[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_157":158,"_159":160},"routes/_app.x.$handle.$name",{"_98":97,"_32":45,"_106":88,"_27":53,"_13":14,"_107":-5,"_11":108,"_109":110,"_111":112,"_113":114,"_115":116,"_20":-5,"_117":-5,"_118":-5,"_119":25,"_120":121,"_122":123,"_124":-5,"_125":-5,"_126":127},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":25},"version",8,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","417f6ebc-5b34-11f1-9787-ee650bb23af1","name","fileType","http","content","// twilio-otp.val.ts\n//\n// Thin shim between Vapi apiRequest tools (JSON body) and Twilio Verify\n// (form-urlencoded body). Deploy as a Val Town HTTP val.\n//\n// Two routes:\n// POST /sendOtp body: { to: \"+1E164...\" } -> Twilio Verify create\n// POST /verifyOtp body: { to: \"+1E164...\", code: \"123456\" } -> Twilio Verify check\n//\n// Twilio creds are read from Val Town env vars at request time. Set these in\n// Val Town's environment variables panel:\n// TWILIO_ACCOUNT_SID (AC...)\n// TWILIO_AUTH_TOKEN\n// TWILIO_VERIFY_SID (VA...)\n//\n// Response shape, both routes:\n// 200 { ok: true, status: \"pending\" | \"approved\", sid?, channel?, valid? }\n// 200 { ok: false, status: \"denied\" | \"expired\" | \"max_attempts\" | \"wrong_code\", error? }\n// 4xx { ok: false, error: \"\", code: }\n//\n// \"denied/expired/max_attempts/wrong_code\" are surfaced as 200 so the Vapi tool\n// reads them as a normal response and the assistant can react conversationally.\n// Network/auth/config errors return 4xx/5xx so Vapi flags a tool failure.\n\ntype SendBody = { to?: string };\ntype VerifyBody = { to?: string; code?: string };\n\nfunction json(status: number, body: unknown): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"content-type\": \"application/json\" },\n });\n}\n\nfunction basicAuth(sid: string, token: string): string {\n return \"Basic \" + btoa(`${sid}:${token}`);\n}\n\nasync function twilioPost(path: string, params: Record) {\n const sid = Deno.env.get(\"TWILIO_ACCOUNT_SID\");\n const token = Deno.env.get(\"TWILIO_AUTH_TOKEN\");\n const verifySid = Deno.env.get(\"TWILIO_VERIFY_SID\");\n const envState = {\n TWILIO_ACCOUNT_SID: sid\n ? `set (len=${sid.length}, starts=${sid.slice(0, 4)})`\n : \"MISSING\",\n TWILIO_AUTH_TOKEN: token ? `set (len=${token.length})` : \"MISSING\",\n TWILIO_VERIFY_SID: verifySid\n ? `set (len=${verifySid.length}, starts=${verifySid.slice(0, 4)})`\n : \"MISSING\",\n };\n if (!sid || !token || !verifySid) {\n return {\n httpStatus: 500,\n body: { ok: false, error: \"Server missing TWILIO_* env vars\", envState },\n };\n }\n const form = new URLSearchParams(params);\n const url = `https://verify.twilio.com/v2/Services/${verifySid}${path}`;\n let res: Response;\n try {\n res = await fetch(url, {\n method: \"POST\",\n headers: {\n \"authorization\": basicAuth(sid, token),\n \"content-type\": \"application/x-www-form-urlencoded\",\n },\n body: form.toString(),\n });\n } catch (e) {\n return {\n httpStatus: 500,\n body: {\n ok: false,\n error: \"fetch failed\",\n reason: String(e),\n envState,\n url,\n },\n };\n }\n const rawText = await res.text();\n let body: any = {};\n try {\n body = JSON.parse(rawText);\n } catch {\n body = { raw: rawText };\n }\n return {\n httpStatus: res.status,\n body: { ...body, _debug: { upstreamStatus: res.status, envState, url } },\n };\n}\n\nasync function handleSend(req: Request): Promise {\n let parsed: SendBody;\n try {\n parsed = await req.json();\n } catch {\n return json(400, { ok: false, error: \"Body must be JSON\" });\n }\n const to = (parsed.to || \"\").trim();\n if (!to.startsWith(\"+\")) {\n return json(400, { ok: false, error: \"to must be E.164 (start with +)\" });\n }\n\n const { httpStatus, body } = await twilioPost(\"/Verifications\", {\n To: to,\n Channel: \"sms\",\n });\n if (httpStatus >= 400) {\n return json(httpStatus, {\n ok: false,\n error: body?.message || \"twilio error\",\n code: body?.code,\n });\n }\n return json(200, {\n ok: true,\n status: body?.status,\n sid: body?.sid,\n channel: body?.channel,\n });\n}\n\nasync function handleVerify(req: Request): Promise {\n let parsed: VerifyBody;\n try {\n parsed = await req.json();\n } catch {\n return json(400, { ok: false, error: \"Body must be JSON\" });\n }\n const to = (parsed.to || \"\").trim();\n const code = (parsed.code || \"\").trim();\n if (!to.startsWith(\"+\")) {\n return json(400, { ok: false, error: \"to must be E.164\" });\n }\n if (!/^\\d{4,10}$/.test(code)) {\n return json(400, { ok: false, error: \"code must be 4-10 digits\" });\n }\n\n const { httpStatus, body } = await twilioPost(\"/VerificationCheck\", {\n To: to,\n Code: code,\n });\n // 404 from Twilio means the verification expired or was already approved.\n if (httpStatus === 404) {\n return json(200, {\n ok: false,\n status: \"expired\",\n error: \"verification not found or already finalized\",\n });\n }\n if (httpStatus >= 400) {\n return json(httpStatus, {\n ok: false,\n error: body?.message || \"twilio error\",\n code: body?.code,\n });\n }\n // Twilio returns status: \"approved\" | \"pending\" | \"canceled\". valid: boolean.\n const status = body?.status;\n const valid = body?.valid === true;\n if (status === \"approved\" || valid) {\n return json(200, { ok: true, status: \"approved\", valid: true });\n }\n return json(200, { ok: false, status: \"wrong_code\", valid: false });\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n if (req.method === \"GET\" && url.pathname === \"/\") {\n return json(200, {\n ok: true,\n routes: [\"POST /sendOtp { to }\", \"POST /verifyOtp { to, code }\"],\n note: \"Vapi-to-Twilio Verify shim.\",\n });\n }\n if (req.method === \"POST\" && url.pathname === \"/sendOtp\") {\n return handleSend(req);\n }\n if (req.method === \"POST\" && url.pathname === \"/verifyOtp\") {\n return handleVerify(req);\n }\n return json(404, { ok: false, error: \"not found\" });\n}","// main.ts\n//\n// Shim between Vapi apiRequest tools (JSON body) and Twilio Messaging.\n// Self-manages the OTP code (generate + store + verify) so the SMS body is\n// fully under our control and the code never passes through Vapi/the model.\n//\n// Two routes (contract UNCHANGED from the prior Twilio Verify shim, so the\n// Vapi sendOtp/verifyOtp tools and the OTP assistant prompt need no changes):\n// POST /sendOtp body: { to: \"+1E164...\" } -> generate + send code\n// POST /verifyOtp body: { to: \"+1E164...\", code: \"123456\" } -> check stored code\n//\n// Env vars (set in Val Town's environment variables panel):\n// TWILIO_ACCOUNT_SID (AC...) required\n// TWILIO_AUTH_TOKEN required\n// TWILIO_FROM (+1E164 sender) required UNLESS messaging service set\n// TWILIO_MESSAGING_SERVICE_SID (MG...) optional; preferred over TWILIO_FROM if set\n// (TWILIO_VERIFY_SID is no longer used.)\n//\n// Response shape (identical to before):\n// 200 { ok: true, status: \"pending\" | \"approved\" }\n// 200 { ok: false, status: \"wrong_code\" | \"expired\" }\n// 4xx/5xx { ok: false, error: \"\" } -> Vapi flags a tool failure\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\ntype SendBody = { to?: string };\ntype VerifyBody = { to?: string; code?: string };\n\nconst CODE_TTL_MS = 10 * 60 * 1000; // 10 minutes\nconst MAX_ATTEMPTS = 5;\nconst SMS_BODY = (code: string) =>\n `Natera: Your code is ${code}. Didn't request this? You can safely ignore this message.`;\n\nfunction json(status: number, body: unknown): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"content-type\": \"application/json\" },\n });\n}\n\nfunction basicAuth(sid: string, token: string): string {\n return \"Basic \" + btoa(`${sid}:${token}`);\n}\n\nfunction genCode(): string {\n const n = crypto.getRandomValues(new Uint32Array(1))[0] % 1_000_000;\n return n.toString().padStart(6, \"0\");\n}\n\nasync function ensureTable(): Promise {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS otp_codes (\n phone TEXT PRIMARY KEY,\n code TEXT NOT NULL,\n expires_at INTEGER NOT NULL,\n attempts INTEGER NOT NULL DEFAULT 0\n )`,\n );\n}\n\nfunction twilioCreds() {\n const sid = Deno.env.get(\"TWILIO_ACCOUNT_SID\");\n const token = Deno.env.get(\"TWILIO_AUTH_TOKEN\");\n const from = Deno.env.get(\"TWILIO_FROM\");\n const msgSvc = Deno.env.get(\"TWILIO_MESSAGING_SERVICE_SID\");\n const envState = {\n TWILIO_ACCOUNT_SID: sid ? `set (starts=${sid.slice(0, 4)})` : \"MISSING\",\n TWILIO_AUTH_TOKEN: token ? `set (len=${token.length})` : \"MISSING\",\n TWILIO_FROM: from ? `set (${from})` : \"unset\",\n TWILIO_MESSAGING_SERVICE_SID: msgSvc ? `set (starts=${msgSvc.slice(0, 4)})` : \"unset\",\n };\n return { sid, token, from, msgSvc, envState };\n}\n\n// Send an SMS via the Twilio Messaging API (NOT Verify), so we control the body.\nasync function sendSmsViaTwilio(to: string, bodyText: string) {\n const { sid, token, from, msgSvc, envState } = twilioCreds();\n if (!sid || !token || (!from && !msgSvc)) {\n return {\n httpStatus: 500,\n body: {\n ok: false,\n error: \"Server missing TWILIO_* env vars (need ACCOUNT_SID, AUTH_TOKEN, and FROM or MESSAGING_SERVICE_SID)\",\n envState,\n },\n };\n }\n const params: Record = { To: to, Body: bodyText };\n if (msgSvc) params.MessagingServiceSid = msgSvc;\n else params.From = from!;\n\n const url = `https://api.twilio.com/2010-04-01/Accounts/${sid}/Messages.json`;\n let res: Response;\n try {\n res = await fetch(url, {\n method: \"POST\",\n headers: {\n \"authorization\": basicAuth(sid, token),\n \"content-type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams(params).toString(),\n });\n } catch (e) {\n return { httpStatus: 500, body: { ok: false, error: \"fetch failed\", reason: String(e), envState } };\n }\n const rawText = await res.text();\n let body: any = {};\n try { body = JSON.parse(rawText); } catch { body = { raw: rawText }; }\n return { httpStatus: res.status, body: { ...body, _debug: { upstreamStatus: res.status, envState } } };\n}\n\nasync function handleSend(req: Request): Promise {\n let parsed: SendBody;\n try { parsed = await req.json(); } catch { return json(400, { ok: false, error: \"Body must be JSON\" }); }\n const to = (parsed.to || \"\").trim();\n if (!to.startsWith(\"+\")) return json(400, { ok: false, error: \"to must be E.164 (start with +)\" });\n\n await ensureTable();\n const code = genCode();\n const expiresAt = Date.now() + CODE_TTL_MS;\n\n // Send first; only persist if Twilio accepted the message.\n const { httpStatus, body } = await sendSmsViaTwilio(to, SMS_BODY(code));\n if (httpStatus >= 400) {\n return json(httpStatus, { ok: false, error: body?.message || \"twilio error\", code: body?.code });\n }\n\n // Overwrite any prior code for this number (a resend supersedes it) and reset attempts.\n await sqlite.execute({\n sql: `INSERT OR REPLACE INTO otp_codes (phone, code, expires_at, attempts) VALUES (?, ?, ?, 0)`,\n args: [to, code, expiresAt],\n });\n\n return json(200, { ok: true, status: \"pending\", sid: body?.sid, channel: \"sms\" });\n}\n\nasync function handleVerify(req: Request): Promise {\n let parsed: VerifyBody;\n try { parsed = await req.json(); } catch { return json(400, { ok: false, error: \"Body must be JSON\" }); }\n const to = (parsed.to || \"\").trim();\n const code = (parsed.code || \"\").trim();\n if (!to.startsWith(\"+\")) return json(400, { ok: false, error: \"to must be E.164\" });\n if (!/^\\d{4,10}$/.test(code)) return json(400, { ok: false, error: \"code must be 4-10 digits\" });\n\n await ensureTable();\n const result = await sqlite.execute({\n sql: `SELECT code, expires_at, attempts FROM otp_codes WHERE phone = ?`,\n args: [to],\n });\n const row = result.rows?.[0] as { code: string; expires_at: number; attempts: number } | undefined;\n\n // No code on file -> treat as expired (mirrors the old Verify \"not found\" path).\n if (!row) return json(200, { ok: false, status: \"expired\", error: \"no code on file\" });\n\n const storedCode = String(row.code);\n const expiresAt = Number(row.expires_at);\n const attempts = Number(row.attempts);\n\n if (Date.now() > expiresAt) {\n await sqlite.execute({ sql: `DELETE FROM otp_codes WHERE phone = ?`, args: [to] });\n return json(200, { ok: false, status: \"expired\", error: \"code expired\" });\n }\n\n if (code === storedCode) {\n await sqlite.execute({ sql: `DELETE FROM otp_codes WHERE phone = ?`, args: [to] });\n return json(200, { ok: true, status: \"approved\", valid: true });\n }\n\n // Wrong code: bump attempts; after MAX_ATTEMPTS, invalidate so they must request a fresh one.\n const newAttempts = attempts + 1;\n if (newAttempts >= MAX_ATTEMPTS) {\n await sqlite.execute({ sql: `DELETE FROM otp_codes WHERE phone = ?`, args: [to] });\n return json(200, { ok: false, status: \"expired\", error: \"too many attempts\" });\n }\n await sqlite.execute({ sql: `UPDATE otp_codes SET attempts = ? WHERE phone = ?`, args: [newAttempts, to] });\n return json(200, { ok: false, status: \"wrong_code\", valid: false });\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n if (req.method === \"GET\" && url.pathname === \"/\") {\n return json(200, {\n ok: true,\n routes: [\"POST /sendOtp { to }\", \"POST /verifyOtp { to, code }\"],\n note: \"Vapi-to-Twilio Messaging OTP shim (self-managed code).\",\n });\n }\n if (req.method === \"POST\" && url.pathname === \"/sendOtp\") return handleSend(req);\n if (req.method === \"POST\" && url.pathname === \"/verifyOtp\") return handleVerify(req);\n return json(404, { ok: false, error: \"not found\" });\n}\n","createdAt",["D",1781734773536],"branchVersion","branchId","417b2e56-5b34-11f1-9787-ee650bb23af1","id","417a6214-5b34-11f1-9787-ee650bb23af1","natera-send-verify",["D",1780041542015],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","019ca0d6-7e9d-7708-aea8-6df17bfdceea","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019ca0d6-7e9d-7708-aea8-700f071be19f","tursoName","417a62145b3411f19787ee650bb23af1","tursoHostname","417a62145b3411f19787ee650bb23af1-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789504908499],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_105":101},"org",{"_98":97,"_99":-5,"_100":101,"_18":55,"_102":103,"_104":25},"branch",{"_13":87,"_32":88,"_43":42,"_89":44,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":45,"_96":97},"isOwned",15,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","veltson","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoiZGVmYXVsdCIsImlpZCI6Imluc18yTm10cGhQUklwU0tqZHNiOHNnNGd2ZjJURFUiLCJyaWQiOiJ1c2VyXzNBR2hoWFBtaWhlZUdZZlg1TnNKZ2Uwc1YyQyJ9","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":152,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":153,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":154,"_82":155,"_84":156,"_86":25},"tree",[147],"files",[147],"counts",{"_136":61,"_137":138,"_139":61,"_140":141,"_142":143},"contents",[128],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":129,"_32":28,"_30":31,"_130":-5,"_41":42,"_40":14,"_131":25,"_38":132,"_13":133,"_33":34,"_35":37,"_24":25,"_134":-5,"_27":135},"24fb2b0d-aa37-4a8d-bb80-da29367d3373","parentId","latest",["D",1781734773536],5,"label",[28],"pulls","branches",1,"forks","envVars",{"_144":133,"_146":61},"connections",{"_144":61,"_145":61},"count","unfilledCount","emptyCount",{"_43":129,"_32":28,"_30":31,"_130":-5,"_41":42,"_40":14,"_131":25,"_38":148,"_13":133,"_33":34,"_35":37,"_24":25,"_134":-5,"_149":150,"_27":151},["D",1781734773536],"children",[],[28],["D",1780041542015],["D",1789504908499],{"_98":97,"_105":101},{"_98":97,"_99":-5,"_100":101,"_18":55,"_102":103,"_104":25},{"_13":87,"_32":88,"_43":42,"_89":44,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":45,"_96":97},"ctx",{"_80":-5,"_125":190,"_191":192,"_193":194,"_195":25,"_196":25,"_197":25,"_198":123,"_199":-5,"_200":-7,"_201":-7,"_202":61,"_203":25,"_204":25,"_205":-5,"_206":25,"_207":25,"_208":25,"_209":-5},"ENV",{"_161":162,"_163":164,"_165":88,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v8