[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_106":107,"_108":109},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","xdv","name","subscriptions","path","index.ts","project",{"_22":46,"_11":12,"_33":47,"_48":-5,"_49":42,"_50":51,"_52":51,"_53":54,"_55":-5,"_56":57,"_58":25,"_59":32,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_13":45},"permalink","https://www.val.town/x/xdv/subscriptions/code/index.ts","extension","id","d03368bc-57c9-4629-8057-9cc16d3a81cf","fileId","c177e026-a63a-11f1-bee9-1607ee4eb77e","parentId","branchId","723ee93a-6b67-428c-b3cc-6f9491011d78","branchVersion",88,"latest",true,"createdAt",["D",1788302826089],"version",4,"fileType","http","content","/**\n * HTTP entry point: the dashboard and its JSON API.\n *\n * Val Town assigns this file's URL — read it from `links.endpoint` rather than\n * constructing it. Set the same value as the APP_URL environment variable so the\n * outgoing emails can link back here.\n */\nimport { Hono } from \"npm:hono@^4.13.5\";\nimport { parseVal, serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { getOAuthUserData, oauthMiddleware } from \"https://esm.town/v/std/oauth/middleware.ts\";\nimport type { BillingCycle, Currency } from \"./shared/types.ts\";\nimport { CURRENCIES, isLive } from \"./shared/types.ts\";\nimport { currentPeriod, toMinor } from \"./shared/money.ts\";\nimport { ensureSchema } from \"./backend/db.ts\";\nimport { baseCurrency } from \"./backend/fx.ts\";\nimport {\n cancelSubscription,\n chargesFor,\n createSubscription,\n deleteSubscription,\n getSubscription,\n listViews,\n ratingsFor,\n reactivateSubscription,\n saveRating,\n setCategory,\n updateSubscription,\n} from \"./backend/subscriptions.ts\";\nimport { byCategory, forecast, history, savings, summary } from \"./backend/analytics.ts\";\nimport { closeItemsFor, generateReviewItems, listReviewItems, resolveReviewItem } from \"./backend/review.ts\";\nimport { handleInbound } from \"./backend/email/handle.ts\";\nimport { isConfigured } from \"./backend/llm.ts\";\nimport { Root } from \"./frontend/root.tsx\";\n\n/** The signed-in Val Town account, once it has passed the gate below. */\ninterface Viewer {\n username: string | null;\n}\n\nconst app = new Hono<{ Variables: { viewer: Viewer } }>();\n\n/**\n * Who may see the dashboard.\n *\n * This is spending data, so the endpoint is not left open. Val Town's platform-level\n * restricted access needs a paid business org, so the gate lives in the val instead:\n * you log in with a Val Town account and this decides whether to let you through.\n *\n * `ALLOWED_USERS` is a comma-separated list of Val Town handles or account emails.\n *\n * set — it is the *entire* guest list. Org membership admits nobody on its own.\n * unset — members of the org that owns this val get in.\n *\n * That distinction is the point. Two people each need their own copy of this app,\n * and sharing an org so one of them can reach their copy would otherwise hand them\n * the other copy too. Naming the guest list explicitly keeps each instance to its\n * own person, whatever the org says. Leaving it unset keeps a fresh deploy from\n * locking its owner out of itself.\n */\nfunction allowedIdentities(): string[] {\n return (Deno.env.get(\"ALLOWED_USERS\") ?? \"\")\n .split(\",\")\n .map((entry) => entry.trim().toLowerCase())\n .filter(Boolean);\n}\n\nasync function viewerOf(req: Request) {\n const session = await getOAuthUserData(req).catch(() => null);\n if (!session?.user) return null;\n\n // Either identifier may be listed: the handle is stable, but the email is what\n // you actually know about a colleague before they have signed up.\n const handle = session.user.username?.toLowerCase() ?? \"\";\n const email = session.user.email?.toLowerCase() ?? \"\";\n const allowed = allowedIdentities();\n\n const permitted = allowed.length > 0\n ? (handle !== \"\" && allowed.includes(handle)) || (email !== \"\" && allowed.includes(email))\n : session.isOrgMember === true;\n\n return permitted ? session.user : { ...session.user, denied: true as const };\n}\n\napp.use(\"*\", async (c, next) => {\n const viewer = await viewerOf(c.req.raw);\n const isApi = c.req.path.startsWith(\"/api/\");\n\n if (!viewer) {\n // Not signed in at all: send people to log in, tell machines plainly.\n if (isApi) return c.json({ error: \"sign in to use this API\" }, 401);\n return c.redirect(\"/auth/login\");\n }\n if (\"denied\" in viewer) {\n // Signed in but not on the list — redirecting here would just bounce them\n // back and forth, so say what happened instead.\n const message =\n `Signed in as ${viewer.username}, but this dashboard is limited to the people on its guest list. ` +\n `Each person using this tracker has their own copy, so you may be looking at someone else's.`;\n if (isApi) return c.json({ error: message }, 403);\n return c.html(\n `\n

${message}

\n \n `,\n 403,\n );\n }\n\n c.set(\"viewer\", { username: viewer.username });\n return next();\n});\n\napp.get(\"/\", (c) => c.html(Root()));\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n/** Everything the dashboard needs, in one round trip. */\napp.get(\"/api/state\", async (c) => {\n await ensureSchema();\n const views = await listViews(true);\n const live = views.filter((s) => isLive(s.status));\n const [sum, fc, hist, sav, review, cats, base] = await Promise.all([\n summary(views),\n forecast(12, live),\n history(12),\n savings(),\n listReviewItems(\"open\"),\n byCategory(live),\n baseCurrency(),\n ]);\n const viewer = c.get(\"viewer\");\n return c.json({\n baseCurrency: base,\n period: currentPeriod(),\n llmConfigured: isConfigured(),\n viewer: viewer ? { username: viewer.username } : null,\n summary: sum,\n subscriptions: views,\n forecast: fc,\n history: hist,\n savings: sav,\n review,\n categories: cats,\n });\n});\n\napp.get(\"/api/subscriptions/:id\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const sub = await getSubscription(id);\n if (!sub) return c.json({ error: \"not found\" }, 404);\n const [charges, ratings] = await Promise.all([chargesFor(id), ratingsFor(id)]);\n return c.json({ subscription: sub, charges, ratings });\n});\n\napp.post(\"/api/subscriptions\", async (c) => {\n const body = await c.req.json();\n const parsed = parseSubscriptionBody(body);\n if (\"error\" in parsed) return c.json(parsed, 400);\n const id = await createSubscription(parsed.value);\n return c.json({ id }, 201);\n});\n\napp.patch(\"/api/subscriptions/:id\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json() as Record;\n const patch: Record = {};\n\n if (body.amount != null) patch.amountMinor = toMinor(Number(body.amount));\n if (body.amountMinor != null) patch.amountMinor = Math.round(Number(body.amountMinor));\n for (const key of [\"planName\", \"startedOn\", \"nextChargeOn\", \"paymentMethod\", \"notes\", \"status\"]) {\n if (key in body) patch[key] = body[key];\n }\n if (body.currency && CURRENCIES.includes(String(body.currency) as Currency)) patch.currency = body.currency;\n if (body.billingCycle === \"monthly\" || body.billingCycle === \"yearly\") patch.billingCycle = body.billingCycle;\n if (\"autoRenew\" in body) patch.autoRenew = Boolean(body.autoRenew);\n\n await updateSubscription(id, patch);\n\n // Category is a property of the service behind this subscription, so it is set\n // separately rather than through the subscription patch.\n if (\"category\" in body) {\n const category = String(body.category ?? \"\").trim();\n await setCategory(id, category === \"\" ? null : category);\n }\n return c.json({ ok: true });\n});\n\napp.post(\"/api/subscriptions/:id/cancel\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({})) as { reason?: string; on?: string };\n await cancelSubscription(id, { reason: body.reason, on: body.on });\n await closeItemsFor(id);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/subscriptions/:id/reactivate\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({})) as { nextChargeOn?: string };\n await reactivateSubscription(id, body.nextChargeOn);\n return c.json({ ok: true });\n});\n\napp.delete(\"/api/subscriptions/:id\", async (c) => {\n await deleteSubscription(Number(c.req.param(\"id\")));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/subscriptions/:id/ratings\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json() as { quality?: number; usage?: number; period?: string; note?: string };\n const quality = Number(body.quality);\n const usage = Number(body.usage);\n if (!Number.isFinite(quality) || !Number.isFinite(usage)) {\n return c.json({ error: \"quality and usage are required, 1 to 5\" }, 400);\n }\n await saveRating(id, body.period ?? currentPeriod(), quality, usage, body.note ?? null);\n await closeItemsFor(id, [\"rating_due\"]);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/review/:id/:action\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const action = c.req.param(\"action\");\n if (action !== \"done\" && action !== \"dismissed\") return c.json({ error: \"unknown action\" }, 400);\n await resolveReviewItem(id, action);\n return c.json({ ok: true });\n});\n\n/** Rebuild the decision inbox on demand — the same routine the daily cron runs. */\napp.post(\"/api/review/refresh\", async (c) => {\n const created = await generateReviewItems();\n return c.json({ created: created.length, items: created });\n});\n\n/**\n * Paste an email here to see exactly what the inbound handler would do with it,\n * without having to send real mail. Writes for real, so it is the fastest way to\n * check extraction against a receipt you actually received.\n */\napp.post(\"/api/email/simulate\", async (c) => {\n const body = await c.req.json() as {\n from?: string;\n subject?: string;\n text?: string;\n html?: string;\n messageId?: string;\n };\n if (!body.text && !body.html) return c.json({ error: \"text or html is required\" }, 400);\n const result = await handleInbound({\n from: body.from ?? \"test@example.com\",\n subject: body.subject ?? null,\n text: body.text ?? null,\n html: body.html ?? null,\n messageId: body.messageId ?? null,\n });\n return c.json(result);\n});\n\n// Full stack traces in the val logs rather than a swallowed 500.\napp.onError((err) => Promise.reject(err));\n\nfunction parseSubscriptionBody(body: Record):\n | { value: Parameters[0] }\n | { error: string }\n{\n const serviceName = String(body.serviceName ?? \"\").trim();\n if (!serviceName) return { error: \"serviceName is required\" };\n\n const amountMinor = body.amountMinor != null\n ? Math.round(Number(body.amountMinor))\n : toMinor(Number(body.amount));\n if (!Number.isFinite(amountMinor) || amountMinor <= 0) return { error: \"amount must be a positive number\" };\n\n const currency = String(body.currency ?? \"PLN\").toUpperCase() as Currency;\n if (!CURRENCIES.includes(currency)) return { error: `currency must be one of ${CURRENCIES.join(\", \")}` };\n\n const billingCycle = body.billingCycle === \"yearly\" ? \"yearly\" : \"monthly\" as BillingCycle;\n\n return {\n value: {\n serviceName,\n planName: body.planName ? String(body.planName) : null,\n amountMinor,\n currency,\n billingCycle,\n startedOn: body.startedOn ? String(body.startedOn) : null,\n nextChargeOn: body.nextChargeOn ? String(body.nextChargeOn) : null,\n category: body.category ? String(body.category) : null,\n paymentMethod: body.paymentMethod ? String(body.paymentMethod) : null,\n notes: body.notes ? String(body.notes) : null,\n source: \"manual\",\n },\n };\n}\n\nexport default oauthMiddleware(app.fetch);\n","deleted",false,"label","xdv-subscriptions",[14],"5588f200-1c41-400f-bf66-81f9f6ac0211",["D",1788290256185],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Track subscriptions, forecast spend, decide what to cancel","imageUrl","userId","5f1525c6-51a0-4c57-858d-f94f1e686d46","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a05e29-777a-77c1-a910-e4a1d8102a40","tursoName","5588f2001c41400fbf6681f9f6ac0211","tursoHostname","5588f2001c41400fbf6681f9f6ac0211-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789509043237],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_105":-5},"org",{"_9":10,"_99":100,"_101":-5,"_56":-5,"_102":103,"_104":42},"branch",{"_35":89,"_11":90,"_22":28,"_91":46,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":12,"_98":10},"isOwned",92,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","xd.ventures","avatar","tier","free","canRestrictVals","profileImageUrl","ctx",{"_82":-5,"_139":140,"_141":142,"_143":144,"_145":42,"_146":42,"_147":42,"_148":32,"_149":-5,"_150":-7,"_151":-7,"_152":63,"_153":42,"_154":42,"_155":-5,"_156":42,"_157":42,"_158":42,"_159":-5},"ENV",{"_110":111,"_112":113,"_114":90,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]