[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_103":104,"_105":106},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","JeffBaseline","name","Baseline","path","server.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":32,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/JeffBaseline/Baseline/code/server.ts","extension","id","1992401e-d7cc-4946-a3d6-70b69a44b64f","fileId","350674d2-b12e-11f1-8bab-1607ee4eb77e","parentId","branchId","d85cdbab-734e-4c44-853b-af146e21b9c3","branchVersion",21,"latest",true,"createdAt",["D",1789514413680],"version",9,"fileType","http","content","import { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport ASSETS from \"./main.ts\";\nconst { ICON_B64, SW_JS, MANIFEST, PAGE } = ASSETS;\nconst SCHEMA = [\n `create table if not exists bt_config (\nid integer primary key check (id = 1),\njson text not null\n)`,\n `create table if not exists bt_user (\nid integer primary key autoincrement,\nemail text unique not null,\nname text not null,\npass text not null,\nrole text not null default 'member',\ncreated integer not null\n)`,\n `create table if not exists bt_session (\ntoken text primary key,\nuser_id integer not null,\ncreated integer not null,\nexpires integer not null\n)`,\n `create table if not exists bt_week (\nmonday text primary key,\nreleased integer not null default 0,\nreleased_at integer,\nreleased_by integer\n)`,\n `create table if not exists bt_slot (\ndate text primary key,\ncanceled integer not null default 0,\nreason text\n)`,\n `create table if not exists bt_signup (\ndate text not null,\nuser_id integer not null,\nat integer not null,\nprimary key (date, user_id)\n)`,\n `create table if not exists bt_msg (\nid integer primary key autoincrement,\nuser_id integer not null,\ntext text not null,\nat integer not null\n)`,\n `create table if not exists bt_meta (\nk text primary key,\nv text not null\n)`,\n `create table if not exists bt_push (\nsub_id text primary key,\nuser_id integer,\nendpoint text not null,\nsub text not null,\ncreated integer not null\n)`,\n `create table if not exists bt_notif_pref (\nuser_id integer primary key,\nnotify_release integer not null default 1,\nnotify_messages integer not null default 1\n)`,\n];\nlet inited = false;\nasync function init() {\n if (inited) return;\n await sqlite.batch(SCHEMA);\n inited = true;\n}\nfunction rows(res: any): any[] {\n const cols: string[] = res.columns || [];\n return (res.rows || []).map((r: any) =>\n Array.isArray(r) ? Object.fromEntries(cols.map((c, i) => [c, r[i]])) : r\n );\n}\nfunction json(data: unknown, status = 200) {\n return new Response(JSON.stringify(data), {\n status,\n headers: {\n \"content-type\": \"application/json; charset=utf-8\",\n \"cache-control\": \"no-store\",\n },\n });\n}\nfunction jsonC(data: unknown, cookie: string | null, status = 200) {\n const h = new Headers({\n \"content-type\": \"application/json; charset=utf-8\",\n \"cache-control\": \"no-store\",\n });\n if (cookie) h.append(\"set-cookie\", cookie);\n return new Response(JSON.stringify(data), { status, headers: h });\n}\nasync function getConfig(): Promise {\n const r =\n rows(await sqlite.execute(\"select json from bt_config where id = 1\"))[0];\n return r ? JSON.parse(r.json) : null;\n}\nasync function userCount(): Promise {\n return Number(\n rows(await sqlite.execute(\"select count(*) c from bt_user\"))[0].c,\n );\n}\nfunction validTz(tz: string): boolean {\n try {\n new Intl.DateTimeFormat(\"en-US\", { timeZone: tz });\n return true;\n } catch {\n return false;\n }\n}\nfunction ymdInTz(date: Date, tz: string): string {\n const p = new Intl.DateTimeFormat(\"en-CA\", {\n timeZone: tz,\n year: \"numeric\",\n month: \"2-digit\",\n day: \"2-digit\",\n }).formatToParts(date);\n const g = (t: string) => p.find((x) => x.type === t)!.value;\n return `${g(\"year\")}-${g(\"month\")}-${g(\"day\")}`;\n}\nfunction addDays(ymd: string, n: number): string {\n const d = new Date(ymd + \"T12:00:00Z\");\n d.setUTCDate(d.getUTCDate() + n);\n return d.toISOString().slice(0, 10);\n}\nfunction dow(ymd: string): number {\n return new Date(ymd + \"T12:00:00Z\").getUTCDay();\n}\nfunction mondayOf(ymd: string): string {\n return addDays(ymd, -((dow(ymd) + 6) % 7));\n}\nfunction rangeLabel(a: string, b: string): string {\n const mon = (y: string) =>\n new Date(y + \"T12:00:00Z\").toLocaleDateString(\"en-US\", {\n month: \"short\",\n timeZone: \"UTC\",\n });\n const day = (y: string) => new Date(y + \"T12:00:00Z\").getUTCDate();\n if (a === b) return `${mon(a)} ${day(a)}`;\n return mon(a) === mon(b)\n ? `${mon(a)} ${day(a)}–${day(b)}`\n : `${mon(a)} ${day(a)} – ${mon(b)} ${day(b)}`;\n}\nconst EMAIL_RE = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\nfunction randomJoinCode(): string {\n const alphabet = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n let s = \"\";\n for (let i = 0; i < 6; i++) {\n s += alphabet[Math.floor(Math.random() * alphabet.length)];\n }\n return s;\n}\nfunction normalizeConfig(b: any): any {\n const maxPlayers = Math.max(\n 1,\n Math.min(12, Math.round(Number(b?.maxPlayers) || 4)),\n );\n let days = Array.isArray(b?.days)\n ? b.days.map(Number).filter((n: number) => n >= 0 && n <= 6)\n : [1, 2, 3, 4, 5];\n days = [...new Set(days)].sort((x, y) => x - y);\n if (!days.length) days = [1, 2, 3, 4, 5];\n const tz = validTz(String(b?.tz || \"\")) ? b.tz : \"America/Denver\";\n const joinCode = (String(b?.joinCode || \"\").trim().slice(0, 40)) ||\n randomJoinCode();\n return { maxPlayers, days, tz, joinCode };\n}\nconst b64u = {\n enc(buf: ArrayBuffer | Uint8Array): string {\n const b = buf instanceof Uint8Array ? buf : new Uint8Array(buf);\n let s = \"\";\n for (let i = 0; i < b.length; i++) s += String.fromCharCode(b[i]);\n return btoa(s).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n },\n dec(str: string): Uint8Array {\n const s = str.replace(/-/g, \"+\").replace(/_/g, \"/\") +\n \"===\".slice((str.length + 3) % 4);\n const bin = atob(s);\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n },\n};\nfunction cat(...arrs: Uint8Array[]): Uint8Array {\n let len = 0;\n for (const a of arrs) len += a.length;\n const out = new Uint8Array(len);\n let o = 0;\n for (const a of arrs) {\n out.set(a, o);\n o += a.length;\n }\n return out;\n}\nasync function hmac(key: Uint8Array, data: Uint8Array): Promise {\n const k = await crypto.subtle.importKey(\n \"raw\",\n key,\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n return new Uint8Array(await crypto.subtle.sign(\"HMAC\", k, data));\n}\nasync function sha256hex(s: string): Promise {\n const d = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(d)].map((x) => x.toString(16).padStart(2, \"0\"))\n .join(\"\");\n}\nasync function ensureVapid(): Promise<{ pub: any; priv: any; rawPub: string }> {\n const row =\n rows(await sqlite.execute(\"select v from bt_meta where k = 'vapid'\"))[0];\n if (row) return JSON.parse(row.v);\n const kp = (await crypto.subtle.generateKey(\n { name: \"ECDSA\", namedCurve: \"P-256\" },\n true,\n [\"sign\", \"verify\"],\n )) as CryptoKeyPair;\n const pub = await crypto.subtle.exportKey(\"jwk\", kp.publicKey);\n const priv = await crypto.subtle.exportKey(\"jwk\", kp.privateKey);\n const rawPub = b64u.enc(\n cat(new Uint8Array([4]), b64u.dec(pub.x!), b64u.dec(pub.y!)),\n );\n const val = { pub, priv, rawPub };\n await sqlite.execute({\n sql:\n \"insert into bt_meta (k, v) values ('vapid', ?) on conflict(k) do nothing\",\n args: [JSON.stringify(val)],\n });\n const again =\n rows(await sqlite.execute(\"select v from bt_meta where k = 'vapid'\"))[0];\n return JSON.parse(again.v);\n}\nasync function vapidHeader(\n endpoint: string,\n vapid: any,\n subject: string,\n): Promise {\n const aud = new URL(endpoint).origin;\n const enc = (o: unknown) =>\n b64u.enc(new TextEncoder().encode(JSON.stringify(o)));\n const head = enc({ typ: \"JWT\", alg: \"ES256\" });\n const body = enc({\n aud,\n exp: Math.floor(Date.now() / 1000) + 12 * 3600,\n sub: subject,\n });\n const signingInput = new TextEncoder().encode(head + \".\" + body);\n const key = await crypto.subtle.importKey(\n \"jwk\",\n vapid.priv,\n { name: \"ECDSA\", namedCurve: \"P-256\" },\n false,\n [\"sign\"],\n );\n const sig = new Uint8Array(\n await crypto.subtle.sign(\n { name: \"ECDSA\", hash: \"SHA-256\" },\n key,\n signingInput,\n ),\n );\n const jwt = head + \".\" + body + \".\" + b64u.enc(sig);\n return `vapid t=${jwt}, k=${vapid.rawPub}`;\n}\nasync function pushOne(\n sub: any,\n message: string,\n vapid: any,\n subject: string,\n): Promise {\n const uaPublic = b64u.dec(sub.keys.p256dh);\n const authSecret = b64u.dec(sub.keys.auth);\n const asKp = (await crypto.subtle.generateKey(\n { name: \"ECDH\", namedCurve: \"P-256\" },\n true,\n [\"deriveBits\"],\n )) as CryptoKeyPair;\n const asPublic = new Uint8Array(\n await crypto.subtle.exportKey(\"raw\", asKp.publicKey),\n );\n const uaKey = await crypto.subtle.importKey(\n \"raw\",\n uaPublic,\n { name: \"ECDH\", namedCurve: \"P-256\" },\n false,\n [],\n );\n const ecdh = new Uint8Array(\n await crypto.subtle.deriveBits(\n { name: \"ECDH\", public: uaKey },\n asKp.privateKey,\n 256,\n ),\n );\n const salt = crypto.getRandomValues(new Uint8Array(16));\n const te = (s: string) => new TextEncoder().encode(s);\n const prkKey = await hmac(authSecret, ecdh);\n const keyInfo = cat(\n te(\"WebPush: info\\0\"),\n uaPublic,\n asPublic,\n new Uint8Array([1]),\n );\n const ikm = (await hmac(prkKey, keyInfo)).slice(0, 32);\n const prk = await hmac(salt, ikm);\n const cek =\n (await hmac(\n prk,\n cat(te(\"Content-Encoding: aes128gcm\\0\"), new Uint8Array([1])),\n )).slice(0, 16);\n const nonce =\n (await hmac(prk, cat(te(\"Content-Encoding: nonce\\0\"), new Uint8Array([1]))))\n .slice(0, 12);\n const plaintext = cat(te(message), new Uint8Array([2]));\n const aesKey = await crypto.subtle.importKey(\n \"raw\",\n cek,\n { name: \"AES-GCM\" },\n false,\n [\"encrypt\"],\n );\n const ciphertext = new Uint8Array(\n await crypto.subtle.encrypt(\n { name: \"AES-GCM\", iv: nonce, tagLength: 128 },\n aesKey,\n plaintext,\n ),\n );\n const rs = 4096;\n const header = cat(\n salt,\n new Uint8Array([\n (rs >>> 24) & 255,\n (rs >>> 16) & 255,\n (rs >>> 8) & 255,\n rs & 255,\n ]),\n new Uint8Array([asPublic.length]),\n asPublic,\n );\n const res = await fetch(sub.endpoint, {\n method: \"POST\",\n headers: {\n TTL: \"86400\",\n \"Content-Encoding\": \"aes128gcm\",\n \"Content-Type\": \"application/octet-stream\",\n Authorization: await vapidHeader(sub.endpoint, vapid, subject),\n },\n body: cat(header, ciphertext),\n });\n return res.status;\n}\nasync function notifyAll(\n title: string,\n body: string,\n url: string,\n tag: string,\n category: \"release\" | \"messages\",\n excludeUserId?: number,\n): Promise {\n const col = category === \"messages\" ? \"notify_messages\" : \"notify_release\";\n const args: any[] = [];\n let sql = `select p.sub_id, p.sub from bt_push p\nleft join bt_notif_pref np on np.user_id = p.user_id\nwhere coalesce(np.${col}, 1) = 1`;\n if (excludeUserId) {\n sql += \" and p.user_id != ?\";\n args.push(excludeUserId);\n }\n const subs = rows(await sqlite.execute({ sql, args }));\n if (!subs.length) return 0;\n const vapid = await ensureVapid();\n const subject = \"mailto:tennis@example.com\";\n const message = JSON.stringify({ title, body, url, tag });\n let ok = 0;\n await Promise.all(\n subs.map(async (r) => {\n try {\n const status = await pushOne(\n JSON.parse(r.sub),\n message,\n vapid,\n subject,\n );\n if (status >= 200 && status < 300) ok++;\n else if (status === 404 || status === 410) {\n await sqlite.execute({\n sql: \"delete from bt_push where sub_id = ?\",\n args: [r.sub_id],\n });\n }\n } catch (_e) { /* one bad subscriber shouldn't sink the batch */ }\n }),\n );\n return ok;\n}\nasync function pbkdf2(\n pw: string,\n salt: Uint8Array,\n iterations: number,\n): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(pw),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt, iterations, hash: \"SHA-256\" },\n key,\n 256,\n );\n return new Uint8Array(bits);\n}\nasync function hashPw(pw: string): Promise {\n const salt = crypto.getRandomValues(new Uint8Array(16));\n const iterations = 100000;\n const h = await pbkdf2(pw, salt, iterations);\n return \"pbkdf2$\" + iterations + \"$\" + b64u.enc(salt) + \"$\" + b64u.enc(h);\n}\nasync function verifyPw(pw: string, stored: string): Promise {\n const parts = String(stored || \"\").split(\"$\");\n if (parts.length !== 4 || parts[0] !== \"pbkdf2\") return false;\n const iterations = parseInt(parts[1], 10) || 100000;\n const salt = b64u.dec(parts[2]);\n const want = b64u.dec(parts[3]);\n const got = await pbkdf2(pw, salt, iterations);\n if (got.length !== want.length) return false;\n let diff = 0;\n for (let i = 0; i < got.length; i++) diff |= got[i] ^ want[i];\n return diff === 0;\n}\nfunction getCookie(req: Request, name: string): string | null {\n const raw = req.headers.get(\"cookie\");\n if (!raw) return null;\n const m = raw.match(new RegExp(\"(?:^|;\\\\s*)\" + name + \"=([^;]*)\"));\n return m ? decodeURIComponent(m[1]) : null;\n}\nconst SESSION_MS = 90 * 24 * 3600 * 1000;\nfunction sessCookie(token: string, maxAgeSec: number): string {\n return `bt_sess=${token}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAgeSec}`;\n}\nasync function makeSession(userId: number): Promise {\n const token = b64u.enc(crypto.getRandomValues(new Uint8Array(32)));\n const now = Date.now();\n await sqlite.execute({\n sql: \"delete from bt_session where expires < ?\",\n args: [now],\n });\n await sqlite.execute({\n sql:\n \"insert into bt_session (token, user_id, created, expires) values (?, ?, ?, ?)\",\n args: [token, userId, now, now + SESSION_MS],\n });\n return token;\n}\nasync function currentUser(req: Request): Promise {\n const token = getCookie(req, \"bt_sess\");\n if (!token) return null;\n const s = rows(\n await sqlite.execute({\n sql: \"select user_id, expires from bt_session where token = ?\",\n args: [token],\n }),\n )[0];\n if (!s || Number(s.expires) < Date.now()) return null;\n const u = rows(\n await sqlite.execute({\n sql: \"select id, email, name, role from bt_user where id = ?\",\n args: [s.user_id],\n }),\n )[0];\n return u || null;\n}\nasync function adminCount(): Promise {\n return Number(\n rows(\n await sqlite.execute(\n \"select count(*) c from bt_user where role = 'admin'\",\n ),\n )[0].c,\n );\n}\nasync function apiSetup(b: any) {\n if ((await userCount()) > 0) return json({ error: \"already_setup\" }, 409);\n const email = String(b?.email || \"\").trim().toLowerCase();\n const name = String(b?.name || \"\").trim();\n const pw = String(b?.password || \"\");\n if (!EMAIL_RE.test(email)) return json({ error: \"bad_email\" }, 400);\n if (name.length < 1 || name.length > 40) {\n return json({ error: \"bad_name\" }, 400);\n }\n if (pw.length < 8) return json({ error: \"weak_password\" }, 400);\n const cfg = normalizeConfig(b);\n await sqlite.execute({\n sql:\n \"insert into bt_config (id, json) values (1, ?) on conflict(id) do update set json = excluded.json\",\n args: [JSON.stringify(cfg)],\n });\n const r = await sqlite.execute({\n sql:\n \"insert into bt_user (email, name, pass, role, created) values (?, ?, ?, 'admin', ?)\",\n args: [email, name, await hashPw(pw), Date.now()],\n });\n const token = await makeSession(Number(r.lastInsertRowid));\n return jsonC({ ok: true }, sessCookie(token, SESSION_MS / 1000));\n}\nasync function apiRegister(b: any) {\n const cfg = await getConfig();\n if (!cfg) return json({ error: \"not_setup\" }, 400);\n const email = String(b?.email || \"\").trim().toLowerCase();\n const name = String(b?.name || \"\").trim();\n const pw = String(b?.password || \"\");\n const code = String(b?.joinCode || \"\").trim();\n if (!code || code.toLowerCase() !== String(cfg.joinCode).toLowerCase()) {\n return json({ error: \"bad_join_code\" }, 403);\n }\n if (!EMAIL_RE.test(email)) return json({ error: \"bad_email\" }, 400);\n if (name.length < 1 || name.length > 40) {\n return json({ error: \"bad_name\" }, 400);\n }\n if (pw.length < 8) return json({ error: \"weak_password\" }, 400);\n const exists = rows(\n await sqlite.execute({\n sql: \"select 1 from bt_user where email = ?\",\n args: [email],\n }),\n )[0];\n if (exists) return json({ error: \"email_taken\" }, 409);\n const r = await sqlite.execute({\n sql:\n \"insert into bt_user (email, name, pass, role, created) values (?, ?, ?, 'member', ?)\",\n args: [email, name, await hashPw(pw), Date.now()],\n });\n const token = await makeSession(Number(r.lastInsertRowid));\n return jsonC({ ok: true }, sessCookie(token, SESSION_MS / 1000));\n}\nasync function apiLogin(b: any) {\n const email = String(b?.email || \"\").trim().toLowerCase();\n const pw = String(b?.password || \"\");\n const u = rows(\n await sqlite.execute({\n sql: \"select id, pass from bt_user where email = ?\",\n args: [email],\n }),\n )[0];\n if (!u || !(await verifyPw(pw, u.pass))) {\n return json({ error: \"bad_login\" }, 401);\n }\n const token = await makeSession(Number(u.id));\n return jsonC({ ok: true }, sessCookie(token, SESSION_MS / 1000));\n}\nasync function apiLogout(req: Request) {\n const token = getCookie(req, \"bt_sess\");\n if (token) {\n await sqlite.execute({\n sql: \"delete from bt_session where token = ?\",\n args: [token],\n });\n }\n return jsonC(\n { ok: true },\n \"bt_sess=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0\",\n );\n}\nasync function apiMe(user: any, b: any) {\n const name = typeof b?.name === \"string\" ? b.name.trim() : null;\n const pw = typeof b?.password === \"string\" && b.password ? b.password : null;\n if (name != null) {\n if (name.length < 1 || name.length > 40) {\n return json({ error: \"bad_name\" }, 400);\n }\n await sqlite.execute({\n sql: \"update bt_user set name = ? where id = ?\",\n args: [name, user.id],\n });\n }\n if (pw != null) {\n if (pw.length < 8) return json({ error: \"weak_password\" }, 400);\n await sqlite.execute({\n sql: \"update bt_user set pass = ? where id = ?\",\n args: [await hashPw(pw), user.id],\n });\n }\n return json({ ok: true });\n}\nasync function apiUsers(user: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n return json({\n users: rows(\n await sqlite.execute(\n \"select id, email, name, role, created from bt_user order by created asc\",\n ),\n ),\n });\n}\nasync function apiUserRole(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const id = Number(b?.userId);\n const role = b?.role === \"admin\" ? \"admin\" : \"member\";\n if (!id) return json({ error: \"bad_request\" }, 400);\n const target =\n rows(\n await sqlite.execute({\n sql: \"select role from bt_user where id = ?\",\n args: [id],\n }),\n )[0];\n if (role === \"member\" && target && target.role === \"admin\") {\n return json({ error: \"admin_locked\" }, 409);\n }\n await sqlite.execute({\n sql: \"update bt_user set role = ? where id = ?\",\n args: [role, id],\n });\n return json({ ok: true });\n}\nasync function apiUserRemove(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const id = Number(b?.userId);\n if (!id) return json({ error: \"bad_request\" }, 400);\n if (id === user.id) return json({ error: \"self\" }, 409);\n const target =\n rows(\n await sqlite.execute({\n sql: \"select role from bt_user where id = ?\",\n args: [id],\n }),\n )[0];\n if (target && target.role === \"admin\" && (await adminCount()) <= 1) {\n return json({ error: \"last_admin\" }, 409);\n }\n await sqlite.batch([\n { sql: \"delete from bt_user where id = ?\", args: [id] },\n { sql: \"delete from bt_session where user_id = ?\", args: [id] },\n { sql: \"delete from bt_signup where user_id = ?\", args: [id] },\n { sql: \"delete from bt_push where user_id = ?\", args: [id] },\n { sql: \"delete from bt_notif_pref where user_id = ?\", args: [id] },\n ]);\n return json({ ok: true });\n}\nasync function apiUserResetPw(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const id = Number(b?.userId);\n const pw = String(b?.password || \"\");\n if (!id || pw.length < 8) return json({ error: \"bad_request\" }, 400);\n await sqlite.execute({\n sql: \"update bt_user set pass = ? where id = ?\",\n args: [await hashPw(pw), id],\n });\n await sqlite.execute({\n sql: \"delete from bt_session where user_id = ?\",\n args: [id],\n });\n return json({ ok: true });\n}\nasync function apiConfig(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const cur = await getConfig();\n // A partial update (e.g. just a new join code) must not silently reset the\n // fields the caller didn't send -- fall back to the current value for each.\n const cfg = normalizeConfig({\n maxPlayers: b?.maxPlayers ?? cur?.maxPlayers,\n days: b?.days ?? cur?.days,\n tz: b?.tz ?? cur?.tz,\n joinCode: b?.joinCode ?? cur?.joinCode,\n });\n await sqlite.execute({\n sql: \"update bt_config set json = ? where id = 1\",\n args: [JSON.stringify(cfg)],\n });\n return json({ ok: true });\n}\nasync function apiNotifPrefs(user: any, b: any) {\n await sqlite.execute({\n sql:\n `insert into bt_notif_pref (user_id, notify_release, notify_messages) values (?, ?, ?)\non conflict(user_id) do update set notify_release = excluded.notify_release, notify_messages = excluded.notify_messages`,\n args: [user.id, b?.release ? 1 : 0, b?.messages ? 1 : 0],\n });\n return json({ ok: true });\n}\nasync function buildState(user: any) {\n const cfg = await getConfig();\n const isAdmin = user.role === \"admin\";\n const npRow = rows(\n await sqlite.execute({\n sql:\n \"select notify_release, notify_messages from bt_notif_pref where user_id = ?\",\n args: [user.id],\n }),\n )[0];\n const notifPrefs = {\n release: npRow ? !!npRow.notify_release : true,\n messages: npRow ? !!npRow.notify_messages : true,\n };\n const today = ymdInTz(new Date(), cfg.tz);\n const monday0 = mondayOf(today);\n const relRows = rows(\n await sqlite.execute(\"select monday, released from bt_week\"),\n );\n const relSet = new Set(\n relRows.filter((r) => r.released).map((r) => r.monday),\n );\n const LABELS = [\"This week\", \"Next week\", \"In 2 weeks\"];\n const weeksMeta: {\n label: string;\n monday: string;\n released: boolean;\n dates: string[];\n }[] = [];\n for (let w = 0; w < LABELS.length; w++) {\n const monday = addDays(monday0, w * 7);\n const released = relSet.has(monday);\n if (!isAdmin && !released) continue;\n const dates: string[] = [];\n for (let i = 0; i < 7; i++) {\n const d = addDays(monday, i);\n if (cfg.days.includes(dow(d))) dates.push(d);\n }\n weeksMeta.push({ label: LABELS[w], monday, released, dates });\n }\n const wantDates: string[] = [];\n for (const w of weeksMeta) wantDates.push(...w.dates);\n let signups: any[] = [];\n let slots: any[] = [];\n if (wantDates.length) {\n const ph = wantDates.map(() => \"?\").join(\",\");\n signups = rows(\n await sqlite.execute({\n sql: `select s.date, s.user_id, s.at, u.name\nfrom bt_signup s join bt_user u on u.id = s.user_id\nwhere s.date in (${ph}) order by s.at asc`,\n args: wantDates,\n }),\n );\n slots = rows(\n await sqlite.execute({\n sql: `select date, canceled, reason from bt_slot where date in (${ph})`,\n args: wantDates,\n }),\n );\n }\n const slotBy: Record = {};\n for (const s of slots) slotBy[s.date] = s;\n const suBy: Record = {};\n for (const r of signups) {\n (suBy[r.date] = suBy[r.date] || []).push({\n userId: r.user_id,\n name: r.name,\n at: r.at,\n });\n }\n const chatLatest = Number(\n rows(await sqlite.execute(\"select max(at) m from bt_msg\"))[0]?.m || 0,\n );\n return {\n me: {\n id: user.id,\n name: user.name,\n email: user.email,\n role: user.role,\n notifPrefs,\n },\n chatLatest,\n config: isAdmin\n ? {\n maxPlayers: cfg.maxPlayers,\n days: cfg.days,\n tz: cfg.tz,\n joinCode: cfg.joinCode,\n }\n : { maxPlayers: cfg.maxPlayers },\n weeks: weeksMeta.map((w) => ({\n key: w.label,\n monday: w.monday,\n released: w.released,\n range: w.dates.length\n ? rangeLabel(w.dates[0], w.dates[w.dates.length - 1])\n : \"\",\n slots: w.dates.map((d) => {\n const sl = slotBy[d] || {};\n return {\n date: d,\n canceled: !!sl.canceled,\n reason: sl.reason || null,\n past: d < today,\n players: suBy[d] || [],\n };\n }),\n })),\n };\n}\nasync function apiClaim(user: any, b: any) {\n const cfg = await getConfig();\n const date = b?.date;\n if (typeof date !== \"string\") return json({ error: \"bad_request\" }, 400);\n if (date < ymdInTz(new Date(), cfg.tz)) return json({ error: \"past\" }, 409);\n let targetId = user.id;\n if (b?.userId != null && Number(b.userId) !== user.id) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n targetId = Number(b.userId);\n const exists = rows(\n await sqlite.execute({\n sql: \"select 1 from bt_user where id = ?\",\n args: [targetId],\n }),\n )[0];\n if (!exists) return json({ error: \"bad_request\" }, 400);\n }\n const wk = rows(\n await sqlite.execute({\n sql: \"select released from bt_week where monday = ?\",\n args: [mondayOf(date)],\n }),\n )[0];\n const released = !!(wk && wk.released);\n if (!released && user.role !== \"admin\") return json({ error: \"hidden\" }, 403);\n const sl = rows(\n await sqlite.execute({\n sql: \"select canceled from bt_slot where date = ?\",\n args: [date],\n }),\n )[0];\n if (sl && sl.canceled) return json({ error: \"canceled\" }, 409);\n const res = await sqlite.execute({\n sql: `insert into bt_signup (date, user_id, at)\nselect ?, ?, ?\nwhere (select count(*) from bt_signup where date = ?) < ?\nand not exists (select 1 from bt_signup where date = ? and user_id = ?)`,\n args: [date, targetId, Date.now(), date, cfg.maxPlayers, date, targetId],\n });\n if (!res.rowsAffected) {\n const already = rows(\n await sqlite.execute({\n sql: \"select 1 from bt_signup where date = ? and user_id = ?\",\n args: [date, targetId],\n }),\n )[0];\n return already ? json({ ok: true }) : json({ error: \"full\" }, 409);\n }\n return json({ ok: true });\n}\nasync function apiRelease(user: any, b: any) {\n const date = b?.date;\n if (typeof date !== \"string\") return json({ error: \"bad_request\" }, 400);\n let targetId = user.id;\n if (b?.userId != null && Number(b.userId) !== user.id) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n targetId = Number(b.userId);\n }\n const del = await sqlite.execute({\n sql: \"delete from bt_signup where date = ? and user_id = ?\",\n args: [date, targetId],\n });\n return json({ ok: !!del.rowsAffected });\n}\nasync function apiReleaseWeek(user: any, b: any, unrelease: boolean) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const monday = b?.monday;\n if (typeof monday !== \"string\") return json({ error: \"bad_request\" }, 400);\n await sqlite.execute({\n sql:\n `insert into bt_week (monday, released, released_at, released_by) values (?, ?, ?, ?)\non conflict(monday) do update set\nreleased = excluded.released,\nreleased_at = excluded.released_at,\nreleased_by = excluded.released_by`,\n args: [monday, unrelease ? 0 : 1, Date.now(), user.id],\n });\n let sent = 0;\n if (!unrelease) {\n const cfg = await getConfig();\n const ds: string[] = [];\n for (let i = 0; i < 7; i++) {\n const d = addDays(monday, i);\n if (cfg.days.includes(dow(d))) ds.push(d);\n }\n const label = ds.length ? rangeLabel(ds[0], ds[ds.length - 1]) : monday;\n try {\n sent = await notifyAll(\n \"🎾 Schedule is open\",\n `${label} — pick your days`,\n \"/\",\n \"wk-\" + monday,\n \"release\",\n );\n } catch (_e) { /* releasing still succeeds */ }\n }\n return json({ ok: true, sent });\n}\nasync function apiCancel(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const date = b?.date;\n if (typeof date !== \"string\") return json({ error: \"bad_request\" }, 400);\n if (b?.canceled) {\n await sqlite.execute({\n sql: `insert into bt_slot (date, canceled, reason) values (?, 1, ?)\non conflict(date) do update set canceled = 1, reason = excluded.reason`,\n args: [date, String(b?.reason || \"\").slice(0, 140)],\n });\n await sqlite.execute({\n sql: \"delete from bt_signup where date = ?\",\n args: [date],\n });\n } else {\n await sqlite.execute({\n sql: \"update bt_slot set canceled = 0, reason = null where date = ?\",\n args: [date],\n });\n }\n return json({ ok: true });\n}\nasync function apiClearDay(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n if (typeof b?.date !== \"string\") return json({ error: \"bad_request\" }, 400);\n await sqlite.execute({\n sql: \"delete from bt_signup where date = ?\",\n args: [b.date],\n });\n return json({ ok: true });\n}\nasync function apiNotify(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const monday = b?.monday;\n if (typeof monday !== \"string\") return json({ error: \"bad_request\" }, 400);\n const cfg = await getConfig();\n const ds: string[] = [];\n for (let i = 0; i < 7; i++) {\n const d = addDays(monday, i);\n if (cfg.days.includes(dow(d))) ds.push(d);\n }\n if (!ds.length) return json({ ok: true, sent: 0 });\n const ph = ds.map(() => \"?\").join(\",\");\n const counts = rows(\n await sqlite.execute({\n sql:\n `select date, count(*) c from bt_signup where date in (${ph}) group by date`,\n args: ds,\n }),\n );\n const canceled = new Set(\n rows(\n await sqlite.execute({\n sql: `select date from bt_slot where date in (${ph}) and canceled = 1`,\n args: ds,\n }),\n ).map((r) => r.date),\n );\n const cmap: Record = {};\n for (const r of counts) cmap[r.date] = Number(r.c);\n let open = 0;\n for (const d of ds) {\n if (canceled.has(d)) continue;\n open += Math.max(0, cfg.maxPlayers - (cmap[d] || 0));\n }\n const label = rangeLabel(ds[0], ds[ds.length - 1]);\n const detail = open > 0\n ? `${label} — ${open} spot${open === 1 ? \"\" : \"s\"} still open`\n : `${label} — all full`;\n const sent = await notifyAll(\n \"🎾 Tennis sign-up\",\n detail,\n \"/\",\n \"wk-\" + monday,\n \"release\",\n );\n return json({ ok: true, sent });\n}\nasync function apiReset(user: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n await sqlite.batch([\n \"delete from bt_signup\",\n \"delete from bt_slot\",\n \"delete from bt_week\",\n ]);\n return json({ ok: true });\n}\nasync function apiChatGet(url: URL) {\n const since = Number(url.searchParams.get(\"since\") || 0);\n const msgs = since\n ? rows(\n await sqlite.execute({\n sql:\n `select m.id, m.text, m.at, u.name from bt_msg m join bt_user u on u.id = m.user_id\nwhere m.at > ? order by m.at asc limit 200`,\n args: [since],\n }),\n )\n : rows(\n await sqlite.execute(\n `select m.id, m.text, m.at, u.name from bt_msg m join bt_user u on u.id = m.user_id\norder by m.id desc limit 80`,\n ),\n ).reverse();\n return json({ messages: msgs });\n}\nasync function apiChatPost(user: any, b: any) {\n const text = String(b?.text || \"\").trim().slice(0, 800);\n if (!text) return json({ error: \"bad_request\" }, 400);\n const at = Date.now();\n await sqlite.execute({\n sql: \"insert into bt_msg (user_id, text, at) values (?, ?, ?)\",\n args: [user.id, text, at],\n });\n await sqlite.execute(\n \"delete from bt_msg where id not in (select id from bt_msg order by id desc limit 300)\",\n );\n try {\n await notifyAll(\n \" \",\n `${user.name}: ${text.slice(0, 140)}`,\n \"/\",\n \"chat\",\n \"messages\",\n user.id,\n );\n } catch (_e) { /* chat post still succeeds even if push fails */ }\n return json({ ok: true, at });\n}\nasync function apiPushSubscribe(user: any, b: any) {\n const sub = b?.sub;\n if (!sub || typeof sub.endpoint !== \"string\" || !sub.keys) {\n return json({ error: \"bad_request\" }, 400);\n }\n const id = await sha256hex(sub.endpoint);\n await sqlite.execute({\n sql:\n `insert into bt_push (sub_id, user_id, endpoint, sub, created) values (?, ?, ?, ?, ?)\non conflict(sub_id) do update set user_id = excluded.user_id, sub = excluded.sub`,\n args: [id, user.id, sub.endpoint, JSON.stringify(sub), Date.now()],\n });\n return json({ ok: true });\n}\nasync function apiPushUnsubscribe(b: any) {\n if (typeof b?.endpoint === \"string\") {\n await sqlite.execute({\n sql: \"delete from bt_push where endpoint = ?\",\n args: [b.endpoint],\n });\n }\n return json({ ok: true });\n}\nexport default async function handler(req: Request): Promise {\n await init();\n const url = new URL(req.url);\n const p = url.pathname;\n const GET = req.method === \"GET\";\n const POST = req.method === \"POST\";\n try {\n if (GET && (p === \"/\" || p === \"/index.html\")) {\n return new Response(PAGE, {\n headers: {\n \"content-type\": \"text/html; charset=utf-8\",\n \"cache-control\": \"no-store\",\n },\n });\n }\n if (GET && p === \"/sw.js\") {\n return new Response(SW_JS, {\n headers: {\n \"content-type\": \"text/javascript; charset=utf-8\",\n \"cache-control\": \"no-cache\",\n },\n });\n }\n if (GET && p === \"/manifest.webmanifest\") {\n return new Response(MANIFEST, {\n headers: { \"content-type\": \"application/manifest+json; charset=utf-8\" },\n });\n }\n if (GET && p === \"/icon-192.png\") {\n return new Response(b64u.dec(ICON_B64), {\n headers: {\n \"content-type\": \"image/png\",\n \"cache-control\": \"public, max-age=86400\",\n },\n });\n }\n const user = await currentUser(req);\n if (GET && p === \"/api/state\") {\n if ((await userCount()) === 0) return json({ needsSetup: true });\n if (!user) return json({ needsAuth: true });\n return json(await buildState(user));\n }\n if (GET && p === \"/api/vapid\") {\n const v = await ensureVapid();\n return json({ key: v.rawPub });\n }\n if (GET && p === \"/api/chat\") {\n if (!user) return json({ error: \"unauth\" }, 401);\n return await apiChatGet(url);\n }\n if (GET && p === \"/api/users\") {\n if (!user) return json({ error: \"unauth\" }, 401);\n return await apiUsers(user);\n }\n if (POST) {\n const b = await req.json().catch(() => ({}));\n if (p === \"/api/setup\") return await apiSetup(b);\n if (p === \"/api/register\") return await apiRegister(b);\n if (p === \"/api/login\") return await apiLogin(b);\n if (p === \"/api/logout\") return await apiLogout(req);\n if (!user) return json({ error: \"unauth\" }, 401);\n if (p === \"/api/me\") return await apiMe(user, b);\n if (p === \"/api/claim\") return await apiClaim(user, b);\n if (p === \"/api/release-spot\") return await apiRelease(user, b);\n if (p === \"/api/release-week\") {\n return await apiReleaseWeek(user, b, false);\n }\n if (p === \"/api/hide-week\") return await apiReleaseWeek(user, b, true);\n if (p === \"/api/cancel\") return await apiCancel(user, b);\n if (p === \"/api/clear-day\") return await apiClearDay(user, b);\n if (p === \"/api/notify\") return await apiNotify(user, b);\n if (p === \"/api/reset\") return await apiReset(user);\n if (p === \"/api/chat\") return await apiChatPost(user, b);\n if (p === \"/api/push/subscribe\") return await apiPushSubscribe(user, b);\n if (p === \"/api/push/unsubscribe\") return await apiPushUnsubscribe(b);\n if (p === \"/api/notif-prefs\") return await apiNotifPrefs(user, b);\n if (p === \"/api/config\") return await apiConfig(user, b);\n if (p === \"/api/user/role\") return await apiUserRole(user, b);\n if (p === \"/api/user/remove\") return await apiUserRemove(user, b);\n if (p === \"/api/user/reset-password\") {\n return await apiUserResetPw(user, b);\n }\n }\n return new Response(\"Not found\", { status: 404 });\n } catch (err) {\n console.error(err);\n return json({ error: \"server_error\", detail: String(err) }, 500);\n }\n}","deleted",false,"label",[14],"1e5c183b-a484-42d1-96f0-48e9966cd71e",["D",1789494372870],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Baseline schedule app","imageUrl","userId","5ccbc412-dad5-431e-aec9-5b3f1a540f4a","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0881e-fc61-7031-85a5-60a2073a1d18","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_102":98},"org",{"_9":10,"_95":96,"_97":98,"_55":56,"_99":100,"_101":42},"branch",{"_35":85,"_11":86,"_22":28,"_87":45,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":12,"_94":10},"isOwned",22,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","jeffyo100","avatar","https://avatars.githubusercontent.com/u/326585370?v=4","tier","free","canRestrictVals","profileImageUrl","ctx",{"_78":-5,"_136":137,"_138":139,"_140":141,"_142":42,"_143":42,"_144":42,"_145":32,"_146":-5,"_147":-7,"_148":-7,"_149":62,"_150":42,"_151":42,"_152":-5,"_153":42,"_154":42,"_155":42,"_156":-5},"ENV",{"_107":108,"_109":110,"_111":86,"_112":113,"_114":115,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]