Baseline

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_169":170,"_171":172},"routes/_app.x.$handle.$name",{"_96":95,"_32":45,"_105":86,"_27":106,"_13":14,"_107":-5,"_11":108,"_109":110,"_111":112,"_113":114,"_115":116,"_20":-5,"_117":-5,"_118":-5,"_119":25,"_120":121,"_122":58,"_123":-5,"_124":-5,"_125":126},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":25},"version",14,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","server.ts","latestPath","fileId","350674d2-b12e-11f1-8bab-1607ee4eb77e","name","fileType","http","content","import { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport ASSETS from \"./main.ts\";\nconst { ICON_B64, SW_JS, MANIFEST, PAGE } = ASSETS;\nconst SCHEMA = [\n `create table if not exists bt_config (\nid integer primary key check (id = 1),\njson text not null\n)`,\n `create table if not exists bt_user (\nid integer primary key autoincrement,\nemail text unique not null,\nname text not null,\npass text not null,\nrole text not null default 'member',\ncreated integer not null\n)`,\n `create table if not exists bt_session (\ntoken text primary key,\nuser_id integer not null,\ncreated integer not null,\nexpires integer not null\n)`,\n `create table if not exists bt_week (\nmonday text primary key,\nreleased integer not null default 0,\nreleased_at integer,\nreleased_by integer\n)`,\n `create table if not exists bt_slot (\ndate text primary key,\ncanceled integer not null default 0,\nreason text\n)`,\n `create table if not exists bt_signup (\ndate text not null,\nuser_id integer not null,\nat integer not null,\nprimary key (date, user_id)\n)`,\n `create table if not exists bt_msg (\nid integer primary key autoincrement,\nuser_id integer not null,\ntext text not null,\nat integer not null\n)`,\n `create table if not exists bt_meta (\nk text primary key,\nv text not null\n)`,\n `create table if not exists bt_push (\nsub_id text primary key,\nuser_id integer,\nendpoint text not null,\nsub text not null,\ncreated integer not null\n)`,\n];\nlet inited = false;\nasync function init() {\n if (inited) return;\n await sqlite.batch(SCHEMA);\n inited = true;\n}\nfunction rows(res: any): any[] {\n const cols: string[] = res.columns || [];\n return (res.rows || []).map((r: any) =>\n Array.isArray(r) ? Object.fromEntries(cols.map((c, i) => [c, r[i]])) : r\n );\n}\nfunction json(data: unknown, status = 200) {\n return new Response(JSON.stringify(data), {\n status,\n headers: {\n \"content-type\": \"application/json; charset=utf-8\",\n \"cache-control\": \"no-store\",\n },\n });\n}\nfunction jsonC(data: unknown, cookie: string | null, status = 200) {\n const h = new Headers({\n \"content-type\": \"application/json; charset=utf-8\",\n \"cache-control\": \"no-store\",\n });\n if (cookie) h.append(\"set-cookie\", cookie);\n return new Response(JSON.stringify(data), { status, headers: h });\n}\nasync function getConfig(): Promise {\n const r =\n rows(await sqlite.execute(\"select json from bt_config where id = 1\"))[0];\n return r ? JSON.parse(r.json) : null;\n}\nasync function userCount(): Promise {\n return Number(\n rows(await sqlite.execute(\"select count(*) c from bt_user\"))[0].c,\n );\n}\nfunction validTz(tz: string): boolean {\n try {\n new Intl.DateTimeFormat(\"en-US\", { timeZone: tz });\n return true;\n } catch {\n return false;\n }\n}\nfunction ymdInTz(date: Date, tz: string): string {\n const p = new Intl.DateTimeFormat(\"en-CA\", {\n timeZone: tz,\n year: \"numeric\",\n month: \"2-digit\",\n day: \"2-digit\",\n }).formatToParts(date);\n const g = (t: string) => p.find((x) => x.type === t)!.value;\n return `${g(\"year\")}-${g(\"month\")}-${g(\"day\")}`;\n}\nfunction addDays(ymd: string, n: number): string {\n const d = new Date(ymd + \"T12:00:00Z\");\n d.setUTCDate(d.getUTCDate() + n);\n return d.toISOString().slice(0, 10);\n}\nfunction dow(ymd: string): number {\n return new Date(ymd + \"T12:00:00Z\").getUTCDay();\n}\nfunction mondayOf(ymd: string): string {\n return addDays(ymd, -((dow(ymd) + 6) % 7));\n}\nfunction rangeLabel(a: string, b: string): string {\n const mon = (y: string) =>\n new Date(y + \"T12:00:00Z\").toLocaleDateString(\"en-US\", {\n month: \"short\",\n timeZone: \"UTC\",\n });\n const day = (y: string) => new Date(y + \"T12:00:00Z\").getUTCDate();\n if (a === b) return `${mon(a)} ${day(a)}`;\n return mon(a) === mon(b)\n ? `${mon(a)} ${day(a)}–${day(b)}`\n : `${mon(a)} ${day(a)} – ${mon(b)} ${day(b)}`;\n}\nconst EMAIL_RE = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\nfunction randomJoinCode(): string {\n const alphabet = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n let s = \"\";\n for (let i = 0; i < 6; i++) {\n s += alphabet[Math.floor(Math.random() * alphabet.length)];\n }\n return s;\n}\nfunction normalizeConfig(b: any): any {\n const maxPlayers = Math.max(\n 1,\n Math.min(12, Math.round(Number(b?.maxPlayers) || 4)),\n );\n let days = Array.isArray(b?.days)\n ? b.days.map(Number).filter((n: number) => n >= 0 && n <= 6)\n : [1, 2, 3, 4, 5];\n days = [...new Set(days)].sort((x, y) => x - y);\n if (!days.length) days = [1, 2, 3, 4, 5];\n const tz = validTz(String(b?.tz || \"\")) ? b.tz : \"America/Denver\";\n const contactEmail =\n typeof b?.contactEmail === \"string\" && EMAIL_RE.test(b.contactEmail.trim())\n ? b.contactEmail.trim()\n : \"\";\n const joinCode = (String(b?.joinCode || \"\").trim().slice(0, 40)) ||\n randomJoinCode();\n return { maxPlayers, days, tz, contactEmail, joinCode };\n}\nconst b64u = {\n enc(buf: ArrayBuffer | Uint8Array): string {\n const b = buf instanceof Uint8Array ? buf : new Uint8Array(buf);\n let s = \"\";\n for (let i = 0; i < b.length; i++) s += String.fromCharCode(b[i]);\n return btoa(s).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n },\n dec(str: string): Uint8Array {\n const s = str.replace(/-/g, \"+\").replace(/_/g, \"/\") +\n \"===\".slice((str.length + 3) % 4);\n const bin = atob(s);\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n },\n};\nfunction cat(...arrs: Uint8Array[]): Uint8Array {\n let len = 0;\n for (const a of arrs) len += a.length;\n const out = new Uint8Array(len);\n let o = 0;\n for (const a of arrs) {\n out.set(a, o);\n o += a.length;\n }\n return out;\n}\nasync function hmac(key: Uint8Array, data: Uint8Array): Promise {\n const k = await crypto.subtle.importKey(\n \"raw\",\n key,\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n return new Uint8Array(await crypto.subtle.sign(\"HMAC\", k, data));\n}\nasync function sha256hex(s: string): Promise {\n const d = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(d)].map((x) => x.toString(16).padStart(2, \"0\"))\n .join(\"\");\n}\nasync function ensureVapid(): Promise<{ pub: any; priv: any; rawPub: string }> {\n const row =\n rows(await sqlite.execute(\"select v from bt_meta where k = 'vapid'\"))[0];\n if (row) return JSON.parse(row.v);\n const kp = (await crypto.subtle.generateKey(\n { name: \"ECDSA\", namedCurve: \"P-256\" },\n true,\n [\"sign\", \"verify\"],\n )) as CryptoKeyPair;\n const pub = await crypto.subtle.exportKey(\"jwk\", kp.publicKey);\n const priv = await crypto.subtle.exportKey(\"jwk\", kp.privateKey);\n const rawPub = b64u.enc(\n cat(new Uint8Array([4]), b64u.dec(pub.x!), b64u.dec(pub.y!)),\n );\n const val = { pub, priv, rawPub };\n await sqlite.execute({\n sql:\n \"insert into bt_meta (k, v) values ('vapid', ?) on conflict(k) do nothing\",\n args: [JSON.stringify(val)],\n });\n const again =\n rows(await sqlite.execute(\"select v from bt_meta where k = 'vapid'\"))[0];\n return JSON.parse(again.v);\n}\nasync function vapidHeader(\n endpoint: string,\n vapid: any,\n subject: string,\n): Promise {\n const aud = new URL(endpoint).origin;\n const enc = (o: unknown) =>\n b64u.enc(new TextEncoder().encode(JSON.stringify(o)));\n const head = enc({ typ: \"JWT\", alg: \"ES256\" });\n const body = enc({\n aud,\n exp: Math.floor(Date.now() / 1000) + 12 * 3600,\n sub: subject,\n });\n const signingInput = new TextEncoder().encode(head + \".\" + body);\n const key = await crypto.subtle.importKey(\n \"jwk\",\n vapid.priv,\n { name: \"ECDSA\", namedCurve: \"P-256\" },\n false,\n [\"sign\"],\n );\n const sig = new Uint8Array(\n await crypto.subtle.sign(\n { name: \"ECDSA\", hash: \"SHA-256\" },\n key,\n signingInput,\n ),\n );\n const jwt = head + \".\" + body + \".\" + b64u.enc(sig);\n return `vapid t=${jwt}, k=${vapid.rawPub}`;\n}\nasync function pushOne(\n sub: any,\n message: string,\n vapid: any,\n subject: string,\n): Promise {\n const uaPublic = b64u.dec(sub.keys.p256dh);\n const authSecret = b64u.dec(sub.keys.auth);\n const asKp = (await crypto.subtle.generateKey(\n { name: \"ECDH\", namedCurve: \"P-256\" },\n true,\n [\"deriveBits\"],\n )) as CryptoKeyPair;\n const asPublic = new Uint8Array(\n await crypto.subtle.exportKey(\"raw\", asKp.publicKey),\n );\n const uaKey = await crypto.subtle.importKey(\n \"raw\",\n uaPublic,\n { name: \"ECDH\", namedCurve: \"P-256\" },\n false,\n [],\n );\n const ecdh = new Uint8Array(\n await crypto.subtle.deriveBits(\n { name: \"ECDH\", public: uaKey },\n asKp.privateKey,\n 256,\n ),\n );\n const salt = crypto.getRandomValues(new Uint8Array(16));\n const te = (s: string) => new TextEncoder().encode(s);\n const prkKey = await hmac(authSecret, ecdh);\n const keyInfo = cat(\n te(\"WebPush: info\\0\"),\n uaPublic,\n asPublic,\n new Uint8Array([1]),\n );\n const ikm = (await hmac(prkKey, keyInfo)).slice(0, 32);\n const prk = await hmac(salt, ikm);\n const cek =\n (await hmac(\n prk,\n cat(te(\"Content-Encoding: aes128gcm\\0\"), new Uint8Array([1])),\n )).slice(0, 16);\n const nonce =\n (await hmac(prk, cat(te(\"Content-Encoding: nonce\\0\"), new Uint8Array([1]))))\n .slice(0, 12);\n const plaintext = cat(te(message), new Uint8Array([2]));\n const aesKey = await crypto.subtle.importKey(\n \"raw\",\n cek,\n { name: \"AES-GCM\" },\n false,\n [\"encrypt\"],\n );\n const ciphertext = new Uint8Array(\n await crypto.subtle.encrypt(\n { name: \"AES-GCM\", iv: nonce, tagLength: 128 },\n aesKey,\n plaintext,\n ),\n );\n const rs = 4096;\n const header = cat(\n salt,\n new Uint8Array([\n (rs >>> 24) & 255,\n (rs >>> 16) & 255,\n (rs >>> 8) & 255,\n rs & 255,\n ]),\n new Uint8Array([asPublic.length]),\n asPublic,\n );\n const res = await fetch(sub.endpoint, {\n method: \"POST\",\n headers: {\n TTL: \"86400\",\n \"Content-Encoding\": \"aes128gcm\",\n \"Content-Type\": \"application/octet-stream\",\n Authorization: await vapidHeader(sub.endpoint, vapid, subject),\n },\n body: cat(header, ciphertext),\n });\n return res.status;\n}\nasync function notifyAll(\n title: string,\n body: string,\n url: string,\n tag: string,\n): Promise {\n const subs = rows(await sqlite.execute(\"select sub_id, sub from bt_push\"));\n if (!subs.length) return 0;\n const vapid = await ensureVapid();\n const cfg = await getConfig();\n const subject = \"mailto:\" + (cfg?.contactEmail || \"tennis@example.com\");\n const message = JSON.stringify({ title, body, url, tag });\n let ok = 0;\n await Promise.all(\n subs.map(async (r) => {\n try {\n const status = await pushOne(\n JSON.parse(r.sub),\n message,\n vapid,\n subject,\n );\n if (status >= 200 && status < 300) ok++;\n else if (status === 404 || status === 410) {\n await sqlite.execute({\n sql: \"delete from bt_push where sub_id = ?\",\n args: [r.sub_id],\n });\n }\n } catch (_e) { /* one bad subscriber shouldn't sink the batch */ }\n }),\n );\n return ok;\n}\nasync function pbkdf2(\n pw: string,\n salt: Uint8Array,\n iterations: number,\n): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(pw),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt, iterations, hash: \"SHA-256\" },\n key,\n 256,\n );\n return new Uint8Array(bits);\n}\nasync function hashPw(pw: string): Promise {\n const salt = crypto.getRandomValues(new Uint8Array(16));\n const iterations = 100000;\n const h = await pbkdf2(pw, salt, iterations);\n return \"pbkdf2$\" + iterations + \"$\" + b64u.enc(salt) + \"$\" + b64u.enc(h);\n}\nasync function verifyPw(pw: string, stored: string): Promise {\n const parts = String(stored || \"\").split(\"$\");\n if (parts.length !== 4 || parts[0] !== \"pbkdf2\") return false;\n const iterations = parseInt(parts[1], 10) || 100000;\n const salt = b64u.dec(parts[2]);\n const want = b64u.dec(parts[3]);\n const got = await pbkdf2(pw, salt, iterations);\n if (got.length !== want.length) return false;\n let diff = 0;\n for (let i = 0; i < got.length; i++) diff |= got[i] ^ want[i];\n return diff === 0;\n}\nfunction getCookie(req: Request, name: string): string | null {\n const raw = req.headers.get(\"cookie\");\n if (!raw) return null;\n const m = raw.match(new RegExp(\"(?:^|;\\\\s*)\" + name + \"=([^;]*)\"));\n return m ? decodeURIComponent(m[1]) : null;\n}\nconst SESSION_MS = 90 * 24 * 3600 * 1000;\nfunction sessCookie(token: string, maxAgeSec: number): string {\n return `bt_sess=${token}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAgeSec}`;\n}\nasync function makeSession(userId: number): Promise {\n const token = b64u.enc(crypto.getRandomValues(new Uint8Array(32)));\n const now = Date.now();\n await sqlite.execute({\n sql: \"delete from bt_session where expires < ?\",\n args: [now],\n });\n await sqlite.execute({\n sql:\n \"insert into bt_session (token, user_id, created, expires) values (?, ?, ?, ?)\",\n args: [token, userId, now, now + SESSION_MS],\n });\n return token;\n}\nasync function currentUser(req: Request): Promise {\n const token = getCookie(req, \"bt_sess\");\n if (!token) return null;\n const s = rows(\n await sqlite.execute({\n sql: \"select user_id, expires from bt_session where token = ?\",\n args: [token],\n }),\n )[0];\n if (!s || Number(s.expires) < Date.now()) return null;\n const u = rows(\n await sqlite.execute({\n sql: \"select id, email, name, role from bt_user where id = ?\",\n args: [s.user_id],\n }),\n )[0];\n return u || null;\n}\nasync function adminCount(): Promise {\n return Number(\n rows(\n await sqlite.execute(\n \"select count(*) c from bt_user where role = 'admin'\",\n ),\n )[0].c,\n );\n}\nasync function apiSetup(b: any) {\n if ((await userCount()) > 0) return json({ error: \"already_setup\" }, 409);\n const email = String(b?.email || \"\").trim().toLowerCase();\n const name = String(b?.name || \"\").trim();\n const pw = String(b?.password || \"\");\n if (!EMAIL_RE.test(email)) return json({ error: \"bad_email\" }, 400);\n if (name.length < 1 || name.length > 40) {\n return json({ error: \"bad_name\" }, 400);\n }\n if (pw.length < 8) return json({ error: \"weak_password\" }, 400);\n const cfg = normalizeConfig(b);\n await sqlite.execute({\n sql:\n \"insert into bt_config (id, json) values (1, ?) on conflict(id) do update set json = excluded.json\",\n args: [JSON.stringify(cfg)],\n });\n const r = await sqlite.execute({\n sql:\n \"insert into bt_user (email, name, pass, role, created) values (?, ?, ?, 'admin', ?)\",\n args: [email, name, await hashPw(pw), Date.now()],\n });\n const token = await makeSession(Number(r.lastInsertRowid));\n return jsonC({ ok: true }, sessCookie(token, SESSION_MS / 1000));\n}\nasync function apiRegister(b: any) {\n const cfg = await getConfig();\n if (!cfg) return json({ error: \"not_setup\" }, 400);\n const email = String(b?.email || \"\").trim().toLowerCase();\n const name = String(b?.name || \"\").trim();\n const pw = String(b?.password || \"\");\n const code = String(b?.joinCode || \"\").trim();\n if (!code || code.toLowerCase() !== String(cfg.joinCode).toLowerCase()) {\n return json({ error: \"bad_join_code\" }, 403);\n }\n if (!EMAIL_RE.test(email)) return json({ error: \"bad_email\" }, 400);\n if (name.length < 1 || name.length > 40) {\n return json({ error: \"bad_name\" }, 400);\n }\n if (pw.length < 8) return json({ error: \"weak_password\" }, 400);\n const exists = rows(\n await sqlite.execute({\n sql: \"select 1 from bt_user where email = ?\",\n args: [email],\n }),\n )[0];\n if (exists) return json({ error: \"email_taken\" }, 409);\n const r = await sqlite.execute({\n sql:\n \"insert into bt_user (email, name, pass, role, created) values (?, ?, ?, 'member', ?)\",\n args: [email, name, await hashPw(pw), Date.now()],\n });\n const token = await makeSession(Number(r.lastInsertRowid));\n return jsonC({ ok: true }, sessCookie(token, SESSION_MS / 1000));\n}\nasync function apiLogin(b: any) {\n const email = String(b?.email || \"\").trim().toLowerCase();\n const pw = String(b?.password || \"\");\n const u = rows(\n await sqlite.execute({\n sql: \"select id, pass from bt_user where email = ?\",\n args: [email],\n }),\n )[0];\n if (!u || !(await verifyPw(pw, u.pass))) {\n return json({ error: \"bad_login\" }, 401);\n }\n const token = await makeSession(Number(u.id));\n return jsonC({ ok: true }, sessCookie(token, SESSION_MS / 1000));\n}\nasync function apiLogout(req: Request) {\n const token = getCookie(req, \"bt_sess\");\n if (token) {\n await sqlite.execute({\n sql: \"delete from bt_session where token = ?\",\n args: [token],\n });\n }\n return jsonC(\n { ok: true },\n \"bt_sess=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0\",\n );\n}\nasync function apiMe(user: any, b: any) {\n const name = typeof b?.name === \"string\" ? b.name.trim() : null;\n const pw = typeof b?.password === \"string\" && b.password ? b.password : null;\n if (name != null) {\n if (name.length < 1 || name.length > 40) {\n return json({ error: \"bad_name\" }, 400);\n }\n await sqlite.execute({\n sql: \"update bt_user set name = ? where id = ?\",\n args: [name, user.id],\n });\n }\n if (pw != null) {\n if (pw.length < 8) return json({ error: \"weak_password\" }, 400);\n await sqlite.execute({\n sql: \"update bt_user set pass = ? where id = ?\",\n args: [await hashPw(pw), user.id],\n });\n }\n return json({ ok: true });\n}\nasync function apiUsers(user: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n return json({\n users: rows(\n await sqlite.execute(\n \"select id, email, name, role, created from bt_user order by created asc\",\n ),\n ),\n });\n}\nasync function apiUserRole(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const id = Number(b?.userId);\n const role = b?.role === \"admin\" ? \"admin\" : \"member\";\n if (!id) return json({ error: \"bad_request\" }, 400);\n if (role === \"member\") {\n const target =\n rows(\n await sqlite.execute({\n sql: \"select role from bt_user where id = ?\",\n args: [id],\n }),\n )[0];\n if (target && target.role === \"admin\" && (await adminCount()) <= 1) {\n return json({ error: \"last_admin\" }, 409);\n }\n }\n await sqlite.execute({\n sql: \"update bt_user set role = ? where id = ?\",\n args: [role, id],\n });\n return json({ ok: true });\n}\nasync function apiUserRemove(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const id = Number(b?.userId);\n if (!id) return json({ error: \"bad_request\" }, 400);\n if (id === user.id) return json({ error: \"self\" }, 409);\n const target =\n rows(\n await sqlite.execute({\n sql: \"select role from bt_user where id = ?\",\n args: [id],\n }),\n )[0];\n if (target && target.role === \"admin\" && (await adminCount()) <= 1) {\n return json({ error: \"last_admin\" }, 409);\n }\n await sqlite.batch([\n { sql: \"delete from bt_user where id = ?\", args: [id] },\n { sql: \"delete from bt_session where user_id = ?\", args: [id] },\n { sql: \"delete from bt_signup where user_id = ?\", args: [id] },\n { sql: \"delete from bt_push where user_id = ?\", args: [id] },\n ]);\n return json({ ok: true });\n}\nasync function apiUserResetPw(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const id = Number(b?.userId);\n const pw = String(b?.password || \"\");\n if (!id || pw.length < 8) return json({ error: \"bad_request\" }, 400);\n await sqlite.execute({\n sql: \"update bt_user set pass = ? where id = ?\",\n args: [await hashPw(pw), id],\n });\n await sqlite.execute({\n sql: \"delete from bt_session where user_id = ?\",\n args: [id],\n });\n return json({ ok: true });\n}\nasync function apiConfig(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const cur = await getConfig();\n // A partial update (e.g. just a new join code) must not silently reset the\n // fields the caller didn't send -- fall back to the current value for each.\n const cfg = normalizeConfig({\n maxPlayers: b?.maxPlayers ?? cur?.maxPlayers,\n days: b?.days ?? cur?.days,\n tz: b?.tz ?? cur?.tz,\n contactEmail: b?.contactEmail ?? cur?.contactEmail,\n joinCode: b?.joinCode ?? cur?.joinCode,\n });\n await sqlite.execute({\n sql: \"update bt_config set json = ? where id = 1\",\n args: [JSON.stringify(cfg)],\n });\n return json({ ok: true });\n}\nasync function buildState(user: any) {\n const cfg = await getConfig();\n const isAdmin = user.role === \"admin\";\n const today = ymdInTz(new Date(), cfg.tz);\n const monday0 = mondayOf(today);\n const relRows = rows(\n await sqlite.execute(\"select monday, released from bt_week\"),\n );\n const relSet = new Set(\n relRows.filter((r) => r.released).map((r) => r.monday),\n );\n const LABELS = [\"This week\", \"Next week\", \"In 2 weeks\"];\n const weeksMeta: {\n label: string;\n monday: string;\n released: boolean;\n dates: string[];\n }[] = [];\n for (let w = 0; w < LABELS.length; w++) {\n const monday = addDays(monday0, w * 7);\n const released = relSet.has(monday);\n if (!isAdmin && !released) continue;\n const dates: string[] = [];\n for (let i = 0; i < 7; i++) {\n const d = addDays(monday, i);\n if (cfg.days.includes(dow(d))) dates.push(d);\n }\n weeksMeta.push({ label: LABELS[w], monday, released, dates });\n }\n const wantDates: string[] = [];\n for (const w of weeksMeta) wantDates.push(...w.dates);\n let signups: any[] = [];\n let slots: any[] = [];\n if (wantDates.length) {\n const ph = wantDates.map(() => \"?\").join(\",\");\n signups = rows(\n await sqlite.execute({\n sql: `select s.date, s.user_id, s.at, u.name\nfrom bt_signup s join bt_user u on u.id = s.user_id\nwhere s.date in (${ph}) order by s.at asc`,\n args: wantDates,\n }),\n );\n slots = rows(\n await sqlite.execute({\n sql: `select date, canceled, reason from bt_slot where date in (${ph})`,\n args: wantDates,\n }),\n );\n }\n const slotBy: Record = {};\n for (const s of slots) slotBy[s.date] = s;\n const suBy: Record = {};\n for (const r of signups) {\n (suBy[r.date] = suBy[r.date] || []).push({\n userId: r.user_id,\n name: r.name,\n at: r.at,\n });\n }\n const chatLatest = Number(\n rows(await sqlite.execute(\"select max(at) m from bt_msg\"))[0]?.m || 0,\n );\n return {\n me: { id: user.id, name: user.name, email: user.email, role: user.role },\n chatLatest,\n config: isAdmin\n ? {\n maxPlayers: cfg.maxPlayers,\n days: cfg.days,\n tz: cfg.tz,\n contactEmail: cfg.contactEmail || \"\",\n joinCode: cfg.joinCode,\n }\n : { maxPlayers: cfg.maxPlayers },\n weeks: weeksMeta.map((w) => ({\n key: w.label,\n monday: w.monday,\n released: w.released,\n range: w.dates.length\n ? rangeLabel(w.dates[0], w.dates[w.dates.length - 1])\n : \"\",\n slots: w.dates.map((d) => {\n const sl = slotBy[d] || {};\n return {\n date: d,\n canceled: !!sl.canceled,\n reason: sl.reason || null,\n past: d < today,\n players: suBy[d] || [],\n };\n }),\n })),\n };\n}\nasync function apiClaim(user: any, b: any) {\n const cfg = await getConfig();\n const date = b?.date;\n if (typeof date !== \"string\") return json({ error: \"bad_request\" }, 400);\n if (date < ymdInTz(new Date(), cfg.tz)) return json({ error: \"past\" }, 409);\n let targetId = user.id;\n if (b?.userId != null && Number(b.userId) !== user.id) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n targetId = Number(b.userId);\n const exists = rows(\n await sqlite.execute({\n sql: \"select 1 from bt_user where id = ?\",\n args: [targetId],\n }),\n )[0];\n if (!exists) return json({ error: \"bad_request\" }, 400);\n }\n const wk = rows(\n await sqlite.execute({\n sql: \"select released from bt_week where monday = ?\",\n args: [mondayOf(date)],\n }),\n )[0];\n const released = !!(wk && wk.released);\n if (!released && user.role !== \"admin\") return json({ error: \"hidden\" }, 403);\n const sl = rows(\n await sqlite.execute({\n sql: \"select canceled from bt_slot where date = ?\",\n args: [date],\n }),\n )[0];\n if (sl && sl.canceled) return json({ error: \"canceled\" }, 409);\n const res = await sqlite.execute({\n sql: `insert into bt_signup (date, user_id, at)\nselect ?, ?, ?\nwhere (select count(*) from bt_signup where date = ?) < ?\nand not exists (select 1 from bt_signup where date = ? and user_id = ?)`,\n args: [date, targetId, Date.now(), date, cfg.maxPlayers, date, targetId],\n });\n if (!res.rowsAffected) {\n const already = rows(\n await sqlite.execute({\n sql: \"select 1 from bt_signup where date = ? and user_id = ?\",\n args: [date, targetId],\n }),\n )[0];\n return already ? json({ ok: true }) : json({ error: \"full\" }, 409);\n }\n return json({ ok: true });\n}\nasync function apiRelease(user: any, b: any) {\n const date = b?.date;\n if (typeof date !== \"string\") return json({ error: \"bad_request\" }, 400);\n let targetId = user.id;\n if (b?.userId != null && Number(b.userId) !== user.id) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n targetId = Number(b.userId);\n }\n const del = await sqlite.execute({\n sql: \"delete from bt_signup where date = ? and user_id = ?\",\n args: [date, targetId],\n });\n return json({ ok: !!del.rowsAffected });\n}\nasync function apiReleaseWeek(user: any, b: any, unrelease: boolean) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const monday = b?.monday;\n if (typeof monday !== \"string\") return json({ error: \"bad_request\" }, 400);\n await sqlite.execute({\n sql:\n `insert into bt_week (monday, released, released_at, released_by) values (?, ?, ?, ?)\non conflict(monday) do update set\nreleased = excluded.released,\nreleased_at = excluded.released_at,\nreleased_by = excluded.released_by`,\n args: [monday, unrelease ? 0 : 1, Date.now(), user.id],\n });\n let sent = 0;\n if (!unrelease) {\n const cfg = await getConfig();\n const ds: string[] = [];\n for (let i = 0; i < 7; i++) {\n const d = addDays(monday, i);\n if (cfg.days.includes(dow(d))) ds.push(d);\n }\n const label = ds.length ? rangeLabel(ds[0], ds[ds.length - 1]) : monday;\n try {\n sent = await notifyAll(\n \"🎾 Schedule is open\",\n `${label} — pick your days`,\n \"/\",\n \"wk-\" + monday,\n );\n } catch (_e) { /* releasing still succeeds */ }\n }\n return json({ ok: true, sent });\n}\nasync function apiCancel(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const date = b?.date;\n if (typeof date !== \"string\") return json({ error: \"bad_request\" }, 400);\n if (b?.canceled) {\n await sqlite.execute({\n sql: `insert into bt_slot (date, canceled, reason) values (?, 1, ?)\non conflict(date) do update set canceled = 1, reason = excluded.reason`,\n args: [date, String(b?.reason || \"\").slice(0, 140)],\n });\n await sqlite.execute({\n sql: \"delete from bt_signup where date = ?\",\n args: [date],\n });\n } else {\n await sqlite.execute({\n sql: \"update bt_slot set canceled = 0, reason = null where date = ?\",\n args: [date],\n });\n }\n return json({ ok: true });\n}\nasync function apiClearDay(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n if (typeof b?.date !== \"string\") return json({ error: \"bad_request\" }, 400);\n await sqlite.execute({\n sql: \"delete from bt_signup where date = ?\",\n args: [b.date],\n });\n return json({ ok: true });\n}\nasync function apiNotify(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const monday = b?.monday;\n if (typeof monday !== \"string\") return json({ error: \"bad_request\" }, 400);\n const cfg = await getConfig();\n const ds: string[] = [];\n for (let i = 0; i < 7; i++) {\n const d = addDays(monday, i);\n if (cfg.days.includes(dow(d))) ds.push(d);\n }\n if (!ds.length) return json({ ok: true, sent: 0 });\n const ph = ds.map(() => \"?\").join(\",\");\n const counts = rows(\n await sqlite.execute({\n sql:\n `select date, count(*) c from bt_signup where date in (${ph}) group by date`,\n args: ds,\n }),\n );\n const canceled = new Set(\n rows(\n await sqlite.execute({\n sql: `select date from bt_slot where date in (${ph}) and canceled = 1`,\n args: ds,\n }),\n ).map((r) => r.date),\n );\n const cmap: Record = {};\n for (const r of counts) cmap[r.date] = Number(r.c);\n let open = 0;\n for (const d of ds) {\n if (canceled.has(d)) continue;\n open += Math.max(0, cfg.maxPlayers - (cmap[d] || 0));\n }\n const label = rangeLabel(ds[0], ds[ds.length - 1]);\n const body = open > 0\n ? `${label} — ${open} spot${open === 1 ? \"\" : \"s\"} still open`\n : `${label} — all full`;\n const sent = await notifyAll(\"🎾 Tennis sign-up\", body, \"/\", \"wk-\" + monday);\n return json({ ok: true, sent });\n}\nasync function apiReset(user: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n await sqlite.batch([\n \"delete from bt_signup\",\n \"delete from bt_slot\",\n \"delete from bt_week\",\n ]);\n return json({ ok: true });\n}\nasync function apiChatGet(url: URL) {\n const since = Number(url.searchParams.get(\"since\") || 0);\n const msgs = since\n ? rows(\n await sqlite.execute({\n sql:\n `select m.id, m.text, m.at, u.name from bt_msg m join bt_user u on u.id = m.user_id\nwhere m.at > ? order by m.at asc limit 200`,\n args: [since],\n }),\n )\n : rows(\n await sqlite.execute(\n `select m.id, m.text, m.at, u.name from bt_msg m join bt_user u on u.id = m.user_id\norder by m.id desc limit 80`,\n ),\n ).reverse();\n return json({ messages: msgs });\n}\nasync function apiChatPost(user: any, b: any) {\n const text = String(b?.text || \"\").trim().slice(0, 800);\n if (!text) return json({ error: \"bad_request\" }, 400);\n const at = Date.now();\n await sqlite.execute({\n sql: \"insert into bt_msg (user_id, text, at) values (?, ?, ?)\",\n args: [user.id, text, at],\n });\n await sqlite.execute(\n \"delete from bt_msg where id not in (select id from bt_msg order by id desc limit 300)\",\n );\n return json({ ok: true, at });\n}\nasync function apiPushSubscribe(user: any, b: any) {\n const sub = b?.sub;\n if (!sub || typeof sub.endpoint !== \"string\" || !sub.keys) {\n return json({ error: \"bad_request\" }, 400);\n }\n const id = await sha256hex(sub.endpoint);\n await sqlite.execute({\n sql:\n `insert into bt_push (sub_id, user_id, endpoint, sub, created) values (?, ?, ?, ?, ?)\non conflict(sub_id) do update set user_id = excluded.user_id, sub = excluded.sub`,\n args: [id, user.id, sub.endpoint, JSON.stringify(sub), Date.now()],\n });\n return json({ ok: true });\n}\nasync function apiPushUnsubscribe(b: any) {\n if (typeof b?.endpoint === \"string\") {\n await sqlite.execute({\n sql: \"delete from bt_push where endpoint = ?\",\n args: [b.endpoint],\n });\n }\n return json({ ok: true });\n}\nexport default async function handler(req: Request): Promise {\n await init();\n const url = new URL(req.url);\n const p = url.pathname;\n const GET = req.method === \"GET\";\n const POST = req.method === \"POST\";\n try {\n if (GET && (p === \"/\" || p === \"/index.html\")) {\n return new Response(PAGE, {\n headers: {\n \"content-type\": \"text/html; charset=utf-8\",\n \"cache-control\": \"no-store\",\n },\n });\n }\n if (GET && p === \"/sw.js\") {\n return new Response(SW_JS, {\n headers: {\n \"content-type\": \"text/javascript; charset=utf-8\",\n \"cache-control\": \"no-cache\",\n },\n });\n }\n if (GET && p === \"/manifest.webmanifest\") {\n return new Response(MANIFEST, {\n headers: { \"content-type\": \"application/manifest+json; charset=utf-8\" },\n });\n }\n if (GET && p === \"/icon-192.png\") {\n return new Response(b64u.dec(ICON_B64), {\n headers: {\n \"content-type\": \"image/png\",\n \"cache-control\": \"public, max-age=86400\",\n },\n });\n }\n const user = await currentUser(req);\n if (GET && p === \"/api/state\") {\n if ((await userCount()) === 0) return json({ needsSetup: true });\n if (!user) return json({ needsAuth: true });\n return json(await buildState(user));\n }\n if (GET && p === \"/api/vapid\") {\n const v = await ensureVapid();\n return json({ key: v.rawPub });\n }\n if (GET && p === \"/api/chat\") {\n if (!user) return json({ error: \"unauth\" }, 401);\n return await apiChatGet(url);\n }\n if (GET && p === \"/api/users\") {\n if (!user) return json({ error: \"unauth\" }, 401);\n return await apiUsers(user);\n }\n if (POST) {\n const b = await req.json().catch(() => ({}));\n if (p === \"/api/setup\") return await apiSetup(b);\n if (p === \"/api/register\") return await apiRegister(b);\n if (p === \"/api/login\") return await apiLogin(b);\n if (p === \"/api/logout\") return await apiLogout(req);\n if (!user) return json({ error: \"unauth\" }, 401);\n if (p === \"/api/me\") return await apiMe(user, b);\n if (p === \"/api/claim\") return await apiClaim(user, b);\n if (p === \"/api/release-spot\") return await apiRelease(user, b);\n if (p === \"/api/release-week\") {\n return await apiReleaseWeek(user, b, false);\n }\n if (p === \"/api/hide-week\") return await apiReleaseWeek(user, b, true);\n if (p === \"/api/cancel\") return await apiCancel(user, b);\n if (p === \"/api/clear-day\") return await apiClearDay(user, b);\n if (p === \"/api/notify\") return await apiNotify(user, b);\n if (p === \"/api/reset\") return await apiReset(user);\n if (p === \"/api/chat\") return await apiChatPost(user, b);\n if (p === \"/api/push/subscribe\") return await apiPushSubscribe(user, b);\n if (p === \"/api/push/unsubscribe\") return await apiPushUnsubscribe(b);\n if (p === \"/api/config\") return await apiConfig(user, b);\n if (p === \"/api/user/role\") return await apiUserRole(user, b);\n if (p === \"/api/user/remove\") return await apiUserRemove(user, b);\n if (p === \"/api/user/reset-password\") {\n return await apiUserResetPw(user, b);\n }\n }\n return new Response(\"Not found\", { status: 404 });\n } catch (err) {\n console.error(err);\n return json({ error: \"server_error\", detail: String(err) }, 500);\n }\n}","import { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport ASSETS from \"./main.ts\";\nconst { ICON_B64, SW_JS, MANIFEST, PAGE } = ASSETS;\nconst SCHEMA = [\n `create table if not exists bt_config (\nid integer primary key check (id = 1),\njson text not null\n)`,\n `create table if not exists bt_user (\nid integer primary key autoincrement,\nemail text unique not null,\nname text not null,\npass text not null,\nrole text not null default 'member',\ncreated integer not null\n)`,\n `create table if not exists bt_session (\ntoken text primary key,\nuser_id integer not null,\ncreated integer not null,\nexpires integer not null\n)`,\n `create table if not exists bt_week (\nmonday text primary key,\nreleased integer not null default 0,\nreleased_at integer,\nreleased_by integer\n)`,\n `create table if not exists bt_slot (\ndate text primary key,\ncanceled integer not null default 0,\nreason text\n)`,\n `create table if not exists bt_signup (\ndate text not null,\nuser_id integer not null,\nat integer not null,\nprimary key (date, user_id)\n)`,\n `create table if not exists bt_msg (\nid integer primary key autoincrement,\nuser_id integer not null,\ntext text not null,\nat integer not null\n)`,\n `create table if not exists bt_meta (\nk text primary key,\nv text not null\n)`,\n `create table if not exists bt_push (\nsub_id text primary key,\nuser_id integer,\nendpoint text not null,\nsub text not null,\ncreated integer not null\n)`,\n `create table if not exists bt_notif_pref (\nuser_id integer primary key,\nnotify_release integer not null default 1,\nnotify_messages integer not null default 1\n)`,\n];\nlet inited = false;\nasync function init() {\n if (inited) return;\n await sqlite.batch(SCHEMA);\n inited = true;\n}\nfunction rows(res: any): any[] {\n const cols: string[] = res.columns || [];\n return (res.rows || []).map((r: any) =>\n Array.isArray(r) ? Object.fromEntries(cols.map((c, i) => [c, r[i]])) : r\n );\n}\nfunction json(data: unknown, status = 200) {\n return new Response(JSON.stringify(data), {\n status,\n headers: {\n \"content-type\": \"application/json; charset=utf-8\",\n \"cache-control\": \"no-store\",\n },\n });\n}\nfunction jsonC(data: unknown, cookie: string | null, status = 200) {\n const h = new Headers({\n \"content-type\": \"application/json; charset=utf-8\",\n \"cache-control\": \"no-store\",\n });\n if (cookie) h.append(\"set-cookie\", cookie);\n return new Response(JSON.stringify(data), { status, headers: h });\n}\nasync function getConfig(): Promise {\n const r =\n rows(await sqlite.execute(\"select json from bt_config where id = 1\"))[0];\n return r ? JSON.parse(r.json) : null;\n}\nasync function userCount(): Promise {\n return Number(\n rows(await sqlite.execute(\"select count(*) c from bt_user\"))[0].c,\n );\n}\nfunction validTz(tz: string): boolean {\n try {\n new Intl.DateTimeFormat(\"en-US\", { timeZone: tz });\n return true;\n } catch {\n return false;\n }\n}\nfunction ymdInTz(date: Date, tz: string): string {\n const p = new Intl.DateTimeFormat(\"en-CA\", {\n timeZone: tz,\n year: \"numeric\",\n month: \"2-digit\",\n day: \"2-digit\",\n }).formatToParts(date);\n const g = (t: string) => p.find((x) => x.type === t)!.value;\n return `${g(\"year\")}-${g(\"month\")}-${g(\"day\")}`;\n}\nfunction addDays(ymd: string, n: number): string {\n const d = new Date(ymd + \"T12:00:00Z\");\n d.setUTCDate(d.getUTCDate() + n);\n return d.toISOString().slice(0, 10);\n}\nfunction dow(ymd: string): number {\n return new Date(ymd + \"T12:00:00Z\").getUTCDay();\n}\nfunction mondayOf(ymd: string): string {\n return addDays(ymd, -((dow(ymd) + 6) % 7));\n}\nfunction rangeLabel(a: string, b: string): string {\n const mon = (y: string) =>\n new Date(y + \"T12:00:00Z\").toLocaleDateString(\"en-US\", {\n month: \"short\",\n timeZone: \"UTC\",\n });\n const day = (y: string) => new Date(y + \"T12:00:00Z\").getUTCDate();\n if (a === b) return `${mon(a)} ${day(a)}`;\n return mon(a) === mon(b)\n ? `${mon(a)} ${day(a)}–${day(b)}`\n : `${mon(a)} ${day(a)} – ${mon(b)} ${day(b)}`;\n}\nconst EMAIL_RE = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\nfunction randomJoinCode(): string {\n const alphabet = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n let s = \"\";\n for (let i = 0; i < 6; i++) {\n s += alphabet[Math.floor(Math.random() * alphabet.length)];\n }\n return s;\n}\nfunction normalizeConfig(b: any): any {\n const maxPlayers = Math.max(\n 1,\n Math.min(12, Math.round(Number(b?.maxPlayers) || 4)),\n );\n let days = Array.isArray(b?.days)\n ? b.days.map(Number).filter((n: number) => n >= 0 && n <= 6)\n : [1, 2, 3, 4, 5];\n days = [...new Set(days)].sort((x, y) => x - y);\n if (!days.length) days = [1, 2, 3, 4, 5];\n const tz = validTz(String(b?.tz || \"\")) ? b.tz : \"America/Denver\";\n const joinCode = (String(b?.joinCode || \"\").trim().slice(0, 40)) ||\n randomJoinCode();\n return { maxPlayers, days, tz, joinCode };\n}\nconst b64u = {\n enc(buf: ArrayBuffer | Uint8Array): string {\n const b = buf instanceof Uint8Array ? buf : new Uint8Array(buf);\n let s = \"\";\n for (let i = 0; i < b.length; i++) s += String.fromCharCode(b[i]);\n return btoa(s).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n },\n dec(str: string): Uint8Array {\n const s = str.replace(/-/g, \"+\").replace(/_/g, \"/\") +\n \"===\".slice((str.length + 3) % 4);\n const bin = atob(s);\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n },\n};\nfunction cat(...arrs: Uint8Array[]): Uint8Array {\n let len = 0;\n for (const a of arrs) len += a.length;\n const out = new Uint8Array(len);\n let o = 0;\n for (const a of arrs) {\n out.set(a, o);\n o += a.length;\n }\n return out;\n}\nasync function hmac(key: Uint8Array, data: Uint8Array): Promise {\n const k = await crypto.subtle.importKey(\n \"raw\",\n key,\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n return new Uint8Array(await crypto.subtle.sign(\"HMAC\", k, data));\n}\nasync function sha256hex(s: string): Promise {\n const d = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(d)].map((x) => x.toString(16).padStart(2, \"0\"))\n .join(\"\");\n}\nasync function ensureVapid(): Promise<{ pub: any; priv: any; rawPub: string }> {\n const row =\n rows(await sqlite.execute(\"select v from bt_meta where k = 'vapid'\"))[0];\n if (row) return JSON.parse(row.v);\n const kp = (await crypto.subtle.generateKey(\n { name: \"ECDSA\", namedCurve: \"P-256\" },\n true,\n [\"sign\", \"verify\"],\n )) as CryptoKeyPair;\n const pub = await crypto.subtle.exportKey(\"jwk\", kp.publicKey);\n const priv = await crypto.subtle.exportKey(\"jwk\", kp.privateKey);\n const rawPub = b64u.enc(\n cat(new Uint8Array([4]), b64u.dec(pub.x!), b64u.dec(pub.y!)),\n );\n const val = { pub, priv, rawPub };\n await sqlite.execute({\n sql:\n \"insert into bt_meta (k, v) values ('vapid', ?) on conflict(k) do nothing\",\n args: [JSON.stringify(val)],\n });\n const again =\n rows(await sqlite.execute(\"select v from bt_meta where k = 'vapid'\"))[0];\n return JSON.parse(again.v);\n}\nasync function vapidHeader(\n endpoint: string,\n vapid: any,\n subject: string,\n): Promise {\n const aud = new URL(endpoint).origin;\n const enc = (o: unknown) =>\n b64u.enc(new TextEncoder().encode(JSON.stringify(o)));\n const head = enc({ typ: \"JWT\", alg: \"ES256\" });\n const body = enc({\n aud,\n exp: Math.floor(Date.now() / 1000) + 12 * 3600,\n sub: subject,\n });\n const signingInput = new TextEncoder().encode(head + \".\" + body);\n const key = await crypto.subtle.importKey(\n \"jwk\",\n vapid.priv,\n { name: \"ECDSA\", namedCurve: \"P-256\" },\n false,\n [\"sign\"],\n );\n const sig = new Uint8Array(\n await crypto.subtle.sign(\n { name: \"ECDSA\", hash: \"SHA-256\" },\n key,\n signingInput,\n ),\n );\n const jwt = head + \".\" + body + \".\" + b64u.enc(sig);\n return `vapid t=${jwt}, k=${vapid.rawPub}`;\n}\nasync function pushOne(\n sub: any,\n message: string,\n vapid: any,\n subject: string,\n): Promise {\n const uaPublic = b64u.dec(sub.keys.p256dh);\n const authSecret = b64u.dec(sub.keys.auth);\n const asKp = (await crypto.subtle.generateKey(\n { name: \"ECDH\", namedCurve: \"P-256\" },\n true,\n [\"deriveBits\"],\n )) as CryptoKeyPair;\n const asPublic = new Uint8Array(\n await crypto.subtle.exportKey(\"raw\", asKp.publicKey),\n );\n const uaKey = await crypto.subtle.importKey(\n \"raw\",\n uaPublic,\n { name: \"ECDH\", namedCurve: \"P-256\" },\n false,\n [],\n );\n const ecdh = new Uint8Array(\n await crypto.subtle.deriveBits(\n { name: \"ECDH\", public: uaKey },\n asKp.privateKey,\n 256,\n ),\n );\n const salt = crypto.getRandomValues(new Uint8Array(16));\n const te = (s: string) => new TextEncoder().encode(s);\n const prkKey = await hmac(authSecret, ecdh);\n const keyInfo = cat(\n te(\"WebPush: info\\0\"),\n uaPublic,\n asPublic,\n new Uint8Array([1]),\n );\n const ikm = (await hmac(prkKey, keyInfo)).slice(0, 32);\n const prk = await hmac(salt, ikm);\n const cek =\n (await hmac(\n prk,\n cat(te(\"Content-Encoding: aes128gcm\\0\"), new Uint8Array([1])),\n )).slice(0, 16);\n const nonce =\n (await hmac(prk, cat(te(\"Content-Encoding: nonce\\0\"), new Uint8Array([1]))))\n .slice(0, 12);\n const plaintext = cat(te(message), new Uint8Array([2]));\n const aesKey = await crypto.subtle.importKey(\n \"raw\",\n cek,\n { name: \"AES-GCM\" },\n false,\n [\"encrypt\"],\n );\n const ciphertext = new Uint8Array(\n await crypto.subtle.encrypt(\n { name: \"AES-GCM\", iv: nonce, tagLength: 128 },\n aesKey,\n plaintext,\n ),\n );\n const rs = 4096;\n const header = cat(\n salt,\n new Uint8Array([\n (rs >>> 24) & 255,\n (rs >>> 16) & 255,\n (rs >>> 8) & 255,\n rs & 255,\n ]),\n new Uint8Array([asPublic.length]),\n asPublic,\n );\n const res = await fetch(sub.endpoint, {\n method: \"POST\",\n headers: {\n TTL: \"86400\",\n \"Content-Encoding\": \"aes128gcm\",\n \"Content-Type\": \"application/octet-stream\",\n Authorization: await vapidHeader(sub.endpoint, vapid, subject),\n },\n body: cat(header, ciphertext),\n });\n return res.status;\n}\nasync function notifyAll(\n title: string,\n body: string,\n url: string,\n tag: string,\n category: \"release\" | \"messages\",\n excludeUserId?: number,\n): Promise {\n const col = category === \"messages\" ? \"notify_messages\" : \"notify_release\";\n const args: any[] = [];\n let sql = `select p.sub_id, p.sub from bt_push p\nleft join bt_notif_pref np on np.user_id = p.user_id\nwhere coalesce(np.${col}, 1) = 1`;\n if (excludeUserId) {\n sql += \" and p.user_id != ?\";\n args.push(excludeUserId);\n }\n const subs = rows(await sqlite.execute({ sql, args }));\n if (!subs.length) return 0;\n const vapid = await ensureVapid();\n const subject = \"mailto:tennis@example.com\";\n const message = JSON.stringify({ title, body, url, tag });\n let ok = 0;\n await Promise.all(\n subs.map(async (r) => {\n try {\n const status = await pushOne(\n JSON.parse(r.sub),\n message,\n vapid,\n subject,\n );\n if (status >= 200 && status < 300) ok++;\n else if (status === 404 || status === 410) {\n await sqlite.execute({\n sql: \"delete from bt_push where sub_id = ?\",\n args: [r.sub_id],\n });\n }\n } catch (_e) { /* one bad subscriber shouldn't sink the batch */ }\n }),\n );\n return ok;\n}\nasync function pbkdf2(\n pw: string,\n salt: Uint8Array,\n iterations: number,\n): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(pw),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt, iterations, hash: \"SHA-256\" },\n key,\n 256,\n );\n return new Uint8Array(bits);\n}\nasync function hashPw(pw: string): Promise {\n const salt = crypto.getRandomValues(new Uint8Array(16));\n const iterations = 100000;\n const h = await pbkdf2(pw, salt, iterations);\n return \"pbkdf2$\" + iterations + \"$\" + b64u.enc(salt) + \"$\" + b64u.enc(h);\n}\nasync function verifyPw(pw: string, stored: string): Promise {\n const parts = String(stored || \"\").split(\"$\");\n if (parts.length !== 4 || parts[0] !== \"pbkdf2\") return false;\n const iterations = parseInt(parts[1], 10) || 100000;\n const salt = b64u.dec(parts[2]);\n const want = b64u.dec(parts[3]);\n const got = await pbkdf2(pw, salt, iterations);\n if (got.length !== want.length) return false;\n let diff = 0;\n for (let i = 0; i < got.length; i++) diff |= got[i] ^ want[i];\n return diff === 0;\n}\nfunction getCookie(req: Request, name: string): string | null {\n const raw = req.headers.get(\"cookie\");\n if (!raw) return null;\n const m = raw.match(new RegExp(\"(?:^|;\\\\s*)\" + name + \"=([^;]*)\"));\n return m ? decodeURIComponent(m[1]) : null;\n}\nconst SESSION_MS = 90 * 24 * 3600 * 1000;\nfunction sessCookie(token: string, maxAgeSec: number): string {\n return `bt_sess=${token}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAgeSec}`;\n}\nasync function makeSession(userId: number): Promise {\n const token = b64u.enc(crypto.getRandomValues(new Uint8Array(32)));\n const now = Date.now();\n await sqlite.execute({\n sql: \"delete from bt_session where expires < ?\",\n args: [now],\n });\n await sqlite.execute({\n sql:\n \"insert into bt_session (token, user_id, created, expires) values (?, ?, ?, ?)\",\n args: [token, userId, now, now + SESSION_MS],\n });\n return token;\n}\nasync function currentUser(req: Request): Promise {\n const token = getCookie(req, \"bt_sess\");\n if (!token) return null;\n const s = rows(\n await sqlite.execute({\n sql: \"select user_id, expires from bt_session where token = ?\",\n args: [token],\n }),\n )[0];\n if (!s || Number(s.expires) < Date.now()) return null;\n const u = rows(\n await sqlite.execute({\n sql: \"select id, email, name, role from bt_user where id = ?\",\n args: [s.user_id],\n }),\n )[0];\n return u || null;\n}\nasync function adminCount(): Promise {\n return Number(\n rows(\n await sqlite.execute(\n \"select count(*) c from bt_user where role = 'admin'\",\n ),\n )[0].c,\n );\n}\nasync function apiSetup(b: any) {\n if ((await userCount()) > 0) return json({ error: \"already_setup\" }, 409);\n const email = String(b?.email || \"\").trim().toLowerCase();\n const name = String(b?.name || \"\").trim();\n const pw = String(b?.password || \"\");\n if (!EMAIL_RE.test(email)) return json({ error: \"bad_email\" }, 400);\n if (name.length < 1 || name.length > 40) {\n return json({ error: \"bad_name\" }, 400);\n }\n if (pw.length < 8) return json({ error: \"weak_password\" }, 400);\n const cfg = normalizeConfig(b);\n await sqlite.execute({\n sql:\n \"insert into bt_config (id, json) values (1, ?) on conflict(id) do update set json = excluded.json\",\n args: [JSON.stringify(cfg)],\n });\n const r = await sqlite.execute({\n sql:\n \"insert into bt_user (email, name, pass, role, created) values (?, ?, ?, 'admin', ?)\",\n args: [email, name, await hashPw(pw), Date.now()],\n });\n const token = await makeSession(Number(r.lastInsertRowid));\n return jsonC({ ok: true }, sessCookie(token, SESSION_MS / 1000));\n}\nasync function apiRegister(b: any) {\n const cfg = await getConfig();\n if (!cfg) return json({ error: \"not_setup\" }, 400);\n const email = String(b?.email || \"\").trim().toLowerCase();\n const name = String(b?.name || \"\").trim();\n const pw = String(b?.password || \"\");\n const code = String(b?.joinCode || \"\").trim();\n if (!code || code.toLowerCase() !== String(cfg.joinCode).toLowerCase()) {\n return json({ error: \"bad_join_code\" }, 403);\n }\n if (!EMAIL_RE.test(email)) return json({ error: \"bad_email\" }, 400);\n if (name.length < 1 || name.length > 40) {\n return json({ error: \"bad_name\" }, 400);\n }\n if (pw.length < 8) return json({ error: \"weak_password\" }, 400);\n const exists = rows(\n await sqlite.execute({\n sql: \"select 1 from bt_user where email = ?\",\n args: [email],\n }),\n )[0];\n if (exists) return json({ error: \"email_taken\" }, 409);\n const r = await sqlite.execute({\n sql:\n \"insert into bt_user (email, name, pass, role, created) values (?, ?, ?, 'member', ?)\",\n args: [email, name, await hashPw(pw), Date.now()],\n });\n const token = await makeSession(Number(r.lastInsertRowid));\n return jsonC({ ok: true }, sessCookie(token, SESSION_MS / 1000));\n}\nasync function apiLogin(b: any) {\n const email = String(b?.email || \"\").trim().toLowerCase();\n const pw = String(b?.password || \"\");\n const u = rows(\n await sqlite.execute({\n sql: \"select id, pass from bt_user where email = ?\",\n args: [email],\n }),\n )[0];\n if (!u || !(await verifyPw(pw, u.pass))) {\n return json({ error: \"bad_login\" }, 401);\n }\n const token = await makeSession(Number(u.id));\n return jsonC({ ok: true }, sessCookie(token, SESSION_MS / 1000));\n}\nasync function apiLogout(req: Request) {\n const token = getCookie(req, \"bt_sess\");\n if (token) {\n await sqlite.execute({\n sql: \"delete from bt_session where token = ?\",\n args: [token],\n });\n }\n return jsonC(\n { ok: true },\n \"bt_sess=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0\",\n );\n}\nasync function apiMe(user: any, b: any) {\n const name = typeof b?.name === \"string\" ? b.name.trim() : null;\n const pw = typeof b?.password === \"string\" && b.password ? b.password : null;\n if (name != null) {\n if (name.length < 1 || name.length > 40) {\n return json({ error: \"bad_name\" }, 400);\n }\n await sqlite.execute({\n sql: \"update bt_user set name = ? where id = ?\",\n args: [name, user.id],\n });\n }\n if (pw != null) {\n if (pw.length < 8) return json({ error: \"weak_password\" }, 400);\n await sqlite.execute({\n sql: \"update bt_user set pass = ? where id = ?\",\n args: [await hashPw(pw), user.id],\n });\n }\n return json({ ok: true });\n}\nasync function apiUsers(user: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n return json({\n users: rows(\n await sqlite.execute(\n \"select id, email, name, role, created from bt_user order by created asc\",\n ),\n ),\n });\n}\nasync function apiUserRole(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const id = Number(b?.userId);\n const role = b?.role === \"admin\" ? \"admin\" : \"member\";\n if (!id) return json({ error: \"bad_request\" }, 400);\n if (role === \"member\") {\n const target =\n rows(\n await sqlite.execute({\n sql: \"select role from bt_user where id = ?\",\n args: [id],\n }),\n )[0];\n if (target && target.role === \"admin\" && (await adminCount()) <= 1) {\n return json({ error: \"last_admin\" }, 409);\n }\n }\n await sqlite.execute({\n sql: \"update bt_user set role = ? where id = ?\",\n args: [role, id],\n });\n return json({ ok: true });\n}\nasync function apiUserRemove(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const id = Number(b?.userId);\n if (!id) return json({ error: \"bad_request\" }, 400);\n if (id === user.id) return json({ error: \"self\" }, 409);\n const target =\n rows(\n await sqlite.execute({\n sql: \"select role from bt_user where id = ?\",\n args: [id],\n }),\n )[0];\n if (target && target.role === \"admin\" && (await adminCount()) <= 1) {\n return json({ error: \"last_admin\" }, 409);\n }\n await sqlite.batch([\n { sql: \"delete from bt_user where id = ?\", args: [id] },\n { sql: \"delete from bt_session where user_id = ?\", args: [id] },\n { sql: \"delete from bt_signup where user_id = ?\", args: [id] },\n { sql: \"delete from bt_push where user_id = ?\", args: [id] },\n { sql: \"delete from bt_notif_pref where user_id = ?\", args: [id] },\n ]);\n return json({ ok: true });\n}\nasync function apiUserResetPw(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const id = Number(b?.userId);\n const pw = String(b?.password || \"\");\n if (!id || pw.length < 8) return json({ error: \"bad_request\" }, 400);\n await sqlite.execute({\n sql: \"update bt_user set pass = ? where id = ?\",\n args: [await hashPw(pw), id],\n });\n await sqlite.execute({\n sql: \"delete from bt_session where user_id = ?\",\n args: [id],\n });\n return json({ ok: true });\n}\nasync function apiConfig(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const cur = await getConfig();\n // A partial update (e.g. just a new join code) must not silently reset the\n // fields the caller didn't send -- fall back to the current value for each.\n const cfg = normalizeConfig({\n maxPlayers: b?.maxPlayers ?? cur?.maxPlayers,\n days: b?.days ?? cur?.days,\n tz: b?.tz ?? cur?.tz,\n joinCode: b?.joinCode ?? cur?.joinCode,\n });\n await sqlite.execute({\n sql: \"update bt_config set json = ? where id = 1\",\n args: [JSON.stringify(cfg)],\n });\n return json({ ok: true });\n}\nasync function apiNotifPrefs(user: any, b: any) {\n await sqlite.execute({\n sql:\n `insert into bt_notif_pref (user_id, notify_release, notify_messages) values (?, ?, ?)\non conflict(user_id) do update set notify_release = excluded.notify_release, notify_messages = excluded.notify_messages`,\n args: [user.id, b?.release ? 1 : 0, b?.messages ? 1 : 0],\n });\n return json({ ok: true });\n}\nasync function buildState(user: any) {\n const cfg = await getConfig();\n const isAdmin = user.role === \"admin\";\n const npRow = rows(\n await sqlite.execute({\n sql:\n \"select notify_release, notify_messages from bt_notif_pref where user_id = ?\",\n args: [user.id],\n }),\n )[0];\n const notifPrefs = {\n release: npRow ? !!npRow.notify_release : true,\n messages: npRow ? !!npRow.notify_messages : true,\n };\n const today = ymdInTz(new Date(), cfg.tz);\n const monday0 = mondayOf(today);\n const relRows = rows(\n await sqlite.execute(\"select monday, released from bt_week\"),\n );\n const relSet = new Set(\n relRows.filter((r) => r.released).map((r) => r.monday),\n );\n const LABELS = [\"This week\", \"Next week\", \"In 2 weeks\"];\n const weeksMeta: {\n label: string;\n monday: string;\n released: boolean;\n dates: string[];\n }[] = [];\n for (let w = 0; w < LABELS.length; w++) {\n const monday = addDays(monday0, w * 7);\n const released = relSet.has(monday);\n if (!isAdmin && !released) continue;\n const dates: string[] = [];\n for (let i = 0; i < 7; i++) {\n const d = addDays(monday, i);\n if (cfg.days.includes(dow(d))) dates.push(d);\n }\n weeksMeta.push({ label: LABELS[w], monday, released, dates });\n }\n const wantDates: string[] = [];\n for (const w of weeksMeta) wantDates.push(...w.dates);\n let signups: any[] = [];\n let slots: any[] = [];\n if (wantDates.length) {\n const ph = wantDates.map(() => \"?\").join(\",\");\n signups = rows(\n await sqlite.execute({\n sql: `select s.date, s.user_id, s.at, u.name\nfrom bt_signup s join bt_user u on u.id = s.user_id\nwhere s.date in (${ph}) order by s.at asc`,\n args: wantDates,\n }),\n );\n slots = rows(\n await sqlite.execute({\n sql: `select date, canceled, reason from bt_slot where date in (${ph})`,\n args: wantDates,\n }),\n );\n }\n const slotBy: Record = {};\n for (const s of slots) slotBy[s.date] = s;\n const suBy: Record = {};\n for (const r of signups) {\n (suBy[r.date] = suBy[r.date] || []).push({\n userId: r.user_id,\n name: r.name,\n at: r.at,\n });\n }\n const chatLatest = Number(\n rows(await sqlite.execute(\"select max(at) m from bt_msg\"))[0]?.m || 0,\n );\n return {\n me: {\n id: user.id,\n name: user.name,\n email: user.email,\n role: user.role,\n notifPrefs,\n },\n chatLatest,\n config: isAdmin\n ? {\n maxPlayers: cfg.maxPlayers,\n days: cfg.days,\n tz: cfg.tz,\n joinCode: cfg.joinCode,\n }\n : { maxPlayers: cfg.maxPlayers },\n weeks: weeksMeta.map((w) => ({\n key: w.label,\n monday: w.monday,\n released: w.released,\n range: w.dates.length\n ? rangeLabel(w.dates[0], w.dates[w.dates.length - 1])\n : \"\",\n slots: w.dates.map((d) => {\n const sl = slotBy[d] || {};\n return {\n date: d,\n canceled: !!sl.canceled,\n reason: sl.reason || null,\n past: d < today,\n players: suBy[d] || [],\n };\n }),\n })),\n };\n}\nasync function apiClaim(user: any, b: any) {\n const cfg = await getConfig();\n const date = b?.date;\n if (typeof date !== \"string\") return json({ error: \"bad_request\" }, 400);\n if (date < ymdInTz(new Date(), cfg.tz)) return json({ error: \"past\" }, 409);\n let targetId = user.id;\n if (b?.userId != null && Number(b.userId) !== user.id) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n targetId = Number(b.userId);\n const exists = rows(\n await sqlite.execute({\n sql: \"select 1 from bt_user where id = ?\",\n args: [targetId],\n }),\n )[0];\n if (!exists) return json({ error: \"bad_request\" }, 400);\n }\n const wk = rows(\n await sqlite.execute({\n sql: \"select released from bt_week where monday = ?\",\n args: [mondayOf(date)],\n }),\n )[0];\n const released = !!(wk && wk.released);\n if (!released && user.role !== \"admin\") return json({ error: \"hidden\" }, 403);\n const sl = rows(\n await sqlite.execute({\n sql: \"select canceled from bt_slot where date = ?\",\n args: [date],\n }),\n )[0];\n if (sl && sl.canceled) return json({ error: \"canceled\" }, 409);\n const res = await sqlite.execute({\n sql: `insert into bt_signup (date, user_id, at)\nselect ?, ?, ?\nwhere (select count(*) from bt_signup where date = ?) < ?\nand not exists (select 1 from bt_signup where date = ? and user_id = ?)`,\n args: [date, targetId, Date.now(), date, cfg.maxPlayers, date, targetId],\n });\n if (!res.rowsAffected) {\n const already = rows(\n await sqlite.execute({\n sql: \"select 1 from bt_signup where date = ? and user_id = ?\",\n args: [date, targetId],\n }),\n )[0];\n return already ? json({ ok: true }) : json({ error: \"full\" }, 409);\n }\n return json({ ok: true });\n}\nasync function apiRelease(user: any, b: any) {\n const date = b?.date;\n if (typeof date !== \"string\") return json({ error: \"bad_request\" }, 400);\n let targetId = user.id;\n if (b?.userId != null && Number(b.userId) !== user.id) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n targetId = Number(b.userId);\n }\n const del = await sqlite.execute({\n sql: \"delete from bt_signup where date = ? and user_id = ?\",\n args: [date, targetId],\n });\n return json({ ok: !!del.rowsAffected });\n}\nasync function apiReleaseWeek(user: any, b: any, unrelease: boolean) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const monday = b?.monday;\n if (typeof monday !== \"string\") return json({ error: \"bad_request\" }, 400);\n await sqlite.execute({\n sql:\n `insert into bt_week (monday, released, released_at, released_by) values (?, ?, ?, ?)\non conflict(monday) do update set\nreleased = excluded.released,\nreleased_at = excluded.released_at,\nreleased_by = excluded.released_by`,\n args: [monday, unrelease ? 0 : 1, Date.now(), user.id],\n });\n let sent = 0;\n if (!unrelease) {\n const cfg = await getConfig();\n const ds: string[] = [];\n for (let i = 0; i < 7; i++) {\n const d = addDays(monday, i);\n if (cfg.days.includes(dow(d))) ds.push(d);\n }\n const label = ds.length ? rangeLabel(ds[0], ds[ds.length - 1]) : monday;\n try {\n sent = await notifyAll(\n \"🎾 Schedule is open\",\n `${label} — pick your days`,\n \"/\",\n \"wk-\" + monday,\n \"release\",\n );\n } catch (_e) { /* releasing still succeeds */ }\n }\n return json({ ok: true, sent });\n}\nasync function apiCancel(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const date = b?.date;\n if (typeof date !== \"string\") return json({ error: \"bad_request\" }, 400);\n if (b?.canceled) {\n await sqlite.execute({\n sql: `insert into bt_slot (date, canceled, reason) values (?, 1, ?)\non conflict(date) do update set canceled = 1, reason = excluded.reason`,\n args: [date, String(b?.reason || \"\").slice(0, 140)],\n });\n await sqlite.execute({\n sql: \"delete from bt_signup where date = ?\",\n args: [date],\n });\n } else {\n await sqlite.execute({\n sql: \"update bt_slot set canceled = 0, reason = null where date = ?\",\n args: [date],\n });\n }\n return json({ ok: true });\n}\nasync function apiClearDay(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n if (typeof b?.date !== \"string\") return json({ error: \"bad_request\" }, 400);\n await sqlite.execute({\n sql: \"delete from bt_signup where date = ?\",\n args: [b.date],\n });\n return json({ ok: true });\n}\nasync function apiNotify(user: any, b: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n const monday = b?.monday;\n if (typeof monday !== \"string\") return json({ error: \"bad_request\" }, 400);\n const cfg = await getConfig();\n const ds: string[] = [];\n for (let i = 0; i < 7; i++) {\n const d = addDays(monday, i);\n if (cfg.days.includes(dow(d))) ds.push(d);\n }\n if (!ds.length) return json({ ok: true, sent: 0 });\n const ph = ds.map(() => \"?\").join(\",\");\n const counts = rows(\n await sqlite.execute({\n sql:\n `select date, count(*) c from bt_signup where date in (${ph}) group by date`,\n args: ds,\n }),\n );\n const canceled = new Set(\n rows(\n await sqlite.execute({\n sql: `select date from bt_slot where date in (${ph}) and canceled = 1`,\n args: ds,\n }),\n ).map((r) => r.date),\n );\n const cmap: Record = {};\n for (const r of counts) cmap[r.date] = Number(r.c);\n let open = 0;\n for (const d of ds) {\n if (canceled.has(d)) continue;\n open += Math.max(0, cfg.maxPlayers - (cmap[d] || 0));\n }\n const label = rangeLabel(ds[0], ds[ds.length - 1]);\n const body = open > 0\n ? `${label} — ${open} spot${open === 1 ? \"\" : \"s\"} still open`\n : `${label} — all full`;\n const sent = await notifyAll(\n \"🎾 Tennis sign-up\",\n body,\n \"/\",\n \"wk-\" + monday,\n \"release\",\n );\n return json({ ok: true, sent });\n}\nasync function apiReset(user: any) {\n if (user.role !== \"admin\") return json({ error: \"forbidden\" }, 403);\n await sqlite.batch([\n \"delete from bt_signup\",\n \"delete from bt_slot\",\n \"delete from bt_week\",\n ]);\n return json({ ok: true });\n}\nasync function apiChatGet(url: URL) {\n const since = Number(url.searchParams.get(\"since\") || 0);\n const msgs = since\n ? rows(\n await sqlite.execute({\n sql:\n `select m.id, m.text, m.at, u.name from bt_msg m join bt_user u on u.id = m.user_id\nwhere m.at > ? order by m.at asc limit 200`,\n args: [since],\n }),\n )\n : rows(\n await sqlite.execute(\n `select m.id, m.text, m.at, u.name from bt_msg m join bt_user u on u.id = m.user_id\norder by m.id desc limit 80`,\n ),\n ).reverse();\n return json({ messages: msgs });\n}\nasync function apiChatPost(user: any, b: any) {\n const text = String(b?.text || \"\").trim().slice(0, 800);\n if (!text) return json({ error: \"bad_request\" }, 400);\n const at = Date.now();\n await sqlite.execute({\n sql: \"insert into bt_msg (user_id, text, at) values (?, ?, ?)\",\n args: [user.id, text, at],\n });\n await sqlite.execute(\n \"delete from bt_msg where id not in (select id from bt_msg order by id desc limit 300)\",\n );\n try {\n await notifyAll(\n user.name,\n text.slice(0, 140),\n \"/\",\n \"chat\",\n \"messages\",\n user.id,\n );\n } catch (_e) { /* chat post still succeeds even if push fails */ }\n return json({ ok: true, at });\n}\nasync function apiPushSubscribe(user: any, b: any) {\n const sub = b?.sub;\n if (!sub || typeof sub.endpoint !== \"string\" || !sub.keys) {\n return json({ error: \"bad_request\" }, 400);\n }\n const id = await sha256hex(sub.endpoint);\n await sqlite.execute({\n sql:\n `insert into bt_push (sub_id, user_id, endpoint, sub, created) values (?, ?, ?, ?, ?)\non conflict(sub_id) do update set user_id = excluded.user_id, sub = excluded.sub`,\n args: [id, user.id, sub.endpoint, JSON.stringify(sub), Date.now()],\n });\n return json({ ok: true });\n}\nasync function apiPushUnsubscribe(b: any) {\n if (typeof b?.endpoint === \"string\") {\n await sqlite.execute({\n sql: \"delete from bt_push where endpoint = ?\",\n args: [b.endpoint],\n });\n }\n return json({ ok: true });\n}\nexport default async function handler(req: Request): Promise {\n await init();\n const url = new URL(req.url);\n const p = url.pathname;\n const GET = req.method === \"GET\";\n const POST = req.method === \"POST\";\n try {\n if (GET && (p === \"/\" || p === \"/index.html\")) {\n return new Response(PAGE, {\n headers: {\n \"content-type\": \"text/html; charset=utf-8\",\n \"cache-control\": \"no-store\",\n },\n });\n }\n if (GET && p === \"/sw.js\") {\n return new Response(SW_JS, {\n headers: {\n \"content-type\": \"text/javascript; charset=utf-8\",\n \"cache-control\": \"no-cache\",\n },\n });\n }\n if (GET && p === \"/manifest.webmanifest\") {\n return new Response(MANIFEST, {\n headers: { \"content-type\": \"application/manifest+json; charset=utf-8\" },\n });\n }\n if (GET && p === \"/icon-192.png\") {\n return new Response(b64u.dec(ICON_B64), {\n headers: {\n \"content-type\": \"image/png\",\n \"cache-control\": \"public, max-age=86400\",\n },\n });\n }\n const user = await currentUser(req);\n if (GET && p === \"/api/state\") {\n if ((await userCount()) === 0) return json({ needsSetup: true });\n if (!user) return json({ needsAuth: true });\n return json(await buildState(user));\n }\n if (GET && p === \"/api/vapid\") {\n const v = await ensureVapid();\n return json({ key: v.rawPub });\n }\n if (GET && p === \"/api/chat\") {\n if (!user) return json({ error: \"unauth\" }, 401);\n return await apiChatGet(url);\n }\n if (GET && p === \"/api/users\") {\n if (!user) return json({ error: \"unauth\" }, 401);\n return await apiUsers(user);\n }\n if (POST) {\n const b = await req.json().catch(() => ({}));\n if (p === \"/api/setup\") return await apiSetup(b);\n if (p === \"/api/register\") return await apiRegister(b);\n if (p === \"/api/login\") return await apiLogin(b);\n if (p === \"/api/logout\") return await apiLogout(req);\n if (!user) return json({ error: \"unauth\" }, 401);\n if (p === \"/api/me\") return await apiMe(user, b);\n if (p === \"/api/claim\") return await apiClaim(user, b);\n if (p === \"/api/release-spot\") return await apiRelease(user, b);\n if (p === \"/api/release-week\") {\n return await apiReleaseWeek(user, b, false);\n }\n if (p === \"/api/hide-week\") return await apiReleaseWeek(user, b, true);\n if (p === \"/api/cancel\") return await apiCancel(user, b);\n if (p === \"/api/clear-day\") return await apiClearDay(user, b);\n if (p === \"/api/notify\") return await apiNotify(user, b);\n if (p === \"/api/reset\") return await apiReset(user);\n if (p === \"/api/chat\") return await apiChatPost(user, b);\n if (p === \"/api/push/subscribe\") return await apiPushSubscribe(user, b);\n if (p === \"/api/push/unsubscribe\") return await apiPushUnsubscribe(b);\n if (p === \"/api/notif-prefs\") return await apiNotifPrefs(user, b);\n if (p === \"/api/config\") return await apiConfig(user, b);\n if (p === \"/api/user/role\") return await apiUserRole(user, b);\n if (p === \"/api/user/remove\") return await apiUserRemove(user, b);\n if (p === \"/api/user/reset-password\") {\n return await apiUserResetPw(user, b);\n }\n }\n return new Response(\"Not found\", { status: 404 });\n } catch (err) {\n console.error(err);\n return json({ error: \"server_error\", detail: String(err) }, 500);\n }\n}","createdAt",["D",1789508999843],"branchVersion","branchId","d85cdbab-734e-4c44-853b-af146e21b9c3","id","1e5c183b-a484-42d1-96f0-48e9966cd71e","Baseline",["D",1789494372870],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Baseline schedule app","imageUrl","5ccbc412-dad5-431e-aec9-5b3f1a540f4a","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0881e-fc61-7031-85a5-60a2073a1d18","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_96":95,"_104":100},"org",{"_96":95,"_97":98,"_99":100,"_18":55,"_101":102,"_103":25},"branch",{"_13":85,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"isOwned",22,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","JeffBaseline","handle","displayName","jeffyo100","avatar","https://avatars.githubusercontent.com/u/326585370?v=4","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":165,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":166,"_80":167,"_82":168,"_84":25},"tree",[156,157],"files",[156,157],"counts",{"_145":62,"_146":147,"_148":62,"_149":150,"_151":152},"contents",[127,128],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":136,"_32":137,"_30":138,"_130":-5,"_41":42,"_40":139,"_131":25,"_38":140,"_13":141,"_33":142,"_35":143,"_24":25,"_134":-5,"_27":144},{"_43":129,"_32":28,"_30":31,"_130":-5,"_41":42,"_40":14,"_131":25,"_38":132,"_13":133,"_33":34,"_35":37,"_24":25,"_134":-5,"_27":135},"90fb797f-b39f-40a5-8e73-dea6182bc5fc","parentId","latest",["D",1789508999843],5,"label",[28],"d55488f4-eda7-49ac-94fe-4bd3b1c824eb","main.ts","57bfc790-b12d-11f1-9ea7-1607ee4eb77e",13,["D",1789508989186],7,"script","// Baseline -- static assets (icon, service worker, manifest, page HTML).\n// Imported by the main server val. Safe to edit the page markup/CSS/JS here.\n\nconst ICON_B64 =\n \"iVBORw0KGgoAAAANSUhEUgAAAMAAAADACAYAAABS3GwHAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAA8xSURBVHhe7Z3Pz15FFcf5HxATQzBgKk2pthWx0ApWGkTQNCYmRk1EFsYFmNBF40JIKAu66ULfhbqwm64gkS6MC0xEExMT44KFK/+dx3zf5CaP5977POfcmTk/Zs7iwwK4971zn/nOnDm/7kMPn330mw+fe+y9JBmRh/CPz5x7bJckI5ICSIYmBZAMTQogGZoUQDI0KYBkaFIAydCkAJKhSQEkQ5MCSIYmBZAMTQogGZoUQDI0KYBkaFIAydCkAJKh6UYAjyz8uyQ5RjcCSGyIvvCkAJKhSQEkQ5MCSIYmBZAMzZACiH5wS+oxpABAiiABwwoApAiSoQUANEXw+Fcf3734g3NH+eKVJ2bXJm0YXgCglggwcTGBX7t5cffW7Wd29z66tnvwyUu7f//3u5v5y7++fXqft+8+u3vj7adP7//UtS/M/nayjRRAAZdffXL3s19+ZXdy/4Xd3z99ZTZ5W/LP/3xn9/sPvnEqiue/d3b2bAmPLgVQa0WnXHrpjNmEP8a+ICBM+uzJMl0KoCaw22HSfPjx9dmk8wxML4ghzxOHSQGs8P2ff3l39w9fn02siGBn+OGbF3afu/j5ZrtjVFIAC7z6k/OzSdQD7/76udlYRycFsMJb7z0zm0CR+eDj66c7AB3n6KQAVsBkwaShEykiOCCfT9fpIimAA8CbgslDJ1Q03njn6dnYDjHSOWE4ATwqNAOim0JS0+ez5+f/rmeGEQDcgfCGSCdEdFNIGiS789uru/t/evE05kH/W48MIQD4w/dNmd/cf372/xwiqin07onM6/PTm5f+7/pbdy6LFouIdC0ABLGw6tOJAaR2cTRTCDlEkiAYdoolkSMA2PNu0K0A8INiEtAfdAI/tiRlACvhoft540e/uDAbwxoY24O/riftIe0DgUF6XQ90KQCYPPRHXEJ6HsAkoPfwyL0/Xps9+yG4u9vtkyui9xWBrgRwyORZQ2oKeT8QY2e79C2+yYL4wJLpswZMop7SsbsRAOzdLQlr0gnz8o+fmt3DE1jN6TMfQrpgAJiCEvPRM10IAIe0P//j5dkPxQVuP3rPQ8CLRO/hAbwDiYlSYtLhXIDiHHrPaIQXAFaiGrn5yPOn914Df5Ne7wHpwbf0UI/d88br52f3jkRoAcAckdivh8BkkKye8LHTe1giff5f3X12do+tINWa3j8KYQXQwha/9f7l2d9ZA+cGer0lkmdvsYNFFUFIAawFbUrBPSXBIy9nAelz48xD71EDLEr0b3knnABw4K1h868hSR9osQttAZVr9NnWwDmBXl8LCFGae2RNKAHA/1zi7eEicfF5iAt4el4sTpFSJ8IIAEGuLX7+LUiS5WgCmTaY0PSZ1tDasbBIRQmWhREAmkPRF90SbnCshjuxhBuvf2n2TGtonlmwWEm8UlaEEAC6rNEX3Bq4CelzrAEPDL1eA4nrs4Xn5xh3fnd19hzecC8ARBvpi9UABzqYXfR5lkA+Db1eA0keU02/vwTv7lHXAoBrz9K8kESHkYFJr2+JxPWJ/6+F25jDaa6V40OxawFo2/0UHOboM62hfRiWuGshZHq9JuhSxzXVtHErAAu7fwnuIVN7leUmolkf0ie8ngdcCgAuNM3JdAiJS3RLavEW/vbpK7O/vQYETK+3wmOQzKUAtCYSB8lhuCS9WAI6N9C/vUbrwJcEj65RdwJAei19cdZw04zx42rsXNycGwvX5zEkjgUNXAnAi71KkdTYtu4oDfOHu4pya301kXivNHAlAHwGiL4wL3B/tJbJZkBi/hzq9GAJPjBCn9UKNwLQ9qJI4QadMA56bU247Um81StQJAl8LXEjAM+rP5DUDbc6eGKB4Jo/ECy93hNedgEXAvC++k9wvUGt0g4kLtlWRS818bALuBCA99V/gmt+tMpf4pphVrlJUjzsAuYCiLL6A+4BtJU7lBv9tU59kGC9C5gLIMrqDyS5QbWT4yT2f+2/3RLrXcBUAK1WypZwV6zaq7AkFhHtnXJdzC0wFYBW6kBNuJHM2ucAbstDj9HfY6CZMR2HFqYC8JTzwwXPTMexBDxG9NoSerT/J5AuTcehhZkAWgeMWgHzgo5ljZqRWK4LVrPutyZWmaJmAuD28PcIt2C+Vl6QpPMDcoXo9RHAtwfoWDQwEwC2PfoSosCNB9QyR7iNryLa/xPoJ8T1ctXERACRfyjA7RhR6yDMDYC1TsRrjUWnaRMBeCl33Ir2QZi741i1Z6mFRdmkiQCsi91LkZQk1jgIc2MPUQ/AE5JAYy3UBRAx+LUE8m3o2Jao4erl2satslA10W6pqC6AWnaxNdxuEaUf0pCsij0sLNqNtNQFEN3+n+BGhEvz8rnnDe8FMFy0zwHqAohu/09wPUGlnhnu39Hq/NwayY5XA3UB9LBNA25xSqnJx3WB1oo5eEAzOU5VAOgRSQcbFW50trQ4hduSpfSs4Qlu25caqArAY8+frUhcofRaCdwkuBreJi9wz1c1UBVAT9s04CaolXzWiRsDiFADzAVFUnR8rVAVABKe6GAjw52cJRVaXHu4RGTe4Hq+aqAqgJ5WKcA1T0oEQO+1Br0uMugOSMfXClUBeGx7WAL3gIpienotB+5EqJVz5Alu9LsUNQH0+CO1FgDyiOi9luglCLYP17wsRU0AyPGgg4wO10e/NUuTWwhfGmvwCNe8LEVNAD3FACa4hepbuzRzBVAabfZIdwLocZXipils/X7YyALQSopLARTA7RS3dYJySyG33t8z3QkgYg+gY7QWQOv7e0arV5CaAKBoOsjotJ6gre/vGaTN03G2QE0Ar928OBtkdFpP0Nb390x3AsgdYH79MVrf3zMpgABwvUBbJ2gKYD7W2qgJoEcvEDcOsHWCjiyA7rxAIwtga10wVwA9eti6E0D0bnBLcAXQOhLc4+Ki1SVOTQA95gKlANrRXSpE1Hboh+CW7m1Nhhs5G1SrXbqaAEAvHSEmcPikY1xiazo0t0VIaeG9R7iVcKWoCuDDDlr37cPdprdWhHE/xtFbrQVapdMxtkJVALU+GOEF7ocySnp20nut0dPuitJZOr5WqAqgl7aIE9xtuqRgndt5okYXai9otkdUFUBv/mo6vjXodRK4pYE99QXSygQFqgLoKRbAPaCWer+0ulB7QisGAFQFgEp/OtiocH30pS5Krqt1a7TZIyifpeNrhaoAQC+eIKy4dGxLlHZt5ibc9WJeanqAgLoA0PaODjoi3JV5az3wBLcLNQJH9NqInNx/YTa2lqgLoJcGudwOxljB6bUSuF2oS88aXuAuLLVQF0AvQRutb4RJulBH/Uj2PlyvVy3UBQCinwO4EVpQEgOY4LYJ3Bpx9oK2/Q9MBBD9HMA1S2p5vbiJYaXmljXa9j8wEUCpZ8Qabr+eWnEPrl0cvTIMjRPomFpjIgAQuVM0tw6glmuS63KtJTgLYFZy0z5qYiaAyGYQ1wNUKzjFNblA1KQ4C/MHmAkg8mrFXangw6fXbgGTmnsQLsk8tUQz/WEfMwGAiN4gyWpc0y3JdQ9GPAjDHOYKvDamAoj40TxuakLtHY5bfYbkOXqtdzQ/ikcxFUDE6CU3O7O2uLnCw0oa7RzA3d1aYCoAgMMPfSGe4dr/tavfJKZXpIAYzGD6/JqYC6C2qdASSalejQgwhVuBtrUNiwVWh98JcwGAKLsA95tgrbo0cM8BURYV69UfuBBAlB+MWwTfKiLLjUCDmh6oVliv/sCFAID3XYDbpAps7QN0DElmaKtnqIWH1R+4EYD3XYCb/gAvTMvVl5sYVysNoxUeVn/gRgDA8y7AnXit+3R6EWIJXlZ/4EoAaKDr0YfN7QABWndn4BbjA69mEHcx0cCVAAB6wtAXZg03GxNoZLlyq9E8pp3fPrkye05L3AkAW/eDT3x1OeNGKlubPxNcdyzQECQXPAs3lqGFOwEArYnEQRL80kpEk3iktJ6Jg9ZXXyS4FAConUqwFW7uD2gR/V2DG5Pw4l2TLCSauBUAcm40J9QSksOvdl8efHSDPsMa1jUCKHaHg4M+lwfcCgBgUll6hbi1uEDb4yIRp3VMwIvPfwnXAgC104q5SKqwcLCzECr3Ax0Yh9Vh2DLXn4N7AQCLABk3/x5YZV9K3LMWzwi7n7uIWBFCABbnAa6v3XJ1xa7DdStq71Ke7f59QggAwJuBl0pfdAu4DWmBtX0tiQlonVMgNG7nDGvCCADgpWqsYlzbGlh7WCQF5VouUY/+/jVCCQC0XnElpYfars818E7os63ROr6i+XmjGoQTAEALPfriayFZ/Wv1/SlFItqWZ4Fbd/ixCS+EFABo8cVJScWVt44W3Hwl0CI9QvPLjjUJKwCAFYf+EFtB7jzXowJaTKISJAf32p6rqJMfhBYAqGUOSaK+tSdQLSS7QK0Ao/dA1zHCCwDgEFhi10psaFBr8tRGUiwDEKii95AQ7cC7RBcCADi8bo0TSFZOmEleSw2BJHsVGaVbF45Irs5DdCMAgIksNU0k6QSgtRuxFOluJm3hjkUmSpCLQ1cCAEib4H6YDmLhtjoEHksMl5CeZ7jBPBSza37EWoPuBDDBqS3mdloDmCja+UhbkUSHAXbOY6YQankl94xCtwIAiNSumUQStyGwyKYsgds+5dj4YPJIIs3R6FoAYMkkQk2txPQpOSxageeVHO4BfU/wEvVm8lC6F8AEqpKwG2BicOtpJyK1G98Htr3EbMGigMUBq77FFxstGEYAAD/w14SrYqtGt1pITaEnrz6xO/McPyIenaEEIAU+/7UzRBS2mEIjkQI4QOs2h1pITaGRSAGsEPFjc4eQmkKjkAJYAPXAntMdtiKpdRiFFMACF66fOQ38RLf/J+DVQcrylRtnd48sjHdkUgBHgPvUe/7PGvDrI4iV9v86KYA9Dq2OcKHCN44eRVuzTlsDjw8mPXKBJMU9I5MC2Ahci5holoKYJjzynjx9dCISKYBKQBAwN1CrDJPp3kd1o8fIxMRkx/2Ri58Tvg7DC+CQ2VMDmCLwvgCcJzCBjwEhTdf0notjTRcCaD2Jk37pQgBJspUhBZA7RjIxpACSZCIFkAxNCiAZmhRAMjQpgGRouhBAenWSrXQhgCTZSgogGZoUQDI0KYBkaFIAydCkAJKhSQEkQ5MCSIYmBZAMTQogGZoUQDI0KYBkaFIAydCkAJKhSQEkQ5MCSIbmf5uNwy4BXrXcAAAAAElFTkSuQmCC\";\n\nconst SW_JS = `\nself.addEventListener('install', function(){ self.skipWaiting(); });\nself.addEventListener('activate', function(e){ e.waitUntil(self.clients.claim()); });\nself.addEventListener('push', function(e){\nvar d = {};\ntry { d = e.data ? e.data.json() : {}; }\ncatch (_) { d = { body: (e.data && e.data.text) ? e.data.text() : '' }; }\nvar title = d.title || 'Baseline';\nvar opts = {\nbody: d.body || '',\nicon: '/icon-192.png',\nbadge: '/icon-192.png',\ntag: d.tag || 'baseline',\nrenotify: true,\ndata: { url: d.url || '/' }\n};\ne.waitUntil(self.registration.showNotification(title, opts));\n});\nself.addEventListener('notificationclick', function(e){\ne.notification.close();\nvar url = (e.notification.data && e.notification.data.url) || '/';\ne.waitUntil(\nself.clients.matchAll({ type: 'window', includeUncontrolled: true }).then(function(list){\nfor (var i = 0; i < list.length; i++){\nvar c = list[i];\nif (c.url && c.url.indexOf(self.location.origin) === 0 && 'focus' in c) return c.focus();\n}\nif (self.clients.openWindow) return self.clients.openWindow(url);\n})\n);\n});\n`;\n\nconst MANIFEST = JSON.stringify({\n name: \"Baseline\",\n short_name: \"Baseline\",\n start_url: \"/\",\n scope: \"/\",\n display: \"standalone\",\n orientation: \"portrait\",\n background_color: \"#14291d\",\n theme_color: \"#c8d64b\",\n icons: [\n {\n src: \"/icon-192.png\",\n sizes: \"192x192\",\n type: \"image/png\",\n purpose: \"any\",\n },\n {\n src: \"/icon-192.png\",\n sizes: \"192x192\",\n type: \"image/png\",\n purpose: \"maskable\",\n },\n ],\n});\n\nconst PAGE = `\n\n\n\n\n\nBaseline\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Loading…

\n\n\n\n`;\n\nexport default { ICON_B64, SW_JS, MANIFEST, PAGE };",[137],"pulls","branches",1,"forks","envVars",{"_153":62,"_155":62},"connections",{"_153":62,"_154":62},"count","unfilledCount","emptyCount",{"_43":136,"_32":137,"_30":138,"_130":-5,"_41":42,"_40":139,"_131":25,"_38":162,"_13":141,"_33":142,"_35":143,"_24":25,"_134":-5,"_159":163,"_27":164},{"_43":129,"_32":28,"_30":31,"_130":-5,"_41":42,"_40":14,"_131":25,"_38":158,"_13":133,"_33":34,"_35":37,"_24":25,"_134":-5,"_159":160,"_27":161},["D",1789508999843],"children",[],[28],["D",1789508989186],[],[137],["D",1789494372870],{"_96":95,"_104":100},{"_96":95,"_97":98,"_99":100,"_18":55,"_101":102,"_103":25},{"_13":85,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"ctx",{"_78":-5,"_124":202,"_203":204,"_205":206,"_207":25,"_208":25,"_209":25,"_210":58,"_211":-5,"_212":-7,"_213":-7,"_214":62,"_215":25,"_216":25,"_217":-5,"_218":25,"_219":25,"_220":25,"_221":-5},"ENV",{"_173":174,"_175":176,"_177":86,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189,"_190":191,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v14