[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_172":173,"_174":175},"routes/_app.x.$handle.$name",{"_99":98,"_32":45,"_107":89,"_27":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":25,"_122":123,"_124":58,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",112,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","37350edc-a1be-11f1-bfeb-1607ee4eb77e","name","fileType","http","content","// Backend for the Amazon Pharmacy RFP reference-call demo agent (Vapi tool server).\n// One endpoint, dispatched by function name.\n//\n// Consolidated from gerardroy/amazon-pharmacy-rfp-demo (the base) plus the five\n// account-lifecycle handlers that were stranded in gerardroy/amazon-pharmacy-mock-sandbox.\n// Both of those enforced verification server side keyed per call ID, independently, so\n// attaching tools from both would mean verifying against one did not verify against the\n// other. One backend, one OTP table, one verification gate.\n//\n// Design rules, carried from prior pharmacy builds plus what this RFP grades:\n// - The OTP is generated, stored and compared HERE; the model never sees the code.\n// - Verification is enforced server-side, not by a model-supplied boolean.\n// - No arithmetic in the model: prices, doses and day supplies are precomputed AND\n// pre-worded (`*_spoken`) so currency and dose registers are always read correctly.\n// - A misheard drug name returns `did_you_mean`, never a bare failure.\n// - Business failures are HTTP 200 with an `error` discriminator the model can act on.\n// Only a genuinely broken request is a 4xx.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport {\n CATALOG, Drug, Lang, decimalWords, didYouMean, digitWords, intWords, matchDrug, moneyWords,\n resolveSupply, strengthWords, supplyNote, unitLong,\n} from \"./catalog.ts\";\n\n// ---- order history -----------------------------------------------------------\n// One fixture per profile, selected by the caller's ANI. Each `medication` is an exact\n// CATALOG name and each `strength` and `days_supply` is a value that drug really\n// carries, so \"what happened to my lisinopril\", \"reorder it\" and \"how much is\n// lisinopril\" are the same drug quoting the same numbers from the same source.\n//\n// Every profile carries the same FOUR shapes, because the demo leans on all four and a\n// caller who lands on a fixture missing one hits a dead end mid-demo:\n// 1. in flight shipped / in_transit -> delivery tracking has something to track\n// 2. preparing processing / preparing, no prescriber -> a renewal has to escalate\n// 3. delivered refills remaining -> a reorder succeeds\n// 4. delivered refills_remaining 0 -> a reorder fails into a renewal\n// The two delivered orders in each set are deliberately priced apart, because `claims()`\n// derives claim amounts from them and two equal amounts would make every \"reverse that\n// charge\" ask ambiguous.\n//\n// Dates are offsets, not literals, so the fixture cannot go stale between now and the\n// demo. An order that is still moving stays a day or two out no matter when it is read.\ntype Order = {\n order_id: string;\n medication: string;\n strength: number;\n days_supply: number;\n status: \"delivered\" | \"shipped\" | \"processing\";\n delivery_state: \"delivered\" | \"in_transit\" | \"preparing\";\n orderedDaysAgo: number;\n etaDaysFromNow: number;\n refills_remaining: number;\n prescriber: string | null;\n carrier: string;\n tracking_note: string;\n};\n\n// The original fixture, unchanged. Every regression simulation written so far, and the\n// default rendering of GET /orders, expects exactly these four orders, so nothing here\n// moves when a new profile is added.\nconst VELTSON_ORDERS: Order[] = [\n {\n order_id: \"ORD-58204\", medication: \"Zepbound\", strength: 12.5, days_supply: 84,\n status: \"shipped\", delivery_state: \"in_transit\",\n orderedDaysAgo: 8, etaDaysFromNow: 2,\n refills_remaining: 2, prescriber: \"Dr. Marcus Hale\", carrier: \"Amazon Logistics\",\n tracking_note: \"Left the regional facility overnight; last scan was Kent, Washington this morning.\",\n },\n {\n order_id: \"ORD-57731\", medication: \"Lisinopril\", strength: 10, days_supply: 90,\n status: \"delivered\", delivery_state: \"delivered\",\n orderedDaysAgo: 43, etaDaysFromNow: -39,\n refills_remaining: 3, prescriber: \"Dr. Anita Rao\", carrier: \"Amazon Logistics\",\n tracking_note: \"Left at the front door, photo on file.\",\n },\n {\n order_id: \"ORD-57402\", medication: \"Atorvastatin\", strength: 20, days_supply: 90,\n status: \"processing\", delivery_state: \"preparing\",\n orderedDaysAgo: 2, etaDaysFromNow: 3,\n // No prescriber on file, so a renewal on this one has to escalate.\n refills_remaining: 2, prescriber: null, carrier: \"Amazon Logistics\",\n tracking_note: \"Still at the fulfilment pharmacy; it has not been handed to the carrier yet.\",\n },\n {\n order_id: \"ORD-56119\", medication: \"Metformin\", strength: 500, days_supply: 90,\n status: \"delivered\", delivery_state: \"delivered\",\n // Out of refills, so a reorder has to fail into a renewal, and the renewal succeeds.\n orderedDaysAgo: 68, etaDaysFromNow: -64,\n refills_remaining: 0, prescriber: \"Dr. Anita Rao\", carrier: \"Amazon Logistics\",\n tracking_note: \"Delivered to the mailbox.\",\n },\n];\n\n// The fixture an unrecognised caller gets, and the one that matters most: an Amazon\n// evaluator dialling from their own handset lands here. Different medications from the\n// veltson set so it is visibly a different account, same four shapes so nothing in the\n// demo is unreachable from it.\nconst DEFAULT_ORDERS: Order[] = [\n {\n // Strength 2 rather than 1 on purpose. A strength of exactly one reads as \"one\n // milligrams\" through the shared spoken-unit formatter, and this is the account an\n // evaluator is most likely to land on, so the fixture sidesteps it rather than\n // reaching into formatting code the whole catalog shares.\n order_id: \"ORD-70110\", medication: \"Ozempic\", strength: 2, days_supply: 84,\n status: \"shipped\", delivery_state: \"in_transit\",\n orderedDaysAgo: 6, etaDaysFromNow: 2,\n refills_remaining: 2, prescriber: \"Dr. Priya Raman\", carrier: \"Amazon Logistics\",\n tracking_note: \"Scanned out of the Sumner, Washington facility late last night.\",\n },\n {\n order_id: \"ORD-70255\", medication: \"Rosuvastatin\", strength: 10, days_supply: 90,\n status: \"processing\", delivery_state: \"preparing\",\n orderedDaysAgo: 1, etaDaysFromNow: 4,\n // No prescriber on file, so a renewal on this one has to escalate.\n refills_remaining: 2, prescriber: null, carrier: \"Amazon Logistics\",\n tracking_note: \"Still at the fulfilment pharmacy; it has not been handed to the carrier yet.\",\n },\n {\n order_id: \"ORD-70388\", medication: \"Losartan\", strength: 50, days_supply: 90,\n status: \"delivered\", delivery_state: \"delivered\",\n orderedDaysAgo: 37, etaDaysFromNow: -33,\n refills_remaining: 3, prescriber: \"Dr. Owen Castellanos\", carrier: \"Amazon Logistics\",\n tracking_note: \"Left at the front door, photo on file.\",\n },\n {\n order_id: \"ORD-70471\", medication: \"Duloxetine\", strength: 30, days_supply: 90,\n status: \"delivered\", delivery_state: \"delivered\",\n // Out of refills, so a reorder has to fail into a renewal, and the renewal succeeds.\n orderedDaysAgo: 74, etaDaysFromNow: -70,\n refills_remaining: 0, prescriber: \"Dr. Owen Castellanos\", carrier: \"Amazon Logistics\",\n tracking_note: \"Delivered to the mailbox.\",\n },\n];\n\nconst PROFILE_2_ORDERS: Order[] = [\n {\n order_id: \"ORD-72130\", medication: \"Mounjaro\", strength: 7.5, days_supply: 84,\n status: \"shipped\", delivery_state: \"in_transit\",\n orderedDaysAgo: 9, etaDaysFromNow: 1,\n refills_remaining: 1, prescriber: \"Dr. Naomi Whitfield\", carrier: \"Amazon Logistics\",\n tracking_note: \"On the truck for delivery; last scan was the local station this morning.\",\n },\n {\n order_id: \"ORD-72264\", medication: \"Escitalopram\", strength: 10, days_supply: 90,\n status: \"processing\", delivery_state: \"preparing\",\n orderedDaysAgo: 3, etaDaysFromNow: 2,\n refills_remaining: 3, prescriber: null, carrier: \"Amazon Logistics\",\n tracking_note: \"Still at the fulfilment pharmacy; it has not been handed to the carrier yet.\",\n },\n {\n order_id: \"ORD-72391\", medication: \"Amlodipine\", strength: 5, days_supply: 90,\n status: \"delivered\", delivery_state: \"delivered\",\n orderedDaysAgo: 51, etaDaysFromNow: -47,\n refills_remaining: 2, prescriber: \"Dr. Samuel Ortega\", carrier: \"Amazon Logistics\",\n tracking_note: \"Handed to a resident at the door.\",\n },\n {\n order_id: \"ORD-72485\", medication: \"Gabapentin\", strength: 300, days_supply: 90,\n status: \"delivered\", delivery_state: \"delivered\",\n orderedDaysAgo: 62, etaDaysFromNow: -58,\n refills_remaining: 0, prescriber: \"Dr. Samuel Ortega\", carrier: \"Amazon Logistics\",\n tracking_note: \"Delivered to the mailbox.\",\n },\n];\n\nconst PROFILE_3_ORDERS: Order[] = [\n {\n order_id: \"ORD-74140\", medication: \"Trulicity\", strength: 1.5, days_supply: 84,\n status: \"shipped\", delivery_state: \"in_transit\",\n orderedDaysAgo: 5, etaDaysFromNow: 3,\n refills_remaining: 2, prescriber: \"Dr. Elena Vasquez\", carrier: \"Amazon Logistics\",\n tracking_note: \"Left the regional facility overnight and is moving toward the local station.\",\n },\n {\n order_id: \"ORD-74278\", medication: \"Pantoprazole\", strength: 40, days_supply: 90,\n status: \"processing\", delivery_state: \"preparing\",\n orderedDaysAgo: 2, etaDaysFromNow: 3,\n refills_remaining: 1, prescriber: null, carrier: \"Amazon Logistics\",\n tracking_note: \"Still at the fulfilment pharmacy; it has not been handed to the carrier yet.\",\n },\n {\n order_id: \"ORD-74362\", medication: \"Metoprolol\", strength: 50, days_supply: 90,\n status: \"delivered\", delivery_state: \"delivered\",\n orderedDaysAgo: 46, etaDaysFromNow: -42,\n refills_remaining: 2, prescriber: \"Dr. Theo Lindqvist\", carrier: \"Amazon Logistics\",\n tracking_note: \"Left at the front door, photo on file.\",\n },\n {\n order_id: \"ORD-74499\", medication: \"Bupropion XL\", strength: 150, days_supply: 90,\n status: \"delivered\", delivery_state: \"delivered\",\n orderedDaysAgo: 80, etaDaysFromNow: -76,\n refills_remaining: 0, prescriber: \"Dr. Theo Lindqvist\", carrier: \"Amazon Logistics\",\n tracking_note: \"Delivered to the mailroom in the lobby.\",\n },\n];\n\nconst DAY_MS = 86400000;\nconst isoDay = (offsetDays: number) =>\n new Date(Date.now() + offsetDays * DAY_MS).toISOString().slice(0, 10);\n\nconst orderDate = (o: Order) => isoDay(-o.orderedDaysAgo);\nconst orderEta = (o: Order) => isoDay(o.etaDaysFromNow);\n\nconst drugFor = (o: Order): Drug => CATALOG.find((d) => d.name === o.medication)!;\n// What the plan actually paid, taken from the catalog rather than stored alongside it,\n// so an order and a fresh price quote for the same drug can never disagree.\nconst orderPaid = (o: Order): number => drugFor(o).insurance[String(o.days_supply)] ?? 0;\n\n// Every helper below takes the order set explicitly rather than closing over one. A\n// helper that reaches for a module-level fixture is a helper that silently reads the\n// wrong caller's account the moment a second profile exists.\nconst mostRecentOrder = (orders: Order[]) =>\n [...orders].sort((a, b) => a.orderedDaysAgo - b.orderedDaysAgo)[0];\n\n// ---- language ----------------------------------------------------------------\n// The tool call carries `language` as a Vapi STATIC parameter, so it is always present and\n// never model-generated. Resolved ONCE at the top of handleTool and threaded down, the same\n// way the profile is, because a handler that re-resolves it is a handler that can answer\n// half a turn in the wrong language.\n//\n// Anything unrecognised is English. A missing field, a locale tag (\"es-MX\", \"es-419\") and a\n// full name (\"Spanish\") all land somewhere sensible; nothing else changes behaviour.\n//\n// What is and is not translated, deliberately: every `*_spoken` field is, because the model\n// reads those verbatim and the RFP grades spoken number formatting. `message`, `next_step`\n// and `instruction` are NOT, because they are directives addressed to the model rather than\n// words for the caller, and the model renders its own speech in the call's language.\nfunction langFor(args: any): Lang {\n const s = String(args?.language ?? \"\").trim().toLowerCase();\n if (s.startsWith(\"es\") || s.startsWith(\"spanish\") || s.startsWith(\"español\")) return \"es\";\n return \"en\";\n}\n\n// Fixed spoken phrases that carry no number. Kept in one table so the Spanish can be read\n// and corrected in a single place rather than hunted through thirteen handlers.\nconst PHRASE = {\n byEightPm: { en: \"by eight PM\", es: \"antes de las ocho de la noche\" },\n businessDays: { en: \"one to two business days\", es: \"de uno a dos días hábiles\" },\n transferExpected: {\n en: \"one to two business days, and we will text you when it lands\",\n es: \"de uno a dos días hábiles, y le enviaremos un mensaje de texto cuando llegue\",\n },\n withinADay: { en: \"within twenty-four hours\", es: \"en un plazo de veinticuatro horas\" },\n and: { en: \" and \", es: \" y \" },\n} as const;\nconst say = (k: keyof typeof PHRASE, lang: Lang) => PHRASE[k][lang];\n\n// English keeps the adjectival singular here (\"eighty-four day\", as in \"an eighty-four day\n// supply\"). Spanish has no such form, so it reads as a plain count of days.\nconst daysSpoken = (n: number, lang: Lang = \"en\") =>\n lang === \"es\" ? `${intWords(n, \"es\", \"m\")} día${n === 1 ? \"\" : \"s\"}` : `${intWords(n)} day`;\n\n// The English path composes a strength as decimalWords plus a plural unit, which reads\n// \"one milligrams\" at exactly 1. Reproduced verbatim rather than fixed, because English\n// output is frozen. The Spanish path uses strengthWords, where that agreement is graded.\nconst looseStrengthSpoken = (v: number, unit: string, lang: Lang) =>\n lang === \"es\" ? strengthWords(v, unit, \"es\") : `${decimalWords(v)} ${unitLong(unit)}`;\n\n// ---- spoken dates ------------------------------------------------------------\nconst MONTHS = [\"January\",\"February\",\"March\",\"April\",\"May\",\"June\",\"July\",\"August\",\n \"September\",\"October\",\"November\",\"December\"];\nconst WEEKDAYS = [\"Sunday\",\"Monday\",\"Tuesday\",\"Wednesday\",\"Thursday\",\"Friday\",\"Saturday\"];\n// Spanish month and weekday names are lowercase, and a Spanish date takes a plain cardinal\n// rather than an ordinal: \"tres de septiembre\", not \"tercero de septiembre\". Only the first\n// of the month keeps an ordinal, which is why ordinalWords has no Spanish counterpart.\nconst MONTHS_ES = [\"enero\",\"febrero\",\"marzo\",\"abril\",\"mayo\",\"junio\",\"julio\",\"agosto\",\n \"septiembre\",\"octubre\",\"noviembre\",\"diciembre\"];\nconst WEEKDAYS_ES = [\"domingo\",\"lunes\",\"martes\",\"miércoles\",\"jueves\",\"viernes\",\"sábado\"];\nconst dayNumberEs = (n: number) => n === 1 ? \"primero\" : intWords(n, \"es\", \"m\");\nconst ORD_IRREGULAR: Record = {\n one: \"first\", two: \"second\", three: \"third\", five: \"fifth\",\n eight: \"eighth\", nine: \"ninth\", twelve: \"twelfth\",\n};\n\n// 14 -> \"fourteenth\", 21 -> \"twenty-first\", 30 -> \"thirtieth\". Built off intWords so the\n// date register matches the money and dose registers instead of drifting from them.\nfunction ordinalWords(n: number): string {\n const w = intWords(n);\n const cut = Math.max(w.lastIndexOf(\"-\"), w.lastIndexOf(\" \"));\n const head = w.slice(0, cut + 1), tail = w.slice(cut + 1);\n if (ORD_IRREGULAR[tail]) return head + ORD_IRREGULAR[tail];\n if (tail.endsWith(\"y\")) return head + tail.slice(0, -1) + \"ieth\";\n return head + tail + \"th\";\n}\n\nconst asDate = (iso: string) => new Date(iso + \"T12:00:00Z\");\nconst dateSpoken = (iso: string, lang: Lang = \"en\") => {\n const d = asDate(iso);\n if (lang === \"es\") return `${dayNumberEs(d.getUTCDate())} de ${MONTHS_ES[d.getUTCMonth()]}`;\n return `${MONTHS[d.getUTCMonth()]} ${ordinalWords(d.getUTCDate())}`;\n};\nconst dayAndDateSpoken = (iso: string, lang: Lang = \"en\") => {\n const d = asDate(iso);\n if (lang === \"es\") {\n return `${WEEKDAYS_ES[d.getUTCDay()]}, ${dayNumberEs(d.getUTCDate())} de ${MONTHS_ES[d.getUTCMonth()]}`;\n }\n return `${WEEKDAYS[d.getUTCDay()]}, ${MONTHS[d.getUTCMonth()]} ${ordinalWords(d.getUTCDate())}`;\n};\n\n// Spanish letter names, so a confirmation number is spelled \"o, erre, de\" rather than the\n// English alphabet read at a Spanish caller. Only ORD, RNW, CLM and TRF are spelled today;\n// the whole alphabet is here so a new prefix is not a silent regression.\nconst ES_LETTERS: Record = {\n a:\"a\", b:\"be\", c:\"ce\", d:\"de\", e:\"e\", f:\"efe\", g:\"ge\", h:\"hache\", i:\"i\", j:\"jota\",\n k:\"ka\", l:\"ele\", m:\"eme\", n:\"ene\", o:\"o\", p:\"pe\", q:\"cu\", r:\"erre\", s:\"ese\", t:\"te\",\n u:\"u\", v:\"ve\", w:\"doble ve\", x:\"equis\", y:\"ye\", z:\"zeta\",\n};\n\n// Identifiers are read digit by digit, never as a number and never with hyphens.\nconst idSpoken = (prefix: string, id: string, lang: Lang = \"en\") =>\n lang === \"es\"\n ? `${prefix.split(\"\").map((c) => ES_LETTERS[c.toLowerCase()] ?? c).join(\", \")}, ${digitWords(id, \"es\")}`\n : `${prefix.split(\"\").join(\" \")}, ${digitWords(id)}`;\n\nconst STATUS_SPOKEN: Record = {\n delivered: \"delivered\",\n shipped: \"shipped and on its way\",\n processing: \"being prepared at the pharmacy\",\n};\nconst DELIVERY_SPOKEN: Record = {\n delivered: \"delivered\",\n in_transit: \"out with the carrier\",\n preparing: \"not handed to the carrier yet\",\n};\nconst STATUS_SPOKEN_ES: Record = {\n delivered: \"entregado\",\n shipped: \"enviado y en camino\",\n processing: \"en preparación en la farmacia\",\n};\nconst DELIVERY_SPOKEN_ES: Record = {\n delivered: \"entregado\",\n in_transit: \"con el transportista\",\n preparing: \"aún no se ha entregado al transportista\",\n};\nconst statusSpoken = (s: string, lang: Lang) => (lang === \"es\" ? STATUS_SPOKEN_ES : STATUS_SPOKEN)[s];\nconst deliverySpoken = (s: string, lang: Lang) => (lang === \"es\" ? DELIVERY_SPOKEN_ES : DELIVERY_SPOKEN)[s];\n\n// \"resurtido\" is the Mexican pharmacy term for a refill on an existing prescription, as\n// distinct from \"renovación\", the renewal this demo also offers. Keeping them apart matters\n// here, because create_reorder and request_prescription_renewal are two different tools.\nconst refillsSpoken = (n: number, lang: Lang = \"en\") =>\n lang === \"es\"\n ? `${intWords(n, \"es\", \"m\")} resurtido${n === 1 ? \"\" : \"s\"}`\n : `${intWords(n)} refill${n === 1 ? \"\" : \"s\"}`;\n\n// Every speakable value on an order, pre-worded. The model reads these verbatim and\n// never formats a number itself.\nfunction orderView(o: Order, lang: Lang = \"en\") {\n const d = drugFor(o);\n const landed = o.status === \"delivered\";\n const eta = orderEta(o);\n return {\n order_id: o.order_id,\n order_id_spoken: idSpoken(\"ORD\", o.order_id, lang),\n medication: o.medication,\n generic: d.generic,\n form: d.form,\n strength: o.strength,\n strength_spoken: strengthWords(o.strength, d.unit, lang),\n days_supply: o.days_supply,\n days_supply_spoken: daysSpoken(o.days_supply, lang),\n status: o.status,\n status_spoken: statusSpoken(o.status, lang),\n order_date: orderDate(o),\n order_date_spoken: dateSpoken(orderDate(o), lang),\n refills_remaining: o.refills_remaining,\n refills_remaining_spoken: refillsSpoken(o.refills_remaining, lang),\n delivery_state: o.delivery_state,\n delivery_state_spoken: deliverySpoken(o.delivery_state, lang),\n delivered_on_spoken: landed ? dayAndDateSpoken(eta, lang) : null,\n eta_spoken: landed ? null : `${dayAndDateSpoken(eta, lang)} ${say(\"byEightPm\", lang)}`,\n amount_paid_spoken: moneyWords(orderPaid(o), lang),\n carrier: o.carrier,\n };\n}\n\nconst onFileSpoken = (orders: Order[], lang: Lang = \"en\") =>\n orders.map((o) => `${o.medication} ${looseStrengthSpoken(o.strength, drugFor(o).unit, lang)}`)\n .join(\", \");\n\n// Resolves a spoken medication name to an order on this account. A mangled name still\n// goes through did_you_mean; a real catalog drug with no order is a different failure.\nfunction findOrder(nameRaw: unknown, orders: Order[]) {\n const m = matchDrug(nameRaw);\n const order = m.exact ? (orders.find((o) => o.medication === m.exact!.name) ?? null) : null;\n return { match: m, order };\n}\n\nconst notOnFile = (nameRaw: unknown, orders: Order[], lang: Lang = \"en\") => ({\n error: \"medication_not_on_file\",\n medications_on_file_spoken: onFileSpoken(orders, lang),\n message: `There is no prescription for \"${String(nameRaw ?? \"\")}\" on this account. Read the medications in medications_on_file_spoken exactly as written and ask which one they meant.`,\n next_step: \"Offer the medications in medications_on_file_spoken and ask which one they meant.\",\n});\n\n// ---- accounts and profiles ---------------------------------------------------\n// Accounts are deliberately unnamed, matching the reference call: nothing\n// account-specific is spoken before the code clears.\n//\n// The demo is graded live by an evaluator who may dial in from their own handset, so\n// \"one hardcoded account\" would mean every caller is the same person. A profile is the\n// unit that changes: one account plus one order set, chosen by the caller's ANI, with a\n// complete fallback for a number we do not recognise.\n//\n// A profile decides WHOSE ORDERS a caller sees. It never decides where a verification\n// text goes; see resolveDestination.\ntype Account = {\n account_id: string;\n mobile_on_file: string;\n email_masked: string;\n same_day_delivery_eligible: boolean;\n // Derived from the profile's own orders rather than hardcoded, so if the \"are you\n // calling about your ... order?\" beat is ever restored after verification, it names\n // the same order get_order_status would read out.\n readonly recent_order: { medication: string; spoken: string; status: string };\n};\n\ntype Profile = {\n id: string;\n label: string;\n account: Account;\n orders: Order[];\n};\n\nfunction makeProfile(\n id: string,\n label: string,\n account: Omit,\n orders: Order[],\n): Profile {\n return {\n id,\n label,\n orders,\n account: {\n ...account,\n get recent_order() {\n const o = mostRecentOrder(orders);\n return {\n medication: o.medication,\n spoken: `your ${o.medication} ${decimalWords(o.strength)} ${unitLong(drugFor(o).unit)} order`,\n status: o.status,\n };\n },\n },\n };\n}\n\n// Display only. The account's mobile is never a send destination, so this can be blank\n// on a profile whose phone key is unset without breaking anything.\nconst DEMO_MEMBER_PHONE = Deno.env.get(\"DEMO_MEMBER_PHONE\") ?? \"\";\nconst DEMO_PROFILE_2_PHONE = Deno.env.get(\"DEMO_PROFILE_2_PHONE\") ?? \"\";\nconst DEMO_PROFILE_3_PHONE = Deno.env.get(\"DEMO_PROFILE_3_PHONE\") ?? \"\";\n\nconst VELTSON_PROFILE = makeProfile(\"veltson\", \"Veltson, GLP-1 plus cardiometabolic\", {\n account_id: \"AMZ-PH-40192\",\n mobile_on_file: DEMO_MEMBER_PHONE,\n email_masked: \"j••••••n@gmail.com\",\n same_day_delivery_eligible: true,\n}, VELTSON_ORDERS);\n\n// Where every unrecognised caller lands, including every run with no caller ID at all:\n// web calls, /chat, simulations and bare curl. It is a full account, not a stub, because\n// the person most likely to land here is the evaluator.\nconst DEFAULT_PROFILE = makeProfile(\"default\", \"Default, any unrecognised caller\", {\n account_id: \"AMZ-PH-51867\",\n mobile_on_file: \"\",\n email_masked: \"a••••••r@outlook.com\",\n same_day_delivery_eligible: true,\n}, DEFAULT_ORDERS);\n\nconst PROFILE_2 = makeProfile(\"profile2\", \"Demo profile two, GLP-1 plus mental health\", {\n account_id: \"AMZ-PH-62341\",\n mobile_on_file: DEMO_PROFILE_2_PHONE,\n email_masked: \"m••••••z@yahoo.com\",\n same_day_delivery_eligible: true,\n}, PROFILE_2_ORDERS);\n\nconst PROFILE_3 = makeProfile(\"profile3\", \"Demo profile three, GLP-1 plus cardiac and GI\", {\n account_id: \"AMZ-PH-73508\",\n mobile_on_file: DEMO_PROFILE_3_PHONE,\n email_masked: \"d••••••e@icloud.com\",\n same_day_delivery_eligible: true,\n}, PROFILE_3_ORDERS);\n\n// Which number reaches which profile. The veltson number is pinned as a literal because\n// it is the fixture every existing regression simulation dials. The other two come from\n// the environment so no further real phone number is ever committed to source; an unset\n// variable simply leaves that profile unreachable by ANI rather than failing.\nconst PROFILE_REGISTRY: { profile: Profile; envVar: string | null; phone: string | null }[] = [\n { profile: VELTSON_PROFILE, envVar: null, phone: toE164(\"+16193616937\") },\n { profile: PROFILE_2, envVar: \"DEMO_PROFILE_2_PHONE\", phone: toE164(DEMO_PROFILE_2_PHONE) },\n { profile: PROFILE_3, envVar: \"DEMO_PROFILE_3_PHONE\", phone: toE164(DEMO_PROFILE_3_PHONE) },\n];\n\nconst PROFILES = new Map(\n PROFILE_REGISTRY.filter((r) => r.phone).map((r) => [r.phone!, r.profile]),\n);\n\n// Resolved once per tool call and threaded through, never re-resolved per handler, so\n// one request can never read two different accounts.\nfunction profileFor(ctx: { customerNumber?: string }): Profile {\n const e164 = toE164(ctx.customerNumber);\n return (e164 ? PROFILES.get(e164) : undefined) ?? DEFAULT_PROFILE;\n}\n\nconst ALL_PROFILES = [VELTSON_PROFILE, DEFAULT_PROFILE, PROFILE_2, PROFILE_3];\nconst profileById = (id: unknown) =>\n ALL_PROFILES.find((p) => p.id === String(id ?? \"\").trim().toLowerCase()) ?? null;\n\n// ---- OTP ---------------------------------------------------------------------\nconst OTP_TTL_MIN = 10, OTP_MAX_ATTEMPTS = 3, OTP_MAX_SENDS = 3;\n// How long after a send an untried code is assumed to still be in flight rather than\n// undelivered. Inside this window a second send_verification_code is refused as\n// unrequested; past it, an untried code is a plausible \"I never got the text\".\nconst OTP_RESEND_GRACE_SEC = 90;\n\nlet ready: Promise | null = null;\nfunction init() {\n ready ??= Promise.all([\n sqlite.execute(`CREATE TABLE IF NOT EXISTS rfp_otp (\n call_id TEXT PRIMARY KEY, code TEXT NOT NULL, destination TEXT NOT NULL,\n expires_at TEXT NOT NULL, attempts INTEGER NOT NULL DEFAULT 0,\n sends INTEGER NOT NULL DEFAULT 1, verified_at TEXT)`),\n sqlite.execute(`CREATE TABLE IF NOT EXISTS rfp_events (\n id INTEGER PRIMARY KEY AUTOINCREMENT, ts TEXT NOT NULL, call_id TEXT,\n type TEXT NOT NULL, payload TEXT)`),\n // The committed-writes ledger. The stored row IS the confirmation: a replay returns\n // the exact payload the first call returned, confirmation number included, rather\n // than minting a second one.\n sqlite.execute(`CREATE TABLE IF NOT EXISTS rfp_writes (\n call_id TEXT NOT NULL, tool TEXT NOT NULL, idem_key TEXT NOT NULL,\n subject TEXT NOT NULL, result TEXT NOT NULL, created_at TEXT NOT NULL,\n PRIMARY KEY (call_id, tool, idem_key))`),\n // One row per call, not one per answer. The closing survey is two questions asked\n // in sequence, so record_survey_response gets called twice on a normal call and the\n // second call must fill in the second column rather than open a second row.\n sqlite.execute(`CREATE TABLE IF NOT EXISTS rfp_survey (\n call_id TEXT PRIMARY KEY, csat_score INTEGER, would_recommend TEXT,\n verbatim TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL)`),\n ]).then(() => {});\n return ready;\n}\n\n// Best-effort. The event log is for demo observability only, so a transient libsql\n// blip must never take down a customer-facing answer mid-call.\nasync function logEvent(callId: string, type: string, payload: unknown) {\n try {\n await init();\n await sqlite.execute({\n sql: `INSERT INTO rfp_events (ts, call_id, type, payload) VALUES (?, ?, ?, ?)`,\n args: [new Date().toISOString(), callId, type, JSON.stringify(payload)],\n });\n } catch (e) {\n console.error(\"logEvent failed (non-fatal):\", String(e));\n }\n}\n\nasync function otpRow(callId: string) {\n if (!callId) return null;\n await init();\n const rs = await sqlite.execute({\n sql: `SELECT code,destination,expires_at,attempts,sends,verified_at FROM rfp_otp WHERE call_id=?`,\n args: [callId],\n });\n const r = rs.rows[0];\n if (!r) return null;\n return {\n code: String(r[0]), destination: String(r[1]), expires_at: String(r[2]),\n attempts: Number(r[3]), sends: Number(r[4]), verified_at: r[5] ? String(r[5]) : null,\n };\n}\n\nfunction toE164(raw: unknown): string | null {\n const s = String(raw ?? \"\").trim(), d = s.replace(/[^\\d]/g, \"\");\n if (s.startsWith(\"+\") && d.length >= 11) return \"+\" + d;\n if (d.length === 11 && d.startsWith(\"1\")) return \"+\" + d;\n if (d.length === 10) return \"+1\" + d;\n return null;\n}\n\nconst last4 = (e: string) => e.slice(-4);\n\n// Where the verification code goes. Priority matters: the number the caller is\n// actually calling from ALWAYS wins. DEMO_MEMBER_PHONE is only a fallback for web\n// calls and chat tests, where there is no caller ID at all — if it takes priority,\n// every real caller gets someone else's phone texted instead of their own.\n//\n// The number is read from the call object, never from tool arguments, so the model\n// cannot redirect the code to a destination of its choosing.\n//\n// Note what this deliberately does NOT read: the resolved profile. A matched ANI decides\n// whose orders the caller sees and nothing else. Reading a profile's mobile_on_file here\n// would mean an unmatched caller could be texted a code belonging to somebody else's\n// handset, which has happened before on a demo build. The fallback is the raw\n// DEMO_MEMBER_PHONE env var, exactly as before, and it is display-only: the send path\n// below refuses anything that is not `caller_id`.\nfunction resolveDestination(ctx: { customerNumber?: string }):\n { to: string; source: \"caller_id\" | \"demo_fallback\" } | null {\n const live = toE164(ctx.customerNumber);\n if (live) return { to: live, source: \"caller_id\" };\n const demo = toE164(DEMO_MEMBER_PHONE);\n if (demo) return { to: demo, source: \"demo_fallback\" };\n return null;\n}\n\n// Both languages in one table, because normalizeCode strips every non-digit AFTER mapping:\n// a Spanish word that is not here does not fail loudly, it silently becomes nothing, and\n// \"cuatro siete dos\" parses to an empty string and comes back as \"no digits came through\n// at all\". This matters even on a Spanish call whose transcriber usually emits numerals,\n// because the fallback rung renders digits as words.\n//\n// Nothing here collides: no Spanish digit word is also an English one. The variants are\n// phonetic shapes a transcriber actually produces (seseo for cinco and cero, b/v for nueve),\n// kept deliberately short of anything that is a common word in either language, since a\n// wrong mapping mints a digit the caller never said.\nconst WORD_DIGITS: Record = {\n // English\n zero: \"0\", oh: \"0\", o: \"0\", one: \"1\", won: \"1\", two: \"2\", to: \"2\", too: \"2\",\n three: \"3\", four: \"4\", for: \"4\", fore: \"4\", five: \"5\", six: \"6\", seven: \"7\",\n eight: \"8\", ate: \"8\", nine: \"9\",\n // Spanish\n cero: \"0\", uno: \"1\", dos: \"2\", tres: \"3\", cuatro: \"4\", cinco: \"5\", seis: \"6\",\n siete: \"7\", ocho: \"8\", nueve: \"9\",\n // Spanish, plausible transcriber shapes\n sero: \"0\", un: \"1\", una: \"1\", quatro: \"4\", cuatros: \"4\", sinco: \"5\", cincos: \"5\",\n seys: \"6\", ciete: \"7\", sietes: \"7\", ochos: \"8\", nuebe: \"9\", nuevo: \"9\", nueves: \"9\",\n};\n\n// Callers give the code three ways: spoken words, spoken digits, or DTMF keypad.\n// All three arrive here as text, so normalize them to bare digits.\nfunction normalizeCode(raw: unknown): string {\n return String(raw ?? \"\").toLowerCase()\n .replace(/[a-z]+/g, (w) => WORD_DIGITS[w] ?? \" \")\n .replace(/[^\\d]/g, \"\");\n}\n\n// Sends through Vapi's own Twilio SMS transport, so no Twilio credentials live here.\n// useLLMGeneratedMessageForOutbound:false forwards the body verbatim — the code is\n// never seen by any language model.\nasync function sendSms(to: string, body: string): Promise<{ ok: true } | { ok: false; message: string }> {\n const key = Deno.env.get(\"VAPI_API_KEY\");\n const phoneNumberId = Deno.env.get(\"VAPI_PHONE_NUMBER_ID\");\n const assistantId = Deno.env.get(\"VAPI_SMS_ASSISTANT_ID\");\n if (!key || !phoneNumberId || !assistantId) {\n return { ok: false, message: \"SMS is not configured on this server\" };\n }\n let res: Response;\n try {\n res = await fetch(\"https://api.vapi.ai/chat\", {\n method: \"POST\",\n headers: { Authorization: `Bearer ${key}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n assistantId, input: body,\n transport: {\n type: \"twilio.sms\", phoneNumberId, customer: { number: to },\n useLLMGeneratedMessageForOutbound: false,\n },\n }),\n });\n } catch (e) {\n return { ok: false, message: `could not reach the SMS provider: ${String(e)}` };\n }\n if (res.status === 429) return { ok: false, message: \"the SMS provider is rate limited right now\" };\n if (!res.ok) {\n const t = await res.text().catch(() => \"\");\n let m = `SMS provider returned ${res.status}`;\n try { const j = JSON.parse(t); if (j?.message) m = String(j.message); } catch { /* keep status */ }\n return { ok: false, message: m };\n }\n return { ok: true };\n}\n\nconst smsConfigured = () => !!(Deno.env.get(\"VAPI_API_KEY\") &&\n Deno.env.get(\"VAPI_PHONE_NUMBER_ID\") && Deno.env.get(\"VAPI_SMS_ASSISTANT_ID\"));\n\n// Server-authoritative: a model-supplied \"verified\" flag is never trusted.\nasync function gateVerified(callId: string): Promise {\n const row = await otpRow(callId);\n if (row?.verified_at) return null;\n return {\n error: \"verification_required\",\n message: \"The caller has not passed code verification. Run send_verification_code and check_verification_code first. Note that general catalog questions — availability, strengths, price — do NOT require verification.\",\n };\n}\n\n// Confirm-then-commit. The write handlers are the only ones that change anything, so\n// the caller has to hear the details back and say yes before the commit happens.\nfunction gateConfirmed(args: any): any | null {\n if (args?.confirmed_with_caller !== true) {\n return {\n error: \"confirmation_required\",\n message: \"This has not been confirmed with the caller yet. Read the medication, strength and day supply back to them, get a spoken yes, then call again with confirmed_with_caller true.\",\n next_step: \"Read the details back, get a yes, then retry with confirmed_with_caller true.\",\n };\n }\n return null;\n}\n\n// ---- write idempotency -------------------------------------------------------\n// A model that retries a tool call must not place a second order. Two guards, because\n// a retry can look like either shape: the same idempotency key twice, or two different\n// keys for the same medication on the same call.\nconst idemKey = (args: any, fallback: string) =>\n String(args?.idempotency_key ?? \"\").trim() || fallback;\n\nasync function priorWrite(callId: string, tool: string, key: string): Promise {\n await init();\n const rs = await sqlite.execute({\n sql: `SELECT result FROM rfp_writes WHERE call_id=? AND tool=? AND idem_key=?`,\n args: [callId, tool, key],\n });\n return rs.rows[0] ? JSON.parse(String(rs.rows[0][0])) : null;\n}\n\nasync function priorWriteForSubject(callId: string, tool: string, subject: string): Promise {\n await init();\n const rs = await sqlite.execute({\n sql: `SELECT result FROM rfp_writes WHERE call_id=? AND tool=? AND subject=? ORDER BY rowid DESC LIMIT 1`,\n args: [callId, tool, subject],\n });\n return rs.rows[0] ? JSON.parse(String(rs.rows[0][0])) : null;\n}\n\nasync function writesThisCall(callId: string, tool: string): Promise {\n if (!callId) return [];\n await init();\n const rs = await sqlite.execute({\n sql: `SELECT result FROM rfp_writes WHERE call_id=? AND tool=? ORDER BY rowid ASC`,\n args: [callId, tool],\n });\n return rs.rows.map((r) => JSON.parse(String(r[0])));\n}\n\n// Insert then read back, so two concurrent identical calls cannot both mint a\n// confirmation number: the loser's insert is ignored and it returns the winner's row.\nasync function commitWrite(\n callId: string, tool: string, key: string, subject: string, build: () => any,\n): Promise {\n await init();\n const fresh = build();\n await sqlite.execute({\n sql: `INSERT OR IGNORE INTO rfp_writes (call_id,tool,idem_key,subject,result,created_at)\n VALUES (?,?,?,?,?,?)`,\n args: [callId, tool, key, subject, JSON.stringify(fresh), new Date().toISOString()],\n });\n return (await priorWrite(callId, tool, key)) ?? fresh;\n}\n\nconst replayed = (result: any, note: string) => ({\n ...result, idempotent_replay: true, next_step: note,\n});\n\n// ---- claims ------------------------------------------------------------------\n// Derived from the delivered orders rather than kept as a separate list, so a claim\n// amount and the price the same order quotes are the same number by construction.\nfunction claims(orders: Order[]) {\n return orders.filter((o) => o.status === \"delivered\").map((o) => ({\n claim_id: \"CLM-\" + o.order_id.slice(4),\n order_id: o.order_id,\n medication: o.medication,\n strength: o.strength,\n unit: drugFor(o).unit,\n amount: orderPaid(o),\n date: orderEta(o),\n }));\n}\n\nfunction claimDateMatches(iso: string, spoken: string): boolean {\n const s = spoken.toLowerCase().trim();\n if (!s) return true;\n if (iso.includes(s)) return true;\n const d = asDate(iso);\n if (!s.includes(MONTHS[d.getUTCMonth()].toLowerCase())) return false;\n // A bare month is enough. A month plus a day has to line up on the day too.\n const day = s.match(/\\b(\\d{1,2})\\b/);\n return !day || Number(day[1]) === d.getUTCDate();\n}\n\n// ---- closing survey ----------------------------------------------------------\n// Deliberately ungated. A satisfaction rating is not account data, so a caller who was\n// never verified, or who only asked a catalog question, can still be surveyed.\n\ntype SurveyRow = { csat_score: number | null; would_recommend: string | null; verbatim: string | null };\n\n// The model is told to send a digit, but a caller says \"five\" and some models pass the\n// word straight through. Cheaper to accept both than to bounce a perfectly good answer.\nconst SCORE_WORDS: Record = { one: 1, two: 2, three: 3, four: 4, five: 5 };\n\n// Returns undefined when nothing was supplied, null when something was supplied that is\n// not a rating from one to five. The two cases read differently: one is a caller who has\n// not answered yet, the other is an answer we have to ask again for.\nfunction parseCsat(raw: unknown): number | null | undefined {\n const s = String(raw ?? \"\").trim().toLowerCase();\n if (!s) return undefined;\n const n = SCORE_WORDS[s] ?? Number(s.match(/-?\\d+(?:\\.\\d+)?/)?.[0] ?? NaN);\n if (!Number.isInteger(n) || n < 1 || n > 5) return null;\n return n;\n}\n\nconst RECOMMEND_WORDS: Record = {\n yes: \"yes\", yeah: \"yes\", yep: \"yes\", yup: \"yes\", sure: \"yes\", absolutely: \"yes\",\n definitely: \"yes\", certainly: \"yes\", true: \"yes\", y: \"yes\",\n no: \"no\", nope: \"no\", nah: \"no\", negative: \"no\", false: \"no\", n: \"no\",\n unsure: \"unsure\", maybe: \"unsure\", \"not sure\": \"unsure\", \"don't know\": \"unsure\",\n dont_know: \"unsure\", neutral: \"unsure\", unknown: \"unsure\",\n};\n\n// Same three-state contract as parseCsat. An unrecognised value is not persisted, so the\n// next_step below falls back to asking the question again rather than banking a guess.\nfunction parseRecommend(raw: unknown): \"yes\" | \"no\" | \"unsure\" | null | undefined {\n const s = String(raw ?? \"\").trim().toLowerCase().replace(/[.!?]+$/, \"\");\n if (!s) return undefined;\n if (RECOMMEND_WORDS[s]) return RECOMMEND_WORDS[s];\n if (/\\b(yes|yeah|yep|sure|absolutely|definitely|would)\\b/.test(s) && !/\\bnot\\b/.test(s)) return \"yes\";\n if (/\\b(no|nope|nah|would not|wouldn't)\\b/.test(s)) return \"no\";\n if (/\\b(unsure|not sure|maybe|depends|don't know|dont know)\\b/.test(s)) return \"unsure\";\n return null;\n}\n\n// COALESCE is the whole upsert: a column the model did not send this time keeps whatever\n// the earlier call put there, so question two cannot erase question one's answer. Done in\n// one statement rather than read-then-write so two concurrent calls cannot interleave.\n// Verbatim accumulates instead of overwriting, because both answers can carry an aside.\nasync function saveSurvey(callId: string, patch: SurveyRow): Promise {\n await init();\n const now = new Date().toISOString();\n await sqlite.execute({\n sql: `INSERT INTO rfp_survey (call_id,csat_score,would_recommend,verbatim,created_at,updated_at)\n VALUES (?,?,?,?,?,?)\n ON CONFLICT(call_id) DO UPDATE SET\n csat_score = COALESCE(excluded.csat_score, rfp_survey.csat_score),\n would_recommend = COALESCE(excluded.would_recommend, rfp_survey.would_recommend),\n verbatim = CASE\n WHEN excluded.verbatim IS NULL THEN rfp_survey.verbatim\n WHEN rfp_survey.verbatim IS NULL THEN excluded.verbatim\n WHEN instr(rfp_survey.verbatim, excluded.verbatim) > 0 THEN rfp_survey.verbatim\n ELSE rfp_survey.verbatim || ' | ' || excluded.verbatim END,\n updated_at = excluded.updated_at`,\n args: [callId, patch.csat_score, patch.would_recommend, patch.verbatim, now, now],\n });\n const rs = await sqlite.execute({\n sql: `SELECT csat_score,would_recommend,verbatim FROM rfp_survey WHERE call_id=?`,\n args: [callId],\n });\n const r = rs.rows[0];\n if (!r) return patch;\n return {\n csat_score: r[0] === null ? null : Number(r[0]),\n would_recommend: r[1] === null ? null : String(r[1]),\n verbatim: r[2] === null ? null : String(r[2]),\n };\n}\n\n// ---- tool handlers -----------------------------------------------------------\nasync function handleTool(name: string, args: any, callId: string, ctx: { customerNumber?: string; isLiveCall?: boolean }): Promise {\n // Resolved once, here, and threaded through every branch below. Calling profileFor\n // again inside a handler would work today and would be the seam a future edit reads\n // two different accounts through.\n const profile = profileFor(ctx);\n const acct = profile.account;\n const history = profile.orders;\n // Same rule as the profile above, and for the same reason: resolved once, threaded down.\n const lang = langFor(args);\n switch (name) {\n case \"lookup_account\": {\n // We can only SMS-verify the line the caller is on, so a caller who says this\n // is not their account number cannot be verified here — that is a handoff, not\n // a prompt for another number. Accepting a spoken number would also let anyone\n // point the code at a handset they control.\n if (args?.mobile_confirmed === false) {\n return {\n error: \"mobile_not_confirmed\",\n message: \"The caller says this is not the mobile on their account. We can only send a code to the line they are calling from, so hand off with transfer_to_human, department customer_care, reason_code mobile_not_on_account.\",\n };\n }\n const dest = resolveDestination(ctx);\n if (!dest) {\n return {\n error: \"no_account_match\",\n message: \"No account could be matched to a mobile number. Hand off with transfer_to_human, department customer_care.\",\n };\n }\n await logEvent(callId, \"account_lookup\", { mobile_last4: last4(dest.to), source: dest.source, profile: profile.id });\n return {\n account_found: true, mobile_last4: last4(dest.to), email_masked: acct.email_masked,\n next_step: \"Send the code with send_verification_code. Speak no account detail yet.\",\n };\n }\n\n case \"send_verification_code\": {\n if (!callId) return { error: \"no_call_context\", message: \"This tool only works during a live call or chat.\" };\n const existing = await otpRow(callId);\n if (existing?.verified_at) {\n return { status: \"already_verified\", message: \"Already verified on this call. Continue with the caller's request.\" };\n }\n // A resend clears the attempt counter, so a locked call must not buy fresh guesses.\n if (existing && existing.attempts >= OTP_MAX_ATTEMPTS) {\n return { error: \"verification_locked\", message: \"Locked after too many incorrect codes. Do not resend. Use transfer_to_human with reason_code verification_failed.\" };\n }\n if (existing && existing.sends >= OTP_MAX_SENDS) {\n return { error: \"too_many_sends\", message: `A code was already sent ${existing.sends} times. Use transfer_to_human with reason_code verification_failed.` };\n }\n // Unrequested resends. The agent used to call this again the moment a code came back\n // wrong, which silently burned one of three sends AND invalidated the code the caller\n // was already holding, so two more wrong reads locked a caller who had the right code\n // in front of them the whole time. A live code with attempts left is not replaced.\n //\n // Two shapes of unrequested resend, both refused. If the caller has already tried the\n // code, they demonstrably have it and a misheard read is not a delivery problem. If\n // nobody has tried it yet and the text went out seconds ago, it is still in flight.\n // Past that grace window an untried code is treated as a genuine \"I never got it\" and\n // resent, which is the one case a hard refusal would strand. `caller_requested_resend`\n // is honoured if the tool schema ever carries it; today it never arrives.\n if (existing && !existing.verified_at && args?.caller_requested_resend !== true) {\n const expiresAt = Date.parse(existing.expires_at);\n const sentAt = expiresAt - OTP_TTL_MIN * 60000;\n const attemptsLeft = OTP_MAX_ATTEMPTS - existing.attempts;\n const tooSoon = Date.now() - sentAt < OTP_RESEND_GRACE_SEC * 1000;\n if (Date.now() < expiresAt && attemptsLeft > 0 && (existing.attempts > 0 || tooSoon)) {\n await logEvent(callId, \"otp_resend_refused\", {\n reason: existing.attempts > 0 ? \"code_still_valid\" : \"still_in_flight\",\n attempts: existing.attempts, sends: existing.sends,\n });\n return {\n error: \"resend_not_needed\",\n attempts_remaining: attemptsLeft,\n mobile_last4: last4(existing.destination),\n message: existing.attempts > 0\n ? \"No new code was sent. The code already on their phone is still valid and they still have attempts left, so replacing it would only invalidate the one they are holding. Say the code did not match, invite them to read it again or key it in, and call check_verification_code with what they give you. Only call this tool again if they say they never received the text.\"\n : \"No new code was sent, because the first text went out moments ago and may still be arriving. Give it a beat, then ask them to read you the six digits when it lands. Only call this tool again if they say it never arrived.\",\n };\n }\n }\n const dest = resolveDestination(ctx);\n if (!dest) return { error: \"no_phone_on_file\", message: \"No mobile number available to text. Use transfer_to_human with reason_code verification_failed.\" };\n // Fail closed unless a genuine caller number was resolved. Only `caller_id` can ever\n // be texted; the DEMO_MEMBER_PHONE fallback is display-only and unsendable on every\n // surface.\n //\n // The previous rule was `demo_fallback && !isLiveCall`, keyed on the presence of\n // call.id. That covered /chat and webchat but left a hole: a vapi.websocket\n // simulation DOES carry call.id and carries no caller ID, so it resolved to\n // demo_fallback with isLiveCall true and would have texted DEMO_MEMBER_PHONE on\n // every run. Nothing had hit it yet only because every scenario happens to mock this\n // tool, which is protection by convention and would break the first time someone\n // wrote a voice scenario without the mock.\n //\n // call.id therefore is not the signal; a resolved caller number is. A real inbound\n // or outbound phone call always carries one, and nothing without one could read a\n // texted code anyway, so this costs no legitimate path. `isLiveCall` is deliberately\n // gone rather than left unused, because a field that reads true on a simulation is\n // the trap itself.\n if (dest.source !== \"caller_id\") {\n await logEvent(callId, \"otp_send_suppressed\", { reason: \"no_caller_number\", source: dest.source, mobile_last4: last4(dest.to) });\n return {\n error: \"sms_suppressed_outside_call\",\n message: \"This run has no caller ID, so no verification text was sent and nobody was messaged. Verification cannot complete here. Catalog questions still work; if the caller needs account access, use transfer_to_human with reason_code verification_failed.\",\n };\n }\n const to = dest.to;\n const code = String(100000 + (crypto.getRandomValues(new Uint32Array(1))[0] % 900000));\n const sent = await sendSms(to, `Amazon Pharmacy: ${code} is your verification code. It expires in ${OTP_TTL_MIN} minutes. We will never ask you to share it by email or text reply.`);\n if (!sent.ok) {\n await logEvent(callId, \"otp_send_failed\", { mobile_last4: last4(to), source: dest.source, reason: sent.message });\n return { error: \"sms_failed\", message: `The code could not be sent (${sent.message}). Apologize briefly and use transfer_to_human with reason_code verification_failed.` };\n }\n await init();\n await sqlite.execute({\n sql: `INSERT INTO rfp_otp (call_id,code,destination,expires_at,attempts,sends,verified_at)\n VALUES (?,?,?,?,0,1,NULL)\n ON CONFLICT(call_id) DO UPDATE SET code=excluded.code, destination=excluded.destination,\n expires_at=excluded.expires_at, attempts=0, sends=rfp_otp.sends+1`,\n args: [callId, code, to, new Date(Date.now() + OTP_TTL_MIN * 60000).toISOString()],\n });\n await logEvent(callId, \"otp_sent\", { mobile_last4: last4(to), source: dest.source, resend: !!existing });\n return {\n status: \"code_sent\", digits: 6, mobile_last4: last4(to), email_masked: acct.email_masked,\n expires_in_minutes: OTP_TTL_MIN,\n instruction: \"Tell the caller a six-digit code went to their email and mobile, and that they can speak it or enter it on the keypad. You cannot see the code — never say it, guess it, or confirm a partial match.\",\n };\n }\n\n case \"check_verification_code\": {\n if (!callId) return { error: \"no_call_context\", message: \"This tool only works during a live call or chat.\" };\n const row = await otpRow(callId);\n if (!row) return { error: \"no_code_issued\", message: \"No code has been sent yet. Call send_verification_code first.\" };\n if (row.verified_at) return { verified: true, message: \"Already verified on this call.\" };\n // Hard lock on entry, or the attempt cap is only advisory and the code is\n // brute-forceable by simply calling this tool again.\n if (row.attempts >= OTP_MAX_ATTEMPTS) {\n return {\n verified: false, error: \"too_many_attempts\", attempts_remaining: 0,\n message: \"Locked after too many incorrect codes. Do not retry or resend. Use transfer_to_human with reason_code verification_failed, without explaining why on the call.\",\n };\n }\n const supplied = normalizeCode(args?.code);\n if (supplied.length !== 6) {\n // Naming the count is the whole point. \"That was not six digits\" makes the caller\n // guess what went wrong; \"I only heard five\" tells them exactly what to fix, and it\n // gives away nothing, because it counts THEIR digits and never touches ours.\n const heard = supplied.length;\n return {\n error: \"malformed_code\",\n digits_heard: heard,\n digits_heard_spoken: intWords(heard, lang, \"neutral\"),\n message: heard === 0\n ? \"No digits came through at all. Ask them to say the six digits or key them in. This did not count as an attempt.\"\n : heard < 6\n ? `Only ${intWords(heard)} digit${heard === 1 ? \"\" : \"s\"} came through and the code is six. Say exactly that, naming the number you heard, and ask for all six. Something like \"I only caught ${intWords(heard)} there, could you give me all six?\". Do not hint at any digit and do not say which ones were missing. This did not count as an attempt.`\n : `${intWords(heard)} digits came through and the code is only six. Say exactly that, naming the number you heard, and ask them to give it again. Something like \"I caught ${intWords(heard)} digits there, and the code is six, could you try once more?\". Do not hint at any digit. This did not count as an attempt.`,\n };\n }\n if (Date.now() > Date.parse(row.expires_at)) {\n return {\n verified: false, error: \"code_expired\",\n message: row.sends < OTP_MAX_SENDS\n ? \"That code expired. Offer to send a fresh one, then call send_verification_code.\"\n : \"That code expired and no resends remain. Use transfer_to_human with reason_code verification_failed.\",\n };\n }\n const attempts = row.attempts + 1, ok = supplied === row.code;\n await sqlite.execute({\n sql: `UPDATE rfp_otp SET attempts=?, verified_at=? WHERE call_id=?`,\n args: [attempts, ok ? new Date().toISOString() : null, callId],\n });\n if (ok) {\n await logEvent(callId, \"otp_verified\", { attempts });\n // recent_order is deliberately NOT returned. Leading with \"are you calling\n // about your Aspirin order?\" followed the reference transcript so closely it\n // read as a script rather than a live agent. The data stays on the profile's\n // account as acct.recent_order, so this is a one-line change to restore.\n // Verification is not always the first thing that happens. A caller can decline it,\n // do a whole catalog and pricing conversation, and only verify when they finally ask\n // for something that needs an account. This instruction used to say \"ask how you can\n // help them today\" unconditionally, which threw away everything they had just told\n // us and made them start over at the moment they were closest to finishing.\n // The event log already knows which it was, so it decides rather than the model.\n const PLUMBING = [\"otp_sent\", \"otp_failed\", \"otp_verified\", \"otp_send_failed\",\n \"otp_send_suppressed\", \"otp_resend_refused\", \"account_lookup\"];\n let priorWork: string[] = [];\n try {\n const rows = await sqlite.execute({\n sql: `SELECT DISTINCT type FROM rfp_events WHERE call_id = ?`, args: [callId],\n });\n priorWork = (rows.rows as unknown as Record[])\n .map((r) => String(r.type ?? (r as unknown as string[])[0]))\n .filter((t) => t && !PLUMBING.includes(t));\n } catch { /* an unreadable log must not block a verified caller */ }\n return {\n verified: true,\n same_day_delivery_eligible: acct.same_day_delivery_eligible,\n work_already_done_on_this_call: priorWork,\n instruction: priorWork.length\n ? \"Say the code was correct in one short line, then go straight back to what they were already doing. They have been on this call a while and have already told you what they want, so asking how you can help them is asking them to start over at the moment they were about to finish. Pick up the exact thread that needed verification and carry on from there. Do not re-ask anything they have already answered.\"\n : \"Say the code was correct in one short line, then ask an open question, how can you help them today. Do not guess at their reason for calling and do not bring up any past order.\",\n };\n }\n const remaining = OTP_MAX_ATTEMPTS - attempts;\n await logEvent(callId, \"otp_failed\", { attempts, attempts_remaining: Math.max(remaining, 0) });\n if (remaining <= 0) {\n return {\n verified: false, error: \"too_many_attempts\", attempts_remaining: 0,\n message: \"Too many incorrect codes. Do not retry or resend. Use transfer_to_human with reason_code verification_failed, without explaining why on the call.\",\n };\n }\n return {\n verified: false, attempts_remaining: remaining,\n message: \"That code does not match. Say so plainly and invite them to try again, speaking it or using the keypad. Never hint at the correct digits.\",\n };\n }\n\n case \"check_medication_availability\": {\n const m = matchDrug(args?.medication_name);\n if (!m.exact) return didYouMean(m);\n const d: Drug = m.exact;\n const strengths = d.strengths.map((s) => ({ value: s, spoken: strengthWords(s, d.unit, lang) }));\n return {\n medication: d.name, generic: d.generic, category: d.category, form: d.form,\n in_stock: d.stock !== \"backordered\", availability: d.stock,\n strengths, strengths_spoken_list: strengths.map((s) => s.spoken).join(\", \"),\n strength_count_spoken: intWords(d.strengths.length, lang, \"neutral\"),\n limited_strengths_spoken: d.limited.length\n ? d.limited.map((s) => strengthWords(s, d.unit, lang)).join(say(\"and\", lang)) : null,\n requires_prescription: d.rx,\n day_supply_options: d.supplies,\n day_supply_options_spoken: d.supplies\n .map((s) => lang === \"es\" ? daysSpoken(s, lang) : `${intWords(s)} days`).join(\", \"),\n availability_note: d.stock === \"backordered\"\n ? `${d.name} is on backorder nationwide. Offer to check an alternative in the same category, or to notify them when it is back.`\n : d.stock === \"limited\"\n ? `${d.name} is available, but the strengths in limited_strengths_spoken are supply-constrained. Mention that only if they ask for one of those.`\n : null,\n // Two separate turns, in this order, and the model reliably collapses them into\n // one invented guess unless the sequence is spelled out at the point of use.\n next_step:\n \"Two questions, one at a time, before any pricing lookup. First: read the strengths \" +\n \"from strengths_spoken_list and ask which one they want. Then, once they have named a \" +\n \"strength, ask whether they would like a price for a particular day supply, naming the \" +\n \"values from day_supply_options_spoken inside your own sentence. Only call \" +\n \"get_medication_pricing once they \" +\n \"have named a day supply themselves. Do not choose one for them.\\n\" +\n \"The moment they name ANY number, call get_medication_pricing with exactly that number, \" +\n \"even a number not in day_supply_options. Thirty is a valid thing to send. This tool \" +\n \"resolves it to the nearest real supply and hands back the reason, which you then explain. \" +\n \"Do not check their number against the options yourself and do not ask them to pick again \" +\n \"from the list; they have already answered and asking twice is the failure here.\",\n };\n }\n\n case \"get_medication_pricing\": {\n const m = matchDrug(args?.medication_name);\n if (!m.exact) return didYouMean(m);\n const d: Drug = m.exact;\n const strengthRaw = parseFloat(String(args?.strength ?? \"\").replace(/[^0-9.]/g, \"\"));\n if (isNaN(strengthRaw) || !d.strengths.includes(strengthRaw)) {\n return {\n error: \"strength_required\",\n available_strengths_spoken: d.strengths.map((s) => strengthWords(s, d.unit, lang)).join(\", \"),\n message: `Ask which strength of ${d.name} they want, offering the values in available_strengths_spoken read exactly as written.`,\n };\n }\n const reqDays = parseInt(String(args?.days_supply ?? \"\").replace(/[^0-9]/g, \"\"), 10);\n if (isNaN(reqDays)) {\n return {\n error: \"days_supply_required\",\n options_spoken: d.supplies.map((s) => daysSpoken(s, lang)).join(\", \"),\n message: \"Ask what day supply they want, offering the values in options_spoken.\",\n };\n }\n const days = resolveSupply(d, reqDays);\n const ins = d.insurance[String(days)], cash = d.cash[String(days)];\n // Manufacturer copay cards floor out rather than zeroing a copay: the savings\n // are capped so the caller is never told they could pay nothing.\n const savings = d.couponMax > 0\n ? Math.max(0, Math.min(d.couponMax, Math.round((ins - COUPON_FLOOR) * 100) / 100)) : 0;\n const lowest = Math.round((ins - savings) * 100) / 100;\n const couponApplies = savings > 0;\n const doses = d.schedule === \"weekly\" ? days / 7 : days;\n const ml = (d.schedule === \"weekly\" && d.mlPerDose)\n ? Math.round(d.mlPerDose * doses * 100) / 100 : null;\n const verified = !(await gateVerified(callId));\n await logEvent(callId, \"pricing_quote\", { drug: d.name, strength: strengthRaw, days });\n return {\n medication: d.name, generic: d.generic, form: d.form,\n strength_spoken: strengthWords(strengthRaw, d.unit, lang),\n days_supply: days, days_supply_spoken: daysSpoken(days, lang),\n supply_note: supplyNote(d, reqDays, days, lang),\n volume_spoken: ml\n ? (lang === \"es\"\n ? `${decimalWords(ml, \"es\", \"m\")} ${ml === 1 ? \"mililitro\" : \"mililitros\"}`\n : `${decimalWords(ml)} milliliters`)\n : null,\n insurance_price_spoken: d.rx ? moneyWords(ins, lang) : null,\n cash_price_spoken: moneyWords(cash, lang),\n coupon_available: couponApplies,\n coupon_savings_spoken: couponApplies ? moneyWords(savings, lang) : null,\n lowest_price_spoken: couponApplies ? moneyWords(lowest, lang) : null,\n coupon_note: (!couponApplies && d.couponMax > 0)\n ? \"A manufacturer coupon exists for this medication, but it cannot go below the copay they already have at this day supply. Do not mention a coupon.\" : null,\n availability: d.stock,\n requires_prescription: d.rx,\n estimate_disclaimer: \"The average insurance price is an estimate based on what other customers paid; the caller's actual price may differ.\",\n same_day_delivery_eligible: verified ? acct.same_day_delivery_eligible : null,\n // The shape of this turn is the client's, not ours, and it is prescriptive because\n // the model otherwise reads every field it was handed as its own short sentence.\n // Eight clipped sentences carrying a copay and a cash price together is the version\n // that landed badly on a real call: shorter than their script in words, far worse to\n // listen to. cash_price_spoken stays in the payload for a caller who asks and is\n // deliberately kept out of the default read, because their script never quotes it.\n next_step: d.rx\n ? \"FOUR sentences, around seventy words, no more. Nobody can hold more than that spoken \" +\n \"aloud, and every extra clause is one they cannot interrupt.\\n\" +\n \"1. The day supply, medication and strength, volume_spoken if set, then \" +\n \"insurance_price_spoken. If coupon_available, finish the same sentence with the coupon \" +\n \"bringing it down to as little as lowest_price_spoken.\\n\" +\n \"2. The estimate disclaimer, short: that is an estimate based on what other customers \" +\n \"paid, so theirs may differ.\\n\" +\n \"3. To order it we would need their prescription sent to us by their prescriber.\\n\" +\n \"4. Would they like to transfer their prescription from another pharmacy TO AMAZON \" +\n \"PHARMACY. Name us in that question every time; where it is going is the point of asking.\\n\" +\n \"If supply_note is set they asked for a supply we do not sell, so sentence 1 MUST say \" +\n \"which supply you are quoting and why it differs, as a clause inside that sentence and \" +\n \"never as a sentence of its own. That clause is not optional and is never dropped to \" +\n \"save words: quoting a different supply without saying so is a silent substitution.\\n\" +\n \"LEAVE OUT: the cash price, unless they ask or there is no \" +\n \"insurance price; same-day delivery, which belongs later if they take the transfer or \" +\n \"ask about delivery; and anything else in this payload not listed above.\"\n : \"Give this as one flowing answer using the spoken fields exactly as written. No \" +\n \"prescription is needed for this item, so do not mention prescriptions or transfers.\",\n };\n }\n\n case \"initiate_prescription_transfer\": {\n const g = await gateVerified(callId);\n if (g) return g;\n const m = matchDrug(args?.medication_name);\n if (!m.exact) return didYouMean(m);\n if (!String(args?.current_pharmacy ?? \"\").trim()) {\n return { error: \"missing_pharmacy\", message: \"Ask which pharmacy currently holds the prescription, then retry.\" };\n }\n const result = {\n transfer_id: \"TRF-\" + String(30000 + Math.floor(Math.random() * 9000)),\n medication: m.exact.name, from_pharmacy: String(args.current_pharmacy),\n status: \"initiated\",\n expected_spoken: say(\"transferExpected\", lang),\n };\n await logEvent(callId, \"transfer_rx\", result);\n return result;\n }\n\n // ---- account lifecycle, ported from amazon-pharmacy-mock-sandbox ----------\n // All five read the resolved profile's own orders, all five gate on the same\n // server-side OTP, and all five return every speakable value pre-worded.\n\n case \"get_order_status\": {\n const g = await gateVerified(callId);\n if (g) return g;\n const named = String(args?.medication_name ?? \"\").trim();\n const placed = await writesThisCall(callId, \"create_reorder\");\n if (named) {\n const { match, order } = findOrder(named, history);\n if (!match.exact) return didYouMean(match);\n if (!order) return notOnFile(named, history, lang);\n await logEvent(callId, \"order_status\", { order_id: order.order_id, medication: order.medication, profile: profile.id });\n return {\n orders: [orderView(order, lang)], order_count: 1, order_count_spoken: intWords(1, lang, \"neutral\"),\n placed_this_call: placed,\n next_step: \"Read the status using status_spoken, and the date using order_date_spoken or eta_spoken, exactly as written. Do not restate any number in digits.\",\n };\n }\n const all = [...history].sort((a, b) => a.orderedDaysAgo - b.orderedDaysAgo).map((o) => orderView(o, lang));\n await logEvent(callId, \"order_status\", { order_id: null, count: all.length, profile: profile.id });\n return {\n orders: all, order_count: all.length, order_count_spoken: intWords(all.length, lang, \"neutral\"),\n placed_this_call: placed,\n next_step: \"Lead with the most recent order only, using its spoken fields exactly as written, and ask whether they want to hear about the others rather than listing all of them.\",\n };\n }\n\n case \"get_delivery_status\": {\n const g = await gateVerified(callId);\n if (g) return g;\n const wantedId = String(args?.order_id ?? \"\").trim().toUpperCase();\n const named = String(args?.medication_name ?? \"\").trim();\n let order: Order | null = null;\n if (wantedId) {\n order = history.find((o) => o.order_id.toUpperCase() === wantedId) ?? null;\n if (!order) {\n return {\n error: \"order_not_found\",\n message: `No order on this account matches ${wantedId}. Ask the caller which medication the delivery is for instead of asking for the number again.`,\n next_step: \"Ask which medication the delivery is for, then call again with medication_name.\",\n };\n }\n } else if (named) {\n const found = findOrder(named, history);\n if (!found.match.exact) return didYouMean(found.match);\n if (!found.order) return notOnFile(named, history, lang);\n order = found.order;\n } else {\n // No hint from the caller, so answer about the parcel actually in motion.\n order = history.find((o) => o.delivery_state === \"in_transit\")\n ?? history.find((o) => o.delivery_state === \"preparing\")\n ?? mostRecentOrder(history);\n }\n await logEvent(callId, \"delivery_status\", { order_id: order.order_id, profile: profile.id });\n const view = orderView(order, lang);\n return {\n ...view,\n tracking_note: order.tracking_note,\n same_day_delivery_eligible: acct.same_day_delivery_eligible,\n next_step: view.eta_spoken\n ? \"Give the carrier and the arrival from eta_spoken exactly as written. Offer the tracking_note detail only if they ask where it is right now.\"\n : \"Say it already arrived, using delivered_on_spoken exactly as written, and ask whether they received it.\",\n };\n }\n\n case \"create_reorder\": {\n const g = (await gateVerified(callId)) ?? gateConfirmed(args);\n if (g) return g;\n const { match, order } = findOrder(args?.medication_name, history);\n if (!match.exact) return didYouMean(match);\n if (!order) return notOnFile(args?.medication_name, history, lang);\n\n // Same key twice is the same order, always.\n const key = idemKey(args, `reorder:${order.medication}`);\n const replay = await priorWrite(callId, \"create_reorder\", key);\n if (replay) {\n return replayed(replay, \"This is the order already placed earlier on this call, not a new one. Repeat the confirmation number from confirmation_number_spoken if they ask, and do not say a second order was placed.\");\n }\n // Two different keys for the same medication on the same call is still one intent.\n const dup = await priorWriteForSubject(callId, \"create_reorder\", order.medication);\n if (dup) {\n return {\n ...dup, duplicate_request: true,\n next_step: `A refill for ${order.medication} was already placed on this call. Confirm that one using confirmation_number_spoken and do not place another.`,\n };\n }\n\n if (order.refills_remaining < 1) {\n return {\n error: \"no_refills_remaining\",\n medication: order.medication,\n strength_spoken: looseStrengthSpoken(order.strength, drugFor(order).unit, lang),\n prescriber: order.prescriber,\n message: `${order.medication} has no refills remaining, so it cannot be reordered. Offer to request a renewal from the prescriber instead.`,\n next_step: \"Tell the caller there are no refills left, offer a renewal request, and on a yes call request_prescription_renewal.\",\n };\n }\n\n const d = drugFor(order);\n const etaIso = isoDay(2);\n return await commitWrite(callId, \"create_reorder\", key, order.medication, () => {\n const confirmation = \"ORD-\" + String(60000 + Math.floor(Math.random() * 9000));\n const left = order.refills_remaining - 1;\n return {\n status: \"placed\",\n confirmation_number: confirmation,\n confirmation_number_spoken: idSpoken(\"ORD\", confirmation, lang),\n medication: order.medication,\n generic: d.generic,\n strength_spoken: strengthWords(order.strength, d.unit, lang),\n days_supply_spoken: daysSpoken(order.days_supply, lang),\n copay_spoken: moneyWords(d.insurance[String(order.days_supply)] ?? 0, lang),\n refills_remaining_after: left,\n refills_remaining_after_spoken: refillsSpoken(left, lang),\n delivery_spoken: `${dayAndDateSpoken(etaIso, lang)} ${say(\"byEightPm\", lang)}`,\n same_day_delivery_eligible: acct.same_day_delivery_eligible,\n estimate_disclaimer: \"The copay is an estimate and is confirmed when the order is filled.\",\n next_step: \"Confirm the order in one line using copay_spoken and delivery_spoken exactly as written, give the confirmation number from confirmation_number_spoken, then ask if there is anything else.\",\n };\n });\n }\n\n case \"request_prescription_renewal\": {\n const g = (await gateVerified(callId)) ?? gateConfirmed(args);\n if (g) return g;\n const { match, order } = findOrder(args?.medication_name, history);\n if (!match.exact) return didYouMean(match);\n if (!order) return notOnFile(args?.medication_name, history, lang);\n\n const key = idemKey(args, `renewal:${order.medication}`);\n const replay = await priorWrite(callId, \"request_prescription_renewal\", key);\n if (replay) {\n return replayed(replay, \"This is the renewal already submitted earlier on this call, not a second one. Repeat the reference from request_id_spoken if they ask.\");\n }\n const dup = await priorWriteForSubject(callId, \"request_prescription_renewal\", order.medication);\n if (dup) {\n return {\n ...dup, duplicate_request: true,\n next_step: `A renewal for ${order.medication} was already submitted on this call. Confirm that one using request_id_spoken and do not submit another.`,\n };\n }\n\n if (!order.prescriber) {\n return {\n error: \"no_prescriber_on_file\",\n medication: order.medication,\n message: `There is no prescriber on file for ${order.medication}, so a renewal cannot be requested from here. Hand off with transfer_to_human, department customer_care, reason_code no_prescriber_on_file.`,\n next_step: \"Tell the caller a teammate needs to sort this out, then call transfer_to_human with department customer_care.\",\n };\n }\n\n const d = drugFor(order);\n return await commitWrite(callId, \"request_prescription_renewal\", key, order.medication, () => {\n const requestId = \"RNW-\" + String(40000 + Math.floor(Math.random() * 9000));\n return {\n status: \"submitted\",\n request_id: requestId,\n request_id_spoken: idSpoken(\"RNW\", requestId, lang),\n medication: order.medication,\n generic: d.generic,\n strength_spoken: strengthWords(order.strength, d.unit, lang),\n days_supply_spoken: daysSpoken(order.days_supply, lang),\n prescriber: order.prescriber,\n expected_response_spoken: say(\"businessDays\", lang),\n next_step: \"Say the request went to the prescriber, give the timeframe from expected_response_spoken exactly as written, and say we will text them when it comes back. Do not promise it will be approved.\",\n };\n });\n }\n\n case \"process_claim_reversal\": {\n const g = (await gateVerified(callId)) ?? gateConfirmed(args);\n if (g) return g;\n const amt = parseFloat(String(args?.claim_amount ?? \"\").replace(/[^0-9.]/g, \"\"));\n const dateStr = String(args?.claim_date ?? \"\").trim();\n const named = String(args?.medication_name ?? \"\").trim();\n if (!named && isNaN(amt) && !dateStr) {\n return {\n error: \"claim_details_required\",\n message: \"Nothing was given to identify the claim. Ask which medication the charge was for, and the amount or roughly when it was.\",\n next_step: \"Ask which medication the charge was for, then retry with medication_name.\",\n };\n }\n let pool = claims(history);\n if (named) {\n const m = matchDrug(named);\n if (!m.exact) return didYouMean(m);\n pool = pool.filter((c) => c.medication === m.exact!.name);\n }\n if (!isNaN(amt)) pool = pool.filter((c) => Math.abs(c.amount - amt) <= 0.51);\n if (dateStr) pool = pool.filter((c) => claimDateMatches(c.date, dateStr));\n\n if (pool.length === 0) {\n return {\n error: \"no_matching_claim\",\n message: \"No reversible claim on this account matches that. Do not guess at which charge they mean. Hand off with transfer_to_human, department billing, reason_code claim_not_found.\",\n next_step: \"Tell the caller billing will need to look at it, then call transfer_to_human with department billing.\",\n };\n }\n if (pool.length > 1) {\n return {\n error: \"ambiguous_claim\",\n candidates_spoken: pool.map((c) => `${c.medication}, ${moneyWords(c.amount)}, ${dateSpoken(c.date)}`).join(\"; \"),\n message: \"More than one claim matches. Read the options in candidates_spoken exactly as written and ask which one, then retry.\",\n next_step: \"Read candidates_spoken and ask which charge they mean, then call again with medication_name.\",\n };\n }\n\n const c = pool[0];\n const key = idemKey(args, `reversal:${c.claim_id}`);\n const replay = await priorWrite(callId, \"process_claim_reversal\", key);\n if (replay) {\n return replayed(replay, \"This reversal was already processed earlier on this call. Repeat the reference from claim_id_spoken if they ask, and do not process it twice.\");\n }\n const dup = await priorWriteForSubject(callId, \"process_claim_reversal\", c.claim_id);\n if (dup) {\n return {\n ...dup, duplicate_request: true,\n next_step: \"This charge was already reversed on this call. Confirm that one and do not process another.\",\n };\n }\n return await commitWrite(callId, \"process_claim_reversal\", key, c.claim_id, () => ({\n status: \"reversal_processed\",\n claim_id: c.claim_id,\n claim_id_spoken: idSpoken(\"CLM\", c.claim_id),\n order_id: c.order_id,\n medication: c.medication,\n strength_spoken: strengthWords(c.strength, c.unit),\n amount_spoken: moneyWords(c.amount),\n original_fill_date_spoken: dateSpoken(c.date),\n posts_by_spoken: \"within twenty-four hours\",\n next_step: \"Confirm the reversal in one line using amount_spoken and posts_by_spoken exactly as written, then ask if there is anything else. Do not say the money is back on their card already.\",\n }));\n }\n\n case \"transfer_to_human\": {\n const dept = String(args?.department ?? \"\").toLowerCase().trim();\n if (![\"pharmacist\", \"customer_care\", \"billing\"].includes(dept)) {\n return { error: \"invalid_department\", message: \"department must be one of: pharmacist, customer_care, billing.\" };\n }\n if (!String(args?.call_summary ?? \"\").trim()) {\n return { error: \"missing_call_summary\", message: \"Include a brief call_summary so the specialist has context, then retry.\" };\n }\n // This must not instruct an endCall. The agent obeyed the old wording literally and\n // fired endCall in the same turn as the transfer on every handoff path, which will\n // race or kill a real warm-transfer-experimental tool once one is wired. It also\n // must not name a queue position: the old response returned queue_position 1 and the\n // agent read it out as \"you're next in line\", a wait-time promise we cannot keep.\n const result = {\n status: \"transfer_accepted\", department: dept,\n instruction: \"Say one short line, that you are connecting them now and the specialist has the full context. Then stop and wait. Do not end the call, do not use the endCall tool, and do not say anything about a wait time, a queue, or a position in line.\",\n };\n await logEvent(callId, \"transfer_to_human\", { ...result, reason_code: args?.reason_code ?? null, call_summary: args.call_summary });\n return result;\n }\n\n case \"record_survey_response\": {\n const csat = parseCsat(args?.csat_score);\n const rec = parseRecommend(args?.would_recommend);\n const verbatim = String(args?.verbatim ?? \"\").trim() || null;\n\n // A rating we could not read is the one failure worth bouncing, because the\n // question has a fixed answer set and the caller is right there to repeat it. An\n // unreadable would_recommend is not bounced: it falls through unrecorded and the\n // next_step below asks that question again, which is the same recovery without a\n // second round trip.\n if (csat === null) {\n // Whatever else came in on the same call is still banked. Losing a good\n // recommendation because the rating was garbled would make the retry lossy.\n if (callId && (rec || verbatim)) await saveSurvey(callId, { csat_score: null, would_recommend: rec ?? null, verbatim });\n await logEvent(callId, \"survey_invalid_csat\", { raw: args?.csat_score ?? null });\n return {\n error: \"invalid_csat\",\n message: \"That was not a rating from one to five, so no score was recorded. Ask them again for a number from one to five, then call this tool again with csat_score.\",\n next_step: \"Ask them again, in one short line, for a number from one to five. Do not offer any other scale and do not move on to the second question yet.\",\n };\n }\n\n // No call id means a chat or a bare curl, where there is nothing durable to key on.\n // The survey still sequences correctly off this turn's arguments alone, so the beat\n // plays out identically; only the row is skipped.\n // A call that carried no answer at all is not a survey response and must not open a\n // row. Otherwise a model that fires the tool before asking anything leaves an\n // all-null record in /survey that reads like a caller who refused to answer.\n const patch: SurveyRow = { csat_score: csat ?? null, would_recommend: rec ?? null, verbatim };\n const anything = patch.csat_score !== null || patch.would_recommend !== null || patch.verbatim !== null;\n const state: SurveyRow = (callId && anything) ? await saveSurvey(callId, patch) : patch;\n await logEvent(callId, \"survey_response\", {\n csat_score: state.csat_score, would_recommend: state.would_recommend,\n verbatim: state.verbatim, persisted: !!callId && anything,\n });\n\n const haveCsat = state.csat_score !== null;\n const haveRec = state.would_recommend !== null;\n const out: any = {\n status: \"survey_recorded\",\n csat_score: state.csat_score,\n would_recommend: state.would_recommend,\n questions_remaining: (haveCsat ? 0 : 1) + (haveRec ? 0 : 1),\n };\n // Never let the model turn a stored integer into words itself, same rule as every\n // price and dose in this file.\n if (haveCsat) out.csat_spoken = intWords(state.csat_score!);\n\n if (haveCsat && haveRec) {\n out.survey_complete = true;\n out.next_step = \"The survey is finished and no questions remain. Thank them warmly in ONE short sentence, then end the call. Do not ask anything further, do not read their answers back to them, and do not offer more help.\";\n } else if (haveCsat) {\n out.survey_complete = false;\n out.next_step = \"Thank them briefly, in a few words, then ask the second and final question: would they recommend Amazon Pharmacy to someone else. Do not re-ask the rating and do not add a third question.\";\n } else {\n out.survey_complete = false;\n out.next_step = \"No rating has been recorded yet. Ask the first question: on a scale from one to five, how would they rate their experience today. Then call this tool again with csat_score.\";\n }\n return out;\n }\n\n default:\n return { error: \"unknown_tool\", message: `No handler for tool \"${name}\".` };\n }\n}\n\n// ---- catalog rendering -------------------------------------------------------\n// Manufacturer copay cards floor at this price rather than reducing a copay to zero.\nconst COUPON_FLOOR = 25;\n// Money always prints with cents when it has them: $3.10, never $3.1.\nconst USD = (n: number) => \"$\" + (Number.isInteger(n) ? String(n) : n.toFixed(2));\n\nconst STOCK_LABEL: Record = {\n in_stock: \"In stock\", limited: \"Limited supply\", backordered: \"On backorder\",\n};\nconst shortUnit = (u: string) => u === \"units/mL\" ? \"units/mL\" : u;\n\nfunction catalogRows() {\n return CATALOG.map((d) => ({\n name: d.name, generic: d.generic, category: d.category, form: d.form,\n strengths: d.strengths.map((s) => `${s} ${shortUnit(d.unit)}`).join(\", \"),\n strengths_spoken: d.strengths.map((s) => strengthWords(s, d.unit)),\n availability: STOCK_LABEL[d.stock],\n limited: d.limited.map((s) => `${s} ${shortUnit(d.unit)}`).join(\", \"),\n rx: d.rx ? \"Rx\" : \"OTC\",\n supplies: d.supplies,\n insurance: d.rx\n ? d.supplies.map((s) => s + \"d \" + USD(d.insurance[String(s)])).join(\" · \") : \"—\",\n cash: d.supplies.map((s) => s + \"d \" + USD(d.cash[String(s)])).join(\" · \"),\n coupon: d.couponMax > 0\n ? \"up to \" + USD(d.couponMax) + \" off, floor \" + USD(COUPON_FLOOR) : \"—\",\n }));\n}\n\nfunction catalogHtml(): string {\n const rows = catalogRows();\n const cats = [...new Set(rows.map((r) => r.category))];\n const esc = (s: string) => s.replace(/&/g, \"&\").replace(/ {\n const body = rows.filter((r) => r.category === c).map((r) => `\n \n ${esc(r.name)}${esc(r.generic)}\n ${esc(r.form)}${r.rx}\n ${esc(r.strengths)}\n ${esc(r.availability)}${r.limited ? `limited: ${esc(r.limited)}` : \"\"}\n ${esc(r.insurance)}\n ${esc(r.cash)}\n ${esc(r.coupon)}\n `).join(\"\");\n return `

${esc(c)}

\n \n \n ${body}

Medication	Form	Strengths	Availability	Insurance price	Cash price	Coupon

`;\n }).join(\"\");\n const totalStrengths = CATALOG.reduce((n, d) => n + d.strengths.length, 0);\n return `\nAmazon Pharmacy Voice Assistant — Medication Knowledge Base\n\n

Amazon Pharmacy Voice Assistant — Medication Knowledge Base

Every medication, strength, availability state and price the demo assistant can answer for. All values are mock data created for this demonstration.

${CATALOG.length}medications

${totalStrengths}strength options

${cats.length}categories

${CATALOG.filter((d) => d.stock !== \"in_stock\").length}constrained supply

\n${sections}\n\n`;\n}\n\nconst TOOLS = [\n \"lookup_account\", \"send_verification_code\", \"check_verification_code\",\n \"check_medication_availability\", \"get_medication_pricing\", \"initiate_prescription_transfer\",\n \"get_order_status\", \"get_delivery_status\", \"create_reorder\",\n \"request_prescription_renewal\", \"process_claim_reversal\", \"transfer_to_human\",\n \"record_survey_response\",\n];\n\n// ---- Vapi webhook plumbing ---------------------------------------------------\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n if (req.method === \"GET\" && url.pathname === \"/catalog\") {\n return new Response(catalogHtml(), { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } });\n }\n if (req.method === \"GET\" && url.pathname === \"/catalog.json\") {\n return Response.json({ count: CATALOG.length, drugs: catalogRows() });\n }\n // The order fixture as the handlers see it, for checking fixture coherence and for\n // writing simulations against real values rather than guessed ones. Defaults to the\n // DEFAULT profile, matching what an unrecognised caller actually hears, since that is\n // the account most reads of this route are checking; ?profile= renders any other,\n // and ?profile=veltson is the fixture the existing simulations were written against.\n // The profile is always named in the response, so a fixture read can never be\n // attributed to the wrong account.\n if (req.method === \"GET\" && url.pathname === \"/orders\") {\n const wanted = url.searchParams.get(\"profile\");\n const p = wanted ? profileById(wanted) : DEFAULT_PROFILE;\n if (!p) {\n return Response.json({\n error: \"unknown_profile\", requested: wanted,\n known: ALL_PROFILES.map((x) => x.id),\n }, { status: 404 });\n }\n return Response.json({\n profile: p.id,\n profile_label: p.label,\n account_id: p.account.account_id,\n count: p.orders.length,\n orders: [...p.orders].sort((a, b) => a.orderedDaysAgo - b.orderedDaysAgo).map(orderView),\n claims: claims(p.orders).map((c) => ({ ...c, amount_spoken: moneyWords(c.amount), date_spoken: dateSpoken(c.date) })),\n });\n }\n // Which profiles exist and which of them a caller can actually reach. Phone numbers are\n // reported as last four digits only, here and everywhere else, so this route can be\n // opened on a shared screen during the demo.\n if (req.method === \"GET\" && url.pathname === \"/profiles\") {\n const phoneFor = (p: Profile) => PROFILE_REGISTRY.find((r) => r.profile === p) ?? null;\n return Response.json({\n count: ALL_PROFILES.length,\n default_profile: DEFAULT_PROFILE.id,\n profiles: ALL_PROFILES.map((p) => {\n const reg = phoneFor(p);\n return {\n id: p.id,\n label: p.label,\n account_id: p.account.account_id,\n is_default: p.id === DEFAULT_PROFILE.id,\n phone_env_var: reg?.envVar ?? null,\n phone_configured: !!reg?.phone,\n phone_last4: reg?.phone ? last4(reg.phone) : null,\n order_count: p.orders.length,\n medications: p.orders.map((o) => `${o.medication} ${o.strength} ${drugFor(o).unit}`),\n };\n }),\n });\n }\n // Closing-survey results, newest first. Same read-only shape as /events.\n if (req.method === \"GET\" && url.pathname === \"/survey\") {\n await init();\n const rs = await sqlite.execute(\n `SELECT call_id,csat_score,would_recommend,verbatim,created_at,updated_at\n FROM rfp_survey ORDER BY updated_at DESC LIMIT 100`,\n );\n const rows = rs.rows.map((r) => ({\n call_id: r[0],\n csat_score: r[1] === null ? null : Number(r[1]),\n csat_spoken: r[1] === null ? null : intWords(Number(r[1])),\n would_recommend: r[2],\n verbatim: r[3],\n created_at: r[4],\n updated_at: r[5],\n }));\n const scored = rows.filter((r) => r.csat_score !== null);\n return Response.json({\n count: rows.length,\n // Precomputed here for the same reason the tools pre-word everything: whoever\n // reads this endpoint should not have to average the column themselves.\n average_csat: scored.length\n ? Math.round((scored.reduce((s, r) => s + r.csat_score!, 0) / scored.length) * 100) / 100\n : null,\n would_recommend_yes: rows.filter((r) => r.would_recommend === \"yes\").length,\n responses: rows,\n });\n }\n if (req.method === \"GET\" && url.pathname === \"/events\") {\n await init();\n const rs = await sqlite.execute(`SELECT ts,call_id,type,payload FROM rfp_events ORDER BY id DESC LIMIT 50`);\n return Response.json({\n events: rs.rows.map((r) => ({ ts: r[0], call_id: r[1], type: r[2], payload: JSON.parse(String(r[3] ?? \"null\")) })),\n });\n }\n if (req.method === \"GET\") {\n return Response.json({\n ok: true, service: \"amazon-pharmacy-rfp-demo\", drugs: CATALOG.length,\n orders: DEFAULT_PROFILE.orders.length, tools: TOOLS,\n // Named explicitly: this route carries no caller number, so everything it counts\n // is the default profile's, and a reader should not have to infer that.\n profile: DEFAULT_PROFILE.id, profile_label: DEFAULT_PROFILE.label,\n profiles: ALL_PROFILES.length,\n profiles_reachable_by_ani: PROFILE_REGISTRY.filter((r) => r.phone).length,\n sms_configured: smsConfigured(), member_phone_configured: !!toE164(DEMO_MEMBER_PHONE),\n });\n }\n\n let body: any;\n try { body = await req.json(); } catch { return Response.json({ error: \"invalid_json\" }, { status: 400 }); }\n const msg = body?.message;\n if (msg?.type !== \"tool-calls\") {\n return Response.json({ error: \"unsupported_message_type\", got: msg?.type ?? null }, { status: 400 });\n }\n // Voice calls carry call.id; /chat and simulation runs carry chat/session ids.\n const callId = msg?.call?.id ?? msg?.chat?.id ?? msg?.session?.id ?? msg?.chatId ?? \"\";\n // Read from the call itself, never from tool arguments, so the model cannot\n // redirect the verification text to a number of its choosing.\n // Deliberately no isLiveCall flag. call.id is true on a vapi.websocket simulation, so it\n // never distinguished a real call from a synthetic one. The caller number is the only\n // honest signal, and resolveDestination is the single place that reads it.\n const ctx = {\n customerNumber: msg?.call?.customer?.number ?? msg?.customer?.number,\n };\n const toolCalls = msg.toolCallList ?? msg.toolCalls ?? [];\n\n const results: { toolCallId: string; result: string }[] = [];\n for (const tc of toolCalls) {\n const name = tc.name ?? tc.function?.name;\n let a = tc.arguments ?? tc.function?.arguments ?? {};\n if (typeof a === \"string\") { try { a = JSON.parse(a); } catch { a = {}; } }\n let out: any;\n try { out = await handleTool(name, a, callId, ctx); }\n catch (e) { out = { error: \"internal_error\", message: String(e) }; }\n results.push({ toolCallId: tc.id, result: JSON.stringify(out) });\n }\n return Response.json({ results });\n}\n","// Backend for the Amazon Pharmacy RFP reference-call demo agent (Vapi tool server).\n// One endpoint, dispatched by function name.\n//\n// Consolidated from gerardroy/amazon-pharmacy-rfp-demo (the base) plus the five\n// account-lifecycle handlers that were stranded in gerardroy/amazon-pharmacy-mock-sandbox.\n// Both of those enforced verification server side keyed per call ID, independently, so\n// attaching tools from both would mean verifying against one did not verify against the\n// other. One backend, one OTP table, one verification gate.\n//\n// Design rules, carried from prior pharmacy builds plus what this RFP grades:\n// - The OTP is generated, stored and compared HERE; the model never sees the code.\n// - Verification is enforced server-side, not by a model-supplied boolean.\n// - No arithmetic in the model: prices, doses and day supplies are precomputed AND\n// pre-worded (`*_spoken`) so currency and dose registers are always read correctly.\n// - A misheard drug name returns `did_you_mean`, never a bare failure.\n// - Business failures are HTTP 200 with an `error` discriminator the model can act on.\n// Only a genuinely broken request is a 4xx.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport {\n CATALOG, Drug, Lang, decimalWords, didYouMean, digitWords, intWords, matchDrug, moneyWords,\n resolveSupply, strengthWords, supplyNote, unitLong,\n} from \"./catalog.ts\";\n\n// ---- order history -----------------------------------------------------------\n// One fixture per profile, selected by the caller's ANI. Each `medication` is an exact\n// CATALOG name and each `strength` and `days_supply` is a value that drug really\n// carries, so \"what happened to my lisinopril\", \"reorder it\" and \"how much is\n// lisinopril\" are the same drug quoting the same numbers from the same source.\n//\n// Every profile carries the same FOUR shapes, because the demo leans on all four and a\n// caller who lands on a fixture missing one hits a dead end mid-demo:\n// 1. in flight shipped / in_transit -> delivery tracking has something to track\n// 2. preparing processing / preparing, no prescriber -> a renewal has to escalate\n// 3. delivered refills remaining -> a reorder succeeds\n// 4. delivered refills_remaining 0 -> a reorder fails into a renewal\n// The two delivered orders in each set are deliberately priced apart, because `claims()`\n// derives claim amounts from them and two equal amounts would make every \"reverse that\n// charge\" ask ambiguous.\n//\n// Dates are offsets, not literals, so the fixture cannot go stale between now and the\n// demo. An order that is still moving stays a day or two out no matter when it is read.\ntype Order = {\n order_id: string;\n medication: string;\n strength: number;\n days_supply: number;\n status: \"delivered\" | \"shipped\" | \"processing\";\n delivery_state: \"delivered\" | \"in_transit\" | \"preparing\";\n orderedDaysAgo: number;\n etaDaysFromNow: number;\n refills_remaining: number;\n prescriber: string | null;\n carrier: string;\n tracking_note: string;\n};\n\n// The original fixture, unchanged. Every regression simulation written so far, and the\n// default rendering of GET /orders, expects exactly these four orders, so nothing here\n// moves when a new profile is added.\nconst VELTSON_ORDERS: Order[] = [\n {\n order_id: \"ORD-58204\", medication: \"Zepbound\", strength: 12.5, days_supply: 84,\n status: \"shipped\", delivery_state: \"in_transit\",\n orderedDaysAgo: 8, etaDaysFromNow: 2,\n refills_remaining: 2, prescriber: \"Dr. Marcus Hale\", carrier: \"Amazon Logistics\",\n tracking_note: \"Left the regional facility overnight; last scan was Kent, Washington this morning.\",\n },\n {\n order_id: \"ORD-57731\", medication: \"Lisinopril\", strength: 10, days_supply: 90,\n status: \"delivered\", delivery_state: \"delivered\",\n orderedDaysAgo: 43, etaDaysFromNow: -39,\n refills_remaining: 3, prescriber: \"Dr. Anita Rao\", carrier: \"Amazon Logistics\",\n tracking_note: \"Left at the front door, photo on file.\",\n },\n {\n order_id: \"ORD-57402\", medication: \"Atorvastatin\", strength: 20, days_supply: 90,\n status: \"processing\", delivery_state: \"preparing\",\n orderedDaysAgo: 2, etaDaysFromNow: 3,\n // No prescriber on file, so a renewal on this one has to escalate.\n refills_remaining: 2, prescriber: null, carrier: \"Amazon Logistics\",\n tracking_note: \"Still at the fulfilment pharmacy; it has not been handed to the carrier yet.\",\n },\n {\n order_id: \"ORD-56119\", medication: \"Metformin\", strength: 500, days_supply: 90,\n status: \"delivered\", delivery_state: \"delivered\",\n // Out of refills, so a reorder has to fail into a renewal, and the renewal succeeds.\n orderedDaysAgo: 68, etaDaysFromNow: -64,\n refills_remaining: 0, prescriber: \"Dr. Anita Rao\", carrier: \"Amazon Logistics\",\n tracking_note: \"Delivered to the mailbox.\",\n },\n];\n\n// The fixture an unrecognised caller gets, and the one that matters most: an Amazon\n// evaluator dialling from their own handset lands here. Different medications from the\n// veltson set so it is visibly a different account, same four shapes so nothing in the\n// demo is unreachable from it.\nconst DEFAULT_ORDERS: Order[] = [\n {\n // Strength 2 rather than 1 on purpose. A strength of exactly one reads as \"one\n // milligrams\" through the shared spoken-unit formatter, and this is the account an\n // evaluator is most likely to land on, so the fixture sidesteps it rather than\n // reaching into formatting code the whole catalog shares.\n order_id: \"ORD-70110\", medication: \"Ozempic\", strength: 2, days_supply: 84,\n status: \"shipped\", delivery_state: \"in_transit\",\n orderedDaysAgo: 6, etaDaysFromNow: 2,\n refills_remaining: 2, prescriber: \"Dr. Priya Raman\", carrier: \"Amazon Logistics\",\n tracking_note: \"Scanned out of the Sumner, Washington facility late last night.\",\n },\n {\n order_id: \"ORD-70255\", medication: \"Rosuvastatin\", strength: 10, days_supply: 90,\n status: \"processing\", delivery_state: \"preparing\",\n orderedDaysAgo: 1, etaDaysFromNow: 4,\n // No prescriber on file, so a renewal on this one has to escalate.\n refills_remaining: 2, prescriber: null, carrier: \"Amazon Logistics\",\n tracking_note: \"Still at the fulfilment pharmacy; it has not been handed to the carrier yet.\",\n },\n {\n order_id: \"ORD-70388\", medication: \"Losartan\", strength: 50, days_supply: 90,\n status: \"delivered\", delivery_state: \"delivered\",\n orderedDaysAgo: 37, etaDaysFromNow: -33,\n refills_remaining: 3, prescriber: \"Dr. Owen Castellanos\", carrier: \"Amazon Logistics\",\n tracking_note: \"Left at the front door, photo on file.\",\n },\n {\n order_id: \"ORD-70471\", medication: \"Duloxetine\", strength: 30, days_supply: 90,\n status: \"delivered\", delivery_state: \"delivered\",\n // Out of refills, so a reorder has to fail into a renewal, and the renewal succeeds.\n orderedDaysAgo: 74, etaDaysFromNow: -70,\n refills_remaining: 0, prescriber: \"Dr. Owen Castellanos\", carrier: \"Amazon Logistics\",\n tracking_note: \"Delivered to the mailbox.\",\n },\n];\n\nconst PROFILE_2_ORDERS: Order[] = [\n {\n order_id: \"ORD-72130\", medication: \"Mounjaro\", strength: 7.5, days_supply: 84,\n status: \"shipped\", delivery_state: \"in_transit\",\n orderedDaysAgo: 9, etaDaysFromNow: 1,\n refills_remaining: 1, prescriber: \"Dr. Naomi Whitfield\", carrier: \"Amazon Logistics\",\n tracking_note: \"On the truck for delivery; last scan was the local station this morning.\",\n },\n {\n order_id: \"ORD-72264\", medication: \"Escitalopram\", strength: 10, days_supply: 90,\n status: \"processing\", delivery_state: \"preparing\",\n orderedDaysAgo: 3, etaDaysFromNow: 2,\n refills_remaining: 3, prescriber: null, carrier: \"Amazon Logistics\",\n tracking_note: \"Still at the fulfilment pharmacy; it has not been handed to the carrier yet.\",\n },\n {\n order_id: \"ORD-72391\", medication: \"Amlodipine\", strength: 5, days_supply: 90,\n status: \"delivered\", delivery_state: \"delivered\",\n orderedDaysAgo: 51, etaDaysFromNow: -47,\n refills_remaining: 2, prescriber: \"Dr. Samuel Ortega\", carrier: \"Amazon Logistics\",\n tracking_note: \"Handed to a resident at the door.\",\n },\n {\n order_id: \"ORD-72485\", medication: \"Gabapentin\", strength: 300, days_supply: 90,\n status: \"delivered\", delivery_state: \"delivered\",\n orderedDaysAgo: 62, etaDaysFromNow: -58,\n refills_remaining: 0, prescriber: \"Dr. Samuel Ortega\", carrier: \"Amazon Logistics\",\n tracking_note: \"Delivered to the mailbox.\",\n },\n];\n\nconst PROFILE_3_ORDERS: Order[] = [\n {\n order_id: \"ORD-74140\", medication: \"Trulicity\", strength: 1.5, days_supply: 84,\n status: \"shipped\", delivery_state: \"in_transit\",\n orderedDaysAgo: 5, etaDaysFromNow: 3,\n refills_remaining: 2, prescriber: \"Dr. Elena Vasquez\", carrier: \"Amazon Logistics\",\n tracking_note: \"Left the regional facility overnight and is moving toward the local station.\",\n },\n {\n order_id: \"ORD-74278\", medication: \"Pantoprazole\", strength: 40, days_supply: 90,\n status: \"processing\", delivery_state: \"preparing\",\n orderedDaysAgo: 2, etaDaysFromNow: 3,\n refills_remaining: 1, prescriber: null, carrier: \"Amazon Logistics\",\n tracking_note: \"Still at the fulfilment pharmacy; it has not been handed to the carrier yet.\",\n },\n {\n order_id: \"ORD-74362\", medication: \"Metoprolol\", strength: 50, days_supply: 90,\n status: \"delivered\", delivery_state: \"delivered\",\n orderedDaysAgo: 46, etaDaysFromNow: -42,\n refills_remaining: 2, prescriber: \"Dr. Theo Lindqvist\", carrier: \"Amazon Logistics\",\n tracking_note: \"Left at the front door, photo on file.\",\n },\n {\n order_id: \"ORD-74499\", medication: \"Bupropion XL\", strength: 150, days_supply: 90,\n status: \"delivered\", delivery_state: \"delivered\",\n orderedDaysAgo: 80, etaDaysFromNow: -76,\n refills_remaining: 0, prescriber: \"Dr. Theo Lindqvist\", carrier: \"Amazon Logistics\",\n tracking_note: \"Delivered to the mailroom in the lobby.\",\n },\n];\n\nconst DAY_MS = 86400000;\nconst isoDay = (offsetDays: number) =>\n new Date(Date.now() + offsetDays * DAY_MS).toISOString().slice(0, 10);\n\nconst orderDate = (o: Order) => isoDay(-o.orderedDaysAgo);\nconst orderEta = (o: Order) => isoDay(o.etaDaysFromNow);\n\nconst drugFor = (o: Order): Drug => CATALOG.find((d) => d.name === o.medication)!;\n// What the plan actually paid, taken from the catalog rather than stored alongside it,\n// so an order and a fresh price quote for the same drug can never disagree.\nconst orderPaid = (o: Order): number => drugFor(o).insurance[String(o.days_supply)] ?? 0;\n\n// Every helper below takes the order set explicitly rather than closing over one. A\n// helper that reaches for a module-level fixture is a helper that silently reads the\n// wrong caller's account the moment a second profile exists.\nconst mostRecentOrder = (orders: Order[]) =>\n [...orders].sort((a, b) => a.orderedDaysAgo - b.orderedDaysAgo)[0];\n\n// ---- language ----------------------------------------------------------------\n// The tool call carries `language` as a Vapi STATIC parameter, so it is always present and\n// never model-generated. Resolved ONCE at the top of handleTool and threaded down, the same\n// way the profile is, because a handler that re-resolves it is a handler that can answer\n// half a turn in the wrong language.\n//\n// Anything unrecognised is English. A missing field, a locale tag (\"es-MX\", \"es-419\") and a\n// full name (\"Spanish\") all land somewhere sensible; nothing else changes behaviour.\n//\n// What is and is not translated, deliberately: every `*_spoken` field is, because the model\n// reads those verbatim and the RFP grades spoken number formatting. `message`, `next_step`\n// and `instruction` are NOT, because they are directives addressed to the model rather than\n// words for the caller, and the model renders its own speech in the call's language.\nfunction langFor(args: any): Lang {\n const s = String(args?.language ?? \"\").trim().toLowerCase();\n if (s.startsWith(\"es\") || s.startsWith(\"spanish\") || s.startsWith(\"español\")) return \"es\";\n return \"en\";\n}\n\n// Fixed spoken phrases that carry no number. Kept in one table so the Spanish can be read\n// and corrected in a single place rather than hunted through thirteen handlers.\nconst PHRASE = {\n byEightPm: { en: \"by eight PM\", es: \"antes de las ocho de la noche\" },\n businessDays: { en: \"one to two business days\", es: \"de uno a dos días hábiles\" },\n transferExpected: {\n en: \"one to two business days, and we will text you when it lands\",\n es: \"de uno a dos días hábiles, y le enviaremos un mensaje de texto cuando llegue\",\n },\n withinADay: { en: \"within twenty-four hours\", es: \"en un plazo de veinticuatro horas\" },\n and: { en: \" and \", es: \" y \" },\n} as const;\nconst say = (k: keyof typeof PHRASE, lang: Lang) => PHRASE[k][lang];\n\n// English keeps the adjectival singular here (\"eighty-four day\", as in \"an eighty-four day\n// supply\"). Spanish has no such form, so it reads as a plain count of days.\nconst daysSpoken = (n: number, lang: Lang = \"en\") =>\n lang === \"es\" ? `${intWords(n, \"es\", \"m\")} día${n === 1 ? \"\" : \"s\"}` : `${intWords(n)} day`;\n\n// The English path composes a strength as decimalWords plus a plural unit, which reads\n// \"one milligrams\" at exactly 1. Reproduced verbatim rather than fixed, because English\n// output is frozen. The Spanish path uses strengthWords, where that agreement is graded.\nconst looseStrengthSpoken = (v: number, unit: string, lang: Lang) =>\n lang === \"es\" ? strengthWords(v, unit, \"es\") : `${decimalWords(v)} ${unitLong(unit)}`;\n\n// ---- spoken dates ------------------------------------------------------------\nconst MONTHS = [\"January\",\"February\",\"March\",\"April\",\"May\",\"June\",\"July\",\"August\",\n \"September\",\"October\",\"November\",\"December\"];\nconst WEEKDAYS = [\"Sunday\",\"Monday\",\"Tuesday\",\"Wednesday\",\"Thursday\",\"Friday\",\"Saturday\"];\n// Spanish month and weekday names are lowercase, and a Spanish date takes a plain cardinal\n// rather than an ordinal: \"tres de septiembre\", not \"tercero de septiembre\". Only the first\n// of the month keeps an ordinal, which is why ordinalWords has no Spanish counterpart.\nconst MONTHS_ES = [\"enero\",\"febrero\",\"marzo\",\"abril\",\"mayo\",\"junio\",\"julio\",\"agosto\",\n \"septiembre\",\"octubre\",\"noviembre\",\"diciembre\"];\nconst WEEKDAYS_ES = [\"domingo\",\"lunes\",\"martes\",\"miércoles\",\"jueves\",\"viernes\",\"sábado\"];\nconst dayNumberEs = (n: number) => n === 1 ? \"primero\" : intWords(n, \"es\", \"m\");\nconst ORD_IRREGULAR: Record = {\n one: \"first\", two: \"second\", three: \"third\", five: \"fifth\",\n eight: \"eighth\", nine: \"ninth\", twelve: \"twelfth\",\n};\n\n// 14 -> \"fourteenth\", 21 -> \"twenty-first\", 30 -> \"thirtieth\". Built off intWords so the\n// date register matches the money and dose registers instead of drifting from them.\nfunction ordinalWords(n: number): string {\n const w = intWords(n);\n const cut = Math.max(w.lastIndexOf(\"-\"), w.lastIndexOf(\" \"));\n const head = w.slice(0, cut + 1), tail = w.slice(cut + 1);\n if (ORD_IRREGULAR[tail]) return head + ORD_IRREGULAR[tail];\n if (tail.endsWith(\"y\")) return head + tail.slice(0, -1) + \"ieth\";\n return head + tail + \"th\";\n}\n\nconst asDate = (iso: string) => new Date(iso + \"T12:00:00Z\");\nconst dateSpoken = (iso: string, lang: Lang = \"en\") => {\n const d = asDate(iso);\n if (lang === \"es\") return `${dayNumberEs(d.getUTCDate())} de ${MONTHS_ES[d.getUTCMonth()]}`;\n return `${MONTHS[d.getUTCMonth()]} ${ordinalWords(d.getUTCDate())}`;\n};\nconst dayAndDateSpoken = (iso: string, lang: Lang = \"en\") => {\n const d = asDate(iso);\n if (lang === \"es\") {\n return `${WEEKDAYS_ES[d.getUTCDay()]}, ${dayNumberEs(d.getUTCDate())} de ${MONTHS_ES[d.getUTCMonth()]}`;\n }\n return `${WEEKDAYS[d.getUTCDay()]}, ${MONTHS[d.getUTCMonth()]} ${ordinalWords(d.getUTCDate())}`;\n};\n\n// Spanish letter names, so a confirmation number is spelled \"o, erre, de\" rather than the\n// English alphabet read at a Spanish caller. Only ORD, RNW, CLM and TRF are spelled today;\n// the whole alphabet is here so a new prefix is not a silent regression.\nconst ES_LETTERS: Record = {\n a:\"a\", b:\"be\", c:\"ce\", d:\"de\", e:\"e\", f:\"efe\", g:\"ge\", h:\"hache\", i:\"i\", j:\"jota\",\n k:\"ka\", l:\"ele\", m:\"eme\", n:\"ene\", o:\"o\", p:\"pe\", q:\"cu\", r:\"erre\", s:\"ese\", t:\"te\",\n u:\"u\", v:\"ve\", w:\"doble ve\", x:\"equis\", y:\"ye\", z:\"zeta\",\n};\n\n// Identifiers are read digit by digit, never as a number and never with hyphens.\nconst idSpoken = (prefix: string, id: string, lang: Lang = \"en\") =>\n lang === \"es\"\n ? `${prefix.split(\"\").map((c) => ES_LETTERS[c.toLowerCase()] ?? c).join(\", \")}, ${digitWords(id, \"es\")}`\n : `${prefix.split(\"\").join(\" \")}, ${digitWords(id)}`;\n\nconst STATUS_SPOKEN: Record = {\n delivered: \"delivered\",\n shipped: \"shipped and on its way\",\n processing: \"being prepared at the pharmacy\",\n};\nconst DELIVERY_SPOKEN: Record = {\n delivered: \"delivered\",\n in_transit: \"out with the carrier\",\n preparing: \"not handed to the carrier yet\",\n};\nconst STATUS_SPOKEN_ES: Record = {\n delivered: \"entregado\",\n shipped: \"enviado y en camino\",\n processing: \"en preparación en la farmacia\",\n};\nconst DELIVERY_SPOKEN_ES: Record = {\n delivered: \"entregado\",\n in_transit: \"con el transportista\",\n preparing: \"aún no se ha entregado al transportista\",\n};\nconst statusSpoken = (s: string, lang: Lang) => (lang === \"es\" ? STATUS_SPOKEN_ES : STATUS_SPOKEN)[s];\nconst deliverySpoken = (s: string, lang: Lang) => (lang === \"es\" ? DELIVERY_SPOKEN_ES : DELIVERY_SPOKEN)[s];\n\n// \"resurtido\" is the Mexican pharmacy term for a refill on an existing prescription, as\n// distinct from \"renovación\", the renewal this demo also offers. Keeping them apart matters\n// here, because create_reorder and request_prescription_renewal are two different tools.\nconst refillsSpoken = (n: number, lang: Lang = \"en\") =>\n lang === \"es\"\n ? `${intWords(n, \"es\", \"m\")} resurtido${n === 1 ? \"\" : \"s\"}`\n : `${intWords(n)} refill${n === 1 ? \"\" : \"s\"}`;\n\n// Every speakable value on an order, pre-worded. The model reads these verbatim and\n// never formats a number itself.\nfunction orderView(o: Order, lang: Lang = \"en\") {\n const d = drugFor(o);\n const landed = o.status === \"delivered\";\n const eta = orderEta(o);\n return {\n order_id: o.order_id,\n order_id_spoken: idSpoken(\"ORD\", o.order_id, lang),\n medication: o.medication,\n generic: d.generic,\n form: d.form,\n strength: o.strength,\n strength_spoken: strengthWords(o.strength, d.unit, lang),\n days_supply: o.days_supply,\n days_supply_spoken: daysSpoken(o.days_supply, lang),\n status: o.status,\n status_spoken: statusSpoken(o.status, lang),\n order_date: orderDate(o),\n order_date_spoken: dateSpoken(orderDate(o), lang),\n refills_remaining: o.refills_remaining,\n refills_remaining_spoken: refillsSpoken(o.refills_remaining, lang),\n delivery_state: o.delivery_state,\n delivery_state_spoken: deliverySpoken(o.delivery_state, lang),\n delivered_on_spoken: landed ? dayAndDateSpoken(eta, lang) : null,\n eta_spoken: landed ? null : `${dayAndDateSpoken(eta, lang)} ${say(\"byEightPm\", lang)}`,\n amount_paid_spoken: moneyWords(orderPaid(o), lang),\n carrier: o.carrier,\n };\n}\n\nconst onFileSpoken = (orders: Order[], lang: Lang = \"en\") =>\n orders.map((o) => `${o.medication} ${looseStrengthSpoken(o.strength, drugFor(o).unit, lang)}`)\n .join(\", \");\n\n// Resolves a spoken medication name to an order on this account. A mangled name still\n// goes through did_you_mean; a real catalog drug with no order is a different failure.\nfunction findOrder(nameRaw: unknown, orders: Order[]) {\n const m = matchDrug(nameRaw);\n const order = m.exact ? (orders.find((o) => o.medication === m.exact!.name) ?? null) : null;\n return { match: m, order };\n}\n\nconst notOnFile = (nameRaw: unknown, orders: Order[], lang: Lang = \"en\") => ({\n error: \"medication_not_on_file\",\n medications_on_file_spoken: onFileSpoken(orders, lang),\n message: `There is no prescription for \"${String(nameRaw ?? \"\")}\" on this account. Read the medications in medications_on_file_spoken exactly as written and ask which one they meant.`,\n next_step: \"Offer the medications in medications_on_file_spoken and ask which one they meant.\",\n});\n\n// ---- accounts and profiles ---------------------------------------------------\n// Accounts are deliberately unnamed, matching the reference call: nothing\n// account-specific is spoken before the code clears.\n//\n// The demo is graded live by an evaluator who may dial in from their own handset, so\n// \"one hardcoded account\" would mean every caller is the same person. A profile is the\n// unit that changes: one account plus one order set, chosen by the caller's ANI, with a\n// complete fallback for a number we do not recognise.\n//\n// A profile decides WHOSE ORDERS a caller sees. It never decides where a verification\n// text goes; see resolveDestination.\ntype Account = {\n account_id: string;\n mobile_on_file: string;\n email_masked: string;\n same_day_delivery_eligible: boolean;\n // Derived from the profile's own orders rather than hardcoded, so if the \"are you\n // calling about your ... order?\" beat is ever restored after verification, it names\n // the same order get_order_status would read out.\n readonly recent_order: { medication: string; spoken: string; status: string };\n};\n\ntype Profile = {\n id: string;\n label: string;\n account: Account;\n orders: Order[];\n};\n\nfunction makeProfile(\n id: string,\n label: string,\n account: Omit,\n orders: Order[],\n): Profile {\n return {\n id,\n label,\n orders,\n account: {\n ...account,\n get recent_order() {\n const o = mostRecentOrder(orders);\n return {\n medication: o.medication,\n spoken: `your ${o.medication} ${decimalWords(o.strength)} ${unitLong(drugFor(o).unit)} order`,\n status: o.status,\n };\n },\n },\n };\n}\n\n// Display only. The account's mobile is never a send destination, so this can be blank\n// on a profile whose phone key is unset without breaking anything.\nconst DEMO_MEMBER_PHONE = Deno.env.get(\"DEMO_MEMBER_PHONE\") ?? \"\";\nconst DEMO_PROFILE_2_PHONE = Deno.env.get(\"DEMO_PROFILE_2_PHONE\") ?? \"\";\nconst DEMO_PROFILE_3_PHONE = Deno.env.get(\"DEMO_PROFILE_3_PHONE\") ?? \"\";\n\nconst VELTSON_PROFILE = makeProfile(\"veltson\", \"Veltson, GLP-1 plus cardiometabolic\", {\n account_id: \"AMZ-PH-40192\",\n mobile_on_file: DEMO_MEMBER_PHONE,\n email_masked: \"j••••••n@gmail.com\",\n same_day_delivery_eligible: true,\n}, VELTSON_ORDERS);\n\n// Where every unrecognised caller lands, including every run with no caller ID at all:\n// web calls, /chat, simulations and bare curl. It is a full account, not a stub, because\n// the person most likely to land here is the evaluator.\nconst DEFAULT_PROFILE = makeProfile(\"default\", \"Default, any unrecognised caller\", {\n account_id: \"AMZ-PH-51867\",\n mobile_on_file: \"\",\n email_masked: \"a••••••r@outlook.com\",\n same_day_delivery_eligible: true,\n}, DEFAULT_ORDERS);\n\nconst PROFILE_2 = makeProfile(\"profile2\", \"Demo profile two, GLP-1 plus mental health\", {\n account_id: \"AMZ-PH-62341\",\n mobile_on_file: DEMO_PROFILE_2_PHONE,\n email_masked: \"m••••••z@yahoo.com\",\n same_day_delivery_eligible: true,\n}, PROFILE_2_ORDERS);\n\nconst PROFILE_3 = makeProfile(\"profile3\", \"Demo profile three, GLP-1 plus cardiac and GI\", {\n account_id: \"AMZ-PH-73508\",\n mobile_on_file: DEMO_PROFILE_3_PHONE,\n email_masked: \"d••••••e@icloud.com\",\n same_day_delivery_eligible: true,\n}, PROFILE_3_ORDERS);\n\n// Which number reaches which profile. The veltson number is pinned as a literal because\n// it is the fixture every existing regression simulation dials. The other two come from\n// the environment so no further real phone number is ever committed to source; an unset\n// variable simply leaves that profile unreachable by ANI rather than failing.\nconst PROFILE_REGISTRY: { profile: Profile; envVar: string | null; phone: string | null }[] = [\n { profile: VELTSON_PROFILE, envVar: null, phone: toE164(\"+16193616937\") },\n { profile: PROFILE_2, envVar: \"DEMO_PROFILE_2_PHONE\", phone: toE164(DEMO_PROFILE_2_PHONE) },\n { profile: PROFILE_3, envVar: \"DEMO_PROFILE_3_PHONE\", phone: toE164(DEMO_PROFILE_3_PHONE) },\n];\n\nconst PROFILES = new Map(\n PROFILE_REGISTRY.filter((r) => r.phone).map((r) => [r.phone!, r.profile]),\n);\n\n// Resolved once per tool call and threaded through, never re-resolved per handler, so\n// one request can never read two different accounts.\nfunction profileFor(ctx: { customerNumber?: string }): Profile {\n const e164 = toE164(ctx.customerNumber);\n return (e164 ? PROFILES.get(e164) : undefined) ?? DEFAULT_PROFILE;\n}\n\nconst ALL_PROFILES = [VELTSON_PROFILE, DEFAULT_PROFILE, PROFILE_2, PROFILE_3];\nconst profileById = (id: unknown) =>\n ALL_PROFILES.find((p) => p.id === String(id ?? \"\").trim().toLowerCase()) ?? null;\n\n// ---- OTP ---------------------------------------------------------------------\nconst OTP_TTL_MIN = 10, OTP_MAX_ATTEMPTS = 3, OTP_MAX_SENDS = 3;\n// How long after a send an untried code is assumed to still be in flight rather than\n// undelivered. Inside this window a second send_verification_code is refused as\n// unrequested; past it, an untried code is a plausible \"I never got the text\".\nconst OTP_RESEND_GRACE_SEC = 90;\n\nlet ready: Promise | null = null;\nfunction init() {\n ready ??= Promise.all([\n sqlite.execute(`CREATE TABLE IF NOT EXISTS rfp_otp (\n call_id TEXT PRIMARY KEY, code TEXT NOT NULL, destination TEXT NOT NULL,\n expires_at TEXT NOT NULL, attempts INTEGER NOT NULL DEFAULT 0,\n sends INTEGER NOT NULL DEFAULT 1, verified_at TEXT)`),\n sqlite.execute(`CREATE TABLE IF NOT EXISTS rfp_events (\n id INTEGER PRIMARY KEY AUTOINCREMENT, ts TEXT NOT NULL, call_id TEXT,\n type TEXT NOT NULL, payload TEXT)`),\n // The committed-writes ledger. The stored row IS the confirmation: a replay returns\n // the exact payload the first call returned, confirmation number included, rather\n // than minting a second one.\n sqlite.execute(`CREATE TABLE IF NOT EXISTS rfp_writes (\n call_id TEXT NOT NULL, tool TEXT NOT NULL, idem_key TEXT NOT NULL,\n subject TEXT NOT NULL, result TEXT NOT NULL, created_at TEXT NOT NULL,\n PRIMARY KEY (call_id, tool, idem_key))`),\n // One row per call, not one per answer. The closing survey is two questions asked\n // in sequence, so record_survey_response gets called twice on a normal call and the\n // second call must fill in the second column rather than open a second row.\n sqlite.execute(`CREATE TABLE IF NOT EXISTS rfp_survey (\n call_id TEXT PRIMARY KEY, csat_score INTEGER, would_recommend TEXT,\n verbatim TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL)`),\n ]).then(() => {});\n return ready;\n}\n\n// Best-effort. The event log is for demo observability only, so a transient libsql\n// blip must never take down a customer-facing answer mid-call.\nasync function logEvent(callId: string, type: string, payload: unknown) {\n try {\n await init();\n await sqlite.execute({\n sql: `INSERT INTO rfp_events (ts, call_id, type, payload) VALUES (?, ?, ?, ?)`,\n args: [new Date().toISOString(), callId, type, JSON.stringify(payload)],\n });\n } catch (e) {\n console.error(\"logEvent failed (non-fatal):\", String(e));\n }\n}\n\nasync function otpRow(callId: string) {\n if (!callId) return null;\n await init();\n const rs = await sqlite.execute({\n sql: `SELECT code,destination,expires_at,attempts,sends,verified_at FROM rfp_otp WHERE call_id=?`,\n args: [callId],\n });\n const r = rs.rows[0];\n if (!r) return null;\n return {\n code: String(r[0]), destination: String(r[1]), expires_at: String(r[2]),\n attempts: Number(r[3]), sends: Number(r[4]), verified_at: r[5] ? String(r[5]) : null,\n };\n}\n\nfunction toE164(raw: unknown): string | null {\n const s = String(raw ?? \"\").trim(), d = s.replace(/[^\\d]/g, \"\");\n if (s.startsWith(\"+\") && d.length >= 11) return \"+\" + d;\n if (d.length === 11 && d.startsWith(\"1\")) return \"+\" + d;\n if (d.length === 10) return \"+1\" + d;\n return null;\n}\n\nconst last4 = (e: string) => e.slice(-4);\n\n// Where the verification code goes. Priority matters: the number the caller is\n// actually calling from ALWAYS wins. DEMO_MEMBER_PHONE is only a fallback for web\n// calls and chat tests, where there is no caller ID at all — if it takes priority,\n// every real caller gets someone else's phone texted instead of their own.\n//\n// The number is read from the call object, never from tool arguments, so the model\n// cannot redirect the code to a destination of its choosing.\n//\n// Note what this deliberately does NOT read: the resolved profile. A matched ANI decides\n// whose orders the caller sees and nothing else. Reading a profile's mobile_on_file here\n// would mean an unmatched caller could be texted a code belonging to somebody else's\n// handset, which has happened before on a demo build. The fallback is the raw\n// DEMO_MEMBER_PHONE env var, exactly as before, and it is display-only: the send path\n// below refuses anything that is not `caller_id`.\nfunction resolveDestination(ctx: { customerNumber?: string }):\n { to: string; source: \"caller_id\" | \"demo_fallback\" } | null {\n const live = toE164(ctx.customerNumber);\n if (live) return { to: live, source: \"caller_id\" };\n const demo = toE164(DEMO_MEMBER_PHONE);\n if (demo) return { to: demo, source: \"demo_fallback\" };\n return null;\n}\n\n// Both languages in one table, because normalizeCode strips every non-digit AFTER mapping:\n// a Spanish word that is not here does not fail loudly, it silently becomes nothing, and\n// \"cuatro siete dos\" parses to an empty string and comes back as \"no digits came through\n// at all\". This matters even on a Spanish call whose transcriber usually emits numerals,\n// because the fallback rung renders digits as words.\n//\n// Nothing here collides: no Spanish digit word is also an English one. The variants are\n// phonetic shapes a transcriber actually produces (seseo for cinco and cero, b/v for nueve),\n// kept deliberately short of anything that is a common word in either language, since a\n// wrong mapping mints a digit the caller never said.\nconst WORD_DIGITS: Record = {\n // English\n zero: \"0\", oh: \"0\", o: \"0\", one: \"1\", won: \"1\", two: \"2\", to: \"2\", too: \"2\",\n three: \"3\", four: \"4\", for: \"4\", fore: \"4\", five: \"5\", six: \"6\", seven: \"7\",\n eight: \"8\", ate: \"8\", nine: \"9\",\n // Spanish\n cero: \"0\", uno: \"1\", dos: \"2\", tres: \"3\", cuatro: \"4\", cinco: \"5\", seis: \"6\",\n siete: \"7\", ocho: \"8\", nueve: \"9\",\n // Spanish, plausible transcriber shapes\n sero: \"0\", un: \"1\", una: \"1\", quatro: \"4\", cuatros: \"4\", sinco: \"5\", cincos: \"5\",\n seys: \"6\", ciete: \"7\", sietes: \"7\", ochos: \"8\", nuebe: \"9\", nuevo: \"9\", nueves: \"9\",\n};\n\n// Callers give the code three ways: spoken words, spoken digits, or DTMF keypad.\n// All three arrive here as text, so normalize them to bare digits.\nfunction normalizeCode(raw: unknown): string {\n return String(raw ?? \"\").toLowerCase()\n .replace(/[a-z]+/g, (w) => WORD_DIGITS[w] ?? \" \")\n .replace(/[^\\d]/g, \"\");\n}\n\n// Sends through Vapi's own Twilio SMS transport, so no Twilio credentials live here.\n// useLLMGeneratedMessageForOutbound:false forwards the body verbatim — the code is\n// never seen by any language model.\nasync function sendSms(to: string, body: string): Promise<{ ok: true } | { ok: false; message: string }> {\n const key = Deno.env.get(\"VAPI_API_KEY\");\n const phoneNumberId = Deno.env.get(\"VAPI_PHONE_NUMBER_ID\");\n const assistantId = Deno.env.get(\"VAPI_SMS_ASSISTANT_ID\");\n if (!key || !phoneNumberId || !assistantId) {\n return { ok: false, message: \"SMS is not configured on this server\" };\n }\n let res: Response;\n try {\n res = await fetch(\"https://api.vapi.ai/chat\", {\n method: \"POST\",\n headers: { Authorization: `Bearer ${key}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n assistantId, input: body,\n transport: {\n type: \"twilio.sms\", phoneNumberId, customer: { number: to },\n useLLMGeneratedMessageForOutbound: false,\n },\n }),\n });\n } catch (e) {\n return { ok: false, message: `could not reach the SMS provider: ${String(e)}` };\n }\n if (res.status === 429) return { ok: false, message: \"the SMS provider is rate limited right now\" };\n if (!res.ok) {\n const t = await res.text().catch(() => \"\");\n let m = `SMS provider returned ${res.status}`;\n try { const j = JSON.parse(t); if (j?.message) m = String(j.message); } catch { /* keep status */ }\n return { ok: false, message: m };\n }\n return { ok: true };\n}\n\nconst smsConfigured = () => !!(Deno.env.get(\"VAPI_API_KEY\") &&\n Deno.env.get(\"VAPI_PHONE_NUMBER_ID\") && Deno.env.get(\"VAPI_SMS_ASSISTANT_ID\"));\n\n// Server-authoritative: a model-supplied \"verified\" flag is never trusted.\nasync function gateVerified(callId: string): Promise {\n const row = await otpRow(callId);\n if (row?.verified_at) return null;\n return {\n error: \"verification_required\",\n message: \"The caller has not passed code verification. Run send_verification_code and check_verification_code first. Note that general catalog questions — availability, strengths, price — do NOT require verification.\",\n };\n}\n\n// Confirm-then-commit. The write handlers are the only ones that change anything, so\n// the caller has to hear the details back and say yes before the commit happens.\nfunction gateConfirmed(args: any): any | null {\n if (args?.confirmed_with_caller !== true) {\n return {\n error: \"confirmation_required\",\n message: \"This has not been confirmed with the caller yet. Read the medication, strength and day supply back to them, get a spoken yes, then call again with confirmed_with_caller true.\",\n next_step: \"Read the details back, get a yes, then retry with confirmed_with_caller true.\",\n };\n }\n return null;\n}\n\n// ---- write idempotency -------------------------------------------------------\n// A model that retries a tool call must not place a second order. Two guards, because\n// a retry can look like either shape: the same idempotency key twice, or two different\n// keys for the same medication on the same call.\nconst idemKey = (args: any, fallback: string) =>\n String(args?.idempotency_key ?? \"\").trim() || fallback;\n\nasync function priorWrite(callId: string, tool: string, key: string): Promise {\n await init();\n const rs = await sqlite.execute({\n sql: `SELECT result FROM rfp_writes WHERE call_id=? AND tool=? AND idem_key=?`,\n args: [callId, tool, key],\n });\n return rs.rows[0] ? JSON.parse(String(rs.rows[0][0])) : null;\n}\n\nasync function priorWriteForSubject(callId: string, tool: string, subject: string): Promise {\n await init();\n const rs = await sqlite.execute({\n sql: `SELECT result FROM rfp_writes WHERE call_id=? AND tool=? AND subject=? ORDER BY rowid DESC LIMIT 1`,\n args: [callId, tool, subject],\n });\n return rs.rows[0] ? JSON.parse(String(rs.rows[0][0])) : null;\n}\n\nasync function writesThisCall(callId: string, tool: string): Promise {\n if (!callId) return [];\n await init();\n const rs = await sqlite.execute({\n sql: `SELECT result FROM rfp_writes WHERE call_id=? AND tool=? ORDER BY rowid ASC`,\n args: [callId, tool],\n });\n return rs.rows.map((r) => JSON.parse(String(r[0])));\n}\n\n// Insert then read back, so two concurrent identical calls cannot both mint a\n// confirmation number: the loser's insert is ignored and it returns the winner's row.\nasync function commitWrite(\n callId: string, tool: string, key: string, subject: string, build: () => any,\n): Promise {\n await init();\n const fresh = build();\n await sqlite.execute({\n sql: `INSERT OR IGNORE INTO rfp_writes (call_id,tool,idem_key,subject,result,created_at)\n VALUES (?,?,?,?,?,?)`,\n args: [callId, tool, key, subject, JSON.stringify(fresh), new Date().toISOString()],\n });\n return (await priorWrite(callId, tool, key)) ?? fresh;\n}\n\nconst replayed = (result: any, note: string) => ({\n ...result, idempotent_replay: true, next_step: note,\n});\n\n// ---- claims ------------------------------------------------------------------\n// Derived from the delivered orders rather than kept as a separate list, so a claim\n// amount and the price the same order quotes are the same number by construction.\nfunction claims(orders: Order[]) {\n return orders.filter((o) => o.status === \"delivered\").map((o) => ({\n claim_id: \"CLM-\" + o.order_id.slice(4),\n order_id: o.order_id,\n medication: o.medication,\n strength: o.strength,\n unit: drugFor(o).unit,\n amount: orderPaid(o),\n date: orderEta(o),\n }));\n}\n\nfunction claimDateMatches(iso: string, spoken: string): boolean {\n const s = spoken.toLowerCase().trim();\n if (!s) return true;\n if (iso.includes(s)) return true;\n const d = asDate(iso);\n if (!s.includes(MONTHS[d.getUTCMonth()].toLowerCase())) return false;\n // A bare month is enough. A month plus a day has to line up on the day too.\n const day = s.match(/\\b(\\d{1,2})\\b/);\n return !day || Number(day[1]) === d.getUTCDate();\n}\n\n// ---- closing survey ----------------------------------------------------------\n// Deliberately ungated. A satisfaction rating is not account data, so a caller who was\n// never verified, or who only asked a catalog question, can still be surveyed.\n\ntype SurveyRow = { csat_score: number | null; would_recommend: string | null; verbatim: string | null };\n\n// The model is told to send a digit, but a caller says \"five\" and some models pass the\n// word straight through. Cheaper to accept both than to bounce a perfectly good answer.\nconst SCORE_WORDS: Record = { one: 1, two: 2, three: 3, four: 4, five: 5 };\n\n// Returns undefined when nothing was supplied, null when something was supplied that is\n// not a rating from one to five. The two cases read differently: one is a caller who has\n// not answered yet, the other is an answer we have to ask again for.\nfunction parseCsat(raw: unknown): number | null | undefined {\n const s = String(raw ?? \"\").trim().toLowerCase();\n if (!s) return undefined;\n const n = SCORE_WORDS[s] ?? Number(s.match(/-?\\d+(?:\\.\\d+)?/)?.[0] ?? NaN);\n if (!Number.isInteger(n) || n < 1 || n > 5) return null;\n return n;\n}\n\nconst RECOMMEND_WORDS: Record = {\n yes: \"yes\", yeah: \"yes\", yep: \"yes\", yup: \"yes\", sure: \"yes\", absolutely: \"yes\",\n definitely: \"yes\", certainly: \"yes\", true: \"yes\", y: \"yes\",\n no: \"no\", nope: \"no\", nah: \"no\", negative: \"no\", false: \"no\", n: \"no\",\n unsure: \"unsure\", maybe: \"unsure\", \"not sure\": \"unsure\", \"don't know\": \"unsure\",\n dont_know: \"unsure\", neutral: \"unsure\", unknown: \"unsure\",\n};\n\n// Same three-state contract as parseCsat. An unrecognised value is not persisted, so the\n// next_step below falls back to asking the question again rather than banking a guess.\nfunction parseRecommend(raw: unknown): \"yes\" | \"no\" | \"unsure\" | null | undefined {\n const s = String(raw ?? \"\").trim().toLowerCase().replace(/[.!?]+$/, \"\");\n if (!s) return undefined;\n if (RECOMMEND_WORDS[s]) return RECOMMEND_WORDS[s];\n if (/\\b(yes|yeah|yep|sure|absolutely|definitely|would)\\b/.test(s) && !/\\bnot\\b/.test(s)) return \"yes\";\n if (/\\b(no|nope|nah|would not|wouldn't)\\b/.test(s)) return \"no\";\n if (/\\b(unsure|not sure|maybe|depends|don't know|dont know)\\b/.test(s)) return \"unsure\";\n return null;\n}\n\n// COALESCE is the whole upsert: a column the model did not send this time keeps whatever\n// the earlier call put there, so question two cannot erase question one's answer. Done in\n// one statement rather than read-then-write so two concurrent calls cannot interleave.\n// Verbatim accumulates instead of overwriting, because both answers can carry an aside.\nasync function saveSurvey(callId: string, patch: SurveyRow): Promise {\n await init();\n const now = new Date().toISOString();\n await sqlite.execute({\n sql: `INSERT INTO rfp_survey (call_id,csat_score,would_recommend,verbatim,created_at,updated_at)\n VALUES (?,?,?,?,?,?)\n ON CONFLICT(call_id) DO UPDATE SET\n csat_score = COALESCE(excluded.csat_score, rfp_survey.csat_score),\n would_recommend = COALESCE(excluded.would_recommend, rfp_survey.would_recommend),\n verbatim = CASE\n WHEN excluded.verbatim IS NULL THEN rfp_survey.verbatim\n WHEN rfp_survey.verbatim IS NULL THEN excluded.verbatim\n WHEN instr(rfp_survey.verbatim, excluded.verbatim) > 0 THEN rfp_survey.verbatim\n ELSE rfp_survey.verbatim || ' | ' || excluded.verbatim END,\n updated_at = excluded.updated_at`,\n args: [callId, patch.csat_score, patch.would_recommend, patch.verbatim, now, now],\n });\n const rs = await sqlite.execute({\n sql: `SELECT csat_score,would_recommend,verbatim FROM rfp_survey WHERE call_id=?`,\n args: [callId],\n });\n const r = rs.rows[0];\n if (!r) return patch;\n return {\n csat_score: r[0] === null ? null : Number(r[0]),\n would_recommend: r[1] === null ? null : String(r[1]),\n verbatim: r[2] === null ? null : String(r[2]),\n };\n}\n\n// ---- tool handlers -----------------------------------------------------------\nasync function handleTool(name: string, args: any, callId: string, ctx: { customerNumber?: string; isLiveCall?: boolean }): Promise {\n // Resolved once, here, and threaded through every branch below. Calling profileFor\n // again inside a handler would work today and would be the seam a future edit reads\n // two different accounts through.\n const profile = profileFor(ctx);\n const acct = profile.account;\n const history = profile.orders;\n // Same rule as the profile above, and for the same reason: resolved once, threaded down.\n const lang = langFor(args);\n switch (name) {\n case \"lookup_account\": {\n // We can only SMS-verify the line the caller is on, so a caller who says this\n // is not their account number cannot be verified here — that is a handoff, not\n // a prompt for another number. Accepting a spoken number would also let anyone\n // point the code at a handset they control.\n if (args?.mobile_confirmed === false) {\n return {\n error: \"mobile_not_confirmed\",\n message: \"The caller says this is not the mobile on their account. We can only send a code to the line they are calling from, so hand off with transfer_to_human, department customer_care, reason_code mobile_not_on_account.\",\n };\n }\n const dest = resolveDestination(ctx);\n if (!dest) {\n return {\n error: \"no_account_match\",\n message: \"No account could be matched to a mobile number. Hand off with transfer_to_human, department customer_care.\",\n };\n }\n await logEvent(callId, \"account_lookup\", { mobile_last4: last4(dest.to), source: dest.source, profile: profile.id });\n return {\n account_found: true, mobile_last4: last4(dest.to), email_masked: acct.email_masked,\n next_step: \"Send the code with send_verification_code. Speak no account detail yet.\",\n };\n }\n\n case \"send_verification_code\": {\n if (!callId) return { error: \"no_call_context\", message: \"This tool only works during a live call or chat.\" };\n const existing = await otpRow(callId);\n if (existing?.verified_at) {\n return { status: \"already_verified\", message: \"Already verified on this call. Continue with the caller's request.\" };\n }\n // A resend clears the attempt counter, so a locked call must not buy fresh guesses.\n if (existing && existing.attempts >= OTP_MAX_ATTEMPTS) {\n return { error: \"verification_locked\", message: \"Locked after too many incorrect codes. Do not resend. Use transfer_to_human with reason_code verification_failed.\" };\n }\n if (existing && existing.sends >= OTP_MAX_SENDS) {\n return { error: \"too_many_sends\", message: `A code was already sent ${existing.sends} times. Use transfer_to_human with reason_code verification_failed.` };\n }\n // Unrequested resends. The agent used to call this again the moment a code came back\n // wrong, which silently burned one of three sends AND invalidated the code the caller\n // was already holding, so two more wrong reads locked a caller who had the right code\n // in front of them the whole time. A live code with attempts left is not replaced.\n //\n // Two shapes of unrequested resend, both refused. If the caller has already tried the\n // code, they demonstrably have it and a misheard read is not a delivery problem. If\n // nobody has tried it yet and the text went out seconds ago, it is still in flight.\n // Past that grace window an untried code is treated as a genuine \"I never got it\" and\n // resent, which is the one case a hard refusal would strand. `caller_requested_resend`\n // is honoured if the tool schema ever carries it; today it never arrives.\n if (existing && !existing.verified_at && args?.caller_requested_resend !== true) {\n const expiresAt = Date.parse(existing.expires_at);\n const sentAt = expiresAt - OTP_TTL_MIN * 60000;\n const attemptsLeft = OTP_MAX_ATTEMPTS - existing.attempts;\n const tooSoon = Date.now() - sentAt < OTP_RESEND_GRACE_SEC * 1000;\n if (Date.now() < expiresAt && attemptsLeft > 0 && (existing.attempts > 0 || tooSoon)) {\n await logEvent(callId, \"otp_resend_refused\", {\n reason: existing.attempts > 0 ? \"code_still_valid\" : \"still_in_flight\",\n attempts: existing.attempts, sends: existing.sends,\n });\n return {\n error: \"resend_not_needed\",\n attempts_remaining: attemptsLeft,\n mobile_last4: last4(existing.destination),\n message: existing.attempts > 0\n ? \"No new code was sent. The code already on their phone is still valid and they still have attempts left, so replacing it would only invalidate the one they are holding. Say the code did not match, invite them to read it again or key it in, and call check_verification_code with what they give you. Only call this tool again if they say they never received the text.\"\n : \"No new code was sent, because the first text went out moments ago and may still be arriving. Give it a beat, then ask them to read you the six digits when it lands. Only call this tool again if they say it never arrived.\",\n };\n }\n }\n const dest = resolveDestination(ctx);\n if (!dest) return { error: \"no_phone_on_file\", message: \"No mobile number available to text. Use transfer_to_human with reason_code verification_failed.\" };\n // Fail closed unless a genuine caller number was resolved. Only `caller_id` can ever\n // be texted; the DEMO_MEMBER_PHONE fallback is display-only and unsendable on every\n // surface.\n //\n // The previous rule was `demo_fallback && !isLiveCall`, keyed on the presence of\n // call.id. That covered /chat and webchat but left a hole: a vapi.websocket\n // simulation DOES carry call.id and carries no caller ID, so it resolved to\n // demo_fallback with isLiveCall true and would have texted DEMO_MEMBER_PHONE on\n // every run. Nothing had hit it yet only because every scenario happens to mock this\n // tool, which is protection by convention and would break the first time someone\n // wrote a voice scenario without the mock.\n //\n // call.id therefore is not the signal; a resolved caller number is. A real inbound\n // or outbound phone call always carries one, and nothing without one could read a\n // texted code anyway, so this costs no legitimate path. `isLiveCall` is deliberately\n // gone rather than left unused, because a field that reads true on a simulation is\n // the trap itself.\n if (dest.source !== \"caller_id\") {\n await logEvent(callId, \"otp_send_suppressed\", { reason: \"no_caller_number\", source: dest.source, mobile_last4: last4(dest.to) });\n return {\n error: \"sms_suppressed_outside_call\",\n message: \"This run has no caller ID, so no verification text was sent and nobody was messaged. Verification cannot complete here. Catalog questions still work; if the caller needs account access, use transfer_to_human with reason_code verification_failed.\",\n };\n }\n const to = dest.to;\n const code = String(100000 + (crypto.getRandomValues(new Uint32Array(1))[0] % 900000));\n const sent = await sendSms(to, `Amazon Pharmacy: ${code} is your verification code. It expires in ${OTP_TTL_MIN} minutes. We will never ask you to share it by email or text reply.`);\n if (!sent.ok) {\n await logEvent(callId, \"otp_send_failed\", { mobile_last4: last4(to), source: dest.source, reason: sent.message });\n return { error: \"sms_failed\", message: `The code could not be sent (${sent.message}). Apologize briefly and use transfer_to_human with reason_code verification_failed.` };\n }\n await init();\n await sqlite.execute({\n sql: `INSERT INTO rfp_otp (call_id,code,destination,expires_at,attempts,sends,verified_at)\n VALUES (?,?,?,?,0,1,NULL)\n ON CONFLICT(call_id) DO UPDATE SET code=excluded.code, destination=excluded.destination,\n expires_at=excluded.expires_at, attempts=0, sends=rfp_otp.sends+1`,\n args: [callId, code, to, new Date(Date.now() + OTP_TTL_MIN * 60000).toISOString()],\n });\n await logEvent(callId, \"otp_sent\", { mobile_last4: last4(to), source: dest.source, resend: !!existing });\n return {\n status: \"code_sent\", digits: 6, mobile_last4: last4(to), email_masked: acct.email_masked,\n expires_in_minutes: OTP_TTL_MIN,\n instruction: \"Tell the caller a six-digit code went to their email and mobile, and that they can speak it or enter it on the keypad. You cannot see the code — never say it, guess it, or confirm a partial match.\",\n };\n }\n\n case \"check_verification_code\": {\n if (!callId) return { error: \"no_call_context\", message: \"This tool only works during a live call or chat.\" };\n const row = await otpRow(callId);\n if (!row) return { error: \"no_code_issued\", message: \"No code has been sent yet. Call send_verification_code first.\" };\n if (row.verified_at) return { verified: true, message: \"Already verified on this call.\" };\n // Hard lock on entry, or the attempt cap is only advisory and the code is\n // brute-forceable by simply calling this tool again.\n if (row.attempts >= OTP_MAX_ATTEMPTS) {\n return {\n verified: false, error: \"too_many_attempts\", attempts_remaining: 0,\n message: \"Locked after too many incorrect codes. Do not retry or resend. Use transfer_to_human with reason_code verification_failed, without explaining why on the call.\",\n };\n }\n const supplied = normalizeCode(args?.code);\n if (supplied.length !== 6) {\n // Naming the count is the whole point. \"That was not six digits\" makes the caller\n // guess what went wrong; \"I only heard five\" tells them exactly what to fix, and it\n // gives away nothing, because it counts THEIR digits and never touches ours.\n const heard = supplied.length;\n return {\n error: \"malformed_code\",\n digits_heard: heard,\n digits_heard_spoken: intWords(heard, lang, \"neutral\"),\n message: heard === 0\n ? \"No digits came through at all. Ask them to say the six digits or key them in. This did not count as an attempt.\"\n : heard < 6\n ? `Only ${intWords(heard)} digit${heard === 1 ? \"\" : \"s\"} came through and the code is six. Say exactly that, naming the number you heard, and ask for all six. Something like \"I only caught ${intWords(heard)} there, could you give me all six?\". Do not hint at any digit and do not say which ones were missing. This did not count as an attempt.`\n : `${intWords(heard)} digits came through and the code is only six. Say exactly that, naming the number you heard, and ask them to give it again. Something like \"I caught ${intWords(heard)} digits there, and the code is six, could you try once more?\". Do not hint at any digit. This did not count as an attempt.`,\n };\n }\n if (Date.now() > Date.parse(row.expires_at)) {\n return {\n verified: false, error: \"code_expired\",\n message: row.sends < OTP_MAX_SENDS\n ? \"That code expired. Offer to send a fresh one, then call send_verification_code.\"\n : \"That code expired and no resends remain. Use transfer_to_human with reason_code verification_failed.\",\n };\n }\n const attempts = row.attempts + 1, ok = supplied === row.code;\n await sqlite.execute({\n sql: `UPDATE rfp_otp SET attempts=?, verified_at=? WHERE call_id=?`,\n args: [attempts, ok ? new Date().toISOString() : null, callId],\n });\n if (ok) {\n await logEvent(callId, \"otp_verified\", { attempts });\n // recent_order is deliberately NOT returned. Leading with \"are you calling\n // about your Aspirin order?\" followed the reference transcript so closely it\n // read as a script rather than a live agent. The data stays on the profile's\n // account as acct.recent_order, so this is a one-line change to restore.\n // Verification is not always the first thing that happens. A caller can decline it,\n // do a whole catalog and pricing conversation, and only verify when they finally ask\n // for something that needs an account. This instruction used to say \"ask how you can\n // help them today\" unconditionally, which threw away everything they had just told\n // us and made them start over at the moment they were closest to finishing.\n // The event log already knows which it was, so it decides rather than the model.\n const PLUMBING = [\"otp_sent\", \"otp_failed\", \"otp_verified\", \"otp_send_failed\",\n \"otp_send_suppressed\", \"otp_resend_refused\", \"account_lookup\"];\n let priorWork: string[] = [];\n try {\n const rows = await sqlite.execute({\n sql: `SELECT DISTINCT type FROM rfp_events WHERE call_id = ?`, args: [callId],\n });\n priorWork = (rows.rows as unknown as Record[])\n .map((r) => String(r.type ?? (r as unknown as string[])[0]))\n .filter((t) => t && !PLUMBING.includes(t));\n } catch { /* an unreadable log must not block a verified caller */ }\n return {\n verified: true,\n same_day_delivery_eligible: acct.same_day_delivery_eligible,\n work_already_done_on_this_call: priorWork,\n instruction: priorWork.length\n ? \"Say the code was correct in one short line, then go straight back to what they were already doing. They have been on this call a while and have already told you what they want, so asking how you can help them is asking them to start over at the moment they were about to finish. Pick up the exact thread that needed verification and carry on from there. Do not re-ask anything they have already answered.\"\n : \"Say the code was correct in one short line, then ask an open question, how can you help them today. Do not guess at their reason for calling and do not bring up any past order.\",\n };\n }\n const remaining = OTP_MAX_ATTEMPTS - attempts;\n await logEvent(callId, \"otp_failed\", { attempts, attempts_remaining: Math.max(remaining, 0) });\n if (remaining <= 0) {\n return {\n verified: false, error: \"too_many_attempts\", attempts_remaining: 0,\n message: \"Too many incorrect codes. Do not retry or resend. Use transfer_to_human with reason_code verification_failed, without explaining why on the call.\",\n };\n }\n return {\n verified: false, attempts_remaining: remaining,\n message: \"That code does not match. Say so plainly and invite them to try again, speaking it or using the keypad. Never hint at the correct digits.\",\n };\n }\n\n case \"check_medication_availability\": {\n const m = matchDrug(args?.medication_name);\n if (!m.exact) return didYouMean(m);\n const d: Drug = m.exact;\n const strengths = d.strengths.map((s) => ({ value: s, spoken: strengthWords(s, d.unit, lang) }));\n return {\n medication: d.name, generic: d.generic, category: d.category, form: d.form,\n in_stock: d.stock !== \"backordered\", availability: d.stock,\n strengths, strengths_spoken_list: strengths.map((s) => s.spoken).join(\", \"),\n strength_count_spoken: intWords(d.strengths.length, lang, \"neutral\"),\n limited_strengths_spoken: d.limited.length\n ? d.limited.map((s) => strengthWords(s, d.unit, lang)).join(say(\"and\", lang)) : null,\n requires_prescription: d.rx,\n day_supply_options: d.supplies,\n day_supply_options_spoken: d.supplies\n .map((s) => lang === \"es\" ? daysSpoken(s, lang) : `${intWords(s)} days`).join(\", \"),\n availability_note: d.stock === \"backordered\"\n ? `${d.name} is on backorder nationwide. Offer to check an alternative in the same category, or to notify them when it is back.`\n : d.stock === \"limited\"\n ? `${d.name} is available, but the strengths in limited_strengths_spoken are supply-constrained. Mention that only if they ask for one of those.`\n : null,\n // Two separate turns, in this order, and the model reliably collapses them into\n // one invented guess unless the sequence is spelled out at the point of use.\n next_step:\n \"Two questions, one at a time, before any pricing lookup. First: read the strengths \" +\n \"from strengths_spoken_list and ask which one they want. Then, once they have named a \" +\n \"strength, ask whether they would like a price for a particular day supply, naming the \" +\n \"values from day_supply_options_spoken inside your own sentence. Only call \" +\n \"get_medication_pricing once they \" +\n \"have named a day supply themselves. Do not choose one for them.\\n\" +\n \"The moment they name ANY number, call get_medication_pricing with exactly that number, \" +\n \"even a number not in day_supply_options. Thirty is a valid thing to send. This tool \" +\n \"resolves it to the nearest real supply and hands back the reason, which you then explain. \" +\n \"Do not check their number against the options yourself and do not ask them to pick again \" +\n \"from the list; they have already answered and asking twice is the failure here.\",\n };\n }\n\n case \"get_medication_pricing\": {\n const m = matchDrug(args?.medication_name);\n if (!m.exact) return didYouMean(m);\n const d: Drug = m.exact;\n const strengthRaw = parseFloat(String(args?.strength ?? \"\").replace(/[^0-9.]/g, \"\"));\n if (isNaN(strengthRaw) || !d.strengths.includes(strengthRaw)) {\n return {\n error: \"strength_required\",\n available_strengths_spoken: d.strengths.map((s) => strengthWords(s, d.unit, lang)).join(\", \"),\n message: `Ask which strength of ${d.name} they want, offering the values in available_strengths_spoken read exactly as written.`,\n };\n }\n const reqDays = parseInt(String(args?.days_supply ?? \"\").replace(/[^0-9]/g, \"\"), 10);\n if (isNaN(reqDays)) {\n return {\n error: \"days_supply_required\",\n options_spoken: d.supplies.map((s) => daysSpoken(s, lang)).join(\", \"),\n message: \"Ask what day supply they want, offering the values in options_spoken.\",\n };\n }\n const days = resolveSupply(d, reqDays);\n const ins = d.insurance[String(days)], cash = d.cash[String(days)];\n // Manufacturer copay cards floor out rather than zeroing a copay: the savings\n // are capped so the caller is never told they could pay nothing.\n const savings = d.couponMax > 0\n ? Math.max(0, Math.min(d.couponMax, Math.round((ins - COUPON_FLOOR) * 100) / 100)) : 0;\n const lowest = Math.round((ins - savings) * 100) / 100;\n const couponApplies = savings > 0;\n const doses = d.schedule === \"weekly\" ? days / 7 : days;\n const ml = (d.schedule === \"weekly\" && d.mlPerDose)\n ? Math.round(d.mlPerDose * doses * 100) / 100 : null;\n const verified = !(await gateVerified(callId));\n await logEvent(callId, \"pricing_quote\", { drug: d.name, strength: strengthRaw, days });\n return {\n medication: d.name, generic: d.generic, form: d.form,\n strength_spoken: strengthWords(strengthRaw, d.unit, lang),\n days_supply: days, days_supply_spoken: daysSpoken(days, lang),\n supply_note: supplyNote(d, reqDays, days, lang),\n volume_spoken: ml\n ? (lang === \"es\"\n ? `${decimalWords(ml, \"es\", \"m\")} ${ml === 1 ? \"mililitro\" : \"mililitros\"}`\n : `${decimalWords(ml)} milliliters`)\n : null,\n insurance_price_spoken: d.rx ? moneyWords(ins, lang) : null,\n cash_price_spoken: moneyWords(cash, lang),\n coupon_available: couponApplies,\n coupon_savings_spoken: couponApplies ? moneyWords(savings, lang) : null,\n lowest_price_spoken: couponApplies ? moneyWords(lowest, lang) : null,\n coupon_note: (!couponApplies && d.couponMax > 0)\n ? \"A manufacturer coupon exists for this medication, but it cannot go below the copay they already have at this day supply. Do not mention a coupon.\" : null,\n availability: d.stock,\n requires_prescription: d.rx,\n estimate_disclaimer: \"The average insurance price is an estimate based on what other customers paid; the caller's actual price may differ.\",\n same_day_delivery_eligible: verified ? acct.same_day_delivery_eligible : null,\n // The shape of this turn is the client's, not ours, and it is prescriptive because\n // the model otherwise reads every field it was handed as its own short sentence.\n // Eight clipped sentences carrying a copay and a cash price together is the version\n // that landed badly on a real call: shorter than their script in words, far worse to\n // listen to. cash_price_spoken stays in the payload for a caller who asks and is\n // deliberately kept out of the default read, because their script never quotes it.\n next_step: d.rx\n ? \"FOUR sentences, around seventy words, no more. Nobody can hold more than that spoken \" +\n \"aloud, and every extra clause is one they cannot interrupt.\\n\" +\n \"1. The day supply, medication and strength, volume_spoken if set, then \" +\n \"insurance_price_spoken. If coupon_available, finish the same sentence with the coupon \" +\n \"bringing it down to as little as lowest_price_spoken.\\n\" +\n \"2. The estimate disclaimer, short: that is an estimate based on what other customers \" +\n \"paid, so theirs may differ.\\n\" +\n \"3. To order it we would need their prescription sent to us by their prescriber.\\n\" +\n \"4. Would they like to transfer their prescription from another pharmacy TO AMAZON \" +\n \"PHARMACY. Name us in that question every time; where it is going is the point of asking.\\n\" +\n \"If supply_note is set they asked for a supply we do not sell, so sentence 1 MUST say \" +\n \"which supply you are quoting and why it differs, as a clause inside that sentence and \" +\n \"never as a sentence of its own. That clause is not optional and is never dropped to \" +\n \"save words: quoting a different supply without saying so is a silent substitution.\\n\" +\n \"LEAVE OUT: the cash price, unless they ask or there is no \" +\n \"insurance price; same-day delivery, which belongs later if they take the transfer or \" +\n \"ask about delivery; and anything else in this payload not listed above.\"\n : \"Give this as one flowing answer using the spoken fields exactly as written. No \" +\n \"prescription is needed for this item, so do not mention prescriptions or transfers.\",\n };\n }\n\n case \"initiate_prescription_transfer\": {\n const g = await gateVerified(callId);\n if (g) return g;\n const m = matchDrug(args?.medication_name);\n if (!m.exact) return didYouMean(m);\n if (!String(args?.current_pharmacy ?? \"\").trim()) {\n return { error: \"missing_pharmacy\", message: \"Ask which pharmacy currently holds the prescription, then retry.\" };\n }\n const result = {\n transfer_id: \"TRF-\" + String(30000 + Math.floor(Math.random() * 9000)),\n medication: m.exact.name, from_pharmacy: String(args.current_pharmacy),\n status: \"initiated\",\n expected_spoken: say(\"transferExpected\", lang),\n };\n await logEvent(callId, \"transfer_rx\", result);\n return result;\n }\n\n // ---- account lifecycle, ported from amazon-pharmacy-mock-sandbox ----------\n // All five read the resolved profile's own orders, all five gate on the same\n // server-side OTP, and all five return every speakable value pre-worded.\n\n case \"get_order_status\": {\n const g = await gateVerified(callId);\n if (g) return g;\n const named = String(args?.medication_name ?? \"\").trim();\n const placed = await writesThisCall(callId, \"create_reorder\");\n if (named) {\n const { match, order } = findOrder(named, history);\n if (!match.exact) return didYouMean(match);\n if (!order) return notOnFile(named, history, lang);\n await logEvent(callId, \"order_status\", { order_id: order.order_id, medication: order.medication, profile: profile.id });\n return {\n orders: [orderView(order, lang)], order_count: 1, order_count_spoken: intWords(1, lang, \"neutral\"),\n placed_this_call: placed,\n next_step: \"Read the status using status_spoken, and the date using order_date_spoken or eta_spoken, exactly as written. Do not restate any number in digits.\",\n };\n }\n const all = [...history].sort((a, b) => a.orderedDaysAgo - b.orderedDaysAgo).map((o) => orderView(o, lang));\n await logEvent(callId, \"order_status\", { order_id: null, count: all.length, profile: profile.id });\n return {\n orders: all, order_count: all.length, order_count_spoken: intWords(all.length, lang, \"neutral\"),\n placed_this_call: placed,\n next_step: \"Lead with the most recent order only, using its spoken fields exactly as written, and ask whether they want to hear about the others rather than listing all of them.\",\n };\n }\n\n case \"get_delivery_status\": {\n const g = await gateVerified(callId);\n if (g) return g;\n const wantedId = String(args?.order_id ?? \"\").trim().toUpperCase();\n const named = String(args?.medication_name ?? \"\").trim();\n let order: Order | null = null;\n if (wantedId) {\n order = history.find((o) => o.order_id.toUpperCase() === wantedId) ?? null;\n if (!order) {\n return {\n error: \"order_not_found\",\n message: `No order on this account matches ${wantedId}. Ask the caller which medication the delivery is for instead of asking for the number again.`,\n next_step: \"Ask which medication the delivery is for, then call again with medication_name.\",\n };\n }\n } else if (named) {\n const found = findOrder(named, history);\n if (!found.match.exact) return didYouMean(found.match);\n if (!found.order) return notOnFile(named, history, lang);\n order = found.order;\n } else {\n // No hint from the caller, so answer about the parcel actually in motion.\n order = history.find((o) => o.delivery_state === \"in_transit\")\n ?? history.find((o) => o.delivery_state === \"preparing\")\n ?? mostRecentOrder(history);\n }\n await logEvent(callId, \"delivery_status\", { order_id: order.order_id, profile: profile.id });\n const view = orderView(order, lang);\n return {\n ...view,\n tracking_note: order.tracking_note,\n same_day_delivery_eligible: acct.same_day_delivery_eligible,\n next_step: view.eta_spoken\n ? \"Give the carrier and the arrival from eta_spoken exactly as written. Offer the tracking_note detail only if they ask where it is right now.\"\n : \"Say it already arrived, using delivered_on_spoken exactly as written, and ask whether they received it.\",\n };\n }\n\n case \"create_reorder\": {\n const g = (await gateVerified(callId)) ?? gateConfirmed(args);\n if (g) return g;\n const { match, order } = findOrder(args?.medication_name, history);\n if (!match.exact) return didYouMean(match);\n if (!order) return notOnFile(args?.medication_name, history, lang);\n\n // Same key twice is the same order, always.\n const key = idemKey(args, `reorder:${order.medication}`);\n const replay = await priorWrite(callId, \"create_reorder\", key);\n if (replay) {\n return replayed(replay, \"This is the order already placed earlier on this call, not a new one. Repeat the confirmation number from confirmation_number_spoken if they ask, and do not say a second order was placed.\");\n }\n // Two different keys for the same medication on the same call is still one intent.\n const dup = await priorWriteForSubject(callId, \"create_reorder\", order.medication);\n if (dup) {\n return {\n ...dup, duplicate_request: true,\n next_step: `A refill for ${order.medication} was already placed on this call. Confirm that one using confirmation_number_spoken and do not place another.`,\n };\n }\n\n if (order.refills_remaining < 1) {\n return {\n error: \"no_refills_remaining\",\n medication: order.medication,\n strength_spoken: looseStrengthSpoken(order.strength, drugFor(order).unit, lang),\n prescriber: order.prescriber,\n message: `${order.medication} has no refills remaining, so it cannot be reordered. Offer to request a renewal from the prescriber instead.`,\n next_step: \"Tell the caller there are no refills left, offer a renewal request, and on a yes call request_prescription_renewal.\",\n };\n }\n\n const d = drugFor(order);\n const etaIso = isoDay(2);\n return await commitWrite(callId, \"create_reorder\", key, order.medication, () => {\n const confirmation = \"ORD-\" + String(60000 + Math.floor(Math.random() * 9000));\n const left = order.refills_remaining - 1;\n return {\n status: \"placed\",\n confirmation_number: confirmation,\n confirmation_number_spoken: idSpoken(\"ORD\", confirmation, lang),\n medication: order.medication,\n generic: d.generic,\n strength_spoken: strengthWords(order.strength, d.unit, lang),\n days_supply_spoken: daysSpoken(order.days_supply, lang),\n copay_spoken: moneyWords(d.insurance[String(order.days_supply)] ?? 0, lang),\n refills_remaining_after: left,\n refills_remaining_after_spoken: refillsSpoken(left, lang),\n delivery_spoken: `${dayAndDateSpoken(etaIso, lang)} ${say(\"byEightPm\", lang)}`,\n same_day_delivery_eligible: acct.same_day_delivery_eligible,\n estimate_disclaimer: \"The copay is an estimate and is confirmed when the order is filled.\",\n next_step: \"Confirm the order in one line using copay_spoken and delivery_spoken exactly as written, give the confirmation number from confirmation_number_spoken, then ask if there is anything else.\",\n };\n });\n }\n\n case \"request_prescription_renewal\": {\n const g = (await gateVerified(callId)) ?? gateConfirmed(args);\n if (g) return g;\n const { match, order } = findOrder(args?.medication_name, history);\n if (!match.exact) return didYouMean(match);\n if (!order) return notOnFile(args?.medication_name, history, lang);\n\n const key = idemKey(args, `renewal:${order.medication}`);\n const replay = await priorWrite(callId, \"request_prescription_renewal\", key);\n if (replay) {\n return replayed(replay, \"This is the renewal already submitted earlier on this call, not a second one. Repeat the reference from request_id_spoken if they ask.\");\n }\n const dup = await priorWriteForSubject(callId, \"request_prescription_renewal\", order.medication);\n if (dup) {\n return {\n ...dup, duplicate_request: true,\n next_step: `A renewal for ${order.medication} was already submitted on this call. Confirm that one using request_id_spoken and do not submit another.`,\n };\n }\n\n if (!order.prescriber) {\n return {\n error: \"no_prescriber_on_file\",\n medication: order.medication,\n message: `There is no prescriber on file for ${order.medication}, so a renewal cannot be requested from here. Hand off with transfer_to_human, department customer_care, reason_code no_prescriber_on_file.`,\n next_step: \"Tell the caller a teammate needs to sort this out, then call transfer_to_human with department customer_care.\",\n };\n }\n\n const d = drugFor(order);\n return await commitWrite(callId, \"request_prescription_renewal\", key, order.medication, () => {\n const requestId = \"RNW-\" + String(40000 + Math.floor(Math.random() * 9000));\n return {\n status: \"submitted\",\n request_id: requestId,\n request_id_spoken: idSpoken(\"RNW\", requestId, lang),\n medication: order.medication,\n generic: d.generic,\n strength_spoken: strengthWords(order.strength, d.unit, lang),\n days_supply_spoken: daysSpoken(order.days_supply, lang),\n prescriber: order.prescriber,\n expected_response_spoken: say(\"businessDays\", lang),\n next_step: \"Say the request went to the prescriber, give the timeframe from expected_response_spoken exactly as written, and say we will text them when it comes back. Do not promise it will be approved.\",\n };\n });\n }\n\n case \"process_claim_reversal\": {\n const g = (await gateVerified(callId)) ?? gateConfirmed(args);\n if (g) return g;\n const amt = parseFloat(String(args?.claim_amount ?? \"\").replace(/[^0-9.]/g, \"\"));\n const dateStr = String(args?.claim_date ?? \"\").trim();\n const named = String(args?.medication_name ?? \"\").trim();\n if (!named && isNaN(amt) && !dateStr) {\n return {\n error: \"claim_details_required\",\n message: \"Nothing was given to identify the claim. Ask which medication the charge was for, and the amount or roughly when it was.\",\n next_step: \"Ask which medication the charge was for, then retry with medication_name.\",\n };\n }\n let pool = claims(history);\n if (named) {\n const m = matchDrug(named);\n if (!m.exact) return didYouMean(m);\n pool = pool.filter((c) => c.medication === m.exact!.name);\n }\n if (!isNaN(amt)) pool = pool.filter((c) => Math.abs(c.amount - amt) <= 0.51);\n if (dateStr) pool = pool.filter((c) => claimDateMatches(c.date, dateStr));\n\n if (pool.length === 0) {\n return {\n error: \"no_matching_claim\",\n message: \"No reversible claim on this account matches that. Do not guess at which charge they mean. Hand off with transfer_to_human, department billing, reason_code claim_not_found.\",\n next_step: \"Tell the caller billing will need to look at it, then call transfer_to_human with department billing.\",\n };\n }\n if (pool.length > 1) {\n return {\n error: \"ambiguous_claim\",\n candidates_spoken: pool.map((c) => `${c.medication}, ${moneyWords(c.amount, lang)}, ${dateSpoken(c.date, lang)}`).join(\"; \"),\n message: \"More than one claim matches. Read the options in candidates_spoken exactly as written and ask which one, then retry.\",\n next_step: \"Read candidates_spoken and ask which charge they mean, then call again with medication_name.\",\n };\n }\n\n const c = pool[0];\n const key = idemKey(args, `reversal:${c.claim_id}`);\n const replay = await priorWrite(callId, \"process_claim_reversal\", key);\n if (replay) {\n return replayed(replay, \"This reversal was already processed earlier on this call. Repeat the reference from claim_id_spoken if they ask, and do not process it twice.\");\n }\n const dup = await priorWriteForSubject(callId, \"process_claim_reversal\", c.claim_id);\n if (dup) {\n return {\n ...dup, duplicate_request: true,\n next_step: \"This charge was already reversed on this call. Confirm that one and do not process another.\",\n };\n }\n return await commitWrite(callId, \"process_claim_reversal\", key, c.claim_id, () => ({\n status: \"reversal_processed\",\n claim_id: c.claim_id,\n claim_id_spoken: idSpoken(\"CLM\", c.claim_id),\n order_id: c.order_id,\n medication: c.medication,\n strength_spoken: strengthWords(c.strength, c.unit),\n amount_spoken: moneyWords(c.amount),\n original_fill_date_spoken: dateSpoken(c.date),\n posts_by_spoken: \"within twenty-four hours\",\n next_step: \"Confirm the reversal in one line using amount_spoken and posts_by_spoken exactly as written, then ask if there is anything else. Do not say the money is back on their card already.\",\n }));\n }\n\n case \"transfer_to_human\": {\n const dept = String(args?.department ?? \"\").toLowerCase().trim();\n if (![\"pharmacist\", \"customer_care\", \"billing\"].includes(dept)) {\n return { error: \"invalid_department\", message: \"department must be one of: pharmacist, customer_care, billing.\" };\n }\n if (!String(args?.call_summary ?? \"\").trim()) {\n return { error: \"missing_call_summary\", message: \"Include a brief call_summary so the specialist has context, then retry.\" };\n }\n // This must not instruct an endCall. The agent obeyed the old wording literally and\n // fired endCall in the same turn as the transfer on every handoff path, which will\n // race or kill a real warm-transfer-experimental tool once one is wired. It also\n // must not name a queue position: the old response returned queue_position 1 and the\n // agent read it out as \"you're next in line\", a wait-time promise we cannot keep.\n const result = {\n status: \"transfer_accepted\", department: dept,\n instruction: \"Say one short line, that you are connecting them now and the specialist has the full context. Then stop and wait. Do not end the call, do not use the endCall tool, and do not say anything about a wait time, a queue, or a position in line.\",\n };\n await logEvent(callId, \"transfer_to_human\", { ...result, reason_code: args?.reason_code ?? null, call_summary: args.call_summary });\n return result;\n }\n\n case \"record_survey_response\": {\n const csat = parseCsat(args?.csat_score);\n const rec = parseRecommend(args?.would_recommend);\n const verbatim = String(args?.verbatim ?? \"\").trim() || null;\n\n // A rating we could not read is the one failure worth bouncing, because the\n // question has a fixed answer set and the caller is right there to repeat it. An\n // unreadable would_recommend is not bounced: it falls through unrecorded and the\n // next_step below asks that question again, which is the same recovery without a\n // second round trip.\n if (csat === null) {\n // Whatever else came in on the same call is still banked. Losing a good\n // recommendation because the rating was garbled would make the retry lossy.\n if (callId && (rec || verbatim)) await saveSurvey(callId, { csat_score: null, would_recommend: rec ?? null, verbatim });\n await logEvent(callId, \"survey_invalid_csat\", { raw: args?.csat_score ?? null });\n return {\n error: \"invalid_csat\",\n message: \"That was not a rating from one to five, so no score was recorded. Ask them again for a number from one to five, then call this tool again with csat_score.\",\n next_step: \"Ask them again, in one short line, for a number from one to five. Do not offer any other scale and do not move on to the second question yet.\",\n };\n }\n\n // No call id means a chat or a bare curl, where there is nothing durable to key on.\n // The survey still sequences correctly off this turn's arguments alone, so the beat\n // plays out identically; only the row is skipped.\n // A call that carried no answer at all is not a survey response and must not open a\n // row. Otherwise a model that fires the tool before asking anything leaves an\n // all-null record in /survey that reads like a caller who refused to answer.\n const patch: SurveyRow = { csat_score: csat ?? null, would_recommend: rec ?? null, verbatim };\n const anything = patch.csat_score !== null || patch.would_recommend !== null || patch.verbatim !== null;\n const state: SurveyRow = (callId && anything) ? await saveSurvey(callId, patch) : patch;\n await logEvent(callId, \"survey_response\", {\n csat_score: state.csat_score, would_recommend: state.would_recommend,\n verbatim: state.verbatim, persisted: !!callId && anything,\n });\n\n const haveCsat = state.csat_score !== null;\n const haveRec = state.would_recommend !== null;\n const out: any = {\n status: \"survey_recorded\",\n csat_score: state.csat_score,\n would_recommend: state.would_recommend,\n questions_remaining: (haveCsat ? 0 : 1) + (haveRec ? 0 : 1),\n };\n // Never let the model turn a stored integer into words itself, same rule as every\n // price and dose in this file.\n if (haveCsat) out.csat_spoken = intWords(state.csat_score!);\n\n if (haveCsat && haveRec) {\n out.survey_complete = true;\n out.next_step = \"The survey is finished and no questions remain. Thank them warmly in ONE short sentence, then end the call. Do not ask anything further, do not read their answers back to them, and do not offer more help.\";\n } else if (haveCsat) {\n out.survey_complete = false;\n out.next_step = \"Thank them briefly, in a few words, then ask the second and final question: would they recommend Amazon Pharmacy to someone else. Do not re-ask the rating and do not add a third question.\";\n } else {\n out.survey_complete = false;\n out.next_step = \"No rating has been recorded yet. Ask the first question: on a scale from one to five, how would they rate their experience today. Then call this tool again with csat_score.\";\n }\n return out;\n }\n\n default:\n return { error: \"unknown_tool\", message: `No handler for tool \"${name}\".` };\n }\n}\n\n// ---- catalog rendering -------------------------------------------------------\n// Manufacturer copay cards floor at this price rather than reducing a copay to zero.\nconst COUPON_FLOOR = 25;\n// Money always prints with cents when it has them: $3.10, never $3.1.\nconst USD = (n: number) => \"$\" + (Number.isInteger(n) ? String(n) : n.toFixed(2));\n\nconst STOCK_LABEL: Record = {\n in_stock: \"In stock\", limited: \"Limited supply\", backordered: \"On backorder\",\n};\nconst shortUnit = (u: string) => u === \"units/mL\" ? \"units/mL\" : u;\n\nfunction catalogRows() {\n return CATALOG.map((d) => ({\n name: d.name, generic: d.generic, category: d.category, form: d.form,\n strengths: d.strengths.map((s) => `${s} ${shortUnit(d.unit)}`).join(\", \"),\n strengths_spoken: d.strengths.map((s) => strengthWords(s, d.unit)),\n availability: STOCK_LABEL[d.stock],\n limited: d.limited.map((s) => `${s} ${shortUnit(d.unit)}`).join(\", \"),\n rx: d.rx ? \"Rx\" : \"OTC\",\n supplies: d.supplies,\n insurance: d.rx\n ? d.supplies.map((s) => s + \"d \" + USD(d.insurance[String(s)])).join(\" · \") : \"—\",\n cash: d.supplies.map((s) => s + \"d \" + USD(d.cash[String(s)])).join(\" · \"),\n coupon: d.couponMax > 0\n ? \"up to \" + USD(d.couponMax) + \" off, floor \" + USD(COUPON_FLOOR) : \"—\",\n }));\n}\n\nfunction catalogHtml(): string {\n const rows = catalogRows();\n const cats = [...new Set(rows.map((r) => r.category))];\n const esc = (s: string) => s.replace(/&/g, \"&\").replace(/ {\n const body = rows.filter((r) => r.category === c).map((r) => `\n \n ${esc(r.name)}${esc(r.generic)}\n ${esc(r.form)}${r.rx}\n ${esc(r.strengths)}\n ${esc(r.availability)}${r.limited ? `limited: ${esc(r.limited)}` : \"\"}\n ${esc(r.insurance)}\n ${esc(r.cash)}\n ${esc(r.coupon)}\n `).join(\"\");\n return `

Diff · v112