Inbox sweep

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_311":312,"_313":314},"routes/_app.x.$handle.$name",{"_100":99,"_32":45,"_108":90,"_27":109,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_20":-5,"_120":-5,"_121":-5,"_122":25,"_123":124,"_125":59,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":25},"version",281,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","create-account.ts","latestPath","fileId","3fa3cf86-a614-11f1-a3fe-1607ee4eb77e","name","fileType","script","content","// Create a Salesforce Account from a chat conversation.\n//\n// WHAT MAKES THIS SAFE\n// The bot may only create ONE shape of account: card-on-file, terms of zero.\n// Of ~1,586 accounts created in the 120 days to 9/1/2026, ~1,376 were exactly\n// that, so this covers the overwhelming majority of real signups — while making\n// it structurally impossible for a chat bot to extend credit to a stranger.\n// Net-30 and Net-60 accounts stay a human decision, because those are the ones\n// where being wrong costs money rather than a refund.\n//\n// WHY THE REGION IS RESOLVED IN CODE AND NOT BY THE MODEL\n// Delivery_Region__c is a RESTRICTED picklist and it drives which truck the\n// account lands on. A wrong value is not a cosmetic error — it is a stop on the\n// wrong route. So the model never picks it: it supplies a ZIP, and this file\n// maps it. Where the mapping is genuinely ambiguous the account is NOT created\n// and a human is asked, which is the same refuse-rather-than-guess rule the\n// rest of this project runs on.\n\nimport { getAccessToken } from \"./salesforce.ts\";\nimport { ZIP_REGION } from \"./zip-regions.ts\";\n\nconst API = \"v59.0\";\n\n/** The one shape of account a bot is allowed to create. */\nconst CARD_ON_FILE = {\n Terms__c: \"0\",\n Payment_Method_Type__c: \"Debit/Credit Card\",\n Invoice_Set_Up__c: \"Credit Card Invoice\",\n};\n\n/** Frequencies the Salesforce picklist actually accepts. */\nexport const FREQUENCIES = [\n \"Weekly\", \"Bi-Weekly\", \"15 Days\", \"30 Days\", \"60 Days\", \"4 Weeks\", \"Call in\",\n];\n\n/**\n * WHAT AN UNRESOLVED ZIP DEFAULTS TO, when regionForZip() cannot place it.\n *\n * Used to be \"Unassigned - Needs Review\", a value added to the picklist on\n * 9/4/2026 specifically to mean \"a person needs to assign this,\" on purpose\n * not a real geography. That broke a real signup on 9/10/2026: Marquisa\n * Swanson (West Orange, NJ 07052, an unmapped ZIP) got this value written to\n * Delivery_Region__c, and the org's own \"New Delivery Date V2\" flow — a\n * SEPARATE restricted-picklist check on the same field, downstream of the\n * Account insert — rejected it outright (INVALID_OR_NULL_FOR_RESTRICTED_\n * PICKLIST), failing the entire insert. No account was created at all; the\n * bot told the customer \"the system's not letting that go through.\"\n *\n * Changed 9/11/2026 per the office: default to Essex instead. It is a real,\n * active Delivery_Region__c value, so it satisfies every downstream flow's\n * validation the way \"Unassigned - Needs Review\" did not — this is the\n * office's own chosen catch-all for \"the address didn't resolve,\" not a\n * geographic claim that every unmapped customer is actually in Essex County.\n * The pricebook automation DOES recognize Essex and will price the account\n * accordingly, unlike the old placeholder; a human still needs to confirm the\n * real route, which is why regionGuessed and the Description stamp below\n * still fire exactly as before.\n */\nconst DEFAULT_REGION = \"Essex\";\n\n/**\n * Common phrasings mapped to the one canonical picklist value each should\n * become. \"Bi-Weekly\" and \"15 Days\" mean the same real-world schedule in this\n * org, and 15 Days is the one already used in practice, so every biweekly-ish\n * phrasing collapses to it — INCLUDING the literal string \"Bi-Weekly\", which\n * is why this is checked before the exact-match branch below rather than\n * after it.\n */\nconst FREQUENCY_SYNONYMS: Record = {\n \"weekly\": \"Weekly\",\n \"bi-weekly\": \"15 Days\",\n \"biweekly\": \"15 Days\",\n \"bi weekly\": \"15 Days\",\n \"every two weeks\": \"15 Days\",\n \"every 2 weeks\": \"15 Days\",\n \"twice a month\": \"15 Days\",\n \"twice monthly\": \"15 Days\",\n \"every 15 days\": \"15 Days\",\n \"15 days\": \"15 Days\",\n \"monthly\": \"30 Days\",\n \"once a month\": \"30 Days\",\n \"every month\": \"30 Days\",\n \"30 days\": \"30 Days\",\n \"every two months\": \"60 Days\",\n \"every 2 months\": \"60 Days\",\n \"bimonthly\": \"60 Days\",\n \"bi-monthly\": \"60 Days\",\n \"60 days\": \"60 Days\",\n \"every 4 weeks\": \"4 Weeks\",\n \"4 weeks\": \"4 Weeks\",\n \"call in\": \"Call in\",\n \"tbd\": \"Call in\",\n \"unknown\": \"Call in\",\n};\n\n/**\n * Canonicalize a frequency string to a value the picklist accepts.\n *\n * Never blocks. An unrecognized value defaults to \"30 Days\" (monthly) rather\n * than refusing the signup — per the same reasoning as UNASSIGNED_REGION,\n * getting the account and invoice created is worth more than a perfectly\n * accurate first-guess schedule, which a human corrects afterward same as the\n * route.\n */\nexport function canonicalFrequency(v: unknown): { value: string; guessed: boolean } {\n const raw = String(v ?? \"\").trim();\n const key = raw.toLowerCase();\n if (FREQUENCY_SYNONYMS[key]) return { value: FREQUENCY_SYNONYMS[key], guessed: false };\n const exact = FREQUENCIES.find((f) => f.toLowerCase() === key);\n if (exact) return { value: exact, guessed: false };\n return { value: \"30 Days\", guessed: true };\n}\n\n/**\n * ZIP to Delivery_Region__c.\n *\n * Florida follows the rule confirmed by the office on 9/1/2026 — \"Orlando and\n * west is Florida, the rest is New Miami\" — which matches how the route builder\n * already groups them: the `florida` region is Tampa Bay plus Orlando, and\n * `New Miami` is the southeast metro.\n *\n * Returns null when the answer is genuinely uncertain rather than guessing.\n */\nexport function regionForZip(zip: string, state: string): string | null {\n const zip5 = String(zip ?? \"\").trim().slice(0, 5);\n const z = Number(zip5);\n const st = String(state ?? \"\").trim().toUpperCase();\n\n // MEASURED DATA FIRST. zip-regions.ts records where the office actually files\n // accounts, which beats every rule below because those encode what a ZIP map\n // implies rather than what the routes really do. This is what makes Hoboken,\n // Manhattan and Long Island answerable at all.\n if (ZIP_REGION[zip5]) return ZIP_REGION[zip5];\n\n if (st === \"CT\") return \"Connecticut\";\n if (st === \"DC\") return \"New DC\";\n if (st === \"MD\") return \"New Maryland\";\n if (st === \"VA\") return \"New Virginia\";\n if (st === \"CA\") return \"Los Angeles\";\n if (st === \"PA\") return \"Greater Philadelphia Area\";\n\n if (st === \"FL\") {\n if (!z) return null;\n // MELBOURNE IS NOT SERVED — confirmed by the office 9/1/2026. Returning\n // null sends it down the region_unknown path, so the bot hands the address\n // to a person instead of creating an account on a route that does not run.\n // The Delivery_Region__c picklist still HAS \"Greater Melbourne FL\", which is\n // exactly why this has to be refused here: the insert would have succeeded.\n if (z >= 32901 && z <= 32999) return null;\n // Miami-Dade, Broward and Palm Beach. Everything else in the state — Tampa\n // Bay, Sarasota, Naples, Orlando, the north — is the \"Florida\" route.\n if (z >= 33000 && z <= 33499) return \"New Miami\";\n return \"Florida\";\n }\n\n if (st === \"NY\") {\n if (!z) return null;\n if (z >= 11200 && z <= 11299) return \"Brooklyn\";\n if (z >= 10300 && z <= 10399) return \"Richmond\"; // Staten Island\n if (z >= 10400 && z <= 10499) return \"Bronx\";\n if ((z >= 11100 && z <= 11199) || (z >= 11300 && z <= 11499)\n || (z >= 11600 && z <= 11699)) return \"Queens\";\n if (z >= 11000 && z <= 11099) return \"Nassau\";\n if (z >= 11500 && z <= 11599) return \"Nassau\";\n if (z >= 11900 && z <= 11999) return \"Suffolk\"; // East End\n if (z >= 10500 && z <= 10599) return \"West Chester\";\n if (z >= 10900 && z <= 10999) return \"Rockland\";\n // 11700-11899 is deliberately absent. Nassau and Suffolk interleave through\n // that band — Levittown 11756 is Nassau while its neighbours are Suffolk —\n // and a first draft of this function put Levittown on the wrong truck.\n //\n // Manhattan is absent for the same reason: Lower/Midtown/Upper do not split\n // on ZIP cleanly. Ask a person.\n return null;\n }\n\n // NEW JERSEY IS ABSENT ON PURPOSE, AND IT IS NOT AN OVERSIGHT.\n //\n // Its six regions are not geography. Checked against the org's own accounts\n // on 9/1/2026: of 270 NJ ZIPs holding four or more accounts, 103 have\n // accounts filed under MORE THAN ONE region. ZIP 07004 alone spans Essex,\n // North and West. Delivery_Region__c in New Jersey is a route assignment a\n // person makes from truck loading and history, so there is no ZIP rule to\n // write — any mapping would be a coin flip dressed up as logic.\n return null;\n}\n\n// PRICING IS THE ORG'S JOB. There was a hand-built rate table here, derived\n// from the live cart. It is gone, because the org already does this better:\n// on insert it assigns a pricebook by region and fills Price_Per_Bottle__c and\n// Price_Per_Delivery__c itself. Measured 9/1/2026 — Hudson came back 10.99/5.00\n// and Greater Philadelphia 13.99/8.00, on an account where nothing was written.\n//\n// WHAT THE ORG DOES ON ITS OWN when this file inserts an Account:\n// Create Custom Invoice for online orders → invoice header (fires on any\n// Account created with a\n// Description — our audit stamp\n// qualifies)\n// New Online Order → Opportunity, \"2 Bottles\",\n// StageName \"Delivery Due\"\n// pricebook automation → Price_Per_Bottle / _Delivery\n//\n// The one link still missing is a Recurring_Delivery_Product__c, which is what\n// produces Delivery_Line_Item__c records, which is what\n// \"Create RDP/DLI Invoice Lines\" turns into invoice lines.\n\n/**\n * Product2 ids for the 5-gallon PLASTIC bottles, by water type.\n *\n * Matched by ID, never by name. The catalogue's capitalisation is inconsistent\n * — \"Tribeca – SPRING – 5 Gallon Water Bottles\" on the 5-gallon but \"Spring\" on\n * the 3-gallon — and it uses an en dash, so string matching is a trap.\n *\n * GLASS IS ABSENT deliberately. It is a different SKU at a different price and\n * the chat tool does not capture bottle type, so a glass order must not be\n * silently set up as plastic.\n */\nconst PRODUCT_5GAL_PLASTIC: Record = {\n alkaline: \"01tPm00000CIwGLIA1\",\n spring: \"01tPm00000CIwBVIA1\",\n distilled: \"01tPm00000CJ493IAD\",\n};\n\n/**\n * Canonical spelling of the water type.\n *\n * The org's pricing flow decides the Spring/Distilled surcharge with a text\n * CONTAINS test, so \"spring\" from a chat transcript has to become \"Spring\"\n * before it is written or the customer is silently underbilled. Alkaline is the\n * default because it is what the store sells by default and what the bot quotes\n * when nobody says otherwise.\n */\nconst WATER_TYPES: Record = {\n alkaline: \"Alkaline\",\n spring: \"Spring\",\n distilled: \"Distilled\",\n};\n\nexport function canonicalWaterType(v: unknown): string {\n return WATER_TYPES[String(v ?? \"\").trim().toLowerCase()] ?? \"Alkaline\";\n}\n\n/**\n * Create the customer's standing order.\n *\n * THIS IS THE LAST LINK IN A CHAIN THE ORG OTHERWISE RUNS ITSELF. Inserting the\n * Account already fires the invoice header, the Delivery, and the pricebook.\n * What was missing is this: no Recurring Delivery Product means no Delivery\n * Line Items, which means \"Create RDP/DLI Invoice Lines\" has nothing to turn\n * into invoice lines and the customer's invoice stays empty.\n *\n * The price is READ BACK off the Account rather than calculated here. The org's\n * pricebook automation has already set Price_Per_Bottle__c by region, and it is\n * the authority — an earlier version of this file carried its own rate table\n * and the pricebook simply overwrote it.\n *\n * Best-effort: a failure here leaves the account standing and the office adds\n * the standing order by hand, which is a normal day. Losing a completed signup\n * because of it would not be.\n */\nasync function addStandingOrder(\n accountId: string,\n bottles: number,\n waterType: string | undefined,\n instanceUrl: string,\n token: string,\n): Promise {\n const productId = PRODUCT_5GAL_PLASTIC[canonicalWaterType(waterType).toLowerCase()];\n if (!productId) {\n console.log(`addStandingOrder: no product for waterType=${waterType}`);\n return null;\n }\n\n // Product_Name__c IS NOT OPTIONAL, and leaving it null is worse than it looks.\n //\n // \"Checkbox to Add RDP to Blank Delivery\" copies it into both Name and\n // Product_Name__c on the Delivery Line Item, where it is REQUIRED. An RDP\n // without it does not merely fail to bill — it makes the delivery permanently\n // unpullable, because the office's own Pull RDPs checkbox then throws\n // REQUIRED_FIELD_MISSING for that account. So we read the name off Product2\n // rather than hardcoding it (the catalogue's capitalisation and en dashes are\n // a trap), and if we cannot read it we create NO RDP at all. A missing\n // standing order is a phone call; a poisoned one breaks the office's button.\n const prod = await fetch(\n `${instanceUrl}/services/data/${API}/sobjects/Product2/${productId}?fields=Name`,\n { headers: { Authorization: `Bearer ${token}` } },\n );\n const productName = prod.ok ? (await prod.json())?.Name ?? null : null;\n if (!productName) {\n console.error(\"addStandingOrder: cannot read Product2.Name — refusing to create a nameless RDP\");\n return null;\n }\n\n // Read the price the org just assigned. Not calculated, not guessed.\n const acc = await fetch(\n `${instanceUrl}/services/data/${API}/sobjects/Account/${accountId}`\n + \"?fields=Price_Per_Bottle__c\",\n { headers: { Authorization: `Bearer ${token}` } },\n );\n const pricePerBottle = acc.ok ? (await acc.json())?.Price_Per_Bottle__c ?? null : null;\n if (pricePerBottle == null) {\n console.log(\"addStandingOrder: pricebook has not set Price_Per_Bottle__c yet\");\n }\n\n const res = await fetch(\n `${instanceUrl}/services/data/${API}/sobjects/Recurring_Delivery_Product__c`,\n {\n method: \"POST\",\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n Account_Relationship__c: accountId,\n Product__c: productId,\n Product_Name__c: productName,\n Quantity__c: bottles,\n Unit_Size__c: 1,\n Product_Family__c: \"Bottled Water\",\n RDP_Is_Active__c: true,\n ...(pricePerBottle != null ? { Price_Per_Item__c: pricePerBottle } : {}),\n }),\n },\n );\n\n if (!res.ok) {\n console.error(\"addStandingOrder failed:\", res.status, (await res.text()).slice(0, 250));\n return null;\n }\n const id = (await res.json())?.id ?? null;\n console.log(`addStandingOrder OK ${id} ${bottles} x ${waterType} @ ${pricePerBottle}`);\n return id;\n}\n\nexport type NewAccount = {\n name?: string;\n phone?: string;\n email?: string;\n street?: string;\n city?: string;\n state?: string;\n zip?: string;\n bottles?: number | string;\n waterType?: string;\n frequency?: string;\n cooler?: boolean;\n /**\n * The first-order total the bot quoted, INCLUDING any promotion it applied.\n *\n * This is the number the customer agreed to, so it is the number they are\n * charged: it lands on the signup invoice as Shipping and Handling, the same\n * slot a website order's checkout payment goes into. Without it there is no\n * charge and the pay link opens a $0 invoice, so the caller should always\n * send it.\n */\n orderTotal?: number | string;\n createdVia?: string;\n};\n\nexport type CreateResult =\n // standingOrder false means the account is real and billable but the recurring\n // delivery product did not get created, so the invoice will have no lines\n // until someone adds it. Surfaced rather than swallowed.\n | {\n ok: true;\n accountId: string;\n region: string;\n name: string;\n standingOrder: boolean;\n /** First invoice's pay link. Absent if the invoice was not raised. */\n payLink?: string;\n /** True if the ZIP had no region mapping and UNASSIGNED_REGION was used. */\n regionGuessed?: boolean;\n /** True if the frequency didn't match a known phrasing and defaulted to 30 Days. */\n frequencyGuessed?: boolean;\n }\n | { ok: false; reason: \"missing\"; missing: string[] }\n | { ok: false; reason: \"duplicate\"; accountId: string; name: string }\n | { ok: false; reason: \"error\"; message: string };\n\n/** Escape a value for a SOQL string literal. */\nfunction soql(v: string): string {\n return String(v).replace(/\\\\/g, \"\\\\\\\\\").replace(/'/g, \"\\\\'\");\n}\n\n/**\n * Create the account.\n *\n * Checks for an existing account on the same phone FIRST. A duplicate is the\n * likeliest failure in practice — an existing customer asks the bot to \"set up\n * service\" for a second location — and silently creating a second account\n * splits their billing and their route history.\n */\nexport async function createAccount(input: NewAccount): Promise {\n const req: Record = {\n name: String(input.name ?? \"\").trim(),\n street: String(input.street ?? \"\").trim(),\n city: String(input.city ?? \"\").trim(),\n state: String(input.state ?? \"\").trim().toUpperCase(),\n zip: String(input.zip ?? \"\").trim(),\n };\n const missing = Object.entries(req).filter(([, v]) => !v).map(([k]) => k);\n\n const bottles = Number(input.bottles);\n if (!bottles || bottles < 1) missing.push(\"bottles\");\n\n if (missing.length) return { ok: false, reason: \"missing\", missing };\n\n // NEITHER FREQUENCY NOR REGION BLOCK ANYMORE. Both are required, restricted\n // picklists in Salesforce, so an unresolved value still has to become SOME\n // valid picklist entry — it just no longer has to be the right one on the\n // first try. Getting the account created and the first invoice raised beats\n // stalling the whole signup on a route assignment or a schedule guess, and\n // both are flagged (UNASSIGNED_REGION, the Description stamp below) for a\n // human to correct afterward.\n const { value: frequency, guessed: frequencyGuessed } = canonicalFrequency(input.frequency);\n\n let region = regionForZip(req.zip, req.state);\n const regionGuessed = !region;\n if (regionGuessed) {\n region = UNASSIGNED_REGION;\n console.warn(\n `createAccount: no delivery region mapping for ${req.city}, ${req.state} ${req.zip}`\n + ` — inserting as \"${UNASSIGNED_REGION}\" for a team member to fix.`,\n );\n }\n\n const { access_token, instance_url } = await getAccessToken();\n\n // Duplicate check on phone, which is how this org identifies people.\n const digits = String(input.phone ?? \"\").replace(/[^0-9]/g, \"\").slice(-10);\n if (digits.length === 10) {\n const pattern = `%${digits.slice(0, 3)}%${digits.slice(3, 6)}%${digits.slice(6)}%`;\n const res = await fetch(\n `${instance_url}/services/data/${API}/query?q=`\n + encodeURIComponent(`SELECT Id, Name FROM Account WHERE Phone LIKE '${soql(pattern)}' LIMIT 1`),\n { headers: { Authorization: `Bearer ${access_token}` } },\n );\n if (res.ok) {\n const found = (await res.json())?.records?.[0];\n if (found) {\n return { ok: false, reason: \"duplicate\", accountId: found.Id, name: found.Name };\n }\n }\n }\n\n const waterType = canonicalWaterType(input.waterType);\n\n // THE QUOTED TOTAL IS ALSO THE TRIGGER, not just a number to store.\n // \"Tribeca Chat First Invoice\" keys on Chat_Order_Total__c being non-null —\n // it is the one field only this bot ever writes, which is why it is a safer\n // marker than Description (a long text area, which does not evaluate through\n // a cross-object lookup and silently matched nothing). No total means no\n // charge on the signup invoice, so it is worth saying so out loud.\n // The 2000 ceiling is a garbage filter, not a pricing rule. The largest\n // plausible first order here is a handful of glass bottles with deposits,\n // well under it; a number above that is a decimal-point slip or a model\n // inventing something, and it must not reach an invoice. The real\n // per-account check happens after insert, against the org's own prices.\n const orderTotal = Number(input.orderTotal);\n const hasTotal = Number.isFinite(orderTotal) && orderTotal > 0 && orderTotal <= 2000;\n if (!hasTotal) {\n console.warn(\n `createAccount: unusable orderTotal (${JSON.stringify(input.orderTotal)})`\n + \" — signup invoice will be $0 and no pay link is worth sending\",\n );\n }\n\n const body: Record = {\n Name: req.name,\n Phone: input.phone ?? null,\n // Shipping is what the Shipping_Address_Required validation rule checks.\n // Billing is copied from it so invoices have somewhere to go.\n ShippingStreet: req.street,\n ShippingCity: req.city,\n ShippingState: req.state,\n ShippingPostalCode: req.zip,\n BillingStreet: req.street,\n BillingCity: req.city,\n BillingState: req.state,\n BillingPostalCode: req.zip,\n Amount_of_Bottles__c: bottles,\n Frequency__c: frequency,\n Delivery_Region__c: region,\n // BOTH OF THESE ARE READ BY BILLING, not decoration.\n //\n // Email_Address__c becomes fw1__Recipient_Email__c on the recurring\n // invoice — leave it null and the customer is billed but never receives\n // the invoice, which is the worst of both outcomes. It used to live only\n // inside the Description stamp, where nothing could read it.\n //\n // Water_Cooler__c is matched against the literal string \"Cooler Needed\" by\n // \"create line items for online orders\"; that is the only thing that adds\n // the $8 cooler line. It is a TEXT field, not a picklist, so the wording\n // has to be exact. Left null when no cooler is wanted, so a customer can\n // never be charged for one they did not ask for.\n ...(input.email ? { Email_Address__c: input.email } : {}),\n ...(input.cooler ? { Water_Cooler__c: \"Cooler Needed\" } : {}),\n // WATER TYPE SETS THE PRICE, and it does so through a text blob.\n //\n // \"Update Delivery Region for Online Orders\" adds $1/bottle for Spring and\n // Distilled, and it decides by testing whether Online_Product_Variation__c\n // CONTAINS \"Spring\" or \"Distilled\". That field is the raw WooCommerce\n // variation text. This file used to leave it null, so a Spring signup was\n // priced as Alkaline — and because the recurring invoice reads\n // Price_Per_Bottle__c straight off the Account, that underbilled the\n // customer $1/bottle every cycle, not once. Measured against a real Spring\n // account in Midtown on 9/1/2026: 13.49 with the surcharge, 12.49 without.\n //\n // ONLY the water-type line is written, deliberately. The same flow reads\n // this field for frequency (\"Frequency:

Weekly

\"), glass bottles\n // (\"Amount of Glass Bottles\") and the two Florida routes (\"Miami Metro\n // Area, Dade County\"). A fuller blob would hand it decisions this file\n // already makes and could move an account onto another truck, so the\n // string stays the one token that has to be there. Format — including the\n // HTML — matches what the website writes.\n Water_Type__c: waterType,\n Online_Product_Variation__c: `Water Type:

${waterType}

Weekly

${waterType}

`,\n // COMMISSION TRACKING NEEDS THIS, AND NOTHING ELSE SETS IT.\n //\n // The Sales Commission Visualforce page halves a rep's per-customer\n // credit for a self-service signup, keyed on Account.Online_Order__c.\n // Every account this file creates came out of a chat/SMS conversation\n // with no rep on the phone, so it is always \"Online Order\" here — never\n // conditional, because this bot has no path where a human walked the\n // customer through it.\n Online_Order__c: \"Online Order\",\n ...(hasTotal ? { Chat_Order_Total__c: orderTotal } : {}),\n ...CARD_ON_FILE,\n // WE DO NOT SET PRICING. The org assigns a pricebook on insert and fills\n // Price_Per_Bottle__c / Price_Per_Delivery__c itself, per region. Proven\n // 9/1/2026: an account created with NO price written came back with 13.99\n // and 8.00 for Greater Philadelphia, and a Hudson account we DID write\n // 11.99 to came back 10.99 — the org overwrote us. Writing a rate here is\n // redundant at best and fights the pricebook at worst.\n // Stamped so every bot-created account is findable in one query. Without\n // this there is no way to audit what the bot made, or to unpick it.\n Description: `Created by ${input.createdVia ?? \"Tribeca chat\"} on `\n + new Date().toISOString().slice(0, 10)\n + (input.email ? ` · ${input.email}` : \"\")\n + (input.waterType ? ` · ${input.waterType}` : \"\")\n + (input.cooler ? \" · cooler requested\" : \"\")\n + (regionGuessed ? \" · REGION UNASSIGNED — NEEDS REVIEW\" : \"\")\n + (frequencyGuessed\n ? ` · frequency defaulted to 30 Days (raw: \"${input.frequency ?? \"\"}\")`\n : \"\"),\n };\n\n const res = await fetch(`${instance_url}/services/data/${API}/sobjects/Account`, {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${access_token}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify(body),\n });\n\n const out = await res.json().catch(() => null);\n if (!res.ok || !out?.id) {\n const err = Array.isArray(out) ? out[0] : null;\n console.error(\"createAccount failed:\", res.status, JSON.stringify(out)?.slice(0, 600));\n\n // SALESFORCE'S DUPLICATE RULE TALKS TO ADMINS, NOT CUSTOMERS.\n //\n // Its message is the literal \"Use one of these records?\" — a prompt meant\n // for someone looking at a list of matches. Relayed by a chat bot it is\n // nonsense, and that is exactly what happened in testing on 9/1/2026.\n //\n // Note this is NOT the same as our own phone check above. The org rule is\n // a FUZZY name-and-address match, and it is configured allowSave, i.e. a\n // warning the office may click straight past. So a hit here is not proof\n // of a duplicate — two different people in one Hoboken apartment building\n // will trip it. We still refuse rather than send the insert back with the\n // bypass header, because silently merging two customers' billing is far\n // worse than handing the signup to a person. Reported as a duplicate so\n // the bot says something true, with the matched account logged for the\n // office to judge.\n const match = err?.duplicateResult?.matchResults?.[0]?.matchRecords?.[0]?.record;\n if (err?.duplicateResult || err?.errorCode === \"DUPLICATES_DETECTED\") {\n console.warn(\n `createAccount blocked by ${err?.duplicateResult?.duplicateRule ?? \"duplicate rule\"}`\n + ` — matched ${match?.Id ?? \"(unreadable)\"} ${match?.Name ?? \"\"}`,\n );\n if (match?.Id) {\n return { ok: false, reason: \"duplicate\", accountId: match.Id, name: match.Name ?? req.name };\n }\n return {\n ok: false,\n reason: \"error\",\n message: \"This looks close to an account we already have, so a team member \"\n + \"needs to check it before setting up service.\",\n };\n }\n\n // Everything else gets a customer-safe sentence. Raw Salesforce errors name\n // fields, rules and objects, and none of that belongs in front of a\n // visitor — it is logged above, which is where the office can find it.\n return {\n ok: false,\n reason: \"error\",\n message: \"The account could not be created right now. A team member can finish setting it up.\",\n };\n }\n\n console.log(`createAccount OK ${out.id} region=${region}`);\n // No customer name in the log: Val Town's logs are not purgeable, so a name\n // written here outlives every retention rule. The id finds the account.\n\n // INVOICING IS SALESFORCE'S JOB, NOT OURS.\n //\n // Inserting the Account fires the org's own \"Create Custom Invoice for online\n // orders\" flow, and \"Create RDP/DLI Invoice Lines\" fills the lines in once a\n // Recurring Delivery Product exists. We deliberately do not write invoice\n // records from here: the integration user cannot touch fw1__Invoice__c at all\n // (FinancialForce licence, not field security — it answers \"sObject type is\n // not supported\"), and reaching around the org's automation to bill a\n // customer from an HTTP call would be the wrong place for it even if it\n // worked. An earlier version tried and is deliberately removed.\n //\n // What we DO supply is the one input the org's automation cannot invent: the\n // standing order. Awaited rather than fired and forgotten, because Val Town\n // stops the isolate when the response is sent and a floating promise would be\n // killed mid-flight — intermittently, which is the worst way for it to fail.\n const rdpId = await addStandingOrder(\n out.id, bottles, input.waterType, instance_url, access_token,\n ).catch((e) => {\n console.error(\"addStandingOrder threw:\", e);\n return null;\n });\n\n // THE PAY LINK IS SAFE HERE, AND ONLY HERE. READ THIS BEFORE COPYING IT.\n //\n // invoice.ts refuses to hand out this same URL unless the visitor is signed\n // in to WordPress, and that rule is right: there the invoice is reached by\n // LOOKING SOMEONE UP from a phone number, a phone number is not proof of\n // identity, and the page shows the invoice's line items and updates the card\n // on file. Handing it to the wrong person is a real disclosure.\n //\n // A signup is not a lookup. This account did not exist a second ago, the\n // visitor supplied every field of it in this conversation, and the invoice\n // was raised for them from those answers. There is no other customer whose\n // data could be exposed, because there is no search. Do NOT lift this into\n // any path that finds an EXISTING account — that is exactly the case\n // invoice.ts is protecting.\n //\n // The link is written to the Account by \"Tribeca Chat First Invoice\", which\n // runs during the RDP insert above; the chat cannot read fw1__Invoice__c\n // itself to learn the id. No RDP means no invoice and no link, which is why\n // this is only attempted when one was created.\n let payLink: string | undefined;\n if (rdpId) {\n try {\n const linked = await fetch(\n `${instance_url}/services/data/${API}/sobjects/Account/${out.id}`\n + \"?fields=Most_Recent_Invoice_Link__c,Price_Per_Bottle__c,Price_Per_Delivery__c\",\n { headers: { Authorization: `Bearer ${access_token}` } },\n );\n const acc2 = linked.ok ? await linked.json() : null;\n const url = acc2?.Most_Recent_Invoice_Link__c ?? null;\n if (url) payLink = String(url);\n else console.log(\"createAccount: first invoice raised no pay link\");\n\n // AUDIT THE MODEL'S ARITHMETIC AGAINST THE ORG'S OWN PRICES.\n //\n // orderTotal is the one number in this file that a language model\n // supplies, and it is the number the customer is charged. Everything\n // else here is deterministic by design. So it is checked against what\n // the org itself assigned: bottles x Price_Per_Bottle__c, plus the\n // delivery fee, plus a cooler, plus the $5-per-bottle first-order\n // deposit. A quote BELOW that is expected and fine — the 25for2025\n // promotion is a real discount. A quote ABOVE it means the model\n // invented a number, and the customer is being overcharged.\n //\n // Logged rather than corrected: the account and invoice already exist by\n // now, and quietly rewriting what a customer was told they would pay\n // would be its own kind of wrong. This is for the office to catch.\n const ppb = Number(acc2?.Price_Per_Bottle__c);\n const ppd = Number(acc2?.Price_Per_Delivery__c);\n if (hasTotal && Number.isFinite(ppb) && Number.isFinite(ppd)) {\n const ceiling = bottles * ppb + ppd + (input.cooler ? 8 : 0) + bottles * 5;\n if (orderTotal > ceiling + 0.01) {\n console.error(\n `createAccount OVERCHARGE CHECK FAILED on ${out.id}: quoted ${orderTotal.toFixed(2)}`\n + ` exceeds ${ceiling.toFixed(2)} (${bottles} x ${ppb} + ${ppd} delivery`\n + `${input.cooler ? \" + 8 cooler\" : \"\"} + ${bottles * 5} deposit). Review this invoice.`,\n );\n }\n }\n } catch (e) {\n // A missing link must never lose the signup — the account is already real.\n console.error(\"createAccount: pay link read failed:\", e);\n }\n }\n\n return {\n ok: true,\n accountId: out.id,\n region,\n name: req.name,\n standingOrder: !!rdpId,\n ...(payLink ? { payLink } : {}),\n ...(regionGuessed ? { regionGuessed: true } : {}),\n ...(frequencyGuessed ? { frequencyGuessed: true } : {}),\n };\n}\n","createdAt",["D",1789146781521],"branchVersion","branchId","ceda7ac1-4fbd-45e5-ab28-65082ea4218c","id","0979b5fe-99f9-4673-be24-063bb9928dc3","tribeca-salesforce-agent",["D",1785197056244],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Read-only Salesforce Account/Opportunity API access","imageUrl","c5acd3b3-60a7-4deb-bc6d-528f83012ea9","pinnedFileId","6093920c-8a18-11f1-a4ec-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f8fe3-60c5-70ee-a317-3aded0417f73","tursoName","0979b5fe99f94673be24063bb9928dc3","tursoHostname","0979b5fe99f94673be24063bb9928dc3-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789491713377],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_100":99,"_107":-5},"org",{"_100":99,"_101":102,"_103":-5,"_18":-5,"_104":105,"_106":25},"branch",{"_13":89,"_32":90,"_43":42,"_91":44,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":45,"_98":99},"isOwned",290,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","tribeca_airep","handle","displayName","Tribeca_AIrep","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":306,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":307,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":308,"_84":309,"_86":310,"_88":25},"tree",[253,254,255,256,257,258,259,260,261,262,263,264,265],"files",[253,254,255,256,257,258,259,260,261,262,263,264,265],"counts",{"_242":63,"_243":150,"_244":63,"_245":246,"_247":248},"contents",[130,131,132,133,134,135,136,137,138,139,140,141,142],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":236,"_32":237,"_30":238,"_146":-5,"_41":42,"_40":150,"_148":59,"_38":239,"_13":63,"_33":20,"_35":240,"_24":25,"_152":-5,"_27":241},{"_43":227,"_32":228,"_30":229,"_146":-5,"_41":42,"_40":230,"_148":59,"_38":231,"_13":232,"_33":160,"_35":233,"_24":25,"_152":234,"_27":235},{"_43":223,"_32":28,"_30":31,"_146":-5,"_41":42,"_40":14,"_148":25,"_38":224,"_13":225,"_33":34,"_35":37,"_24":25,"_152":-5,"_27":226},{"_43":214,"_32":215,"_30":216,"_146":-5,"_41":42,"_40":217,"_148":25,"_38":218,"_13":219,"_33":220,"_35":221,"_24":25,"_152":-5,"_27":222},{"_43":206,"_32":207,"_30":208,"_146":-5,"_41":42,"_40":209,"_148":25,"_38":210,"_13":211,"_33":160,"_35":212,"_24":25,"_152":-5,"_27":213},{"_43":199,"_32":200,"_30":201,"_146":-5,"_41":42,"_40":202,"_148":59,"_38":203,"_13":166,"_33":34,"_35":204,"_24":25,"_152":-5,"_27":205},{"_43":192,"_32":193,"_30":57,"_146":-5,"_41":42,"_40":194,"_148":59,"_38":195,"_13":196,"_33":160,"_35":197,"_24":25,"_152":-5,"_27":198},{"_43":184,"_32":185,"_30":186,"_146":-5,"_41":42,"_40":187,"_148":59,"_38":188,"_13":189,"_33":34,"_35":190,"_24":25,"_152":-5,"_27":191},{"_43":177,"_32":178,"_30":179,"_146":-5,"_41":42,"_40":180,"_148":59,"_38":181,"_13":150,"_33":34,"_35":182,"_24":25,"_152":-5,"_27":183},{"_43":170,"_32":171,"_30":172,"_146":-5,"_41":42,"_40":173,"_148":59,"_38":174,"_13":63,"_33":34,"_35":175,"_24":25,"_152":-5,"_27":176},{"_43":163,"_32":164,"_30":165,"_146":-5,"_41":42,"_40":166,"_148":59,"_38":167,"_13":63,"_33":160,"_35":168,"_24":25,"_152":-5,"_27":169},{"_43":154,"_32":155,"_30":156,"_146":-5,"_41":42,"_40":157,"_148":59,"_38":158,"_13":159,"_33":160,"_35":161,"_24":25,"_152":-5,"_27":162},{"_43":143,"_32":144,"_30":145,"_146":-5,"_41":42,"_40":147,"_148":59,"_38":149,"_13":150,"_33":34,"_35":151,"_24":25,"_152":-5,"_27":153},"a37df26d-ea57-42cc-9bf8-cb805051de20","zip-regions.ts","d4036134-a621-11f1-94d5-1607ee4eb77e","parentId",144,"latest",["D",1788536535693],1,"// ZIP to Delivery_Region__c, MEASURED FROM THE ORG'S OWN ACCOUNTS on 9/1/2026.\n//\n// WHY THIS IS A TABLE AND NOT A RULE\n// New Jersey's regions are route names, not geography — Essex, Hudson, North,\n// West, South, Jersey Shore — and no formula reproduces them. Manhattan splits\n// three ways along lines ZIPs do not follow. Nassau and Suffolk interleave\n// through the 117xx band. Every attempt to write this as logic put someone on\n// the wrong truck: a first draft sent Levittown 11756 to Suffolk when it is\n// Nassau, and refusing all of New Jersey turned away a Hoboken signup that the\n// office files under Hudson 118 times out of 131.\n//\n// So it is measured instead. Each ZIP below is where the office ACTUALLY files\n// accounts, from a GROUP BY over live Account records. A ZIP earns a place here\n// only with at least 4 accounts AND at least 70% of them in one region.\n//\n// 161 further ZIPs were genuinely split — 07004 runs Essex 23 / North 14 /\n// West 7 / South 1 — and are deliberately ABSENT, so they still go to a human.\n// If the office itself does not treat a ZIP consistently, no lookup should\n// pretend otherwise.\n//\n// REFRESH (aggregate queries cannot page, so one state at a time):\n// sf data query --target-org info@tribecabeverage.com --json --query // \"SELECT ShippingPostalCode, Delivery_Region__c, COUNT(Id) FROM Account\n// WHERE ShippingState = 'NJ' AND Delivery_Region__c != null\n// AND ShippingPostalCode != null\n// GROUP BY ShippingPostalCode, Delivery_Region__c LIMIT 2000\"\n\nexport const ZIP_REGION: Record = {\n // Bronx (25 ZIPs)\n \"10451\": \"Bronx\", \"10452\": \"Bronx\", \"10453\": \"Bronx\", \"10454\": \"Bronx\", \"10455\": \"Bronx\",\n \"10456\": \"Bronx\", \"10457\": \"Bronx\", \"10458\": \"Bronx\", \"10459\": \"Bronx\", \"10460\": \"Bronx\",\n \"10461\": \"Bronx\", \"10462\": \"Bronx\", \"10463\": \"Bronx\", \"10464\": \"Bronx\", \"10465\": \"Bronx\",\n \"10466\": \"Bronx\", \"10467\": \"Bronx\", \"10468\": \"Bronx\", \"10469\": \"Bronx\", \"10470\": \"Bronx\",\n \"10471\": \"Bronx\", \"10472\": \"Bronx\", \"10473\": \"Bronx\", \"10474\": \"Bronx\", \"10475\": \"Bronx\",\n // Brooklyn (39 ZIPs)\n \"11201\": \"Brooklyn\", \"11203\": \"Brooklyn\", \"11204\": \"Brooklyn\", \"11205\": \"Brooklyn\", \"11206\": \"Brooklyn\",\n \"11207\": \"Brooklyn\", \"11208\": \"Brooklyn\", \"11209\": \"Brooklyn\", \"11210\": \"Brooklyn\", \"11211\": \"Brooklyn\",\n \"11212\": \"Brooklyn\", \"11213\": \"Brooklyn\", \"11214\": \"Brooklyn\", \"11215\": \"Brooklyn\", \"11216\": \"Brooklyn\",\n \"11217\": \"Brooklyn\", \"11218\": \"Brooklyn\", \"11219\": \"Brooklyn\", \"11220\": \"Brooklyn\", \"11221\": \"Brooklyn\",\n \"11222\": \"Brooklyn\", \"11223\": \"Brooklyn\", \"11224\": \"Brooklyn\", \"11225\": \"Brooklyn\", \"11226\": \"Brooklyn\",\n \"11228\": \"Brooklyn\", \"11229\": \"Brooklyn\", \"11230\": \"Brooklyn\", \"11231\": \"Brooklyn\", \"11232\": \"Brooklyn\",\n \"11233\": \"Brooklyn\", \"11234\": \"Brooklyn\", \"11235\": \"Brooklyn\", \"11236\": \"Brooklyn\", \"11237\": \"Brooklyn\",\n \"11238\": \"Brooklyn\", \"11239\": \"Brooklyn\", \"11242\": \"Brooklyn\", \"11249\": \"Brooklyn\",\n // Dutchess (5 ZIPs)\n \"12508\": \"Dutchess\", \"12524\": \"Dutchess\", \"12572\": \"Dutchess\", \"12590\": \"Dutchess\", \"12603\": \"Dutchess\",\n // Essex (20 ZIPs)\n \"07003\": \"Essex\", \"07009\": \"Essex\", \"07017\": \"Essex\", \"07018\": \"Essex\", \"07028\": \"Essex\",\n \"07040\": \"Essex\", \"07050\": \"Essex\", \"07068\": \"Essex\", \"07078\": \"Essex\", \"07102\": \"Essex\",\n \"07103\": \"Essex\", \"07104\": \"Essex\", \"07105\": \"Essex\", \"07106\": \"Essex\", \"07107\": \"Essex\",\n \"07108\": \"Essex\", \"07109\": \"Essex\", \"07111\": \"Essex\", \"07112\": \"Essex\", \"07114\": \"Essex\",\n // Hudson (12 ZIPs)\n \"07002\": \"Hudson\", \"07030\": \"Hudson\", \"07086\": \"Hudson\", \"07087\": \"Hudson\", \"07093\": \"Hudson\",\n \"07302\": \"Hudson\", \"07304\": \"Hudson\", \"07305\": \"Hudson\", \"07306\": \"Hudson\", \"07307\": \"Hudson\",\n \"07310\": \"Hudson\", \"07311\": \"Hudson\",\n // Jersey Shore (3 ZIPs)\n \"07716\": \"Jersey Shore\", \"07758\": \"Jersey Shore\", \"08721\": \"Jersey Shore\",\n // Lower Manhattan (12 ZIPs)\n \"10002\": \"Lower Manhattan\", \"10004\": \"Lower Manhattan\", \"10005\": \"Lower Manhattan\", \"10006\": \"Lower Manhattan\", \"10007\": \"Lower Manhattan\",\n \"10009\": \"Lower Manhattan\", \"10012\": \"Lower Manhattan\", \"10013\": \"Lower Manhattan\", \"10014\": \"Lower Manhattan\", \"10038\": \"Lower Manhattan\",\n \"10280\": \"Lower Manhattan\", \"10282\": \"Lower Manhattan\",\n // Midtown Manhattan (13 ZIPs)\n \"10017\": \"Midtown Manhattan\", \"10018\": \"Midtown Manhattan\", \"10019\": \"Midtown Manhattan\", \"10020\": \"Midtown Manhattan\", \"10022\": \"Midtown Manhattan\",\n \"10036\": \"Midtown Manhattan\", \"10110\": \"Midtown Manhattan\", \"10111\": \"Midtown Manhattan\", \"10123\": \"Midtown Manhattan\", \"10155\": \"Midtown Manhattan\",\n \"10165\": \"Midtown Manhattan\", \"10170\": \"Midtown Manhattan\", \"10174\": \"Midtown Manhattan\",\n // Nassau (58 ZIPs)\n \"11003\": \"Nassau\", \"11005\": \"Nassau\", \"11010\": \"Nassau\", \"11021\": \"Nassau\", \"11023\": \"Nassau\",\n \"11024\": \"Nassau\", \"11030\": \"Nassau\", \"11040\": \"Nassau\", \"11042\": \"Nassau\", \"11050\": \"Nassau\",\n \"11096\": \"Nassau\", \"11501\": \"Nassau\", \"11507\": \"Nassau\", \"11510\": \"Nassau\", \"11514\": \"Nassau\",\n \"11516\": \"Nassau\", \"11518\": \"Nassau\", \"11520\": \"Nassau\", \"11530\": \"Nassau\", \"11542\": \"Nassau\",\n \"11545\": \"Nassau\", \"11550\": \"Nassau\", \"11552\": \"Nassau\", \"11553\": \"Nassau\", \"11554\": \"Nassau\",\n \"11557\": \"Nassau\", \"11558\": \"Nassau\", \"11559\": \"Nassau\", \"11560\": \"Nassau\", \"11561\": \"Nassau\",\n \"11563\": \"Nassau\", \"11565\": \"Nassau\", \"11566\": \"Nassau\", \"11568\": \"Nassau\", \"11570\": \"Nassau\",\n \"11572\": \"Nassau\", \"11576\": \"Nassau\", \"11577\": \"Nassau\", \"11579\": \"Nassau\", \"11580\": \"Nassau\",\n \"11581\": \"Nassau\", \"11590\": \"Nassau\", \"11596\": \"Nassau\", \"11598\": \"Nassau\", \"11710\": \"Nassau\",\n \"11714\": \"Nassau\", \"11735\": \"Nassau\", \"11753\": \"Nassau\", \"11756\": \"Nassau\", \"11758\": \"Nassau\",\n \"11762\": \"Nassau\", \"11771\": \"Nassau\", \"11783\": \"Nassau\", \"11791\": \"Nassau\", \"11793\": \"Nassau\",\n \"11797\": \"Nassau\", \"11801\": \"Nassau\", \"11803\": \"Nassau\",\n // North (79 ZIPs)\n \"07010\": \"North\", \"07011\": \"North\", \"07012\": \"North\", \"07013\": \"North\", \"07014\": \"North\",\n \"07024\": \"North\", \"07026\": \"North\", \"07031\": \"North\", \"07055\": \"North\", \"07057\": \"North\",\n \"07070\": \"North\", \"07071\": \"North\", \"07072\": \"North\", \"07073\": \"North\", \"07074\": \"North\",\n \"07075\": \"North\", \"07401\": \"North\", \"07407\": \"North\", \"07410\": \"North\", \"07417\": \"North\",\n \"07420\": \"North\", \"07421\": \"North\", \"07422\": \"North\", \"07423\": \"North\", \"07424\": \"North\",\n // 07440 (Pequannock) added 9/4/2026, NOT from the measured GROUP BY —\n // it had zero existing accounts to measure. Confirmed directly by the\n // office instead, live, while a real signup was blocked on it.\n \"07440\": \"North\",\n \"07430\": \"North\", \"07432\": \"North\", \"07436\": \"North\", \"07446\": \"North\", \"07450\": \"North\",\n \"07452\": \"North\", \"07456\": \"North\", \"07457\": \"North\", \"07458\": \"North\", \"07463\": \"North\",\n \"07470\": \"North\", \"07481\": \"North\", \"07501\": \"North\", \"07502\": \"North\", \"07503\": \"North\",\n \"07504\": \"North\", \"07505\": \"North\", \"07506\": \"North\", \"07508\": \"North\", \"07512\": \"North\",\n \"07513\": \"North\", \"07514\": \"North\", \"07522\": \"North\", \"07524\": \"North\", \"07601\": \"North\",\n \"07604\": \"North\", \"07605\": \"North\", \"07607\": \"North\", \"07621\": \"North\", \"07624\": \"North\",\n \"07626\": \"North\", \"07628\": \"North\", \"07630\": \"North\", \"07631\": \"North\", \"07632\": \"North\",\n \"07640\": \"North\", \"07642\": \"North\", \"07643\": \"North\", \"07644\": \"North\", \"07645\": \"North\",\n \"07646\": \"North\", \"07649\": \"North\", \"07652\": \"North\", \"07656\": \"North\", \"07657\": \"North\",\n \"07660\": \"North\", \"07661\": \"North\", \"07663\": \"North\", \"07666\": \"North\", \"07670\": \"North\",\n \"07675\": \"North\", \"07677\": \"North\", \"07874\": \"North\", \"07931\": \"North\",\n // Orange (11 ZIPs)\n \"10918\": \"Orange\", \"10924\": \"Orange\", \"10925\": \"Orange\", \"10940\": \"Orange\", \"10941\": \"Orange\",\n \"10950\": \"Orange\", \"10990\": \"Orange\", \"10992\": \"Orange\", \"12518\": \"Orange\", \"12550\": \"Orange\",\n \"12553\": \"Orange\",\n // Queens (56 ZIPs)\n \"11004\": \"Queens\", \"11101\": \"Queens\", \"11102\": \"Queens\", \"11103\": \"Queens\", \"11104\": \"Queens\",\n \"11105\": \"Queens\", \"11106\": \"Queens\", \"11109\": \"Queens\", \"11354\": \"Queens\", \"11355\": \"Queens\",\n \"11356\": \"Queens\", \"11357\": \"Queens\", \"11358\": \"Queens\", \"11360\": \"Queens\", \"11361\": \"Queens\",\n \"11363\": \"Queens\", \"11364\": \"Queens\", \"11365\": \"Queens\", \"11366\": \"Queens\", \"11367\": \"Queens\",\n \"11368\": \"Queens\", \"11369\": \"Queens\", \"11370\": \"Queens\", \"11372\": \"Queens\", \"11373\": \"Queens\",\n \"11374\": \"Queens\", \"11375\": \"Queens\", \"11377\": \"Queens\", \"11378\": \"Queens\", \"11379\": \"Queens\",\n \"11385\": \"Queens\", \"11411\": \"Queens\", \"11412\": \"Queens\", \"11413\": \"Queens\", \"11414\": \"Queens\",\n \"11415\": \"Queens\", \"11416\": \"Queens\", \"11417\": \"Queens\", \"11418\": \"Queens\", \"11419\": \"Queens\",\n \"11420\": \"Queens\", \"11421\": \"Queens\", \"11422\": \"Queens\", \"11423\": \"Queens\", \"11427\": \"Queens\",\n \"11428\": \"Queens\", \"11429\": \"Queens\", \"11430\": \"Queens\", \"11432\": \"Queens\", \"11433\": \"Queens\",\n \"11434\": \"Queens\", \"11435\": \"Queens\", \"11436\": \"Queens\", \"11691\": \"Queens\", \"11692\": \"Queens\",\n \"11693\": \"Queens\",\n // Richmond (12 ZIPs)\n \"10301\": \"Richmond\", \"10302\": \"Richmond\", \"10303\": \"Richmond\", \"10304\": \"Richmond\", \"10305\": \"Richmond\",\n \"10306\": \"Richmond\", \"10307\": \"Richmond\", \"10308\": \"Richmond\", \"10309\": \"Richmond\", \"10310\": \"Richmond\",\n \"10312\": \"Richmond\", \"10314\": \"Richmond\",\n // Rockland (16 ZIPs)\n \"10923\": \"Rockland\", \"10927\": \"Rockland\", \"10952\": \"Rockland\", \"10954\": \"Rockland\", \"10956\": \"Rockland\",\n \"10960\": \"Rockland\", \"10962\": \"Rockland\", \"10964\": \"Rockland\", \"10965\": \"Rockland\", \"10970\": \"Rockland\",\n \"10977\": \"Rockland\", \"10980\": \"Rockland\", \"10983\": \"Rockland\", \"10989\": \"Rockland\", \"10994\": \"Rockland\",\n \"12779\": \"Rockland\",\n // South (49 ZIPs)\n \"07008\": \"South\", \"07023\": \"South\", \"07036\": \"South\", \"07060\": \"South\", \"07063\": \"South\",\n \"07065\": \"South\", \"07067\": \"South\", \"07095\": \"South\", \"07730\": \"South\", \"07732\": \"South\",\n \"07748\": \"South\", \"07751\": \"South\", \"07760\": \"South\", \"08005\": \"South\", \"08012\": \"South\",\n \"08016\": \"South\", \"08021\": \"South\", \"08043\": \"South\", \"08046\": \"South\", \"08050\": \"South\",\n \"08060\": \"South\", \"08068\": \"South\", \"08075\": \"South\", \"08081\": \"South\", \"08094\": \"South\",\n \"08103\": \"South\", \"08109\": \"South\", \"08234\": \"South\", \"08518\": \"South\", \"08534\": \"South\",\n \"08536\": \"South\", \"08540\": \"South\", \"08609\": \"South\", \"08610\": \"South\", \"08611\": \"South\",\n \"08618\": \"South\", \"08648\": \"South\", \"08736\": \"South\", \"08759\": \"South\", \"08837\": \"South\",\n \"08846\": \"South\", \"08852\": \"South\", \"08854\": \"South\", \"08859\": \"South\", \"08861\": \"South\",\n \"08863\": \"South\", \"08879\": \"South\", \"08886\": \"South\", \"08904\": \"South\",\n // Suffolk (45 ZIPs)\n \"11702\": \"Suffolk\", \"11703\": \"Suffolk\", \"11704\": \"Suffolk\", \"11706\": \"Suffolk\", \"11716\": \"Suffolk\",\n \"11720\": \"Suffolk\", \"11721\": \"Suffolk\", \"11725\": \"Suffolk\", \"11727\": \"Suffolk\", \"11729\": \"Suffolk\",\n \"11741\": \"Suffolk\", \"11742\": \"Suffolk\", \"11743\": \"Suffolk\", \"11746\": \"Suffolk\", \"11751\": \"Suffolk\",\n \"11763\": \"Suffolk\", \"11764\": \"Suffolk\", \"11766\": \"Suffolk\", \"11767\": \"Suffolk\", \"11768\": \"Suffolk\",\n \"11772\": \"Suffolk\", \"11777\": \"Suffolk\", \"11779\": \"Suffolk\", \"11782\": \"Suffolk\", \"11787\": \"Suffolk\",\n \"11788\": \"Suffolk\", \"11795\": \"Suffolk\", \"11798\": \"Suffolk\", \"11901\": \"Suffolk\", \"11930\": \"Suffolk\",\n \"11932\": \"Suffolk\", \"11933\": \"Suffolk\", \"11937\": \"Suffolk\", \"11940\": \"Suffolk\", \"11946\": \"Suffolk\",\n \"11952\": \"Suffolk\", \"11953\": \"Suffolk\", \"11954\": \"Suffolk\", \"11962\": \"Suffolk\", \"11963\": \"Suffolk\",\n \"11967\": \"Suffolk\", \"11968\": \"Suffolk\", \"11971\": \"Suffolk\", \"11975\": \"Suffolk\", \"11976\": \"Suffolk\",\n // Upper Manhattan (20 ZIPs)\n \"10021\": \"Upper Manhattan\", \"10023\": \"Upper Manhattan\", \"10024\": \"Upper Manhattan\", \"10025\": \"Upper Manhattan\", \"10026\": \"Upper Manhattan\",\n \"10027\": \"Upper Manhattan\", \"10028\": \"Upper Manhattan\", \"10029\": \"Upper Manhattan\", \"10030\": \"Upper Manhattan\", \"10031\": \"Upper Manhattan\",\n \"10032\": \"Upper Manhattan\", \"10033\": \"Upper Manhattan\", \"10034\": \"Upper Manhattan\", \"10035\": \"Upper Manhattan\", \"10037\": \"Upper Manhattan\",\n \"10039\": \"Upper Manhattan\", \"10040\": \"Upper Manhattan\", \"10069\": \"Upper Manhattan\", \"10075\": \"Upper Manhattan\", \"10128\": \"Upper Manhattan\",\n // West (23 ZIPs)\n \"07035\": \"West\", \"07045\": \"West\", \"07046\": \"West\", \"07054\": \"West\", \"07082\": \"West\",\n \"07801\": \"West\", \"07821\": \"West\", \"07828\": \"West\", \"07830\": \"West\", \"07836\": \"West\",\n \"07840\": \"West\", \"07849\": \"West\", \"07850\": \"West\", \"07852\": \"West\", \"07860\": \"West\",\n \"07869\": \"West\", \"07930\": \"West\", \"07940\": \"West\", \"07950\": \"West\", \"07960\": \"West\",\n \"07981\": \"West\", \"08530\": \"West\", \"08809\": \"West\",\n // West Chester (45 ZIPs)\n \"10504\": \"West Chester\", \"10506\": \"West Chester\", \"10514\": \"West Chester\", \"10520\": \"West Chester\", \"10526\": \"West Chester\",\n \"10528\": \"West Chester\", \"10530\": \"West Chester\", \"10533\": \"West Chester\", \"10536\": \"West Chester\", \"10538\": \"West Chester\",\n \"10541\": \"West Chester\", \"10543\": \"West Chester\", \"10549\": \"West Chester\", \"10550\": \"West Chester\", \"10552\": \"West Chester\",\n \"10553\": \"West Chester\", \"10560\": \"West Chester\", \"10562\": \"West Chester\", \"10570\": \"West Chester\", \"10573\": \"West Chester\",\n \"10577\": \"West Chester\", \"10580\": \"West Chester\", \"10583\": \"West Chester\", \"10589\": \"West Chester\", \"10590\": \"West Chester\",\n \"10591\": \"West Chester\", \"10595\": \"West Chester\", \"10597\": \"West Chester\", \"10598\": \"West Chester\", \"10601\": \"West Chester\",\n \"10603\": \"West Chester\", \"10604\": \"West Chester\", \"10605\": \"West Chester\", \"10606\": \"West Chester\", \"10701\": \"West Chester\",\n \"10703\": \"West Chester\", \"10706\": \"West Chester\", \"10707\": \"West Chester\", \"10708\": \"West Chester\", \"10709\": \"West Chester\",\n \"10710\": \"West Chester\", \"10801\": \"West Chester\", \"10803\": \"West Chester\", \"10804\": \"West Chester\", \"10805\": \"West Chester\",\n};\n","label",[144],"039fce44-a092-4b5a-b07f-aafb087d385c","triage.ts","999a7962-ad31-11f1-87c8-1607ee4eb77e",278,["D",1789144012730],36,"http","// One decision per email, made here rather than in Apps Script.\n//\n// The Gmail add-on used to carry the matching rules, the skip rules and the\n// digest itself. All of that now lives in this file, because the Apps Script\n// editor can only be edited by pasting into a browser and that paste fails\n// silently often enough to have lost four separate edits on 2026-09-10. What\n// is left in Apps Script is the part that genuinely has to be there: reading\n// Gmail, applying labels, and drawing the card.\n//\n// POST /triage { messageId?, from, subject, body, model?, force?, record? }\n// -> the whole verdict, including the Gmail label to apply.\n// GET /triage/pending what the digest has not sent yet\n// GET /triage/recent the last few verdicts, for looking at\n//\n// Auth: API_SHARED_SECRET, same as the rest of the val.\n//\n// It records what it decided so the same message is never analysed twice and\n// so the digest cron has something to send. Nothing here writes to Salesforce.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { sfQuery } from \"./salesforce.ts\";\n\nconst OWN_DOMAIN = \"tribecabeverage.com\";\n// Our own numbers turn up in quoted replies, signatures, and in the subject of\n// a forwarded text (\"SMS From To 19739134568\"). 973-913-4568 matters\n// most: two Accounts carry it, so without it a forward whose real number missed\n// would fall through and confidently show the wrong customer.\nconst OWN_PHONES = new Set([\"6466812965\", \"6467988015\", \"9739134568\"]);\n\n// Our own street address, keyed the way extractAddresses keys one:\n// `${number}|${core.toLowerCase()}`. This matters as much as OWN_PHONES and for\n// the same reason: \"23 Carol St Clifton NJ 07014\" sits in the signature of every\n// outbound email, so it is quoted back to us in every single reply. Whenever the\n// email and phone tiers missed, the address tier matched our own signature and\n// confidently returned the Account literally named \"test address 23 Carol St\" -\n// producing a Ready-to-act row proposing a delivery-date change on the wrong\n// record. Seen on the first live sweep, 2026-09-10.\nconst OWN_ADDRESSES = new Set([\"23|carol\"]);\n\n// Free filters, applied before anything costs a request. Marketing mail is\n// deliberately absent: it costs one cheap Salesforce lookup, fails to match,\n// and never reaches the model.\nconst SKIP_SENDER = /(^|[.<@])(noreply|no-reply|donotreply|do-not-reply|mailer-daemon|postmaster)/i;\nconst SKIP_SUBJECT = /^\\s*(skipped delivery|automatic reply|out of office|automatic response|delivery status notification|undeliverable|read receipt)/i;\n\n// The customer portal mails these to info@ from info@, which meant the\n// own-domain rule below threw away the best input this thing gets. They are\n// machine-written but the CUSTOMER wrote the request: it is already\n// categorised (Earlier Delivery / Skip Delivery / Order Change / Standing\n// Order Change / Move Delivery / Account Details Update), the account name is\n// the last segment of the subject, and the body carries the customer's email,\n// phone, service address, current delivery week and the close-date rule. About\n// fifteen arrive on a normal working day. Found 2026-09-10.\nconst PORTAL_SUBJECT = /^\\s*Customer Portal Request\\s*[—–-]/i;\n\n/** \"Customer Portal Request — Earlier Delivery Request — Ursula Serluca CPA\" -> \"Ursula Serluca CPA\". */\nexport function portalAccountName(subject: string): string | null {\n if (!PORTAL_SUBJECT.test(subject ?? \"\")) return null;\n // Split on the em dash only. Account names contain plain hyphens\n // (\"Middlesex College - Dean's Office, North Hall\"), so splitting on those\n // would cut the name in half.\n const parts = String(subject).split(/[—–]/);\n if (parts.length < 3) return null;\n return parts.slice(2).join(\"—\").trim() || null;\n}\n\nexport const LABELS: Record = {\n action: \"SF Triage/Action ready\",\n human: \"SF Triage/Needs a person\",\n none: \"SF Triage/No action\",\n nomatch: \"SF Triage/No account match\",\n skipped: \"\",\n};\n\n// GMAIL LABELLING IS OFF, AND OFF IS THE DEFAULT.\n//\n// info@ is a shared mailbox. A Gmail label shows as a coloured chip on the\n// message row for everyone who opens it, and Gmail has no setting that hides a\n// chip from the conversation list - \"hide in label list\" only affects the left\n// sidebar. So there is no way to label quietly, and the inbox is not ours to\n// decorate. Turned off at the customer's request on 2026-09-10.\n//\n// Nothing else changes: every verdict is still recorded in triage_v1, so the\n// digest email and /digest-preview show exactly what they did before. The sweep\n// in Apps Script guards with `if (t.label)`, so an empty string here means it\n// creates no label and touches no thread.\n//\n// Set the val env var GMAIL_LABELS=on to put the chips back.\nconst GMAIL_LABELS = (Deno.env.get(\"GMAIL_LABELS\") ?? \"\").toLowerCase() === \"on\";\nfunction labelFor(verdict: string) {\n return GMAIL_LABELS ? (LABELS[verdict] ?? \"\") : \"\";\n}\n\nconst ACCOUNT_FIELDS =\n \"Id, Name, Phone, Email_Address__c, Water_Type__c, Water_Cooler__c, Amount_of_Bottles__c, Frequency__c, \" +\n \"ShippingStreet, ShippingCity, ShippingPostalCode, BillingStreet, Balance_for_Wordpress__c, \" +\n \"Most_Recent_Invoice_Number__c, Most_Recent_Invoice_Amount__c, \" +\n \"(SELECT Id, Name, StageName, CloseDate, Route_Date__c, Needs_Delivery_ASAP__c FROM Opportunities ORDER BY CreatedDate DESC LIMIT 1)\";\n\nfunction json(body: unknown, status = 200) {\n return new Response(JSON.stringify(body), { status, headers: { \"Content-Type\": \"application/json\" } });\n}\nfunction esc(v: string) {\n return v.replace(/\\\\/g, \"\\\\\\\\\").replace(/'/g, \"\\\\'\");\n}\n\n/** Checkbox fields come back as real booleans; \"true\" reads like debug output. */\nfunction fmtCell(v: unknown) {\n if (v === null || v === undefined || v === \"\") return \"(empty)\";\n if (v === true) return \"Yes\";\n if (v === false) return \"No\";\n return String(v);\n}\n\n// Email content is not kept. Anything older than this is deleted outright, and\n// the triage record keeps only what dedupe needs. Runs on every digest tick.\nexport const RETAIN_CONTENT_MS = 24 * 60 * 60 * 1000;\nexport const RETAIN_DEDUPE_MS = 48 * 60 * 60 * 1000;\n\n// ---------------------------------------------------------------------------\n// Signals: everything in the From header, subject and body that could identify\n// a customer. Priority when searching is email, then phone, then address, then\n// the sender's name.\n// ---------------------------------------------------------------------------\n\nfunction normalizePhone(raw: string) {\n let d = String(raw ?? \"\").replace(/\\D/g, \"\");\n if (d.length === 11 && d[0] === \"1\") d = d.slice(1);\n return d.length === 10 ? d : null;\n}\nfunction formatPhone(ten: string) {\n return `(${ten.slice(0, 3)}) ${ten.slice(3, 6)}-${ten.slice(6)}`;\n}\nfunction uniq(list: string[]) {\n const seen = new Set();\n return list.filter((v) => {\n const k = String(v).toLowerCase();\n if (!v || seen.has(k)) return false;\n seen.add(k);\n return true;\n });\n}\n\nconst STREET_SUFFIX =\n \"(?:Street|St|Avenue|Ave|Av|Road|Rd|Boulevard|Blvd|Drive|Dr|Lane|Ln|Place|Pl|Court|Ct|Way|Parkway|Pkwy|Terrace|Ter|Highway|Hwy|Square|Sq|Plaza|Plz|Circle|Cir)\";\nconst STREET_DIRECTIONAL = /^(n|s|e|w|north|south|east|west|ne|nw|se|sw)\\.?$/i;\nconst STREET_SUFFIX_RE = new RegExp(`^${STREET_SUFFIX}$`, \"i\");\n\ntype Addr = { number: string; core: string; raw: string };\n\n/** \"127 E 56th St\" -> { number: \"127\", core: \"56\", raw: \"127 E 56th St\" } */\nfunction parseStreet(raw: string, num: string, name: string): Addr | null {\n const tokens = name.replace(/[.,]/g, \" \").trim().split(/\\s+/)\n .filter((t) => t && !STREET_DIRECTIONAL.test(t) && !STREET_SUFFIX_RE.test(t));\n if (!tokens.length) return null;\n let core = tokens.reduce((best, t) => (t.length > best.length ? t : best), \"\");\n const ordinal = core.match(/^(\\d+)(st|nd|rd|th)$/i);\n if (ordinal) core = ordinal[1];\n if (core.length < 2) return null;\n return { number: num, core, raw: raw.replace(/\\s+/g, \" \").trim() };\n}\n\nfunction extractAddresses(text: string): Addr[] {\n const out: Addr[] = [];\n let m: RegExpExecArray | null;\n const noSuffix = /\\b(\\d{1,6})\\s+(Broadway|Bowery|Park Row|Avenue\\s+[A-Z]\\b|Ave\\.?\\s+[A-Z]\\b)/gi;\n while ((m = noSuffix.exec(text)) !== null) {\n const a = parseStreet(m[0], m[1], m[2]);\n if (a) out.push(a);\n }\n const withSuffix = new RegExp(\n `\\\\b(\\\\d{1,6})\\\\s+((?:[A-Za-z0-9][A-Za-z0-9.'-]*\\\\s+){0,3}[A-Za-z0-9][A-Za-z0-9.'-]*)\\\\s+${STREET_SUFFIX}\\\\b\\\\.?`,\n \"gi\",\n );\n while ((m = withSuffix.exec(text)) !== null) {\n const a = parseStreet(m[0], m[1], m[2]);\n if (a) out.push(a);\n }\n const seen = new Set();\n return out.filter((a) => {\n const k = `${a.number}|${a.core.toLowerCase()}`;\n if (seen.has(k) || OWN_ADDRESSES.has(k)) return false;\n seen.add(k);\n return true;\n });\n}\n\nexport function extractSignals(fromHeader: string, subject: string, body: string) {\n const text = `${subject ?? \"\"}\\n${body ?? \"\"}`;\n const emails: string[] = [];\n const fromEmail = (fromHeader ?? \"\").match(/[\\w.+-]+@[\\w-]+\\.[\\w.-]+/);\n if (fromEmail) emails.push(fromEmail[0].toLowerCase());\n for (const e of text.match(/[\\w.+-]+@[\\w-]+\\.[\\w.-]+/g) ?? []) {\n emails.push(e.toLowerCase().replace(/[.,;:]+$/, \"\"));\n }\n const cleanEmails = uniq(emails).filter((e) => !e.includes(`@${OWN_DOMAIN}`));\n\n const phones: string[] = [];\n for (const p of text.match(/(?:\\+?1[-.\\s]?)?\$?\\d{3}\$?[-.\\s]?\\d{3}[-.\\s]?\\d{4}\\b/g) ?? []) {\n const ten = normalizePhone(p);\n if (ten && !OWN_PHONES.has(ten)) phones.push(ten);\n }\n\n const names: string[] = [];\n const nameMatch = (fromHeader ?? \"\").match(/^\"?([^\"<]+?)\"?\\s*<[\\w.+-]+@/);\n if (nameMatch) {\n const n = nameMatch[1].replace(/\\s+via\\s+.*$/i, \"\").replace(/[^\\w\\s.'&-]/g, \" \").replace(/\\s+/g, \" \").trim();\n if (n && !/tribeca/i.test(n)) names.push(n);\n }\n // A portal request is sent by us on the customer's behalf, so the From name\n // is \"TriBeCa Beverage Company\" and is thrown away just above. The account\n // name in the subject is the real one, and it is exact rather than a guess,\n // so it goes to the front of the queue.\n const portalName = portalAccountName(subject ?? \"\");\n if (portalName) names.unshift(portalName);\n\n return { emails: cleanEmails, phones: uniq(phones), addresses: extractAddresses(text), names: uniq(names) };\n}\n\nexport function describeSignals(s: ReturnType) {\n const parts: string[] = [];\n if (s.emails.length) parts.push(`email ${s.emails.join(\", \")}`);\n if (s.phones.length) parts.push(`phone ${s.phones.map(formatPhone).join(\", \")}`);\n if (s.addresses.length) parts.push(`address ${s.addresses.map((a) => a.raw).join(\"; \")}`);\n if (s.names.length) parts.push(`name ${s.names.join(\", \")}`);\n return parts.join(\" / \");\n}\n\n/** Search in priority order and stop at the first tier that hits. */\nexport async function lookupAccounts(sig: ReturnType) {\n if (sig.emails.length) {\n const list = sig.emails.map((e) => `'${esc(e)}'`).join(\", \");\n const r = (await sfQuery(`SELECT ${ACCOUNT_FIELDS} FROM Account WHERE Email_Address__c IN (${list}) LIMIT 10`)).records ?? [];\n if (r.length) {\n const hit = sig.emails.find((e) => r.some((a: any) => (a.Email_Address__c ?? \"\").toLowerCase() === e));\n return { accounts: r, matchedOn: `email ${hit ?? sig.emails[0]}`, tier: \"email\" };\n }\n }\n for (const ten of sig.phones) {\n const cands = (await sfQuery(`SELECT ${ACCOUNT_FIELDS} FROM Account WHERE Phone LIKE '%${esc(ten.slice(-4))}' LIMIT 50`)).records ?? [];\n const exact = cands.filter((a: any) => normalizePhone(a.Phone ?? \"\") === ten);\n if (exact.length) return { accounts: exact, matchedOn: `phone ${formatPhone(ten)}`, tier: \"phone\" };\n }\n for (const addr of sig.addresses) {\n const like = `'%${esc(addr.number)} %${esc(addr.core)}%'`;\n const rows = (await sfQuery(\n `SELECT ${ACCOUNT_FIELDS} FROM Account WHERE ShippingStreet LIKE ${like} OR BillingStreet LIKE ${like} LIMIT 20`,\n )).records ?? [];\n const confirmed = rows.filter((a: any) =>\n [a.ShippingStreet, a.BillingStreet].some((street) =>\n String(street ?? \"\").split(/\\r?\\n/).some((line) => {\n const t = line.trim();\n return new RegExp(`^${addr.number}\\\\b`).test(t) && t.toLowerCase().includes(addr.core.toLowerCase());\n })\n )\n );\n if (confirmed.length) return { accounts: confirmed, matchedOn: `address ${addr.raw}`, tier: \"address\" };\n }\n for (const name of sig.names) {\n if (!(/\\s/.test(name) || name.length >= 4)) continue;\n const rows = (await sfQuery(\n `SELECT ${ACCOUNT_FIELDS} FROM Account WHERE Name LIKE '%${esc(name)}%' ORDER BY LastModifiedDate DESC LIMIT 10`,\n )).records ?? [];\n if (rows.length) {\n return {\n accounts: rows,\n matchedOn: `name \"${name}\"${rows.length > 1 ? ` (${rows.length} accounts, check the alternates)` : \"\"}`,\n tier: \"name\",\n };\n }\n }\n return { accounts: [], matchedOn: \"\", tier: \"none\" };\n}\n\n// ---------------------------------------------------------------------------\n// Record of what was decided. Doubles as the dedupe record and the digest queue.\n// ---------------------------------------------------------------------------\n\nasync function ensureTable() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS triage_v1 (\n message_id TEXT PRIMARY KEY,\n decided_at INTEGER NOT NULL,\n verdict TEXT NOT NULL,\n sender TEXT,\n subject TEXT,\n account_id TEXT,\n account_name TEXT,\n matched_on TEXT,\n summary TEXT,\n needs_human TEXT,\n actions_json TEXT,\n thread_id TEXT,\n digested INTEGER NOT NULL DEFAULT 0\n )`);\n // The email itself, so the panel can show what the customer actually wrote\n // instead of only a summary of it. Added after the fact, hence the ALTER:\n // the table already exists in production. Treated as content, so purge wipes\n // it at 24 hours along with the subject and summary.\n try {\n await sqlite.execute(\"ALTER TABLE triage_v1 ADD COLUMN body TEXT\");\n } catch { /* already there; SQLite has no ADD COLUMN IF NOT EXISTS */ }\n // 0 = leave the message alone (the default, and what almost every row stays).\n // 1 = every proposed change was applied and nothing was left for a person, so\n // the sweep may mark it read in Gmail. 2 = the sweep has done so.\n try {\n await sqlite.execute(\"ALTER TABLE triage_v1 ADD COLUMN mark_read INTEGER NOT NULL DEFAULT 0\");\n } catch { /* already there */ }\n\n // THE OUTCOME LEDGER: what we proposed, and what the office actually did.\n //\n // Separate table on purpose. triage_v1 is email content and is wiped at 24\n // hours, which means the evidence for \"was that proposal right?\" disappears\n // exactly as fast as it accumulates - the only reason a comparison was\n // possible on 2026-09-11 is that the proposals happened to be hours old.\n // This table holds no email: an id, a field name, and the values. It can\n // therefore be kept long enough to say something.\n //\n // Account.Name and Email_Address__c ARE customer data, so for those the\n // values are stored as a hash. Agreement is still computable (equal hashes\n // mean equal values) without keeping the name or address itself.\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS outcome_v1 (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n message_id TEXT NOT NULL,\n proposed_at INTEGER NOT NULL,\n sobject TEXT NOT NULL,\n record_id TEXT NOT NULL,\n field TEXT NOT NULL,\n proposed_from TEXT,\n proposed_to TEXT,\n assumed INTEGER NOT NULL DEFAULT 0,\n hashed INTEGER NOT NULL DEFAULT 0,\n applied_by_us INTEGER NOT NULL DEFAULT 0,\n observed_at INTEGER,\n observed_value TEXT,\n observed_by TEXT,\n verdict TEXT\n )`);\n await sqlite.execute(\n \"CREATE INDEX IF NOT EXISTS outcome_v1_unobserved ON outcome_v1 (observed_at, proposed_at)\",\n );\n}\n\n// Values for these are never stored in the clear - see the note above.\nconst PERSONAL_FIELDS = new Set([\"Name\", \"Email_Address__c\"]);\n\nasync function digest8(v: unknown) {\n const data = new TextEncoder().encode(String(v ?? \"\"));\n const buf = await crypto.subtle.digest(\"SHA-256\", data);\n return [...new Uint8Array(buf)].slice(0, 8).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/** Record each proposed field change so it can be compared with reality later. */\nasync function recordProposals(messageId: string, actions: any[]) {\n for (const a of actions ?? []) {\n const personal = PERSONAL_FIELDS.has(String(a.field));\n const from = personal ? await digest8(a.currentValue) : String(a.currentValue ?? \"\");\n const to = personal ? await digest8(a.newValue) : String(a.newValue ?? \"\");\n await sqlite.execute({\n sql: `INSERT INTO outcome_v1\n (message_id, proposed_at, sobject, record_id, field, proposed_from, proposed_to, assumed, hashed)\n VALUES (?,?,?,?,?,?,?,?,?)`,\n args: [messageId, Date.now(), String(a.sobject), String(a.id), String(a.field),\n from, to, a.assumed ? 1 : 0, personal ? 1 : 0],\n });\n }\n}\n\nasync function alreadySeen(messageId: string) {\n const r = await sqlite.execute({ sql: \"SELECT verdict FROM triage_v1 WHERE message_id = ?\", args: [messageId] });\n return r.rows.length ? String((r.rows[0] as any).verdict ?? \"\") : null;\n}\n\n/** `body` is kept only for rows the panel will show; a no-match needs none. */\nasync function store(v: any, body: string | null = null) {\n await sqlite.execute({\n sql: `INSERT OR REPLACE INTO triage_v1\n (message_id, decided_at, verdict, sender, subject, account_id, account_name, matched_on, summary, needs_human, actions_json, thread_id, body, digested)\n VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,0)`,\n args: [\n v.messageId, Date.now(), v.verdict, v.from ?? \"\", v.subject ?? \"\",\n v.account?.Id ?? null, v.account?.Name ?? null, v.matchedOn ?? \"\",\n v.summary ?? \"\", v.needs_human ?? \"\", JSON.stringify(v.actions ?? []),\n v.threadId ?? null,\n // Enough to read the request and the quoted thread under it, without\n // keeping a 250KB invoice email around.\n body ? body.slice(0, 8000) : null,\n ],\n });\n}\n\n// ---------------------------------------------------------------------------\n\nconst SELF = \"https://tribeca_airep--8afdccb8abcb11f18b091607ee4eb77e.web.val.run\";\n\n// ---------------------------------------------------------------------------\n// The panel: a password-protected page that can apply changes.\n//\n// The master key can never be handed to a browser - it also unlocks arbitrary\n// SOQL on main.ts - so the page holds no key at all. It proves who it is with a\n// signed session cookie, and this val makes the privileged call to /apply\n// server-side, supplying both the master key and the approval password from its\n// own env. Neither ever reaches the page.\n//\n// The password (PANEL_PASSWORD) is therefore the whole gate, which is why the\n// link alone no longer shows anything: knowing the URL is not knowing the\n// password. Fails closed if the env var is missing.\n// ---------------------------------------------------------------------------\nconst COOKIE = \"sfpanel\";\nconst SESSION_MS = 12 * 60 * 60 * 1000;\n\nasync function sign(data: string) {\n const secret = Deno.env.get(\"API_SHARED_SECRET\") ?? \"\";\n const key = await crypto.subtle.importKey(\n \"raw\", new TextEncoder().encode(secret), { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"],\n );\n const sig = await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(data));\n return [...new Uint8Array(sig)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/** Constant time, so a wrong cookie cannot be tuned byte by byte. */\nfunction same(a: string, b: string) {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\n\nasync function hasSession(req: Request) {\n const raw = (req.headers.get(\"cookie\") ?? \"\").split(/;\\s*/)\n .find((c) => c.startsWith(`${COOKIE}=`));\n if (!raw) return false;\n const [exp, sig] = decodeURIComponent(raw.slice(COOKIE.length + 1)).split(\".\");\n if (!exp || !sig || !/^\\d+$/.test(exp) || Number(exp) < Date.now()) return false;\n return same(await sign(exp), sig);\n}\n\nasync function sessionCookie() {\n const exp = String(Date.now() + SESSION_MS);\n const v = `${exp}.${await sign(exp)}`;\n return `${COOKIE}=${encodeURIComponent(v)}; Path=/; Max-Age=${SESSION_MS / 1000}; ` +\n `HttpOnly; Secure; SameSite=Strict`;\n}\n\nfunction loginPage(failed: boolean) {\n return `` +\n `` +\n `Inbox sweep` +\n `

` +\n `

Inbox sweep

` +\n `

This page can change Salesforce. Enter the password.

` +\n (failed ? `

Wrong password.

` : \"\") +\n `

`;\n}\n\n/** Apply the ticked changes for one message, using what triage already stored. */\nasync function panelApply(body: any) {\n const messageId = String(body.messageId ?? \"\");\n const indexes: number[] = Array.isArray(body.indexes) ? body.indexes.map(Number) : [];\n if (!messageId || !indexes.length) return json({ error: \"Nothing to apply.\" }, 400);\n\n const row = (await sqlite.execute({\n sql: \"SELECT actions_json, needs_human FROM triage_v1 WHERE message_id = ?\",\n args: [messageId],\n })).rows[0] as any;\n if (!row) return json({ error: \"That message is no longer on file. Reload the page.\" }, 404);\n\n let stored: any[] = [];\n try {\n stored = JSON.parse(String(row.actions_json ?? \"[]\"));\n } catch { /* fall through to the empty check */ }\n // Content is wiped at 24 hours, so an old tab can point at a row that no\n // longer holds anything to apply.\n if (!stored.length) return json({ error: \"This item has aged out. Reload the page.\" }, 410);\n\n const chosen = indexes\n .filter((i) => Number.isInteger(i) && i >= 0 && i < stored.length)\n .map((i) => stored[i]);\n if (!chosen.length) return json({ error: \"Nothing to apply.\" }, 400);\n\n const password = Deno.env.get(\"EMAIL_ACTIONS_APPROVAL_PASSWORD\");\n if (!password) return json({ error: \"Approval password is not configured on the server.\" }, 500);\n\n const res = await fetch(`${SELF}/apply`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", \"x-api-key\": Deno.env.get(\"API_SHARED_SECRET\") ?? \"\" },\n body: JSON.stringify({ actions: chosen, password }),\n signal: AbortSignal.timeout(60_000),\n });\n const out = await res.json();\n\n // MAY THE SWEEP MARK THIS ONE READ? Only on the strictest reading of \"done\".\n //\n // Applying one field is not the same as the email being dealt with. Aurora\n // Ortega asked for a different bottle count AND an urgent delivery, and a\n // person may still owe her a reply; info@ is shared, so marking that read\n // buries it for whoever else works the inbox. So all four must hold: every\n // proposed change was ticked, every one of them actually landed, none failed,\n // and the model left nothing for a person. Anything less and the message\n // stays unread, which is the safe direction to be wrong in.\n const everythingTicked = chosen.length === stored.length;\n const everythingLanded = out?.applied === stored.length && !out?.failed;\n const nothingForAPerson = !String(row.needs_human ?? \"\").trim();\n if (res.ok && everythingTicked && everythingLanded && nothingForAPerson) {\n await sqlite.execute({\n sql: \"UPDATE triage_v1 SET mark_read = 1 WHERE message_id = ?\",\n args: [messageId],\n });\n }\n\n // /apply re-reads every record and re-checks every guard, so a change that has\n // gone stale since the sweep is rejected there rather than written blindly.\n return json(out, res.ok ? 200 : res.status);\n}\n\nasync function propose(emailText: string, account: any, opportunity: any, model?: string) {\n // Header, never ?key=. See the note in the handler: query strings land in\n // Val Town's traces verbatim and stay there.\n const res = await fetch(`${SELF}/propose`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", \"x-api-key\": Deno.env.get(\"API_SHARED_SECRET\") ?? \"\" },\n body: JSON.stringify({ emailText, account, opportunity, ...(model ? { model } : {}) }),\n signal: AbortSignal.timeout(60_000),\n });\n return await res.json();\n}\n\nasync function triage(body: any) {\n const from = String(body.from ?? \"\");\n const subject = String(body.subject ?? \"\");\n const text = String(body.body ?? \"\");\n const messageId = body.messageId ? String(body.messageId) : null;\n const record = body.record !== false;\n if (!from && !subject && !text) return json({ error: \"from, subject or body is required\" }, 400);\n\n await ensureTable();\n\n if (messageId && !body.force) {\n const seen = await alreadySeen(messageId);\n if (seen) return json({ skipped: true, reason: \"already triaged\", verdict: seen, label: labelFor(seen), messageId });\n }\n\n // Free filters first - but a portal request is exempt from both of them. It\n // comes from our own address and it is machine-written, so it was being\n // dropped twice over, and it is the one kind of mail here that states the\n // customer's request outright. See PORTAL_SUBJECT.\n const isPortal = PORTAL_SUBJECT.test(subject);\n if (!isPortal && from.toLowerCase().includes(OWN_DOMAIN)) {\n return json({ skipped: true, reason: \"our own mail\", verdict: \"skipped\", label: \"\", messageId });\n }\n if (!isPortal && (SKIP_SENDER.test(from) || SKIP_SUBJECT.test(subject))) {\n return json({ skipped: true, reason: \"machine mail\", verdict: \"skipped\", label: \"\", messageId });\n }\n\n // A typed search from the card's home page is treated like a tiny email:\n // anything shaped like an address, phone or street matches as that, and\n // whatever is left over is treated as a name.\n let signals;\n if (body.searchQuery) {\n const q = String(body.searchQuery).trim();\n signals = extractSignals(\"\", \"\", q);\n if (!signals.emails.length && !signals.phones.length && !signals.addresses.length) {\n signals = { ...signals, names: [q] };\n }\n } else {\n signals = extractSignals(from, subject, text);\n }\n const found = await lookupAccounts(signals);\n\n const base: any = {\n skipped: false,\n messageId,\n threadId: body.threadId ?? null,\n from,\n subject,\n signals: { ...signals, described: describeSignals(signals) },\n matchedOn: found.matchedOn,\n matchTier: found.tier,\n account: found.accounts[0] ?? null,\n alternates: found.accounts.slice(1, 5).map((a: any) => ({ Id: a.Id, Name: a.Name, Phone: a.Phone, Email_Address__c: a.Email_Address__c })),\n };\n\n if (!found.accounts.length) {\n base.verdict = \"nomatch\";\n base.label = labelFor(\"nomatch\");\n if (record && messageId) await store(base);\n return json(base);\n }\n\n const account = { ...found.accounts[0] };\n const latestOpp = account.Opportunities?.records?.[0] ?? null;\n delete account.Opportunities;\n base.account = account;\n\n // THE OPEN DELIVERY, NOT THE NEWEST RECORD. The subquery above orders by\n // CreatedDate, so for a customer whose most recent Opportunity has already\n // been Delivered it hands back a closed one - and every guard in the catalog\n // requires stage 'Delivery Due', so a genuine \"where is my water\" email came\n // back with nothing to do. Found by replaying a real hour of inbox on\n // 2026-09-10. Cost is one extra query per matched account.\n const openOpp = (await sfQuery(\n `SELECT Id, Name, StageName, CloseDate, Route_Date__c, Needs_Delivery_ASAP__c FROM Opportunity\n WHERE AccountId = '${esc(String(account.Id))}' AND StageName = 'Delivery Due'\n ORDER BY CloseDate ASC LIMIT 1`,\n )).records?.[0] ?? null;\n const opportunity = openOpp ?? latestOpp;\n base.opportunity = opportunity;\n\n // LOOKUP ONLY. The card calls this when someone merely opens an email, so it\n // must not spend a model call: it wants the account, the delivery and the\n // alternates to draw with, and nothing more. The Analyze button then calls\n // again without this flag. Without the split, every email anyone opened -\n // including spam - would cost an analysis.\n if (body.lookupOnly) {\n base.verdict = \"lookup\";\n base.label = \"\";\n return json(base);\n }\n\n const analysis = await propose(`Subject: ${subject}\\n\\n${text}`, account, opportunity, body.model);\n if (analysis?.error) return json({ ...base, error: analysis.error }, 500);\n\n base.account = account;\n base.opportunity = opportunity;\n base.model = analysis.model ?? null;\n base.summary = analysis.summary ?? \"\";\n base.recommendation = analysis.recommendation ?? \"\";\n base.needs_human = analysis.needs_human ?? \"\";\n base.actions = analysis.actions ?? [];\n base.skippedActions = analysis.skipped ?? [];\n // \"none\" must mean \"nobody needs to do anything\", not \"no field changed\".\n // A matched customer asking when their delivery is, or asking for a one-off\n // change we have no field for, produced no actions AND an empty needs_human,\n // so it landed in \"none\" and would have dropped out of the digest entirely.\n // If the model recommended anything other than doing nothing, that is a\n // person's job. Seen on real mail 2026-09-10.\n const rec = String(base.recommendation ?? \"\").trim();\n const recommendsNothing = !rec || /^\\s*(no action needed|none|n\\/?a)\\b/i.test(rec);\n base.verdict = base.actions.length\n ? \"action\"\n : (base.needs_human || !recommendsNothing ? \"human\" : \"none\");\n if (!base.actions.length && !base.needs_human && !recommendsNothing) {\n base.needs_human = rec;\n }\n base.label = labelFor(base.verdict);\n\n if (record && messageId) {\n await store(base, text);\n await recordProposals(messageId, base.actions);\n }\n return json(base);\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n // THE PANEL ROUTES ARE GATED BY THE PASSWORD, NOT BY A KEY. They come first\n // so that no key in a URL can reach them: a link on its own now shows a login\n // form and nothing else.\n const p = url.pathname;\n if (p.endsWith(\"/digest-login\") || p.endsWith(\"/digest-preview\") ||\n p.endsWith(\"/digest-apply\") || p.endsWith(\"/digest-logout\")) {\n const expected = Deno.env.get(\"PANEL_PASSWORD\");\n if (!expected) {\n return new Response(\"The panel password is not configured on the server.\", { status: 500 });\n }\n\n if (p.endsWith(\"/digest-logout\")) {\n return new Response(\"\", {\n status: 302,\n headers: { \"Location\": \"digest-preview\", \"Set-Cookie\": `${COOKIE}=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Strict` },\n });\n }\n\n if (p.endsWith(\"/digest-login\")) {\n if (req.method !== \"POST\") return new Response(\"POST required\", { status: 405 });\n const form = await req.formData();\n if (!same(String(form.get(\"password\") ?? \"\"), expected)) {\n // Deliberately slow, so the one gate on this page cannot be guessed at\n // speed. A person typing it once will not notice.\n await new Promise((r) => setTimeout(r, 1000));\n return new Response(loginPage(true), {\n status: 401,\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n }\n return new Response(\"\", {\n status: 302,\n headers: { \"Location\": \"digest-preview\", \"Set-Cookie\": await sessionCookie() },\n });\n }\n\n if (!(await hasSession(req))) {\n if (p.endsWith(\"/digest-apply\")) return json({ error: \"Session expired. Reload the page.\" }, 401);\n return new Response(loginPage(false), {\n status: 401,\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n }\n\n if (p.endsWith(\"/digest-apply\")) {\n if (req.method !== \"POST\") return json({ error: \"POST required\" }, 405);\n try {\n return await panelApply(await req.json());\n } catch (err) {\n return json({ error: String(err) }, 500);\n }\n }\n\n // The page itself, now with tick boxes and an Apply button.\n await ensureTable();\n const { renderDigest } = await import(\"./digest.ts\");\n // FILTER AND ORDER IN SQL, NOT AFTERWARDS.\n //\n // This used to take the 60 oldest rows of ANY verdict and only then keep the\n // action/human ones in JavaScript. Most rows are 'nomatch' or 'none', so the\n // limit was spent on rows the page never draws: with 115 rows pending, 47 of\n // them showable, the page drew 28 and silently dropped the 19 newest. The\n // panel was showing yesterday's work and hiding this morning's. Found\n // 2026-09-11. Newest first for the same reason - a fresh customer email\n // matters more than one that has sat here since last night.\n const undigested = url.searchParams.get(\"all\") ? \"\" : \"AND digested = 0\";\n const rows = (await sqlite.execute(\n `SELECT * FROM triage_v1\n WHERE verdict IN ('action','human') ${undigested}\n ORDER BY decided_at DESC LIMIT 100`,\n )).rows as any[];\n const html = renderDigest(\n rows.filter((r) => r.verdict === \"action\"),\n rows.filter((r) => r.verdict === \"human\"),\n true,\n );\n return new Response(html, { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } });\n }\n\n // TWO KEYS, ON PURPOSE, AND ONE OF THEM MUST NOT TRAVEL IN A URL.\n //\n // Val Town records the full request URL in its traces, so a key passed as\n // ?key= is written to platform logs on every single call and cannot be\n // purged (verified 2026-09-10). API_SHARED_SECRET also unlocks arbitrary\n // SOQL on main.ts, so publishing it that way is the worst option available.\n // It is therefore accepted ONLY as a header here.\n //\n // The read-only pages are the exception: a browser following a link cannot\n // set a header. Those use VIEW_KEY, which shows recent triage results and\n // grants nothing else, so leaking it costs a rotation rather than the org.\n const headerKey = req.headers.get(\"x-api-key\");\n const queryKey = url.searchParams.get(\"key\");\n const master = Deno.env.get(\"API_SHARED_SECRET\");\n // Two view keys are accepted only because Val Town will not show a stored\n // value back to you and has no update-in-place tool, so replacing one means\n // adding the new alongside the old. Delete VIEW_KEY in the UI and drop it\n // from this list once the new link is in use.\n const viewKeys = [Deno.env.get(\"VIEW_KEY\"), Deno.env.get(\"VIEW_KEY_2\")]\n .filter((k): k is string => !!k);\n const isMaster = !!master && headerKey === master;\n const isViewer = viewKeys.some((k) => headerKey === k || queryKey === k);\n\n const isPage = req.method === \"GET\" &&\n (url.pathname.endsWith(\"/inbound\") || url.pathname.endsWith(\"/digest-preview\"));\n\n if (isPage ? !(isViewer || isMaster) : !isMaster) {\n return new Response(\n isPage\n ? \"Unauthorized\"\n : \"Unauthorized. Send the key as an x-api-key header, not in the URL.\",\n { status: 401 },\n );\n }\n\n await ensureTable();\n\n if (req.method === \"GET\") {\n // Kept only so an old bookmark says something sensible. Forwarding was\n // dropped on 2026-09-10: an email val is an unauthenticated front door, and\n // anyone who worked out its address could have injected invented customers.\n // The add-on now pushes to /triage with a key instead.\n if (url.pathname.endsWith(\"/inbound\")) {\n return new Response(\n \"Forwarding was removed. The add-on now pushes messages to /triage with a key, \" +\n \"so there is no open address to receive mail. See /digest-preview.\",\n { status: 410, headers: { \"Content-Type\": \"text/plain; charset=utf-8\" } },\n );\n }\n if (url.pathname.endsWith(\"/inbound-old-disabled\")) {\n let rows: any[] = [];\n try {\n rows = (await sqlite.execute(\n \"SELECT * FROM inbound_test ORDER BY id DESC LIMIT 20\",\n )).rows as any[];\n } catch {\n rows = []; // table only exists once something has been received\n }\n const esc2 = (v: unknown) =>\n String(v ?? \"\").replace(/&/g, \"&\").replace(//g, \">\");\n let html = `` +\n `

` +\n `

Mail that reached Val Town

` +\n `

Newest first. The line that matters is From.

`;\n if (!rows.length) {\n html += `

Nothing has arrived yet.

`;\n }\n for (const r of rows) {\n let headers: Record = {};\n try {\n headers = JSON.parse(String(r.headers_json ?? \"{}\"));\n } catch { /* keep going, a bad row should still render */ }\n const notable = Object.keys(headers).filter((k) =>\n /^(from|reply-to|return-path|sender|delivered-to|x-forwarded|x-original|resent-)/i.test(k)\n );\n html += `

`;\n html += `

${esc2(new Date(Number(r.received_at)).toLocaleString(\"en-US\", { timeZone: \"America/New_York\" }))}

`;\n html += `

From: ${esc2(r.sender)}

`;\n html += `

To: ${esc2(r.recipients)}

`;\n html += `

Subject: ${esc2(r.subject)}

`;\n if (notable.length) {\n html += `

Routing headers

`;\n          for (const k of notable) html += `${esc2(k)}: ${esc2(headers[k])}\\n`;\n          html += `

`;\n }\n // What triage made of it. This is the half that matters once the\n // plumbing is proven: matched account, verdict, and the exact changes.\n let t: any = null;\n try {\n t = r.triage_json ? JSON.parse(String(r.triage_json)) : null;\n } catch { /* render the rest anyway */ }\n if (t) {\n const colour = t.verdict === \"action\" ? \"#1a73e8\" : t.verdict === \"human\" ? \"#f9ab00\" : \"#9aa0a6\";\n html += `

`;\n if (t.error) {\n html += `

Triage failed: ${esc2(t.error)}

`;\n } else {\n html += `

Verdict: ${esc2(t.verdict ?? \"-\")}${t.skipped ? ` (skipped: ${esc2(t.reason)})` : \"\"}

`;\n html += `

Matched: ${esc2(t.matchedOn || \"no account matched\")}` +\n (t.account?.Name ? ` → ${esc2(t.account.Name)}` : \"\") + `

`;\n if (t.signals?.described) {\n html += `

Looked for: ${esc2(t.signals.described)}

`;\n }\n if (t.summary) html += `

${esc2(t.summary)}

`;\n for (const a of t.actions ?? []) {\n html += `

→ ${esc2(a.label)}: ${esc2(fmtCell(a.currentValue))} → ${esc2(fmtCell(a.newValue))}` +\n (a.assumed ? ` [date assumed]` : \"\") + `

`;\n }\n if (t.needs_human) {\n html += `

Needs a person: ${esc2(t.needs_human)}

`;\n }\n if (t.model) html += `

Analysis by ${esc2(t.model)}

`;\n }\n html += `

`;\n } else {\n html += `

No triage recorded for this message.

`;\n }\n html += `

Body

` +\n `

${esc2(r.text_head)}

`;\n html += `

`;\n }\n html += `

`;\n return new Response(html, { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } });\n }\n // The exact email the cron would send, without sending it or marking\n // anything as sent. Add ?verdict=all to include rows already digested.\n if (url.pathname.endsWith(\"/digest-preview\")) {\n const { renderDigest } = await import(\"./digest.ts\");\n const where = url.searchParams.get(\"all\") ? \"\" : \"WHERE digested = 0\";\n const rows = (await sqlite.execute(\n `SELECT * FROM triage_v1 ${where} ORDER BY decided_at ASC LIMIT 60`,\n )).rows as any[];\n const html = renderDigest(\n rows.filter((r) => r.verdict === \"action\"),\n rows.filter((r) => r.verdict === \"human\"),\n );\n return new Response(html, { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } });\n }\n // The sweep asks \"anything I should mark read?\" once per run. Gmail can\n // only be touched from Apps Script, so the val decides and the sweep acts.\n if (url.pathname.endsWith(\"/to-mark-read\")) {\n const r = await sqlite.execute(\n \"SELECT message_id, thread_id FROM triage_v1 WHERE mark_read = 1 LIMIT 50\",\n );\n return json({ messages: r.rows });\n }\n // Agreement, per field: of the proposals the office has since acted on,\n // how often did they land on the value we proposed? 'untouched' rows are\n // excluded from the rate because they mostly mean \"nobody has dealt with it\n // yet\", not \"they disagreed\".\n if (url.pathname.endsWith(\"/outcomes\")) {\n const byField = (await sqlite.execute(\n `SELECT sobject, field, assumed,\n SUM(verdict = 'agreed') agreed,\n SUM(verdict = 'diverged') diverged,\n SUM(verdict = 'untouched') untouched,\n SUM(observed_at IS NULL) pending\n FROM outcome_v1 GROUP BY sobject, field, assumed\n ORDER BY agreed + diverged DESC`,\n )).rows as any[];\n const divergences = (await sqlite.execute(\n `SELECT sobject, field, proposed_from, proposed_to, observed_value, observed_by,\n assumed, hashed, proposed_at\n FROM outcome_v1 WHERE verdict = 'diverged'\n ORDER BY proposed_at DESC LIMIT 100`,\n )).rows as any[];\n const rate = (r: any) => {\n const decided = Number(r.agreed) + Number(r.diverged);\n return decided ? Math.round((100 * Number(r.agreed)) / decided) : null;\n };\n return json({\n note:\n \"agreement_pct counts only proposals the office has acted on. 'untouched' means nobody has dealt with it, which is not disagreement.\",\n byField: byField.map((r) => ({ ...r, agreement_pct: rate(r) })),\n divergences,\n });\n }\n if (url.pathname.endsWith(\"/pending\")) {\n const r = await sqlite.execute(\"SELECT * FROM triage_v1 WHERE digested = 0 ORDER BY decided_at DESC LIMIT 100\");\n return json({ pending: r.rows });\n }\n const r = await sqlite.execute(\"SELECT message_id, decided_at, verdict, account_name, subject, matched_on FROM triage_v1 ORDER BY decided_at DESC LIMIT 30\");\n return json({ ok: true, routes: [\"POST /triage\", \"GET /triage/pending\", \"GET /triage/recent\"], recent: r.rows });\n }\n if (req.method !== \"POST\") return json({ error: \"POST required\" }, 405);\n\n let body: any;\n try {\n body = await req.json();\n } catch {\n return json({ error: \"Invalid JSON body\" }, 400);\n }\n // The sweep reports back which ones it actually marked, so they are not\n // offered again on the next run.\n if (url.pathname.endsWith(\"/marked-read\")) {\n const ids = (Array.isArray(body?.messageIds) ? body.messageIds : []).map(String).slice(0, 50);\n if (!ids.length) return json({ updated: 0 });\n await sqlite.execute({\n sql: `UPDATE triage_v1 SET mark_read = 2\n WHERE mark_read = 1 AND message_id IN (${ids.map(() => \"?\").join(\",\")})`,\n args: ids,\n });\n return json({ updated: ids.length });\n }\n\n try {\n return await triage(body);\n } catch (err) {\n return json({ error: String(err) }, 500);\n }\n}\n",[155],"dd222e53-0f2b-4397-a2e2-a850cba4c1bc","summarize.ts","f2354b70-8a80-11f1-b11c-1607ee4eb77e",4,["D",1785242184864],"function buildPrompt(emailText: string, account: unknown, opportunity: unknown): string {\n return `You help staff at a bottled water delivery company (Tribeca Beverage) quickly triage customer emails.\n\nCustomer email:\n\"\"\"\n${emailText}\n\"\"\"\n\nKnown Salesforce Account data (read-only):\n${JSON.stringify(account)}\n\nKnown Salesforce latest delivery record (Opportunity, read-only):\n${JSON.stringify(opportunity)}\n\nRespond with ONLY valid JSON, no markdown fences, in this exact shape:\n{\"summary\": \"one or two sentence plain-English summary of what the customer wants\", \"recommendation\": \"a specific, actionable recommendation for what staff should check or update in Salesforce, referencing exact field names when relevant; say 'No action needed' if nothing needs changing\"}`;\n}\n\nasync function callGemini(prompt: string): Promise<{ summary: string; recommendation: string }> {\n const apiKey = Deno.env.get(\"GEMINI_API_KEY\")!;\n const res = await fetch(\n `https://generativelanguage.googleapis.com/v1beta/models/gemini-flash-latest:generateContent?key=${apiKey}`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n contents: [{ parts: [{ text: prompt }] }],\n }),\n },\n );\n\n if (!res.ok) {\n throw new Error(`Gemini request failed: ${res.status} ${await res.text()}`);\n }\n\n const data = await res.json();\n const text = data?.candidates?.[0]?.content?.parts?.[0]?.text ?? \"\";\n const cleaned = text.replace(/```json|```/g, \"\").trim();\n\n try {\n return JSON.parse(cleaned);\n } catch {\n return { summary: text, recommendation: \"\" };\n }\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const providedKey = url.searchParams.get(\"key\") ?? req.headers.get(\"x-api-key\");\n if (providedKey !== Deno.env.get(\"API_SHARED_SECRET\")) {\n return new Response(\"Unauthorized\", { status: 401 });\n }\n\n if (req.method !== \"POST\") {\n return new Response(JSON.stringify({ error: \"POST required\" }), {\n status: 405,\n headers: { \"Content-Type\": \"application/json\" },\n });\n }\n\n let body: { emailText?: string; account?: unknown; opportunity?: unknown };\n try {\n body = await req.json();\n } catch {\n return new Response(JSON.stringify({ error: \"Invalid JSON body\" }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\" },\n });\n }\n\n const emailText = String(body.emailText || \"\").slice(0, 4000);\n const prompt = buildPrompt(emailText, body.account ?? null, body.opportunity ?? null);\n\n try {\n const result = await callGemini(prompt);\n return new Response(JSON.stringify(result), {\n headers: { \"Content-Type\": \"application/json\" },\n });\n } catch (err) {\n return new Response(JSON.stringify({ error: String(err) }), {\n status: 502,\n headers: { \"Content-Type\": \"application/json\" },\n });\n }\n}\n",[164],"1fb64299-5de3-4c99-9ffa-2223f2e93339","scratch_verify_final.ts","29b97ab4-a87a-11f1-af94-1607ee4eb77e",155,["D",1788537806456],"import { getAccessToken } from \"./salesforce.ts\";\nconst { access_token, instance_url } = await getAccessToken();\nconst ids = [\"001Pm00001i7SguIAE\", \"001Pm00001i8zE9IAI\"];\nfor (const id of ids) {\n const res = await fetch(\n `${instance_url}/services/data/v59.0/sobjects/Account/${id}` +\n \"?fields=Name,Delivery_Region__c,Frequency__c,Amount_of_Bottles__c\",\n { headers: { Authorization: `Bearer ${access_token}` } },\n );\n console.log(JSON.stringify(await res.json(), null, 2));\n}\n",[171],"b86e91b3-2509-4dde-99c7-9ce612af0516","scratch_check_recurring_invoice.ts","e13213de-a87c-11f1-9471-1607ee4eb77e",162,["D",1788538986202],"import { getAccessToken } from \"./salesforce.ts\";\nconst { access_token, instance_url } = await getAccessToken();\n\nconst res = await fetch(\n `${instance_url}/services/data/v59.0/sobjects/`,\n { headers: { Authorization: `Bearer ${access_token}` } },\n);\nconst data = await res.json();\nconst match = data.sobjects.find((o: any) => o.keyPrefix === \"a1E\");\nconsole.log(\"MATCH FOR a1E:\", JSON.stringify(match, null, 2));\n",[178],"ca789961-767d-4d74-8105-664976ca8673","salesforce.ts","31a68f76-8a18-11f1-8b25-1607ee4eb77e",15,["D",1786983868322],3,"let cachedToken: { access_token: string; instance_url: string; expiresAt: number } | null = null;\nconst TOKEN_TTL_MS = 15 * 60 * 1000;\n\nasync function fetchNewToken(): Promise<{ access_token: string; instance_url: string }> {\n const instanceUrl = Deno.env.get(\"SF_INSTANCE_URL\")!;\n const res = await fetch(`${instanceUrl}/services/oauth2/token`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n grant_type: \"client_credentials\",\n client_id: Deno.env.get(\"SF_CLIENT_ID\")!,\n client_secret: Deno.env.get(\"SF_CLIENT_SECRET\")!,\n }),\n });\n if (!res.ok) {\n throw new Error(`Salesforce auth failed: ${res.status} ${await res.text()}`);\n }\n const token = await res.json();\n cachedToken = { ...token, expiresAt: Date.now() + TOKEN_TTL_MS };\n return token;\n}\n\nexport async function getAccessToken(): Promise<{ access_token: string; instance_url: string }> {\n if (cachedToken && cachedToken.expiresAt > Date.now()) {\n return cachedToken;\n }\n return fetchNewToken();\n}\n\nexport async function sfQuery(soql: string): Promise {\n const { access_token, instance_url } = await getAccessToken();\n const res = await fetch(\n `${instance_url}/services/data/v59.0/query?q=${encodeURIComponent(soql)}`,\n { headers: { Authorization: `Bearer ${access_token}` } },\n );\n\n if (res.status === 401) {\n cachedToken = null;\n const retryAuth = await fetchNewToken();\n const retryRes = await fetch(\n `${retryAuth.instance_url}/services/data/v59.0/query?q=${encodeURIComponent(soql)}`,\n { headers: { Authorization: `Bearer ${retryAuth.access_token}` } },\n );\n if (!retryRes.ok) {\n throw new Error(`Salesforce query failed: ${retryRes.status} ${await retryRes.text()}`);\n }\n return retryRes.json();\n }\n\n if (!res.ok) {\n throw new Error(`Salesforce query failed: ${res.status} ${await res.text()}`);\n }\n return res.json();\n}\n\n// Update many records in one call.\n//\n// sfUpdate is one HTTP round-trip per record, which is fine for the one-at-a-time\n// callers but not for a route plan: a Miami week is 215 opportunities, and 215\n// sequential PATCHes do not finish inside a Val Town run. The composite endpoint\n// takes 200 records at a time.\n//\n// allOrNone is false deliberately. A route plan is not a transaction - if three\n// records fail their validation rules, the other 197 should still be scheduled,\n// and the caller is told exactly which three so it can say so rather than\n// rolling back work that was fine.\nexport async function sfUpdateMany(\n sobject: string,\n records: { id: string; fields: Record }[],\n): Promise<{ id: string; success: boolean; errors: unknown[] }[]> {\n if (records.length === 0) return [];\n if (records.length > 200) throw new Error(\"composite update takes at most 200 records\");\n\n const body = JSON.stringify({\n allOrNone: false,\n records: records.map((r) => ({\n attributes: { type: sobject },\n Id: r.id,\n ...r.fields,\n })),\n });\n\n const doPatch = (token: string, instance: string) =>\n fetch(`${instance}/services/data/v59.0/composite/sobjects`, {\n method: \"PATCH\",\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body,\n });\n\n const { access_token, instance_url } = await getAccessToken();\n let res = await doPatch(access_token, instance_url);\n if (res.status === 401) {\n cachedToken = null;\n const retryAuth = await fetchNewToken();\n res = await doPatch(retryAuth.access_token, retryAuth.instance_url);\n }\n if (!res.ok) {\n throw new Error(`Salesforce bulk update failed: ${res.status} ${await res.text()}`);\n }\n return await res.json();\n}\n\nexport async function sfUpdate(sobject: string, id: string, fields: Record): Promise {\n const { access_token, instance_url } = await getAccessToken();\n const doPatch = (token: string, url: string) =>\n fetch(url, {\n method: \"PATCH\",\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify(fields),\n });\n\n let res = await doPatch(access_token, `${instance_url}/services/data/v59.0/sobjects/${sobject}/${id}`);\n\n if (res.status === 401) {\n cachedToken = null;\n const retryAuth = await fetchNewToken();\n res = await doPatch(retryAuth.access_token, `${retryAuth.instance_url}/services/data/v59.0/sobjects/${sobject}/${id}`);\n }\n\n if (!res.ok && res.status !== 204) {\n throw new Error(`Salesforce update failed: ${res.status} ${await res.text()}`);\n }\n}\n",[185],"3d6f01a8-7526-41d7-b7d7-38b79149bec8","main.ts",230,["D",1789068572223],12,"import { sfQuery, sfUpdate, sfUpdateMany } from \"./salesforce.ts\";\n\nconst ALLOWED_UPDATES: Record = {\n // Route_Date__c and Route_Name__c are what the route builder commits when a\n // plan is sent out: which day the stop is going and whose truck has it.\n Opportunity: [\"CloseDate\", \"Route_Date__c\", \"Route_Name__c\"],\n Lead: [\"AI_Call_Status__c\", \"AI_Call_Last_Attempt__c\", \"AI_Call_Attempts__c\", \"AI_Call_Summary__c\", \"DoNotCall\", \"Status\"],\n};\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const providedKey = url.searchParams.get(\"key\") ?? req.headers.get(\"x-api-key\");\n // Rotated 2026-09-10. The previous key had been published in Val Town's\n // traces (they record full request URLs and cannot be purged), so it is\n // treated as compromised and is no longer accepted. Consumers each hold their\n // own copy: tribeca-route-builder and tribeca-tawk-transcripts in\n // SALESFORCE_AGENT_KEY, the Gmail add-on in SF_API_KEY. Send it as an\n // x-api-key HEADER, never in a query string, or you republish it.\n if (providedKey !== Deno.env.get(\"API_SHARED_SECRET\")) {\n return new Response(\"Unauthorized\", { status: 401 });\n }\n\n if (req.method === \"POST\") {\n let body: any;\n try {\n body = await req.json();\n } catch {\n return new Response(JSON.stringify({ error: \"Invalid JSON body\" }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\" },\n });\n }\n\n // Bulk form: { sobject, records: [{ id, fields }, ...] }. Same allow-list as\n // the single-record form below - the only thing that changes is how many go\n // per round-trip. Returns Salesforce's own per-record verdicts rather than\n // one overall success, because with allOrNone off some can fail alone.\n const { sobject, id, fields, records } = body ?? {};\n if (Array.isArray(records)) {\n const allowed = ALLOWED_UPDATES[sobject];\n if (!allowed) {\n return Response.json({ error: `Updates to '${sobject}' are not allowed` }, { status: 400 });\n }\n if (records.length > 200) {\n return Response.json({ error: \"at most 200 records per call\" }, { status: 400 });\n }\n const bad = [\n ...new Set(records.flatMap((r: any) => Object.keys(r?.fields ?? {}))),\n ].filter((f) => !allowed.includes(f));\n if (bad.length > 0) {\n return Response.json({ error: `Fields not allowed: ${bad.join(\", \")}` }, { status: 400 });\n }\n if (records.some((r: any) => !r?.id || !r?.fields)) {\n return Response.json({ error: \"each record needs id and fields\" }, { status: 400 });\n }\n try {\n return Response.json({ success: true, results: await sfUpdateMany(sobject, records) });\n } catch (err) {\n return Response.json({ error: String(err) }, { status: 400 });\n }\n }\n\n if (!sobject || !id || !fields || typeof fields !== \"object\") {\n return new Response(\n JSON.stringify({ error: \"Body must include sobject, id, and fields\" }),\n { status: 400, headers: { \"Content-Type\": \"application/json\" } },\n );\n }\n\n const allowedFields = ALLOWED_UPDATES[sobject];\n if (!allowedFields) {\n return new Response(JSON.stringify({ error: `Updates to '${sobject}' are not allowed` }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\" },\n });\n }\n\n const invalidFields = Object.keys(fields).filter((f) => !allowedFields.includes(f));\n if (invalidFields.length > 0) {\n return new Response(\n JSON.stringify({ error: `Fields not allowed: ${invalidFields.join(\", \")}` }),\n { status: 400, headers: { \"Content-Type\": \"application/json\" } },\n );\n }\n\n try {\n await sfUpdate(sobject, id, fields);\n return new Response(JSON.stringify({ success: true }), {\n headers: { \"Content-Type\": \"application/json\" },\n });\n } catch (err) {\n return new Response(JSON.stringify({ error: String(err) }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\" },\n });\n }\n }\n\n const soql = url.searchParams.get(\"q\");\n if (!soql) {\n return new Response(\n JSON.stringify({ error: \"Missing required 'q' query parameter (a SOQL query string)\" }),\n { status: 400, headers: { \"Content-Type\": \"application/json\" } },\n );\n }\n\n try {\n const result = await sfQuery(soql);\n return new Response(JSON.stringify(result), {\n headers: { \"Content-Type\": \"application/json\" },\n });\n } catch (err) {\n return new Response(JSON.stringify({ error: String(err) }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\" },\n });\n }\n}\n",[193],"7e281786-bb51-4679-87c4-8ac62fb36172","invoice.ts","0c66727e-a61c-11f1-a740-1607ee4eb77e",64,["D",1788284535958],"// What a customer owes, and the link that lets them pay it.\n//\n// READ THIS BEFORE CHANGING HOW THE LINK IS HANDED OUT.\n//\n// The pay link is a public Salesforce Sites page whose only parameter is the\n// invoice RECORD ID:\n//\n// https://tribecabeverage.my.salesforce-sites.com/payments/fw1__Payment\n// ?invoiceId=a13Pm00001bhO2xIAE&showInvoiceLines=true\n//\n// A Salesforce id is an identifier, not a secret — it is structured and\n// sequential rather than random. So this URL is not a capability token in the\n// way a Stripe payment link is. Anyone holding one can see the invoice AND its\n// line items, and the page also updates the card on file. Treat it as\n// sensitive customer data, not as a harmless convenience link.\n//\n// THE RULE THIS FILE ENFORCES: the link is returned ONLY when the caller says\n// the visitor is authenticated — signed in to their WordPress/WooCommerce\n// account, which is a real credential check. A phone number typed into a chat\n// box is NOT authentication: phone numbers are widely known, and someone who\n// guessed one would otherwise be handed a stranger's invoice.\n//\n// Unauthenticated callers still get something useful — whether a balance\n// exists, and a masked hint of the email it can be sent to — just never the\n// link or the line items.\n\nimport { sfQuery } from \"./salesforce.ts\";\n\nfunction esc(v: string): string {\n return String(v).replace(/\\\\/g, \"\\\\\\\\\").replace(/'/g, \"\\\\'\").slice(0, 120);\n}\n\nfunction tenDigits(raw: string): string | null {\n const d = String(raw ?? \"\").replace(/\\D/g, \"\");\n const ten = d.length === 11 && d.startsWith(\"1\") ? d.slice(1) : d;\n return ten.length === 10 ? ten : null;\n}\n\n/** \"b••••••@yahoo.com\" — enough for the customer to recognise, useless to anyone else. */\nfunction maskEmail(email: string | null): string | null {\n if (!email || !email.includes(\"@\")) return null;\n const [user, domain] = email.split(\"@\");\n const head = user.slice(0, 1);\n return `${head}${\"•\".repeat(Math.max(3, Math.min(user.length - 1, 8)))}@${domain}`;\n}\n\nfunction money(n: unknown): string {\n const v = Number(n ?? 0);\n return \"$\" + v.toFixed(2);\n}\n\nexport type InvoiceResult = {\n found: boolean;\n ambiguous?: boolean;\n balanceDue?: number;\n invoiceNumber?: string | null;\n status?: string | null;\n dueDate?: string | null;\n /** Present ONLY for an authenticated visitor. */\n payLink?: string;\n /** Masked hint so an agent can offer to send it somewhere the customer owns. */\n emailOnFile?: string | null;\n message: string;\n};\n\nexport async function invoiceStatus(\n phoneRaw: string | null,\n opts: { authenticated?: boolean } = {},\n): Promise {\n const phone = phoneRaw ? tenDigits(phoneRaw) : null;\n if (!phone) {\n return { found: false, message: \"Need the phone number on the account to look up a balance.\" };\n }\n\n const [a, b, c] = [phone.slice(0, 3), phone.slice(3, 6), phone.slice(6)];\n const pattern = `%${esc(a)}%${esc(b)}%${esc(c)}%`;\n\n const rows = (await sfQuery(\n `SELECT Id, Name, Email_Address__c,\n Most_Recent_Invoice_Link__c, Most_Recent_Invoice_Amount_Due__c,\n Most_Recent_Invoice_Number__c, Most_Recent_Invoice_Status__c,\n Most_Recent_Invoice_Due_Date__c, Most_Recent_Invoice_Paid__c,\n Amount_of_Unpaid_Invoices__c, Balance_for_Valtown__c\n FROM Account WHERE Phone LIKE '${pattern}' LIMIT 2`,\n )).records ?? [];\n\n if (!rows.length) {\n return { found: false, message: \"No account found with that phone number. The office can check other records.\" };\n }\n if (rows.length > 1) {\n // Never guess whose invoice this is. Handing the wrong person a pay link is\n // worse than making a real customer wait for a human.\n return {\n found: false,\n ambiguous: true,\n message: \"That number is on more than one account, so I can't safely pull up a balance. A team member will confirm which account it is.\",\n };\n }\n\n const r = rows[0];\n\n // Balance_for_Valtown__c FIRST. It is a formula field whose entire definition\n // is `fw1__Total_Balance_Amount__c` — someone built it precisely because the\n // FinancialForce rollup is NOT readable by an integration user. Granting FLS\n // on the fw1 field does not work; it still reports \"No such column\".\n //\n // This matters because Most_Recent_Invoice_Amount_Due__c is populated later\n // by other automation and is simply BLANK on a freshly invoiced account.\n // Reading that first made the bot tell a customer with $28.98 outstanding\n // that they owed nothing — caught 9/1/2026 by invoicing a test account and\n // watching the lookup disagree with the org.\n const rollup = Number(r.Balance_for_Valtown__c ?? 0);\n const recent = Number(r.Most_Recent_Invoice_Amount_Due__c ?? 0);\n const due = rollup > 0 ? rollup : recent;\n\n // \"Paid\" only counts when the rollup agrees. A stale flag must never be able\n // to suppress a real balance.\n const paid = r.Most_Recent_Invoice_Paid__c === true && rollup <= 0;\n const emailOnFile = maskEmail(r.Email_Address__c ?? null);\n\n if (paid || due <= 0) {\n return {\n found: true,\n balanceDue: 0,\n status: r.Most_Recent_Invoice_Status__c ?? null,\n emailOnFile,\n message: \"The most recent invoice on this account is paid — nothing is currently due.\",\n };\n }\n\n const base: InvoiceResult = {\n found: true,\n balanceDue: due,\n invoiceNumber: r.Most_Recent_Invoice_Number__c ?? null,\n status: r.Most_Recent_Invoice_Status__c ?? null,\n dueDate: r.Most_Recent_Invoice_Due_Date__c ?? null,\n emailOnFile,\n message: \"\",\n };\n\n if (opts.authenticated && r.Most_Recent_Invoice_Link__c) {\n base.payLink = String(r.Most_Recent_Invoice_Link__c);\n base.message =\n `${money(due)} is currently due` +\n (base.dueDate ? ` (due ${base.dueDate})` : \"\") +\n \". They can pay it with the link, which also updates the card on file for future deliveries.\";\n return base;\n }\n\n // Not authenticated: say the amount, withhold the link.\n base.message =\n `${money(due)} is currently due` +\n (base.dueDate ? ` (due ${base.dueDate})` : \"\") +\n \". Do NOT share a payment link in this chat — the visitor is not signed in. \" +\n (emailOnFile\n ? `Offer to have it emailed to the address on file (${emailOnFile}), or bring in a team member.`\n : \"There is no email on file, so a team member has to handle this.\");\n return base;\n}\n",[200],"21663256-aa39-463f-8678-e51a163b41ad","email-actions.ts","8afdccb8-abcb-11f1-8b09-1607ee4eb77e",279,["D",1789144387673],34,"// Email-driven Salesforce changes for the Gmail add-on (\"Salesforce Account\n// Lookup Sidebar\", Apps Script project 1p2qIBm3…).\n//\n// POST /propose read a customer email + the matched Account / latest\n// Delivery (Opportunity) and return the exact field changes\n// the add-on could make, each with a reason. NOTHING IS\n// WRITTEN HERE. If the email is not about something on the\n// allow-list below, `actions` is empty and the add-on shows\n// only the summary.\n// POST /apply apply a list of changes a person has ticked and approved in\n// the add-on. Re-validated against the same allow-list, then\n// read back from Salesforce so the summary shows what is\n// actually on the record now, not what we asked for.\n//\n// Auth: API_SHARED_SECRET (?key= or x-api-key), same as main.ts, because this\n// file writes.\n//\n// WHY THE ALLOW-LIST IS THIS SMALL. The Connected App runs as the \"Salesforce\n// Agent\" user (005Pm00000rbvjxIAA). Its permission set can EDIT only Account,\n// Opportunity, Lead and Recurring_Delivery_Product__c, and within those only a\n// handful of fields (checked against FieldPermissions on 2026-09-08; Opportunity\n// .Needs_Delivery_ASAP__c was granted edit on 2026-09-09). Anything not listed\n// here either cannot be written by this user at all (Account.Phone, shipping\n// address) or is deliberately kept a human decision (Terms__c,\n// Payment_Method_Type__c, Delivery_Region__c, OwnerId).\n// The model never sees fields outside this list, and the server drops anything\n// it invents anyway.\nimport { sfQuery, sfUpdateMany } from \"./salesforce.ts\";\n\ntype FieldSpec = {\n label: string;\n type: \"string\" | \"number\" | \"date\" | \"email\" | \"picklist\" | \"checkbox\";\n values?: string[];\n hint: string;\n // Extra rule applied to (current, new) before a change is accepted.\n guard?: (current: unknown, next: string, record: Record) => string | null;\n};\n\nconst CATALOG: Record> = {\n Account: {\n Frequency__c: {\n label: \"Delivery Frequency\",\n type: \"picklist\",\n // Values as actually used in the org (counts checked 2026-09-08):\n // 30 Days 12.7k, Call in 7k, Bi-Weekly 2.4k, Cancelled 2.1k, 60 Days 1.1k,\n // Weekly 608. \"15 Days\" and \"4 Weeks\" exist in the picklist but are not\n // used in practice, so the model is not offered them.\n values: [\"Weekly\", \"Bi-Weekly\", \"30 Days\", \"60 Days\", \"Call in\", \"Cancelled\"],\n hint: \"How often the customer gets a standing delivery. 'Cancelled' ends recurring service for good. \" +\n \"Every-other-week / biweekly / twice a month = 'Bi-Weekly'. Monthly = '30 Days'. Every two months = '60 Days'. \" +\n \"'Call in' = no standing schedule, customer calls when they need water.\",\n },\n Amount_of_Bottles__c: {\n label: \"Amount of Bottles\",\n type: \"number\",\n hint: \"Number of 5-gallon bottles per standing delivery.\",\n guard: (_c, n) => Number(n) >= 0 && Number(n) <= 500 ? null : \"bottle count out of range\",\n },\n Water_Type__c: {\n // Free-text field in Salesforce, but the office writes it in a fixed\n // shorthand (ALK 13.9k, SPRING 5.4k, ALKALINE 1.3k, GLASS SPRING 622,\n // ALK/SPRING 222, DISTILLED 192, GLASS ALK 157 ...). Offer only that\n // shorthand so a change lands in the same vocabulary as every other record.\n label: \"Water Type\",\n type: \"picklist\",\n values: [\"ALK\", \"SPRING\", \"DISTILLED\", \"GLASS ALK\", \"GLASS SPRING\", \"ALK/SPRING\"],\n hint: \"Which water the customer receives. ALK = alkaline in plastic 5-gal bottles, SPRING = spring water, \" +\n \"GLASS ... = the same in glass bottles, ALK/SPRING = a mix. 'ALKALINE' on a record means the same as 'ALK' - do not propose that change.\",\n },\n Email_Address__c: {\n label: \"Email Address\",\n type: \"email\",\n hint: \"The customer's contact/billing email on the account.\",\n },\n Name: {\n label: \"Account Name\",\n type: \"string\",\n hint: \"Business or customer name. Only change when the customer explicitly says the name is wrong or has changed.\",\n },\n },\n Opportunity: {\n CloseDate: {\n label: \"Delivery Date\",\n type: \"date\",\n hint: \"The scheduled date of this delivery. Change when the customer asks to move / reschedule the upcoming delivery.\",\n guard: (_c, _n, rec) => rec.StageName === \"Delivery Due\" ? null : \"only a 'Delivery Due' delivery can be rescheduled\",\n },\n Route_Date__c: {\n label: \"Route Date\",\n type: \"date\",\n hint: \"The committed route day once dispatch has planned it. If it is set, move it to the same new date as the Delivery Date; if it is null, leave it alone.\",\n guard: (c, _n, rec) => {\n if (c == null) return \"Route Date is not set on this delivery; leave it null\";\n return rec.StageName === \"Delivery Due\" ? null : \"only a 'Delivery Due' delivery can be re-routed\";\n },\n },\n Needs_Delivery_ASAP__c: {\n label: \"Needs Delivery ASAP\",\n type: \"checkbox\",\n hint: \"Dispatch's urgency flag on this delivery, and the one the office actually acts on. \" +\n \"Tick it whenever the customer is out of water, chasing a delivery that has not come, or says they need it urgently. \" +\n \"Tick it alongside a date change rather than instead of one.\",\n // ONLY EVER SET, NEVER CLEARED. A flag raised in error is visible noise\n // the office can ignore; a flag cleared in error is silent and the\n // customer simply keeps waiting. 326 of ~13,000 open deliveries carry it\n // (2026-09-09), so it is a real signal and not a formality. Unticking\n // stays a human's job.\n guard: (_c, n, rec) => {\n if (n !== \"true\") return \"this flag may only be set, never cleared\";\n return rec.StageName === \"Delivery Due\" ? null : \"only a 'Delivery Due' delivery can be flagged urgent\";\n },\n },\n // STAGE IS DELIBERATELY NOT WRITABLE. Do not put it back.\n //\n // It used to allow 'Delivery Due' -> 'Void Delivery' so that a skip request\n // could cancel the delivery. That is the wrong answer: voiding throws the\n // delivery away instead of postponing it, and the customer is left on a\n // standing order with nothing scheduled. A skip is a DATE change - push the\n // delivery out by one service cycle - which is what the office does by hand.\n // Removed on the owner's instruction, 2026-09-10.\n //\n // Kept out of the catalog rather than merely discouraged in the prompt, so\n // validate() rejects a StageName action outright however it was arrived at.\n },\n};\n\nconst ACCOUNT_URL = \"https://tribecabeverage.lightning.force.com/lightning/r/Account/\";\nconst OPP_URL = \"https://tribecabeverage.lightning.force.com/lightning/r/Opportunity/\";\n\nfunction json(body: unknown, status = 200) {\n return new Response(JSON.stringify(body), { status, headers: { \"Content-Type\": \"application/json\" } });\n}\n\nfunction esc(v: string) {\n return v.replace(/\\\\/g, \"\\\\\\\\\").replace(/'/g, \"\\\\'\");\n}\n\n/** Normalize a proposed value to what Salesforce will accept; null = reject. */\nfunction coerce(spec: FieldSpec, raw: unknown): { value: unknown; error?: string } {\n const s = String(raw ?? \"\").trim();\n switch (spec.type) {\n case \"number\": {\n const n = Number(s);\n return Number.isFinite(n) ? { value: n } : { value: null, error: `'${s}' is not a number` };\n }\n case \"date\": {\n if (!/^\\d{4}-\\d{2}-\\d{2}$/.test(s)) return { value: null, error: `'${s}' is not a YYYY-MM-DD date` };\n const d = new Date(s + \"T12:00:00Z\");\n if (Number.isNaN(d.getTime())) return { value: null, error: `'${s}' is not a real date` };\n return { value: s };\n }\n case \"email\": {\n return /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(s) ? { value: s } : { value: null, error: `'${s}' is not an email address` };\n }\n case \"picklist\": {\n const hit = (spec.values ?? []).find((v) => v.toLowerCase() === s.toLowerCase());\n return hit ? { value: hit } : { value: null, error: `'${s}' is not one of: ${(spec.values ?? []).join(\", \")}` };\n }\n case \"checkbox\": {\n const t = s.toLowerCase();\n if ([\"true\", \"yes\", \"y\", \"1\", \"checked\"].includes(t)) return { value: true };\n if ([\"false\", \"no\", \"n\", \"0\", \"unchecked\"].includes(t)) return { value: false };\n return { value: null, error: `'${s}' is not true or false` };\n }\n default:\n return s.length > 0 && s.length <= 255 ? { value: s } : { value: null, error: \"empty or too long\" };\n }\n}\n\nfunction sameValue(a: unknown, b: unknown) {\n if (a == null && b == null) return true;\n if (typeof a === \"number\" || typeof b === \"number\") return Number(a) === Number(b);\n return String(a ?? \"\").trim().toLowerCase() === String(b ?? \"\").trim().toLowerCase();\n}\n\n/** Human-readable description of the writable surface, for the prompt. */\nfunction describeCatalog() {\n return Object.entries(CATALOG).map(([obj, fields]) =>\n `${obj}:\\n` + Object.entries(fields).map(([f, s]) =>\n ` - ${f} (\"${s.label}\", ${s.type}${s.values ? `, one of: ${s.values.join(\" | \")}` : \"\"}): ${s.hint}`\n ).join(\"\\n\")\n ).join(\"\\n\");\n}\n\nfunction todayInET() {\n const now = new Date();\n const date = now.toLocaleDateString(\"en-CA\", { timeZone: \"America/New_York\" }); // YYYY-MM-DD\n const weekday = now.toLocaleDateString(\"en-US\", { timeZone: \"America/New_York\", weekday: \"long\" });\n // The date an \"expedite this\" email moves the delivery to is TODAY, by the\n // owner's instruction on 2026-09-09. Worth knowing what it does and does not\n // do: the route crons run 5:30-5:40am ET, so today's trucks are already out\n // before the office reads its mail, and this does not put the stop on one.\n // What it does is stop the delivery sitting weeks out and make it read as due\n // now, which is the office's cue to fit it in. Actual dispatch still needs\n // Route_Date__c, which this integration user may not set from empty.\n return { date, weekday, soonestDate: date };\n}\n\nconst PROPOSAL_SCHEMA = {\n type: \"OBJECT\",\n properties: {\n relevant: { type: \"BOOLEAN\", description: \"true only if the email asks for something that maps to a listed field\" },\n summary: { type: \"STRING\", description: \"one or two plain-English sentences: what the customer wants\" },\n recommendation: { type: \"STRING\", description: \"what staff should do; 'No action needed' if nothing\" },\n needs_human: { type: \"STRING\", description: \"anything the customer asked for that is NOT covered by the listed fields (address change, billing dispute, equipment, complaints...). Empty string if none.\" },\n actions: {\n type: \"ARRAY\",\n items: {\n type: \"OBJECT\",\n properties: {\n sobject: { type: \"STRING\", description: \"Account or Opportunity\" },\n field: { type: \"STRING\", description: \"API name exactly as listed\" },\n newValue: { type: \"STRING\", description: \"the new value; dates as YYYY-MM-DD\" },\n reason: { type: \"STRING\", description: \"one sentence quoting or paraphrasing the customer's request\" },\n assumed: { type: \"BOOLEAN\", description: \"true ONLY when the customer wanted the delivery sooner but named no date, so you chose the next working day for them. false whenever the customer named the value themselves.\" },\n },\n required: [\"sobject\", \"field\", \"newValue\", \"reason\", \"assumed\"],\n },\n },\n },\n required: [\"relevant\", \"summary\", \"recommendation\", \"needs_human\", \"actions\"],\n};\n\n// PRIMARY MODEL: Claude Opus 5, reached through claude-json.ts in\n// Tribeca_Rep/tribeca-chat. That val is on a different Val Town account and is\n// the one holding ANTHROPIC_API_KEY; secrets cannot be read or shared across\n// accounts, so the call is proxied to where the key already lives (gated by\n// LLM_PROXY_KEY, set on both vals). The Gemini JSON schema below is plain JSON\n// Schema apart from upper-case type names, so one schema serves both.\nconst CLAUDE_PROXY_URL = \"https://tribeca_rep--586be75cabd111f196d01607ee4eb77e.web.val.run\";\n\nfunction toJsonSchema(node: any): any {\n if (Array.isArray(node)) return node.map(toJsonSchema);\n if (node && typeof node === \"object\") {\n const out: any = {};\n for (const [k, v] of Object.entries(node)) {\n out[k] = k === \"type\" && typeof v === \"string\" ? v.toLowerCase() : toJsonSchema(v);\n }\n if (out.type === \"object\" && out.properties && out.additionalProperties === undefined) {\n out.additionalProperties = false;\n }\n return out;\n }\n return node;\n}\n\nasync function callClaude(prompt: string, model?: string): Promise<{ out: any; model: string }> {\n const key = Deno.env.get(\"LLM_PROXY_KEY\");\n if (!key) throw new Error(\"LLM_PROXY_KEY not set\");\n const res = await fetch(CLAUDE_PROXY_URL, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", \"x-proxy-key\": key },\n body: JSON.stringify({\n prompt,\n schema: toJsonSchema(PROPOSAL_SCHEMA),\n effort: \"medium\",\n max_tokens: 4000,\n // Caller may ask for a cheaper model. The proxy owns the allow-list, so\n // an unknown name falls back to its default rather than erroring. The\n // background sweep uses Sonnet; a person pressing Analyze gets the default.\n ...(model ? { model } : {}),\n }),\n signal: AbortSignal.timeout(50_000),\n });\n const data = await res.json().catch(() => ({}));\n if (!res.ok || !data?.ok) {\n throw new Error(`Claude proxy ${res.status}: ${data?.error ?? \"no body\"}`);\n }\n return { out: data.parsed, model: String(data.model ?? \"claude\") };\n}\n\n// Claude first; Gemini only if the proxy is unreachable or declines, so an\n// outage on one provider does not take the Analyze button down.\nasync function callModel(prompt: string, model?: string): Promise<{ out: any; model: string }> {\n try {\n return await callClaude(prompt, model);\n } catch (err) {\n console.error(\"claude failed, falling back to gemini:\", String(err).slice(0, 300));\n const out = await callGemini(prompt);\n return { out, model: \"gemini-flash-latest (fallback)\" };\n }\n}\n\n// FALLBACK MODEL. 429/503 from Gemini are transient (the shared \"flash-latest\"\n// alias gets overloaded), so retry a couple of times before giving up - the\n// person is waiting on a button press in Gmail, not a batch.\nasync function callGemini(prompt: string) {\n const apiKey = Deno.env.get(\"GEMINI_API_KEY\");\n let lastErr = \"\";\n for (let attempt = 0; attempt < 3; attempt++) {\n if (attempt > 0) await new Promise((r) => setTimeout(r, 1200 * attempt));\n const res = await fetch(\n `https://generativelanguage.googleapis.com/v1beta/models/gemini-flash-latest:generateContent?key=${apiKey}`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n contents: [{ parts: [{ text: prompt }] }],\n generationConfig: {\n temperature: 0.1,\n responseMimeType: \"application/json\",\n responseSchema: PROPOSAL_SCHEMA,\n },\n }),\n },\n );\n if (res.status === 429 || res.status === 503) {\n lastErr = `Gemini ${res.status}: ${(await res.text()).slice(0, 300)}`;\n console.log(\"gemini retryable\", lastErr);\n continue;\n }\n if (!res.ok) throw new Error(`Gemini request failed: ${res.status} ${(await res.text()).slice(0, 500)}`);\n const data = await res.json();\n const text = data?.candidates?.[0]?.content?.parts?.[0]?.text ?? \"\";\n return JSON.parse(text.replace(/```json|```/g, \"\").trim());\n }\n throw new Error(`Gemini unavailable after 3 attempts. ${lastErr}`);\n}\n\nfunction buildPrompt(emailText: string, account: Record | null, opportunity: Record | null) {\n const { date, weekday, soonestDate } = todayInET();\n return `You help office staff at Tribeca Beverage (5-gallon bottled water delivery, NYC / NJ / Florida) act on customer emails inside Salesforce.\n\nToday is ${weekday}, ${date} (America/New_York). Resolve relative dates (\"next Tuesday\", \"the 15th\") against today; a date with no year is the next occurrence.\n\nCustomer email:\n\"\"\"\n${emailText}\n\"\"\"\n\nMatched Salesforce Account (current values, read-only JSON):\n${JSON.stringify(account)}\n\nLatest delivery record for that account (Opportunity, current values):\n${JSON.stringify(opportunity)}\n\nThe ONLY fields that can be changed, with their meaning:\n${describeCatalog()}\n\nRules:\n- Propose a change ONLY when this email asks for it and it maps to one of the fields above. Never infer or \"improve\" anything the customer did not ask for. The single exception is the expedite rule below.\n- EXPEDITE. If the customer wants their delivery sooner - they are chasing a delivery that has not arrived, saying they are out of water, asking why nothing has come, or complaining that they have been asking for a while - propose BOTH of these: Opportunity.Needs_Delivery_ASAP__c = true (assumed=false, this is what they are actually asking for), and, when they named no date, Opportunity.CloseDate = ${soonestDate} (today) with assumed=true and a reason saying they did not name a date. If they DID name a date, use their date with assumed=false and still tick the urgency flag.\n- Set assumed=false on every change where the customer named the value themselves, and never use assumed for anything except a delivery date they left unsaid.\n- Do NOT expedite when the customer is only asking a question, disputing a bill, or is content with the date already on the record.\n- Never propose a value equal to the current value.\n- SKIP. If the customer wants to skip, hold, postpone or cancel THIS upcoming delivery, never void or cancel the delivery record - move it. Propose Opportunity.CloseDate pushed forward, assumed=false: to the date or timeframe they named if they named one, otherwise by one service cycle from the current CloseDate using Account.Frequency__c (Weekly +7 days, Bi-Weekly +14, 30 Days +30, 60 Days +60). If Frequency__c is \"Call in\" or missing, propose no date and put it in needs_human instead. Never tick Needs_Delivery_ASAP__c on a skip.\n- CANCELLING SERVICE IS NOT A SKIP, and it is the most damaging thing on this list: Account.Frequency__c = \"Cancelled\" ends every future delivery, not just this one. Propose it ONLY when the customer plainly says they want to stop service for good - \"cancel my service\", \"close the account\", \"we are switching suppliers\", \"stop deliveries permanently\". Wording like \"not at this time\", \"not right now\", \"we don't need any this week\", \"skip this one\", \"hold off\", \"pause\", \"we're fine for now\" is a SKIP: move the date and leave Frequency__c alone. If you genuinely cannot tell which one they mean, propose nothing and say so in needs_human.\n- If the customer wants a different delivery day, change Opportunity.CloseDate; also change Route_Date__c to the same date only if Route_Date__c currently has a value.\n- WHICH DAY, when the customer names a WEEK rather than a date (\"the week of the 21st\", \"next week\"). If the email itself states a close-date rule, follow the email. Otherwise use the account's Frequency__c: for \"Weekly\" or \"Bi-Weekly\" pick the FRIDAY of that week - that is the house pattern, 67% and 78% of those deliveries respectively fall on a Friday (measured 2026-09-11). For \"30 Days\" and \"60 Days\" there is NO house pattern, so keep the same weekday as the delivery's current Close Date rather than inventing one.\n- Anything requested that is not covered above goes in needs_human, not in actions.\n- If the email is spam, a vendor, an internal message, or not a customer request, set relevant=false with an empty actions list.\n- Address the account by name in summary/recommendation when useful. Be brief.`;\n}\n\ntype Action = { sobject: string; id: string; field: string; newValue: unknown };\n\n/** Validate raw actions against the catalog and the current records. */\nfunction validate(\n raw: any[],\n records: Record | null>, // { Account: {...}, Opportunity: {...} }\n) {\n const accepted: any[] = [];\n const skipped: any[] = [];\n const seen = new Set();\n for (const a of Array.isArray(raw) ? raw : []) {\n const sobject = String(a?.sobject ?? \"\");\n const field = String(a?.field ?? \"\");\n const spec = CATALOG[sobject]?.[field];\n const rec = records[sobject];\n const why = (reason: string) => skipped.push({ sobject, field, newValue: a?.newValue, reason });\n if (!spec) { why(\"not an allowed object/field\"); continue; }\n if (!rec || !rec.Id) { why(`no ${sobject} record in context`); continue; }\n if (a?.id && a.id !== rec.Id) { why(\"record id does not match the matched record\"); continue; }\n if (seen.has(sobject + \".\" + field)) { why(\"duplicate\"); continue; }\n const { value, error } = coerce(spec, a?.newValue);\n if (error) { why(error); continue; }\n if (sameValue(rec[field], value)) { why(\"already set to that value\"); continue; }\n const g = spec.guard?.(rec[field], String(value), rec);\n if (g) { why(g); continue; }\n // An ASSUMED date is one the customer never said out loud, so it gets a\n // rule the model cannot talk its way past: it must be a date field, and it\n // must move the delivery EARLIER. That is the whole point of expediting.\n // It also means an already-overdue delivery is left alone rather than\n // quietly pushed out, and \"assumed\" can never be borrowed to justify\n // changing water type, frequency or anything else unasked.\n const assumed = a?.assumed === true;\n if (assumed) {\n if (spec.type !== \"date\") { why(\"only a date may be assumed\"); continue; }\n const current = String(rec[field] ?? \"\");\n if (!current) { why(\"cannot assume a date when the record has none\"); continue; }\n if (String(value) >= current) { why(`assumed date ${value} is not earlier than the current ${current}`); continue; }\n // AND IT MUST NOT HAVE GONE STALE. An assumed date is always \"today\" at\n // the moment the email was analysed, but the proposal sits on the panel\n // until someone looks at it - overnight, or over a weekend. Applying it\n // then would backdate the delivery to a day nobody chose, and the rule\n // above cannot catch it because a past date is still earlier than the\n // one on the record. Seen on a real row the morning after, 2026-09-11.\n const today = todayInET().date;\n if (String(value) < today) {\n why(`assumed date ${value} was today's date when this was analysed and is now in the past; re-analyse the email`);\n continue;\n }\n }\n seen.add(sobject + \".\" + field);\n accepted.push({\n sobject,\n id: rec.Id,\n recordName: rec.Name ?? null,\n recordUrl: (sobject === \"Account\" ? ACCOUNT_URL : OPP_URL) + rec.Id + \"/view\",\n field,\n label: spec.label,\n currentValue: rec[field] ?? null,\n newValue: value,\n assumed,\n reason: String(a?.reason ?? \"\").slice(0, 300),\n });\n }\n return { accepted, skipped };\n}\n\nconst READBACK_FIELDS: Record = {\n Account: \"Id, Name, Frequency__c, Amount_of_Bottles__c, Water_Type__c, Email_Address__c\",\n Opportunity: \"Id, Name, StageName, CloseDate, Route_Date__c, Route_Name__c, Needs_Delivery_ASAP__c\",\n};\n\nasync function fetchRecord(sobject: string, id: string) {\n const fields = READBACK_FIELDS[sobject];\n if (!fields || !/^[a-zA-Z0-9]{15,18}$/.test(id)) return null;\n const r = await sfQuery(`SELECT ${fields} FROM ${sobject} WHERE Id = '${esc(id)}' LIMIT 1`);\n return r.records?.[0] ?? null;\n}\n\nasync function propose(body: any) {\n const emailText = String(body.emailText ?? \"\").slice(0, 6000);\n if (!emailText.trim()) return json({ error: \"emailText is required\" }, 400);\n const account = body.account ?? null;\n const opportunity = body.opportunity ?? null;\n if (!account?.Id) {\n // No customer matched: nothing on the allow-list can apply. Still give a summary so the card is useful.\n const { out, model } = await callModel(buildPrompt(emailText, null, null), body.model);\n return json({ relevant: false, model, summary: out.summary ?? \"\", recommendation: out.recommendation ?? \"\", needs_human: out.needs_human ?? \"\", actions: [], skipped: [] });\n }\n // Refresh from Salesforce so the model reasons about (and we diff against) live values,\n // not the copy the add-on cached when the card first rendered.\n const [liveAccount, liveOpp] = await Promise.all([\n fetchRecord(\"Account\", String(account.Id)),\n opportunity?.Id ? fetchRecord(\"Opportunity\", String(opportunity.Id)) : Promise.resolve(null),\n ]);\n const acct = liveAccount ?? account;\n const opp = liveOpp ?? opportunity;\n const { out, model } = await callModel(buildPrompt(emailText, acct, opp), body.model);\n const { accepted, skipped } = validate(out.actions, { Account: acct, Opportunity: opp });\n return json({\n relevant: Boolean(out.relevant) && accepted.length > 0,\n model,\n summary: out.summary ?? \"\",\n recommendation: out.recommendation ?? \"\",\n needs_human: out.needs_human ?? \"\",\n actions: accepted,\n skipped,\n });\n}\n\nasync function apply(body: any) {\n // Second factor on top of the shared API key: the person pressing Apply in\n // Gmail must type the approval password. Checked here, not in Apps Script,\n // so it never sits in the add-on source. Fails closed if the env var is\n // missing - a misconfigured val must not become an open write path.\n const expected = Deno.env.get(\"EMAIL_ACTIONS_APPROVAL_PASSWORD\");\n if (!expected) return json({ error: \"Approval password is not configured on the server\", code: \"no_password\" }, 500);\n if (String(body.password ?? \"\") !== expected) {\n return json({ error: \"Incorrect approval password. Nothing was changed.\", code: \"bad_password\" }, 403);\n }\n const actions: Action[] = Array.isArray(body.actions) ? body.actions : [];\n if (actions.length === 0) return json({ error: \"actions is empty\" }, 400);\n if (actions.length > 20) return json({ error: \"at most 20 changes per call\" }, 400);\n\n // Re-read every touched record: the approval may be minutes old and the\n // guards (stage, route date) must be judged against what is there NOW.\n const ids = new Map(); // key sobject|id\n for (const a of actions) ids.set(`${a.sobject}|${a.id}`, a.id);\n const live: Record> = {};\n await Promise.all([...ids.keys()].map(async (k) => {\n const [sobject, id] = k.split(\"|\");\n const rec = await fetchRecord(sobject, id);\n if (rec) live[k] = rec;\n }));\n\n const accepted: any[] = [];\n const rejected: any[] = [];\n for (const a of actions) {\n const rec = live[`${a.sobject}|${a.id}`] ?? null;\n const v = validate([a], { [a.sobject]: rec } as any);\n if (v.accepted.length) accepted.push(v.accepted[0]);\n else rejected.push({ ...a, reason: v.skipped[0]?.reason ?? (rec ? \"rejected\" : \"record not found\") });\n }\n\n // One PATCH per record, grouped by object, allOrNone off - Salesforce reports\n // each record's own verdict and we pass it through.\n const results: any[] = [];\n const bySobject = new Map>();\n for (const a of accepted) {\n if (!bySobject.has(a.sobject)) bySobject.set(a.sobject, new Map());\n const m = bySobject.get(a.sobject)!;\n if (!m.has(a.id)) m.set(a.id, []);\n m.get(a.id)!.push(a);\n }\n for (const [sobject, byId] of bySobject) {\n const records = [...byId.entries()].map(([id, acts]) => ({\n id,\n fields: Object.fromEntries(acts.map((a) => [a.field, a.newValue])),\n }));\n let verdicts: any[] = [];\n let callError: string | null = null;\n try {\n verdicts = await sfUpdateMany(sobject, records);\n } catch (err) {\n callError = String(err);\n }\n for (let i = 0; i < records.length; i++) {\n const verdict = verdicts[i];\n const ok = !callError && verdict?.success === true;\n const error = callError ?? (ok ? null : (verdict?.errors ?? []).map((e: any) => e.message).join(\"; \") || \"update failed\");\n const after = ok ? await fetchRecord(sobject, records[i].id) : null;\n for (const a of byId.get(records[i].id)!) {\n const confirmed = after ? after[a.field] ?? null : null;\n results.push({\n ...a,\n ok: ok && sameValue(confirmed, a.newValue),\n confirmedValue: confirmed,\n error: ok ? (sameValue(confirmed, a.newValue) ? null : \"Salesforce accepted the update but the field reads back differently (an automation may have changed it)\") : error,\n });\n }\n }\n }\n\n const applied = results.filter((r) => r.ok).length;\n const failed = results.length - applied + rejected.length;\n return json({\n applied,\n failed,\n results,\n rejected,\n summary: `${applied} change${applied === 1 ? \"\" : \"s\"} applied` + (failed ? `, ${failed} not applied` : \"\") + \".\",\n });\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const providedKey = url.searchParams.get(\"key\") ?? req.headers.get(\"x-api-key\");\n // Rotated 2026-09-10; the previous key is no longer accepted. See main.ts.\n if (providedKey !== Deno.env.get(\"API_SHARED_SECRET\")) {\n return new Response(\"Unauthorized\", { status: 401 });\n }\n if (req.method === \"GET\") {\n return json({ ok: true, routes: [\"POST /propose\", \"POST /apply\"], catalog: Object.fromEntries(Object.entries(CATALOG).map(([o, f]) => [o, Object.keys(f)])) });\n }\n if (req.method !== \"POST\") return json({ error: \"POST required\" }, 405);\n let body: any;\n try {\n body = await req.json();\n } catch {\n return json({ error: \"Invalid JSON body\" }, 400);\n }\n try {\n if (url.pathname.endsWith(\"/propose\")) return await propose(body);\n if (url.pathname.endsWith(\"/apply\")) return await apply(body);\n return json({ error: \"unknown route; use /propose or /apply\" }, 404);\n } catch (err) {\n // 500, not 502: Val Town's edge replaces a 502 body with its own\n // \"error code: 502\" page, which would hide the message from the add-on.\n return json({ error: String(err) }, 500);\n }\n}\n",[207],"a3183f88-1ab3-4e17-a7be-dadcff1b5882","digest.ts","72679932-ad32-11f1-8d94-1607ee4eb77e",277,["D",1789143995926],18,"interval","// The inbox digest, sent from here rather than from Apps Script.\n//\n// Runs every 15 minutes and mails whatever triage.ts has decided since the last\n// send. Living in Val Town rather than the add-on means the add-on never needs\n// permission to send mail on the office's behalf, and it means the wording can\n// be changed without touching the Apps Script editor.\n//\n// WHEN IT SENDS. Something actionable goes out on the next run, because that is\n// a customer waiting. Everything else waits until the oldest unsent item is an\n// hour old, so a quiet afternoon produces one email rather than four an hour.\n// A run with nothing pending sends nothing at all.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { email } from \"https://esm.town/v/std/email\";\n\nconst HOLD_NON_URGENT_MS = 60 * 60 * 1000;\nconst MAX_ROWS = 60;\n\nfunction esc(v: unknown) {\n return String(v ?? \"\")\n .replace(/&/g, \"&\").replace(//g, \">\");\n}\n\nfunction fmt(v: unknown) {\n if (v === null || v === undefined || v === \"\") return \"(empty)\";\n if (v === true) return \"Yes\";\n if (v === false) return \"No\";\n return String(v);\n}\n\n// The mailbox these emails live in. Used to address the Gmail link by ACCOUNT\n// rather than by slot number.\nconst MAILBOX = \"info@tribecabeverage.com\";\n\nfunction threadLink(threadId: unknown) {\n if (!threadId) return null;\n // NOT /mail/u/0/. The slot number is per browser profile, not per account:\n // info@ is u/1 in one profile here and u/5 in another, so a hard-coded 0\n // opens whichever account happens to be first - someone else's inbox, or a\n // \"couldn't find that conversation\" page. authuser= names the account and\n // lets Gmail resolve the slot itself.\n return `https://mail.google.com/mail/u/?authuser=${encodeURIComponent(MAILBOX)}#all/${threadId}`;\n}\n\nfunction section(title: string, rows: any[], withActions: boolean, interactive = false) {\n if (!rows.length) return \"\";\n const colour = withActions ? \"#1a73e8\" : \"#f9ab00\";\n let html = `

${esc(title)}

`;\n for (const r of rows) {\n const link = threadLink(r.thread_id);\n const mid = esc(r.message_id);\n let recordUrl: string | null = null;\n html += `

`;\n html += `

${esc(r.account_name ?? \"(no account)\")} ${esc(r.matched_on)}

`;\n html += `

${esc(r.subject)}

`;\n if (r.summary) html += `

${esc(r.summary)}

`;\n if (withActions) {\n let actions: any[] = [];\n try {\n actions = JSON.parse(String(r.actions_json ?? \"[]\"));\n } catch { /* a malformed row should not kill the digest */ }\n // The delivery record these changes land on, so the row can link straight\n // to it. Prefer the Opportunity: an action row is nearly always about a\n // delivery, and the Account is one click from there anyway.\n recordUrl = (actions.find((a: any) => a.sobject === \"Opportunity\") ?? actions[0])?.recordUrl ?? null;\n actions.forEach((a: any, i: number) => {\n // TWO KINDS OF CHANGE ARRIVE UNTICKED.\n //\n // An assumed date, because nobody but the model chose it - that is the\n // same rule the Gmail card follows. And ending service outright, because\n // it stops every future delivery rather than the one being discussed,\n // and the difference between \"not at this time\" and \"cancel my service\"\n // is one a person should confirm. Both still show, both still explain\n // themselves; they just cannot be applied by pressing one button.\n const ending = a.field === \"Frequency__c\" && String(a.newValue) === \"Cancelled\";\n const note = a.assumed\n ? ` [date assumed]`\n : (ending ? ` [ends all future deliveries]` : \"\");\n const body = `${esc(a.label)}: ${esc(fmt(a.currentValue))} → ${esc(fmt(a.newValue))}${note}`;\n if (interactive) {\n html += `

` +\n ` ${body}

`;\n } else {\n html += `

→ ${body}

`;\n }\n });\n if (interactive && actions.length) {\n html += `

` +\n `

`;\n }\n } else if (r.needs_human) {\n html += `

${esc(r.needs_human)}

`;\n }\n // Always a new tab. From the panel, navigating away loses the ticks you had\n // already set on every other row; from the emailed digest it keeps the\n // digest open while you work through it.\n const links: string[] = [];\n if (link) links.push(`Open the email`);\n if (recordUrl) {\n links.push(`Open in Salesforce`);\n }\n if (links.length) {\n html += `

${links.join(` · `)}

`;\n }\n // THE EMAIL ITSELF, on the panel only.\n //\n // Collapsed, because the value of this page is that thirty rows can be\n // scanned at once and full bodies would destroy that. Open it when the\n // summary is not enough to judge the change - which is most of the time\n // that a proposal looks wrong. Left out of the emailed digest entirely:\n // thirty full bodies would make it enormous, and the email is a nudge to\n // come here rather than a place to work.\n if (interactive && r.body) {\n html += `

` +\n `

Read the email

` +\n `

${esc(r.body)}

` +\n `

`;\n }\n html += `

`;\n }\n return html;\n}\n\n// Only ever inlined into the panel, never into the emailed digest - a mail\n// client would strip it, and there is nothing for it to talk to from an inbox.\nconst PANEL_SCRIPT = `\n`;\n\n/** Exported so triage.ts can show the exact email without sending one. */\nexport function renderDigest(actions: any[], humans: any[], interactive = false) {\n const when = new Date().toLocaleString(\"en-US\", {\n timeZone: \"America/New_York\", hour: \"numeric\", minute: \"2-digit\", hour12: true,\n });\n // Subjects carry em dashes (every portal request does) and customer names\n // carry accents. Without this a mail client that guesses latin-1 renders them\n // as mojibake. The /digest-preview response sets the charset in its header,\n // but the emailed copy has only what is in the markup.\n let html = `` +\n `

`;\n html += `

Inbox sweep, ${esc(when)}

`;\n html += `

Unread customer mail matched to Salesforce. Nothing has been changed. ` +\n (interactive\n ? `Untick anything you disagree with, then press Apply.

`\n : `Open a message and use the Salesforce Account Lookup panel to apply anything below.

`);\n html += section(`Ready to act (${actions.length})`, actions, true, interactive);\n html += section(`Needs a person (${humans.length})`, humans, false, interactive);\n html += `

`;\n if (interactive) html += PANEL_SCRIPT;\n return html;\n}\n\n/**\n * Email content does not linger here.\n *\n * Anything inbound.ts recorded is deleted outright once it is 24 hours old.\n * The triage record is treated differently: its sender, subject, summary and\n * proposed changes are all derived from the customer's email, so those columns\n * are blanked at 24 hours too, but the message id and verdict survive to 48\n * hours so the sweep does not re-analyse something it already handled. The\n * sweep only looks back 24 hours, so nothing is lost by that.\n *\n * Runs before the enabled check, so retention happens whether or not the digest\n * is switched on.\n */\nasync function purgeOldContent() {\n const contentCutoff = Date.now() - 24 * 60 * 60 * 1000;\n const dedupeCutoff = Date.now() - 48 * 60 * 60 * 1000;\n try {\n const b = await sqlite.execute({\n sql: `UPDATE triage_v1 SET sender = NULL, subject = NULL, summary = NULL,\n needs_human = NULL, actions_json = NULL, account_name = NULL,\n body = NULL\n WHERE decided_at < ? AND subject IS NOT NULL`,\n args: [contentCutoff],\n });\n const c = await sqlite.execute({\n sql: \"DELETE FROM triage_v1 WHERE decided_at < ?\",\n args: [dedupeCutoff],\n });\n if (b.rowsAffected || c.rowsAffected) {\n console.log(`purge: ${b.rowsAffected} triage rows stripped of content, ${c.rowsAffected} dropped`);\n }\n } catch (err) {\n // A missing table on a fresh val is normal; anything else is worth seeing.\n console.log(\"purge skipped:\", String(err).slice(0, 160));\n }\n}\n\n// How long the office gets before we look. Short enough that the record has not\n// moved on for unrelated reasons, long enough that \"nobody has got to it yet\"\n// is not mistaken for \"they disagreed\".\nconst OBSERVE_AFTER_MS = 20 * 60 * 60 * 1000;\n\nconst OUTCOME_FIELDS: Record = {\n Opportunity: \"Id, CloseDate, Route_Date__c, Needs_Delivery_ASAP__c, StageName\",\n Account: \"Id, Amount_of_Bottles__c, Frequency__c, Water_Type__c, Email_Address__c, Name\",\n};\nconst OUTCOME_PERSONAL = new Set([\"Name\", \"Email_Address__c\"]);\n\nasync function hash8(v: unknown) {\n const buf = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(String(v ?? \"\")));\n return [...new Uint8Array(buf)].slice(0, 8).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\nfunction samish(a: unknown, b: unknown) {\n const n = (v: unknown) =>\n v === null || v === undefined ? \"\" : (typeof v === \"boolean\" ? String(v) : String(v).trim().toLowerCase());\n return n(a) === n(b);\n}\n\n/**\n * Look at what the office actually did with each proposal.\n *\n * AGREED the field now holds what we proposed\n * DIVERGED it holds something else, and something else changed it\n * UNTOUCHED it still holds what it held when we proposed\n *\n * This is the only way to find out whether a rule is right. It reads Salesforce\n * and writes nothing to it.\n */\nasync function observeOutcomes() {\n let rows: any[] = [];\n try {\n rows = (await sqlite.execute({\n sql: `SELECT id, sobject, record_id, field, proposed_from, proposed_to, hashed\n FROM outcome_v1 WHERE observed_at IS NULL AND proposed_at < ? LIMIT 60`,\n args: [Date.now() - OBSERVE_AFTER_MS],\n })).rows as any[];\n } catch {\n return; // table not created yet on a cold val\n }\n if (!rows.length) return;\n\n const { sfQuery } = await import(\"./salesforce.ts\");\n const byObject = new Map();\n for (const r of rows) {\n if (!OUTCOME_FIELDS[r.sobject]) continue;\n if (!byObject.has(r.sobject)) byObject.set(r.sobject, []);\n byObject.get(r.sobject)!.push(String(r.record_id));\n }\n const live: Record = {};\n for (const [sobject, ids] of byObject) {\n const uniqueIds = [...new Set(ids)].filter((id) => /^[a-zA-Z0-9]{15,18}$/.test(id));\n for (let i = 0; i < uniqueIds.length; i += 40) {\n const inList = uniqueIds.slice(i, i + 40).map((id) => `'${id}'`).join(\",\");\n const q = await sfQuery(\n `SELECT ${OUTCOME_FIELDS[sobject]}, LastModifiedBy.Name FROM ${sobject} WHERE Id IN (${inList})`,\n );\n for (const rec of q.records ?? []) live[rec.Id] = rec;\n }\n }\n\n let agreed = 0, diverged = 0, untouched = 0;\n for (const r of rows) {\n const rec = live[String(r.record_id)];\n if (!rec) continue;\n const raw = rec[r.field];\n const seen = r.hashed ? await hash8(raw) : raw;\n let verdict: string;\n if (samish(seen, r.proposed_to)) { verdict = \"agreed\"; agreed++; }\n else if (samish(seen, r.proposed_from)) { verdict = \"untouched\"; untouched++; }\n else { verdict = \"diverged\"; diverged++; }\n await sqlite.execute({\n sql: `UPDATE outcome_v1 SET observed_at = ?, observed_value = ?, observed_by = ?, verdict = ?\n WHERE id = ?`,\n args: [\n Date.now(),\n r.hashed ? String(seen) : (raw === null || raw === undefined ? null : String(raw)),\n String((rec.LastModifiedBy ?? {}).Name ?? \"\"),\n verdict,\n r.id,\n ],\n });\n }\n console.log(`outcomes: observed ${agreed + diverged + untouched} - ${agreed} agreed, ${diverged} diverged, ${untouched} untouched`);\n}\n\nexport default async function () {\n await purgeOldContent();\n try {\n await observeOutcomes();\n } catch (err) {\n // Never let measurement break the digest.\n console.log(\"outcomes skipped:\", String(err).slice(0, 160));\n }\n\n // OFF UNTIL SOMEONE SAYS OTHERWISE. Creating an interval file starts it\n // running immediately on a default schedule, so without this the first thing\n // a newly written digest does is mail the office unasked. Set the env var\n // DIGEST_ENABLED to \"true\" to start sending; everything else keeps working\n // and /triage/digest-preview still shows exactly what would go out.\n if ((Deno.env.get(\"DIGEST_ENABLED\") ?? \"\").toLowerCase() !== \"true\") {\n console.log(\"digest: disabled (set DIGEST_ENABLED=true to start sending)\");\n return;\n }\n const to = Deno.env.get(\"DIGEST_TO\") ?? \"info@tribecabeverage.com\";\n\n const pending = (await sqlite.execute({\n sql: `SELECT * FROM triage_v1 WHERE digested = 0 AND verdict IN ('action','human')\n ORDER BY decided_at ASC LIMIT ?`,\n args: [MAX_ROWS],\n })).rows as any[];\n\n if (!pending.length) {\n console.log(\"digest: nothing pending\");\n return;\n }\n\n const actions = pending.filter((r) => r.verdict === \"action\");\n const humans = pending.filter((r) => r.verdict === \"human\");\n const oldest = Math.min(...pending.map((r) => Number(r.decided_at) || Date.now()));\n const stale = Date.now() - oldest > HOLD_NON_URGENT_MS;\n\n if (!actions.length && !stale) {\n console.log(`digest: holding ${humans.length} non-urgent, oldest ${Math.round((Date.now() - oldest) / 60000)} min`);\n return;\n }\n\n const html = renderDigest(actions, humans);\n\n await email({\n to,\n subject: `Inbox sweep — ${actions.length} to act on, ${humans.length} to read`,\n html,\n text: `${actions.length} ready to act, ${humans.length} need a person. Open the HTML version.`,\n });\n\n await sqlite.batch(\n pending.map((r) => ({\n sql: \"UPDATE triage_v1 SET digested = 1 WHERE message_id = ?\",\n args: [r.message_id],\n })),\n );\n\n console.log(`digest: sent ${actions.length} action, ${humans.length} human to ${to}`);\n}\n",[215],"e23779f7-e699-43a1-a0f8-b1921dde92c9",["D",1789146781521],51,[28],"d45da689-4ccf-4d40-b153-e54fa243c6cf","apollo-tools.ts","9cef414e-a0be-11f1-957d-1607ee4eb77e",143,["D",1788534716081],17,"// Read-only tools for tawk.to's Apollo AI agent.\n//\n// Lives inside this val on purpose: sfQuery is right here, so there's no proxy\n// hop and no Salesforce credentials copied into a second val.\n//\n// GET /openapi.json the schema tawk fetches (public, no auth)\n// GET /account-lookup the tool Apollo calls (x-api-key required)\n// GET / config status\n//\n// Auth uses its OWN key, APOLLO_TOOL_KEY — deliberately NOT API_SHARED_SECRET.\n// That secret unlocks arbitrary SOQL on main.ts; if the tawk integration ever\n// leaked it, the blast radius would be the entire org. This key only reaches\n// the one narrow lookup below.\nimport { sfQuery } from \"./salesforce.ts\";\n\nfunction esc(v: string): string {\n return v.replace(/\\\\/g, \"\\\\\\\\\").replace(/'/g, \"\\\\'\").slice(0, 120);\n}\n\nfunction normalizePhone(raw: string): string | null {\n const d = raw.replace(/\\D/g, \"\");\n const ten = d.length === 11 && d.startsWith(\"1\") ? d.slice(1) : d;\n return ten.length === 10 ? ten : null;\n}\n\nasync function lookupAccount(phoneRaw?: string | null, email?: string | null) {\n const phone = phoneRaw ? normalizePhone(phoneRaw) : null;\n\n // Email lookup is NOT possible with this integration user's permissions:\n // Contact is not accessible at all, Account has no email column, and\n // Lead.Email is hidden by field-level security. Verified by schema probe\n // 2026-08-25. Phone against Account.Phone is the only route.\n if (!phone) {\n return {\n found: false,\n needs_phone: true,\n message: email\n ? \"Accounts can only be looked up by phone number. Ask the visitor for the phone number on their account.\"\n : \"Need a phone number to look up an account.\",\n };\n }\n\n // Account.Phone is stored formatted — \"(DDD) DDD-DDDD\" in this org — so a\n // bare digit string never matches as a substring. Put wildcards between the\n // area code, exchange and line number so any separator style matches, and a\n // trailing wildcard so extensions (\"x12\") don't break it. Wildcards also\n // match empty, so unformatted values still match.\n const [area, exch, line] = [phone.slice(0, 3), phone.slice(3, 6), phone.slice(6)];\n const pattern = `%${esc(area)}%${esc(exch)}%${esc(line)}%`;\n const accounts = (await sfQuery(\n `SELECT Id, Name, Phone FROM Account WHERE Phone LIKE '${pattern}' LIMIT 2`,\n )).records ?? [];\n\n if (!accounts.length) {\n return { found: false, message: \"No account found with that phone number. The office can check other records.\" };\n }\n if (accounts.length > 1) {\n // Ambiguous: never guess whose account this is. Flagged separately from a\n // genuine no-match so the caller can say \"more than one\" rather than the\n // false \"we have no record of you\".\n return {\n found: false,\n ambiguous: true,\n message: \"That number is on more than one account. The office will need to confirm which one.\",\n };\n }\n\n const c = { AccountId: accounts[0].Id, Account: { Name: accounts[0].Name } };\n const accountName = c.Account?.Name ?? \"your account\";\n let nextDelivery: string | null = null;\n\n if (c.AccountId) {\n const today = new Date().toISOString().slice(0, 10);\n // Deliveries are Opportunities; Route_Date__c is the committed route day,\n // CloseDate the fallback before a route is planned.\n const opps = (await sfQuery(\n `SELECT Id, Route_Date__c, CloseDate FROM Opportunity\n WHERE AccountId = '${esc(String(c.AccountId))}'\n AND StageName = 'Delivery Due'\n AND (Route_Date__c >= ${today} OR (Route_Date__c = null AND CloseDate >= ${today}))\n ORDER BY CloseDate ASC LIMIT 1`,\n )).records ?? [];\n if (opps.length) nextDelivery = opps[0].Route_Date__c ?? opps[0].CloseDate ?? null;\n }\n\n return {\n found: true,\n account_name: accountName,\n next_delivery_date: nextDelivery,\n message: nextDelivery\n ? `Account found. Next scheduled delivery is ${nextDelivery}.`\n : \"Account found, but no delivery is currently scheduled. The office can arrange one.\",\n };\n}\n\n/**\n * Has this visitor already submitted a Lead — through the site's popup, an ad\n * form, anywhere — even though they are not an existing customer?\n *\n * WHY THIS EXISTS. A visitor who filled out the website popup gets a real\n * Salesforce Lead with no connection back to the chat at all — no shared\n * identifier, confirmed 9/3/2026 by checking a real one end to end. If they\n * then start chatting, the bot has no way to know they already gave us their\n * email, and asks for it again from scratch. This closes that gap the same\n * way lookupAccount closes it for actual customers: a narrow, read-only\n * check, called only once the visitor has given the chat a phone or email\n * themselves.\n *\n * TWO SEPARATE ATTEMPTS, TWO SEPARATE try/catch BLOCKS. Lead.Email was found\n * hidden by field-level security for this integration user on 2026-08-25 (see\n * lookupAccount above) — so the email attempt is expected to possibly fail,\n * and it must not be able to take the phone attempt down with it. Left\n * genuinely live rather than skipped outright, because a permission can\n * change without this file knowing, and the only honest way to find out is to\n * try and log what actually comes back.\n */\nasync function lookupLead(phoneRaw, email) {\n const phone = phoneRaw ? normalizePhone(phoneRaw) : null;\n if (!phone && !email) {\n return { found: false, message: \"Need a phone number or email to look up a lead.\" };\n }\n if (phone) {\n const [area, exch, line] = [phone.slice(0, 3), phone.slice(3, 6), phone.slice(6)];\n const pattern = `%${esc(area)}%${esc(exch)}%${esc(line)}%`;\n try {\n const leads = (await sfQuery(`SELECT Id, Company, Status, CreatedDate FROM Lead\n WHERE Phone LIKE '${pattern}' AND IsConverted = false\n ORDER BY CreatedDate DESC LIMIT 2`)).records ?? [];\n if (leads.length === 1) {\n return {\n found: true,\n source: \"phone\",\n company: leads[0].Company ?? null,\n status: leads[0].Status ?? null,\n created_date: leads[0].CreatedDate ? String(leads[0].CreatedDate).slice(0, 10) : null,\n };\n }\n if (leads.length > 1) {\n return { found: false, ambiguous: true, message: \"More than one lead matches that phone number.\" };\n }\n }\n catch (err) {\n console.warn(\"lead-lookup phone query failed:\", String(err).slice(0, 200));\n }\n }\n if (email) {\n try {\n const leads = (await sfQuery(`SELECT Id, Company, Status, CreatedDate FROM Lead\n WHERE Email = '${esc(email)}' AND IsConverted = false\n ORDER BY CreatedDate DESC LIMIT 2`)).records ?? [];\n if (leads.length === 1) {\n return {\n found: true,\n source: \"email\",\n company: leads[0].Company ?? null,\n status: leads[0].Status ?? null,\n created_date: leads[0].CreatedDate ? String(leads[0].CreatedDate).slice(0, 10) : null,\n };\n }\n if (leads.length > 1) {\n return { found: false, ambiguous: true, message: \"More than one lead matches that email address.\" };\n }\n }\n catch (err) {\n // NOT logged as an error — an inaccessible field is an expected,\n // already-documented outcome, not a fault in this code.\n console.warn(\"lead-lookup email query failed (Lead.Email may still be FLS-restricted):\", String(err).slice(0, 200));\n }\n }\n return { found: false, message: \"No matching lead found.\" };\n}\n// Descriptions are read by the AI as instructions, per tawk's docs — so they\n// say when to call and what not to say, not what a developer would want.\nconst openapi = (origin: string) => ({\n openapi: \"3.0.3\",\n info: { title: \"TriBeCa Beverage account tools\", version: \"1.0.0\" },\n servers: [{ url: origin }],\n paths: {\n \"/account-lookup\": {\n get: {\n operationId: \"lookupAccount\",\n summary: \"Look up the customer's own account and next delivery date\",\n description:\n \"Call this when a visitor asks about THEIR OWN account: whether they are already a customer, when their next delivery is, or whether one is scheduled. \" +\n \"You must have a phone number or email address the visitor themselves gave you in this conversation — ask for one if you do not have it. \" +\n \"Never call this with a name only, and never with details the visitor did not provide. \" +\n \"Report only what the response contains. If found is false, say you could not find the account and offer to have the office check. Never confirm or deny whether some other person or business is a customer. \" +\n \"Never promise to change, cancel, or reschedule a delivery — you can only report what is already scheduled.\",\n parameters: [\n {\n name: \"phone\",\n in: \"query\",\n required: false,\n schema: { type: \"string\" },\n description: \"Phone number as the visitor gave it; any common format is fine.\",\n },\n {\n name: \"email\",\n in: \"query\",\n required: false,\n schema: { type: \"string\" },\n description: \"Email address the visitor gave.\",\n },\n ],\n responses: {\n \"200\": {\n description: \"Lookup result, always present even when nothing matched.\",\n content: {\n \"application/json\": {\n schema: {\n type: \"object\",\n properties: {\n found: { type: \"boolean\", description: \"Whether exactly one account matched.\" },\n account_name: { type: \"string\", description: \"Account name on file.\" },\n next_delivery_date: {\n type: \"string\",\n nullable: true,\n description: \"Next scheduled delivery (YYYY-MM-DD), or null if none.\",\n },\n message: {\n type: \"string\",\n description: \"Plain-language summary. Prefer relaying this over inventing wording.\",\n },\n },\n required: [\"found\", \"message\"],\n },\n },\n },\n },\n },\n },\n },\n },\n});\n\n/** The same gate /account-lookup uses. Returns null when the key checks out. */\nfunction rejectUnlessKeyed(req: Request, label: string): Response | null {\n const expected = Deno.env.get(\"APOLLO_TOOL_KEY\");\n if (!expected) return Response.json({ error: \"APOLLO_TOOL_KEY not set on this val\" }, { status: 500 });\n const supplied = req.headers.get(\"x-api-key\");\n if (supplied !== expected) {\n console.warn(\n supplied === null\n ? `${label} REJECTED: no x-api-key header`\n : `${label} REJECTED: x-api-key present but wrong (length ${supplied.length})`,\n );\n return Response.json({ error: \"Unauthorized\" }, { status: 401 });\n }\n return null;\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const origin = url.origin;\n\n if (url.pathname === \"/openapi.json\") return Response.json(openapi(origin));\n\n // Account creation. THE ONLY WRITE IN THIS VAL.\n //\n // POST only, deliberately: a write behind a GET is one link preview or\n // crawler away from creating accounts nobody asked for.\n //\n // This endpoint is NOT in openapi.json. That schema is fetched publicly by\n // tawk, and publishing a create-account tool there would hand it to whichever\n // agent happens to read it. Only our own chat calls this, with the key.\n if (url.pathname === \"/create-account\") {\n if (req.method !== \"POST\") return Response.json({ error: \"POST required\" }, { status: 405 });\n\n const rejected = rejectUnlessKeyed(req, \"create-account\");\n if (rejected) return rejected;\n\n try {\n const { createAccount } = await import(\"./create-account.ts\");\n const result = await createAccount(await req.json().catch(() => ({})));\n // A refusal comes back as HTTP 200 with ok:false. The caller is a chat bot\n // that has to say something to a customer, and \"you already have an\n // account\" or \"a person needs to assign your route\" are answers, not\n // failures — an HTTP error would just become a generic apology.\n return Response.json(result);\n } catch (err) {\n console.error(\"create-account failed:\", err);\n return Response.json({\n ok: false,\n reason: \"error\",\n message: \"The account could not be created right now. The office can set it up.\",\n });\n }\n }\n\n // Balance and pay link. POST only and NOT in openapi.json, for the same\n // reason as /create-account: that schema is public, and this returns money\n // and a link that can update a card on file.\n if (url.pathname === \"/invoice-status\") {\n if (req.method !== \"POST\") return Response.json({ error: \"POST required\" }, { status: 405 });\n\n const rejected = rejectUnlessKeyed(req, \"invoice-status\");\n if (rejected) return rejected;\n\n try {\n const { invoiceStatus } = await import(\"./invoice.ts\");\n const body = await req.json().catch(() => ({}));\n // `authenticated` must mean a real credential check — a signed-in\n // WordPress session. The caller asserts it; this endpoint trusts the\n // caller because the caller holds the key. A phone number is not it.\n const out = await invoiceStatus(body.phone ?? null, { authenticated: body.authenticated === true });\n console.log(`invoice-status found=${out.found} due=${out.balanceDue ?? \"-\"} link=${out.payLink ? \"yes\" : \"no\"}`);\n return Response.json(out);\n } catch (err) {\n console.error(\"invoice-status failed:\", err);\n // A failed query must never read as \"you owe nothing\".\n return Response.json({\n found: false,\n errored: true,\n message: \"I can't check the balance right now. A team member can look it up directly.\",\n });\n }\n }\n\n // NOT IN openapi.json, same reasoning as /create-account and\n // /invoice-status: that schema is fetched publicly by tawk's Apollo agent,\n // and a Lead is closer to a stranger's contact info than an account is —\n // no reason to widen who can query it beyond our own chat, which holds\n // the key.\n if (url.pathname === \"/lead-lookup\") {\n const rejected = rejectUnlessKeyed(req, \"lead-lookup\");\n if (rejected) return rejected;\n\n try {\n const result = await lookupLead(url.searchParams.get(\"phone\"), url.searchParams.get(\"email\"));\n console.log(`lead-lookup found=${result.found} source=${(result as any).source ?? \"-\"}`);\n return Response.json(result);\n } catch (err) {\n console.error(\"lead-lookup failed:\", err);\n return Response.json({\n found: false,\n errored: true,\n message: \"The lookup service is unavailable right now.\",\n });\n }\n }\n\n if (url.pathname === \"/account-lookup\") {\n const expected = Deno.env.get(\"APOLLO_TOOL_KEY\");\n if (!expected) return Response.json({ error: \"APOLLO_TOOL_KEY not set on this val\" }, { status: 500 });\n const supplied = req.headers.get(\"x-api-key\");\n if (supplied !== expected) {\n // Log rejections too, otherwise \"never called\" and \"called with the wrong\n // key\" are indistinguishable when debugging the tawk integration.\n // Never log the value itself — just enough to tell the cases apart.\n console.warn(\n supplied === null\n ? `account-lookup REJECTED: no x-api-key header (headers seen: ${\n [...req.headers.keys()].join(\", \")\n })`\n : `account-lookup REJECTED: x-api-key present but wrong (length ${supplied.length})`,\n );\n return Response.json({ error: \"Unauthorized\" }, { status: 401 });\n }\n try {\n const result = await lookupAccount(url.searchParams.get(\"phone\"), url.searchParams.get(\"email\"));\n console.log(`account-lookup found=${result.found}`);\n return Response.json(result);\n } catch (err) {\n console.error(\"account-lookup failed:\", err);\n // errored is distinct from found:false on purpose. A failed query must\n // never be reported to a visitor as \"no account found\" — that is a\n // different, and wrong, statement about their account.\n // Never leak internals to a customer-facing agent.\n return Response.json({\n found: false,\n errored: true,\n message: \"The lookup service is unavailable right now. The office can check directly.\",\n });\n }\n }\n\n const ok = (v: string) => (Deno.env.get(v) ? \"set\" : \"MISSING\");\n return new Response(\n `Apollo tools\n\n

Apollo tools

tawk → Automation → Integrations → OpenAPI Server:

Schema File URL

${origin}/openapi.json

\nAPI base URL

${origin}

\nAuth: API key · Key x-api-key · Value = APOLLO_TOOL_KEY

APOLLO_TOOL_KEY: ${ok(\"APOLLO_TOOL_KEY\")}

view schema

`,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n}\n","tribeca-apollo",[228],"0b87765f-4eb2-47ba-841b-52d908840c4c","README.md","df7174d2-8a17-11f1-ad76-1607ee4eb77e",["D",1785197056265],"# Tribeca Salesforce Agent\n\nRead-only access to Salesforce Account and Opportunity data via OAuth Client Credentials Flow, scoped by the \"Salesforce Agent\" permission set.\n",[237],"pulls","branches","forks","envVars",{"_249":251,"_252":63},"connections",{"_249":63,"_250":63},"count","unfilledCount",13,"emptyCount",{"_43":236,"_32":237,"_30":238,"_146":-5,"_41":42,"_40":150,"_148":59,"_38":303,"_13":63,"_33":20,"_35":240,"_24":25,"_152":-5,"_267":304,"_27":305},{"_43":227,"_32":228,"_30":229,"_146":-5,"_41":42,"_40":230,"_148":59,"_38":300,"_13":232,"_33":160,"_35":233,"_24":25,"_152":234,"_267":301,"_27":302},{"_43":223,"_32":28,"_30":31,"_146":-5,"_41":42,"_40":14,"_148":25,"_38":297,"_13":225,"_33":34,"_35":37,"_24":25,"_152":-5,"_267":298,"_27":299},{"_43":214,"_32":215,"_30":216,"_146":-5,"_41":42,"_40":217,"_148":25,"_38":294,"_13":219,"_33":220,"_35":221,"_24":25,"_152":-5,"_267":295,"_27":296},{"_43":206,"_32":207,"_30":208,"_146":-5,"_41":42,"_40":209,"_148":25,"_38":291,"_13":211,"_33":160,"_35":212,"_24":25,"_152":-5,"_267":292,"_27":293},{"_43":199,"_32":200,"_30":201,"_146":-5,"_41":42,"_40":202,"_148":59,"_38":288,"_13":166,"_33":34,"_35":204,"_24":25,"_152":-5,"_267":289,"_27":290},{"_43":192,"_32":193,"_30":57,"_146":-5,"_41":42,"_40":194,"_148":59,"_38":285,"_13":196,"_33":160,"_35":197,"_24":25,"_152":-5,"_267":286,"_27":287},{"_43":184,"_32":185,"_30":186,"_146":-5,"_41":42,"_40":187,"_148":59,"_38":282,"_13":189,"_33":34,"_35":190,"_24":25,"_152":-5,"_267":283,"_27":284},{"_43":177,"_32":178,"_30":179,"_146":-5,"_41":42,"_40":180,"_148":59,"_38":279,"_13":150,"_33":34,"_35":182,"_24":25,"_152":-5,"_267":280,"_27":281},{"_43":170,"_32":171,"_30":172,"_146":-5,"_41":42,"_40":173,"_148":59,"_38":276,"_13":63,"_33":34,"_35":175,"_24":25,"_152":-5,"_267":277,"_27":278},{"_43":163,"_32":164,"_30":165,"_146":-5,"_41":42,"_40":166,"_148":59,"_38":273,"_13":63,"_33":160,"_35":168,"_24":25,"_152":-5,"_267":274,"_27":275},{"_43":154,"_32":155,"_30":156,"_146":-5,"_41":42,"_40":157,"_148":59,"_38":270,"_13":159,"_33":160,"_35":161,"_24":25,"_152":-5,"_267":271,"_27":272},{"_43":143,"_32":144,"_30":145,"_146":-5,"_41":42,"_40":147,"_148":59,"_38":266,"_13":150,"_33":34,"_35":151,"_24":25,"_152":-5,"_267":268,"_27":269},["D",1788536535693],"children",[],[144],["D",1789144012730],[],[155],["D",1785242184864],[],[164],["D",1788537806456],[],[171],["D",1788538986202],[],[178],["D",1786983868322],[],[185],["D",1789068572223],[],[193],["D",1788284535958],[],[200],["D",1789144387673],[],[207],["D",1789143995926],[],[215],["D",1789146781521],[],[28],["D",1788534716081],[],[228],["D",1785197056265],[],[237],["D",1785197056244],["D",1789491713377],{"_100":99,"_107":-5},{"_100":99,"_101":102,"_103":-5,"_18":-5,"_104":105,"_106":25},{"_13":89,"_32":90,"_43":42,"_91":44,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":45,"_98":99},"ctx",{"_82":-5,"_127":344,"_345":346,"_347":348,"_349":25,"_350":25,"_351":25,"_352":59,"_353":-5,"_354":-7,"_355":-7,"_356":63,"_357":25,"_358":25,"_359":-5,"_360":25,"_361":25,"_362":25,"_363":-5},"ENV",{"_315":316,"_317":318,"_319":90,"_320":321,"_322":323,"_324":325,"_326":327,"_328":329,"_330":331,"_332":333,"_334":335,"_336":337,"_338":339,"_340":341,"_342":343},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v281