[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_103":104,"_105":106},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","chotchkies","name","guildcalendar","path","store.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":-5,"_53":-5,"_54":55,"_56":57,"_58":32,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/chotchkies/guildcalendar/code/store.ts","extension","id","7742d344-7ef6-4cb2-adbf-7cc4bf41e552","fileId","df88630e-a9de-11f1-85b6-1607ee4eb77e","parentId","branchId","d824da79-12b4-4503-842c-a4bddb5df6f2","branchVersion",20,"latest",true,"createdAt",["D",1788882912455],"version",3,"fileType","script","content","// Storage for the two things concurrent HTTP requests mutate.\n//\n// The scraped events snapshot stays in blob storage on purpose: cron.ts is its\n// only writer and it replaces the whole document every time, which is exactly\n// what an object store is good at. The taken-list and the SEQUENCE map are a\n// different problem. Both were read-whole, modified in memory and written back,\n// and an object store has no atomic update and no transaction — so two HTTP\n// requests that overlap silently discard one of the two writes. That happened\n// in production: a click was overwritten by a later write, and a key that had\n// been removed came back. It is a property of the primitive, not an ordering\n// bug, so those two moved here. A hide is one INSERT, an unhide is one DELETE,\n// and a sequence bump is one UPSERT — no read-modify-write anywhere.\n//\n// Account-scoped sqlite, not val-scoped (`.../sqlite/main.ts`), for one\n// reason: cron.ts and http.ts must see the same rows, and account scope is\n// true whether those two files are one val or two. It is also the same scope\n// the blob store already has, so nothing about who-can-see-what changes. The\n// docs call account scope legacy but promise it keeps working; switching to\n// val scope later is the single import line below plus nothing else, because\n// row decoding is shape-agnostic (see `col`).\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport type { Fullness } from \"./parse.ts\";\n\n// Namespaced: the account-scoped database is shared with every other val on\n// the account, so \"taken\" or \"sequences\" would be a collision waiting to\n// happen.\nconst TAKEN = \"guild_taken\";\nconst SEQ = \"guild_sequences\";\nconst META = \"guild_meta\";\nconst FIRST_SEEN = \"guild_first_seen\";\nconst SESSIONS = \"guild_sessions\";\n\n/**\n * The whole point of the migration, spelled out so it cannot drift: hiding a\n * class touches one row and reads nothing first, so two overlapping requests\n * cannot lose one another. OR IGNORE makes a double-submit a no-op rather than\n * an error.\n */\nexport const HIDE_SQL = `INSERT OR IGNORE INTO ${TAKEN} (course_key) VALUES (?)`;\nexport const UNHIDE_SQL = `DELETE FROM ${TAKEN} WHERE course_key = ?`;\n\n/**\n * Account-scoped sqlite returns each row as an array; val-scoped returns an\n * object keyed by column name. Reading both means the import at the top of\n * this file can change without turning every column read into a silent\n * `undefined`.\n */\nexport function col(row: unknown, name: string, index: number): unknown {\n return Array.isArray(row) ? row[index] : (row as Record)[name];\n}\n\n/**\n * Turso can hand integers back as BigInt depending on client config, and both\n * a BigInt and a numeric string coerce cleanly. Anything that does not is a\n * row shape `col` did not understand — a libsql protocol wrapper such as\n * `{type:\"integer\",value:\"4\"}` coerces to NaN. Defaulting to 0 there would map\n * every uid to zero, look like a successful read, and publish `SEQUENCE:0` on\n * every event in /all.ics, which is not a missing update but a poisoned one:\n * subscribers that already hold a higher number ignore every future change.\n * Throwing hands http.ts the 503 it already has for an unreadable store.\n */\nexport function int(v: unknown): number {\n const n = Number(v);\n if (!Number.isFinite(n)) {\n throw new Error(`sequence store returned a non-numeric value (${typeof v})`);\n }\n return n;\n}\n\n/**\n * The same failure one table over, and a worse one, because it cannot even\n * fail loudly on its own: `String(row)` on a shape `col` did not understand\n * yields \"[object Object]\" or \"undefined\", which matches no course key, so\n * /new.ics answers 200 with every hidden class restored and looks exactly like\n * a correct feed. A key that is not a non-empty string is not a key. Exported\n * so the check is testable without a database.\n */\nexport function courseKeyOf(row: unknown): string {\n const v = col(row, \"course_key\", 0);\n if (typeof v !== \"string\" || !v.trim()) {\n throw new Error(`taken-list row did not decode to a course key (${typeof v})`);\n }\n return v;\n}\n\ntype Stmt = { sql: string; args: unknown[] };\n\n/**\n * A daily scrape is several hundred rows and one giant batch is a bad idea.\n * Splitting it costs the all-or-nothing guarantee across chunks, which is fine\n * here: every statement is idempotent, every import insert re-checks the\n * marker inside the statement (see IMPORT_TAKEN_SQL), and the marker rides in\n * the same list as the rows it certifies — so a half-finished import is simply\n * redone, and a marker can never be reached without the rows before it.\n */\nasync function chunked(stmts: Stmt[], size = 200): Promise {\n for (let i = 0; i < stmts.length; i += size) {\n await sqlite.batch(stmts.slice(i, i + size));\n }\n}\n\n// ---------------------------------------------------------------------------\n// Legacy import — pure halves, so they are testable without a database.\n// ---------------------------------------------------------------------------\n\n/**\n * Faithful, deliberately not clever. The live list is known to be wrong (it\n * holds a class the owner never chose and is missing one he did), and it is\n * still not this function's job to have an opinion — he clears it through the\n * app after deploying. Only values that could never have been a course key at\n * all are dropped: non-strings, blanks, and exact duplicates.\n *\n * Absent and unreadable are different answers and must stay different. A\n * missing blob key means there is nothing to import and the step is genuinely\n * done. A value that is present but not a list — `{\"keys\":[...]}`, a bare\n * string from a partial write — means the list exists and we failed to read\n * it; returning `[]` there would import nothing, let the caller mark the step\n * complete, and make the list unrecoverable. So that case throws and the\n * import is retried instead. A JSON `null` counts as absent: `getJSON` gives\n * `undefined` for a missing key, but a store that answered `null` instead\n * would otherwise wedge a fresh val at a permanent 503, and no truncated\n * array parses to `null` anyway.\n */\nexport function normalizeTaken(raw: unknown): string[] {\n if (raw == null) return [];\n if (!Array.isArray(raw)) {\n throw new Error(\n `legacy taken-list is present but not an array (${typeof raw}); ` +\n `refusing to mark the import done over a list that may still exist`,\n );\n }\n const out: string[] = [];\n for (const v of raw) {\n if (typeof v !== \"string\") continue;\n const key = v.trim();\n if (key && !out.includes(key)) out.push(key);\n }\n return out;\n}\n\n/** Same absent-versus-unreadable rule as `normalizeTaken`, same reason. */\nexport function normalizeSequences(raw: unknown): Record {\n const out: Record = {};\n if (raw == null) return out;\n if (typeof raw !== \"object\" || Array.isArray(raw)) {\n throw new Error(\n `legacy sequence map is present but not an object (${typeof raw}); ` +\n `refusing to mark the import done`,\n );\n }\n for (const [uid, v] of Object.entries(raw as Record)) {\n const n = Number(v);\n if (uid && Number.isFinite(n) && n >= 0) out[uid] = Math.floor(n);\n }\n return out;\n}\n\nexport function normalizePrints(raw: unknown): Record {\n const out: Record = {};\n if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return out;\n for (const [uid, v] of Object.entries(raw as Record)) {\n if (uid && typeof v === \"string\") out[uid] = v;\n }\n return out;\n}\n\n// ---------------------------------------------------------------------------\n// Schema + one-time import\n// ---------------------------------------------------------------------------\n\n/** Resolved once per isolate; concurrent callers await the same promise. */\nlet initialised: Promise | null = null;\n\n/**\n * Called by every exported operation, so a fresh val or a new branch builds\n * its own schema on first use with no manual setup step. On failure the cached\n * promise is dropped so the next request retries rather than inheriting a\n * permanently poisoned isolate.\n */\nexport function init(): Promise {\n if (!initialised) {\n initialised = (async () => {\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS ${TAKEN} (course_key TEXT PRIMARY KEY)`,\n `CREATE TABLE IF NOT EXISTS ${SEQ} (\n uid TEXT PRIMARY KEY,\n seq INTEGER NOT NULL DEFAULT 0,\n fingerprint TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS ${META} (key TEXT PRIMARY KEY, value TEXT NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS ${FIRST_SEEN} (\n event_id TEXT PRIMARY KEY,\n first_seen TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS ${SESSIONS} (\n id TEXT PRIMARY KEY,\n expires_at TEXT NOT NULL\n )`,\n ]);\n await importLegacy();\n })().catch((e) => {\n initialised = null;\n throw e;\n });\n }\n return initialised;\n}\n\nconst TAKEN_STEP = \"taken:imported\";\nconst SEQ_STEP = \"sequences:imported\";\n\nasync function imported(step: string): Promise {\n const r = await sqlite.execute({ sql: `SELECT 1 FROM ${META} WHERE key = ?`, args: [step] });\n return r.rows.length > 0;\n}\n\n/**\n * The import inserts, unlike HIDE_SQL, re-check the marker *inside* the\n * statement, and that is the whole point of them.\n *\n * `imported()` and the inserts are separate round trips, so two isolates that\n * cold-start at the same moment can both see no marker. The second one's insert\n * then lands after the first has already imported, written the marker, and\n * served the owner's DELETE — resurrecting a key he just removed. That is the\n * original production bug wearing a different hat, and no amount of batching\n * alone fixes it, because a transaction that never re-reads the marker will\n * happily re-insert rows a committed transaction already retired.\n *\n * Gating each insert on the marker turns the loser of that race into a no-op\n * the instant the winner commits, and appending the marker to the same\n * statement list means the marker is never written ahead of the rows it\n * certifies. The marker, not table-emptiness, remains the gate: nothing here\n * looks at a row count, so the list the owner clears right after deploying\n * stays cleared, including across a cold start.\n */\nexport const IMPORT_TAKEN_SQL = `INSERT OR IGNORE INTO ${TAKEN} (course_key)\n SELECT ? WHERE NOT EXISTS (SELECT 1 FROM ${META} WHERE key = ?)`;\n\nexport const IMPORT_SEQ_SQL = `INSERT OR IGNORE INTO ${SEQ} (uid, seq, fingerprint)\n SELECT ?, ?, ? WHERE NOT EXISTS (SELECT 1 FROM ${META} WHERE key = ?)`;\n\nfunction markStmt(step: string): Stmt {\n return {\n sql: `INSERT OR IGNORE INTO ${META} (key, value) VALUES (?, ?)`,\n args: [step, new Date().toISOString()],\n };\n}\n\n/**\n * The marker, not row-emptiness, is what decides this. That distinction is\n * load-bearing: the owner intends to clear the bad list through the app right\n * after deploying, and an emptiness test would read that empty table on the\n * very next request and helpfully restore every entry he just deleted.\n *\n * A blob read that *throws* is a different thing from a blob key that is\n * absent. Absent means there is nothing to import and the step is done. A\n * throw means we do not know, so it propagates: the caller turns it into a\n * 503 and the step is retried next time, rather than marking an empty import\n * as complete and losing the list. A value that is present but not the shape\n * we expect is the third case and behaves like the throw, not like the absent\n * one — see `normalizeTaken`.\n *\n * The marker is never written on its own: it is the last statement of the same\n * list as the rows it certifies, and each of those rows re-checks it, so the\n * check and the write cannot be interleaved by a second isolate.\n */\nasync function importLegacy(): Promise {\n if (!(await imported(TAKEN_STEP))) {\n let raw: unknown;\n try {\n raw = await blob.getJSON(\"taken\");\n } catch (e) {\n throw new Error(`legacy taken-list read failed, import not attempted: ${e}`);\n }\n // Throws on a present-but-unreadable value, before a single statement\n // runs, so no marker is ever written over a list we could not parse.\n const keys = normalizeTaken(raw);\n await chunked([\n ...keys.map((key) => ({ sql: IMPORT_TAKEN_SQL, args: [key, TAKEN_STEP] })),\n markStmt(TAKEN_STEP),\n ]);\n }\n\n if (!(await imported(SEQ_STEP))) {\n let seqRaw: unknown;\n let printRaw: unknown;\n try {\n seqRaw = await blob.getJSON(\"sequences\");\n printRaw = await blob.getJSON(\"prints\");\n } catch (e) {\n throw new Error(`legacy sequence read failed, import not attempted: ${e}`);\n }\n const seqs = normalizeSequences(seqRaw);\n const prints = normalizePrints(printRaw);\n const uids = [...new Set([...Object.keys(seqs), ...Object.keys(prints)])];\n await chunked([\n ...uids.map((uid) => ({\n sql: IMPORT_SEQ_SQL,\n args: [uid, seqs[uid] ?? 0, prints[uid] ?? null, SEQ_STEP],\n })),\n markStmt(SEQ_STEP),\n ]);\n }\n}\n\n// ---------------------------------------------------------------------------\n// Taken list\n// ---------------------------------------------------------------------------\n\nexport async function takenKeys(): Promise {\n await init();\n const r = await sqlite.execute(`SELECT course_key FROM ${TAKEN} ORDER BY course_key`);\n return (r.rows as unknown[]).map(courseKeyOf);\n}\n\nexport async function hide(key: string): Promise {\n await init();\n await sqlite.execute({ sql: HIDE_SQL, args: [key] });\n}\n\nexport async function unhide(key: string): Promise {\n await init();\n await sqlite.execute({ sql: UNHIDE_SQL, args: [key] });\n}\n\n/**\n * Only future offerings of a finished class are dropped. Past events stay, so\n * the calendar remains a record of what you actually did.\n */\nexport function filterTaken(\n events: T[],\n done: string[],\n today: string,\n): T[] {\n const hidden = new Set(done);\n return events.filter((e) => !(e.courseKey && hidden.has(e.courseKey) && e.start >= today));\n}\n\n// ---------------------------------------------------------------------------\n// SEQUENCE map\n// ---------------------------------------------------------------------------\n\nexport interface SeqRow {\n seq: number;\n fingerprint: string | null;\n}\n\n/**\n * Read side for /all.ics and /new.ics: just uid -> seq.\n *\n * An empty table is a valid answer here, not an error, and is deliberately not\n * gated. It occurs in exactly one situation: a val that has never completed a\n * cron run and had no legacy sequences to import — and there `SEQUENCE:0` is\n * the true answer, because no subscriber has ever been handed a higher number\n * for these UIDs. Every other route to an empty read is already covered: a row\n * shape that cannot be decoded throws (see `int`) and http.ts answers 503, a\n * failed `putSequences` leaves yesterday's rows in place rather than none, a\n * legacy blob that cannot be parsed refuses to mark itself imported, and\n * nothing in this file ever deletes from the table. Gating the feed on a\n * non-empty table would trade that correct zero for a 503 on every fresh val\n * until the first nightly scrape lands, which is the worse failure.\n */\nexport async function sequenceMap(): Promise> {\n await init();\n const r = await sqlite.execute(`SELECT uid, seq FROM ${SEQ}`);\n const out: Record = {};\n for (const row of r.rows as unknown[]) {\n out[String(col(row, \"uid\", 0))] = int(col(row, \"seq\", 1));\n }\n return out;\n}\n\n/** Read side for cron: it needs the stored fingerprint to decide on a bump. */\nexport async function sequenceRows(): Promise> {\n await init();\n const r = await sqlite.execute(`SELECT uid, seq, fingerprint FROM ${SEQ}`);\n const out: Record = {};\n for (const row of r.rows as unknown[]) {\n const fp = col(row, \"fingerprint\", 2);\n out[String(col(row, \"uid\", 0))] = {\n seq: int(col(row, \"seq\", 1)),\n fingerprint: fp == null ? null : String(fp),\n };\n }\n return out;\n}\n\n/**\n * Unchanged rule, moved out of cron.ts so it can be tested: bump only when we\n * have a previous fingerprint and it differs. A UID we have never seen, or one\n * stored before fingerprints were kept, starts where it is.\n */\nexport function nextSequence(prev: SeqRow | undefined, fingerprint: string): number {\n const seq = prev?.seq ?? 0;\n const was = prev?.fingerprint;\n return was && was !== fingerprint ? seq + 1 : seq;\n}\n\nexport async function putSequences(\n entries: { uid: string; seq: number; fingerprint: string }[],\n): Promise {\n await init();\n await chunked(entries.map((e) => ({\n sql: `INSERT INTO ${SEQ} (uid, seq, fingerprint) VALUES (?, ?, ?)\n ON CONFLICT(uid) DO UPDATE SET seq = excluded.seq, fingerprint = excluded.fingerprint`,\n args: [e.uid, e.seq, e.fingerprint],\n })));\n}\n\n// ---------------------------------------------------------------------------\n// Fullness snapshot\n// ---------------------------------------------------------------------------\n//\n// Blob, not a sqlite table, and a separate key rather than a field on each\n// event. Three reasons, in order of weight:\n//\n// 1. The migration at the top of this file was not about sqlite being nicer.\n// It was about read-modify-write: two overlapping HTTP requests editing one\n// JSON document silently discard one of the writes. Fullness has no HTTP\n// mutation path at all — no request ever writes it. cron.ts is the sole\n// writer and it replaces the entire document every run, which is the exact\n// shape the header of this file already calls out as correct for blob.\n// Putting it in sqlite would import the ceremony without the reason.\n// 2. A separate key keeps the `events` document byte-for-byte what it is\n// today. Folding a field into every event would rewrite the one document\n// http.ts's 503 semantics and the previous version's rollback both depend\n// on, to carry data that changes on a different schedule and matters less.\n// 3. Reading it must never be able to fail the page. A sqlite read goes\n// through init(), which builds schema and can reach the legacy taken-list\n// blob — so a fullness read would inherit failure modes belonging to\n// hiding classes. readFullness() deliberately calls neither.\n//\n// The snapshot carries its own fetched-at because a stale answer here is worse\n// than no answer: \"FULL\" on a class that opened up last night sends the owner\n// to a waitlist he does not need, and nothing on the page would show that the\n// claim is a day old. Past its window it is dropped and every event reads\n// \"unknown\", which renders exactly as the page did before this existed.\n\nconst FULLNESS_KEY = \"guild_fullness\";\n\n/**\n * Cron runs daily, so a healthy snapshot is always under 24h old. 26 gives a\n * late or slow run two hours of slack while still expiring one *missed* run\n * rather than showing yesterday's answer as if it were today's.\n */\nexport const FULLNESS_MAX_AGE_MS = 26 * 60 * 60 * 1000;\n\nexport interface FullnessSnapshot {\n fetchedAt: string;\n states: Record;\n}\n\nexport async function putFullness(states: Record): Promise {\n const snap: FullnessSnapshot = { fetchedAt: new Date().toISOString(), states };\n await blob.setJSON(FULLNESS_KEY, snap);\n}\n\n/**\n * The pure half, so the expiry and the shape checks are testable without a\n * store. Unlike normalizeTaken and normalizeSequences, this NEVER throws, and\n * the difference is deliberate rather than an oversight.\n *\n * Those two guard data that cannot be re-derived: refusing to read a garbled\n * taken-list is what stops an import from marking itself done and losing the\n * owner's choices for good. This document is regenerated in full by the next\n * cron run and holds nothing a user typed. Every failure it can have — absent,\n * wrong shape, undatable, expired, junk values — has the same correct answer,\n * which is \"we do not know\", and \"we do not know\" is a state this feature is\n * built to render. Throwing would convert a missing decoration into a 503 on\n * the class list.\n *\n * A timestamp in the future is treated as unusable rather than as\n * indefinitely fresh, so a clock skew cannot pin a stale snapshot open.\n */\nexport function normalizeFullness(raw: unknown, now: number): Record {\n const out: Record = {};\n if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return out;\n\n const snap = raw as Partial;\n const at = Date.parse(String(snap.fetchedAt ?? \"\"));\n if (!Number.isFinite(at)) return out;\n if (now - at > FULLNESS_MAX_AGE_MS) return out;\n if (at - now > 60 * 60 * 1000) return out;\n\n const states = snap.states;\n if (!states || typeof states !== \"object\" || Array.isArray(states)) return out;\n for (const [id, v] of Object.entries(states as Record)) {\n // A stored \"unknown\" is dropped rather than kept: absent already means\n // unknown, and one spelling of it is enough.\n if (/^\\d+$/.test(id) && (v === \"full\" || v === \"open\")) out[id] = v;\n }\n return out;\n}\n\n/**\n * Never throws, never 503s, never calls init(). An empty map is a complete and\n * honest answer meaning every event is \"unknown\".\n */\nexport async function readFullness(): Promise> {\n try {\n return normalizeFullness(await blob.getJSON(FULLNESS_KEY), Date.now());\n } catch {\n return {};\n }\n}\n\n// ---------------------------------------------------------------------------\n// First-seen — \"what is newly posted\"\n// ---------------------------------------------------------------------------\n//\n// Wild Apricot publishes no posting date anywhere in the markup, so there is\n// nothing to scrape and nothing to backfill. The only thing that can be known\n// is when WE first saw an event, which means this is a going-forward record\n// and the day it starts is the day it becomes meaningful.\n//\n// sqlite, not blob, and for the reason at the top of this file rather than by\n// habit: this is an accumulating set that must never lose an entry, and the\n// write is \"insert the ones I have not got\" — one INSERT OR IGNORE per id,\n// no read-modify-write. A blob would be read whole, edited and written back,\n// which is the exact shape that already cost a click in production. cron is\n// the only writer today, but the primitive should not be the thing standing\n// between us and a second one.\n//\n// KEYED ON THE EVENT ID ALONE, not on the `${id}:${start}` pair the scrape\n// dedups with. Those are two different identities and the difference is\n// visible in the live data: 12 of 206 ids on the Sep-Dec grid carry more than\n// one start, because a multi-session class is one Wild Apricot event posted\n// once and drawn on several days (event-6756661 sits on 01, 08 and 15 Sep).\n// The id is the posting; the pair is one occurrence of it. Keying on the pair\n// would mint a brand-new key every time the Guild moved a session by a day,\n// and the class would badge itself \"new\" again on a reschedule — which is\n// precisely the thing this feature must not do. Keying on the id, a moved\n// session keeps the date its posting was first seen, and a genuinely new\n// posting gets a genuinely new row.\n\n/** Marker key in the meta table, same table and same discipline as the two imports. */\nconst BASELINE_STEP = \"firstSeen:baselined\";\n\n/** The steady-state write: remember the ones we have not got, touch nothing else. */\nexport const FIRST_SEEN_SQL =\n `INSERT OR IGNORE INTO ${FIRST_SEEN} (event_id, first_seen) VALUES (?, ?)`;\n\n/**\n * The first-run write, marker-gated inside the statement for exactly the\n * reason IMPORT_TAKEN_SQL is — see the long comment there, it applies verbatim.\n * `imported()` and the inserts are separate round trips, so two isolates can\n * both see no marker; gating each insert on the marker turns the loser into a\n * no-op the instant the winner commits, and the marker is appended to the same\n * statement list as the rows it certifies so it can never be reached ahead of\n * them.\n */\nexport const BASELINE_FIRST_SEEN_SQL =\n `INSERT OR IGNORE INTO ${FIRST_SEEN} (event_id, first_seen)\n SELECT ?, ? WHERE NOT EXISTS (SELECT 1 FROM ${META} WHERE key = ?)`;\n\n/**\n * The stamp every event already on the calendar gets on the first run after\n * deploy. The Unix epoch, deliberately, rather than \"now minus the window\":\n * it is outside any window anyone could later choose, so widening NEW_WINDOW_MS\n * from 7 days to 30 cannot retroactively light up all ~330 baselined events.\n * It is also the honest value — we do not know when these were posted, only\n * that it was before we started looking — and it never reaches the page,\n * because `isNewSince` rejects it long before anything formats a date.\n */\nexport const BASELINE_STAMP = new Date(0).toISOString();\n\n/**\n * Seven days. Cron runs daily, so a badge survives about seven sightings: long\n * enough that the owner can miss a few days and still see what arrived, short\n * enough that \"new\" keeps meaning new. Nothing else depends on the number —\n * it is one constant read by one pure function.\n */\nexport const NEW_WINDOW_MS = 7 * 24 * 60 * 60 * 1000;\n\n/**\n * Called by cron after the events snapshot is already committed. Idempotent:\n * re-running it the same day writes nothing, because every id it would insert\n * is already there.\n */\nexport async function recordFirstSeen(ids: string[], now: Date = new Date()): Promise {\n await init();\n\n const unique: string[] = [];\n const seen = new Set();\n for (const id of ids) {\n const key = String(id).trim();\n if (key && !seen.has(key)) {\n seen.add(key);\n unique.push(key);\n }\n }\n\n // First run after deploy. Everything currently on the calendar is recorded\n // as having been there all along, so the badge means something only from the\n // NEXT run onward. Without this the feature would announce all ~330 existing\n // events as new on day one, which is the one output that would teach the\n // owner to ignore it.\n if (!(await imported(BASELINE_STEP))) {\n await chunked([\n ...unique.map((id) => ({\n sql: BASELINE_FIRST_SEEN_SQL,\n args: [id, BASELINE_STAMP, BASELINE_STEP],\n })),\n markStmt(BASELINE_STEP),\n ]);\n return;\n }\n\n const at = now.toISOString();\n await chunked(unique.map((id) => ({ sql: FIRST_SEEN_SQL, args: [id, at] })));\n}\n\n/**\n * Never throws, and the reason is narrower than readFullness's.\n *\n * This one does go through init(), so it can fail the way the taken-list read\n * fails. It is still not a fourth member of http.ts's 503 set, because on the\n * page that reads it the taken-list read has already run and already 503'd if\n * sqlite was unreachable — by the time this is called, the store has answered\n * once. What is left is a failure of this table alone, and its correct answer\n * is \"nothing is known to be new\", which renders exactly as the page rendered\n * before this feature existed. Taking the class list down over a missing badge\n * would be the regression.\n */\nexport async function readFirstSeen(): Promise> {\n try {\n await init();\n const r = await sqlite.execute(`SELECT event_id, first_seen FROM ${FIRST_SEEN}`);\n const out: Record = {};\n for (const row of r.rows as unknown[]) {\n const id = col(row, \"event_id\", 0);\n const at = col(row, \"first_seen\", 1);\n // A row that does not decode to two strings is dropped, not guessed at.\n // Unlike the sequence map there is nothing to poison here: a dropped row\n // is one course that does not get a badge.\n if (typeof id === \"string\" && id && typeof at === \"string\" && at) out[id] = at;\n }\n return out;\n } catch {\n return {};\n }\n}\n\n/**\n * The earliest first-seen across a course's occurrences, or null if none of\n * them is recorded yet.\n *\n * Earliest, not latest: a course is new when the course is new. A long-running\n * class that posts a fresh cohort has occurrences we first saw months ago, so\n * its earliest stays old and the row stays unbadged — the cohort is new, the\n * course is not. ISO-8601 strings compare correctly with `<`, so no parsing.\n */\nexport function earliestFirstSeen(\n map: Record,\n ids: string[],\n): string | null {\n let best: string | null = null;\n for (const id of ids) {\n const at = map[id];\n if (!at) continue;\n if (best === null || at < best) best = at;\n }\n return best;\n}\n\n/**\n * Pure, so the window is testable without a clock or a database. A stamp that\n * does not parse, or one from the future, is not new — same posture as the\n * fullness snapshot: an unusable timestamp must not be able to pin a badge on.\n */\nexport function isNewSince(at: string | null, now: number): boolean {\n if (!at) return false;\n const t = Date.parse(at);\n if (!Number.isFinite(t)) return false;\n if (t > now) return false;\n return now - t <= NEW_WINDOW_MS;\n}\n\n// ---------------------------------------------------------------------------\n// Admin sessions\n// ---------------------------------------------------------------------------\n//\n// The cookie used to BE the password: login set `guild_auth=` and\n// the check string-compared the cookie back against the env var. So every copy\n// of the cookie was a copy of the secret — a curl cookie jar, a devtools\n// panel, a screenshot. Two of those leaked during testing, and each one forced\n// a rotation of GUILD_TOKEN, which logs the owner out of every device at once\n// because there was nothing else to revoke.\n//\n// A session id fixes both halves. It is minted at random, so it discloses\n// nothing about the secret and cannot be worked backwards into it; and it is a\n// row, so revoking one device is a DELETE rather than a rotation.\n//\n// sqlite rather than blob, for the reason at the top of this file rather than\n// by habit: every write here is one row and reads nothing first — a login is\n// one INSERT, a logout one DELETE, the sweep one DELETE. Two overlapping\n// logins cannot lose one another the way two overlapping clicks once lost a\n// hide.\n\n/**\n * 32 bytes of CSPRNG output rendered as 64 lowercase hex characters.\n *\n * `crypto.getRandomValues`, never `Math.random()`: Math.random is seeded state\n * that an observer of one output can often continue, which is not what this\n * value has to survive. 256 bits is far past guessable, and hex keeps the id\n * inside the cookie-value grammar, so nothing has to percent-encode it on the\n * way out or decode it on the way back in — one less place for a value to\n * change shape between being set and being looked up.\n *\n * Nothing here reads GUILD_TOKEN, hashes it, or seeds anything from it. The id\n * is independent of the secret, which is the point: holding a session id must\n * not put anyone one step closer to the password.\n */\nexport function newSessionId(): string {\n const bytes = new Uint8Array(32);\n crypto.getRandomValues(bytes);\n return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/**\n * Cheap shape gate, so a cookie left over from the old scheme — or any other\n * junk a client sends — is rejected without a round trip. It is a\n * convenience, not the security boundary: the lookup is what authenticates,\n * and a well-formed id that is not in the table is exactly as unauthenticated\n * as a malformed one.\n */\nexport function isSessionId(v: unknown): v is string {\n return typeof v === \"string\" && /^[0-9a-f]{64}$/.test(v);\n}\n\n/**\n * One year, chosen to match the cookie's existing `Max-Age=31536000` exactly\n * rather than to be interesting. The owner's experience is unchanged: he logs\n * in once and stays logged in for a year. What is new is that the year is now\n * enforced on the server as well, so a cookie that outlives its row — copied,\n * restored from a browser backup, held by a client that ignores Max-Age —\n * stops working on schedule instead of never.\n */\nexport const SESSION_TTL_MS = 31536000 * 1000;\n\n/** The same number in the unit `Set-Cookie` wants, so the two cannot drift. */\nexport const SESSION_MAX_AGE_S = 31536000;\n\n/**\n * One row, nothing read first — the discipline HIDE_SQL is written to, for the\n * same reason. A plain INSERT rather than INSERT OR IGNORE: a collision on a\n * 256-bit random id is not a double-submit to be absorbed quietly, it is\n * something that cannot happen, and ignoring it would hand the caller a cookie\n * for a session row it does not own.\n */\nexport const SESSION_INSERT_SQL = `INSERT INTO ${SESSIONS} (id, expires_at) VALUES (?, ?)`;\n\n/** By primary key, so it is an index seek no matter how large the table gets. */\nexport const SESSION_SELECT_SQL = `SELECT expires_at FROM ${SESSIONS} WHERE id = ?`;\n\n/** The revocation path the old design had no way to express at all. */\nexport const SESSION_DELETE_SQL = `DELETE FROM ${SESSIONS} WHERE id = ?`;\n\n/**\n * Opportunistic cleanup, batched with a login. Deliberately not a cron job:\n * expired rows are already refused by the read path, so this is housekeeping\n * rather than a correctness requirement, and a table that gains one row per\n * login does not need a scheduled sweeper.\n *\n * `<=` rather than `<`, matching `sessionLive`, which requires the expiry to\n * be strictly in the future — so a row expiring exactly now is swept, not kept\n * for one more instant.\n */\nexport const SESSION_SWEEP_SQL = `DELETE FROM ${SESSIONS} WHERE expires_at <= ?`;\n\n/**\n * The throwing validator for this table, exactly parallel to `courseKeyOf`,\n * and throwing for a sharper reason than that one.\n *\n * A row shape `col` did not understand yields `undefined` or an object here.\n * Any \"treat an unreadable expiry as fine\" default is a silent auth bypass —\n * the one failure mode this whole change exists to remove — and even a\n * \"treat it as expired\" default would quietly log the owner out on a client\n * upgrade that changed the row shape, hiding the real fault. So an expiry that\n * is not a non-empty string is not an expiry, and the throw becomes the 503\n * http.ts already has for a store it cannot read.\n */\nexport function sessionExpiryOf(row: unknown): string {\n const v = col(row, \"expires_at\", 0);\n if (typeof v !== \"string\" || !v.trim()) {\n throw new Error(`session row did not decode to an expiry (${typeof v})`);\n }\n return v;\n}\n\n/**\n * Pure, so the expiry comparison is testable without a database or a clock.\n *\n * An undatable stamp is NOT live — the same posture `isNewSince` and\n * `normalizeFullness` take toward a timestamp they cannot read. There the cost\n * of guessing was a wrong badge; here it would be a session that never\n * expires, so the rule matters more, not less. Strictly greater than: a\n * session whose expiry is this instant has expired.\n */\nexport function sessionLive(expiresAt: string, now: number): boolean {\n const t = Date.parse(expiresAt);\n if (!Number.isFinite(t)) return false;\n return t > now;\n}\n\n/**\n * Mints the id, sweeps what has expired and stores the new row — sweep and\n * insert in one batch, so a login costs one round trip rather than two.\n *\n * Returns the id, which is the only value that ever reaches the cookie.\n * GUILD_TOKEN is not a parameter of this function and is not reachable from\n * it; store.ts does not read the environment at all.\n */\nexport async function createSession(now: Date = new Date()): Promise {\n await init();\n const id = newSessionId();\n const at = now.getTime();\n await sqlite.batch([\n { sql: SESSION_SWEEP_SQL, args: [new Date(at).toISOString()] },\n { sql: SESSION_INSERT_SQL, args: [id, new Date(at + SESSION_TTL_MS).toISOString()] },\n ]);\n return id;\n}\n\n/**\n * The authentication check. Every path out of it is `false` or a throw: there\n * is no cookie value and no row shape that returns true without a matching,\n * unexpired row having actually come back from sqlite.\n *\n * It does not throw on \"no such session\" — an unknown id is a normal, expected\n * answer meaning not logged in. It throws only when the store could not be\n * read or a row would not decode, and the caller turns that into a 503. That\n * is the fail-closed contract: unreadable is never authenticated.\n *\n * A cookie left over from the old raw-secret scheme arrives here as an unknown\n * id and is refused by the shape gate before a query is even sent. There is\n * deliberately no comparison against GUILD_TOKEN on this path: a compatibility\n * fallback that still accepted the raw secret from a cookie would preserve the\n * exact hole being closed.\n */\nexport async function sessionValid(id: unknown, now: Date = new Date()): Promise {\n if (!isSessionId(id)) return false;\n await init();\n const r = await sqlite.execute({ sql: SESSION_SELECT_SQL, args: [id] });\n if (r.rows.length === 0) return false;\n return sessionLive(sessionExpiryOf(r.rows[0]), now.getTime());\n}\n\n/**\n * Logout. One row, by id, and it has to actually run: clearing the cookie\n * alone — which is all the old logout did — leaves the value replayable by\n * anyone holding a copy, and on the old scheme that meant leaving the password\n * live. A caller that cannot complete this must not report a successful\n * logout.\n */\nexport async function destroySession(id: unknown): Promise {\n if (!isSessionId(id)) return;\n await init();\n await sqlite.execute({ sql: SESSION_DELETE_SQL, args: [id] });\n}\n","deleted",false,"label",[14],"344e43c2-1842-48d0-8dbf-76d960b13c0f",["D",1788654659900],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","1398b500-45f0-4bf4-90e5-f35150473c2e","pinnedFileId","3cdb4b5c-a98a-11f1-9fa3-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a05927-4c0c-73bc-ab9c-dd245be766a5","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_102":98},"org",{"_9":10,"_95":96,"_97":98,"_54":55,"_99":100,"_101":42},"branch",{"_35":85,"_11":86,"_22":28,"_87":45,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":12,"_94":10},"isOwned",21,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Cameron Hotchkies","avatar","https://lh3.googleusercontent.com/a/ACg8ocLqBbiwSyhcuAqhs2fRy8Ap0lqA45YFLtS_JtAKAwjEYuXmcXDR=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_78":-5,"_136":137,"_138":139,"_140":141,"_142":42,"_143":42,"_144":42,"_145":32,"_146":-5,"_147":-7,"_148":-7,"_149":62,"_150":42,"_151":42,"_152":-5,"_153":42,"_154":42,"_155":42,"_156":-5},"ENV",{"_107":108,"_109":110,"_111":86,"_112":113,"_114":115,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]