Zoro Dashboard

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_155":156,"_157":158},"routes/_app.x.$handle.$name",{"_96":95,"_32":45,"_105":86,"_27":53,"_13":14,"_106":-5,"_11":107,"_108":109,"_110":111,"_112":113,"_114":115,"_20":-5,"_116":-5,"_117":-5,"_118":25,"_119":120,"_121":58,"_122":-5,"_123":-5,"_124":125},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":25},"version",62,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","3744c522-a5f4-11f1-bad4-1607ee4eb77e","name","fileType","http","content","// ============================================================\n// Zoro Dashboard v3 — paste this whole file into your Val Town HTTP val\n// ============================================================\n// Requires two environment variables already set in this val:\n// GOOGLE_SA_EMAIL -> your service account's client_email\n// GOOGLE_SA_PRIVATE_KEY -> your service account's private_key (whole PEM block)\n// The service account must have Editor access on the \"Data base\" Sheet.\n//\n// PIN gate: 2222 = Ahmed (full edit), 2468 = Zahra (view-only, no Ledger,\n// no \"Ahmed's Daily Tasks\" checklist). This is a soft/family gate, not real\n// auth — the PINs live in the page source like any client-side check.\nconst SPREADSHEET_ID = \"1-hmgkH-NE4DsXRwi69160kamCztjQ4-jVfEJpaKZ9pI\";\nconst SHEET_NAME = \"Sheet1\";\nconst ORDER_BLOB_KEY = \"zoro-dashboard-section-order-v2\";\nconst AHMED_PIN = \"2222\";\nconst ZAHRA_PIN = \"2468\";\n// ---------- PWA assets ----------\nconst ICON_192_B64 =\n \"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAIAAAD8GO2jAAAAKUlEQVR42u3NQQkAAAgEsAtuFqtqCh/CYP+lek5FIBAIBAKBQCAQfAkWOzFkediIa1EAAAAASUVORK5CYII=\";\nconst ICON_512_B64 =\n \"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAIAAAD8GO2jAAAAKUlEQVR42u3NQQkAAAgEsAtuFqtqCh/CYP+lek5FIBAIBAKBQCAQfAkWOzFkediIa1EAAAAASUVORK5CYII=\";\n// ---------- Google auth (service account -> access token) ----------\nfunction pemToArrayBuffer(pem: string): ArrayBuffer {\n const clean = pem\n .replace(/-----BEGIN PRIVATE KEY-----/, \"\")\n .replace(/-----END PRIVATE KEY-----/, \"\")\n .replace(/\\\\n/g, \"\")\n .replace(/\\s/g, \"\");\n const binary = atob(clean);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);\n return bytes.buffer;\n}\nfunction b64url(input: ArrayBuffer | object): string {\n let bytes: Uint8Array;\n if (input instanceof ArrayBuffer) bytes = new Uint8Array(input);\n else bytes = new TextEncoder().encode(JSON.stringify(input));\n let str = \"\";\n bytes.forEach((b) => (str += String.fromCharCode(b)));\n return btoa(str).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\nlet cachedToken: { token: string; expires: number } | null = null;\nasync function getAccessToken(): Promise {\n if (cachedToken && cachedToken.expires > Date.now() + 30000) {\n return cachedToken.token;\n }\n const email = Deno.env.get(\"GOOGLE_SA_EMAIL\")!;\n const rawKey = Deno.env.get(\"GOOGLE_SA_PRIVATE_KEY\")!.replace(/\\\\n/g, \"\\n\");\n const key = await crypto.subtle.importKey(\n \"pkcs8\",\n pemToArrayBuffer(rawKey),\n { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const now = Math.floor(Date.now() / 1000);\n const header = { alg: \"RS256\", typ: \"JWT\" };\n const claims = {\n iss: email,\n scope: \"https://www.googleapis.com/auth/spreadsheets\",\n aud: \"https://oauth2.googleapis.com/token\",\n iat: now,\n exp: now + 3600,\n };\n const unsigned = b64url(header) + \".\" + b64url(claims);\n const sig = await crypto.subtle.sign(\n \"RSASSA-PKCS1-v1_5\",\n key,\n new TextEncoder().encode(unsigned),\n );\n const jwt = unsigned + \".\" + b64url(sig);\n const res = await fetch(\"https://oauth2.googleapis.com/token\", {\n method: \"POST\",\n headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n body: \"grant_type=\" +\n encodeURIComponent(\"urn:ietf:params:oauth:grant-type:jwt-bearer\") +\n \"&assertion=\" +\n jwt,\n });\n const data = await res.json();\n if (!data.access_token) {\n throw new Error(\"Auth failed: \" + JSON.stringify(data));\n }\n cachedToken = {\n token: data.access_token,\n expires: Date.now() + data.expires_in * 1000,\n };\n return data.access_token;\n}\n// ---------- Sheets API helpers ----------\nfunction colLetter(zeroIndex: number): string {\n let n = zeroIndex + 1;\n let s = \"\";\n while (n > 0) {\n const r = (n - 1) % 26;\n s = String.fromCharCode(65 + r) + s;\n n = Math.floor((n - 1) / 26);\n }\n return s;\n}\nasync function sheetsGetAll(): Promise<\n { header: string[]; rows: Record[] }\n> {\n const token = await getAccessToken();\n const res = await fetch(\n `https://sheets.googleapis.com/v4/spreadsheets/${SPREADSHEET_ID}/values/${\n encodeURIComponent(\n SHEET_NAME,\n )\n }`,\n { headers: { Authorization: \"Bearer \" + token } },\n );\n const data = await res.json();\n const values: string[][] = data.values || [];\n const header = (values[0] || []).map((h) => h.trim());\n const rows = values.slice(1).map((r) => {\n const obj: Record = {};\n header.forEach((h, i) => (obj[h] = r[i] || \"\"));\n return obj;\n });\n return { header, rows };\n}\nasync function sheetsUpdateCell(\n rowNumber: number,\n colIndex: number,\n value: string,\n) {\n const token = await getAccessToken();\n const range = `${SHEET_NAME}!${colLetter(colIndex)}${rowNumber}:${\n colLetter(colIndex)\n }${rowNumber}`;\n await fetch(\n `https://sheets.googleapis.com/v4/spreadsheets/${SPREADSHEET_ID}/values/${\n encodeURIComponent(\n range,\n )\n }?valueInputOption=RAW`,\n {\n method: \"PUT\",\n headers: {\n Authorization: \"Bearer \" + token,\n \"content-type\": \"application/json\",\n },\n body: JSON.stringify({ values: [[value]] }),\n },\n );\n}\n// ---------- API handlers ----------\nasync function handleData(): Promise {\n const { header, rows } = await sheetsGetAll();\n // Self-provision the Investment/Balance columns so n8n's autoMapInputData\n // append has somewhere to write them (cheap no-op once they already exist).\n await ensureColumns(header, [\n \"asset_name\",\n \"quantity\",\n \"flow_direction\",\n \"debt_flow\",\n ]);\n rows.sort((a, b) => (b.date || \"\").localeCompare(a.date || \"\"));\n return new Response(JSON.stringify(rows), {\n headers: { \"content-type\": \"application/json\" },\n });\n}\n// Statuses that count as \"finished\" for the purposes of auto-tracking completed_at.\nconst COMPLETION_STATUSES = [\"done\", \"paid\"];\n// Returns the column index for `name`, creating the header cell (appending a new\n// column) if it doesn't exist yet. Mutates `header` in place so later lookups in\n// the same request see the new column too.\nasync function ensureColumns(header: string[], names: string[]): Promise {\n const missing = names.filter((n) => header.indexOf(n) === -1);\n if (!missing.length) return;\n const startIdx = header.length;\n header.push(...missing);\n const token = await getAccessToken();\n const endIdx = startIdx + missing.length;\n // The sheet's grid may not have enough columns yet -- expand it first,\n // otherwise the values.update PUT below fails with \"exceeds grid limits\".\n const metaResp = await fetch(\n `https://sheets.googleapis.com/v4/spreadsheets/${SPREADSHEET_ID}?fields=sheets.properties`,\n { headers: { Authorization: \"Bearer \" + token } },\n );\n const meta = await metaResp.json();\n const sheetProps = (meta.sheets || []).map((s: any) => s.properties).find(\n (p: any) => p.title === SHEET_NAME,\n );\n if (\n sheetProps && sheetProps.gridProperties &&\n sheetProps.gridProperties.columnCount < endIdx\n ) {\n await fetch(\n `https://sheets.googleapis.com/v4/spreadsheets/${SPREADSHEET_ID}:batchUpdate`,\n {\n method: \"POST\",\n headers: {\n Authorization: \"Bearer \" + token,\n \"content-type\": \"application/json\",\n },\n body: JSON.stringify({\n requests: [{\n appendDimension: {\n sheetId: sheetProps.sheetId,\n dimension: \"COLUMNS\",\n length: endIdx - sheetProps.gridProperties.columnCount,\n },\n }],\n }),\n },\n );\n }\n const startCol = colLetter(startIdx);\n const endCol = colLetter(startIdx + missing.length - 1);\n const range = `${SHEET_NAME}!${startCol}1:${endCol}1`;\n await fetch(\n `https://sheets.googleapis.com/v4/spreadsheets/${SPREADSHEET_ID}/values/${\n encodeURIComponent(range)\n }?valueInputOption=RAW`,\n {\n method: \"PUT\",\n headers: {\n Authorization: \"Bearer \" + token,\n \"content-type\": \"application/json\",\n },\n body: JSON.stringify({ values: [missing] }),\n },\n );\n}\nasync function ensureColumn(header: string[], name: string): Promise {\n const existing = header.indexOf(name);\n if (existing >= 0) return existing;\n const newIdx = header.length;\n header.push(name);\n await sheetsUpdateCell(1, newIdx, name);\n return newIdx;\n}\nasync function handleUpdateItem(req: Request): Promise {\n const body = await req.json();\n const { id, status, notes, archived, pin } = body;\n if (pin !== AHMED_PIN && pin !== ZAHRA_PIN) {\n return new Response(JSON.stringify({ error: \"unauthorized\" }), {\n status: 403,\n });\n }\n if (!id) {\n return new Response(JSON.stringify({ error: \"id required\" }), {\n status: 400,\n });\n }\n const { header, rows } = await sheetsGetAll();\n const idx = rows.findIndex((r) => r.id === id);\n if (idx === -1) {\n return new Response(JSON.stringify({ error: \"not found\" }), {\n status: 404,\n });\n }\n const rowNumber = idx + 2; // +1 header, +1 to move from 0-index to 1-index\n const currentRow = rows[idx];\n if (pin === ZAHRA_PIN && (currentRow.type !== \"Grocery\" || notes !== undefined)) {\n return new Response(JSON.stringify({ error: \"unauthorized\" }), {\n status: 403,\n });\n }\n if (status !== undefined) {\n const colIdx = header.indexOf(\"status\");\n if (colIdx >= 0) await sheetsUpdateCell(rowNumber, colIdx, status);\n // Auto-track completed_at whenever an item transitions into or out of a\n // completion status (done/paid), so the dashboard can show \"finished on X\"\n // and later build completion-based views without any manual date entry.\n const wasComplete = COMPLETION_STATUSES.includes(\n (currentRow.status || \"\").toLowerCase(),\n );\n const isComplete = COMPLETION_STATUSES.includes(\n (status || \"\").toLowerCase(),\n );\n if (isComplete && !wasComplete) {\n const completedIdx = await ensureColumn(header, \"completed_at\");\n await sheetsUpdateCell(rowNumber, completedIdx, new Date().toISOString());\n } else if (!isComplete && wasComplete) {\n const completedIdx = await ensureColumn(header, \"completed_at\");\n await sheetsUpdateCell(rowNumber, completedIdx, \"\");\n }\n }\n if (notes !== undefined) {\n const colIdx = header.indexOf(\"notes\");\n if (colIdx >= 0) await sheetsUpdateCell(rowNumber, colIdx, notes);\n }\n if (archived !== undefined) {\n const colIdx = await ensureColumn(header, \"archived\");\n await sheetsUpdateCell(rowNumber, colIdx, archived ? \"TRUE\" : \"FALSE\");\n }\n return new Response(JSON.stringify({ ok: true }), {\n headers: { \"content-type\": \"application/json\" },\n });\n}\nfunction generateId(): string {\n const n = new Date();\n const p = (x: number) => x < 10 ? \"0\" + x : String(x);\n return String(n.getFullYear()) + p(n.getMonth() + 1) + p(n.getDate()) + \"-\" +\n p(n.getHours()) + p(n.getMinutes()) + p(n.getSeconds()) + \"-\" +\n Math.random().toString(36).slice(2, 6);\n}\nasync function handleAddItem(req: Request): Promise {\n const body = await req.json();\n const {\n pin,\n type,\n topic,\n title,\n description,\n amount,\n currency,\n event_date,\n event_time,\n due_date,\n merchant,\n asset_name,\n } = body;\n if (pin !== AHMED_PIN && pin !== ZAHRA_PIN) {\n return new Response(JSON.stringify({ error: \"unauthorized\" }), {\n status: 403,\n });\n }\n if (pin === ZAHRA_PIN && type !== \"Grocery\") {\n return new Response(JSON.stringify({ error: \"unauthorized\" }), {\n status: 403,\n });\n }\n if (!type || !topic || !title) {\n return new Response(\n JSON.stringify({ error: \"type, topic, and title are required\" }),\n { status: 400 },\n );\n }\n const { header } = await sheetsGetAll();\n await ensureColumns(header, [\n \"asset_name\",\n \"quantity\",\n \"flow_direction\",\n \"debt_flow\",\n ]);\n const id = generateId();\n const rowObj: Record = {};\n header.forEach((h) => {\n rowObj[h] = \"\";\n });\n Object.assign(rowObj, {\n id,\n date: new Date().toISOString(),\n type,\n topic,\n title,\n archived: \"FALSE\",\n });\n if (description) rowObj.description = description;\n if (amount) rowObj.amount = String(amount);\n if (currency) rowObj.currency = currency;\n if (event_date) rowObj.event_date = event_date;\n if (event_time) rowObj.event_time = event_time;\n if (due_date) rowObj.due_date = due_date;\n if (merchant) rowObj.merchant = merchant;\n if (header.indexOf(\"added_by\") >= 0) rowObj.added_by = \"dashboard\";\n const rowValues = header.map((h) => rowObj[h] !== undefined ? rowObj[h] : \"\");\n const token = await getAccessToken();\n await fetch(\n `https://sheets.googleapis.com/v4/spreadsheets/${SPREADSHEET_ID}/values/${\n encodeURIComponent(SHEET_NAME)\n }:append?valueInputOption=RAW&insertDataOption=INSERT_ROWS`,\n {\n method: \"POST\",\n headers: {\n Authorization: \"Bearer \" + token,\n \"content-type\": \"application/json\",\n },\n body: JSON.stringify({ values: [rowValues] }),\n },\n );\n return new Response(JSON.stringify({ ok: true, id }), {\n headers: { \"content-type\": \"application/json\" },\n });\n}\nasync function handleGetOrder(): Promise {\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n const order = (await blob.getJSON(ORDER_BLOB_KEY)) || {};\n return new Response(JSON.stringify(order), {\n headers: { \"content-type\": \"application/json\" },\n });\n}\nasync function handleSetOrder(req: Request): Promise {\n const body = await req.json();\n if (body.pin !== AHMED_PIN && body.pin !== ZAHRA_PIN) {\n return new Response(JSON.stringify({ error: \"unauthorized\" }), {\n status: 403,\n });\n }\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n const order = { feed: body.feed || [], ledger: body.ledger || [], grocery: body.grocery || [] };\n await blob.setJSON(ORDER_BLOB_KEY, order);\n return new Response(JSON.stringify({ ok: true }), {\n headers: { \"content-type\": \"application/json\" },\n });\n}\n// ---------- PWA handlers ----------\nfunction b64ToBytes(b64: string): Uint8Array {\n const binary = atob(b64);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);\n return bytes;\n}\nfunction handleIcon(b64: string): Response {\n return new Response(b64ToBytes(b64), {\n headers: {\n \"content-type\": \"image/png\",\n \"cache-control\": \"public, max-age=86400\",\n },\n });\n}\nfunction handleManifest(): Response {\n const manifest = {\n name: \"Zoro Dashboard\",\n short_name: \"Zoro\",\n start_url: \"/\",\n display: \"standalone\",\n background_color: \"#14151d\",\n theme_color: \"#7c9eff\",\n icons: [\n {\n src: \"/icon-192.png\",\n sizes: \"192x192\",\n type: \"image/png\",\n purpose: \"any maskable\",\n },\n {\n src: \"/icon-512.png\",\n sizes: \"512x512\",\n type: \"image/png\",\n purpose: \"any maskable\",\n },\n ],\n };\n return new Response(JSON.stringify(manifest), {\n headers: { \"content-type\": \"application/manifest+json\" },\n });\n}\nfunction handleServiceWorker(): Response {\n const sw = `\nconst CACHE_NAME = 'zoro-shell-v1';\nself.addEventListener('install', (event) => { self.skipWaiting(); });\nself.addEventListener('activate', (event) => { self.clients.claim(); });\nself.addEventListener('fetch', (event) => {\nconst url = new URL(event.request.url);\nif (url.pathname.startsWith('/api/')) {\nreturn; // always network for live data\n}\nevent.respondWith(\nfetch(event.request)\n.then((res) => {\nconst copy = res.clone();\ncaches.open(CACHE_NAME).then((cache) => cache.put(event.request, copy));\nreturn res;\n})\n.catch(() => caches.match(event.request))\n);\n});\n`;\n return new Response(sw, {\n headers: { \"content-type\": \"application/javascript\" },\n });\n}\n// ---------- Frontend ----------\nconst PAGE_HTML = `\n\n\n\n\nZoro Dashboard\n\n\n\n\n\n\n\n\n\n

Zoro Dashboard

Enter your PIN to continue

\n\n\n\n

\n\n\n\n\n`;\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n if (url.pathname === \"/api/data\") return handleData();\n if (url.pathname === \"/api/update-item\" && req.method === \"POST\") {\n return handleUpdateItem(req);\n }\n if (url.pathname === \"/api/add-item\" && req.method === \"POST\") {\n return handleAddItem(req);\n }\n if (url.pathname === \"/api/order\" && req.method === \"GET\") {\n return handleGetOrder();\n }\n if (url.pathname === \"/api/order\" && req.method === \"POST\") {\n return handleSetOrder(req);\n }\n if (url.pathname === \"/manifest.json\") return handleManifest();\n if (url.pathname === \"/sw.js\") return handleServiceWorker();\n if (url.pathname === \"/icon-192.png\") return handleIcon(ICON_192_B64);\n if (url.pathname === \"/icon-512.png\") return handleIcon(ICON_512_B64);\n return new Response(PAGE_HTML, {\n headers: { \"content-type\": \"text/html; charset=utf-8\" },\n });\n}","// ============================================================\n// Zoro Dashboard v3 — paste this whole file into your Val Town HTTP val\n// ============================================================\n// Requires two environment variables already set in this val:\n// GOOGLE_SA_EMAIL -> your service account's client_email\n// GOOGLE_SA_PRIVATE_KEY -> your service account's private_key (whole PEM block)\n// The service account must have Editor access on the \"Data base\" Sheet.\n//\n// PIN gate: 2222 = Ahmed (full edit), 2468 = Zahra (view-only, no Ledger,\n// no \"Ahmed's Daily Tasks\" checklist). This is a soft/family gate, not real\n// auth — the PINs live in the page source like any client-side check.\nconst SPREADSHEET_ID = \"1-hmgkH-NE4DsXRwi69160kamCztjQ4-jVfEJpaKZ9pI\";\nconst SHEET_NAME = \"Sheet1\";\nconst ORDER_BLOB_KEY = \"zoro-dashboard-section-order-v2\";\nconst AHMED_PIN = \"2222\";\nconst ZAHRA_PIN = \"2468\";\n// ---------- PWA assets ----------\nconst ICON_192_B64 =\n \"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAIAAAD8GO2jAAAAKUlEQVR42u3NQQkAAAgEsAtuFqtqCh/CYP+lek5FIBAIBAKBQCAQfAkWOzFkediIa1EAAAAASUVORK5CYII=\";\nconst ICON_512_B64 =\n \"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAIAAAD8GO2jAAAAKUlEQVR42u3NQQkAAAgEsAtuFqtqCh/CYP+lek5FIBAIBAKBQCAQfAkWOzFkediIa1EAAAAASUVORK5CYII=\";\n// ---------- Google auth (service account -> access token) ----------\nfunction pemToArrayBuffer(pem: string): ArrayBuffer {\n const clean = pem\n .replace(/-----BEGIN PRIVATE KEY-----/, \"\")\n .replace(/-----END PRIVATE KEY-----/, \"\")\n .replace(/\\\\n/g, \"\")\n .replace(/\\s/g, \"\");\n const binary = atob(clean);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);\n return bytes.buffer;\n}\nfunction b64url(input: ArrayBuffer | object): string {\n let bytes: Uint8Array;\n if (input instanceof ArrayBuffer) bytes = new Uint8Array(input);\n else bytes = new TextEncoder().encode(JSON.stringify(input));\n let str = \"\";\n bytes.forEach((b) => (str += String.fromCharCode(b)));\n return btoa(str).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\nlet cachedToken: { token: string; expires: number } | null = null;\nasync function getAccessToken(): Promise {\n if (cachedToken && cachedToken.expires > Date.now() + 30000) {\n return cachedToken.token;\n }\n const email = Deno.env.get(\"GOOGLE_SA_EMAIL\")!;\n const rawKey = Deno.env.get(\"GOOGLE_SA_PRIVATE_KEY\")!.replace(/\\\\n/g, \"\\n\");\n const key = await crypto.subtle.importKey(\n \"pkcs8\",\n pemToArrayBuffer(rawKey),\n { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const now = Math.floor(Date.now() / 1000);\n const header = { alg: \"RS256\", typ: \"JWT\" };\n const claims = {\n iss: email,\n scope: \"https://www.googleapis.com/auth/spreadsheets\",\n aud: \"https://oauth2.googleapis.com/token\",\n iat: now,\n exp: now + 3600,\n };\n const unsigned = b64url(header) + \".\" + b64url(claims);\n const sig = await crypto.subtle.sign(\n \"RSASSA-PKCS1-v1_5\",\n key,\n new TextEncoder().encode(unsigned),\n );\n const jwt = unsigned + \".\" + b64url(sig);\n const res = await fetch(\"https://oauth2.googleapis.com/token\", {\n method: \"POST\",\n headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n body: \"grant_type=\" +\n encodeURIComponent(\"urn:ietf:params:oauth:grant-type:jwt-bearer\") +\n \"&assertion=\" +\n jwt,\n });\n const data = await res.json();\n if (!data.access_token) {\n throw new Error(\"Auth failed: \" + JSON.stringify(data));\n }\n cachedToken = {\n token: data.access_token,\n expires: Date.now() + data.expires_in * 1000,\n };\n return data.access_token;\n}\n// ---------- Sheets API helpers ----------\nfunction colLetter(zeroIndex: number): string {\n let n = zeroIndex + 1;\n let s = \"\";\n while (n > 0) {\n const r = (n - 1) % 26;\n s = String.fromCharCode(65 + r) + s;\n n = Math.floor((n - 1) / 26);\n }\n return s;\n}\nasync function sheetsGetAll(): Promise<\n { header: string[]; rows: Record[] }\n> {\n const token = await getAccessToken();\n const res = await fetch(\n `https://sheets.googleapis.com/v4/spreadsheets/${SPREADSHEET_ID}/values/${\n encodeURIComponent(\n SHEET_NAME,\n )\n }`,\n { headers: { Authorization: \"Bearer \" + token } },\n );\n const data = await res.json();\n const values: string[][] = data.values || [];\n const header = (values[0] || []).map((h) => h.trim());\n const rows = values.slice(1).map((r) => {\n const obj: Record = {};\n header.forEach((h, i) => (obj[h] = r[i] || \"\"));\n return obj;\n });\n return { header, rows };\n}\nasync function sheetsUpdateCell(\n rowNumber: number,\n colIndex: number,\n value: string,\n) {\n const token = await getAccessToken();\n const range = `${SHEET_NAME}!${colLetter(colIndex)}${rowNumber}:${\n colLetter(colIndex)\n }${rowNumber}`;\n await fetch(\n `https://sheets.googleapis.com/v4/spreadsheets/${SPREADSHEET_ID}/values/${\n encodeURIComponent(\n range,\n )\n }?valueInputOption=RAW`,\n {\n method: \"PUT\",\n headers: {\n Authorization: \"Bearer \" + token,\n \"content-type\": \"application/json\",\n },\n body: JSON.stringify({ values: [[value]] }),\n },\n );\n}\n// ---------- API handlers ----------\nasync function handleData(): Promise {\n const { header, rows } = await sheetsGetAll();\n // Self-provision the Investment/Balance columns so n8n's autoMapInputData\n // append has somewhere to write them (cheap no-op once they already exist).\n await ensureColumns(header, [\n \"asset_name\",\n \"quantity\",\n \"flow_direction\",\n \"debt_flow\",\n ]);\n rows.sort((a, b) => (b.date || \"\").localeCompare(a.date || \"\"));\n return new Response(JSON.stringify(rows), {\n headers: { \"content-type\": \"application/json\" },\n });\n}\n// Statuses that count as \"finished\" for the purposes of auto-tracking completed_at.\nconst COMPLETION_STATUSES = [\"done\", \"paid\"];\n// Returns the column index for `name`, creating the header cell (appending a new\n// column) if it doesn't exist yet. Mutates `header` in place so later lookups in\n// the same request see the new column too.\nasync function ensureColumns(header: string[], names: string[]): Promise {\n const missing = names.filter((n) => header.indexOf(n) === -1);\n if (!missing.length) return;\n const startIdx = header.length;\n header.push(...missing);\n const token = await getAccessToken();\n const endIdx = startIdx + missing.length;\n // The sheet's grid may not have enough columns yet -- expand it first,\n // otherwise the values.update PUT below fails with \"exceeds grid limits\".\n const metaResp = await fetch(\n `https://sheets.googleapis.com/v4/spreadsheets/${SPREADSHEET_ID}?fields=sheets.properties`,\n { headers: { Authorization: \"Bearer \" + token } },\n );\n const meta = await metaResp.json();\n const sheetProps = (meta.sheets || []).map((s: any) => s.properties).find(\n (p: any) => p.title === SHEET_NAME,\n );\n if (\n sheetProps && sheetProps.gridProperties &&\n sheetProps.gridProperties.columnCount < endIdx\n ) {\n await fetch(\n `https://sheets.googleapis.com/v4/spreadsheets/${SPREADSHEET_ID}:batchUpdate`,\n {\n method: \"POST\",\n headers: {\n Authorization: \"Bearer \" + token,\n \"content-type\": \"application/json\",\n },\n body: JSON.stringify({\n requests: [{\n appendDimension: {\n sheetId: sheetProps.sheetId,\n dimension: \"COLUMNS\",\n length: endIdx - sheetProps.gridProperties.columnCount,\n },\n }],\n }),\n },\n );\n }\n const startCol = colLetter(startIdx);\n const endCol = colLetter(startIdx + missing.length - 1);\n const range = `${SHEET_NAME}!${startCol}1:${endCol}1`;\n await fetch(\n `https://sheets.googleapis.com/v4/spreadsheets/${SPREADSHEET_ID}/values/${\n encodeURIComponent(range)\n }?valueInputOption=RAW`,\n {\n method: \"PUT\",\n headers: {\n Authorization: \"Bearer \" + token,\n \"content-type\": \"application/json\",\n },\n body: JSON.stringify({ values: [missing] }),\n },\n );\n}\nasync function ensureColumn(header: string[], name: string): Promise {\n const existing = header.indexOf(name);\n if (existing >= 0) return existing;\n const newIdx = header.length;\n header.push(name);\n await sheetsUpdateCell(1, newIdx, name);\n return newIdx;\n}\nasync function handleUpdateItem(req: Request): Promise {\n const body = await req.json();\n const { id, status, notes, archived, pin } = body;\n if (pin !== AHMED_PIN && pin !== ZAHRA_PIN) {\n return new Response(JSON.stringify({ error: \"unauthorized\" }), {\n status: 403,\n });\n }\n if (!id) {\n return new Response(JSON.stringify({ error: \"id required\" }), {\n status: 400,\n });\n }\n const { header, rows } = await sheetsGetAll();\n const idx = rows.findIndex((r) => r.id === id);\n if (idx === -1) {\n return new Response(JSON.stringify({ error: \"not found\" }), {\n status: 404,\n });\n }\n const rowNumber = idx + 2; // +1 header, +1 to move from 0-index to 1-index\n const currentRow = rows[idx];\n if (pin === ZAHRA_PIN && (currentRow.type !== \"Grocery\" || notes !== undefined)) {\n return new Response(JSON.stringify({ error: \"unauthorized\" }), {\n status: 403,\n });\n }\n if (status !== undefined) {\n const colIdx = header.indexOf(\"status\");\n if (colIdx >= 0) await sheetsUpdateCell(rowNumber, colIdx, status);\n // Auto-track completed_at whenever an item transitions into or out of a\n // completion status (done/paid), so the dashboard can show \"finished on X\"\n // and later build completion-based views without any manual date entry.\n const wasComplete = COMPLETION_STATUSES.includes(\n (currentRow.status || \"\").toLowerCase(),\n );\n const isComplete = COMPLETION_STATUSES.includes(\n (status || \"\").toLowerCase(),\n );\n if (isComplete && !wasComplete) {\n const completedIdx = await ensureColumn(header, \"completed_at\");\n await sheetsUpdateCell(rowNumber, completedIdx, new Date().toISOString());\n } else if (!isComplete && wasComplete) {\n const completedIdx = await ensureColumn(header, \"completed_at\");\n await sheetsUpdateCell(rowNumber, completedIdx, \"\");\n }\n }\n if (notes !== undefined) {\n const colIdx = header.indexOf(\"notes\");\n if (colIdx >= 0) await sheetsUpdateCell(rowNumber, colIdx, notes);\n }\n if (archived !== undefined) {\n const colIdx = await ensureColumn(header, \"archived\");\n await sheetsUpdateCell(rowNumber, colIdx, archived ? \"TRUE\" : \"FALSE\");\n }\n return new Response(JSON.stringify({ ok: true }), {\n headers: { \"content-type\": \"application/json\" },\n });\n}\nfunction generateId(): string {\n const n = new Date();\n const p = (x: number) => x < 10 ? \"0\" + x : String(x);\n return String(n.getFullYear()) + p(n.getMonth() + 1) + p(n.getDate()) + \"-\" +\n p(n.getHours()) + p(n.getMinutes()) + p(n.getSeconds()) + \"-\" +\n Math.random().toString(36).slice(2, 6);\n}\nasync function handleAddItem(req: Request): Promise {\n const body = await req.json();\n const {\n pin,\n type,\n topic,\n title,\n description,\n amount,\n currency,\n event_date,\n event_time,\n due_date,\n merchant,\n asset_name,\n } = body;\n if (pin !== AHMED_PIN && pin !== ZAHRA_PIN) {\n return new Response(JSON.stringify({ error: \"unauthorized\" }), {\n status: 403,\n });\n }\n if (pin === ZAHRA_PIN && type !== \"Grocery\") {\n return new Response(JSON.stringify({ error: \"unauthorized\" }), {\n status: 403,\n });\n }\n if (!type || !topic || !title) {\n return new Response(\n JSON.stringify({ error: \"type, topic, and title are required\" }),\n { status: 400 },\n );\n }\n const { header } = await sheetsGetAll();\n await ensureColumns(header, [\n \"asset_name\",\n \"quantity\",\n \"flow_direction\",\n \"debt_flow\",\n ]);\n const id = generateId();\n const rowObj: Record = {};\n header.forEach((h) => {\n rowObj[h] = \"\";\n });\n Object.assign(rowObj, {\n id,\n date: new Date().toISOString(),\n type,\n topic,\n title,\n archived: \"FALSE\",\n });\n if (description) rowObj.description = description;\n if (amount) rowObj.amount = String(amount);\n if (currency) rowObj.currency = currency;\n if (event_date) rowObj.event_date = event_date;\n if (event_time) rowObj.event_time = event_time;\n if (due_date) rowObj.due_date = due_date;\n if (merchant) rowObj.merchant = merchant;\n if (asset_name) rowObj.asset_name = asset_name;\n if (header.indexOf(\"added_by\") >= 0) rowObj.added_by = \"dashboard\";\n const rowValues = header.map((h) => rowObj[h] !== undefined ? rowObj[h] : \"\");\n const token = await getAccessToken();\n await fetch(\n `https://sheets.googleapis.com/v4/spreadsheets/${SPREADSHEET_ID}/values/${\n encodeURIComponent(SHEET_NAME)\n }:append?valueInputOption=RAW&insertDataOption=INSERT_ROWS`,\n {\n method: \"POST\",\n headers: {\n Authorization: \"Bearer \" + token,\n \"content-type\": \"application/json\",\n },\n body: JSON.stringify({ values: [rowValues] }),\n },\n );\n return new Response(JSON.stringify({ ok: true, id }), {\n headers: { \"content-type\": \"application/json\" },\n });\n}\nasync function handleGetOrder(): Promise {\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n const order = (await blob.getJSON(ORDER_BLOB_KEY)) || {};\n return new Response(JSON.stringify(order), {\n headers: { \"content-type\": \"application/json\" },\n });\n}\nasync function handleSetOrder(req: Request): Promise {\n const body = await req.json();\n if (body.pin !== AHMED_PIN && body.pin !== ZAHRA_PIN) {\n return new Response(JSON.stringify({ error: \"unauthorized\" }), {\n status: 403,\n });\n }\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n const order = { feed: body.feed || [], ledger: body.ledger || [], grocery: body.grocery || [] };\n await blob.setJSON(ORDER_BLOB_KEY, order);\n return new Response(JSON.stringify({ ok: true }), {\n headers: { \"content-type\": \"application/json\" },\n });\n}\n// ---------- PWA handlers ----------\nfunction b64ToBytes(b64: string): Uint8Array {\n const binary = atob(b64);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);\n return bytes;\n}\nfunction handleIcon(b64: string): Response {\n return new Response(b64ToBytes(b64), {\n headers: {\n \"content-type\": \"image/png\",\n \"cache-control\": \"public, max-age=86400\",\n },\n });\n}\nfunction handleManifest(): Response {\n const manifest = {\n name: \"Zoro Dashboard\",\n short_name: \"Zoro\",\n start_url: \"/\",\n display: \"standalone\",\n background_color: \"#14151d\",\n theme_color: \"#7c9eff\",\n icons: [\n {\n src: \"/icon-192.png\",\n sizes: \"192x192\",\n type: \"image/png\",\n purpose: \"any maskable\",\n },\n {\n src: \"/icon-512.png\",\n sizes: \"512x512\",\n type: \"image/png\",\n purpose: \"any maskable\",\n },\n ],\n };\n return new Response(JSON.stringify(manifest), {\n headers: { \"content-type\": \"application/manifest+json\" },\n });\n}\nfunction handleServiceWorker(): Response {\n const sw = `\nconst CACHE_NAME = 'zoro-shell-v1';\nself.addEventListener('install', (event) => { self.skipWaiting(); });\nself.addEventListener('activate', (event) => { self.clients.claim(); });\nself.addEventListener('fetch', (event) => {\nconst url = new URL(event.request.url);\nif (url.pathname.startsWith('/api/')) {\nreturn; // always network for live data\n}\nevent.respondWith(\nfetch(event.request)\n.then((res) => {\nconst copy = res.clone();\ncaches.open(CACHE_NAME).then((cache) => cache.put(event.request, copy));\nreturn res;\n})\n.catch(() => caches.match(event.request))\n);\n});\n`;\n return new Response(sw, {\n headers: { \"content-type\": \"application/javascript\" },\n });\n}\n// ---------- Frontend ----------\nconst PAGE_HTML = `\n\n\n\n\nZoro Dashboard\n\n\n\n\n\n\n\n\n\n

Zoro Dashboard

Enter your PIN to continue

\n\n\n\n

Zoro Dashboard

Quick Add

Zoro Dashboard

Quick Add

Diff · v62