if (phone) {\n await ensureInboxCard(phone).catch((e) =>\n console.log(\"inbox card failed\", String(e))\n );\n }\n\n // Multi-bot: keep phone as thread id for the main bot, append \"__\"\n // for any other SendPulse bot so /outbound can reply through the right one.\n // Computed here (not just below) because escalateMedia also needs it to send\n // the client's acknowledgement through the right bot.\n const mainBot = Deno.env.get(\"SP_BOT_ID\") || \"\";\n const botId = String(ev?.bot?.id || ev?.bot?._id || mainBot);\n\n // Audio/photo/video/document/sticker: the bot must stay completely silent\n // (never forwarded to MoonAI, never an AI-generated reply) and escalate\n // straight to a manager instead. Also awaited for the same reason as\n // ensureInboxCard above.\n const mediaType = String(msg?.type || \"\");\n if (MEDIA_LABELS[mediaType]) {\n const caption = String(\n msg?.image?.caption ?? msg?.video?.caption ?? msg?.document?.caption ??\n \"\",\n );\n if (phone) {\n await escalateMedia(phone, mediaType, caption, botId).catch((e) =>\n console.log(\"escalateMedia failed\", String(e))\n );\n }\n results.push({ skipped: \"media_escalated\", mediaType, phone });\n continue;\n }\n\n const text = msg?.text?.body ??\n msg?.button?.text ??\n msg?.interactive?.list_reply?.title ??\n msg?.interactive?.button_reply?.title ??\n ev?.info?.message?.text ??\n ev?.message?.text ??\n ev?.text ??\n \"\";\n const suffix = botId && botId !== mainBot ? \"__\" + botId : \"\";\n // reset salt (POST /reset) -> fresh MoonAI conversation for this phone\n const salt = phone ? await saltFor(phone) : \"\";\n const threadId = phone\n ? phone + suffix + (salt ? \"|\" + salt : \"\")\n : String(contact?.id || \"unknown\");\n // Never surface the client's WhatsApp profile name. Everyone is\n // \"client_\" — keeps MoonAI transcripts, the route_deal payload and any\n // CRM record the middleware creates downstream consistent, and the trailing\n // digit run is still the phone for handleAppsScript's recovery path.\n // MoonAI's API channel has no phone field; `from_name` maps to the\n // `messenger_username` system param, so route_deal still carries the number.\n const fromName = phone ? \"client_\" + phone : \"client_unknown\";\n\n if (!text) {\n results.push({ skipped: \"no_text\", threadId });\n continue;\n }\n if (phone) await rememberInbound(String(text), phone);\n\n const payload = {\n thread_id: threadId,\n source: SOURCE,\n from_type: \"user\",\n from_name: fromName,\n message_type: \"text\",\n data: { text: String(text) },\n };\n const r = await fetch(MOONAI_INBOUND, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", \"X-API-Key\": key },\n body: JSON.stringify(payload),\n });\n const rt = await r.text();\n console.log(\"INBOUND\", threadId, \"->\", r.status, rt.slice(0, 300));\n results.push({\n threadId,\n moonai_status: r.status,\n moonai_body: rt.slice(0, 300),\n });\n }\n // Near-real-time nudge for the responsible-owner sync: whenever a client writes\n // in, reconcile owners across deal <-> contacts <-> tasks. syncResponsible()\n // self-throttles to once / SYNC_MIN_GAP, so this is a no-op most of the time.\n // Fire-and-forget — it must never delay the inbound relay. The 15-min cron\n // (val timporello/syncRespCron) is the quiet-hours / off-hours backstop.\n if (results.some((r) => r.moonai_status)) {\n syncResponsible().catch((e) => console.log(\"sync nudge failed\", String(e)));\n }\n return j({ ok: true, results });\n}\n\n// -- /outbound : MoonAI agent webhook -> SendPulse WhatsApp ---------------------\nasync function handleOutbound(body: string): Promise {\n let ev: any;\n try {\n ev = JSON.parse(body || \"{}\");\n } catch {\n return j({ ok: false, error: \"bad_json\" }, 400);\n }\n\n const type = ev?.event_type || \"\";\n if (type !== \"agent_message\" && type !== \"manager_message\") {\n console.log(\"OUTBOUND skip\", type);\n return j({ ok: true, skipped: type || \"no_type\" });\n }\n const m = ev?.message || {};\n if ((m?.message_type || \"text\") !== \"text\") {\n console.log(\"OUTBOUND skip non-text\", m?.message_type);\n return j({ ok: true, skipped: \"non_text:\" + m?.message_type });\n }\n let text = m?.data?.text ?? m?.text ?? \"\";\n // strip leaked markdown fences / whitespace the model sometimes emits\n text = String(text).replace(/```+/g, \"\").replace(/^[\\s`]+|[\\s`]+$/g, \"\");\n const threadId = String(ev?.external_thread_id ?? ev?.thread_id ?? \"\")\n .replace(/^api:[^:]+:/, \"\")\n .replace(/\\|.*$/, \"\"); // drop the reset salt (\"[__]|\")\n if (!text || !threadId) {\n return j({ ok: false, error: \"missing_text_or_thread\", threadId }, 400);\n }\n\n // threadId may be \"__\" (non-main bot) or just \"\"\n const [phonePart, botPart] = threadId.split(\"__\");\n\n // A human operator is handling this chat -> the bot stays out of the way.\n if (await isManagerActive(phonePart)) {\n console.log(\n \"OUTBOUND suppressed (manager active)\",\n phonePart,\n \"|\",\n String(text).slice(0, 80),\n );\n return j({ ok: true, skipped: \"manager_active\", thread: phonePart });\n }\n\n // If the agent mangled a cargo-status reply, replace it with the authoritative\n // answer we computed from find_cargo a moment ago.\n const authoritative = authoritativeCargoText(text);\n if (authoritative) {\n console.log(\n \"OUTBOUND cargo-override\",\n JSON.stringify({\n was: String(text).slice(0, 120),\n now: authoritative.slice(0, 120),\n }),\n );\n text = authoritative;\n }\n\n const digits = String(phonePart || \"\").replace(/[^\\d]/g, \"\");\n const botId = botPart || Deno.env.get(\"SP_BOT_ID\");\n const tok = await spToken();\n\n let endpoint: string;\n let reqBody: string;\n if (digits.length >= 10) {\n endpoint = SP_API + \"/whatsapp/contacts/sendByPhone\";\n reqBody = JSON.stringify({\n bot_id: botId,\n phone: digits,\n message: { type: \"text\", text: { body: String(text) } },\n });\n } else {\n endpoint = SP_API + \"/whatsapp/contacts/send\";\n reqBody = JSON.stringify({\n contact_id: threadId,\n message: { type: \"text\", text: { body: String(text) } },\n });\n }\n\n const r = await fetch(endpoint, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n Authorization: \"Bearer \" + tok,\n },\n body: reqBody,\n });\n const rt = await r.text();\n console.log(\"OUTBOUND\", digits || threadId, \"->\", r.status, rt.slice(0, 400));\n return j({\n ok: r.ok,\n sp_status: r.status,\n sp_body: rt.slice(0, 400),\n cargo_override: !!authoritative,\n sent_text: String(text).slice(0, 200),\n });\n}\n\n// -- responsible-owner sync: deal <-> linked contacts <-> linked tasks ---------\n// SendPulse exposes no CRM webhook, so a val.town cron pings /sync-responsible\n// every ~90s. Goal: responsibleId identical across each open deal and everything\n// linked to it. Last-writer-wins: we remember every member's responsibleId\n// between runs; when exactly one member moved since the last run, that new value\n// is pushed to the others. (updatedAt alone is unreliable — an unrelated comment\n// bumps it — so it is only the tie-breaker the first time a divergent group is\n// seen, or when a change happened outside our tracking.)\nconst SYNC_PIPELINES = [183193, 183194, 183195, 183196, 182841];\nconst SYNC_BOARD = 164785;\nconst SYNC_TASK_DONE_STEP = 498988;\nconst SYNC_MIN_GAP = 60 * 1000;\nlet syncRunning = false;\nlet syncLastRun = 0;\nlet respTableReady: Promise | null = null;\n\nfunction ensureRespTable(): Promise {\n if (!respTableReady) {\n respTableReady = sqlite\n .execute(\n \"CREATE TABLE IF NOT EXISTS resp_state (k TEXT PRIMARY KEY, resp INTEGER NOT NULL, ts INTEGER NOT NULL)\",\n )\n .then(() => {})\n .catch((e) => {\n console.log(\"resp_state init failed\", String(e));\n respTableReady = null;\n });\n }\n return respTableReady ?? Promise.resolve();\n}\n\nasync function spCrm(\n method: string,\n path: string,\n body?: unknown,\n): Promise {\n const tok = await spToken();\n const r = await fetch(SP_API + \"/crm/v1\" + path, {\n method,\n headers: {\n \"Content-Type\": \"application/json\",\n Authorization: \"Bearer \" + tok,\n },\n body: body === undefined ? undefined : JSON.stringify(body),\n });\n const txt = await r.text();\n let data: any = null;\n try {\n data = txt ? JSON.parse(txt) : null;\n } catch {\n data = txt;\n }\n if (!r.ok) {\n throw new Error(\n method + \" \" + path + \" -> \" + r.status + \" \" + txt.slice(0, 200),\n );\n }\n return data;\n}\n\nasync function priorResp(k: string): Promise {\n try {\n const r = await sqlite.execute({\n sql: \"SELECT resp FROM resp_state WHERE k = :k\",\n args: { k },\n });\n if (r.rows && r.rows[0]) return Number((r.rows[0] as unknown[])[0]);\n } catch (_e) { /* ignore */ }\n return null;\n}\nasync function recordResp(k: string, resp: number): Promise {\n try {\n await sqlite.execute({\n sql: \"INSERT INTO resp_state (k, resp, ts) VALUES (:k, :r, :t) \" +\n \"ON CONFLICT(k) DO UPDATE SET resp = :r, ts = :t\",\n args: { k, r: resp, t: Date.now() },\n });\n } catch (_e) { /* ignore */ }\n}\n\nasync function syncResponsible(): Promise {\n if (syncRunning) return { ok: true, skipped: \"running\" };\n if (Date.now() - syncLastRun < SYNC_MIN_GAP) {\n return { ok: true, skipped: \"throttled\" };\n }\n syncRunning = true;\n syncLastRun = Date.now();\n const changes: any[] = [];\n const errors: any[] = [];\n try {\n await ensureRespTable();\n\n // open deals across the 5 call-center pipelines\n const deals: any[] = [];\n for (const p of SYNC_PIPELINES) {\n try {\n const d = await spCrm(\"POST\", \"/deals/get-list\", {\n pipelineIds: [p],\n limit: 50,\n // \"Входящие\" cards are throwaway traffic markers, not real work — keep\n // them out of load-balancing and the deal<->contact<->task sync so a\n // busy day of them never crowds real escalations out of this window.\n filter: [{\n name: \"stepId\",\n expression: \"neq\",\n value: String(INBOX_STEP[p] || 0),\n }],\n });\n for (const x of (d?.data || [])) {\n if ((x.status ?? 1) === 1) deals.push(x);\n }\n } catch (e) {\n errors.push({ pipeline: p, error: String(e) });\n }\n }\n\n // every not-done task on the board -> map dealId -> [full task]\n const tasksByDeal = new Map();\n try {\n for (let off = 0; off < 500; off += 50) {\n const tr = await spCrm(\"POST\", \"/tasks/list\", {\n boardId: SYNC_BOARD,\n limit: 50,\n offset: off,\n });\n const list = tr?.data || [];\n for (const row of list) {\n if (row.stepId === SYNC_TASK_DONE_STEP || row.status === 2) continue;\n let full: any = null;\n try {\n full = await spCrm(\"GET\", \"/tasks/\" + row.id);\n } catch (_e) {\n continue;\n }\n const tk = full?.data || {};\n for (const did of (tk.deals || [])) {\n if (!tasksByDeal.has(did)) tasksByDeal.set(did, []);\n tasksByDeal.get(did)!.push(tk);\n }\n }\n if (list.length < 50) break;\n }\n } catch (e) {\n errors.push({ tasks: true, error: String(e) });\n }\n\n for (const deal of deals) {\n try {\n const dc = await spCrm(\"GET\", \"/deals/\" + deal.id + \"/contacts\");\n const contacts = dc?.data || [];\n const tks = tasksByDeal.get(deal.id) || [];\n\n // backfill the one-click \"Чат\" link if it is still empty\n try {\n const cattr = CHAT_ATTR[Number(deal.pipelineId)];\n const cur = (deal.attributes || []).find((a: any) =>\n Number(a.id) === cattr\n );\n const curVal = cur &&\n (typeof cur.value === \"object\" ? cur.value?.value : cur.value);\n if (cattr && !curVal && contacts[0]) {\n const cl = await fillChatLink(\n Number(deal.id),\n Number(deal.pipelineId),\n contacts[0],\n contacts[0]?.phones?.[0]?.phone || \"\",\n );\n if (cl && cl.url) changes.push({ deal: deal.id, chatLink: cl.url });\n }\n } catch (_e) { /* ignore */ }\n\n type M = {\n key: string;\n resp: number;\n upd: string;\n put: (rid: number) => Promise;\n };\n const members: M[] = [];\n members.push({\n key: \"d:\" + deal.id,\n resp: Number(deal.responsibleId) || 0,\n upd: String(deal.updatedAt || \"\"),\n put: (rid) =>\n spCrm(\"PUT\", \"/deals/\" + deal.id, {\n pipelineId: deal.pipelineId,\n status: deal.status ?? 1,\n stepId: deal.stepId,\n name: deal.name,\n price: deal.price ?? 0,\n currency: deal.currency || \"KZT\",\n responsibleId: rid,\n }),\n });\n for (const c of contacts) {\n members.push({\n key: \"c:\" + c.id,\n resp: Number(c.responsibleId) || 0,\n upd: String(c.updatedAt || \"\"),\n put: (rid) =>\n spCrm(\"PUT\", \"/contacts/\" + c.id, {\n responsibleId: rid,\n firstName: c.firstName || (\"Контакт \" + c.id),\n lastName: c.lastName || \"\",\n }),\n });\n }\n for (const tk of tks) {\n members.push({\n key: \"t:\" + tk.id,\n resp: Number(tk.responsibleId) || 0,\n upd: String(tk.updatedAt || \"\"),\n put: (rid) =>\n spCrm(\"PUT\", \"/tasks/\" + tk.id, {\n name: tk.name,\n boardId: tk.boardId || SYNC_BOARD,\n stepId: tk.stepId,\n priority: tk.priority ?? 2,\n responsibleId: rid,\n }),\n });\n }\n\n const live = members.filter((m) => m.resp > 0);\n if (live.length < 2) {\n for (const m of live) await recordResp(m.key, m.resp);\n continue;\n }\n if (new Set(live.map((m) => m.resp)).size === 1) {\n for (const m of live) await recordResp(m.key, m.resp);\n continue;\n }\n\n // divergent group -> choose the canonical owner\n const moved: M[] = [];\n for (const m of live) {\n const prev = await priorResp(m.key);\n if (prev !== null && prev !== m.resp) moved.push(m);\n }\n let canonical: number;\n if (moved.length) {\n moved.sort((a, b) => (a.upd < b.upd ? 1 : -1));\n canonical = moved[0].resp;\n } else {\n canonical =\n [...live].sort((a, b) => (a.upd < b.upd ? 1 : -1))[0].resp;\n }\n\n for (const m of live) {\n if (m.resp !== canonical) {\n try {\n await m.put(canonical);\n changes.push({\n deal: deal.id,\n member: m.key,\n from: m.resp,\n to: canonical,\n });\n } catch (e) {\n errors.push({ deal: deal.id, member: m.key, error: String(e) });\n }\n }\n await recordResp(m.key, canonical);\n }\n } catch (e) {\n errors.push({ deal: deal.id, error: String(e) });\n }\n }\n\n try {\n await sqlite.execute({\n sql: \"DELETE FROM resp_state WHERE ts < :cut\",\n args: { cut: Date.now() - 14 * 24 * 60 * 60 * 1000 },\n });\n } catch (_e) { /* ignore */ }\n\n return { ok: true, deals: deals.length, changes, errors };\n } catch (e) {\n return { ok: false, error: String(e), changes, errors };\n } finally {\n syncRunning = false;\n }\n}\n\n// -- escalation auto-assign by client language --------------------------------\n// When route_deal creates a new escalation deal, hand it to a manager who speaks\n// the client's language. Алия (9501075) is NOT in any pool — she watches the\n// pipelines and reassigns a deal to herself when she wants to take one.\n// Updated 2026-09-11 per user's spec (\"Первый слой: Языки\"):\n// RU+KZ -> Молдир 9501565, Шолпан 9501561\n// KZ+CN -> Миербан 9504155, 加依娜尔 9501563\n// KZ falls in both rows above -> union of all 4 (user confirmed via question).\n// RU -> only Молдир/Шолпан (only that row claims RU). CN -> only Миербан/加依娜尔.\n// Within a pool we pick the manager with the fewest open deals right now (ties\n// broken round-robin). The deal↔contact↔task sync then propagates the owner.\nconst LANG_MANAGERS: Record = {\n RU: [9501565, 9501561],\n KZ: [9501565, 9501561, 9504155, 9501563],\n CN: [9504155, 9501563],\n};\n// Per-pipeline override, wins over language. Updated 2026-09-11:\n// 183194 Поддержка Посылки -> Молдир + Шолпан + 加依娜尔\n// 183193 Поддержка Хозтовары -> 加依娜尔 + Миербан + Молдир\n// 183196 Склад/Пересорт -> \"то же самое, что в обеих поддержках\" = union\n// of the two pools above (everyone except Алия)\n// 183195 Коммерческие лиды -> ответ клиенту это номер комм. отдела\n// +7 778 085 3000 (уже в промпте, D1/D2/D3),\n// ни один менеджер поддержки лиды не ведёт ->\n// сделка остаётся на Алие (наблюдатель).\n// 182841 Бухгалтерия не упомянута пользователем -> по-прежнему падает по языку\n// (LANG_MANAGERS выше), без отдельного override.\nconst POOL_BY_PIPELINE: Record = {\n 183194: [9501565, 9501561, 9501563],\n 183193: [9501563, 9504155, 9501565],\n 183196: [9501565, 9501561, 9501563, 9504155],\n 183195: [9501075],\n};\nlet rrTableReady: Promise | null = null;\nfunction ensureRrTable(): Promise {\n if (!rrTableReady) {\n rrTableReady = sqlite\n .execute(\n \"CREATE TABLE IF NOT EXISTS assign_rr (k TEXT PRIMARY KEY, n INTEGER NOT NULL)\",\n )\n .then(() => {})\n .catch((e) => {\n console.log(\"assign_rr init failed\", String(e));\n rrTableReady = null;\n });\n }\n return rrTableReady ?? Promise.resolve();\n}\nasync function rrNext(k: string): Promise {\n try {\n await ensureRrTable();\n const r = await sqlite.execute({\n sql: \"SELECT n FROM assign_rr WHERE k = :k\",\n args: { k },\n });\n const n = r.rows && r.rows[0] ? Number((r.rows[0] as unknown[])[0]) : 0;\n await sqlite.execute({\n sql:\n \"INSERT INTO assign_rr (k, n) VALUES (:k, 1) ON CONFLICT(k) DO UPDATE SET n = n + 1\",\n args: { k },\n });\n return n;\n } catch (_e) {\n return 0;\n }\n}\nasync function assignDealByLang(\n dealId: number,\n lang: string,\n pipelineId?: number,\n): Promise {\n const L = String(lang || \"\").trim().toUpperCase();\n const pool = POOL_BY_PIPELINE[Number(pipelineId) || 0] || LANG_MANAGERS[L] ||\n LANG_MANAGERS.RU;\n let rid = pool[0];\n if (pool.length > 1) {\n // fewest open deals wins; count all candidates in one sweep of the pipelines\n const load = new Map(pool.map((r) => [r, 0]));\n for (const p of SYNC_PIPELINES) {\n try {\n const d = await spCrm(\"POST\", \"/deals/get-list\", {\n pipelineIds: [p],\n limit: 50,\n // \"Входящие\" cards are throwaway traffic markers, not real work — keep\n // them out of load-balancing and the deal<->contact<->task sync so a\n // busy day of them never crowds real escalations out of this window.\n filter: [{\n name: \"stepId\",\n expression: \"neq\",\n value: String(INBOX_STEP[p] || 0),\n }],\n });\n for (const x of (d?.data || [])) {\n const r = Number(x.responsibleId);\n if ((x.status ?? 1) === 1 && load.has(r)) {\n load.set(r, (load.get(r) || 0) + 1);\n }\n }\n } catch (_e) { /* ignore a bad pipeline */ }\n }\n const min = Math.min(...pool.map((r) => load.get(r) ?? 0));\n const tied = pool.filter((r) => (load.get(r) ?? 0) === min);\n rid = tied.length === 1\n ? tied[0]\n : tied[await rrNext(\"lang:\" + L) % tied.length];\n }\n const g = await spCrm(\"GET\", \"/deals/\" + dealId);\n const dl = g?.data || {};\n if (!dl.id) return { dealId, error: \"deal_not_found\" };\n if (Number(dl.responsibleId) === rid) {\n return { dealId, rid, lang: L, skipped: \"already\" };\n }\n await spCrm(\"PUT\", \"/deals/\" + dealId, {\n pipelineId: dl.pipelineId,\n status: dl.status ?? 1,\n stepId: dl.stepId,\n name: dl.name,\n price: dl.price ?? 0,\n currency: dl.currency || \"KZT\",\n responsibleId: rid,\n });\n return { dealId, lang: L, rid, from: Number(dl.responsibleId) || 0 };\n}\n\n// -- one-click chat link on the deal card ------------------------------------\n// A per-pipeline \"Чат\" (Link) attribute; we fill it with a direct URL into the\n// client's WhatsApp dialog, on whichever of the two bots the conversation\n// actually lives (so the manager opens the right chat in one click).\nconst CHAT_ATTR: Record = {\n 183193: 1117964,\n 183194: 1117965,\n 183195: 1117966,\n 183196: 1117967,\n 182841: 1117968,\n};\nconst SP_BOTS = [\"69974943d7855b67ca0aa73d\", \"69974b70bcc6ed11b20fd23f\"];\n\n// -- \"Входящие\" tracking cards -------------------------------------------------\n// A first-stage step (\"Входящие\", order=1) added 2026-09-11 to all 5 pipelines.\n// Every raw inbound message (once per phone per Almaty day) gets a lightweight,\n// unassigned-except-Aliya card duplicated into ALL 5 pipelines, purely so a raw\n// message is never *invisible* even when MoonAI handles it itself and no real\n// deal is ever created. Deleted the moment a real escalation happens for that\n// phone (postRouteDeal), or swept at close of business (17:30 Almaty) — a card\n// created after that already-passed cleanup survives to the next day's sweep,\n// which is the \"if it came in the evening, let it hang until tomorrow\" rule.\nconst INBOX_STEP: Record = {\n 183193: 639352,\n 183194: 639353,\n 183195: 639354,\n 183196: 639355,\n 182841: 639356,\n};\nconst INBOX_RESPONSIBLE = 9501075; // Алия — she already just observes/triages\nlet inboxTableReady: Promise | null = null;\nfunction ensureInboxTable(): Promise {\n if (!inboxTableReady) {\n inboxTableReady = sqlite\n .execute(\n \"CREATE TABLE IF NOT EXISTS inbox_cards \" +\n \"(phone TEXT NOT NULL, day TEXT NOT NULL, pipeline_id INTEGER NOT NULL, \" +\n \"deal_id INTEGER NOT NULL, ts INTEGER NOT NULL, PRIMARY KEY (phone, pipeline_id))\",\n )\n .then(() =>\n sqlite.execute(\n \"CREATE TABLE IF NOT EXISTS inbox_cleanup (day TEXT PRIMARY KEY, ts INTEGER NOT NULL)\",\n )\n )\n .then(() => {})\n .catch((e) => {\n console.log(\"inbox_cards init failed\", String(e));\n inboxTableReady = null;\n });\n }\n return inboxTableReady ?? Promise.resolve();\n}\nfunction almatyDateStr(ms: number): string {\n // Asia/Almaty = UTC+5, no DST.\n return new Date(ms + 5 * 3600 * 1000).toISOString().slice(0, 10);\n}\n// Creates the 5 duplicate \"Входящие\" cards for a phone, once per Almaty day.\n// Each card gets the client's contact (find-or-create, \"client_\" name —\n// never a WhatsApp profile name) and the one-click \"Чат\" link attached, so the\n// card is actually openable/useful — not just a bare name string. (Fixed\n// 2026-09-11: originally shipped name-only, which is why the cards looked\n// \"empty\" — no linked contact, no phone field, no way to jump into the chat.)\nasync function ensureInboxCard(phone: string): Promise {\n const digits = String(phone || \"\").replace(/[^\\d]/g, \"\");\n if (digits.length < 10) return { skipped: \"no_phone\" };\n try {\n await ensureInboxTable();\n const day = almatyDateStr(Date.now());\n const seen = await sqlite.execute({\n sql: \"SELECT 1 FROM inbox_cards WHERE phone = :p AND day = :d LIMIT 1\",\n args: { p: digits, d: day },\n });\n if (seen.rows && seen.rows[0]) return { skipped: \"already_today\" };\n\n // Find-or-create the CRM contact once, reuse across all 5 pipeline cards —\n // same convention as the .gs route_deal path (findOrCreateContact_), so a\n // later real escalation for this phone lands on the SAME contact record.\n async function resolveContact(): Promise {\n try {\n const tail = digits.slice(-10);\n const found = await spCrm(\"POST\", \"/contacts/get-list\", {\n phone: digits,\n limit: 20,\n });\n const list = found?.data?.list || found?.data || [];\n for (const c of Array.isArray(list) ? list : []) {\n const pj = JSON.stringify(c?.phones || []).replace(/\\D/g, \"\");\n if (pj.includes(tail)) return Number(c.id);\n }\n const made = await spCrm(\"POST\", \"/contacts\", {\n firstName: \"client_\" + digits,\n phones: [digits],\n messengers: [{ typeId: 5, login: digits }],\n responsibleId: INBOX_RESPONSIBLE,\n });\n return Number(made?.data?.id || made?.id || 0);\n } catch (e) {\n console.log(\"inbox contact resolve failed\", String(e));\n return 0;\n }\n }\n // Contact resolve/create and chat-URL resolve are independent of each other\n // — and, now that this whole function sits on the critical (awaited) path\n // of /inbound, everything below runs in parallel rather than serially: a\n // serial 5-pipeline loop here was clocked at 6+ seconds live, which is long\n // enough that val.town cut the earlier fire-and-forget version off mid-way\n // (see the comment at the call site) even once awaited it would be slow.\n const [contactId, chatUrl] = await Promise.all([\n resolveContact(),\n chatUrlForPhone(digits).catch(() => \"\"),\n ]);\n\n const pids = Object.keys(INBOX_STEP).map(Number);\n const perPipeline = await Promise.all(pids.map(async (pid) => {\n try {\n const body: Record = {\n pipelineId: pid,\n stepId: INBOX_STEP[pid],\n responsibleId: INBOX_RESPONSIBLE,\n name: \"Входящее · \" + digits + \" · \" + day,\n };\n if (contactId) body.contact = [contactId];\n const r = await spCrm(\"POST\", \"/deals\", body);\n const id = r?.data?.id || r?.id;\n if (!id) return null;\n if (chatUrl && CHAT_ATTR[pid]) {\n await spCrm(\"POST\", \"/deals/\" + id + \"/attributes\", {\n attributeId: CHAT_ATTR[pid],\n value: chatUrl,\n }).catch((e) =>\n console.log(\"inbox chat link failed\", pid, String(e))\n );\n }\n await sqlite.execute({\n sql:\n \"INSERT INTO inbox_cards (phone, day, pipeline_id, deal_id, ts) VALUES \" +\n \"(:p, :d, :pid, :did, :t) ON CONFLICT(phone, pipeline_id) DO UPDATE SET \" +\n \"day = :d, deal_id = :did, ts = :t\",\n args: { p: digits, d: day, pid, did: id, t: Date.now() },\n });\n return id as number;\n } catch (e) {\n console.log(\"inbox card create failed\", pid, String(e));\n return null;\n }\n }));\n const created = perPipeline.filter((x): x is number => x != null);\n return { phone: digits, day, contactId, chatUrl: !!chatUrl, created };\n } catch (e) {\n return { error: String(e) };\n }\n}\n// Deletes the tracked \"Входящие\" cards for a phone (called once a real\n// escalation lands, via postRouteDeal).\nasync function deleteInboxCards(phone: string): Promise {\n const digits = String(phone || \"\").replace(/[^\\d]/g, \"\");\n if (digits.length < 10) return { skipped: \"no_phone\" };\n try {\n await ensureInboxTable();\n const r = await sqlite.execute({\n sql: \"SELECT deal_id FROM inbox_cards WHERE phone = :p\",\n args: { p: digits },\n });\n const ids = (r.rows || []).map((row) => Number((row as unknown[])[0]));\n const outcomes = await Promise.all(ids.map(async (id) => {\n try {\n await spCrm(\"DELETE\", \"/deals/\" + id);\n return true;\n } catch (_e) {\n return false; // deal may already be gone\n }\n }));\n const deleted = outcomes.filter(Boolean).length;\n await sqlite.execute({\n sql: \"DELETE FROM inbox_cards WHERE phone = :p\",\n args: { p: digits },\n });\n return { phone: digits, deleted };\n } catch (e) {\n return { error: String(e) };\n }\n}\n// Close-of-business sweep (17:30 Almaty, once/day — hit via the /sync-responsible\n// cron): removes every still-open \"Входящие\" card. A card made after today's\n// sweep already ran (an evening message) simply isn't touched until tomorrow's.\nasync function cleanupInboxCards(): Promise {\n const now = Date.now();\n const almaty = new Date(now + 5 * 3600 * 1000);\n const hour = almaty.getUTCHours();\n const minute = almaty.getUTCMinutes();\n if (hour < 17 || (hour === 17 && minute < 30)) return { skipped: \"not_yet\" };\n try {\n await ensureInboxTable();\n const day = almatyDateStr(now);\n const done = await sqlite.execute({\n sql: \"SELECT 1 FROM inbox_cleanup WHERE day = :d\",\n args: { d: day },\n });\n if (done.rows && done.rows[0]) return { skipped: \"already_done_today\" };\n const r = await sqlite.execute(\"SELECT phone, deal_id FROM inbox_cards\");\n let deleted = 0;\n const errors: string[] = [];\n for (const row of (r.rows || []) as unknown[][]) {\n const id = Number(row[1]);\n try {\n await spCrm(\"DELETE\", \"/deals/\" + id);\n deleted++;\n } catch (e) {\n errors.push(id + \":\" + String(e));\n }\n }\n await sqlite.execute(\"DELETE FROM inbox_cards\");\n await sqlite.execute({\n sql:\n \"INSERT INTO inbox_cleanup (day, ts) VALUES (:d, :t) ON CONFLICT(day) DO NOTHING\",\n args: { d: day, t: now },\n });\n return { day, deleted, errors };\n } catch (e) {\n return { error: String(e) };\n }\n}\n\nasync function spWaGet(path: string): Promise {\n const tok = await spToken();\n const r = await fetch(SP_API + path, {\n headers: { Authorization: \"Bearer \" + tok },\n });\n return r.json().catch(() => ({}));\n}\nfunction chatUrlFromContact(c: any): string {\n const ms = Array.isArray(c?.messengers) ? c.messengers : [];\n const withUrl = ms.filter((m: any) => m && m.chatbotUrl && m.botId);\n if (!withUrl.length) return \"\";\n withUrl.sort((a: any, b: any) =>\n a.isMainChatbot === b.isMainChatbot ? 0 : a.isMainChatbot ? -1 : 1\n );\n return String(withUrl[0].chatbotUrl || \"\");\n}\nasync function resolveWaContact(\n phone: string,\n): Promise<{ bot: string; id: string } | null> {\n const digits = String(phone || \"\").replace(/[^\\d]/g, \"\");\n if (digits.length < 10) return null;\n let best: { bot: string; id: string; key: string } | null = null;\n for (const bot of SP_BOTS) {\n try {\n const d = await spWaGet(\n \"/whatsapp/contacts/getByPhone?bot_id=\" + bot + \"&phone=\" + digits,\n );\n const c = d?.data;\n if (c && c.id) {\n const key = String(c.last_activity_at || \"0000\") +\n (c.is_chat_opened ? \"_1\" : \"_0\");\n if (!best || key > best.key) best = { bot, id: String(c.id), key };\n }\n } catch (_e) { /* ignore this bot */ }\n }\n return best ? { bot: best.bot, id: best.id } : null;\n}\nasync function chatUrlForPhone(phone: string): Promise {\n const best = await resolveWaContact(phone);\n if (!best) return \"\";\n return \"https://login.sendpulse.com/messengers/chats/\" + best.bot +\n \"/contacts/all/\" + best.id + \"/\";\n}\n// Mirrors the CRM assignment onto the SendPulse \"Чаты\" chat itself: sets the\n// chat's operator (so it shows under that manager's \"Мои\") and flags it\n// unread (PUT /contacts/mark-unread — the only way to surface a chat without a\n// fresh client message). Needed because a pure outbound send — the daily\n// rassylka_od broadcast included — never bumps last_activity_at or sets\n// inbox_unread on its own (confirmed live 2026-09-11: a contact's last\n// rassylka_od template sat 2h+ before last_activity_at moved, and only did so\n// when the client actually replied). Without this, escalations were only\n// findable by searching the phone number, even though nothing was \"lost\".\nasync function syncChatOperator(\n phone: string,\n operatorId: number,\n): Promise {\n if (!operatorId) return { skipped: \"no_operator\" };\n const c = await resolveWaContact(phone);\n if (!c) return { skipped: \"no_chat_yet\" };\n const tok = await spToken();\n const assign = await fetch(SP_API + \"/whatsapp/contacts/operators/assign\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n Authorization: \"Bearer \" + tok,\n },\n body: JSON.stringify({ contact_id: c.id, operator_id: operatorId }),\n }).then((r) => r.json()).catch((e) => ({ error: String(e) }));\n const unread = await fetch(\n SP_API + \"/whatsapp/contacts/mark-unread?contact_id=\" + c.id,\n { method: \"PUT\", headers: { Authorization: \"Bearer \" + tok } },\n ).then((r) => r.json()).catch((e) => ({ error: String(e) }));\n return { bot: c.bot, contact_id: c.id, operatorId, assign, unread };\n}\nasync function fillChatLink(\n dealId: number,\n pipelineId: number,\n contact?: any,\n phone?: string,\n): Promise {\n const attrId = CHAT_ATTR[pipelineId];\n if (!attrId) return { skipped: \"no_attr_for_pipeline\" };\n let url = contact ? chatUrlFromContact(contact) : \"\";\n if (!url) {\n url = await chatUrlForPhone(\n phone || (contact?.phones?.[0]?.phone) || \"\",\n );\n }\n if (!url) return { skipped: \"no_chat_yet\" };\n try {\n await spCrm(\"POST\", \"/deals/\" + dealId + \"/attributes\", {\n attributeId: attrId,\n value: url,\n });\n return { dealId, url };\n } catch (_e) {\n try {\n await spCrm(\"PUT\", \"/deals/\" + dealId + \"/attributes/\" + attrId, {\n value: url,\n });\n return { dealId, url, via: \"put\" };\n } catch (e) {\n return { dealId, error: String(e) };\n }\n }\n}\n\n// Runs the full escalation side-effects for a route_deal result: assign the CRM\n// deal to a manager by language (skipped for \"attached\" — вторичка keeps its\n// existing owner, we just read it), fill the one-click \"Чат\" link, mirror the\n// manager onto the SendPulse chat itself (operator + unread — see\n// syncChatOperator), and drop the throwaway \"Входящие\" cards for this phone now\n// that a real deal exists. Shared by the normal MoonAI route_deal path\n// (handleAppsScript) and the media-message fast path (escalateMedia) below.\nasync function postRouteDeal(rb: any, rr: any): Promise {\n if (!rr || !rr.dealId) return;\n let managerId = 0;\n if (rr.action !== \"attached\") {\n let lang = String(rb.lang || \"\");\n try {\n const pl = typeof rb.payload === \"string\"\n ? JSON.parse(rb.payload)\n : (rb.payload || {});\n lang = pl.lang || pl.language || lang;\n } catch (_p) { /* payload not JSON */ }\n const a = await assignDealByLang(\n Number(rr.dealId),\n lang,\n Number(rr.pipelineId),\n )\n .catch((e) => ({ error: String(e) }));\n console.log(\"APPS assignByLang\", JSON.stringify(a));\n managerId = Number((a as any)?.rid) || 0;\n if (rr.pipelineId) {\n const cl = await fillChatLink(\n Number(rr.dealId),\n Number(rr.pipelineId),\n undefined,\n String(rb.phone || \"\"),\n ).catch((e) => ({ error: String(e) }));\n console.log(\"APPS fillChatLink\", JSON.stringify(cl));\n }\n } else {\n try {\n const g = await spCrm(\"GET\", \"/deals/\" + rr.dealId);\n managerId = Number(g?.data?.responsibleId) || 0;\n } catch (_e) { /* ignore */ }\n }\n if (managerId) {\n const so = await syncChatOperator(String(rb.phone || \"\"), managerId)\n .catch((e) => ({ error: String(e) }));\n console.log(\"APPS syncChatOperator\", JSON.stringify(so));\n }\n const dc = await deleteInboxCards(String(rb.phone || \"\")).catch((e) => ({\n error: String(e),\n }));\n console.log(\"APPS deleteInboxCards\", JSON.stringify(dc));\n}\n\n// Audio/voice/image/document/video/sticker inbound: handleInbound routes these\n// here INSTEAD OF forwarding to MoonAI — the bot stays completely silent (no\n// half-baked \"send me a text instead\" reply) and we escalate straight to a\n// manager immediately. Cargo-related media defaults to support_posylki with an\n// empty lang, which POOL_BY_PIPELINE routes to Молдир+Шолпан regardless of\n// language (see LANG_MANAGERS / POOL_BY_PIPELINE).\nconst MEDIA_LABELS: Record = {\n audio: \"аудиосообщение\",\n voice: \"аудиосообщение\",\n image: \"изображение\",\n video: \"видео\",\n document: \"файл\",\n sticker: \"стикер\",\n};\n// Fixed (not AI-generated) acknowledgement sent to the client after a media\n// escalation — the bot itself stays silent/doesn't process the file, but the\n// client still needs SOME confirmation their message arrived rather than\n// total silence until a human eventually replies. Wording matches MoonAI's own\n// standard escalation phrase (see prompt block \"часы колл-центра\" / same text\n// used in correction_send.py), so a client doesn't see two different styles\n// depending on whether they wrote text or sent a file. KZ+RU+CN together (in\n// that order, per user) since we have no text to detect the client's language\n// from on a media-first message.\nconst MEDIA_ACK_TEXT =\n \"Сұрағыңызды менеджерге жолдадым. Колл-орталық Алматы уақытымен 09:00-ден \" +\n \"17:30-ға дейін жұмыс істейді — менеджер сізбен жақын жұмыс уақытында \" +\n \"хабарласады.\\n\" +\n \"Передал(а) ваш вопрос менеджеру. Колл-центр работает с 09:00 до 17:30 \" +\n \"(Алматы) — с вами свяжутся в ближайшее рабочее время.\\n\" +\n \"已将您的问题转交给经理。呼叫中心工作时间为阿拉木图时间09:00至17:30——我们将在最近的工作时间与您联系。\";\nasync function escalateMedia(\n phone: string,\n mediaType: string,\n caption?: string,\n botId?: string,\n): Promise {\n const label = MEDIA_LABELS[mediaType] || \"вложение\";\n const note = \"Клиент прислал \" + label +\n \" — бот медиа не обрабатывает, нужна ручная проверка.\" +\n (caption ? \" Подпись: «\" + caption.slice(0, 200) + \"».\" : \"\");\n const digits = String(phone || \"\").replace(/[^\\d]/g, \"\");\n const rb: any = {\n action: \"route_deal\",\n route: \"support_posylki\",\n phone: digits,\n // Same \"never a WhatsApp profile name in the CRM\" rule as the normal\n // route_deal path (see the phone/contact_name block in handleAppsScript).\n contact_name: digits ? \"client_\" + digits : undefined,\n payload: JSON.stringify({\n business_line: \"posylki\",\n lang: \"\",\n intent: \"media_\" + mediaType,\n handoff_summary: note,\n first_message: note,\n }),\n };\n // See the matching comment in handleAppsScript: checkOpenDeal_ on the .gs side\n // doesn't know \"Входящие\" is a throwaway step, so an open Входящие card for\n // this phone would get mistaken for an already-open deal and silently eat the\n // escalation as a comment instead of creating a real one. Clear first.\n if (digits) {\n await deleteInboxCards(digits).catch((e) =>\n console.log(\"pre-route_deal inbox clear failed (media)\", String(e))\n );\n }\n const target = Deno.env.get(\"APPS_SCRIPT_URL\");\n const token = Deno.env.get(\"SHARED_SECRET\");\n if (!target || !token) return { error: \"proxy_misconfigured\" };\n const outUrl = new URL(target);\n outUrl.searchParams.set(\"token\", token);\n let rr: any = {};\n try {\n const resp = await fetch(outUrl.toString(), {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(rb),\n redirect: \"follow\",\n });\n rr = await resp.json().catch(() => ({}));\n } catch (e) {\n return { error: String(e) };\n }\n console.log(\"MEDIA route_deal\", JSON.stringify(rr));\n await postRouteDeal(rb, rr).catch((e) =>\n console.log(\"postRouteDeal (media) failed\", String(e))\n );\n // Fixed acknowledgement, not the bot \"talking\" — see MEDIA_ACK_TEXT above.\n if (digits) {\n try {\n const tok = await spToken();\n const ackResp = await fetch(SP_API + \"/whatsapp/contacts/sendByPhone\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n Authorization: \"Bearer \" + tok,\n },\n body: JSON.stringify({\n bot_id: botId || Deno.env.get(\"SP_BOT_ID\"),\n phone: digits,\n message: { type: \"text\", text: { body: MEDIA_ACK_TEXT } },\n }),\n });\n console.log(\"MEDIA ack\", digits, \"->\", ackResp.status);\n } catch (e) {\n console.log(\"MEDIA ack failed\", String(e));\n }\n }\n return rr;\n}\n\n// -- find_cargo post-processing --------------------------------------------------\n// Status wording taken VERBATIM from the ALA TMS call-center UI\n// (alatms.com .../landing-bills/client-cargo-in-transit, \"Статус\" filter, 15 states).\n// Confirmed API-code <-> TMS-label pairs: LOADED=Загружен, DISPATCHED=Отправлен,\n// TRANSIT_DISPATCHED=Затаможка началась, TERMINAL_ISSUED=Выдан,\n// LOADED_TRANSIT=Загружен в транзит, TERMINAL_ZONED=В зоне терминала,\n// TRANSIT_RECEIVED=Получен на транзите, TRANSIT_ZONED=В зоне на транзите,\n// TERMINAL_RECEIVED=Получен на терминале. The rest are inferred from order and\n// fall back safely; ALA to confirm the exact codes for the 4 middle states.\nconst CARGO_STATUS_RU: Record = {\n CREATED: \"Создан\",\n RECEIVED: \"Получен\",\n LOADED: \"Загружен\",\n DISPATCHED: \"Отправлен\",\n TRANSIT_RECEIVED: \"Получен на транзите\",\n TRANSIT_ZONED: \"В зоне на транзите\",\n LOADED_TRANSIT: \"Загружен в транзит\",\n TRANSIT_DISPATCHED: \"Затаможка началась\",\n TRANSIT_CUSTOMS_CLEARED: \"Затаможка завершена\",\n TRANSIT_CUSTOMS_EXPORT_COMPLETED: \"Затаможка завершена\",\n CUSTOMS_CLEARED: \"Затаможка завершена\",\n IN_TRANSIT: \"В процессе транзита\",\n CUSTOMS_STARTED: \"Растаможка началась\",\n TERMINAL_CUSTOMS_STARTED: \"Растаможка началась\",\n CUSTOMS: \"Растаможка началась\",\n TO_WAREHOUSE: \"В пути на склад\",\n TERMINAL_DISPATCHED: \"В пути на склад\",\n ARRIVED: \"В пути на склад\",\n TERMINAL_RECEIVED: \"Получен на терминале\",\n TERMINAL_ZONED: \"В зоне терминала\",\n TERMINAL_ISSUED: \"Выдан\",\n RETURNED: \"Возврат\",\n CANCELLED: \"Отменён\",\n};\nfunction cargoStatusRu(code: string): string {\n if (!code) return \"статус уточняется\";\n return CARGO_STATUS_RU[code] || \"в обработке\";\n}\n\n// -- anti-mangle cache --------------------------------------------------------\n// GPT-5.4 in MoonAI rewrites find_cargo results (turns \"Выдан\" into \"в пути\",\n// swaps warehouses, invents statuses). We cache the exact `answer` per track for\n// a few minutes; /outbound then replaces the agent's cargo message with it.\nconst cargoAnswerCache = new Map();\nconst CARGO_CACHE_TTL = 6 * 60 * 1000;\nfunction normTrack(s: string): string {\n return String(s || \"\").toUpperCase().replace(/[^A-Z0-9]/g, \"\");\n}\nfunction cacheCargoAnswer(track: string, answer: string) {\n const k = normTrack(track);\n if (k.length < 4 || !answer) return;\n cargoAnswerCache.set(k, { answer, ts: Date.now() });\n if (cargoAnswerCache.size > 500) {\n const cut = Date.now() - CARGO_CACHE_TTL;\n for (const [key, v] of cargoAnswerCache) {\n if (v.ts < cut) cargoAnswerCache.delete(key);\n }\n }\n}\n// If the agent's outgoing text is a cargo-status reply, return the authoritative\n// cached answer for the track it mentions; else null (send agent text as-is).\n// Guards: only for status-shaped messages, and only within 100s of the lookup\n// (so a later \"передал менеджеру\" reply is never overwritten).\nconst CARGO_OVERRIDE_WINDOW = 100 * 1000;\nconst RE_STATUS =\n /(склад|статус|в пути|выдан|транзит|таможн|терминал|получен|отправлен|загружен|в зоне|не нашл|не найд|қойма|жолда|келді|тапсыр|кеден|仓库|清关|已发货|运输|已到)/i;\nconst RE_HANDOFF =\n /(передал|менеджер|уточните|напишите трек|проверьте номер|менеджерге|нақтылап|толық трек|经理|请提供)/i;\nfunction authoritativeCargoText(agentText: string): string | null {\n const t = String(agentText || \"\").trim();\n // The agent fabricates cargo statuses in EVERY language (its \"translations\" of\n // real data are unreliable too), so we override in any language — a correct RU\n // status line beats a hallucinated KZ/CN one.\n const looksLikeStatus = /груз[^.]{0,40}:/i.test(t) ||\n /[a-z0-9][a-z0-9-]{3,}\\s*(жүг|жүк)/i.test(t) ||\n /货物?\\s*[a-z0-9-]{3,}/i.test(t) ||\n RE_STATUS.test(t);\n if (!looksLikeStatus) return null;\n if (RE_HANDOFF.test(t)) return null;\n const tn = normTrack(t);\n const now = Date.now();\n for (const [k, v] of cargoAnswerCache) {\n if (now - v.ts > CARGO_CACHE_TTL) {\n cargoAnswerCache.delete(k);\n continue;\n }\n if (now - v.ts > CARGO_OVERRIDE_WINDOW) continue;\n if (tn.includes(k)) return v.answer === t ? null : v.answer;\n }\n return null;\n}\n\n// TERMINAL_* means the bag reached ALA's Almaty terminal. The bag's `warehouse`\n// field still holds the China consolidation point (e.g. \"YIwu\") and only misleads\n// the client (\"склад YIwu\" reads as \"still in China\"), so for these statuses we\n// say Almaty instead of the warehouse.\nconst TERMINAL_STAGE = new Set([\n \"TERMINAL_RECEIVED\",\n \"TERMINAL_ZONED\",\n \"TERMINAL_ISSUED\",\n]);\nfunction bagLoc(b: any, multi: boolean): string {\n const st = String(b.status || \"\");\n if (st === \"TERMINAL_ISSUED\") return \"\";\n if (TERMINAL_STAGE.has(st)) {\n return multi\n ? \" (в Алматы, ожидает выдачи)\"\n : \" Груз в Алматы, ожидает выдачи.\";\n }\n if (!b.warehouse) return \"\";\n return multi ? \", склад \" + b.warehouse : \" Склад: \" + b.warehouse + \".\";\n}\n\n// Rewrites a find_cargo response before it reaches MoonAI:\n// - fills status_ru from the complete map\n// - builds one ready-to-send `answer` string (single or multi-bag)\n// - on an empty result, sets a clear \"not found\" answer (never a fake status)\nfunction fixCargo(o: any, reqTrack?: string): any {\n if (!o || (o.source !== \"by-track\" && o.source !== \"by-recipient\")) return o;\n const bags = Array.isArray(o.bags) ? o.bags : [];\n for (const b of bags) b.status_ru = cargoStatusRu(String(b.status || \"\"));\n if (o.ok === false) return o;\n if (!bags.length || o.found === false) {\n o.answer =\n \"По этому трек-коду ничего не нашлось. Проверьте номер, пожалуйста — или я передам вопрос менеджеру.\";\n o.text = o.answer;\n if (reqTrack) cacheCargoAnswer(reqTrack, o.answer);\n return o;\n }\n if (bags.length === 1) {\n const b = bags[0];\n o.answer = \"Груз \" + b.track + \": \" + b.status_ru + \".\" + bagLoc(b, false);\n } else {\n const parts = bags.map((b: any, i: number) =>\n \"мешок \" + (i + 1) + \" — \" + b.status_ru + bagLoc(b, true)\n );\n o.answer = \"Груз \" + (bags[0].track || \"\") + \" (\" + bags.length +\n \" мест): \" +\n parts.join(\"; \") + \".\";\n }\n o.text = o.answer;\n for (const b of bags) if (b.track) cacheCargoAnswer(b.track, o.answer);\n if (reqTrack) cacheCargoAnswer(reqTrack, o.answer);\n return o;\n}\n\n// -- / : existing MoonAI -> Apps Script proxy -----------------------------------\nasync function handleAppsScript(\n req: Request,\n inUrl: URL,\n body: string | undefined,\n): Promise {\n const TARGET = Deno.env.get(\"APPS_SCRIPT_URL\");\n const TOKEN = Deno.env.get(\"SHARED_SECRET\");\n if (!TARGET || !TOKEN) {\n return j(\n {\n ok: false,\n error: \"proxy_misconfigured\",\n hint: \"set APPS_SCRIPT_URL and SHARED_SECRET\",\n },\n 500,\n );\n }\n\n const outUrl = new URL(TARGET);\n outUrl.searchParams.set(\"token\", TOKEN);\n for (const [k, v] of inUrl.searchParams) {\n if (k !== \"token\") outUrl.searchParams.set(k, v);\n }\n\n const method = req.method === \"GET\" ? \"GET\" : \"POST\";\n let out = method === \"GET\" ? undefined : body ?? \"\";\n try {\n const _p = JSON.parse(out || \"{}\");\n if (_p && _p.inputs && typeof _p.inputs === \"object\") {\n out = JSON.stringify(_p.inputs);\n }\n } catch (_e) {\n /* not JSON - forward as-is */\n }\n // route_deal: MoonAI cannot pass the client's phone, so it arrives empty. Recover\n // it from the message we relayed a moment earlier (see phoneForMessage).\n // Also force the CRM *contact* name to \"client_\" — never let a WhatsApp\n // profile name reach the CRM. The .gs reads `contact_name` for the contact\n // (deal name stays its own descriptive value), falling back to \"WhatsApp \"\n // only when `contact_name` is absent, so we always send our own.\n try {\n const rp = JSON.parse(out || \"{}\");\n if (rp && (rp.route || rp.action === \"route_deal\")) {\n let phone = String(rp.phone || \"\").replace(/[^\\d]/g, \"\");\n let firstMsg = \"\";\n try {\n const pl = typeof rp.payload === \"string\"\n ? JSON.parse(rp.payload)\n : (rp.payload || {});\n firstMsg = pl.first_message || \"\";\n if (!phone) phone = String(pl.phone || \"\").replace(/[^\\d]/g, \"\");\n } catch (_p) { /* payload not JSON */ }\n if (phone.length < 10) {\n const recovered = await phoneForMessage(firstMsg);\n if (recovered) phone = recovered;\n }\n const wantName = phone.length >= 10 ? \"client_\" + phone : \"\";\n const changed =\n (phone.length >= 10 && phone !== String(rp.phone || \"\")) ||\n (wantName && rp.contact_name !== wantName);\n if (phone.length >= 10) rp.phone = phone;\n if (wantName) rp.contact_name = wantName;\n if (changed) {\n out = JSON.stringify(rp);\n console.log(\"APPS route_deal phone/name set\", phone, wantName);\n }\n // CRITICAL: the .gs's checkOpenDeal_ only filters by status===1, it has no\n // idea \"Входящие\" is a throwaway tracking step — so if this phone still has\n // an open \"Входящие\" card in the target pipeline, route_deal mistakes THAT\n // for an already-open deal and silently attaches a comment to it instead of\n // creating a real \"Новое обращение\" escalation (found live 2026-09-11: a\n // media escalation attached to its own Входящие card, no real deal, wrong\n // responsible, nothing assigned by language). Clear them first so\n // checkOpenDeal_ sees a clean slate.\n if (phone.length >= 10) {\n await deleteInboxCards(phone).catch((e) =>\n console.log(\"pre-route_deal inbox clear failed\", String(e))\n );\n }\n }\n } catch (_e) { /* ignore */ }\n\n // find_cargo also arrives with phone:\"\" (no system param). Recover it so an\n // empty by-track result can be retried by the client's recipient number.\n let fcPhone = \"\";\n try {\n const rb = JSON.parse(out || \"{}\");\n if (rb && rb.action === \"find_cargo\") {\n fcPhone = String(rb.phone || \"\").replace(/[^\\d]/g, \"\");\n if (fcPhone.length < 10) {\n const rec = await phoneForMessage(\"\");\n if (rec && rec.length >= 10) {\n fcPhone = rec;\n rb.phone = fcPhone;\n out = JSON.stringify(rb);\n }\n }\n }\n } catch (_e) { /* ignore */ }\n\n console.log(\"APPS\", JSON.stringify({ m: method, b: out }));\n\n let resp: Response;\n try {\n resp = await fetch(outUrl.toString(), {\n method,\n headers: { \"Content-Type\": \"application/json\" },\n body: out,\n redirect: \"follow\",\n });\n } catch (e) {\n return j(\n { ok: false, error: \"proxy_fetch_failed\", detail: String(e) },\n 502,\n );\n }\n let reqTrack = \"\";\n try {\n const rb = JSON.parse(out || \"{}\");\n reqTrack = rb.track || (rb.slots && rb.slots.track_code) || \"\";\n } catch (_e) { /* ignore */ }\n\n let text = await resp.text();\n try {\n const parsed = JSON.parse(text);\n if (\n parsed &&\n (parsed.source === \"by-track\" || parsed.source === \"by-recipient\")\n ) {\n text = JSON.stringify(fixCargo(parsed, reqTrack));\n }\n } catch (_e) {\n /* non-JSON - pass through */\n }\n\n // Track lookup came back empty but we know the client's phone -> show the bags\n // registered on that number instead of letting the agent invent a status.\n try {\n const p0 = JSON.parse(text || \"{}\");\n if (\n p0 && p0.source === \"by-track\" && p0.found === false &&\n fcPhone.length >= 10\n ) {\n const r2 = await fetch(outUrl.toString(), {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ action: \"find_cargo\", phone: fcPhone }),\n redirect: \"follow\",\n });\n const p2 = JSON.parse(await r2.text());\n if (\n p2 && p2.source === \"by-recipient\" && Array.isArray(p2.bags) &&\n p2.bags.length\n ) {\n const fixed = fixCargo(p2, \"\");\n fixed.answer = \"По трек-коду «\" + (reqTrack || \"—\") +\n \"» ничего не нашёл. По вашему номеру телефона: \" + fixed.answer;\n fixed.text = fixed.answer;\n if (reqTrack) cacheCargoAnswer(reqTrack, fixed.answer);\n text = JSON.stringify(fixed);\n console.log(\n \"APPS find_cargo by-recipient fallback\",\n fcPhone,\n \"for track\",\n reqTrack,\n );\n }\n }\n } catch (_e) { /* ignore */ }\n\n // route_deal just created (or re-touched) an escalation -> run the shared\n // side-effects (assign by language / chat link / operator+unread / drop\n // \"Входящие\" cards). See postRouteDeal.\n try {\n const rb = JSON.parse(out || \"{}\");\n if (rb && (rb.route || rb.action === \"route_deal\")) {\n const rr = JSON.parse(text || \"{}\");\n await postRouteDeal(rb, rr);\n }\n } catch (_e) { /* ignore */ }\n\n console.log(\"APPS RESP\", text.slice(0, 800));\n return new Response(text, {\n status: resp.status,\n headers: {\n \"Content-Type\": resp.headers.get(\"Content-Type\") ??\n \"application/json; charset=utf-8\",\n \"Access-Control-Allow-Origin\": \"*\",\n },\n });\n}\n\nexport default async function (req: Request): Promise {\n if (req.method === \"OPTIONS\") {\n return new Response(null, {\n headers: {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"POST, GET, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, X-API-Key\",\n },\n });\n }\n\n const inUrl = new URL(req.url);\n const path = inUrl.pathname.replace(/\\/+$/, \"\").toLowerCase();\n const body = req.method === \"GET\" || req.method === \"HEAD\"\n ? undefined\n : await req.text();\n\n try {\n if (path === \"/inbound\") return await handleInbound(body ?? \"\");\n if (path === \"/outbound\") return await handleOutbound(body ?? \"\");\n if (path === \"/privacy\") {\n // Public, unauthenticated static page — required by the Chrome Web\n // Store listing for the personal \"SendPulse Helper\" extension (privacy policy URL).\n return new Response(PRIVACY_HTML, {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n }\n if (path === \"/sync-responsible\") {\n const tok = inUrl.searchParams.get(\"token\") ||\n req.headers.get(\"x-sync-token\") || \"\";\n if (tok !== Deno.env.get(\"SHARED_SECRET\")) {\n return j({ ok: false, error: \"forbidden\" }, 403);\n }\n const sync = await syncResponsible();\n // Piggy-backs on this same 15-min cron ping (val timporello/syncRespCron) —\n // cleanupInboxCards self-throttles to once/day at 17:30 Almaty, so this is a\n // no-op on 95+ of every 96 ticks.\n const inboxCleanup = await cleanupInboxCards().catch((e) => ({\n error: String(e),\n }));\n return j({ ...sync, inboxCleanup });\n }\n if (path === \"/find-chat\") {\n // Called from the SendPulse Helper extension's search box (content.js) so\n // managers can find a client's WhatsApp chat by phone number — SendPulse's\n // own \"Чаты\" search only matches the display name, which for a real\n // WhatsApp profile name (not one of our \"client_\" cold contacts)\n // never contains the number at all, so it's unsearchable there.\n const tok = inUrl.searchParams.get(\"token\") || \"\";\n if (tok !== Deno.env.get(\"SHARED_SECRET\")) {\n return j({ ok: false, error: \"forbidden\" }, 403);\n }\n const phone = inUrl.searchParams.get(\"phone\") || \"\";\n const url = await chatUrlForPhone(phone).catch(() => \"\");\n if (!url) return j({ ok: false, error: \"not_found\" }, 404);\n return j({ ok: true, url });\n }\n if (path === \"/reset\") {\n const tok = inUrl.searchParams.get(\"token\") ||\n req.headers.get(\"x-sync-token\") || \"\";\n if (tok !== Deno.env.get(\"SHARED_SECRET\")) {\n return j({ ok: false, error: \"forbidden\" }, 403);\n }\n const phones = (inUrl.searchParams.get(\"phones\") || \"\")\n .split(/[,\\s]+/).map((p) => p.replace(/[^\\d]/g, \"\")).filter((p) =>\n p.length >= 10\n );\n const done: string[] = [];\n try {\n await ensureSaltTable();\n await ensureMsgTable();\n await ensureMgrTable();\n for (const p of phones) {\n const salt = Date.now().toString(36) +\n Math.random().toString(36).slice(2, 6);\n await sqlite.execute({\n sql:\n \"INSERT INTO thread_salt (phone, salt, ts) VALUES (:p, :s, :t) \" +\n \"ON CONFLICT(phone) DO UPDATE SET salt = :s, ts = :t\",\n args: { p, s: salt, t: Date.now() },\n });\n await sqlite.execute({\n sql: \"DELETE FROM mgr_active WHERE thread = :p\",\n args: { p },\n });\n await sqlite.execute({\n sql: \"DELETE FROM msg_phone WHERE phone = :p\",\n args: { p },\n });\n done.push(p + \"→\" + salt);\n }\n } catch (e) {\n return j({ ok: false, error: String(e), done });\n }\n console.log(\"RESET\", done.join(\" \"));\n return j({ ok: true, reset: done });\n }\n return await handleAppsScript(req, inUrl, body);\n } catch (e) {\n console.log(\"ERR\", path, String(e));\n return j(\n { ok: false, error: \"handler_threw\", path, detail: String(e) },\n 500,\n );\n }\n}","// -----------------------------------------------------------------------------\n// val: timporello/GoogleApps -> https://alatmsmoonai.val.run/\n//\n// Three roles, routed by URL path:\n//\n// POST / MoonAI Custom Integration -> Google Apps Script (/exec)\n// redirect-follow proxy; unwraps MoonAI's {inputs:{...}} body.\n// Handles: ping / sp_check / find_cargo / route_deal / ...\n//\n// POST /inbound SendPulse WhatsApp bot webhook (\"incoming message\")\n// -> MoonAI API channel inbound\n// POST core.mooonai.com/api/v1/channels/api/messages\n// (thread_id = client phone digits)\n//\n// POST /outbound MoonAI API channel outgoing webhook (agent replies)\n// -> SendPulse WhatsApp send\n// POST api.sendpulse.com/whatsapp/contacts/sendByPhone\n//\n// Env vars:\n// APPS_SCRIPT_URL https://script.google.com/macros/s/.../exec (no query)\n// SHARED_SECRET token appended to the Apps Script call\n// MOONAI_API_KEY X-API-Key for the MoonAI API channel (agent 6739)\n// SP_CLIENT_ID SendPulse OAuth client id\n// SP_CLIENT_SECRET SendPulse OAuth client secret\n// SP_BOT_ID SendPulse internal bot id for WhatsApp 77757088880\n// -----------------------------------------------------------------------------\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\n\nconst MOONAI_INBOUND = \"https://core.mooonai.com/api/v1/channels/api/messages\";\nconst SP_API = \"https://api.sendpulse.com\";\nconst SOURCE = \"wa\";\n\n// Served at /privacy — the privacy-policy URL for the \"SendPulse Helper\"\n// Chrome extension's Web Store listing. Public, no token: reviewers and\n// users must be able to open it directly.\nconst PRIVACY_HTML = `\n\nSendPulse Helper — политика конфиденциальности\n\n\n

SendPulse Helper — политика конфиденциальности

Личное расширение Chrome для собственного удобства в работе с SendPulse.\nНе распространяется публично.

\n\n

Что делает расширение

\n\n

Какие данные обрабатываются

\n\n

Что расширение не делает

\n\n

Контакты

По вопросам — timporello@gmail.com

\n`;\n\nfunction j(data: unknown, status = 200): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: {\n \"Content-Type\": \"application/json; charset=utf-8\",\n \"Access-Control-Allow-Origin\": \"*\",\n },\n });\n}\n\n// -- inbound message -> phone map (val.town SQLite, survives isolate recycling) --\n// MoonAI's API channel exposes NO phone to function calls (no system param, and\n// the sender name is not in the model's context). So route_deal always arrives\n// with phone:\"\". We recover it three ways, in order:\n// 1. exact match of the payload's `first_message` against a relayed message\n// 2. fuzzy (substring / shared 20-char prefix) — the agent often trims or\n// concatenates the client's messages\n// 3. the phone of the most recent /inbound within 60s — route_deal reliably\n// fires ~5-10s after the message that triggered it\nconst INBOUND_MSG_TTL = 30 * 60 * 1000;\nconst LAST_INBOUND_WINDOW = 60 * 1000;\nconst LAST_KEY = \"__last_inbound__\";\nlet msgTableReady: Promise | null = null;\nfunction ensureMsgTable(): Promise {\n if (!msgTableReady) {\n msgTableReady = sqlite\n .execute(\n \"CREATE TABLE IF NOT EXISTS msg_phone (k TEXT PRIMARY KEY, phone TEXT NOT NULL, ts INTEGER NOT NULL)\",\n )\n .then(() => {})\n .catch((e) => {\n console.log(\"msg_phone table init failed\", String(e));\n msgTableReady = null;\n });\n }\n return msgTableReady ?? Promise.resolve();\n}\nfunction normMsg(s: string): string {\n return String(s || \"\").toLowerCase().replace(/\\s+/g, \" \").trim().slice(0, 240);\n}\nasync function rememberInbound(text: string, phone: string): Promise {\n const k = normMsg(text);\n const digits = String(phone || \"\").replace(/[^\\d]/g, \"\");\n if (digits.length < 10) return;\n const now = Date.now();\n try {\n await ensureMsgTable();\n const rows = [{ k: LAST_KEY, p: digits, t: now }];\n if (k.length >= 4) rows.push({ k, p: digits, t: now });\n for (const row of rows) {\n await sqlite.execute({\n sql: \"INSERT INTO msg_phone (k, phone, ts) VALUES (:k, :p, :t) \" +\n \"ON CONFLICT(k) DO UPDATE SET phone = :p, ts = :t\",\n args: row,\n });\n }\n await sqlite.execute({\n sql: \"DELETE FROM msg_phone WHERE ts < :cut\",\n args: { cut: now - INBOUND_MSG_TTL },\n });\n } catch (e) {\n console.log(\"rememberInbound failed\", String(e));\n }\n}\n// A first_message that is basically just a greeting is not a reliable key —\n// go straight to the \"most recent inbound\" fallback for those.\nfunction isGreetingOnly(nk: string): boolean {\n const s = nk.replace(/[^a-zа-яёЀ-ӿ ]/gi, \"\").trim();\n return s.length < 14 ||\n /^(салем|сәлем|сәлеметсіз бе|саламатсыз ба|привет|здравствуйте|здрасте|добрый день|добрый вечер|доброе утро|hi|hello|assalam|ассалам)/i\n .test(s);\n}\nasync function phoneForMessage(text: string): Promise {\n const nk = normMsg(text);\n const now = Date.now();\n const weakKey = isGreetingOnly(nk);\n try {\n await ensureMsgTable();\n // 1. exact\n if (!weakKey && nk.length >= 12) {\n const r = await sqlite.execute({\n sql: \"SELECT phone FROM msg_phone WHERE k = :k AND ts > :cut ORDER BY ts DESC LIMIT 1\",\n args: { k: nk, cut: now - INBOUND_MSG_TTL },\n });\n if (r.rows && r.rows[0]) return String((r.rows[0] as unknown[])[0] || \"\");\n }\n // 2. fuzzy against recent relayed messages\n if (!weakKey && nk.length >= 14) {\n const r = await sqlite.execute({\n sql: \"SELECT k, phone FROM msg_phone WHERE ts > :cut AND k != :last ORDER BY ts DESC LIMIT 60\",\n args: { cut: now - INBOUND_MSG_TTL, last: LAST_KEY },\n });\n for (const row of (r.rows || []) as unknown[][]) {\n const rk = String(row[0] || \"\");\n if (\n rk.length >= 8 &&\n (nk.includes(rk) || rk.includes(nk) || nk.slice(0, 20) === rk.slice(0, 20))\n ) {\n return String(row[1] || \"\");\n }\n }\n }\n // 3. most recent inbound within the window\n const r = await sqlite.execute({\n sql: \"SELECT phone FROM msg_phone WHERE k = :last AND ts > :cut LIMIT 1\",\n args: { last: LAST_KEY, cut: now - LAST_INBOUND_WINDOW },\n });\n if (r.rows && r.rows[0]) return String((r.rows[0] as unknown[])[0] || \"\");\n return \"\";\n } catch (e) {\n console.log(\"phoneForMessage failed\", String(e));\n return \"\";\n }\n}\n\n// -- manager takeover: bot goes quiet once a human operator WRITES in the chat --\n// Opening the chat (a flow \"open_chat\" action, or an operator just viewing it) is\n// NOT a takeover — the bot keeps talking until a human actually sends a message.\n// SendPulse fires `outgoing_message` for every send; a human operator's message\n// carries `sent_by: {id,...}` (an object) / channel \"ma\", our relay's sends are\n// `sent_by: null`, channel \"api\". Rolling window: each operator message refreshes\n// it; after MGR_PAUSE_MS of silence the bot may reply again.\nconst MGR_PAUSE_MS = (Number(Deno.env.get(\"MGR_PAUSE_MINUTES\")) || 120) * 60 * 1000;\nlet mgrTableReady: Promise | null = null;\nfunction ensureMgrTable(): Promise {\n if (!mgrTableReady) {\n mgrTableReady = sqlite\n .execute(\n \"CREATE TABLE IF NOT EXISTS mgr_active (thread TEXT PRIMARY KEY, ts INTEGER NOT NULL)\",\n )\n .then(() => {})\n .catch((e) => {\n console.log(\"mgr_active init failed\", String(e));\n mgrTableReady = null;\n });\n }\n return mgrTableReady ?? Promise.resolve();\n}\nasync function markManagerActive(thread: string): Promise {\n const t = String(thread || \"\").replace(/[^\\d]/g, \"\");\n if (t.length < 10) return;\n try {\n await ensureMgrTable();\n await sqlite.execute({\n sql: \"INSERT INTO mgr_active (thread, ts) VALUES (:t, :n) \" +\n \"ON CONFLICT(thread) DO UPDATE SET ts = :n\",\n args: { t, n: Date.now() },\n });\n } catch (e) {\n console.log(\"markManagerActive failed\", String(e));\n }\n}\nasync function isManagerActive(thread: string): Promise {\n const t = String(thread || \"\").replace(/[^\\d]/g, \"\");\n if (t.length < 10) return false;\n try {\n await ensureMgrTable();\n const r = await sqlite.execute({\n sql: \"SELECT ts FROM mgr_active WHERE thread = :t\",\n args: { t },\n });\n const ts = r.rows && r.rows[0] ? Number((r.rows[0] as unknown[])[0]) : 0;\n if (!ts) return false;\n if (Date.now() - ts > MGR_PAUSE_MS) {\n await sqlite.execute({ sql: \"DELETE FROM mgr_active WHERE thread = :t\", args: { t } });\n return false;\n }\n return true;\n } catch (e) {\n console.log(\"isManagerActive failed\", String(e));\n return false;\n }\n}\n\n// -- conversation reset: a per-phone salt appended to the MoonAI thread_id so a\n// reset phone starts a brand-new MoonAI conversation with no old context. Set by\n// POST /reset (token-gated). thread_id format: \"[__]|\";\n// handleOutbound strips \"|\" to recover the phone.\nlet saltTableReady: Promise | null = null;\nfunction ensureSaltTable(): Promise {\n if (!saltTableReady) {\n saltTableReady = sqlite\n .execute(\n \"CREATE TABLE IF NOT EXISTS thread_salt (phone TEXT PRIMARY KEY, salt TEXT NOT NULL, ts INTEGER NOT NULL)\",\n )\n .then(() => {})\n .catch((e) => {\n console.log(\"thread_salt init failed\", String(e));\n saltTableReady = null;\n });\n }\n return saltTableReady ?? Promise.resolve();\n}\nasync function saltFor(phone: string): Promise {\n const p = String(phone || \"\").replace(/[^\\d]/g, \"\");\n if (p.length < 10) return \"\";\n try {\n await ensureSaltTable();\n const r = await sqlite.execute({\n sql: \"SELECT salt FROM thread_salt WHERE phone = :p\",\n args: { p },\n });\n if (r.rows && r.rows[0]) return String((r.rows[0] as unknown[])[0] || \"\");\n } catch (_e) { /* ignore */ }\n return \"\";\n}\n\n// -- SendPulse OAuth (module-level cache) --------------------------------------\nlet spTok = \"\";\nlet spTokExp = 0;\nasync function spToken(): Promise {\n if (spTok && Date.now() < spTokExp) return spTok;\n const r = await fetch(SP_API + \"/oauth/access_token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n grant_type: \"client_credentials\",\n client_id: Deno.env.get(\"SP_CLIENT_ID\"),\n client_secret: Deno.env.get(\"SP_CLIENT_SECRET\"),\n }),\n });\n const d = await r.json().catch(() => ({}));\n spTok = d.access_token || \"\";\n spTokExp = Date.now() + Math.max(0, (Number(d.expires_in) || 3600) - 120) * 1000;\n if (!spTok) throw new Error(\"sp_oauth_failed: \" + JSON.stringify(d).slice(0, 300));\n return spTok;\n}\n\n// -- /inbound : SendPulse bot webhook -> MoonAI API channel ---------------------\nasync function handleInbound(body: string): Promise {\n const key = Deno.env.get(\"MOONAI_API_KEY\");\n if (!key) return j({ ok: false, error: \"no_moonai_key\" }, 500);\n\n let events: any;\n try {\n events = JSON.parse(body || \"[]\");\n } catch {\n return j({ ok: false, error: \"bad_json\" }, 400);\n }\n if (!Array.isArray(events)) events = [events];\n\n const results: any[] = [];\n for (const ev of events) {\n const title = ev?.title || ev?.event || \"\";\n\n // Manager takeover: a human operator SENT a message in this chat. Just opening\n // the chat is not a takeover — the bot keeps replying until a human writes.\n if (title === \"outgoing_message\" || title === \"open_chat\") {\n const om = ev?.info?.message ?? ev?.message ?? {};\n const sentBy = om?.sent_by ?? ev?.info?.sent_by ?? ev?.sent_by ?? null;\n const chan = String(om?.channel ?? ev?.info?.channel ?? ev?.channel ?? \"\");\n const human = title === \"outgoing_message\" && (\n (sentBy && typeof sentBy === \"object\") ||\n (typeof sentBy === \"number\" && sentBy > 0) ||\n chan === \"ma\"\n );\n const c = ev?.contact || {};\n const ph = String(\n c?.channel_data?.phone ?? c?.phone ?? c?.username ?? om?.to ?? om?.from ?? \"\",\n ).replace(/[^\\d]/g, \"\");\n console.log(\n \"INBOUND\",\n title,\n JSON.stringify({ human, chan, by: sentBy && (sentBy.id ?? sentBy), ph }).slice(0, 200),\n );\n if (human && ph) {\n await markManagerActive(ph);\n const mtext = om?.data?.text?.body ?? om?.text?.body ?? om?.data?.text ?? om?.text ?? \"\";\n if (mtext) {\n try {\n await fetch(MOONAI_INBOUND, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", \"X-API-Key\": key },\n body: JSON.stringify({\n thread_id: ph,\n source: SOURCE,\n from_type: \"operator\",\n from_name: \"Менеджер\",\n message_type: \"text\",\n data: { text: String(mtext) },\n }),\n });\n } catch (_e) { /* proxy-side mute is the real guarantee */ }\n }\n }\n results.push({ handled: title, managerActive: !!(human && ph) });\n continue;\n }\n\n if (title !== \"incoming_message\" && title !== \"message\") {\n results.push({ skipped: title || \"no_title\" });\n continue;\n }\n\n const msg = ev?.info?.message?.channel_data?.message || {};\n const contact = ev?.contact || {};\n const phone = String(\n msg?.from ?? contact?.phone ?? contact?.username ?? \"\",\n ).replace(/[^\\d]/g, \"\");\n\n // Every genuine client inbound (media included) gets a throwaway \"Входящие\"\n // tracking card — see ensureInboxCard — so nothing the bot handles silently\n // (or can't handle at all) ever goes fully untracked. MUST be awaited, not\n // fire-and-forget: val.town does not keep a background promise alive after\n // the HTTP response is sent, so an un-awaited multi-call chain here gets cut\n // off mid-flight (confirmed live 2026-09-11 — only some of the 5 pipeline\n // cards were created, sometimes none). ensureInboxCard self-throttles to\n // once/phone/day, so this only costs real time on the first message of the\n // day for a given phone; every later message that day returns almost\n // instantly.\n if (phone) {\n await ensureInboxCard(phone).catch((e) => console.log(\"inbox card failed\", String(e)));\n }\n\n // Multi-bot: keep phone as thread id for the main bot, append \"__\"\n // for any other SendPulse bot so /outbound can reply through the right one.\n // Computed here (not just below) because escalateMedia also needs it to send\n // the client's acknowledgement through the right bot.\n const mainBot = Deno.env.get(\"SP_BOT_ID\") || \"\";\n const botId = String(ev?.bot?.id || ev?.bot?._id || mainBot);\n\n // Audio/photo/video/document/sticker: the bot must stay completely silent\n // (never forwarded to MoonAI, never an AI-generated reply) and escalate\n // straight to a manager instead. Also awaited for the same reason as\n // ensureInboxCard above.\n const mediaType = String(msg?.type || \"\");\n if (MEDIA_LABELS[mediaType]) {\n const caption = String(\n msg?.image?.caption ?? msg?.video?.caption ?? msg?.document?.caption ?? \"\",\n );\n if (phone) {\n await escalateMedia(phone, mediaType, caption, botId).catch((e) =>\n console.log(\"escalateMedia failed\", String(e))\n );\n }\n results.push({ skipped: \"media_escalated\", mediaType, phone });\n continue;\n }\n\n const text =\n msg?.text?.body ??\n msg?.button?.text ??\n msg?.interactive?.list_reply?.title ??\n msg?.interactive?.button_reply?.title ??\n ev?.info?.message?.text ??\n ev?.message?.text ??\n ev?.text ??\n \"\";\n const suffix = botId && botId !== mainBot ? \"__\" + botId : \"\";\n // reset salt (POST /reset) -> fresh MoonAI conversation for this phone\n const salt = phone ? await saltFor(phone) : \"\";\n const threadId = phone\n ? phone + suffix + (salt ? \"|\" + salt : \"\")\n : String(contact?.id || \"unknown\");\n // Never surface the client's WhatsApp profile name. Everyone is\n // \"client_\" — keeps MoonAI transcripts, the route_deal payload and any\n // CRM record the middleware creates downstream consistent, and the trailing\n // digit run is still the phone for handleAppsScript's recovery path.\n // MoonAI's API channel has no phone field; `from_name` maps to the\n // `messenger_username` system param, so route_deal still carries the number.\n const fromName = phone ? \"client_\" + phone : \"client_unknown\";\n\n if (!text) {\n results.push({ skipped: \"no_text\", threadId });\n continue;\n }\n if (phone) await rememberInbound(String(text), phone);\n\n const payload = {\n thread_id: threadId,\n source: SOURCE,\n from_type: \"user\",\n from_name: fromName,\n message_type: \"text\",\n data: { text: String(text) },\n };\n const r = await fetch(MOONAI_INBOUND, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", \"X-API-Key\": key },\n body: JSON.stringify(payload),\n });\n const rt = await r.text();\n console.log(\"INBOUND\", threadId, \"->\", r.status, rt.slice(0, 300));\n results.push({ threadId, moonai_status: r.status, moonai_body: rt.slice(0, 300) });\n }\n // Near-real-time nudge for the responsible-owner sync: whenever a client writes\n // in, reconcile owners across deal <-> contacts <-> tasks. syncResponsible()\n // self-throttles to once / SYNC_MIN_GAP, so this is a no-op most of the time.\n // Fire-and-forget — it must never delay the inbound relay. The 15-min cron\n // (val timporello/syncRespCron) is the quiet-hours / off-hours backstop.\n if (results.some((r) => r.moonai_status)) {\n syncResponsible().catch((e) => console.log(\"sync nudge failed\", String(e)));\n }\n return j({ ok: true, results });\n}\n\n// -- /outbound : MoonAI agent webhook -> SendPulse WhatsApp ---------------------\nasync function handleOutbound(body: string): Promise {\n let ev: any;\n try {\n ev = JSON.parse(body || \"{}\");\n } catch {\n return j({ ok: false, error: \"bad_json\" }, 400);\n }\n\n const type = ev?.event_type || \"\";\n if (type !== \"agent_message\" && type !== \"manager_message\") {\n console.log(\"OUTBOUND skip\", type);\n return j({ ok: true, skipped: type || \"no_type\" });\n }\n const m = ev?.message || {};\n if ((m?.message_type || \"text\") !== \"text\") {\n console.log(\"OUTBOUND skip non-text\", m?.message_type);\n return j({ ok: true, skipped: \"non_text:\" + m?.message_type });\n }\n let text = m?.data?.text ?? m?.text ?? \"\";\n // strip leaked markdown fences / whitespace the model sometimes emits\n text = String(text).replace(/```+/g, \"\").replace(/^[\\s`]+|[\\s`]+$/g, \"\");\n const threadId = String(ev?.external_thread_id ?? ev?.thread_id ?? \"\")\n .replace(/^api:[^:]+:/, \"\")\n .replace(/\\|.*$/, \"\"); // drop the reset salt (\"[__]|\")\n if (!text || !threadId) {\n return j({ ok: false, error: \"missing_text_or_thread\", threadId }, 400);\n }\n\n // threadId may be \"__\" (non-main bot) or just \"\"\n const [phonePart, botPart] = threadId.split(\"__\");\n\n // A human operator is handling this chat -> the bot stays out of the way.\n if (await isManagerActive(phonePart)) {\n console.log(\"OUTBOUND suppressed (manager active)\", phonePart, \"|\", String(text).slice(0, 80));\n return j({ ok: true, skipped: \"manager_active\", thread: phonePart });\n }\n\n // If the agent mangled a cargo-status reply, replace it with the authoritative\n // answer we computed from find_cargo a moment ago.\n const authoritative = authoritativeCargoText(text);\n if (authoritative) {\n console.log(\"OUTBOUND cargo-override\", JSON.stringify({ was: String(text).slice(0, 120), now: authoritative.slice(0, 120) }));\n text = authoritative;\n }\n\n const digits = String(phonePart || \"\").replace(/[^\\d]/g, \"\");\n const botId = botPart || Deno.env.get(\"SP_BOT_ID\");\n const tok = await spToken();\n\n let endpoint: string;\n let reqBody: string;\n if (digits.length >= 10) {\n endpoint = SP_API + \"/whatsapp/contacts/sendByPhone\";\n reqBody = JSON.stringify({\n bot_id: botId,\n phone: digits,\n message: { type: \"text\", text: { body: String(text) } },\n });\n } else {\n endpoint = SP_API + \"/whatsapp/contacts/send\";\n reqBody = JSON.stringify({\n contact_id: threadId,\n message: { type: \"text\", text: { body: String(text) } },\n });\n }\n\n const r = await fetch(endpoint, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", Authorization: \"Bearer \" + tok },\n body: reqBody,\n });\n const rt = await r.text();\n console.log(\"OUTBOUND\", digits || threadId, \"->\", r.status, rt.slice(0, 400));\n return j({\n ok: r.ok,\n sp_status: r.status,\n sp_body: rt.slice(0, 400),\n cargo_override: !!authoritative,\n sent_text: String(text).slice(0, 200),\n });\n}\n\n// -- responsible-owner sync: deal <-> linked contacts <-> linked tasks ---------\n// SendPulse exposes no CRM webhook, so a val.town cron pings /sync-responsible\n// every ~90s. Goal: responsibleId identical across each open deal and everything\n// linked to it. Last-writer-wins: we remember every member's responsibleId\n// between runs; when exactly one member moved since the last run, that new value\n// is pushed to the others. (updatedAt alone is unreliable — an unrelated comment\n// bumps it — so it is only the tie-breaker the first time a divergent group is\n// seen, or when a change happened outside our tracking.)\nconst SYNC_PIPELINES = [183193, 183194, 183195, 183196, 182841];\nconst SYNC_BOARD = 164785;\nconst SYNC_TASK_DONE_STEP = 498988;\nconst SYNC_MIN_GAP = 60 * 1000;\nlet syncRunning = false;\nlet syncLastRun = 0;\nlet respTableReady: Promise | null = null;\n\nfunction ensureRespTable(): Promise {\n if (!respTableReady) {\n respTableReady = sqlite\n .execute(\n \"CREATE TABLE IF NOT EXISTS resp_state (k TEXT PRIMARY KEY, resp INTEGER NOT NULL, ts INTEGER NOT NULL)\",\n )\n .then(() => {})\n .catch((e) => {\n console.log(\"resp_state init failed\", String(e));\n respTableReady = null;\n });\n }\n return respTableReady ?? Promise.resolve();\n}\n\nasync function spCrm(method: string, path: string, body?: unknown): Promise {\n const tok = await spToken();\n const r = await fetch(SP_API + \"/crm/v1\" + path, {\n method,\n headers: { \"Content-Type\": \"application/json\", Authorization: \"Bearer \" + tok },\n body: body === undefined ? undefined : JSON.stringify(body),\n });\n const txt = await r.text();\n let data: any = null;\n try {\n data = txt ? JSON.parse(txt) : null;\n } catch {\n data = txt;\n }\n if (!r.ok) throw new Error(method + \" \" + path + \" -> \" + r.status + \" \" + txt.slice(0, 200));\n return data;\n}\n\nasync function priorResp(k: string): Promise {\n try {\n const r = await sqlite.execute({\n sql: \"SELECT resp FROM resp_state WHERE k = :k\",\n args: { k },\n });\n if (r.rows && r.rows[0]) return Number((r.rows[0] as unknown[])[0]);\n } catch (_e) { /* ignore */ }\n return null;\n}\nasync function recordResp(k: string, resp: number): Promise {\n try {\n await sqlite.execute({\n sql: \"INSERT INTO resp_state (k, resp, ts) VALUES (:k, :r, :t) \" +\n \"ON CONFLICT(k) DO UPDATE SET resp = :r, ts = :t\",\n args: { k, r: resp, t: Date.now() },\n });\n } catch (_e) { /* ignore */ }\n}\n\nasync function syncResponsible(): Promise {\n if (syncRunning) return { ok: true, skipped: \"running\" };\n if (Date.now() - syncLastRun < SYNC_MIN_GAP) return { ok: true, skipped: \"throttled\" };\n syncRunning = true;\n syncLastRun = Date.now();\n const changes: any[] = [];\n const errors: any[] = [];\n try {\n await ensureRespTable();\n\n // open deals across the 5 call-center pipelines\n const deals: any[] = [];\n for (const p of SYNC_PIPELINES) {\n try {\n const d = await spCrm(\"POST\", \"/deals/get-list\", {\n pipelineIds: [p],\n limit: 50,\n // \"Входящие\" cards are throwaway traffic markers, not real work — keep\n // them out of load-balancing and the deal<->contact<->task sync so a\n // busy day of them never crowds real escalations out of this window.\n filter: [{ name: \"stepId\", expression: \"neq\", value: String(INBOX_STEP[p] || 0) }],\n });\n for (const x of (d?.data || [])) if ((x.status ?? 1) === 1) deals.push(x);\n } catch (e) {\n errors.push({ pipeline: p, error: String(e) });\n }\n }\n\n // every not-done task on the board -> map dealId -> [full task]\n const tasksByDeal = new Map();\n try {\n for (let off = 0; off < 500; off += 50) {\n const tr = await spCrm(\"POST\", \"/tasks/list\", {\n boardId: SYNC_BOARD,\n limit: 50,\n offset: off,\n });\n const list = tr?.data || [];\n for (const row of list) {\n if (row.stepId === SYNC_TASK_DONE_STEP || row.status === 2) continue;\n let full: any = null;\n try {\n full = await spCrm(\"GET\", \"/tasks/\" + row.id);\n } catch (_e) {\n continue;\n }\n const tk = full?.data || {};\n for (const did of (tk.deals || [])) {\n if (!tasksByDeal.has(did)) tasksByDeal.set(did, []);\n tasksByDeal.get(did)!.push(tk);\n }\n }\n if (list.length < 50) break;\n }\n } catch (e) {\n errors.push({ tasks: true, error: String(e) });\n }\n\n for (const deal of deals) {\n try {\n const dc = await spCrm(\"GET\", \"/deals/\" + deal.id + \"/contacts\");\n const contacts = dc?.data || [];\n const tks = tasksByDeal.get(deal.id) || [];\n\n // backfill the one-click \"Чат\" link if it is still empty\n try {\n const cattr = CHAT_ATTR[Number(deal.pipelineId)];\n const cur = (deal.attributes || []).find((a: any) => Number(a.id) === cattr);\n const curVal = cur && (typeof cur.value === \"object\" ? cur.value?.value : cur.value);\n if (cattr && !curVal && contacts[0]) {\n const cl = await fillChatLink(\n Number(deal.id),\n Number(deal.pipelineId),\n contacts[0],\n contacts[0]?.phones?.[0]?.phone || \"\",\n );\n if (cl && cl.url) changes.push({ deal: deal.id, chatLink: cl.url });\n }\n } catch (_e) { /* ignore */ }\n\n type M = { key: string; resp: number; upd: string; put: (rid: number) => Promise };\n const members: M[] = [];\n members.push({\n key: \"d:\" + deal.id,\n resp: Number(deal.responsibleId) || 0,\n upd: String(deal.updatedAt || \"\"),\n put: (rid) =>\n spCrm(\"PUT\", \"/deals/\" + deal.id, {\n pipelineId: deal.pipelineId,\n status: deal.status ?? 1,\n stepId: deal.stepId,\n name: deal.name,\n price: deal.price ?? 0,\n currency: deal.currency || \"KZT\",\n responsibleId: rid,\n }),\n });\n for (const c of contacts) {\n members.push({\n key: \"c:\" + c.id,\n resp: Number(c.responsibleId) || 0,\n upd: String(c.updatedAt || \"\"),\n put: (rid) =>\n spCrm(\"PUT\", \"/contacts/\" + c.id, {\n responsibleId: rid,\n firstName: c.firstName || (\"Контакт \" + c.id),\n lastName: c.lastName || \"\",\n }),\n });\n }\n for (const tk of tks) {\n members.push({\n key: \"t:\" + tk.id,\n resp: Number(tk.responsibleId) || 0,\n upd: String(tk.updatedAt || \"\"),\n put: (rid) =>\n spCrm(\"PUT\", \"/tasks/\" + tk.id, {\n name: tk.name,\n boardId: tk.boardId || SYNC_BOARD,\n stepId: tk.stepId,\n priority: tk.priority ?? 2,\n responsibleId: rid,\n }),\n });\n }\n\n const live = members.filter((m) => m.resp > 0);\n if (live.length < 2) {\n for (const m of live) await recordResp(m.key, m.resp);\n continue;\n }\n if (new Set(live.map((m) => m.resp)).size === 1) {\n for (const m of live) await recordResp(m.key, m.resp);\n continue;\n }\n\n // divergent group -> choose the canonical owner\n const moved: M[] = [];\n for (const m of live) {\n const prev = await priorResp(m.key);\n if (prev !== null && prev !== m.resp) moved.push(m);\n }\n let canonical: number;\n if (moved.length) {\n moved.sort((a, b) => (a.upd < b.upd ? 1 : -1));\n canonical = moved[0].resp;\n } else {\n canonical = [...live].sort((a, b) => (a.upd < b.upd ? 1 : -1))[0].resp;\n }\n\n for (const m of live) {\n if (m.resp !== canonical) {\n try {\n await m.put(canonical);\n changes.push({ deal: deal.id, member: m.key, from: m.resp, to: canonical });\n } catch (e) {\n errors.push({ deal: deal.id, member: m.key, error: String(e) });\n }\n }\n await recordResp(m.key, canonical);\n }\n } catch (e) {\n errors.push({ deal: deal.id, error: String(e) });\n }\n }\n\n try {\n await sqlite.execute({\n sql: \"DELETE FROM resp_state WHERE ts < :cut\",\n args: { cut: Date.now() - 14 * 24 * 60 * 60 * 1000 },\n });\n } catch (_e) { /* ignore */ }\n\n return { ok: true, deals: deals.length, changes, errors };\n } catch (e) {\n return { ok: false, error: String(e), changes, errors };\n } finally {\n syncRunning = false;\n }\n}\n\n// -- escalation auto-assign by client language --------------------------------\n// When route_deal creates a new escalation deal, hand it to a manager who speaks\n// the client's language. Алия (9501075) is NOT in any pool — she watches the\n// pipelines and reassigns a deal to herself when she wants to take one.\n// Updated 2026-09-11 per user's spec (\"Первый слой: Языки\"):\n// RU+KZ -> Молдир 9501565, Шолпан 9501561\n// KZ+CN -> Миербан 9504155, 加依娜尔 9501563\n// KZ falls in both rows above -> union of all 4 (user confirmed via question).\n// RU -> only Молдир/Шолпан (only that row claims RU). CN -> only Миербан/加依娜尔.\n// Within a pool we pick the manager with the fewest open deals right now (ties\n// broken round-robin). The deal↔contact↔task sync then propagates the owner.\nconst LANG_MANAGERS: Record = {\n RU: [9501565, 9501561],\n KZ: [9501565, 9501561, 9504155, 9501563],\n CN: [9504155, 9501563],\n};\n// Per-pipeline override, wins over language. Updated 2026-09-11:\n// 183194 Поддержка Посылки -> Молдир + Шолпан + 加依娜尔\n// 183193 Поддержка Хозтовары -> 加依娜尔 + Миербан + Молдир\n// 183196 Склад/Пересорт -> \"то же самое, что в обеих поддержках\" = union\n// of the two pools above (everyone except Алия)\n// 183195 Коммерческие лиды -> ответ клиенту это номер комм. отдела\n// +7 778 085 3000 (уже в промпте, D1/D2/D3),\n// ни один менеджер поддержки лиды не ведёт ->\n// сделка остаётся на Алие (наблюдатель).\n// 182841 Бухгалтерия не упомянута пользователем -> по-прежнему падает по языку\n// (LANG_MANAGERS выше), без отдельного override.\nconst POOL_BY_PIPELINE: Record = {\n 183194: [9501565, 9501561, 9501563],\n 183193: [9501563, 9504155, 9501565],\n 183196: [9501565, 9501561, 9501563, 9504155],\n 183195: [9501075],\n};\nlet rrTableReady: Promise | null = null;\nfunction ensureRrTable(): Promise {\n if (!rrTableReady) {\n rrTableReady = sqlite\n .execute(\"CREATE TABLE IF NOT EXISTS assign_rr (k TEXT PRIMARY KEY, n INTEGER NOT NULL)\")\n .then(() => {})\n .catch((e) => {\n console.log(\"assign_rr init failed\", String(e));\n rrTableReady = null;\n });\n }\n return rrTableReady ?? Promise.resolve();\n}\nasync function rrNext(k: string): Promise {\n try {\n await ensureRrTable();\n const r = await sqlite.execute({ sql: \"SELECT n FROM assign_rr WHERE k = :k\", args: { k } });\n const n = r.rows && r.rows[0] ? Number((r.rows[0] as unknown[])[0]) : 0;\n await sqlite.execute({\n sql: \"INSERT INTO assign_rr (k, n) VALUES (:k, 1) ON CONFLICT(k) DO UPDATE SET n = n + 1\",\n args: { k },\n });\n return n;\n } catch (_e) {\n return 0;\n }\n}\nasync function assignDealByLang(\n dealId: number,\n lang: string,\n pipelineId?: number,\n): Promise {\n const L = String(lang || \"\").trim().toUpperCase();\n const pool = POOL_BY_PIPELINE[Number(pipelineId) || 0] || LANG_MANAGERS[L] ||\n LANG_MANAGERS.RU;\n let rid = pool[0];\n if (pool.length > 1) {\n // fewest open deals wins; count all candidates in one sweep of the pipelines.\n // Fired in parallel, not one-by-one — this sweep alone was 5 sequential HTTP\n // round trips (one per pipeline), a big chunk of why route_deal ballooned to\n // ~25s and started tripping MoonAI's own function-call timeout (found live\n // 2026-09-13: repeated \"route_deal вызвана с ошибкой\" emails).\n const load = new Map(pool.map((r) => [r, 0]));\n await Promise.all(SYNC_PIPELINES.map(async (p) => {\n try {\n const d = await spCrm(\"POST\", \"/deals/get-list\", {\n pipelineIds: [p],\n limit: 50,\n // \"Входящие\" cards are throwaway traffic markers, not real work — keep\n // them out of load-balancing and the deal<->contact<->task sync so a\n // busy day of them never crowds real escalations out of this window.\n filter: [{ name: \"stepId\", expression: \"neq\", value: String(INBOX_STEP[p] || 0) }],\n });\n for (const x of (d?.data || [])) {\n const r = Number(x.responsibleId);\n if ((x.status ?? 1) === 1 && load.has(r)) load.set(r, (load.get(r) || 0) + 1);\n }\n } catch (_e) { /* ignore a bad pipeline */ }\n }));\n const min = Math.min(...pool.map((r) => load.get(r) ?? 0));\n const tied = pool.filter((r) => (load.get(r) ?? 0) === min);\n rid = tied.length === 1 ? tied[0] : tied[await rrNext(\"lang:\" + L) % tied.length];\n }\n const g = await spCrm(\"GET\", \"/deals/\" + dealId);\n const dl = g?.data || {};\n if (!dl.id) return { dealId, error: \"deal_not_found\" };\n if (Number(dl.responsibleId) === rid) return { dealId, rid, lang: L, skipped: \"already\" };\n await spCrm(\"PUT\", \"/deals/\" + dealId, {\n pipelineId: dl.pipelineId,\n status: dl.status ?? 1,\n stepId: dl.stepId,\n name: dl.name,\n price: dl.price ?? 0,\n currency: dl.currency || \"KZT\",\n responsibleId: rid,\n });\n return { dealId, lang: L, rid, from: Number(dl.responsibleId) || 0 };\n}\n\n// -- one-click chat link on the deal card ------------------------------------\n// A per-pipeline \"Чат\" (Link) attribute; we fill it with a direct URL into the\n// client's WhatsApp dialog, on whichever of the two bots the conversation\n// actually lives (so the manager opens the right chat in one click).\nconst CHAT_ATTR: Record = {\n 183193: 1117964,\n 183194: 1117965,\n 183195: 1117966,\n 183196: 1117967,\n 182841: 1117968,\n};\nconst SP_BOTS = [\"69974943d7855b67ca0aa73d\", \"69974b70bcc6ed11b20fd23f\"];\n\n// -- \"Входящие\" tracking cards -------------------------------------------------\n// A first-stage step (\"Входящие\", order=1) added 2026-09-11 to all 5 pipelines.\n// Every raw inbound message (once per phone per Almaty day) gets a lightweight,\n// unassigned-except-Aliya card duplicated into ALL 5 pipelines, purely so a raw\n// message is never *invisible* even when MoonAI handles it itself and no real\n// deal is ever created. Deleted the moment a real escalation happens for that\n// phone (postRouteDeal), or swept at close of business (17:30 Almaty) — a card\n// created after that already-passed cleanup survives to the next day's sweep,\n// which is the \"if it came in the evening, let it hang until tomorrow\" rule.\nconst INBOX_STEP: Record = {\n 183193: 639352,\n 183194: 639353,\n 183195: 639354,\n 183196: 639355,\n 182841: 639356,\n};\nconst INBOX_RESPONSIBLE = 9501075; // Алия — she already just observes/triages\nlet inboxTableReady: Promise | null = null;\nfunction ensureInboxTable(): Promise {\n if (!inboxTableReady) {\n inboxTableReady = sqlite\n .execute(\n \"CREATE TABLE IF NOT EXISTS inbox_cards \" +\n \"(phone TEXT NOT NULL, day TEXT NOT NULL, pipeline_id INTEGER NOT NULL, \" +\n \"deal_id INTEGER NOT NULL, ts INTEGER NOT NULL, PRIMARY KEY (phone, pipeline_id))\",\n )\n .then(() =>\n sqlite.execute(\n \"CREATE TABLE IF NOT EXISTS inbox_cleanup (day TEXT PRIMARY KEY, ts INTEGER NOT NULL)\",\n )\n )\n .then(() => {})\n .catch((e) => {\n console.log(\"inbox_cards init failed\", String(e));\n inboxTableReady = null;\n });\n }\n return inboxTableReady ?? Promise.resolve();\n}\nfunction almatyDateStr(ms: number): string {\n // Asia/Almaty = UTC+5, no DST.\n return new Date(ms + 5 * 3600 * 1000).toISOString().slice(0, 10);\n}\n// Creates the 5 duplicate \"Входящие\" cards for a phone, once per Almaty day.\n// Each card gets the client's contact (find-or-create, \"client_\" name —\n// never a WhatsApp profile name) and the one-click \"Чат\" link attached, so the\n// card is actually openable/useful — not just a bare name string. (Fixed\n// 2026-09-11: originally shipped name-only, which is why the cards looked\n// \"empty\" — no linked contact, no phone field, no way to jump into the chat.)\nasync function ensureInboxCard(phone: string): Promise {\n const digits = String(phone || \"\").replace(/[^\\d]/g, \"\");\n if (digits.length < 10) return { skipped: \"no_phone\" };\n try {\n await ensureInboxTable();\n const day = almatyDateStr(Date.now());\n const seen = await sqlite.execute({\n sql: \"SELECT 1 FROM inbox_cards WHERE phone = :p AND day = :d LIMIT 1\",\n args: { p: digits, d: day },\n });\n if (seen.rows && seen.rows[0]) return { skipped: \"already_today\" };\n\n // Find-or-create the CRM contact once, reuse across all 5 pipeline cards —\n // same convention as the .gs route_deal path (findOrCreateContact_), so a\n // later real escalation for this phone lands on the SAME contact record.\n async function resolveContact(): Promise {\n try {\n const tail = digits.slice(-10);\n const found = await spCrm(\"POST\", \"/contacts/get-list\", { phone: digits, limit: 20 });\n const list = found?.data?.list || found?.data || [];\n for (const c of Array.isArray(list) ? list : []) {\n const pj = JSON.stringify(c?.phones || []).replace(/\\D/g, \"\");\n if (pj.includes(tail)) return Number(c.id);\n }\n const made = await spCrm(\"POST\", \"/contacts\", {\n firstName: \"client_\" + digits,\n phones: [digits],\n messengers: [{ typeId: 5, login: digits }],\n responsibleId: INBOX_RESPONSIBLE,\n });\n return Number(made?.data?.id || made?.id || 0);\n } catch (e) {\n console.log(\"inbox contact resolve failed\", String(e));\n return 0;\n }\n }\n // Contact resolve/create and chat-URL resolve are independent of each other\n // — and, now that this whole function sits on the critical (awaited) path\n // of /inbound, everything below runs in parallel rather than serially: a\n // serial 5-pipeline loop here was clocked at 6+ seconds live, which is long\n // enough that val.town cut the earlier fire-and-forget version off mid-way\n // (see the comment at the call site) even once awaited it would be slow.\n const [contactId, chatUrl] = await Promise.all([\n resolveContact(),\n chatUrlForPhone(digits).catch(() => \"\"),\n ]);\n\n const pids = Object.keys(INBOX_STEP).map(Number);\n const perPipeline = await Promise.all(pids.map(async (pid) => {\n try {\n const body: Record = {\n pipelineId: pid,\n stepId: INBOX_STEP[pid],\n responsibleId: INBOX_RESPONSIBLE,\n name: \"Входящее · \" + digits + \" · \" + day,\n };\n if (contactId) body.contact = [contactId];\n const r = await spCrm(\"POST\", \"/deals\", body);\n const id = r?.data?.id || r?.id;\n if (!id) return null;\n if (chatUrl && CHAT_ATTR[pid]) {\n await spCrm(\"POST\", \"/deals/\" + id + \"/attributes\", {\n attributeId: CHAT_ATTR[pid],\n value: chatUrl,\n }).catch((e) => console.log(\"inbox chat link failed\", pid, String(e)));\n }\n await sqlite.execute({\n sql: \"INSERT INTO inbox_cards (phone, day, pipeline_id, deal_id, ts) VALUES \" +\n \"(:p, :d, :pid, :did, :t) ON CONFLICT(phone, pipeline_id) DO UPDATE SET \" +\n \"day = :d, deal_id = :did, ts = :t\",\n args: { p: digits, d: day, pid, did: id, t: Date.now() },\n });\n return id as number;\n } catch (e) {\n console.log(\"inbox card create failed\", pid, String(e));\n return null;\n }\n }));\n const created = perPipeline.filter((x): x is number => x != null);\n return { phone: digits, day, contactId, chatUrl: !!chatUrl, created };\n } catch (e) {\n return { error: String(e) };\n }\n}\n// Deletes the tracked \"Входящие\" cards for a phone (called once a real\n// escalation lands, via postRouteDeal).\nasync function deleteInboxCards(phone: string): Promise {\n const digits = String(phone || \"\").replace(/[^\\d]/g, \"\");\n if (digits.length < 10) return { skipped: \"no_phone\" };\n try {\n await ensureInboxTable();\n const r = await sqlite.execute({\n sql: \"SELECT deal_id FROM inbox_cards WHERE phone = :p\",\n args: { p: digits },\n });\n const ids = (r.rows || []).map((row) => Number((row as unknown[])[0]));\n const outcomes = await Promise.all(ids.map(async (id) => {\n try {\n await spCrm(\"DELETE\", \"/deals/\" + id);\n return true;\n } catch (_e) {\n return false; // deal may already be gone\n }\n }));\n const deleted = outcomes.filter(Boolean).length;\n await sqlite.execute({ sql: \"DELETE FROM inbox_cards WHERE phone = :p\", args: { p: digits } });\n return { phone: digits, deleted };\n } catch (e) {\n return { error: String(e) };\n }\n}\n// Close-of-business sweep (17:30 Almaty, once/day — hit via the /sync-responsible\n// cron): removes every still-open \"Входящие\" card. A card made after today's\n// sweep already ran (an evening message) simply isn't touched until tomorrow's.\nasync function cleanupInboxCards(): Promise {\n const now = Date.now();\n const almaty = new Date(now + 5 * 3600 * 1000);\n const hour = almaty.getUTCHours();\n const minute = almaty.getUTCMinutes();\n if (hour < 17 || (hour === 17 && minute < 30)) return { skipped: \"not_yet\" };\n try {\n await ensureInboxTable();\n const day = almatyDateStr(now);\n const done = await sqlite.execute({\n sql: \"SELECT 1 FROM inbox_cleanup WHERE day = :d\",\n args: { d: day },\n });\n if (done.rows && done.rows[0]) return { skipped: \"already_done_today\" };\n const r = await sqlite.execute(\"SELECT phone, deal_id FROM inbox_cards\");\n let deleted = 0;\n const errors: string[] = [];\n for (const row of (r.rows || []) as unknown[][]) {\n const id = Number(row[1]);\n try {\n await spCrm(\"DELETE\", \"/deals/\" + id);\n deleted++;\n } catch (e) {\n errors.push(id + \":\" + String(e));\n }\n }\n await sqlite.execute(\"DELETE FROM inbox_cards\");\n await sqlite.execute({\n sql: \"INSERT INTO inbox_cleanup (day, ts) VALUES (:d, :t) ON CONFLICT(day) DO NOTHING\",\n args: { d: day, t: now },\n });\n return { day, deleted, errors };\n } catch (e) {\n return { error: String(e) };\n }\n}\n\nasync function spWaGet(path: string): Promise {\n const tok = await spToken();\n const r = await fetch(SP_API + path, { headers: { Authorization: \"Bearer \" + tok } });\n return r.json().catch(() => ({}));\n}\nfunction chatUrlFromContact(c: any): string {\n const ms = Array.isArray(c?.messengers) ? c.messengers : [];\n const withUrl = ms.filter((m: any) => m && m.chatbotUrl && m.botId);\n if (!withUrl.length) return \"\";\n withUrl.sort((a: any, b: any) =>\n a.isMainChatbot === b.isMainChatbot ? 0 : a.isMainChatbot ? -1 : 1\n );\n return String(withUrl[0].chatbotUrl || \"\");\n}\nasync function resolveWaContact(\n phone: string,\n): Promise<{ bot: string; id: string } | null> {\n const digits = String(phone || \"\").replace(/[^\\d]/g, \"\");\n if (digits.length < 10) return null;\n // Both bots in parallel, not one after another — this was a sequential pair\n // of round trips on every call, and this function got called twice per\n // escalation (once each from fillChatLink and syncChatOperator) before\n // postRouteDeal started sharing one resolution between them.\n const hits = await Promise.all(SP_BOTS.map(async (bot) => {\n try {\n const d = await spWaGet(\n \"/whatsapp/contacts/getByPhone?bot_id=\" + bot + \"&phone=\" + digits,\n );\n const c = d?.data;\n if (c && c.id) {\n const key = String(c.last_activity_at || \"0000\") + (c.is_chat_opened ? \"_1\" : \"_0\");\n return { bot, id: String(c.id), key };\n }\n } catch (_e) { /* ignore this bot */ }\n return null;\n }));\n let best: { bot: string; id: string; key: string } | null = null;\n for (const h of hits) if (h && (!best || h.key > best.key)) best = h;\n return best ? { bot: best.bot, id: best.id } : null;\n}\nasync function chatUrlForPhone(phone: string): Promise {\n const best = await resolveWaContact(phone);\n if (!best) return \"\";\n return \"https://login.sendpulse.com/messengers/chats/\" + best.bot +\n \"/contacts/all/\" + best.id + \"/\";\n}\n// Mirrors the CRM assignment onto the SendPulse \"Чаты\" chat itself: sets the\n// chat's operator (so it shows under that manager's \"Мои\") and flags it\n// unread (PUT /contacts/mark-unread — the only way to surface a chat without a\n// fresh client message). Needed because a pure outbound send — the daily\n// rassylka_od broadcast included — never bumps last_activity_at or sets\n// inbox_unread on its own (confirmed live 2026-09-11: a contact's last\n// rassylka_od template sat 2h+ before last_activity_at moved, and only did so\n// when the client actually replied). Without this, escalations were only\n// findable by searching the phone number, even though nothing was \"lost\".\n// `waContact`: pass a value (including explicit null) when the caller already\n// resolved it — postRouteDeal shares ONE resolveWaContact() between this and\n// fillChatLink instead of each doing its own (was 2 extra sequential round\n// trips per escalation). Omit the argument to resolve it here as before.\nasync function syncChatOperator(\n phone: string,\n operatorId: number,\n waContact?: { bot: string; id: string } | null,\n): Promise {\n if (!operatorId) return { skipped: \"no_operator\" };\n const c = waContact !== undefined ? waContact : await resolveWaContact(phone);\n if (!c) return { skipped: \"no_chat_yet\" };\n const tok = await spToken();\n const [assign, unread] = await Promise.all([\n fetch(SP_API + \"/whatsapp/contacts/operators/assign\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", Authorization: \"Bearer \" + tok },\n body: JSON.stringify({ contact_id: c.id, operator_id: operatorId }),\n }).then((r) => r.json()).catch((e) => ({ error: String(e) })),\n fetch(SP_API + \"/whatsapp/contacts/mark-unread?contact_id=\" + c.id, {\n method: \"PUT\",\n headers: { Authorization: \"Bearer \" + tok },\n }).then((r) => r.json()).catch((e) => ({ error: String(e) })),\n ]);\n return { bot: c.bot, contact_id: c.id, operatorId, assign, unread };\n}\nasync function fillChatLink(\n dealId: number,\n pipelineId: number,\n contact?: any,\n phone?: string,\n waContact?: { bot: string; id: string } | null,\n): Promise {\n const attrId = CHAT_ATTR[pipelineId];\n if (!attrId) return { skipped: \"no_attr_for_pipeline\" };\n let url = contact ? chatUrlFromContact(contact) : \"\";\n if (!url && waContact !== undefined) {\n url = waContact\n ? \"https://login.sendpulse.com/messengers/chats/\" + waContact.bot +\n \"/contacts/all/\" + waContact.id + \"/\"\n : \"\";\n } else if (!url) {\n url = await chatUrlForPhone(\n phone || (contact?.phones?.[0]?.phone) || \"\",\n );\n }\n if (!url) return { skipped: \"no_chat_yet\" };\n try {\n await spCrm(\"POST\", \"/deals/\" + dealId + \"/attributes\", { attributeId: attrId, value: url });\n return { dealId, url };\n } catch (_e) {\n try {\n await spCrm(\"PUT\", \"/deals/\" + dealId + \"/attributes/\" + attrId, { value: url });\n return { dealId, url, via: \"put\" };\n } catch (e) {\n return { dealId, error: String(e) };\n }\n }\n}\n\n// Runs the full escalation side-effects for a route_deal result: assign the CRM\n// deal to a manager by language (skipped for \"attached\" — вторичка keeps its\n// existing owner, we just read it), fill the one-click \"Чат\" link, mirror the\n// manager onto the SendPulse chat itself (operator + unread — see\n// syncChatOperator), and drop the throwaway \"Входящие\" cards for this phone now\n// that a real deal exists. Shared by the normal MoonAI route_deal path\n// (handleAppsScript) and the media-message fast path (escalateMedia) below.\nasync function postRouteDeal(rb: any, rr: any): Promise {\n if (!rr || !rr.dealId) return;\n const phone = String(rb.phone || \"\");\n // Both of these are independent of assignDealByLang/fillChatLink/\n // syncChatOperator below — start them now instead of paying for them\n // serially at the end. Whoever is waiting on THIS function's caller\n // (MoonAI, synchronously, for the route_deal function-call response) pays\n // for every `await` in here; this whole function ballooned to ~25s once\n // Входящие/operator-sync were layered on top of it one at a time, long\n // enough to trip MoonAI's own function-call timeout (live 2026-09-13:\n // repeated \"route_deal вызвана с ошибкой\" — the deal was still being\n // created fine, MoonAI just gave up waiting for the response first).\n const waContactP = resolveWaContact(phone);\n const deleteInboxP = deleteInboxCards(phone).catch((e) => ({ error: String(e) }));\n\n let managerId = 0;\n if (rr.action !== \"attached\") {\n let lang = String(rb.lang || \"\");\n try {\n const pl = typeof rb.payload === \"string\" ? JSON.parse(rb.payload) : (rb.payload || {});\n lang = pl.lang || pl.language || lang;\n } catch (_p) { /* payload not JSON */ }\n const a = await assignDealByLang(Number(rr.dealId), lang, Number(rr.pipelineId))\n .catch((e) => ({ error: String(e) }));\n console.log(\"APPS assignByLang\", JSON.stringify(a));\n managerId = Number((a as any)?.rid) || 0;\n if (rr.pipelineId) {\n const cl = await fillChatLink(\n Number(rr.dealId),\n Number(rr.pipelineId),\n undefined,\n phone,\n await waContactP,\n ).catch((e) => ({ error: String(e) }));\n console.log(\"APPS fillChatLink\", JSON.stringify(cl));\n }\n } else {\n try {\n const g = await spCrm(\"GET\", \"/deals/\" + rr.dealId);\n managerId = Number(g?.data?.responsibleId) || 0;\n } catch (_e) { /* ignore */ }\n }\n if (managerId) {\n const so = await syncChatOperator(phone, managerId, await waContactP)\n .catch((e) => ({ error: String(e) }));\n console.log(\"APPS syncChatOperator\", JSON.stringify(so));\n }\n const dc = await deleteInboxP;\n console.log(\"APPS deleteInboxCards\", JSON.stringify(dc));\n}\n\n// Audio/voice/image/document/video/sticker inbound: handleInbound routes these\n// here INSTEAD OF forwarding to MoonAI — the bot stays completely silent (no\n// half-baked \"send me a text instead\" reply) and we escalate straight to a\n// manager immediately. Cargo-related media defaults to support_posylki with an\n// empty lang, which POOL_BY_PIPELINE routes to Молдир+Шолпан regardless of\n// language (see LANG_MANAGERS / POOL_BY_PIPELINE).\nconst MEDIA_LABELS: Record = {\n audio: \"аудиосообщение\",\n voice: \"аудиосообщение\",\n image: \"изображение\",\n video: \"видео\",\n document: \"файл\",\n sticker: \"стикер\",\n};\n// Fixed (not AI-generated) acknowledgement sent to the client after a media\n// escalation — the bot itself stays silent/doesn't process the file, but the\n// client still needs SOME confirmation their message arrived rather than\n// total silence until a human eventually replies. Wording matches MoonAI's own\n// standard escalation phrase (see prompt block \"часы колл-центра\" / same text\n// used in correction_send.py), so a client doesn't see two different styles\n// depending on whether they wrote text or sent a file. KZ+RU+CN together (in\n// that order, per user) since we have no text to detect the client's language\n// from on a media-first message.\nconst MEDIA_ACK_TEXT =\n \"Сұрағыңызды менеджерге жолдадым. Колл-орталық Алматы уақытымен 09:00-ден \" +\n \"17:30-ға дейін жұмыс істейді — менеджер сізбен жақын жұмыс уақытында \" +\n \"хабарласады.\\n\" +\n \"Передал(а) ваш вопрос менеджеру. Колл-центр работает с 09:00 до 17:30 \" +\n \"(Алматы) — с вами свяжутся в ближайшее рабочее время.\\n\" +\n \"已将您的问题转交给经理。呼叫中心工作时间为阿拉木图时间09:00至17:30——我们将在最近的工作时间与您联系。\";\nasync function escalateMedia(\n phone: string,\n mediaType: string,\n caption?: string,\n botId?: string,\n): Promise {\n const label = MEDIA_LABELS[mediaType] || \"вложение\";\n const note = \"Клиент прислал \" + label +\n \" — бот медиа не обрабатывает, нужна ручная проверка.\" +\n (caption ? \" Подпись: «\" + caption.slice(0, 200) + \"».\" : \"\");\n const digits = String(phone || \"\").replace(/[^\\d]/g, \"\");\n const rb: any = {\n action: \"route_deal\",\n route: \"support_posylki\",\n phone: digits,\n // Same \"never a WhatsApp profile name in the CRM\" rule as the normal\n // route_deal path (see the phone/contact_name block in handleAppsScript).\n contact_name: digits ? \"client_\" + digits : undefined,\n payload: JSON.stringify({\n business_line: \"posylki\",\n lang: \"\",\n intent: \"media_\" + mediaType,\n handoff_summary: note,\n first_message: note,\n }),\n };\n // See the matching comment in handleAppsScript: checkOpenDeal_ on the .gs side\n // doesn't know \"Входящие\" is a throwaway step, so an open Входящие card for\n // this phone would get mistaken for an already-open deal and silently eat the\n // escalation as a comment instead of creating a real one. Clear first.\n if (digits) {\n await deleteInboxCards(digits).catch((e) =>\n console.log(\"pre-route_deal inbox clear failed (media)\", String(e))\n );\n }\n const target = Deno.env.get(\"APPS_SCRIPT_URL\");\n const token = Deno.env.get(\"SHARED_SECRET\");\n if (!target || !token) return { error: \"proxy_misconfigured\" };\n const outUrl = new URL(target);\n outUrl.searchParams.set(\"token\", token);\n let rr: any = {};\n try {\n const resp = await fetch(outUrl.toString(), {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(rb),\n redirect: \"follow\",\n });\n rr = await resp.json().catch(() => ({}));\n } catch (e) {\n return { error: String(e) };\n }\n console.log(\"MEDIA route_deal\", JSON.stringify(rr));\n await postRouteDeal(rb, rr).catch((e) =>\n console.log(\"postRouteDeal (media) failed\", String(e))\n );\n // Fixed acknowledgement, not the bot \"talking\" — see MEDIA_ACK_TEXT above.\n if (digits) {\n try {\n const tok = await spToken();\n const ackResp = await fetch(SP_API + \"/whatsapp/contacts/sendByPhone\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", Authorization: \"Bearer \" + tok },\n body: JSON.stringify({\n bot_id: botId || Deno.env.get(\"SP_BOT_ID\"),\n phone: digits,\n message: { type: \"text\", text: { body: MEDIA_ACK_TEXT } },\n }),\n });\n console.log(\"MEDIA ack\", digits, \"->\", ackResp.status);\n } catch (e) {\n console.log(\"MEDIA ack failed\", String(e));\n }\n }\n return rr;\n}\n\n// -- find_cargo post-processing --------------------------------------------------\n// Status wording taken VERBATIM from the ALA TMS call-center UI\n// (alatms.com .../landing-bills/client-cargo-in-transit, \"Статус\" filter, 15 states).\n// Confirmed API-code <-> TMS-label pairs: LOADED=Загружен, DISPATCHED=Отправлен,\n// TRANSIT_DISPATCHED=Затаможка началась, TERMINAL_ISSUED=Выдан,\n// LOADED_TRANSIT=Загружен в транзит, TERMINAL_ZONED=В зоне терминала,\n// TRANSIT_RECEIVED=Получен на транзите, TRANSIT_ZONED=В зоне на транзите,\n// TERMINAL_RECEIVED=Получен на терминале. The rest are inferred from order and\n// fall back safely; ALA to confirm the exact codes for the 4 middle states.\nconst CARGO_STATUS_RU: Record = {\n CREATED: \"Создан\",\n RECEIVED: \"Получен\",\n LOADED: \"Загружен\",\n DISPATCHED: \"Отправлен\",\n TRANSIT_RECEIVED: \"Получен на транзите\",\n TRANSIT_ZONED: \"В зоне на транзите\",\n LOADED_TRANSIT: \"Загружен в транзит\",\n TRANSIT_DISPATCHED: \"Затаможка началась\",\n TRANSIT_CUSTOMS_CLEARED: \"Затаможка завершена\",\n TRANSIT_CUSTOMS_EXPORT_COMPLETED: \"Затаможка завершена\",\n CUSTOMS_CLEARED: \"Затаможка завершена\",\n IN_TRANSIT: \"В процессе транзита\",\n CUSTOMS_STARTED: \"Растаможка началась\",\n TERMINAL_CUSTOMS_STARTED: \"Растаможка началась\",\n CUSTOMS: \"Растаможка началась\",\n TO_WAREHOUSE: \"В пути на склад\",\n TERMINAL_DISPATCHED: \"В пути на склад\",\n ARRIVED: \"В пути на склад\",\n TERMINAL_RECEIVED: \"Получен на терминале\",\n TERMINAL_ZONED: \"В зоне терминала\",\n TERMINAL_ISSUED: \"Выдан\",\n RETURNED: \"Возврат\",\n CANCELLED: \"Отменён\",\n};\nfunction cargoStatusRu(code: string): string {\n if (!code) return \"статус уточняется\";\n return CARGO_STATUS_RU[code] || \"в обработке\";\n}\n\n// -- anti-mangle cache --------------------------------------------------------\n// GPT-5.4 in MoonAI rewrites find_cargo results (turns \"Выдан\" into \"в пути\",\n// swaps warehouses, invents statuses). We cache the exact `answer` per track for\n// a few minutes; /outbound then replaces the agent's cargo message with it.\nconst cargoAnswerCache = new Map();\nconst CARGO_CACHE_TTL = 6 * 60 * 1000;\nfunction normTrack(s: string): string {\n return String(s || \"\").toUpperCase().replace(/[^A-Z0-9]/g, \"\");\n}\nfunction cacheCargoAnswer(track: string, answer: string) {\n const k = normTrack(track);\n if (k.length < 4 || !answer) return;\n cargoAnswerCache.set(k, { answer, ts: Date.now() });\n if (cargoAnswerCache.size > 500) {\n const cut = Date.now() - CARGO_CACHE_TTL;\n for (const [key, v] of cargoAnswerCache) if (v.ts < cut) cargoAnswerCache.delete(key);\n }\n}\n// If the agent's outgoing text is a cargo-status reply, return the authoritative\n// cached answer for the track it mentions; else null (send agent text as-is).\n// Guards: only for status-shaped messages, and only within 100s of the lookup\n// (so a later \"передал менеджеру\" reply is never overwritten).\nconst CARGO_OVERRIDE_WINDOW = 100 * 1000;\nconst RE_STATUS =\n /(склад|статус|в пути|выдан|транзит|таможн|терминал|получен|отправлен|загружен|в зоне|не нашл|не найд|қойма|жолда|келді|тапсыр|кеден|仓库|清关|已发货|运输|已到)/i;\nconst RE_HANDOFF =\n /(передал|менеджер|уточните|напишите трек|проверьте номер|менеджерге|нақтылап|толық трек|经理|请提供)/i;\nfunction authoritativeCargoText(agentText: string): string | null {\n const t = String(agentText || \"\").trim();\n // The agent fabricates cargo statuses in EVERY language (its \"translations\" of\n // real data are unreliable too), so we override in any language — a correct RU\n // status line beats a hallucinated KZ/CN one.\n const looksLikeStatus =\n /груз[^.]{0,40}:/i.test(t) ||\n /[a-z0-9][a-z0-9-]{3,}\\s*(жүг|жүк)/i.test(t) ||\n /货物?\\s*[a-z0-9-]{3,}/i.test(t) ||\n RE_STATUS.test(t);\n if (!looksLikeStatus) return null;\n if (RE_HANDOFF.test(t)) return null;\n const tn = normTrack(t);\n const now = Date.now();\n for (const [k, v] of cargoAnswerCache) {\n if (now - v.ts > CARGO_CACHE_TTL) { cargoAnswerCache.delete(k); continue; }\n if (now - v.ts > CARGO_OVERRIDE_WINDOW) continue;\n if (tn.includes(k)) return v.answer === t ? null : v.answer;\n }\n return null;\n}\n\n// TERMINAL_* means the bag reached ALA's Almaty terminal. The bag's `warehouse`\n// field still holds the China consolidation point (e.g. \"YIwu\") and only misleads\n// the client (\"склад YIwu\" reads as \"still in China\"), so for these statuses we\n// say Almaty instead of the warehouse.\nconst TERMINAL_STAGE = new Set([\"TERMINAL_RECEIVED\", \"TERMINAL_ZONED\", \"TERMINAL_ISSUED\"]);\nfunction bagLoc(b: any, multi: boolean): string {\n const st = String(b.status || \"\");\n if (st === \"TERMINAL_ISSUED\") return \"\";\n if (TERMINAL_STAGE.has(st)) {\n return multi ? \" (в Алматы, ожидает выдачи)\" : \" Груз в Алматы, ожидает выдачи.\";\n }\n if (!b.warehouse) return \"\";\n return multi ? \", склад \" + b.warehouse : \" Склад: \" + b.warehouse + \".\";\n}\n\n// Rewrites a find_cargo response before it reaches MoonAI:\n// - fills status_ru from the complete map\n// - builds one ready-to-send `answer` string (single or multi-bag)\n// - on an empty result, sets a clear \"not found\" answer (never a fake status)\nfunction fixCargo(o: any, reqTrack?: string): any {\n if (!o || (o.source !== \"by-track\" && o.source !== \"by-recipient\")) return o;\n const bags = Array.isArray(o.bags) ? o.bags : [];\n for (const b of bags) b.status_ru = cargoStatusRu(String(b.status || \"\"));\n if (o.ok === false) return o;\n if (!bags.length || o.found === false) {\n o.answer =\n \"По этому трек-коду ничего не нашлось. Проверьте номер, пожалуйста — или я передам вопрос менеджеру.\";\n o.text = o.answer;\n if (reqTrack) cacheCargoAnswer(reqTrack, o.answer);\n return o;\n }\n if (bags.length === 1) {\n const b = bags[0];\n o.answer = \"Груз \" + b.track + \": \" + b.status_ru + \".\" + bagLoc(b, false);\n } else {\n const parts = bags.map((b: any, i: number) =>\n \"мешок \" + (i + 1) + \" — \" + b.status_ru + bagLoc(b, true)\n );\n o.answer = \"Груз \" + (bags[0].track || \"\") + \" (\" + bags.length + \" мест): \" +\n parts.join(\"; \") + \".\";\n }\n o.text = o.answer;\n for (const b of bags) if (b.track) cacheCargoAnswer(b.track, o.answer);\n if (reqTrack) cacheCargoAnswer(reqTrack, o.answer);\n return o;\n}\n\n// -- / : existing MoonAI -> Apps Script proxy -----------------------------------\nasync function handleAppsScript(\n req: Request,\n inUrl: URL,\n body: string | undefined,\n): Promise {\n const TARGET = Deno.env.get(\"APPS_SCRIPT_URL\");\n const TOKEN = Deno.env.get(\"SHARED_SECRET\");\n if (!TARGET || !TOKEN) {\n return j(\n { ok: false, error: \"proxy_misconfigured\", hint: \"set APPS_SCRIPT_URL and SHARED_SECRET\" },\n 500,\n );\n }\n\n const outUrl = new URL(TARGET);\n outUrl.searchParams.set(\"token\", TOKEN);\n for (const [k, v] of inUrl.searchParams) {\n if (k !== \"token\") outUrl.searchParams.set(k, v);\n }\n\n const method = req.method === \"GET\" ? \"GET\" : \"POST\";\n let out = method === \"GET\" ? undefined : body ?? \"\";\n try {\n const _p = JSON.parse(out || \"{}\");\n if (_p && _p.inputs && typeof _p.inputs === \"object\") out = JSON.stringify(_p.inputs);\n } catch (_e) {\n /* not JSON - forward as-is */\n }\n // route_deal: MoonAI cannot pass the client's phone, so it arrives empty. Recover\n // it from the message we relayed a moment earlier (see phoneForMessage).\n // Also force the CRM *contact* name to \"client_\" — never let a WhatsApp\n // profile name reach the CRM. The .gs reads `contact_name` for the contact\n // (deal name stays its own descriptive value), falling back to \"WhatsApp \"\n // only when `contact_name` is absent, so we always send our own.\n try {\n const rp = JSON.parse(out || \"{}\");\n if (rp && (rp.route || rp.action === \"route_deal\")) {\n let phone = String(rp.phone || \"\").replace(/[^\\d]/g, \"\");\n let firstMsg = \"\";\n try {\n const pl = typeof rp.payload === \"string\" ? JSON.parse(rp.payload) : (rp.payload || {});\n firstMsg = pl.first_message || \"\";\n if (!phone) phone = String(pl.phone || \"\").replace(/[^\\d]/g, \"\");\n } catch (_p) { /* payload not JSON */ }\n if (phone.length < 10) {\n const recovered = await phoneForMessage(firstMsg);\n if (recovered) phone = recovered;\n }\n const wantName = phone.length >= 10 ? \"client_\" + phone : \"\";\n const changed =\n (phone.length >= 10 && phone !== String(rp.phone || \"\")) ||\n (wantName && rp.contact_name !== wantName);\n if (phone.length >= 10) rp.phone = phone;\n if (wantName) rp.contact_name = wantName;\n if (changed) {\n out = JSON.stringify(rp);\n console.log(\"APPS route_deal phone/name set\", phone, wantName);\n }\n // CRITICAL: the .gs's checkOpenDeal_ only filters by status===1, it has no\n // idea \"Входящие\" is a throwaway tracking step — so if this phone still has\n // an open \"Входящие\" card in the target pipeline, route_deal mistakes THAT\n // for an already-open deal and silently attaches a comment to it instead of\n // creating a real \"Новое обращение\" escalation (found live 2026-09-11: a\n // media escalation attached to its own Входящие card, no real deal, wrong\n // responsible, nothing assigned by language). Clear them first so\n // checkOpenDeal_ sees a clean slate.\n if (phone.length >= 10) {\n await deleteInboxCards(phone).catch((e) =>\n console.log(\"pre-route_deal inbox clear failed\", String(e))\n );\n }\n }\n } catch (_e) { /* ignore */ }\n\n // find_cargo also arrives with phone:\"\" (no system param). Recover it so an\n // empty by-track result can be retried by the client's recipient number.\n let fcPhone = \"\";\n try {\n const rb = JSON.parse(out || \"{}\");\n if (rb && rb.action === \"find_cargo\") {\n fcPhone = String(rb.phone || \"\").replace(/[^\\d]/g, \"\");\n if (fcPhone.length < 10) {\n const rec = await phoneForMessage(\"\");\n if (rec && rec.length >= 10) {\n fcPhone = rec;\n rb.phone = fcPhone;\n out = JSON.stringify(rb);\n }\n }\n }\n } catch (_e) { /* ignore */ }\n\n console.log(\"APPS\", JSON.stringify({ m: method, b: out }));\n\n let resp: Response;\n try {\n resp = await fetch(outUrl.toString(), {\n method,\n headers: { \"Content-Type\": \"application/json\" },\n body: out,\n redirect: \"follow\",\n });\n } catch (e) {\n return j({ ok: false, error: \"proxy_fetch_failed\", detail: String(e) }, 502);\n }\n let reqTrack = \"\";\n try {\n const rb = JSON.parse(out || \"{}\");\n reqTrack = rb.track || (rb.slots && rb.slots.track_code) || \"\";\n } catch (_e) { /* ignore */ }\n\n let text = await resp.text();\n try {\n const parsed = JSON.parse(text);\n if (parsed && (parsed.source === \"by-track\" || parsed.source === \"by-recipient\")) {\n text = JSON.stringify(fixCargo(parsed, reqTrack));\n }\n } catch (_e) {\n /* non-JSON - pass through */\n }\n\n // Track lookup came back empty but we know the client's phone -> show the bags\n // registered on that number instead of letting the agent invent a status.\n try {\n const p0 = JSON.parse(text || \"{}\");\n if (p0 && p0.source === \"by-track\" && p0.found === false && fcPhone.length >= 10) {\n const r2 = await fetch(outUrl.toString(), {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ action: \"find_cargo\", phone: fcPhone }),\n redirect: \"follow\",\n });\n const p2 = JSON.parse(await r2.text());\n if (p2 && p2.source === \"by-recipient\" && Array.isArray(p2.bags) && p2.bags.length) {\n const fixed = fixCargo(p2, \"\");\n fixed.answer = \"По трек-коду «\" + (reqTrack || \"—\") +\n \"» ничего не нашёл. По вашему номеру телефона: \" + fixed.answer;\n fixed.text = fixed.answer;\n if (reqTrack) cacheCargoAnswer(reqTrack, fixed.answer);\n text = JSON.stringify(fixed);\n console.log(\"APPS find_cargo by-recipient fallback\", fcPhone, \"for track\", reqTrack);\n }\n }\n } catch (_e) { /* ignore */ }\n\n // route_deal just created (or re-touched) an escalation -> run the shared\n // side-effects (assign by language / chat link / operator+unread / drop\n // \"Входящие\" cards). See postRouteDeal.\n try {\n const rb = JSON.parse(out || \"{}\");\n if (rb && (rb.route || rb.action === \"route_deal\")) {\n const rr = JSON.parse(text || \"{}\");\n await postRouteDeal(rb, rr);\n }\n } catch (_e) { /* ignore */ }\n\n console.log(\"APPS RESP\", text.slice(0, 800));\n return new Response(text, {\n status: resp.status,\n headers: {\n \"Content-Type\": resp.headers.get(\"Content-Type\") ?? \"application/json; charset=utf-8\",\n \"Access-Control-Allow-Origin\": \"*\",\n },\n });\n}\n\nexport default async function (req: Request): Promise {\n if (req.method === \"OPTIONS\") {\n return new Response(null, {\n headers: {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"POST, GET, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, X-API-Key\",\n },\n });\n }\n\n const inUrl = new URL(req.url);\n const path = inUrl.pathname.replace(/\\/+$/, \"\").toLowerCase();\n const body =\n req.method === \"GET\" || req.method === \"HEAD\" ? undefined : await req.text();\n\n try {\n if (path === \"/inbound\") return await handleInbound(body ?? \"\");\n if (path === \"/outbound\") return await handleOutbound(body ?? \"\");\n if (path === \"/privacy\") {\n // Public, unauthenticated static page — required by the Chrome Web\n // Store listing for the personal \"SendPulse Helper\" extension (privacy policy URL).\n return new Response(PRIVACY_HTML, {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n }\n if (path === \"/sync-responsible\") {\n const tok = inUrl.searchParams.get(\"token\") || req.headers.get(\"x-sync-token\") || \"\";\n if (tok !== Deno.env.get(\"SHARED_SECRET\")) return j({ ok: false, error: \"forbidden\" }, 403);\n const sync = await syncResponsible();\n // Piggy-backs on this same 15-min cron ping (val timporello/syncRespCron) —\n // cleanupInboxCards self-throttles to once/day at 17:30 Almaty, so this is a\n // no-op on 95+ of every 96 ticks.\n const inboxCleanup = await cleanupInboxCards().catch((e) => ({ error: String(e) }));\n return j({ ...sync, inboxCleanup });\n }\n if (path === \"/find-chat\") {\n // Called from the SendPulse Helper extension's search box (content.js) so\n // managers can find a client's WhatsApp chat by phone number — SendPulse's\n // own \"Чаты\" search only matches the display name, which for a real\n // WhatsApp profile name (not one of our \"client_\" cold contacts)\n // never contains the number at all, so it's unsearchable there.\n const tok = inUrl.searchParams.get(\"token\") || \"\";\n if (tok !== Deno.env.get(\"SHARED_SECRET\")) return j({ ok: false, error: \"forbidden\" }, 403);\n const phone = inUrl.searchParams.get(\"phone\") || \"\";\n const url = await chatUrlForPhone(phone).catch(() => \"\");\n if (!url) return j({ ok: false, error: \"not_found\" }, 404);\n return j({ ok: true, url });\n }\n if (path === \"/reset\") {\n const tok = inUrl.searchParams.get(\"token\") || req.headers.get(\"x-sync-token\") || \"\";\n if (tok !== Deno.env.get(\"SHARED_SECRET\")) return j({ ok: false, error: \"forbidden\" }, 403);\n const phones = (inUrl.searchParams.get(\"phones\") || \"\")\n .split(/[,\\s]+/).map((p) => p.replace(/[^\\d]/g, \"\")).filter((p) => p.length >= 10);\n const done: string[] = [];\n try {\n await ensureSaltTable();\n await ensureMsgTable();\n await ensureMgrTable();\n for (const p of phones) {\n const salt = Date.now().toString(36) + Math.random().toString(36).slice(2, 6);\n await sqlite.execute({\n sql: \"INSERT INTO thread_salt (phone, salt, ts) VALUES (:p, :s, :t) \" +\n \"ON CONFLICT(phone) DO UPDATE SET salt = :s, ts = :t\",\n args: { p, s: salt, t: Date.now() },\n });\n await sqlite.execute({ sql: \"DELETE FROM mgr_active WHERE thread = :p\", args: { p } });\n await sqlite.execute({ sql: \"DELETE FROM msg_phone WHERE phone = :p\", args: { p } });\n done.push(p + \"→\" + salt);\n }\n } catch (e) {\n return j({ ok: false, error: String(e), done });\n }\n console.log(\"RESET\", done.join(\" \"));\n return j({ ok: true, reset: done });\n }\n return await handleAppsScript(req, inUrl, body);\n } catch (e) {\n console.log(\"ERR\", path, String(e));\n return j({ ok: false, error: \"handler_threw\", path, detail: String(e) }, 500);\n }\n}","createdAt",["D",1789289901914],"branchVersion","branchId","5261a48a-4e48-4d3e-a959-2c0cd46109c4","id","a2846e9c-cffb-4106-82df-12868a39062c","GoogleApps",["D",1788752076387],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","ce838876-d9c7-481d-b172-ac9fe672bd77","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a079ed-a798-7549-8fa9-b8d52f316ced","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_96":95,"_104":100},"org",{"_96":95,"_97":98,"_99":100,"_18":55,"_101":102,"_103":25},"branch",{"_13":85,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"isOwned",48,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","timporello","handle","displayName","Temirlan Kassymkul","avatar","https://lh3.googleusercontent.com/a/ACg8ocK3F3VjTFMvULcxz4CS7J7Hecrru3ZQ_PmzQOvDbreGsF0rIvQkSg=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":152,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":153,"_80":154,"_82":155,"_84":25},"tree",[147],"files",[147],"counts",{"_135":62,"_136":137,"_138":62,"_139":140,"_141":142},"contents",[126],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":25,"_38":130,"_13":131,"_33":34,"_35":37,"_24":25,"_132":133,"_27":134},"40d7e9e8-850b-4481-8f79-e0435c225e1b","parentId","latest",["D",1789289901914],41,"label","alatmsmoonai",[28],"pulls","branches",1,"forks","envVars",{"_143":145,"_146":62},"connections",{"_143":62,"_144":62},"count","unfilledCount",8,"emptyCount",{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":25,"_38":148,"_13":131,"_33":34,"_35":37,"_24":25,"_132":133,"_149":150,"_27":151},["D",1789289901914],"children",[],[28],["D",1788752076387],{"_96":95,"_104":100},{"_96":95,"_97":98,"_99":100,"_18":55,"_101":102,"_103":25},{"_13":85,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"ctx",{"_78":-5,"_123":189,"_190":191,"_192":193,"_194":25,"_195":25,"_196":25,"_197":58,"_198":-5,"_199":-7,"_200":-7,"_201":62,"_202":25,"_203":25,"_204":-5,"_205":25,"_206":25,"_207":25,"_208":-5},"ENV",{"_160":161,"_162":163,"_164":86,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v42