[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_108":109,"_110":111},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","xdv","name","subscriptions-feedback","path","index.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":32,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/xdv/subscriptions-feedback/code/index.ts","extension","id","d82a78e7-8f13-4b11-8901-08a44ff45356","fileId","01a05e91-3c61-747c-96e4-e7f8845199ec","parentId","branchId","3cb18c55-e6c7-42be-b35f-89b94db8140e","branchVersion",19,"latest",true,"createdAt",["D",1788302892448],"version",3,"fileType","http","content","/**\n * HTTP entry point: the dashboard and its JSON API.\n *\n * Val Town assigns this file's URL — read it from `links.endpoint` rather than\n * constructing it. Set the same value as the APP_URL environment variable so the\n * outgoing emails can link back here.\n */\nimport { Hono } from \"npm:hono@^4.13.5\";\nimport { parseVal, serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { getOAuthUserData, oauthMiddleware } from \"https://esm.town/v/std/oauth/middleware.ts\";\nimport type { BillingCycle, Currency } from \"./shared/types.ts\";\nimport { CURRENCIES, isLive } from \"./shared/types.ts\";\nimport { currentPeriod, toMinor } from \"./shared/money.ts\";\nimport { ensureSchema } from \"./backend/db.ts\";\nimport { baseCurrency } from \"./backend/fx.ts\";\nimport {\n cancelSubscription,\n chargesFor,\n createSubscription,\n deleteSubscription,\n getSubscription,\n listViews,\n ratingsFor,\n reactivateSubscription,\n saveRating,\n setCategory,\n updateSubscription,\n} from \"./backend/subscriptions.ts\";\nimport { byCategory, forecast, history, savings, summary } from \"./backend/analytics.ts\";\nimport { closeItemsFor, generateReviewItems, listReviewItems, resolveReviewItem } from \"./backend/review.ts\";\nimport { handleInbound } from \"./backend/email/handle.ts\";\nimport { isConfigured } from \"./backend/llm.ts\";\nimport { Root } from \"./frontend/root.tsx\";\n\n/** The signed-in Val Town account, once it has passed the gate below. */\ninterface Viewer {\n username: string | null;\n}\n\nconst app = new Hono<{ Variables: { viewer: Viewer } }>();\n\n/**\n * Who may see the dashboard.\n *\n * This is spending data, so the endpoint is not left open. Val Town's platform-level\n * restricted access needs a paid business org, so the gate lives in the val instead:\n * you log in with a Val Town account and this decides whether to let you through.\n *\n * `ALLOWED_USERS` is a comma-separated list of Val Town handles or account emails.\n *\n * set — it is the *entire* guest list. Org membership admits nobody on its own.\n * unset — members of the org that owns this val get in.\n *\n * That distinction is the point. Two people each need their own copy of this app,\n * and sharing an org so one of them can reach their copy would otherwise hand them\n * the other copy too. Naming the guest list explicitly keeps each instance to its\n * own person, whatever the org says. Leaving it unset keeps a fresh deploy from\n * locking its owner out of itself.\n */\nfunction allowedIdentities(): string[] {\n return (Deno.env.get(\"ALLOWED_USERS\") ?? \"\")\n .split(\",\")\n .map((entry) => entry.trim().toLowerCase())\n .filter(Boolean);\n}\n\nasync function viewerOf(req: Request) {\n const session = await getOAuthUserData(req).catch(() => null);\n if (!session?.user) return null;\n\n // Either identifier may be listed: the handle is stable, but the email is what\n // you actually know about a colleague before they have signed up.\n const handle = session.user.username?.toLowerCase() ?? \"\";\n const email = session.user.email?.toLowerCase() ?? \"\";\n const allowed = allowedIdentities();\n\n const permitted = allowed.length > 0\n ? (handle !== \"\" && allowed.includes(handle)) || (email !== \"\" && allowed.includes(email))\n : session.isOrgMember === true;\n\n return permitted ? session.user : { ...session.user, denied: true as const };\n}\n\napp.use(\"*\", async (c, next) => {\n const viewer = await viewerOf(c.req.raw);\n const isApi = c.req.path.startsWith(\"/api/\");\n\n if (!viewer) {\n // Not signed in at all: send people to log in, tell machines plainly.\n if (isApi) return c.json({ error: \"sign in to use this API\" }, 401);\n return c.redirect(\"/auth/login\");\n }\n if (\"denied\" in viewer) {\n // Signed in but not on the list — redirecting here would just bounce them\n // back and forth, so say what happened instead.\n const message =\n `Signed in as ${viewer.username}, but this dashboard is limited to the people on its guest list. ` +\n `Each person using this tracker has their own copy, so you may be looking at someone else's.`;\n if (isApi) return c.json({ error: message }, 403);\n return c.html(\n `\n

${message}

\n \n `,\n 403,\n );\n }\n\n c.set(\"viewer\", { username: viewer.username });\n return next();\n});\n\napp.get(\"/\", (c) => c.html(Root()));\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n/** Everything the dashboard needs, in one round trip. */\napp.get(\"/api/state\", async (c) => {\n await ensureSchema();\n const views = await listViews(true);\n const live = views.filter((s) => isLive(s.status));\n const [sum, fc, hist, sav, review, cats, base] = await Promise.all([\n summary(views),\n forecast(12, live),\n history(12),\n savings(),\n listReviewItems(\"open\"),\n byCategory(live),\n baseCurrency(),\n ]);\n const viewer = c.get(\"viewer\");\n return c.json({\n baseCurrency: base,\n period: currentPeriod(),\n llmConfigured: isConfigured(),\n viewer: viewer ? { username: viewer.username } : null,\n summary: sum,\n subscriptions: views,\n forecast: fc,\n history: hist,\n savings: sav,\n review,\n categories: cats,\n });\n});\n\napp.get(\"/api/subscriptions/:id\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const sub = await getSubscription(id);\n if (!sub) return c.json({ error: \"not found\" }, 404);\n const [charges, ratings] = await Promise.all([chargesFor(id), ratingsFor(id)]);\n return c.json({ subscription: sub, charges, ratings });\n});\n\napp.post(\"/api/subscriptions\", async (c) => {\n const body = await c.req.json();\n const parsed = parseSubscriptionBody(body);\n if (\"error\" in parsed) return c.json(parsed, 400);\n const id = await createSubscription(parsed.value);\n return c.json({ id }, 201);\n});\n\napp.patch(\"/api/subscriptions/:id\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json() as Record;\n const patch: Record = {};\n\n if (body.amount != null) patch.amountMinor = toMinor(Number(body.amount));\n if (body.amountMinor != null) patch.amountMinor = Math.round(Number(body.amountMinor));\n for (const key of [\"planName\", \"startedOn\", \"nextChargeOn\", \"paymentMethod\", \"notes\", \"status\"]) {\n if (key in body) patch[key] = body[key];\n }\n if (body.currency && CURRENCIES.includes(String(body.currency) as Currency)) patch.currency = body.currency;\n if (body.billingCycle === \"monthly\" || body.billingCycle === \"yearly\") patch.billingCycle = body.billingCycle;\n if (\"autoRenew\" in body) patch.autoRenew = Boolean(body.autoRenew);\n\n await updateSubscription(id, patch);\n\n // Category is a property of the service behind this subscription, so it is set\n // separately rather than through the subscription patch.\n if (\"category\" in body) {\n const category = String(body.category ?? \"\").trim();\n await setCategory(id, category === \"\" ? null : category);\n }\n return c.json({ ok: true });\n});\n\napp.post(\"/api/subscriptions/:id/cancel\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({})) as { reason?: string; on?: string };\n await cancelSubscription(id, { reason: body.reason, on: body.on });\n await closeItemsFor(id);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/subscriptions/:id/reactivate\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({})) as { nextChargeOn?: string };\n await reactivateSubscription(id, body.nextChargeOn);\n return c.json({ ok: true });\n});\n\napp.delete(\"/api/subscriptions/:id\", async (c) => {\n await deleteSubscription(Number(c.req.param(\"id\")));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/subscriptions/:id/ratings\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json() as { quality?: number; usage?: number; period?: string; note?: string };\n const quality = Number(body.quality);\n const usage = Number(body.usage);\n if (!Number.isFinite(quality) || !Number.isFinite(usage)) {\n return c.json({ error: \"quality and usage are required, 1 to 5\" }, 400);\n }\n await saveRating(id, body.period ?? currentPeriod(), quality, usage, body.note ?? null);\n await closeItemsFor(id, [\"rating_due\"]);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/review/:id/:action\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const action = c.req.param(\"action\");\n if (action !== \"done\" && action !== \"dismissed\") return c.json({ error: \"unknown action\" }, 400);\n await resolveReviewItem(id, action);\n return c.json({ ok: true });\n});\n\n/** Rebuild the decision inbox on demand — the same routine the daily cron runs. */\napp.post(\"/api/review/refresh\", async (c) => {\n const created = await generateReviewItems();\n return c.json({ created: created.length, items: created });\n});\n\n/**\n * Paste an email here to see exactly what the inbound handler would do with it,\n * without having to send real mail. Writes for real, so it is the fastest way to\n * check extraction against a receipt you actually received.\n */\napp.post(\"/api/email/simulate\", async (c) => {\n const body = await c.req.json() as {\n from?: string;\n subject?: string;\n text?: string;\n html?: string;\n messageId?: string;\n };\n if (!body.text && !body.html) return c.json({ error: \"text or html is required\" }, 400);\n const result = await handleInbound({\n from: body.from ?? \"test@example.com\",\n subject: body.subject ?? null,\n text: body.text ?? null,\n html: body.html ?? null,\n messageId: body.messageId ?? null,\n });\n return c.json(result);\n});\n\n// Full stack traces in the val logs rather than a swallowed 500.\napp.onError((err) => Promise.reject(err));\n\nfunction parseSubscriptionBody(body: Record):\n | { value: Parameters[0] }\n | { error: string }\n{\n const serviceName = String(body.serviceName ?? \"\").trim();\n if (!serviceName) return { error: \"serviceName is required\" };\n\n const amountMinor = body.amountMinor != null\n ? Math.round(Number(body.amountMinor))\n : toMinor(Number(body.amount));\n if (!Number.isFinite(amountMinor) || amountMinor <= 0) return { error: \"amount must be a positive number\" };\n\n const currency = String(body.currency ?? \"PLN\").toUpperCase() as Currency;\n if (!CURRENCIES.includes(currency)) return { error: `currency must be one of ${CURRENCIES.join(\", \")}` };\n\n const billingCycle = body.billingCycle === \"yearly\" ? \"yearly\" : \"monthly\" as BillingCycle;\n\n return {\n value: {\n serviceName,\n planName: body.planName ? String(body.planName) : null,\n amountMinor,\n currency,\n billingCycle,\n startedOn: body.startedOn ? String(body.startedOn) : null,\n nextChargeOn: body.nextChargeOn ? String(body.nextChargeOn) : null,\n category: body.category ? String(body.category) : null,\n paymentMethod: body.paymentMethod ? String(body.paymentMethod) : null,\n notes: body.notes ? String(body.notes) : null,\n source: \"manual\",\n },\n };\n}\n\nexport default oauthMiddleware(app.fetch);\n","deleted",false,"label",[14],"9bc728ac-50f9-4071-a163-6ccfe685ce52",["D",1788292971385],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Subscription tracker — separate instance for colleague feedback","imageUrl","userId","5f1525c6-51a0-4c57-858d-f94f1e686d46","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a05e29-777a-77c1-a910-e4a1d8102a40","tursoName","9bc728ac50f94071a1636ccfe685ce52","tursoHostname","9bc728ac50f94071a1636ccfe685ce52-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789514495229],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_107":-5},"org",{"_9":10,"_101":102,"_103":-5,"_55":-5,"_104":105,"_106":42},"branch",{"_35":88,"_11":89,"_22":28,"_90":45,"_91":92,"_93":94,"_95":50,"_96":97,"_98":64,"_99":12,"_100":10},"isOwned",20,"main","projectId","forkedBranchId","723ee93a-6b67-428c-b3cc-6f9491011d78","forkedBranchVersion",60,"forkedProjectPrivacy","forkedProjectId","5588f200-1c41-400f-bf66-81f9f6ac0211","forkedProjectOrgId","projectName","userHandle","displayName","xd.ventures","avatar","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_141":142,"_143":144,"_145":146,"_147":42,"_148":42,"_149":42,"_150":32,"_151":-5,"_152":-7,"_153":-7,"_154":62,"_155":42,"_156":42,"_157":-5,"_158":42,"_159":42,"_160":42,"_161":-5},"ENV",{"_112":113,"_114":115,"_116":89,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138,"_139":140},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]