[{"_1":2,"_332":-5,"_333":-5},"loaderData",{"_3":4,"_95":96,"_267":268},"root",{"_5":6,"_36":37,"_68":69},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":22,"_29":22,"_30":22,"_31":-5,"_32":33,"_34":22,"_35":22},"auth",{"_9":10,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":-5,"_20":-5,"_21":22},"tokenType","session_token","sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesChatPanelState","notificationCount",0,"flagDenols","isBusinessOrgMember","ENV",{"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":57,"_58":59,"_60":61,"_62":63,"_64":65,"_66":67},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","f33c6f02e3b9304fe5cb194294cedf6a64b697a5","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","API_URL","https://api.val.town","clerkState",{"_70":71},"__internal_clerk_state",{"_72":73,"_74":47,"_75":76,"_77":76,"_78":22,"_79":76,"_80":76,"_81":76,"_82":76,"_83":84,"_93":22,"_94":22},"__clerk_ssr_state",{"_9":10,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":-5,"_20":-5,"_21":22},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_85":22,"_21":22,"_86":76,"_87":88,"_89":76,"_90":47,"_91":22,"_92":76},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/_app.x.$handle.$name",{"_97":98,"_99":100,"_101":45,"_102":103,"_104":-7,"_105":106,"_158":159,"_240":241,"_242":243,"_255":256,"_257":258,"_261":-5,"_262":-5,"_263":22,"_264":22,"_265":266},"handle","abhishekplating","name","PlatingPro","branchName","path","ppAuth.ts","version","project",{"_107":108,"_99":100,"_109":110,"_111":-5,"_112":22,"_113":114,"_115":116,"_117":-5,"_14":118,"_119":-5,"_120":22,"_121":-5,"_122":-5,"_123":33,"_16":124,"_125":-5,"_126":-5,"_127":-5,"_128":129,"_130":129,"_131":132,"_133":132,"_134":132,"_135":129,"_136":129,"_23":137,"_140":141,"_145":146,"_157":22},"id","1fffa610-245e-11f1-b73d-42dde27851f2","createdAt",["D",1774012210756],"deletedAt","legacyEnvVars","privacy","public","description","V1","imageUrl","019ca7d6-bbec-76d6-822b-6e2c39ed1dbd","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","019ca7d6-bbec-76d6-822b-72f395b7c435","tursoName","tursoHostname","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_97":98,"_138":139},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoiZGVmYXVsdCIsImlpZCI6Imluc18yTm10cGhQUklwU0tqZHNiOHNnNGd2ZjJURFUiLCJyaWQiOiJ1c2VyXzNBS1hsRkxLQ2d3eHdUMVYzU3p3YTNmakRRbSJ9","org",{"_97":98,"_142":139,"_14":118,"_143":144},"avatar","tier","free","branch",{"_104":147,"_99":45,"_107":148,"_149":108,"_150":-5,"_151":-5,"_152":-5,"_153":-5,"_154":-5,"_155":100,"_156":98},104,"20008210-245e-11f1-b73d-42dde27851f2","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","tree",[160,181,191,200,210,221,230],{"_107":161,"_99":162,"_163":164,"_165":-5,"_166":148,"_167":147,"_168":169,"_109":170,"_104":171,"_172":173,"_174":175,"_176":22,"_177":-5,"_178":179,"_102":180},"4679aa9c-2c70-11f1-b5fd-42dde27851f2","main.ts","fileId","200494d6-245e-11f1-b73d-42dde27851f2","parentId","branchId","branchVersion","latest",true,["D",1774899615537],46,"fileType","http","content","// PlatingPro — Main Router (V22)\nimport { ok, err, handleOptions, rateLimit, ensureAuditTable, sql } from \"./ppShared.ts\";\nimport { login, logout, revokeSelfSessions, verifyToken, getUsers, addUser, deleteUser, updateUser, revokeUserSessions } from \"./ppAuth.ts\";\nimport {\n getDashboard, getDailyData, compareMonths,\n getTargets, updateTarget, deleteTarget,\n getUtilization, updateCapacity,\n getDailyDetail, getGrowth, getPareto,\n getActions, createAction, updateAction,\n getHealthLog, getInsights,\n getMonths, getMoulds,\n getSettings, updateSetting,\n getWhatsAppSummary, sendWhatsApp,\n getTrendPrediction, askQuestion, getExportData,\n getAuditLog\n} from \"./ppAnalytics.ts\";\nimport {\n addProduction, addProductionBatch,\n deleteProduction, deleteProductionBatch,\n getDailyDetailWithIds, getFrequentItems,\n getPrevDayEntries, uploadChunk,\n ensureProductionIndexes\n} from \"./ppProduction.ts\";\nimport {\n salesPing, migrateSales,\n getSalesCustomers, upsertSalesCustomer,\n setSalesCustomerFactory, deleteSalesCustomer,\n saveSalesInvoice, getSalesInvoicesByDate,\n getSalesInvoiceDetail, deleteSalesInvoice, updateSalesInvoice,\n getSalesDashboard, getSalesDates,\n getSalesMonths, getSalesCustomerSummary,\n getOroBeadsMatch\n} from \"./ppSales.ts\";\nimport {\n scanSalesInvoice, gmailSyncOne, gmailSyncBulk,\n getGmailSyncLog, getGmailSyncStats,\n gmailSyncRetry, gmailSyncDelete, bulkScanInvoices\n} from \"./ppSalesAI.ts\";\n\n// Ensure audit table + production indexes at startup (idempotent)\nensureAuditTable();\nensureProductionIndexes();\n\n// FIX 5: Role helpers\nfunction isAdmin(u: any): boolean { return u?.role === \"admin\"; }\n// Roles in DB: \"admin\" | \"management\" | \"operator\"\nfunction isManager(u: any): boolean { return [\"admin\", \"management\"].includes(u?.role); }\n// operator = any authenticated user; isManager/isAdmin for write gates\n\nexport default async function(req: Request): Promise {\n // FIX 2: OPTIONS preflight with request-aware CORS (no wildcard)\n if (req.method === \"OPTIONS\") return handleOptions(req);\n\n const url = new URL(req.url);\n const path = url.pathname.replace(/\\/+$/, \"\");\n const params = url.searchParams;\n const method = req.method;\n const ip = req.headers.get(\"cf-connecting-ip\") || req.headers.get(\"x-forwarded-for\") || \"anon\";\n\n try {\n // ── Public ────────────────────────────────────────────────────\n if (path === \"/api/ping\") return ok({ status: \"ok\", app: \"PlatingPro\", v: 22 }, req);\n\n if (path === \"/api/login\" && method === \"POST\") {\n if (rateLimit(\"login:\" + ip, 10, 60000)) return err(\"Too many login attempts\", 429, req);\n return login(await req.json(), req);\n }\n\n // ── Auth guard ────────────────────────────────────────────────\n const token = req.headers.get(\"Authorization\")?.replace(\"Bearer \", \"\") || \"\";\n const user = await verifyToken(token);\n if (!user) return err(\"Unauthorized\", 401, req);\n const uname: string = user.user_name;\n\n // ── Session management ────────────────────────────────────────\n if (path === \"/api/logout\" && method === \"POST\") return logout(token, req);\n\n // Return current user info (used by frontend to refresh stale localStorage role)\n if (path === \"/api/me\" && method === \"GET\") {\n const u = await sql`SELECT username,display_name,role FROM pp_users WHERE username=${uname} AND active=true`;\n if (!u || u.length === 0) return err(\"User not found\", 404, req);\n return ok({ user: { username: u[0].username, name: u[0].display_name, role: u[0].role } }, req);\n }\n\n // FIX 7: Revoke all own sessions (self-service)\n if (path === \"/api/sessions/revoke-all\" && method === \"POST\") {\n return revokeSelfSessions(uname, token, req);\n }\n\n // ── Analytics — all authenticated ────────────────────────────\n if (path === \"/api/dashboard\") return getDashboard(params, req);\n if (path === \"/api/daily\") return getDailyData(params, req);\n if (path === \"/api/compare\") return compareMonths(params, req);\n if (path === \"/api/targets\" && method === \"GET\") return getTargets(req);\n if (path === \"/api/utilization\") return getUtilization(params, req);\n if (path === \"/api/daily-detail\") return getDailyDetail(params, req);\n if (path === \"/api/growth\") return getGrowth(req);\n if (path === \"/api/pareto\") return getPareto(params, req);\n if (path === \"/api/actions\" && method === \"GET\") return getActions(req);\n if (path === \"/api/health\") return getHealthLog(req);\n if (path === \"/api/insights\") return getInsights(params, req);\n if (path === \"/api/months\") return getMonths(req);\n if (path === \"/api/moulds\") return getMoulds(req);\n if (path === \"/api/prediction\") return getTrendPrediction(req);\n if (path === \"/api/export\") return getExportData(params, req);\n if (path === \"/api/whatsapp\") return getWhatsAppSummary(params, req);\n if (path === \"/api/settings\" && method === \"GET\") return getSettings(user, req);\n // Return Gemini key to authenticated users (needed for large-file client-side scanning)\n if (path === \"/api/gemini-key\" && method === \"GET\") {\n const r = await sql`SELECT value FROM pp_settings WHERE key='gemini_api_key'`;\n const key = r?.[0]?.value || null;\n return ok({ key }, req);\n }\n\n // FIX 5: Targets/capacity/actions write — manager+\n if (path === \"/api/targets\" && method === \"POST\") {\n if (!isManager(user)) return err(\"Forbidden\", 403, req);\n return updateTarget(await req.json(), req);\n }\n if (path === \"/api/targets\" && method === \"DELETE\") {\n if (!isAdmin(user)) return err(\"Forbidden: admin only\", 403, req);\n return deleteTarget(await req.json(), req);\n }\n if (path === \"/api/capacity\" && method === \"POST\") {\n if (!isManager(user)) return err(\"Forbidden\", 403, req);\n return updateCapacity(await req.json(), req);\n }\n if (path === \"/api/actions\" && method === \"POST\") {\n if (!isManager(user)) return err(\"Forbidden\", 403, req);\n return createAction(await req.json(), req);\n }\n if (path === \"/api/actions\" && method === \"PUT\") {\n if (!isManager(user)) return err(\"Forbidden\", 403, req);\n return updateAction(await req.json(), req);\n }\n\n // AI — rate limited, any authenticated\n if (path === \"/api/ask\" && method === \"POST\") {\n if (rateLimit(\"ask:\" + uname, 20, 60000)) return err(\"Too many requests\", 429, req);\n return askQuestion(await req.json(), uname, req);\n }\n if (path === \"/api/whatsapp-send\" && method === \"POST\") {\n if (!isManager(user)) return err(\"Forbidden\", 403, req);\n return sendWhatsApp(await req.json(), req);\n }\n\n // Settings — admin only for writes\n if (path === \"/api/settings\" && method === \"POST\") {\n if (!isAdmin(user)) return err(\"Forbidden: admin only\", 403, req);\n return updateSetting(await req.json(), uname, req);\n }\n\n // Audit log — admin only\n if (path === \"/api/audit-log\" && method === \"GET\") {\n if (!isAdmin(user)) return err(\"Forbidden: admin only\", 403, req);\n return getAuditLog(params, req);\n }\n\n // ── User management — admin only ──────────────────────────────\n if (path === \"/api/users\") {\n if (!isAdmin(user)) return err(\"Forbidden: admin only\", 403, req);\n if (method === \"GET\") return getUsers(req);\n if (method === \"POST\") return addUser(await req.json(), uname, req);\n if (method === \"DELETE\") return deleteUser(await req.json(), uname, req);\n if (method === \"PUT\") return updateUser(await req.json(), uname, req);\n }\n if (path === \"/api/users/revoke\" && method === \"POST\") {\n if (!isAdmin(user)) return err(\"Forbidden: admin only\", 403, req);\n return revokeUserSessions(await req.json(), req);\n }\n\n // ── Production — FIX 5: write routes require manager+ ─────────\n if (path === \"/api/daily-detail-ids\") return getDailyDetailWithIds(params, req);\n if (path === \"/api/frequent-items\" || path === \"/api/frequent\") return getFrequentItems(req);\n if (path === \"/api/prev-day\") return getPrevDayEntries(params, req);\n\n if (path === \"/api/production\" && method === \"POST\") {\n if (!isManager(user)) return err(\"Forbidden\", 403, req);\n return addProduction(await req.json(), req);\n }\n if (path === \"/api/production/batch\" && method === \"POST\") {\n if (!isManager(user)) return err(\"Forbidden\", 403, req);\n return addProductionBatch(await req.json(), req);\n }\n if (path === \"/api/production\" && method === \"DELETE\") {\n if (!isAdmin(user)) return err(\"Forbidden: admin only\", 403, req);\n return deleteProduction(await req.json(), req);\n }\n if (path === \"/api/production/batch-delete\" && method === \"POST\") {\n if (!isAdmin(user)) return err(\"Forbidden: admin only\", 403, req);\n return deleteProductionBatch(await req.json(), req);\n }\n if (path === \"/api/upload\" && method === \"POST\") {\n if (!isManager(user)) return err(\"Forbidden\", 403, req);\n return uploadChunk(await req.json(), req);\n }\n\n // ── Sales reads — any authenticated ──────────────────────────\n if (path === \"/api/sales/ping\") return salesPing(req);\n if (path === \"/api/sales/customers\" && method === \"GET\") return getSalesCustomers(req);\n if (path === \"/api/sales/invoices\" && method === \"GET\") return getSalesInvoicesByDate(params, req);\n if (path === \"/api/sales/invoice-detail\") return getSalesInvoiceDetail(params, req);\n if (path === \"/api/sales/dashboard\") return getSalesDashboard(params, req);\n if (path === \"/api/sales/dates\") return getSalesDates(params, req);\n if (path === \"/api/sales/customer-lookup\" && method === \"GET\") {\n const name = params.get(\"name\") || \"\";\n if (!name) return ok({ factory: null, is_new: true }, req);\n const r = await sql`SELECT factory FROM pp_sales_customers WHERE LOWER(TRIM(name))=LOWER(TRIM(${name})) AND is_deleted IS NOT TRUE LIMIT 1`;\n return ok({ factory: r[0]?.factory || null, is_new: r.length === 0 }, req);\n }\n if (path === \"/api/sales/months\") return getSalesMonths(req);\n if (path === \"/api/sales/customer-summary\") return getSalesCustomerSummary(params, req);\n if (path === \"/api/sales/orobeads-match\") return getOroBeadsMatch(params, req);\n if (path === \"/api/sales/gmail-sync-log\") return getGmailSyncLog(params, req);\n if (path === \"/api/sales/gmail-sync-stats\") return getGmailSyncStats(req);\n\n // ── Sales writes — manager+ ───────────────────────────────────\n if (path === \"/api/sales/migrate\" && method === \"POST\") {\n if (!isAdmin(user)) return err(\"Forbidden: admin only\", 403, req);\n return migrateSales(req);\n }\n if (path === \"/api/sales/customers\" && method === \"POST\") {\n if (!isManager(user)) return err(\"Forbidden\", 403, req);\n return upsertSalesCustomer(await req.json(), req);\n }\n if (path === \"/api/sales/customers\" && method === \"DELETE\") {\n if (!isAdmin(user)) return err(\"Forbidden: admin only\", 403, req);\n return deleteSalesCustomer(await req.json(), req);\n }\n if (path === \"/api/sales/customers/factory\" && method === \"POST\") {\n if (!isManager(user)) return err(\"Forbidden\", 403, req);\n return setSalesCustomerFactory(await req.json(), req);\n }\n if (path === \"/api/sales/invoices\" && method === \"POST\") {\n if (!isManager(user)) return err(\"Forbidden\", 403, req);\n return saveSalesInvoice(await req.json(), req);\n }\n if (path === \"/api/sales/invoices\" && method === \"PUT\") {\n if (!isManager(user)) return err(\"Forbidden\", 403, req);\n return updateSalesInvoice(await req.json(), req);\n }\n if (path === \"/api/sales/invoices\" && method === \"DELETE\") {\n if (!isAdmin(user)) return err(\"Forbidden: admin only\", 403, req);\n return deleteSalesInvoice(await req.json(), uname, req);\n }\n\n // ── Sales AI & Gmail — rate limited ───────────────────────────\n if (path === \"/api/sales/scan\" && method === \"POST\") {\n if (!isManager(user)) return err(\"Forbidden\", 403, req);\n if (rateLimit(\"scan:\" + ip, 30, 60000)) return err(\"Too many scan requests\", 429, req);\n return scanSalesInvoice(await req.json(), uname, req);\n }\n if (path === \"/api/sales/gmail-sync\" && method === \"POST\") {\n if (!isManager(user)) return err(\"Forbidden\", 403, req);\n return gmailSyncOne(await req.json(), req);\n }\n if (path === \"/api/sales/gmail-sync-bulk\" && method === \"POST\") {\n if (!isAdmin(user)) return err(\"Forbidden: admin only\", 403, req);\n if (rateLimit(\"gmail-bulk:\" + uname, 5, 300000)) return err(\"Too many bulk sync requests, wait 5 min\", 429, req);\n return gmailSyncBulk(await req.json(), req);\n }\n if (path === \"/api/sales/gmail-sync-retry\" && method === \"POST\") {\n if (!isManager(user)) return err(\"Forbidden\", 403, req);\n return gmailSyncRetry(await req.json(), req);\n }\n if (path === \"/api/sales/gmail-sync-delete\" && method === \"DELETE\") {\n if (!isAdmin(user)) return err(\"Forbidden: admin only\", 403, req);\n return gmailSyncDelete(await req.json(), req);\n }\n if (path === \"/api/sales/bulk-scan\" && method === \"POST\") {\n if (!isManager(user)) return err(\"Forbidden\", 403, req);\n return bulkScanInvoices(await req.json(), req);\n }\n\n return err(\"Not found\", 404, req);\n } catch (e: any) {\n return err(\"Server error: \" + (e.message || String(e)), 500, req);\n }\n}\n","deleted","label","children",[],[162],{"_107":182,"_99":183,"_163":184,"_165":-5,"_166":148,"_167":185,"_168":169,"_109":186,"_104":187,"_172":173,"_174":188,"_176":22,"_177":-5,"_178":189,"_102":190},"6d83e500-2c41-11f1-81d2-42dde27851f2","ppAnalytics.ts","0dca08fe-2810-11f1-98ef-42dde27851f2",100,["D",1774879494695],10,"// PlatingPro — Analytics, Reports, AI (V20)\nimport { sql, ok, err, audit, SETTINGS_WHITELIST, rateLimit } from \"./ppShared.ts\";\n\nconst SENSITIVE_KEYS = new Set([\"gemini_api_key\",\"whatsapp_api_key\",\"gmail_credentials\",\"gmail_token\"]);\n\n// Helper: convert YYYY-MM to date range for index-friendly queries\nfunction monthRange(m: string): { start: string; end: string } {\n const [y, mo] = m.split(\"-\").map(Number);\n const start = `${m}-01`;\n const nextMo = mo === 12 ? `${y+1}-01-01` : `${y}-${String(mo+1).padStart(2,\"0\")}-01`;\n return { start, end: nextMo };\n}\n\nexport async function getDashboard(p: URLSearchParams, req?: Request): Promise {\n const m = p.get(\"month\") || \"\";\n if (!m) return ok({ kpi: { total_prod:0,total_value:0,total_rej:0,total_rej_cost:0,rej_rate:0,working_days:0 }, plating:[], categories:[], items:[], reasons:[], topProduct:null, topRejection:null }, req);\n const { start, end } = monthRange(m);\n const [kpi,plat,cats,items,reasons,tp,tr] = await Promise.all([\n sql`SELECT COALESCE(SUM(prod_qty),0)::float as total_prod,COALESCE(SUM(prod_amount),0)::float as total_value,COALESCE(SUM(rej_qty),0)::float as total_rej,COALESCE(SUM(rej_amount),0)::float as total_rej_cost,CASE WHEN SUM(prod_qty)>0 THEN ROUND(SUM(rej_qty)/SUM(prod_qty)*100,2)::float ELSE 0 END as rej_rate,COUNT(DISTINCT prod_date)::int as working_days FROM pp_production WHERE prod_date>=${start}::date AND prod_date<${end}::date`,\n sql`SELECT UPPER(TRIM(plating_type))as plating_type,SUM(prod_qty)::float as prod,SUM(rej_qty)::float as rej,SUM(prod_amount)::float as value,CASE WHEN SUM(prod_qty)>0 THEN ROUND(SUM(rej_qty)/SUM(prod_qty)*100,2)::float ELSE 0 END as rej_pct FROM pp_production WHERE prod_date>=${start}::date AND prod_date<${end}::date GROUP BY UPPER(TRIM(plating_type))ORDER BY SUM(prod_qty)DESC`,\n sql`SELECT UPPER(TRIM(category))as category,SUM(prod_qty)::float as prod,SUM(rej_qty)::float as rej,CASE WHEN SUM(prod_qty)>0 THEN ROUND(SUM(rej_qty)/SUM(prod_qty)*100,2)::float ELSE 0 END as rej_pct FROM pp_production WHERE prod_date>=${start}::date AND prod_date<${end}::date AND category IS NOT NULL AND TRIM(category)!=''GROUP BY UPPER(TRIM(category))ORDER BY SUM(prod_qty)DESC`,\n sql`SELECT item_name,mould_no,UPPER(TRIM(plating_type))as plating_type,SUM(prod_qty)::float as prod,SUM(rej_qty)::float as rej,CASE WHEN SUM(prod_qty)>0 THEN ROUND(SUM(rej_qty)/SUM(prod_qty)*100,2)::float ELSE 0 END as rej_pct FROM pp_production WHERE prod_date>=${start}::date AND prod_date<${end}::date GROUP BY item_name,mould_no,UPPER(TRIM(plating_type))HAVING SUM(rej_qty)>0 ORDER BY SUM(rej_qty)DESC LIMIT 20`,\n sql`SELECT UPPER(TRIM(rej_mark))as reason,COUNT(*)::int as count,SUM(rej_qty)::float as total_kg FROM pp_production WHERE prod_date>=${start}::date AND prod_date<${end}::date AND rej_mark IS NOT NULL AND TRIM(rej_mark)!=''GROUP BY UPPER(TRIM(rej_mark))ORDER BY COUNT(*)DESC`,\n sql`SELECT item_name,mould_no,SUM(prod_qty)::float as prod FROM pp_production WHERE prod_date>=${start}::date AND prod_date<${end}::date GROUP BY item_name,mould_no ORDER BY SUM(prod_qty)DESC LIMIT 1`,\n sql`SELECT item_name,mould_no,CASE WHEN SUM(prod_qty)>0 THEN ROUND(SUM(rej_qty)/SUM(prod_qty)*100,2)::float ELSE 0 END as rej_pct FROM pp_production WHERE prod_date>=${start}::date AND prod_date<${end}::date GROUP BY item_name,mould_no HAVING SUM(prod_qty)>=10 ORDER BY CASE WHEN SUM(prod_qty)>0 THEN SUM(rej_qty)/SUM(prod_qty)ELSE 0 END DESC LIMIT 1`,\n ]);\n return ok({ kpi: kpi[0], plating: plat, categories: cats, items, reasons, topProduct: tp[0]||null, topRejection: tr[0]||null }, req);\n}\n\nexport async function getDailyData(p: URLSearchParams, req?: Request): Promise {\n const m = p.get(\"month\") || \"\";\n if (!m) return ok({ days: [] }, req);\n const r = await sql`SELECT EXTRACT(DAY FROM prod_date)::int as day,SUM(prod_qty)::float as prod,SUM(rej_qty)::float as rej,CASE WHEN SUM(prod_qty)>0 THEN ROUND(SUM(rej_qty)/SUM(prod_qty)*100,2)::float ELSE 0 END as rej_pct FROM pp_production WHERE prod_date>=${m+'-01'}::date AND prod_date<(DATE_TRUNC('month',${m+'-01'}::date)+INTERVAL'1 month')::date GROUP BY prod_date ORDER BY prod_date`;\n return ok({ days: r }, req);\n}\n\nexport async function compareMonths(p: URLSearchParams, req?: Request): Promise {\n const m1 = p.get(\"month1\") || \"\", m2 = p.get(\"month2\") || \"\";\n if (!m1 || !m2) return ok({ summary: [] }, req);\n const r = await sql`SELECT TO_CHAR(prod_date,'YYYY-MM')as month,SUM(prod_qty)::float as prod,SUM(prod_amount)::float as value,SUM(rej_qty)::float as rej,SUM(rej_amount)::float as rej_cost,CASE WHEN SUM(prod_qty)>0 THEN ROUND(SUM(rej_qty)/SUM(prod_qty)*100,2)::float ELSE 0 END as rej_rate FROM pp_production WHERE prod_date>=${m1+'-01'}::date AND prod_date<(DATE_TRUNC('month',${m2+'-01'}::date)+INTERVAL'1 month')::date GROUP BY TO_CHAR(prod_date,'YYYY-MM')`;\n return ok({ summary: r }, req);\n}\n\nexport async function getTargets(req?: Request): Promise {\n return ok({ targets: await sql`SELECT*FROM pp_targets ORDER BY plating_type` }, req);\n}\n\nexport async function updateTarget(b: any, req?: Request): Promise {\n if (b.id) { await sql`UPDATE pp_targets SET target_rej_pct=${Number(b.target_rej_pct)},set_by=${b.set_by||'user'} WHERE id=${b.id}`; return ok({ success: true }, req); }\n const r = await sql`INSERT INTO pp_targets(plating_type,target_rej_pct,set_by)VALUES(${b.plating_type},${Number(b.target_rej_pct)},${b.set_by||'user'})RETURNING*`;\n return ok({ target: r[0] }, req);\n}\n\nexport async function deleteTarget(b: any, req?: Request): Promise {\n if (!b.id) return err(\"id required\", 400, req);\n await sql`DELETE FROM pp_targets WHERE id=${b.id}`;\n return ok({ success: true }, req);\n}\n\nexport async function getUtilization(p: URLSearchParams, req?: Request): Promise {\n const m = p.get(\"month\") || \"\";\n // Auto-create table if missing\n await sql`CREATE TABLE IF NOT EXISTS pp_line_capacity (\n id SERIAL PRIMARY KEY,\n plating_type TEXT UNIQUE NOT NULL,\n monthly_capacity_kg NUMERIC NOT NULL DEFAULT 0\n )`;\n // Seed default plating types if table is empty\n const existing = await sql`SELECT COUNT(*)::int as cnt FROM pp_line_capacity`;\n if ((existing[0] as any).cnt === 0) {\n await sql`INSERT INTO pp_line_capacity(plating_type, monthly_capacity_kg) VALUES\n ('COPPER', 5000),('GOLD', 3000),('NICKEL', 4000),('SILVER', 3000)\n ON CONFLICT(plating_type) DO NOTHING`;\n }\n const [cap, prod] = await Promise.all([\n sql`SELECT * FROM pp_line_capacity ORDER BY plating_type`,\n m ? sql`SELECT UPPER(TRIM(plating_type))as pt,SUM(prod_qty)::float as actual FROM pp_production WHERE prod_date>=${m+'-01'}::date AND prod_date<(DATE_TRUNC('month',${m+'-01'}::date)+INTERVAL'1 month')::date GROUP BY UPPER(TRIM(plating_type))` : Promise.resolve([])\n ]);\n return ok({ utilization: cap.map((c: any) => {\n const p2 = (prod as any[]).find((x: any) => x.pt === c.plating_type.toUpperCase());\n const a = p2 ? p2.actual : 0;\n const cp = Number(c.monthly_capacity_kg);\n return { plating_type: c.plating_type, capacity: cp, actual: a, util_pct: cp > 0 ? Math.round(a/cp*100) : 0 };\n })}, req);\n}\n\nexport async function updateCapacity(b: any, req?: Request): Promise {\n if (b.plating_type === '_total') {\n await sql`INSERT INTO pp_settings(key,value)VALUES('total_plant_capacity',${String(b.capacity)})ON CONFLICT(key)DO UPDATE SET value=${String(b.capacity)}`;\n return ok({ success: true }, req);\n }\n await sql`UPDATE pp_line_capacity SET monthly_capacity_kg=${Number(b.capacity)} WHERE plating_type=${b.plating_type}`;\n return ok({ success: true }, req);\n}\n\nexport async function getDailyDetail(p: URLSearchParams, req?: Request): Promise {\n let dateStr = p.get(\"day\") || \"\";\n if (!dateStr) { const y = new Date(); y.setDate(y.getDate()-1); y.setMinutes(y.getMinutes()+330); dateStr = y.toISOString().slice(0,10); }\n const [r, kpi] = await Promise.all([\n sql`SELECT item_name,mould_no,UPPER(TRIM(plating_type))as plating_type,UPPER(TRIM(category))as category,prod_qty::float as prod,prod_amount::float as value,rej_qty::float as rej,rej_amount::float as rej_cost,rej_mark FROM pp_production WHERE prod_date=${dateStr}::date ORDER BY prod_qty DESC`,\n sql`SELECT COALESCE(SUM(prod_qty),0)::float as total_prod,COALESCE(SUM(prod_amount),0)::float as total_value,COALESCE(SUM(rej_qty),0)::float as total_rej,COALESCE(SUM(rej_amount),0)::float as total_rej_cost,CASE WHEN SUM(prod_qty)>0 THEN ROUND(SUM(rej_qty)/SUM(prod_qty)*100,2)::float ELSE 0 END as rej_rate,COUNT(*)::int as entries FROM pp_production WHERE prod_date=${dateStr}::date`\n ]);\n return ok({ date: dateStr, kpi: kpi[0], items: r }, req);\n}\n\nexport async function getGrowth(req?: Request): Promise {\n const r = await sql`SELECT TO_CHAR(prod_date,'YYYY-MM')as month,SUM(prod_qty)::float as prod,SUM(prod_amount)::float as value,SUM(rej_qty)::float as rej,SUM(rej_amount)::float as rej_cost,COUNT(DISTINCT prod_date)::int as days,CASE WHEN SUM(prod_qty)>0 THEN ROUND(SUM(rej_qty)/SUM(prod_qty)*100,2)::float ELSE 0 END as rej_rate,CASE WHEN COUNT(DISTINCT prod_date)>0 THEN ROUND(SUM(prod_qty)/COUNT(DISTINCT prod_date))::int ELSE 0 END as avg_daily FROM pp_production GROUP BY TO_CHAR(prod_date,'YYYY-MM')ORDER BY month`;\n return ok({ months: r }, req);\n}\n\nexport async function getPareto(p: URLSearchParams, req?: Request): Promise {\n const m = p.get(\"month\") || \"\";\n if (!m) return ok({ pareto: [], totalRej: 0 }, req);\n const r = await sql`SELECT item_name,SUM(rej_qty)::float as rej FROM pp_production WHERE prod_date>=${m+'-01'}::date AND prod_date<(DATE_TRUNC('month',${m+'-01'}::date)+INTERVAL'1 month')::date AND rej_qty>0 GROUP BY item_name ORDER BY SUM(rej_qty)DESC`;\n const tot = r.reduce((s: number, x: any) => s + x.rej, 0);\n let cum = 0;\n return ok({ pareto: r.map((x: any) => { cum += x.rej; return { item: x.item_name, rej: x.rej, cumPct: tot>0?Math.round(cum/tot*100):0 }; }), totalRej: tot });\n}\n\nexport async function getActions(req?: Request): Promise {\n return ok({ actions: await sql`SELECT*FROM pp_actions ORDER BY CASE status WHEN 'open' THEN 1 WHEN 'in-progress' THEN 2 ELSE 3 END,created_at DESC` }, req);\n}\n\nexport async function createAction(b: any, req?: Request): Promise {\n const r = await sql`INSERT INTO pp_actions(item_name,mould_no,issue,severity,assignee,action_text,due_date)VALUES(${b.item_name},${b.mould_no||null},${b.issue},${b.severity||'warning'},${b.assignee||null},${b.action_text||null},${b.due_date||null})RETURNING*`;\n return ok({ action: r[0] }, req);\n}\n\nexport async function updateAction(b: any, req?: Request): Promise {\n if (b.status === 'resolved') await sql`UPDATE pp_actions SET status=${b.status},resolved_at=NOW()WHERE id=${b.id}`;\n else await sql`UPDATE pp_actions SET status=${b.status}WHERE id=${b.id}`;\n return ok({ success: true }, req);\n}\n\nexport async function getHealthLog(req?: Request): Promise {\n return ok({ issues: await sql`SELECT*FROM pp_health_log ORDER BY created_at DESC LIMIT 50` }, req);\n}\n\nexport async function getInsights(p: URLSearchParams, req?: Request): Promise {\n const m = p.get(\"month\");\n return ok({ insights: m ? await sql`SELECT*FROM pp_insights WHERE month=${m} ORDER BY CASE severity WHEN 'critical' THEN 1 WHEN 'warning' THEN 2 ELSE 3 END` : await sql`SELECT*FROM pp_insights ORDER BY created_at DESC LIMIT 30` }, req);\n}\n\nexport async function getMonths(req?: Request): Promise {\n const r = await sql`SELECT DISTINCT TO_CHAR(prod_date,'YYYY-MM')as month FROM pp_production ORDER BY month DESC`;\n return ok({ months: r.map((x: any) => x.month) }, req);\n}\n\nexport async function getMoulds(req?: Request): Promise {\n const r = await sql`SELECT DISTINCT ON (mould_no) mould_no, item_name, UPPER(TRIM(category)) as category, moulding_type, prod_rate as rate, rej_rate, UPPER(TRIM(plating_type)) as plating_type FROM pp_production WHERE mould_no IS NOT NULL AND mould_no!='' ORDER BY mould_no, id DESC`;\n return ok({ moulds: r }, req);\n}\n\nexport async function getSettings(user?: any, req?: Request): Promise {\n const r = await sql`SELECT key,value FROM pp_settings`;\n const s: any = {};\n r.forEach((x: any) => {\n s[x.key] = (SENSITIVE_KEYS.has(x.key) && user?.role !== \"admin\") ? \"****\" : x.value;\n });\n return ok({ settings: s }, req);\n}\n\nexport async function updateSetting(b: any, callerName = \"unknown\", req?: Request): Promise {\n if (!b.key || !SETTINGS_WHITELIST.has(b.key)) return err(\"Invalid or unknown setting key\", 400, req);\n await sql`INSERT INTO pp_settings(key,value)VALUES(${b.key},${b.value})ON CONFLICT(key)DO UPDATE SET value=${b.value},updated_at=NOW()`;\n await audit(callerName, \"UPDATE_SETTING\", \"settings\", { key: b.key });\n return ok({ success: true }, req);\n}\n\nexport async function getWhatsAppSummary(p: URLSearchParams, req?: Request): Promise {\n const m = p.get(\"month\") || \"\";\n if (!m) return ok({ text: \"No month\" }, req);\n const [kpi, top3] = await Promise.all([\n sql`SELECT SUM(prod_qty)::float as prod,SUM(prod_amount)::float as value,SUM(rej_qty)::float as rej,SUM(rej_amount)::float as rej_cost FROM pp_production WHERE prod_date>=${m+'-01'}::date AND prod_date<(DATE_TRUNC('month',${m+'-01'}::date)+INTERVAL'1 month')::date`,\n sql`SELECT item_name,SUM(rej_qty)::float as rej FROM pp_production WHERE prod_date>=${m+'-01'}::date AND prod_date<(DATE_TRUNC('month',${m+'-01'}::date)+INTERVAL'1 month')::date AND rej_qty>0 GROUP BY item_name ORDER BY SUM(rej_qty)DESC LIMIT 3`\n ]);\n const k = kpi[0] || {};\n let t = `📊 *PlatingPro — ${m}*\\n━━━━━━━━━━━━━━━━━\\n🏭 *Arihant Enterprises*\\n\\n*Production:* ${(k.prod||0).toLocaleString('en-IN')} kg\\n*Value:* ₹${(k.value||0).toLocaleString('en-IN')}\\n*Rejection:* ${(k.rej||0).toLocaleString('en-IN')} kg (${k.prod>0?((k.rej||0)/k.prod*100).toFixed(2):'0'}%)\\n*Rej Cost:* ₹${(k.rej_cost||0).toLocaleString('en-IN')}\\n\\n⚠️ *Top Rejections:*\\n`;\n top3.forEach((r: any, i: number) => { t += `${i+1}. ${r.item_name} — ${r.rej.toLocaleString('en-IN')} kg\\n`; });\n return ok({ text: t }, req);\n}\n\nexport async function sendWhatsApp(body: any, req?: Request): Promise {\n const { phone, apikey, month } = body;\n const m = month || '';\n const kpi = await sql`SELECT SUM(prod_qty)::float as prod,SUM(prod_amount)::float as value,SUM(rej_qty)::float as rej,SUM(rej_amount)::float as rej_cost FROM pp_production WHERE prod_date>=${m+'-01'}::date AND prod_date<(DATE_TRUNC('month',${m+'-01'}::date)+INTERVAL'1 month')::date`;\n const top3 = await sql`SELECT item_name,SUM(rej_qty)::float as rej FROM pp_production WHERE prod_date>=${m+'-01'}::date AND prod_date<(DATE_TRUNC('month',${m+'-01'}::date)+INTERVAL'1 month')::date AND rej_qty>0 GROUP BY item_name ORDER BY SUM(rej_qty)DESC LIMIT 3`;\n const k = kpi[0] || {};\n const prod = k.prod || 0; const rej = k.rej || 0;\n const rejRate = prod > 0 ? (rej/prod*100).toFixed(2) : '0';\n let text = `📊 *PlatingPro — ${m}*\\n━━━━━━━━━━━━━━━\\n🏭 *Arihant Enterprises*\\n\\n`;\n text += `*Production:* ${prod.toLocaleString('en-IN')} kg\\n*Value:* ₹${(k.value||0).toLocaleString('en-IN')}\\n*Rejection:* ${rej.toLocaleString('en-IN')} kg (${rejRate}%)\\n*Rej Cost:* ₹${(k.rej_cost||0).toLocaleString('en-IN')}\\n\\n⚠️ *Top Rejections:*\\n`;\n top3.forEach((r: any, i: number) => { text += `${i+1}. ${r.item_name} — ${r.rej.toLocaleString('en-IN')} kg\\n`; });\n if (phone && apikey) {\n try {\n const encoded = encodeURIComponent(text);\n const waResp = await fetch(`https://api.callmebot.com/whatsapp.php?phone=${phone}&text=${encoded}&apikey=${apikey}`);\n const waText = await waResp.text();\n return ok({ sent: true, method: 'callmebot', response: waText, text }, req);\n } catch (e: any) { return ok({ sent: false, error: e.message, text }, req); }\n }\n return ok({ sent: false, method: 'manual', text }, req);\n}\n\nexport async function getTrendPrediction(req?: Request): Promise {\n const months = await sql`SELECT TO_CHAR(prod_date,'YYYY-MM') as month,SUM(prod_qty)::float as prod,SUM(prod_amount)::float as value,SUM(rej_qty)::float as rej,CASE WHEN SUM(prod_qty)>0 THEN ROUND(SUM(rej_qty)/SUM(prod_qty)*100,2)::float ELSE 0 END as rej_rate,COUNT(DISTINCT prod_date)::int as days FROM pp_production GROUP BY TO_CHAR(prod_date,'YYYY-MM') ORDER BY month`;\n if (months.length < 2) return ok({ prediction: null, message: \"Need at least 2 months of data\", months: [] }, req);\n const predict = (values: number[]): number => {\n const n = values.length; if (n < 2) return values[0] || 0;\n let sumX=0,sumY=0,sumXY=0,sumX2=0;\n values.forEach((y, x) => { sumX+=x; sumY+=y; sumXY+=x*y; sumX2+=x*x; });\n const slope = (n*sumXY - sumX*sumY) / (n*sumX2 - sumX*sumX);\n const intercept = (sumY - slope*sumX) / n;\n return Math.max(0, Math.round((slope * n + intercept) * 100) / 100);\n };\n const prodValues = months.map((m: any) => m.prod);\n const rejValues = months.map((m: any) => m.rej_rate);\n const valueValues = months.map((m: any) => m.value);\n const nextProd = predict(prodValues);\n const nextRejRate = Math.max(0, Math.min(100, predict(rejValues)));\n const nextValue = predict(valueValues);\n const nextRej = Math.round(nextProd * nextRejRate / 100 * 100) / 100;\n const prodTrend = prodValues.length >= 2 ? (prodValues[prodValues.length-1] > prodValues[prodValues.length-2] ? 'increasing' : 'decreasing') : 'stable';\n const rejTrend = rejValues.length >= 2 ? (rejValues[rejValues.length-1] > rejValues[rejValues.length-2] ? 'worsening' : 'improving') : 'stable';\n const prediction = { next_month_prod: nextProd, next_month_rej_rate: nextRejRate, next_month_value: nextValue, next_month_rej_kg: nextRej, prod_trend: prodTrend, rej_trend: rejTrend, confidence: Math.min(95, 50 + months.length * 10), based_on: months.length + ' months' };\n let geminiInsight = '';\n try {\n const settingsRes = await sql`SELECT value FROM pp_settings WHERE key='gemini_api_key'`;\n const apiKey = settingsRes[0]?.value;\n if (apiKey) {\n const prompt = `You are a factory analytics expert. Based on this electroplating production data, give 3-4 bullet point predictions and recommendations for next month. Be specific with numbers. Data: ${JSON.stringify(months.map((m: any) => ({ month: m.month, prod_kg: m.prod, value: m.value, rej_rate: m.rej_rate+'%', days: m.days })))}. Regression predicts: Production ${nextProd} kg, Rejection ${nextRejRate}%, Value ₹${nextValue}. Keep response under 200 words.`;\n const gResp = await fetch(`https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent?key=${apiKey}`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ contents: [{ parts: [{ text: prompt }] }], generationConfig: { temperature: 0.3, maxOutputTokens: 500 } }) });\n if (gResp.ok) { const gData = await gResp.json(); geminiInsight = gData.candidates?.[0]?.content?.parts?.[0]?.text || ''; }\n }\n } catch (e) { /* Gemini optional */ }\n return ok({ prediction, months, geminiInsight }, req);\n}\n\nexport async function askQuestion(b: any, callerName = \"anon\", req?: Request): Promise {\n const question = b.question;\n if (!question || !question.trim()) return err(\"Question required\", 400, req);\n const m = b.month || \"\";\n const [kpi,plat,topItems,topRej,reasons] = await Promise.all([\n m ? sql`SELECT COALESCE(SUM(prod_qty),0)::float as total_prod,COALESCE(SUM(prod_amount),0)::float as total_value,COALESCE(SUM(rej_qty),0)::float as total_rej,COALESCE(SUM(rej_amount),0)::float as total_rej_cost,CASE WHEN SUM(prod_qty)>0 THEN ROUND(SUM(rej_qty)/SUM(prod_qty)*100,2)::float ELSE 0 END as rej_rate,COUNT(DISTINCT prod_date)::int as working_days FROM pp_production WHERE prod_date>=${m+'-01'}::date AND prod_date<(DATE_TRUNC('month',${m+'-01'}::date)+INTERVAL'1 month')::date` : Promise.resolve([{ total_prod: 0 }]),\n m ? sql`SELECT UPPER(TRIM(plating_type))as plating_type,SUM(prod_qty)::float as prod,SUM(rej_qty)::float as rej,CASE WHEN SUM(prod_qty)>0 THEN ROUND(SUM(rej_qty)/SUM(prod_qty)*100,2)::float ELSE 0 END as rej_pct FROM pp_production WHERE prod_date>=${m+'-01'}::date AND prod_date<(DATE_TRUNC('month',${m+'-01'}::date)+INTERVAL'1 month')::date GROUP BY UPPER(TRIM(plating_type))ORDER BY SUM(prod_qty)DESC` : Promise.resolve([]),\n m ? sql`SELECT item_name,mould_no,SUM(prod_qty)::float as prod,SUM(rej_qty)::float as rej,CASE WHEN SUM(prod_qty)>0 THEN ROUND(SUM(rej_qty)/SUM(prod_qty)*100,2)::float ELSE 0 END as rej_pct FROM pp_production WHERE prod_date>=${m+'-01'}::date AND prod_date<(DATE_TRUNC('month',${m+'-01'}::date)+INTERVAL'1 month')::date GROUP BY item_name,mould_no ORDER BY SUM(prod_qty)DESC LIMIT 30` : Promise.resolve([]),\n m ? sql`SELECT item_name,mould_no,SUM(rej_qty)::float as rej,CASE WHEN SUM(prod_qty)>0 THEN ROUND(SUM(rej_qty)/SUM(prod_qty)*100,2)::float ELSE 0 END as rej_pct FROM pp_production WHERE prod_date>=${m+'-01'}::date AND prod_date<(DATE_TRUNC('month',${m+'-01'}::date)+INTERVAL'1 month')::date GROUP BY item_name,mould_no HAVING SUM(rej_qty)>0 ORDER BY SUM(rej_qty)DESC LIMIT 15` : Promise.resolve([]),\n m ? sql`SELECT UPPER(TRIM(rej_mark))as reason,COUNT(*)::int as count,SUM(rej_qty)::float as total FROM pp_production WHERE prod_date>=${m+'-01'}::date AND prod_date<(DATE_TRUNC('month',${m+'-01'}::date)+INTERVAL'1 month')::date AND rej_mark IS NOT NULL AND TRIM(rej_mark)!='' GROUP BY UPPER(TRIM(rej_mark))ORDER BY COUNT(*)DESC` : Promise.resolve([])\n ]);\n const k = kpi[0] || {};\n let context = `PlatingPro Data for ${m||'all time'}:\\n`;\n context += `Production: ${k.total_prod||0} kg, Value: ₹${k.total_value||0}, Working Days: ${k.working_days||0}\\n`;\n context += `Rejection: ${k.total_rej||0} kg (${k.rej_rate||0}%), Cost: ₹${k.total_rej_cost||0}\\n\\n`;\n context += `Plating Types:\\n${(plat as any[]).map((p: any) => ` ${p.plating_type}: ${p.prod} kg prod, ${p.rej} kg rej (${p.rej_pct}%)`).join('\\n')}\\n\\n`;\n context += `Top Items:\\n${(topItems as any[]).map((t: any) => ` ${t.item_name} (M${t.mould_no||'?'}): ${t.prod} kg, rej ${t.rej_pct}%`).join('\\n')}\\n\\n`;\n context += `Top Rejections:\\n${(topRej as any[]).map((t: any) => ` ${t.item_name} (M${t.mould_no||'?'}): ${t.rej} kg (${t.rej_pct}%)`).join('\\n')}\\n\\n`;\n context += `Rejection Reasons:\\n${(reasons as any[]).map((r: any) => ` ${r.reason}: ${r.count} times, ${r.total} kg`).join('\\n')}\\n`;\n try {\n const settingsRes = await sql`SELECT value FROM pp_settings WHERE key='gemini_api_key'`;\n const apiKey = settingsRes[0]?.value;\n if (!apiKey) return ok({ answer: \"Gemini API key not configured. Go to Settings.\", source: 'no_key' }, req);\n const prompt = `You are PlatingPro AI assistant for Arihant Enterprises electroplating factory. Answer the user's question using ONLY the data provided. Be concise, use numbers, format with bullet points.\\n\\nLive Factory Data:\\n${context}\\n\\nUser Question: ${question}`;\n const gResp = await fetch(`https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent?key=${apiKey}`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ contents: [{ parts: [{ text: prompt }] }], generationConfig: { temperature: 0.3, maxOutputTokens: 800 } }) });\n if (!gResp.ok) { const t = await gResp.text(); return ok({ answer: 'Gemini error: ' + t, source: 'error' }, req); }\n const gData = await gResp.json();\n const answer = gData.candidates?.[0]?.content?.parts?.[0]?.text || 'No response from Gemini';\n return ok({ answer, source: 'gemini' }, req);\n } catch (e: any) { return ok({ answer: 'Error: ' + e.message, source: 'error' }, req); }\n}\n\nexport async function getExportData(p: URLSearchParams, req?: Request): Promise {\n const from = p.get(\"from\") || \"\", to = p.get(\"to\") || \"\";\n if (!from || !to) return err(\"from and to dates required\", 400, req);\n const r = await sql`SELECT TO_CHAR(prod_date,'DD.MM.YYYY') as date,mould_no,item_name,UPPER(TRIM(plating_type))as plating_type,UPPER(TRIM(category))as category,COALESCE(moulding_type,'OUR MOULDING')as moulding_type,prod_qty::float as prod_qty,prod_rate::float as prod_rate,prod_amount::float as prod_amount,rej_qty::float as rej_qty,rej_rate::float as rej_rate,rej_amount::float as rej_amount,COALESCE(rej_mark,'')as rej_mark FROM pp_production WHERE prod_date>=${from}::date AND prod_date<=${to}::date ORDER BY prod_date,item_name`;\n return ok({ from, to, rows: r }, req);\n}\n\nexport async function getAuditLog(p: URLSearchParams, req?: Request): Promise {\n const limit = Math.min(parseInt(p.get(\"limit\") || \"50\"), 200);\n const module = p.get(\"module\") || \"\";\n const rows = module\n ? await sql`SELECT id,user_name,action,module,data,created_at FROM pp_audit_log WHERE module=${module} ORDER BY id DESC LIMIT ${limit}`\n : await sql`SELECT id,user_name,action,module,data,created_at FROM pp_audit_log ORDER BY id DESC LIMIT ${limit}`;\n return ok({ log: rows }, req);\n}\n",[],[183],{"_107":192,"_99":103,"_163":193,"_165":-5,"_166":148,"_167":194,"_168":169,"_109":195,"_104":196,"_172":173,"_174":197,"_176":22,"_177":-5,"_178":198,"_102":199},"fbdc1242-2c31-11f1-ac34-42dde27851f2","0d4b7c8c-2810-11f1-bc65-42dde27851f2",97,["D",1774872861560],7,"// PlatingPro — Auth + User Management (V22)\nimport { sql, ok, err, audit } from \"./ppShared.ts\";\nimport * as bcrypt from \"https://deno.land/x/bcrypt@v0.4.1/mod.ts\";\n\nexport async function login(b: any, req?: Request): Promise {\n const { username, password } = b;\n if (!username || !password) return err(\"Required\", 400, req);\n const r = await sql`SELECT id,username,display_name,role,password FROM pp_users WHERE username=${username.toLowerCase().trim()} AND active=true`;\n if (!r || r.length === 0) return err(\"Invalid credentials\", 401, req);\n const u = r[0];\n const isHashed = u.password?.startsWith(\"$2\");\n let valid = false;\n if (isHashed) {\n valid = await bcrypt.compare(password, u.password);\n } else {\n valid = u.password === password;\n if (valid) {\n const hashed = await bcrypt.hash(password);\n await sql`UPDATE pp_users SET password=${hashed} WHERE id=${u.id}`;\n }\n }\n if (!valid) return err(\"Invalid credentials\", 401, req);\n const t = crypto.randomUUID();\n await sql`INSERT INTO pp_sessions(token,user_name,role) VALUES(${t},${u.username},${u.role})`;\n return ok({ token: t, user: { username: u.username, name: u.display_name, role: u.role } }, req);\n}\n\nexport async function verifyToken(t: string): Promise {\n if (!t) return null;\n const r = await sql`SELECT user_name,role FROM pp_sessions WHERE token=${t} AND expires_at>NOW()`;\n return r?.[0] || null;\n}\n\nexport async function logout(token: string, req?: Request): Promise {\n await sql`DELETE FROM pp_sessions WHERE token=${token}`;\n return ok({ success: true }, req);\n}\n\n// Revoke all sessions for the currently logged-in user (self-service)\nexport async function revokeSelfSessions(userName: string, currentToken: string, req?: Request): Promise {\n await sql`DELETE FROM pp_sessions WHERE user_name=${userName}`;\n await audit(userName, \"REVOKE_ALL_SESSIONS\", \"auth\", { note: \"self-requested\" });\n return ok({ success: true }, req);\n}\n\n// Admin: revoke all sessions for any user by id\nexport async function revokeUserSessions(b: any, req?: Request): Promise {\n if (!b.id) return err(\"id required\", 400, req);\n await sql`DELETE FROM pp_sessions WHERE user_name=(SELECT username FROM pp_users WHERE id=${b.id})`;\n return ok({ success: true }, req);\n}\n\nexport async function getUsers(req?: Request): Promise {\n return ok({ users: await sql`SELECT id,username,display_name,role,active,created_at FROM pp_users ORDER BY id` }, req);\n}\n\nexport async function addUser(b: any, callerName: string, req?: Request): Promise {\n if (!b.username || !b.password || !b.display_name) return err(\"username, password, display_name required\", 400, req);\n try {\n const hashed = await bcrypt.hash(b.password);\n const r = await sql`INSERT INTO pp_users(username,password,display_name,role) VALUES(${b.username.toLowerCase().trim()},${hashed},${b.display_name},${b.role || \"operator\"}) RETURNING id,username,display_name,role`;\n await audit(callerName, \"CREATE_USER\", \"users\", { username: b.username, role: b.role });\n return ok({ user: r[0] }, req);\n } catch (_) { return err(\"Username already exists\", 409, req); }\n}\n\nexport async function deleteUser(b: any, callerName: string, req?: Request): Promise {\n if (!b.id) return err(\"id required\", 400, req);\n await sql`DELETE FROM pp_sessions WHERE user_name=(SELECT username FROM pp_users WHERE id=${b.id})`;\n await sql`DELETE FROM pp_users WHERE id=${b.id}`;\n await audit(callerName, \"DELETE_USER\", \"users\", { id: b.id });\n return ok({ success: true }, req);\n}\n\nexport async function updateUser(b: any, callerName: string, req?: Request): Promise {\n if (!b.id) return err(\"id required\", 400, req);\n if (b.password) {\n const hashed = await bcrypt.hash(b.password);\n await sql`UPDATE pp_users SET display_name=COALESCE(${b.display_name},display_name),role=COALESCE(${b.role},role),password=${hashed},active=COALESCE(${b.active},active) WHERE id=${b.id}`;\n } else {\n await sql`UPDATE pp_users SET display_name=COALESCE(${b.display_name},display_name),role=COALESCE(${b.role},role),active=COALESCE(${b.active},active) WHERE id=${b.id}`;\n }\n await audit(callerName, \"UPDATE_USER\", \"users\", { id: b.id, role: b.role });\n return ok({ success: true }, req);\n}\n",[],[103],{"_107":201,"_99":202,"_163":203,"_165":-5,"_166":148,"_167":204,"_168":169,"_109":205,"_104":206,"_172":173,"_174":207,"_176":22,"_177":-5,"_178":208,"_102":209},"6d3159a2-2c41-11f1-b106-42dde27851f2","ppProduction.ts","0e52f6b4-2810-11f1-b03f-42dde27851f2",99,["D",1774879494151],5,"// PlatingPro — Production Entry + Upload (V20)\nimport { sql, ok, err, isValidDate, isPositiveNumber, requireFields } from \"./ppShared.ts\";\n\n\n// Create indexes for fast queries — call once at startup\nexport async function ensureProductionIndexes(): Promise {\n try {\n await Promise.all([\n sql`CREATE INDEX IF NOT EXISTS idx_pp_prod_date ON pp_production(prod_date)`,\n sql`CREATE INDEX IF NOT EXISTS idx_pp_prod_date_plating ON pp_production(prod_date, plating_type)`,\n sql`CREATE INDEX IF NOT EXISTS idx_pp_prod_item ON pp_production(item_name)`,\n ]);\n } catch(_) {}\n}\n\nexport async function addProduction(b: any, req?: Request): Promise {\n if (!b.item_name) return err(\"item_name is required\", 400, req);\n if (!b.prod_date) return err(\"prod_date is required\", 400, req);\n if (!b.plating_type) return err(\"plating_type is required\", 400, req);\n if (!isValidDate(b.prod_date)) return err(\"prod_date must be YYYY-MM-DD\", 400, req);\n const pa = (Number(b.prod_qty)||0) * (Number(b.prod_rate)||0);\n const ra = (Number(b.rej_qty)||0) * (Number(b.rej_rate)||0);\n const r = await sql`INSERT INTO pp_production(prod_date,mould_no,item_name,plating_type,category,moulding_type,prod_qty,prod_rate,prod_amount,rej_qty,rej_rate,rej_amount,rej_mark)VALUES(${b.prod_date},${b.mould_no||null},${b.item_name},${b.plating_type},${b.category||null},${b.moulding_type||'OUR MOULDING'},${Number(b.prod_qty)||0},${Number(b.prod_rate)||0},${pa},${Number(b.rej_qty)||0},${Number(b.rej_rate)||0},${ra},${b.rej_mark||null})RETURNING*`;\n return ok({ row: r[0] }, req);\n}\n\nexport async function addProductionBatch(b: any, req?: Request): Promise {\n const rows = b.rows;\n if (!rows || !Array.isArray(rows) || rows.length === 0) return err(\"No rows provided\", 400, req);\n if (rows.length > 50) return err(\"Max 50 rows per batch\", 400, req);\n\n // Validate all rows upfront\n const validRows: any[] = [];\n let failed = 0; const errors: string[] = [];\n for (const r of rows) {\n if (!r.item_name || !r.prod_date || !r.plating_type) {\n failed++; errors.push(\"Row missing item_name/prod_date/plating_type\"); continue;\n }\n if (!isValidDate(r.prod_date)) {\n failed++; errors.push(\"Row has invalid prod_date: \" + r.prod_date); continue;\n }\n validRows.push(r);\n }\n\n if (validRows.length === 0) return ok({ saved: 0, failed, errors: errors.slice(0,5) }, req);\n\n // Bulk insert in a single query — much faster than N sequential inserts\n try {\n const values = validRows.map(r => {\n const pa = (Number(r.prod_qty)||0) * (Number(r.prod_rate)||0);\n const ra = (Number(r.rej_qty)||0) * (Number(r.rej_rate)||0);\n return [r.prod_date, r.mould_no||null, r.item_name, r.plating_type, r.category||null,\n r.moulding_type||'OUR MOULDING', Number(r.prod_qty)||0, Number(r.prod_rate)||0,\n pa, Number(r.rej_qty)||0, Number(r.rej_rate)||0, ra, r.rej_mark||null];\n });\n // Build multi-row insert using Promise.all for parallelism (neon doesn't support multi-row VALUES easily)\n await Promise.all(validRows.map(r => {\n const pa = (Number(r.prod_qty)||0) * (Number(r.prod_rate)||0);\n const ra = (Number(r.rej_qty)||0) * (Number(r.rej_rate)||0);\n return sql`INSERT INTO pp_production(prod_date,mould_no,item_name,plating_type,category,moulding_type,prod_qty,prod_rate,prod_amount,rej_qty,rej_rate,rej_amount,rej_mark)VALUES(${r.prod_date},${r.mould_no||null},${r.item_name},${r.plating_type},${r.category||null},${r.moulding_type||'OUR MOULDING'},${Number(r.prod_qty)||0},${Number(r.prod_rate)||0},${pa},${Number(r.rej_qty)||0},${Number(r.rej_rate)||0},${ra},${r.rej_mark||null})`;\n }));\n return ok({ saved: validRows.length, failed, errors: errors.slice(0,5) }, req);\n } catch (e: any) {\n return ok({ saved: 0, failed: validRows.length + failed, errors: [e.message] }, req);\n }\n}\n\nexport async function deleteProduction(b: any, req?: Request): Promise {\n if (!b.id) return err(\"id required\", 400, req);\n await sql`DELETE FROM pp_production WHERE id=${b.id}`;\n return ok({ success: true }, req);\n}\n\nexport async function deleteProductionBatch(b: any, req?: Request): Promise {\n const ids = b.ids;\n if (!ids || !Array.isArray(ids) || ids.length === 0) return err(\"No ids provided\", 400, req);\n if (ids.length > 100) return err(\"Max 100 deletions per batch\", 400, req);\n let deleted = 0;\n for (const id of ids) { try { await sql`DELETE FROM pp_production WHERE id=${id}`; deleted++; } catch (e) {} }\n return ok({ deleted }, req);\n}\n\nexport async function getDailyDetailWithIds(p: URLSearchParams, req?: Request): Promise {\n let dateStr = p.get(\"day\") || \"\";\n if (!dateStr) { const y = new Date(); y.setDate(y.getDate()-1); y.setMinutes(y.getMinutes()+330); dateStr = y.toISOString().slice(0,10); }\n const [r, kpi] = await Promise.all([\n sql`SELECT id,item_name,mould_no,UPPER(TRIM(plating_type))as plating_type,UPPER(TRIM(category))as category,prod_qty::float as prod,prod_amount::float as value,prod_rate::float as rate,rej_qty::float as rej,rej_amount::float as rej_cost,rej_rate::float as rej_rate_val,rej_mark FROM pp_production WHERE TO_CHAR(prod_date,'YYYY-MM-DD')=${dateStr} ORDER BY id DESC`,\n sql`SELECT COALESCE(SUM(prod_qty),0)::float as total_prod,COALESCE(SUM(prod_amount),0)::float as total_value,COALESCE(SUM(rej_qty),0)::float as total_rej,COALESCE(SUM(rej_amount),0)::float as total_rej_cost,CASE WHEN SUM(prod_qty)>0 THEN ROUND(SUM(rej_qty)/SUM(prod_qty)*100,2)::float ELSE 0 END as rej_rate,COUNT(*)::int as entries FROM pp_production WHERE TO_CHAR(prod_date,'YYYY-MM-DD')=${dateStr}`\n ]);\n return ok({ date: dateStr, kpi: kpi[0], items: r }, req);\n}\n\nexport async function getFrequentItems(req?: Request): Promise {\n let r = await sql`SELECT item_name,mould_no,UPPER(TRIM(plating_type))as plating_type,UPPER(TRIM(category))as category,moulding_type,MAX(prod_rate)::float as rate,MAX(rej_rate)::float as rej_rate_val,COUNT(*)::int as freq FROM pp_production WHERE prod_date>=CURRENT_DATE-30 GROUP BY item_name,mould_no,UPPER(TRIM(plating_type)),UPPER(TRIM(category)),moulding_type ORDER BY COUNT(*)DESC LIMIT 20`;\n if (!r || r.length === 0) {\n r = await sql`SELECT item_name,mould_no,UPPER(TRIM(plating_type))as plating_type,UPPER(TRIM(category))as category,moulding_type,MAX(prod_rate)::float as rate,MAX(rej_rate)::float as rej_rate_val,COUNT(*)::int as freq FROM pp_production WHERE prod_date>=CURRENT_DATE-90 GROUP BY item_name,mould_no,UPPER(TRIM(plating_type)),UPPER(TRIM(category)),moulding_type ORDER BY COUNT(*)DESC LIMIT 20`;\n }\n return ok({ items: r }, req);\n}\n\nexport async function getPrevDayEntries(p: URLSearchParams, req?: Request): Promise {\n let dateStr = p.get(\"day\") || \"\";\n if (!dateStr) { const y = new Date(); y.setDate(y.getDate()-1); y.setMinutes(y.getMinutes()+330); dateStr = y.toISOString().slice(0,10); }\n const prevDate = await sql`SELECT TO_CHAR(MAX(prod_date),'YYYY-MM-DD')as d FROM pp_production WHERE prod_date<${dateStr}::date`;\n if (!prevDate || prevDate.length === 0 || !prevDate[0].d) return ok({ date: null, items: [] }, req);\n const pd = prevDate[0].d;\n const r = await sql`SELECT item_name,mould_no,UPPER(TRIM(plating_type))as plating_type,UPPER(TRIM(category))as category,moulding_type,prod_qty::float as prod,prod_rate::float as rate,rej_qty::float as rej,rej_rate::float as rej_rate_val,rej_mark FROM pp_production WHERE TO_CHAR(prod_date,'YYYY-MM-DD')=${pd} ORDER BY id`;\n return ok({ date: pd, items: r }, req);\n}\n\nexport async function uploadChunk(body: any, req?: Request): Promise {\n const { data, fileName, uploadedBy, uploadId: existingId, chunkIndex, totalChunks } = body;\n if (!data || !Array.isArray(data) || data.length === 0) return err(\"No data\", 400, req);\n\n let uploadId = existingId;\n if (!uploadId || chunkIndex === 0) {\n const r = await sql`INSERT INTO pp_uploads(file_name,month,uploaded_by,status)VALUES(${fileName||'unknown'},${'detecting'},${uploadedBy||'system'},'processing')RETURNING id`;\n uploadId = r[0].id;\n }\n\n let imported = 0, rejected = 0, issuesFixed = 0, detectedMonth = '';\n const maxDate = new Date(); maxDate.setMonth(maxDate.getMonth() + 1);\n const maxDateStr = maxDate.toISOString().slice(0,10);\n\n for (const row of data) {\n try {\n const rowKeys = Object.keys(row);\n const norm = (s: string) => s.replace(/\\n/g,' ').replace(/\\s+/g,' ').trim().toUpperCase();\n const g = (names: string[]) => {\n for (const n of names) { if (row[n]!==undefined&&row[n]!==null&&String(row[n]).trim()!=='') return row[n]; }\n for (const n of names) { const nNorm=norm(n); const found=rowKeys.find(k=>norm(k)===nNorm); if (found&&row[found]!==undefined&&row[found]!==null&&String(row[found]).trim()!=='') return row[found]; }\n return null;\n };\n const num = (v: any): number => { if(v===null||v===undefined)return 0; if(typeof v==='number')return v; const s=String(v).replace(/,/g,'').replace(/\\s/g,''); const n=parseFloat(s); return isNaN(n)?0:n; };\n\n const dateRaw = g(['Date','date','DATE']);\n const itemName = String(g(['Item Name','ITEM NAME','item_name','Item'])||'').trim();\n let platingType = String(g(['Plating','PLATING TYPE','Plating Type','plating_type'])||'').trim();\n\n if (!itemName || !dateRaw || itemName==='null' || itemName==='undefined') { rejected++; continue; }\n\n let prodDate: string = '';\n const ds = String(dateRaw);\n if (ds.includes('T')) { prodDate = ds.slice(0,10); }\n else if (ds.includes('.') && ds.split('.').length===3) {\n const [dd,mm,yyyy] = ds.split('.');\n const y=parseInt(yyyy),mo=parseInt(mm),d=parseInt(dd);\n if (y>=2024&&y<=2027&&mo>=1&&mo<=12&&d>=1&&d<=31) { prodDate=`${yyyy}-${mm.padStart(2,'0')}-${dd.padStart(2,'0')}`; } else { rejected++; continue; }\n } else if (ds.includes('-') && ds.length===10) { prodDate = ds; }\n else if (!isNaN(Number(ds)) && Number(ds)>40000) { const d2=new Date((Number(ds)-25569)*86400000); prodDate=d2.toISOString().slice(0,10); }\n else { try { const d2=new Date(ds); if(!isNaN(d2.getTime()))prodDate=d2.toISOString().slice(0,10); else { rejected++; continue; } } catch { rejected++; continue; } }\n\n if (!prodDate || prodDate<'2024-01-01' || prodDate>maxDateStr) { rejected++; continue; }\n if (!detectedMonth) detectedMonth = prodDate.slice(0,7);\n\n const ptL = platingType.toLowerCase().trim();\n if (ptL.includes('gold')) platingType='Gold';\n else if (ptL.includes('copper')) platingType='Copper';\n else if (ptL.includes('nickel')) platingType='Nickel';\n else if (ptL.includes('silver')) platingType='Silver';\n else if (ptL.includes('black')) platingType='Black';\n else platingType = platingType.charAt(0).toUpperCase()+platingType.slice(1).toLowerCase();\n\n const category = String(g(['Category','CATEGORY','category'])||'').toUpperCase().trim();\n const mouldNo = String(g(['Mould No.','Mould\\nNo.','MOULD NO.','mould_no'])||'').trim();\n const mouldType = String(g(['Moulding Type','Moulding\\nType','HIS/OUR MOULDING','moulding_type'])||'OUR MOULDING').trim();\n const prodQty = num(g(['Prod Qty (kg)','Prod Qty\\n(kg)','PROD.QTY','Prod.Qty','prod_qty']));\n const prodRate = num(g(['Rate (₹/kg)','Rate\\n(₹/kg)','PROD. RATE','Prod. Rate','prod_rate']));\n const prodAmount = num(g(['Prod Amount (₹)','Prod Amount\\n(₹)','PROD. AMOUNT','Prod. Amount','prod_amount']));\n const rejQty = num(g(['Rej Qty (kg)','Rej Qty\\n(kg)','Rejection QTY','REJECTION QTY','rej_qty']));\n const rejRate = num(g(['Rej Rate (₹/kg)','Rej Rate\\n(₹/kg)','REJECTION RATE','Rejection Rate','rej_rate']));\n const rejAmount = num(g(['Rej Amount (₹)','Rej Amount\\n(₹)','REJECTION AMOUNT','Rejection Amount','rej_amount']));\n const rejMark = String(g(['Rejection Reason','Rejection\\nReason','Rejection Mark','REJECTION MARK','rej_mark'])||'').trim();\n const finalProdAmount = prodAmount > 0 ? prodAmount : prodQty * prodRate;\n const finalRejAmount = rejAmount > 0 ? rejAmount : rejQty * rejRate;\n\n const existing = await sql`SELECT id FROM pp_production WHERE prod_date=${prodDate} AND COALESCE(mould_no,'')=${mouldNo||''} AND item_name=${itemName} AND UPPER(TRIM(plating_type))=UPPER(TRIM(${platingType})) LIMIT 1`;\n if (existing.length > 0) {\n await sql`UPDATE pp_production SET upload_id=${uploadId},category=${category},moulding_type=${mouldType},prod_qty=${prodQty},prod_rate=${prodRate},prod_amount=${finalProdAmount},rej_qty=${rejQty},rej_rate=${rejRate},rej_amount=${finalRejAmount},rej_mark=${rejMark||null} WHERE id=${existing[0].id}`;\n imported++;\n } else {\n await sql`INSERT INTO pp_production(upload_id,prod_date,mould_no,item_name,plating_type,category,moulding_type,prod_qty,prod_rate,prod_amount,rej_qty,rej_rate,rej_amount,rej_mark)VALUES(${uploadId},${prodDate},${mouldNo},${itemName},${platingType},${category},${mouldType},${prodQty},${prodRate},${finalProdAmount},${rejQty},${rejRate},${finalRejAmount},${rejMark||null})`;\n imported++;\n }\n } catch (e) { rejected++; }\n }\n\n const isLast = !totalChunks || chunkIndex === totalChunks - 1;\n if (isLast && detectedMonth) {\n if (issuesFixed > 0) await sql`INSERT INTO pp_health_log(upload_id,issue_type,title,description,status,auto_fixed)VALUES(${uploadId},'format','Normalization',${issuesFixed+' fixes'},'auto-fixed',true)`;\n const anomalies = await sql`SELECT item_name,mould_no,SUM(prod_qty)::float as prod,SUM(rej_qty)::float as rej FROM pp_production WHERE upload_id=${uploadId} GROUP BY item_name,mould_no HAVING SUM(rej_qty)>SUM(prod_qty)AND SUM(prod_qty)>0`;\n for (const a of anomalies) await sql`INSERT INTO pp_health_log(upload_id,issue_type,title,description,status)VALUES(${uploadId},'anomaly','Rejection>Production',${a.item_name+': '+a.rej+' rej vs '+a.prod+' prod'},'flagged')`;\n await sql`DELETE FROM pp_insights WHERE month=${detectedMonth}`;\n const topR = await sql`SELECT item_name,mould_no,SUM(rej_qty)::float as rej,CASE WHEN SUM(prod_qty)>0 THEN ROUND(SUM(rej_qty)/SUM(prod_qty)*100,2)::float ELSE 0 END as rej_pct FROM pp_production WHERE TO_CHAR(prod_date,'YYYY-MM')=${detectedMonth} GROUP BY item_name,mould_no HAVING SUM(rej_qty)>0 ORDER BY CASE WHEN SUM(prod_qty)>0 THEN SUM(rej_qty)/SUM(prod_qty)ELSE 0 END DESC LIMIT 10`;\n for (const it of topR) { const sev=it.rej_pct>100?'critical':it.rej_pct>10?'warning':'info'; await sql`INSERT INTO pp_insights(month,insight_type,severity,title,description,item_name,mould_no,confidence)VALUES(${detectedMonth},'alert',${sev},${it.item_name+' at '+it.rej_pct+'% rejection'},${it.rej+' kg. '+(it.rej_pct>100?'CRITICAL!':it.rej_pct>10?'High.':'Monitor.')},${it.item_name},${it.mould_no},${it.rej_pct>100?98:85})`; }\n const plR = await sql`SELECT UPPER(TRIM(plating_type))as pt,CASE WHEN SUM(prod_qty)>0 THEN ROUND(SUM(rej_qty)/SUM(prod_qty)*100,2)::float ELSE 0 END as rej_pct FROM pp_production WHERE TO_CHAR(prod_date,'YYYY-MM')=${detectedMonth} GROUP BY UPPER(TRIM(plating_type))HAVING CASE WHEN SUM(prod_qty)>0 THEN SUM(rej_qty)/SUM(prod_qty)*100 ELSE 0 END>2`;\n for (const p of plR) await sql`INSERT INTO pp_insights(month,insight_type,severity,title,description,confidence)VALUES(${detectedMonth},'alert','warning',${p.pt+' plating at '+p.rej_pct+'% rej'},${p.pt+' above 2% target.'},85)`;\n await sql`UPDATE pp_uploads SET month=${detectedMonth},rows_imported=${imported},rows_rejected=${rejected},issues_found=${anomalies.length},issues_auto_fixed=${issuesFixed},status='complete'WHERE id=${uploadId}`;\n }\n return ok({ uploadId, month: detectedMonth, imported, rejected, issuesFixed, isLast }, req);\n}\n",[],[202],{"_107":211,"_99":212,"_163":213,"_165":-5,"_166":148,"_167":214,"_168":169,"_109":215,"_104":216,"_172":217,"_174":218,"_176":22,"_177":-5,"_178":219,"_102":220},"d18d6812-29f5-11f1-9157-42dde27851f2","ppSales.ts","0f23d982-2810-11f1-ae9d-42dde27851f2",94,["D",1774627118446],12,"script","// PlatingPro — Sales Core Module (V20)\n// Customers, Invoices, Dashboard, KG metrics\nimport { err, ok, sql, audit, isValidDate, requireFields } from \"./ppShared.ts\";\n\nexport async function salesPing(req?: Request): Promise {\n return ok({ sales: \"ok\", v: 20 }, req);\n}\n\nexport async function migrateSales(req?: Request): Promise {\n try {\n await sql`CREATE TABLE IF NOT EXISTS pp_sales_customers(id SERIAL PRIMARY KEY,name TEXT UNIQUE NOT NULL,gstin TEXT,factory TEXT,address TEXT,phone TEXT,created_by TEXT,created_at TIMESTAMPTZ DEFAULT NOW(),updated_at TIMESTAMPTZ DEFAULT NOW())`;\n await sql`CREATE TABLE IF NOT EXISTS pp_sales_invoices(id SERIAL PRIMARY KEY,inv_no TEXT UNIQUE NOT NULL,inv_date DATE NOT NULL,customer_id INT,customer_name TEXT NOT NULL,factory TEXT,taxable NUMERIC(12,2) DEFAULT 0,cgst NUMERIC(12,2) DEFAULT 0,sgst NUMERIC(12,2) DEFAULT 0,igst NUMERIC(12,2) DEFAULT 0,total NUMERIC(12,2) DEFAULT 0,source TEXT DEFAULT 'manual',notes TEXT,created_by TEXT,created_at TIMESTAMPTZ DEFAULT NOW())`;\n await sql`CREATE TABLE IF NOT EXISTS pp_sales_items(id SERIAL PRIMARY KEY,invoice_id INT,product_name TEXT NOT NULL,hsn TEXT,qty NUMERIC(12,2) DEFAULT 0,unit TEXT DEFAULT 'PCS',rate NUMERIC(12,4) DEFAULT 0,amount NUMERIC(12,2) DEFAULT 0,color TEXT,description TEXT)`;\n await sql`CREATE TABLE IF NOT EXISTS pp_gmail_sync(id SERIAL PRIMARY KEY,gmail_msg_id TEXT UNIQUE NOT NULL,gmail_subject TEXT,gmail_date TEXT,attachment_name TEXT,inv_no TEXT,status TEXT DEFAULT 'pending',error TEXT,invoice_id INT,scanned_data JSONB,created_at TIMESTAMPTZ DEFAULT NOW())`;\n return ok({\n success: true,\n msg: \"Sales tables ready (V20 with Gmail sync + KG)\",\n }, req);\n } catch (e: any) {\n return err(\"Migration failed: \" + e.message, 500, req);\n }\n}\n\nexport async function getSalesCustomers(req?: Request): Promise {\n const r =\n await sql`SELECT c.id,c.name,c.gstin,c.factory,c.address,c.phone,c.created_at,c.updated_at,COALESCE((SELECT SUM(i.total)::float FROM pp_sales_invoices i WHERE i.customer_id=c.id),0)as total_billing,COALESCE((SELECT COUNT(*)::int FROM pp_sales_invoices i WHERE i.customer_id=c.id),0)as inv_count FROM pp_sales_customers c WHERE COALESCE(c.is_deleted,false)=false ORDER BY total_billing DESC`;\n return ok({ customers: r }, req);\n}\n\nexport async function upsertSalesCustomer(b: any, req?: Request): Promise {\n if (!b.name) return err(\"name required\", 400, req);\n var name = b.name.trim();\n var gstin = (b.gstin || \"\").trim().toUpperCase();\n var factory = b.factory || null;\n if (b.id) {\n await sql`UPDATE pp_sales_customers SET name=${name},gstin=${gstin},factory=${factory},address=${\n b.address || null\n },phone=${b.phone || null},updated_at=NOW() WHERE id=${b.id}`;\n if (factory) {\n await sql`UPDATE pp_sales_invoices SET factory=${factory} WHERE customer_id=${b.id}`;\n }\n return ok({ success: true }, req);\n }\n var ex =\n await sql`SELECT id FROM pp_sales_customers WHERE LOWER(TRIM(name))=LOWER(${name})`;\n if (ex.length > 0) {\n await sql`UPDATE pp_sales_customers SET gstin=COALESCE(NULLIF(${gstin},''),gstin),factory=COALESCE(${factory},factory),updated_at=NOW() WHERE id=${\n ex[0].id\n }`;\n if (factory) {\n await sql`UPDATE pp_sales_invoices SET factory=${factory} WHERE customer_id=${\n ex[0].id\n }`;\n }\n return ok({ success: true, id: ex[0].id, existed: true }, req);\n }\n var r =\n await sql`INSERT INTO pp_sales_customers(name,gstin,factory,created_by)VALUES(${name},${gstin},${factory},${\n b.created_by || \"system\"\n })RETURNING id`;\n return ok({ success: true, id: r[0].id }, req);\n}\n\nexport async function setSalesCustomerFactory(b: any, req?: Request): Promise {\n if (!b.id || !b.factory) return err(\"id and factory required\", 400, req);\n await sql`UPDATE pp_sales_customers SET factory=${b.factory},updated_at=NOW() WHERE id=${b.id}`;\n await sql`UPDATE pp_sales_invoices SET factory=${b.factory} WHERE customer_id=${b.id}`;\n return ok({ success: true }, req);\n}\n\nexport async function deleteSalesCustomer(b: any, req?: Request): Promise {\n if (!b.id) return err(\"id required\", 400, req);\n // Prevent delete if customer has invoices\n const linked = await sql`SELECT COUNT(*)::int as cnt FROM pp_sales_invoices WHERE customer_id=${b.id}`;\n if (linked[0]?.cnt > 0) return err(\"Cannot delete: customer has \" + linked[0].cnt + \" invoice(s). Remove invoices first.\", 409, req);\n // Soft delete\n await sql`UPDATE pp_sales_customers SET is_deleted=true WHERE id=${b.id}`;\n return ok({ success: true }, req);\n}\n\nexport async function saveSalesInvoice(b: any, req?: Request): Promise {\n // FIX 9: Input validation\n if (!b.inv_no || !b.inv_date || !b.customer_name)\n return err(\"inv_no, inv_date, customer_name required\", 400, req);\n if (!isValidDate(b.inv_date)) return err(\"inv_date must be YYYY-MM-DD\", 400, req);\n\n const custName = b.customer_name.trim().replace(/\\s+/g, \" \");\n const custNameNorm = custName.toLowerCase();\n const invNo = b.inv_no.trim().toUpperCase();\n\n // FIX 3: Real DB transaction using BEGIN/COMMIT/ROLLBACK\n try {\n await sql`BEGIN`;\n try {\n // Resolve or create customer (inside transaction)\n let custId = 0;\n const ex = await sql`SELECT id,factory FROM pp_sales_customers WHERE LOWER(TRIM(name))=${custNameNorm} AND COALESCE(is_deleted,false)=false`;\n if (ex.length > 0) {\n custId = ex[0].id;\n if (!b.factory) b.factory = ex[0].factory;\n } else {\n const cr = await sql`INSERT INTO pp_sales_customers(name,gstin,factory,created_by) VALUES(${custName},${(b.gstin||\"\").toUpperCase()},${b.factory||null},${\"system\"}) RETURNING id`;\n custId = cr[0].id;\n }\n\n // Check duplicate invoice number\n const dup = await sql`SELECT id FROM pp_sales_invoices WHERE inv_no=${invNo}`;\n if (dup.length > 0) {\n await sql`ROLLBACK`;\n return err(\"Invoice \" + invNo + \" already exists\", 409, req);\n }\n\n // Compute totals\n let taxable = Number(b.taxable) || 0;\n if (b.items && Array.isArray(b.items) && b.items.length > 0 && taxable === 0) {\n for (const it of b.items) taxable += Number(it.amount || 0);\n }\n const cgst = Number(b.cgst)||0, sgst = Number(b.sgst)||0, igst = Number(b.igst)||0;\n const total = Number(b.total) || (taxable + cgst + sgst + igst);\n\n // Insert invoice header\n const inv = await sql`INSERT INTO pp_sales_invoices(inv_no,inv_date,customer_id,customer_name,factory,taxable,cgst,sgst,igst,total,source,notes,created_by) VALUES(${invNo},${b.inv_date},${custId},${custName},${b.factory||null},${taxable},${cgst},${sgst},${igst},${total},${b.source||\"manual\"},${b.notes||null},${b.created_by||\"system\"}) RETURNING id`;\n const invId = inv[0].id;\n\n // Insert line items\n if (b.items && Array.isArray(b.items)) {\n for (const it of b.items) {\n const amt = Number(it.amount) || (Number(it.qty||0) * Number(it.rate||0));\n await sql`INSERT INTO pp_sales_items(invoice_id,product_name,hsn,qty,unit,rate,amount,color,description) VALUES(${invId},${it.product_name||it.name||\"\"},${it.hsn||\"\"},${Number(it.qty)||0},${it.unit||\"PCS\"},${Number(it.rate)||0},${amt},${it.color||\"\"},${it.description||\"\"})`;\n }\n }\n\n await sql`COMMIT`;\n return ok({ success: true, id: invId, customer_id: custId }, req);\n } catch (inner: any) {\n await sql`ROLLBACK`;\n return err(\"Failed to save invoice: \" + inner.message, 500, req);\n }\n } catch (outer: any) {\n return err(\"Transaction error: \" + outer.message, 500, req);\n }\n}\n\n// V20: includes total_qty (kg) per invoice via subquery join on pp_sales_items\nexport async function getSalesInvoicesByDate(p: URLSearchParams, req?: Request): Promise {\n var date = p.get(\"date\") || \"\";\n var month = p.get(\"month\") || \"\";\n var factory = p.get(\"factory\") || \"\";\n if (date && factory && factory !== \"all\") {\n return ok({\n invoices:\n await sql`SELECT i.*,c.gstin,COALESCE(iq.total_qty,0)::float as total_qty FROM pp_sales_invoices i LEFT JOIN pp_sales_customers c ON i.customer_id=c.id LEFT JOIN (SELECT invoice_id,SUM(qty)::float as total_qty FROM pp_sales_items WHERE LOWER(unit) IN ('kg','kgs','kilo','kilos','kilogram','kilograms') GROUP BY invoice_id) iq ON iq.invoice_id=i.id WHERE TO_CHAR(i.inv_date,'YYYY-MM-DD')=${date} AND i.factory=${factory} ORDER BY i.total DESC`,\n }, req);\n }\n if (date) {\n return ok({\n invoices:\n await sql`SELECT i.*,c.gstin,COALESCE(iq.total_qty,0)::float as total_qty FROM pp_sales_invoices i LEFT JOIN pp_sales_customers c ON i.customer_id=c.id LEFT JOIN (SELECT invoice_id,SUM(qty)::float as total_qty FROM pp_sales_items WHERE LOWER(unit) IN ('kg','kgs','kilo','kilos','kilogram','kilograms') GROUP BY invoice_id) iq ON iq.invoice_id=i.id WHERE TO_CHAR(i.inv_date,'YYYY-MM-DD')=${date} ORDER BY i.total DESC`,\n }, req);\n }\n if (month && factory && factory !== \"all\") {\n return ok({\n invoices:\n await sql`SELECT i.*,c.gstin,COALESCE(iq.total_qty,0)::float as total_qty FROM pp_sales_invoices i LEFT JOIN pp_sales_customers c ON i.customer_id=c.id LEFT JOIN (SELECT invoice_id,SUM(qty)::float as total_qty FROM pp_sales_items WHERE LOWER(unit) IN ('kg','kgs','kilo','kilos','kilogram','kilograms') GROUP BY invoice_id) iq ON iq.invoice_id=i.id WHERE TO_CHAR(i.inv_date,'YYYY-MM')=${month} AND i.factory=${factory} ORDER BY i.inv_date DESC,i.total DESC`,\n }, req);\n }\n if (month) {\n return ok({\n invoices:\n await sql`SELECT i.*,c.gstin,COALESCE(iq.total_qty,0)::float as total_qty FROM pp_sales_invoices i LEFT JOIN pp_sales_customers c ON i.customer_id=c.id LEFT JOIN (SELECT invoice_id,SUM(qty)::float as total_qty FROM pp_sales_items WHERE LOWER(unit) IN ('kg','kgs','kilo','kilos','kilogram','kilograms') GROUP BY invoice_id) iq ON iq.invoice_id=i.id WHERE TO_CHAR(i.inv_date,'YYYY-MM')=${month} ORDER BY i.inv_date DESC,i.total DESC`,\n }, req);\n }\n if (factory && factory !== \"all\") {\n return ok({\n invoices:\n await sql`SELECT i.*,c.gstin,COALESCE(iq.total_qty,0)::float as total_qty FROM pp_sales_invoices i LEFT JOIN pp_sales_customers c ON i.customer_id=c.id LEFT JOIN (SELECT invoice_id,SUM(qty)::float as total_qty FROM pp_sales_items WHERE LOWER(unit) IN ('kg','kgs','kilo','kilos','kilogram','kilograms') GROUP BY invoice_id) iq ON iq.invoice_id=i.id WHERE i.factory=${factory} ORDER BY i.inv_date DESC LIMIT 100`,\n }, req);\n }\n return ok({\n invoices:\n await sql`SELECT i.*,c.gstin,COALESCE(iq.total_qty,0)::float as total_qty FROM pp_sales_invoices i LEFT JOIN pp_sales_customers c ON i.customer_id=c.id LEFT JOIN (SELECT invoice_id,SUM(qty)::float as total_qty FROM pp_sales_items WHERE LOWER(unit) IN ('kg','kgs','kilo','kilos','kilogram','kilograms') GROUP BY invoice_id) iq ON iq.invoice_id=i.id ORDER BY i.inv_date DESC LIMIT 100`,\n }, req);\n}\n\nexport async function getSalesInvoiceDetail(p: URLSearchParams, req?: Request): Promise {\n var id = Number(p.get(\"id\"));\n if (!id) return err(\"id required\", 400, req);\n var inv =\n await sql`SELECT i.*,c.gstin,c.address,c.phone FROM pp_sales_invoices i LEFT JOIN pp_sales_customers c ON i.customer_id=c.id WHERE i.id=${id}`;\n var items =\n await sql`SELECT*FROM pp_sales_items WHERE invoice_id=${id} ORDER BY amount DESC`;\n if (!inv || inv.length === 0) return err(\"Not found\", 404, req);\n return ok({ invoice: inv[0], items: items }, req);\n}\n\nexport async function deleteSalesInvoice(b: any, callerName = \"unknown\", req?: Request): Promise {\n // FIX 6: Require explicit confirmation flag\n if (!b.id) return err(\"id required\", 400, req);\n if (b.confirmDelete !== true) return err(\"confirmDelete: true required to delete an invoice\", 400, req);\n\n // FIX 3: Delete items + header atomically\n try {\n await sql`BEGIN`;\n try {\n const inv = await sql`SELECT inv_no,total FROM pp_sales_invoices WHERE id=${b.id}`;\n if (inv.length === 0) { await sql`ROLLBACK`; return err(\"Invoice not found\", 404, req); }\n await sql`DELETE FROM pp_sales_items WHERE invoice_id=${b.id}`;\n await sql`DELETE FROM pp_sales_invoices WHERE id=${b.id}`;\n await sql`COMMIT`;\n await audit(callerName, \"DELETE_INVOICE\", \"sales\", { id: b.id, inv_no: inv[0].inv_no, total: inv[0].total });\n return ok({ success: true }, req);\n } catch (inner: any) {\n await sql`ROLLBACK`;\n return err(\"Delete failed: \" + inner.message, 500, req);\n }\n } catch (outer: any) {\n return err(\"Transaction error: \" + outer.message, 500, req);\n }\n}\n\nexport async function updateSalesInvoice(b: any, req?: Request): Promise {\n if (!b.id) return err(\"id required\", 400, req);\n var taxable = Number(b.taxable) || 0;\n var cgst = Number(b.cgst) || 0;\n var sgst = Number(b.sgst) || 0;\n var igst = Number(b.igst) || 0;\n var total = Number(b.total) || (taxable + cgst + sgst + igst);\n var custName = (b.customer_name || \"\").trim();\n var factory = b.factory || null;\n var invDate = b.inv_date || null;\n // Update header\n await sql`UPDATE pp_sales_invoices SET\n inv_date=COALESCE(${invDate}::date, inv_date),\n customer_name=COALESCE(NULLIF(${custName},''), customer_name),\n factory=COALESCE(${factory}, factory),\n taxable=${taxable}, cgst=${cgst}, sgst=${sgst}, igst=${igst}, total=${total}\n WHERE id=${b.id}`;\n // Sync customer factory if changed\n if (factory) {\n var cx =\n await sql`SELECT id FROM pp_sales_customers WHERE LOWER(TRIM(name))=LOWER(${custName})`;\n if (cx.length > 0) {\n await sql`UPDATE pp_sales_customers SET factory=${factory},updated_at=NOW() WHERE id=${\n cx[0].id\n }`;\n }\n }\n // Replace all items\n if (b.items && Array.isArray(b.items)) {\n await sql`DELETE FROM pp_sales_items WHERE invoice_id=${b.id}`;\n for (var j = 0; j < b.items.length; j++) {\n var it = b.items[j];\n var amt = Number(it.amount) ||\n (Number(it.qty || 0) * Number(it.rate || 0));\n await sql`INSERT INTO pp_sales_items(invoice_id,product_name,hsn,qty,unit,rate,amount,color,description)VALUES(${b.id},${\n it.product_name || \"\"\n },${it.hsn || \"\"},${Number(it.qty) || 0},${it.unit || \"KG\"},${\n Number(it.rate) || 0\n },${amt},${it.color || \"\"},${it.description || \"\"})`;\n }\n }\n return ok({ success: true }, req);\n}\n\n// BUG6 FIX: Parallelized — all 5 queries run simultaneously via Promise.all (~5x faster)\nexport async function getSalesDashboard(p: URLSearchParams, req?: Request): Promise {\n var date = p.get(\"date\") || \"\";\n var month = p.get(\"month\") || \"\";\n var factory = p.get(\"factory\") || \"\";\n var m = month || (date ? date.slice(0, 7) : \"\");\n var fac = (factory && factory !== \"all\") ? factory : \"\";\n\n var dayQ = !date\n ? Promise.resolve([{\n inv_count: 0,\n taxable: 0,\n cgst: 0,\n sgst: 0,\n igst: 0,\n total: 0,\n cust_count: 0,\n }])\n : fac\n ? sql`SELECT COUNT(*)::int as inv_count,COALESCE(SUM(taxable),0)::float as taxable,COALESCE(SUM(cgst),0)::float as cgst,COALESCE(SUM(sgst),0)::float as sgst,COALESCE(SUM(igst),0)::float as igst,COALESCE(SUM(total),0)::float as total,COUNT(DISTINCT customer_name)::int as cust_count FROM pp_sales_invoices WHERE TO_CHAR(inv_date,'YYYY-MM-DD')=${date} AND factory=${fac}`\n : sql`SELECT COUNT(*)::int as inv_count,COALESCE(SUM(taxable),0)::float as taxable,COALESCE(SUM(cgst),0)::float as cgst,COALESCE(SUM(sgst),0)::float as sgst,COALESCE(SUM(igst),0)::float as igst,COALESCE(SUM(total),0)::float as total,COUNT(DISTINCT customer_name)::int as cust_count FROM pp_sales_invoices WHERE TO_CHAR(inv_date,'YYYY-MM-DD')=${date}`;\n\n var mtdQ = !m\n ? Promise.resolve([{ inv_count: 0, total: 0, cust_count: 0 }])\n : fac\n ? sql`SELECT COUNT(*)::int as inv_count,COALESCE(SUM(total),0)::float as total,COUNT(DISTINCT customer_name)::int as cust_count FROM pp_sales_invoices WHERE TO_CHAR(inv_date,'YYYY-MM')=${m} AND factory=${fac}`\n : sql`SELECT COUNT(*)::int as inv_count,COALESCE(SUM(total),0)::float as total,COUNT(DISTINCT customer_name)::int as cust_count FROM pp_sales_invoices WHERE TO_CHAR(inv_date,'YYYY-MM')=${m}`;\n\n var facQ = date\n ? sql`SELECT factory,COUNT(*)::int as inv_count,COALESCE(SUM(total),0)::float as total FROM pp_sales_invoices WHERE TO_CHAR(inv_date,'YYYY-MM-DD')=${date} AND factory IS NOT NULL GROUP BY factory`\n : Promise.resolve([]);\n\n var trendQ = !m\n ? Promise.resolve([])\n : fac\n ? sql`SELECT TO_CHAR(inv_date,'YYYY-MM-DD')as date,COUNT(*)::int as inv_count,SUM(total)::float as total FROM pp_sales_invoices WHERE TO_CHAR(inv_date,'YYYY-MM')=${m} AND factory=${fac} GROUP BY inv_date ORDER BY inv_date DESC LIMIT 31`\n : sql`SELECT TO_CHAR(inv_date,'YYYY-MM-DD')as date,COUNT(*)::int as inv_count,SUM(total)::float as total FROM pp_sales_invoices WHERE TO_CHAR(inv_date,'YYYY-MM')=${m} GROUP BY inv_date ORDER BY inv_date DESC LIMIT 31`;\n\n var mtdFacQ = m\n ? sql`SELECT factory,COUNT(*)::int as inv_count,COALESCE(SUM(total),0)::float as total FROM pp_sales_invoices WHERE TO_CHAR(inv_date,'YYYY-MM')=${m} AND factory IS NOT NULL GROUP BY factory`\n : Promise.resolve([]);\n\n const [dayArr, mtdArr, facArr, trendArr, mtdFacArr] = await Promise.all([\n dayQ,\n mtdQ,\n facQ,\n trendQ,\n mtdFacQ,\n ]);\n return ok({\n day: dayArr[0],\n mtd: mtdArr[0],\n facSplit: facArr,\n trend: trendArr,\n mtdFacSplit: mtdFacArr,\n }, req);\n}\n\n// OroBeads Match — Bhiwandi (OroBeads) vs Lambodhar daily SALES comparison\n// Shows: daily KG (from items with KG-like units only), taxable Amount, and Avg Rate per factory\nexport async function getOroBeadsMatch(p: URLSearchParams, req?: Request): Promise {\n var month = p.get(\"month\") || \"\";\n if (!month || !/^\\d{4}-\\d{2}$/.test(month)) {\n return err(\"month required (YYYY-MM)\");\n }\n try {\n // Parallel queries: OroBeads daily sales + Lambodhar daily sales\n // KG = only items where unit is KG/Kgs/kg (excludes PCS, NOS, EA, Ltrs, Gross, SET)\n // Amount = invoice taxable (pre-GST) from invoice headers\n var [oroRows, lamRows] = await Promise.all([\n sql`SELECT TO_CHAR(i.inv_date,'YYYY-MM-DD') as date,\n SUM(i.taxable)::float as amount,\n COALESCE(SUM(iq.kg_qty),0)::float as kg\n FROM pp_sales_invoices i\n LEFT JOIN (\n SELECT invoice_id, SUM(qty)::float as kg_qty\n FROM pp_sales_items\n WHERE LOWER(unit) IN ('kg','kgs','kilo','kilos','kilogram','kilograms')\n GROUP BY invoice_id\n ) iq ON iq.invoice_id=i.id\n WHERE TO_CHAR(i.inv_date,'YYYY-MM') = ${month}\n AND i.factory='orobeads'\n GROUP BY TO_CHAR(i.inv_date,'YYYY-MM-DD')\n ORDER BY date`,\n sql`SELECT TO_CHAR(i.inv_date,'YYYY-MM-DD') as date,\n SUM(i.taxable)::float as amount,\n COALESCE(SUM(iq.kg_qty),0)::float as kg\n FROM pp_sales_invoices i\n LEFT JOIN (\n SELECT invoice_id, SUM(qty)::float as kg_qty\n FROM pp_sales_items\n WHERE LOWER(unit) IN ('kg','kgs','kilo','kilos','kilogram','kilograms')\n GROUP BY invoice_id\n ) iq ON iq.invoice_id=i.id\n WHERE TO_CHAR(i.inv_date,'YYYY-MM') = ${month}\n AND i.factory='lambodhar'\n GROUP BY TO_CHAR(i.inv_date,'YYYY-MM-DD')\n ORDER BY date`,\n ]);\n var oroMap: Record = {};\n var lamMap: Record = {};\n for (var r of oroRows) {\n oroMap[r.date] = { kg: Number(r.kg) || 0, amount: Number(r.amount) || 0 };\n }\n for (var r of lamRows) {\n lamMap[r.date] = { kg: Number(r.kg) || 0, amount: Number(r.amount) || 0 };\n }\n var allDates = Array.from(\n new Set([...Object.keys(oroMap), ...Object.keys(lamMap)]),\n ).sort();\n var days = allDates.map(function (d) {\n var o = oroMap[d] || { kg: 0, amount: 0 };\n var l = lamMap[d] || { kg: 0, amount: 0 };\n return {\n date: d,\n oro_kg: o.kg,\n oro_amount: o.amount,\n oro_rate: o.kg > 0 ? Math.round(o.amount / o.kg) : 0,\n lam_kg: l.kg,\n lam_amount: l.amount,\n lam_rate: l.kg > 0 ? Math.round(l.amount / l.kg) : 0,\n };\n });\n var totOroKg = days.reduce(function (s: number, d: any) {\n return s + d.oro_kg;\n }, 0);\n var totOroAmt = days.reduce(function (s: number, d: any) {\n return s + d.oro_amount;\n }, 0);\n var totLamKg = days.reduce(function (s: number, d: any) {\n return s + d.lam_kg;\n }, 0);\n var totLamAmt = days.reduce(function (s: number, d: any) {\n return s + d.lam_amount;\n }, 0);\n return ok({\n month,\n days,\n totals: {\n oro_kg: totOroKg,\n oro_amount: totOroAmt,\n oro_rate: totOroKg > 0 ? Math.round(totOroAmt / totOroKg) : 0,\n lam_kg: totLamKg,\n lam_amount: totLamAmt,\n lam_rate: totLamKg > 0 ? Math.round(totLamAmt / totLamKg) : 0,\n grand_kg: totOroKg + totLamKg,\n grand_amount: totOroAmt + totLamAmt,\n },\n }, req);\n } catch (e: any) {\n return ok({\n month,\n days: [],\n totals: {\n oro_kg: 0,\n oro_amount: 0,\n oro_rate: 0,\n lam_kg: 0,\n lam_amount: 0,\n lam_rate: 0,\n grand_kg: 0,\n grand_amount: 0,\n },\n error: String(e?.message || e),\n }, req);\n }\n}\n\nexport async function getSalesDates(p: URLSearchParams, req?: Request): Promise {\n var m = p.get(\"month\") || \"\";\n if (!m) return ok({ dates: [] }, req);\n var r =\n await sql`SELECT DISTINCT TO_CHAR(inv_date,'YYYY-MM-DD')as date FROM pp_sales_invoices WHERE TO_CHAR(inv_date,'YYYY-MM')=${m} ORDER BY date DESC`;\n return ok({ dates: r.map((x: any) => x.date) }, req);\n}\n\nexport async function getSalesMonths(req?: Request): Promise {\n var r =\n await sql`SELECT DISTINCT TO_CHAR(inv_date,'YYYY-MM')as month FROM pp_sales_invoices ORDER BY month DESC`;\n return ok({ months: r.map((x: any) => x.month) }, req);\n}\n\n// V21: total_qty counts only KG-unit items (excludes PCS, NOS, EA, Gross, Ltrs, SET)\nexport async function getSalesCustomerSummary(p: URLSearchParams, req?: Request): Promise {\n var month = p.get(\"month\") || \"\";\n var factory = p.get(\"factory\") || \"\";\n // KG-only subquery: only sum qty where unit is KG-like\n var kgSub =\n `(SELECT invoice_id,SUM(qty)::float as total_qty FROM pp_sales_items WHERE LOWER(unit) IN ('kg','kgs','kilo','kilos','kilogram','kilograms') GROUP BY invoice_id)`;\n if (month && factory && factory !== \"all\") {\n return ok({\n customers:\n await sql`SELECT i.customer_name,i.factory,c.gstin,COUNT(DISTINCT i.id)::int as inv_count,SUM(i.taxable)::float as taxable,SUM(i.total)::float as total,COALESCE(SUM(iq.total_qty),0)::float as total_qty FROM pp_sales_invoices i LEFT JOIN pp_sales_customers c ON i.customer_id=c.id LEFT JOIN (SELECT invoice_id,SUM(qty)::float as total_qty FROM pp_sales_items WHERE LOWER(unit) IN ('kg','kgs','kilo','kilos','kilogram','kilograms') GROUP BY invoice_id) iq ON iq.invoice_id=i.id WHERE TO_CHAR(i.inv_date,'YYYY-MM')=${month} AND i.factory=${factory} GROUP BY i.customer_name,i.factory,c.gstin ORDER BY SUM(i.total)DESC`,\n }, req);\n }\n if (month) {\n return ok({\n customers:\n await sql`SELECT i.customer_name,i.factory,c.gstin,COUNT(DISTINCT i.id)::int as inv_count,SUM(i.taxable)::float as taxable,SUM(i.total)::float as total,COALESCE(SUM(iq.total_qty),0)::float as total_qty FROM pp_sales_invoices i LEFT JOIN pp_sales_customers c ON i.customer_id=c.id LEFT JOIN (SELECT invoice_id,SUM(qty)::float as total_qty FROM pp_sales_items WHERE LOWER(unit) IN ('kg','kgs','kilo','kilos','kilogram','kilograms') GROUP BY invoice_id) iq ON iq.invoice_id=i.id WHERE TO_CHAR(i.inv_date,'YYYY-MM')=${month} GROUP BY i.customer_name,i.factory,c.gstin ORDER BY SUM(i.total)DESC`,\n }, req);\n }\n return ok({\n customers:\n await sql`SELECT i.customer_name,i.factory,c.gstin,COUNT(DISTINCT i.id)::int as inv_count,SUM(i.taxable)::float as taxable,SUM(i.total)::float as total,COALESCE(SUM(iq.total_qty),0)::float as total_qty FROM pp_sales_invoices i LEFT JOIN pp_sales_customers c ON i.customer_id=c.id LEFT JOIN (SELECT invoice_id,SUM(qty)::float as total_qty FROM pp_sales_items WHERE LOWER(unit) IN ('kg','kgs','kilo','kilos','kilogram','kilograms') GROUP BY invoice_id) iq ON iq.invoice_id=i.id GROUP BY i.customer_name,i.factory,c.gstin ORDER BY SUM(i.total)DESC`,\n }, req);\n}",[],[212],{"_107":222,"_99":223,"_163":224,"_165":-5,"_166":148,"_167":225,"_168":169,"_109":226,"_104":196,"_172":173,"_174":227,"_176":22,"_177":-5,"_178":228,"_102":229},"4f4d5fda-2c6e-11f1-a7fe-42dde27851f2","ppSalesAI.ts","0fbbf532-2810-11f1-a8a8-42dde27851f2",102,["D",1774898771350],"// PlatingPro — Sales AI: Gemini Scan + Gmail Sync + Bulk PDF (V20)\nimport { sql, ok, err, rateLimit, isValidDate } from \"./ppShared.ts\";\n\nconst GEMINI_INVOICE_PROMPT = 'Extract ALL data from this GST sales invoice. Return ONLY valid JSON: {\"inv_no\":\"\",\"inv_date\":\"YYYY-MM-DD\",\"customer_name\":\"\",\"gstin\":\"\",\"items\":[{\"product_name\":\"\",\"hsn\":\"\",\"qty\":0,\"unit\":\"PCS\",\"rate\":0,\"amount\":0,\"color\":\"\"}],\"taxable\":0,\"cgst\":0,\"sgst\":0,\"igst\":0,\"total\":0}. Extract EVERY line item. Return ONLY JSON, no markdown.';\n\nasync function getGeminiKey(): Promise {\n const r = await sql`SELECT value FROM pp_settings WHERE key='gemini_api_key'`;\n return r[0]?.value || null;\n}\n\nasync function callGemini(apiKey: string, body: any): Promise<{ok:boolean,text:string}> {\n const resp = await fetch(`https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent?key=${apiKey}`, {\n method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body)\n });\n if (!resp.ok) { const t = await resp.text(); return { ok: false, text: t }; }\n const d = await resp.json();\n let text = d.candidates?.[0]?.content?.parts?.[0]?.text || '';\n text = text.replace(/```json\\s*/g,'').replace(/```\\s*/g,'').trim();\n return { ok: true, text };\n}\n\n// Scan a single PDF/image/text invoice via Gemini — returns scanned fields\nexport async function scanSalesInvoice(b: any, req?: Request): Promise {\n var content = b.content; var type = b.type || 'text';\n if (!content) return err(\"content required\", 400, req);\n // Reject oversized payloads before they crash Val Town (limit: ~3.5MB base64)\n if (typeof content === 'string' && content.length > 8 * 1024 * 1024) {\n return err(\"File too large even after compression (max ~6MB). Try uploading fewer pages at once.\", 413, req);\n }\n const apiKey = await getGeminiKey();\n if (!apiKey) return err(\"Gemini API key not configured\", 503, req);\n try {\n var gBody: any;\n if (type === 'pdf' || type === 'image') {\n var mimeType = type === 'pdf' ? 'application/pdf' : 'image/jpeg';\n gBody = { contents: [{ parts: [{ inline_data: { mime_type: mimeType, data: content } }, { text: GEMINI_INVOICE_PROMPT }] }], generationConfig: { temperature: 0.1, maxOutputTokens: 4000 } };\n } else {\n gBody = { contents: [{ parts: [{ text: GEMINI_INVOICE_PROMPT + '\\n\\nContent:\\n' + (typeof content === 'string' ? content : JSON.stringify(content)) }] }], generationConfig: { temperature: 0.1, maxOutputTokens: 4000 } };\n }\n const res = await callGemini(apiKey, gBody);\n if (!res.ok) return err('Gemini error: ' + res.text, 502, req);\n try {\n const parsed = JSON.parse(res.text);\n if (parsed.customer_name) {\n const cm = await sql`SELECT factory FROM pp_sales_customers WHERE LOWER(TRIM(name))=LOWER(TRIM(${parsed.customer_name}))`;\n parsed.factory = cm[0]?.factory || null;\n parsed.is_new_customer = cm.length === 0;\n }\n return ok({ scanned: parsed }, req);\n } catch (pe) { return err('Failed to parse Gemini response', 502, req); }\n } catch (e: any) { return err('Scan error: ' + e.message, 500, req); }\n}\n\n// Process a single email PDF via Gemini → save invoice to DB\nexport async function gmailSyncOne(b: any, req?: Request): Promise {\n var msgId = b.gmail_msg_id; var subject = b.gmail_subject || ''; var gmailDate = b.gmail_date || '';\n var attachName = b.attachment_name || ''; var pdfBase64 = b.pdf_base64;\n if (!msgId || !pdfBase64) return err(\"gmail_msg_id and pdf_base64 required\", 400, req);\n if (pdfBase64.length > 5*1024*1024) return err(\"PDF too large (max ~4MB). File: \" + (attachName||msgId), 400, req);\n\n // Check if already synced\n var dup = await sql`SELECT id,status,inv_no FROM pp_gmail_sync WHERE gmail_msg_id=${msgId}`;\n if (dup.length > 0) return ok({ skipped: true, reason: 'Already synced', inv_no: dup[0].inv_no, status: dup[0].status }, req);\n\n await sql`INSERT INTO pp_gmail_sync(gmail_msg_id,gmail_subject,gmail_date,attachment_name,status)VALUES(${msgId},${subject},${gmailDate},${attachName},'scanning')`;\n\n const apiKey = await getGeminiKey();\n if (!apiKey) {\n await sql`UPDATE pp_gmail_sync SET status='error',error='No Gemini API key' WHERE gmail_msg_id=${msgId}`;\n return err('Gemini API key not configured', 503, req);\n }\n\n try {\n const gBody = { contents: [{ parts: [{ inline_data: { mime_type: 'application/pdf', data: pdfBase64 } }, { text: GEMINI_INVOICE_PROMPT }] }], generationConfig: { temperature: 0.1, maxOutputTokens: 4000 } };\n const res = await callGemini(apiKey, gBody);\n if (!res.ok) {\n await sql`UPDATE pp_gmail_sync SET status='error',error=${'Gemini HTTP error'} WHERE gmail_msg_id=${msgId}`;\n return ok({ status: 'error', error: 'Gemini error', detail: res.text }, req);\n }\n\n var parsed: any;\n try { parsed = JSON.parse(res.text); }\n catch (pe) {\n await sql`UPDATE pp_gmail_sync SET status='error',error='JSON parse failed',scanned_data=${JSON.stringify({ raw: res.text.slice(0,500) })} WHERE gmail_msg_id=${msgId}`;\n return ok({ status: 'error', error: 'Failed to parse Gemini response', raw: res.text.slice(0,200) }, req);\n }\n\n await sql`UPDATE pp_gmail_sync SET scanned_data=${JSON.stringify(parsed)},inv_no=${parsed.inv_no||null} WHERE gmail_msg_id=${msgId}`;\n\n // Check duplicate invoice number\n if (parsed.inv_no) {\n var invDup = await sql`SELECT id FROM pp_sales_invoices WHERE inv_no=${parsed.inv_no.trim()}`;\n if (invDup.length > 0) {\n await sql`UPDATE pp_gmail_sync SET status='duplicate',invoice_id=${invDup[0].id} WHERE gmail_msg_id=${msgId}`;\n return ok({ status: 'duplicate', inv_no: parsed.inv_no, existing_id: invDup[0].id }, req);\n }\n }\n\n // Look up customer factory\n if (parsed.customer_name) {\n var cm = await sql`SELECT factory FROM pp_sales_customers WHERE LOWER(TRIM(name))=LOWER(TRIM(${parsed.customer_name}))`;\n parsed.factory = cm[0]?.factory || null;\n }\n\n if (!parsed.inv_no || !parsed.inv_date || !parsed.customer_name) {\n await sql`UPDATE pp_gmail_sync SET status='error',error='Missing required fields (inv_no/date/customer)' WHERE gmail_msg_id=${msgId}`;\n return ok({ status: 'error', error: 'Incomplete scan', parsed: parsed }, req);\n }\n\n // FIX 3: Save customer + invoice + items in a real DB transaction\n var custName = parsed.customer_name.trim().replace(/\\s+/g, \" \");\n var custNameNorm = custName.toLowerCase();\n var invNo = parsed.inv_no.trim();\n var custId = 0;\n\n try {\n await sql`BEGIN`;\n var exC = await sql`SELECT id,factory FROM pp_sales_customers WHERE LOWER(TRIM(name))=${custNameNorm} AND COALESCE(is_deleted,false)=false`;\n if (exC.length > 0) { custId = exC[0].id; if (!parsed.factory) parsed.factory = exC[0].factory; }\n else {\n var crC = await sql`INSERT INTO pp_sales_customers(name,gstin,factory,created_by) VALUES(${custName},${(parsed.gstin||'').toUpperCase()},${parsed.factory||null},${'gmail-sync'}) RETURNING id`;\n custId = crC[0].id;\n }\n var taxable = Number(parsed.taxable) || 0;\n if (parsed.items && Array.isArray(parsed.items) && parsed.items.length > 0 && taxable === 0) {\n for (var ii = 0; ii < parsed.items.length; ii++) taxable += Number(parsed.items[ii].amount||0);\n }\n var cgst = Number(parsed.cgst)||0, sgst = Number(parsed.sgst)||0, igst = Number(parsed.igst)||0;\n var total = Number(parsed.total) || (taxable+cgst+sgst+igst);\n var inv = await sql`INSERT INTO pp_sales_invoices(inv_no,inv_date,customer_id,customer_name,factory,taxable,cgst,sgst,igst,total,source,notes,created_by) VALUES(${invNo},${parsed.inv_date},${custId},${custName},${parsed.factory||null},${taxable},${cgst},${sgst},${igst},${total},${'gmail-sync'},${subject},${b.synced_by||'system'}) RETURNING id`;\n var invId = inv[0].id;\n if (parsed.items && Array.isArray(parsed.items)) {\n for (var j = 0; j < parsed.items.length; j++) {\n var it = parsed.items[j]; var amt = Number(it.amount)||(Number(it.qty||0)*Number(it.rate||0));\n await sql`INSERT INTO pp_sales_items(invoice_id,product_name,hsn,qty,unit,rate,amount,color,description) VALUES(${invId},${it.product_name||it.name||''},${it.hsn||''},${Number(it.qty)||0},${it.unit||'PCS'},${Number(it.rate)||0},${amt},${it.color||''},${it.description||''})`;\n }\n }\n await sql`COMMIT`;\n await sql`UPDATE pp_gmail_sync SET status='saved',invoice_id=${invId} WHERE gmail_msg_id=${msgId}`;\n return ok({ status: 'saved', inv_no: invNo, invoice_id: invId, customer: custName, total: total, items_count: parsed.items?.length||0 }, req);\n } catch (txErr: any) {\n try { await sql`ROLLBACK`; } catch (_) {}\n var txErrMsg = String(txErr?.message||txErr||'Unknown').slice(0,500);\n try { await sql`UPDATE pp_gmail_sync SET status='error',error=${txErrMsg} WHERE gmail_msg_id=${msgId}`; } catch (_) {}\n return ok({ status: 'error', error: 'Save failed: ' + txErrMsg }, req);\n }\n\n } catch (e: any) {\n var errMsg = String(e?.message||e||'Unknown error').slice(0,500);\n try { await sql`UPDATE pp_gmail_sync SET status='error',error=${errMsg} WHERE gmail_msg_id=${msgId}`; } catch (e2) {}\n return ok({ status: 'error', error: 'Sync error: ' + errMsg }, req);\n }\n}\n\n// Bulk sync multiple emails (calls gmailSyncOne for each)\nexport async function gmailSyncBulk(b: any, req?: Request): Promise {\n var emails = b.emails;\n if (!emails || !Array.isArray(emails) || emails.length === 0) return err(\"No emails provided\", 400, req);\n if (emails.length > 50) return err(\"Max 50 emails per batch\", 400, req);\n var results: any[] = []; var saved = 0; var skipped = 0; var errors = 0;\n for (var i = 0; i < emails.length; i++) {\n try {\n var email = emails[i];\n var dup = await sql`SELECT id,status,inv_no FROM pp_gmail_sync WHERE gmail_msg_id=${email.gmail_msg_id}`;\n if (dup.length > 0) { skipped++; results.push({ i, status: 'skipped', inv_no: dup[0].inv_no }); continue; }\n var resp = await gmailSyncOne(email);\n var respBody = await resp.json();\n if (respBody.error) { errors++; results.push({ i, status: 'error', error: respBody.error, attachment: email.attachment_name }); }\n else if (respBody.skipped || respBody.status === 'duplicate') { skipped++; results.push({ i, status: respBody.status||'skipped', inv_no: respBody.inv_no }); }\n else { saved++; results.push({ i, status: 'saved', inv_no: respBody.inv_no, total: respBody.total }); }\n } catch (e: any) { errors++; results.push({ i, status: 'error', error: e.message }); }\n }\n return ok({ saved, skipped, errors, total: emails.length, results }, req);\n}\n\nexport async function getGmailSyncLog(p: URLSearchParams, req?: Request): Promise {\n var limit = Number(p.get(\"limit\")) || 50;\n var status = p.get(\"status\") || \"\";\n try {\n var r: any[];\n if (status) { r = await sql`SELECT id,gmail_msg_id,gmail_subject,gmail_date,attachment_name,inv_no,status,error,invoice_id,created_at FROM pp_gmail_sync WHERE status=${status} ORDER BY created_at DESC LIMIT ${limit}`; }\n else { r = await sql`SELECT id,gmail_msg_id,gmail_subject,gmail_date,attachment_name,inv_no,status,error,invoice_id,created_at FROM pp_gmail_sync ORDER BY created_at DESC LIMIT ${limit}`; }\n return ok({ log: r }, req);\n } catch (e: any) { return ok({ log: [] }, req); }\n}\n\nexport async function getGmailSyncStats(req?: Request): Promise {\n try {\n var [r, total] = await Promise.all([\n sql`SELECT status,COUNT(*)::int as count FROM pp_gmail_sync GROUP BY status`,\n sql`SELECT COUNT(*)::int as total,MIN(created_at)as first_sync,MAX(created_at)as last_sync FROM pp_gmail_sync`\n ]);\n return ok({ stats: r, meta: total[0] }, req);\n } catch (e: any) { return ok({ stats: [], meta: { total: 0 } }, req); }\n}\n\nexport async function gmailSyncRetry(b: any, req?: Request): Promise {\n if (!b.id) return err(\"id required\", 400, req);\n await sql`UPDATE pp_gmail_sync SET status='pending',error=NULL WHERE id=${b.id}`;\n return ok({ success: true }, req);\n}\n\nexport async function gmailSyncDelete(b: any, req?: Request): Promise {\n if (!b.id) return err(\"id required\", 400, req);\n await sql`DELETE FROM pp_gmail_sync WHERE id=${b.id}`;\n return ok({ success: true }, req);\n}\n\n// Bulk scan multiple PDF invoices via Gemini, save all\nexport async function bulkScanInvoices(b: any, req?: Request): Promise {\n var pdfs = b.pdfs;\n if (!pdfs || !Array.isArray(pdfs) || pdfs.length === 0) return err(\"No PDFs provided\", 400, req);\n if (pdfs.length > 20) return err(\"Max 20 PDFs per batch\", 400, req);\n\n const apiKey = await getGeminiKey();\n if (!apiKey) return err('Gemini API key not configured', 503, req);\n\n var results: any[] = []; var saved = 0; var errors = 0;\n for (var i = 0; i < pdfs.length; i++) {\n var pdf = pdfs[i];\n try {\n if (!pdf.base64 || pdf.base64.length > 5*1024*1024) { errors++; results.push({ i, file: pdf.filename, status: 'error', error: 'PDF too large or empty (max ~4MB)' }); continue; }\n\n const gBody = { contents: [{ parts: [{ inline_data: { mime_type: 'application/pdf', data: pdf.base64 } }, { text: GEMINI_INVOICE_PROMPT }] }], generationConfig: { temperature: 0.1, maxOutputTokens: 4000 } };\n const res = await callGemini(apiKey, gBody);\n if (!res.ok) { errors++; results.push({ i, file: pdf.filename, status: 'error', error: 'Gemini HTTP error' }); continue; }\n\n var parsed: any;\n try { parsed = JSON.parse(res.text); }\n catch (pe) { errors++; results.push({ i, file: pdf.filename, status: 'error', error: 'JSON parse failed' }); continue; }\n\n if (!parsed.inv_no || !parsed.inv_date || !parsed.customer_name) { errors++; results.push({ i, file: pdf.filename, status: 'error', error: 'Missing fields', parsed: parsed }); continue; }\n\n // Check duplicate\n var invDup = await sql`SELECT id FROM pp_sales_invoices WHERE inv_no=${parsed.inv_no.trim()}`;\n if (invDup.length > 0) { results.push({ i, file: pdf.filename, status: 'duplicate', inv_no: parsed.inv_no }); continue; }\n\n // FIX 3: Save customer + invoice + items atomically per PDF\n var custName = parsed.customer_name.trim().replace(/\\s+/g,\" \"); var custId = 0;\n try {\n await sql`BEGIN`;\n var exB = await sql`SELECT id,factory FROM pp_sales_customers WHERE LOWER(TRIM(name))=${custName.toLowerCase()} AND COALESCE(is_deleted,false)=false`;\n if (exB.length > 0) { custId = exB[0].id; if (!parsed.factory) parsed.factory = exB[0].factory; }\n else { var crB = await sql`INSERT INTO pp_sales_customers(name,gstin,factory,created_by) VALUES(${custName},${(parsed.gstin||'').toUpperCase()},${parsed.factory||null},${'bulk-upload'}) RETURNING id`; custId = crB[0].id; }\n var taxable = Number(parsed.taxable)||0;\n if (parsed.items && Array.isArray(parsed.items) && taxable===0) { for (var ii=0;ii r.status === 'duplicate').length, total: pdfs.length, results }, req);\n}\n",[],[223],{"_107":231,"_99":232,"_163":233,"_165":-5,"_166":148,"_167":234,"_168":169,"_109":235,"_104":236,"_172":217,"_174":237,"_176":22,"_177":-5,"_178":238,"_102":239},"7dde413e-29a8-11f1-9930-42dde27851f2","ppShared.ts","07a141ea-2810-11f1-b790-42dde27851f2",83,["D",1774593906798],6,"// PlatingPro — Shared DB + Helpers (V22-final)\n// No hardcoded secrets. DB URL from: (1) DATABASE_URL env var, (2) Val Town blob pp_db_url\nimport { neon, type NeonQueryFunction } from \"https://esm.sh/@neondatabase/serverless@0.9.5\";\n\n// Top-level await to resolve DB URL before any request is served\nconst _DB_URL: string = await (async () => {\n // 1. Check env var (set in Val Town UI: Settings → Environment Variables)\n const fromEnv = Deno.env.get(\"DATABASE_URL\");\n if (fromEnv && fromEnv.startsWith(\"postgresql://\")) return fromEnv;\n // 2. Fallback: Val Town blob store (already set via API: POST /v1/blob/pp_db_url)\n try {\n const vtKey = Deno.env.get(\"valtown\") || \"\";\n const r = await fetch(\"https://api.val.town/v1/blob/pp_db_url\", {\n headers: { \"Authorization\": \"Bearer \" + vtKey }\n });\n if (r.ok) {\n const url = (await r.text()).trim();\n if (url.startsWith(\"postgresql://\")) {\n console.log(\"DB: using blob store URL (set DATABASE_URL env var for production)\");\n return url;\n }\n }\n } catch (e) {\n console.error(\"DB blob read failed:\", e);\n }\n throw new Error(\"DATABASE_URL not configured. Set it in Val Town Settings → Environment Variables.\");\n})();\n\nexport const sql: NeonQueryFunction = neon(_DB_URL);\n\n// FIX 2: Request-aware CORS — no wildcard on real responses\nconst ALLOWED_ORIGINS = (Deno.env.get(\"ALLOWED_ORIGINS\") ||\n \"https://platingpro.tiiny.co,https://platingpro.tiiny.site,http://localhost:3000\").split(\",\").map(s => s.trim());\n\nfunction corsHeaders(req?: Request): Record {\n const origin = req?.headers?.get(\"origin\") || \"\";\n const allowed = ALLOWED_ORIGINS.includes(origin) ? origin : \"\";\n const h: Record = {\n \"Content-Type\": \"application/json\",\n \"Access-Control-Allow-Methods\": \"GET,POST,PUT,DELETE,OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, Authorization\",\n \"Vary\": \"Origin\",\n };\n if (allowed) h[\"Access-Control-Allow-Origin\"] = allowed;\n return h;\n}\n\nexport function handleOptions(req: Request): Response {\n return new Response(\"\", { status: 204, headers: corsHeaders(req) });\n}\nexport function ok(d: any, req?: Request): Response {\n return new Response(JSON.stringify(d), { status: 200, headers: corsHeaders(req) });\n}\nexport function err(m: string, c = 400, req?: Request): Response {\n return new Response(JSON.stringify({ error: m }), { status: c, headers: corsHeaders(req) });\n}\n\n// Rate limiter (in-memory per key)\nconst RL = new Map();\nexport function rateLimit(key: string, max: number, windowMs: number): boolean {\n const now = Date.now();\n const e = RL.get(key);\n if (!e || e.reset < now) { RL.set(key, { count: 1, reset: now + windowMs }); return false; }\n e.count++;\n return e.count > max;\n}\n\n// Settings whitelist\nexport const SETTINGS_WHITELIST = new Set([\n \"gemini_api_key\", \"whatsapp_phone\", \"whatsapp_api_key\",\n \"gmail_credentials\", \"gmail_token\", \"gmail_client_id\", \"gmail_client_secret\",\n \"company_name\", \"division\", \"theme\", \"accent_color\", \"font_size\",\n \"auto_heal\", \"alert_threshold\", \"default_factory\",\n \"gold_rate\", \"copper_rate\", \"nickel_rate\", \"silver_rate\", \"black_rate\",\n \"target_rej_pct\",\n]);\n\n// Audit log — never throws, silent fail\nexport async function audit(userName: string, action: string, module: string, data: any): Promise {\n try {\n const d = JSON.stringify(data);\n await sql`INSERT INTO pp_audit_log(user_name,action,module,data) VALUES(${userName},${action},${module},${d}::jsonb)`;\n } catch (_) {}\n}\n\n// FIX 8: Idempotent audit table + schema migration\nexport async function ensureAuditTable(): Promise {\n try {\n await sql`CREATE TABLE IF NOT EXISTS pp_audit_log(\n id SERIAL PRIMARY KEY,\n user_name TEXT,\n action TEXT,\n module TEXT,\n data JSONB,\n created_at TIMESTAMPTZ DEFAULT NOW()\n )`;\n await sql`CREATE INDEX IF NOT EXISTS idx_audit_log_user ON pp_audit_log(user_name)`;\n await sql`CREATE INDEX IF NOT EXISTS idx_audit_log_created ON pp_audit_log(created_at DESC)`;\n await sql`CREATE INDEX IF NOT EXISTS idx_audit_log_module ON pp_audit_log(module)`;\n await sql`ALTER TABLE pp_sales_customers ADD COLUMN IF NOT EXISTS is_deleted BOOLEAN DEFAULT false`;\n } catch (_) {}\n}\n\n// Input helpers\nexport function isValidDate(s: string): boolean {\n return typeof s === \"string\" && /^\\d{4}-\\d{2}-\\d{2}$/.test(s) && !isNaN(Date.parse(s));\n}\nexport function isPositiveNumber(n: any): boolean {\n return !isNaN(Number(n)) && Number(n) >= 0;\n}\nexport function requireFields(b: any, ...fields: string[]): string | null {\n for (const f of fields) {\n if (b[f] === undefined || b[f] === null || b[f] === \"\") return `${f} is required`;\n }\n return null;\n}\n",[],[232],"files",[160,181,191,200,210,221,230],"counts",{"_244":33,"_245":246,"_247":33,"_248":249,"_252":253},"pulls","branches",1,"forks","envVars",{"_250":246,"_251":33},"count","emptyCount","connections",{"_250":33,"_254":33},"unfilledCount","contents",[],"file",{"_107":192,"_166":148,"_163":193,"_99":103,"_174":197,"_172":173,"_104":196,"_165":-5,"_109":259,"_167":194,"_177":-5,"_102":260},["D",1774872861560],[103],"upstreamProject","upstreamBranch","emptyEnvVars","isNew","flags",[],"routes/_app.x.$handle.$name.branch.$branch.history_.$",{"_97":98,"_99":100,"_101":45,"_102":103,"_105":269,"_257":274,"_277":278,"_318":319,"_329":33,"_330":33,"_331":22},{"_107":108,"_99":100,"_109":270,"_111":-5,"_112":22,"_113":114,"_115":116,"_117":-5,"_14":118,"_119":-5,"_120":22,"_121":-5,"_122":-5,"_123":33,"_16":124,"_125":-5,"_126":-5,"_127":-5,"_128":129,"_130":129,"_131":132,"_133":132,"_134":132,"_135":129,"_136":129,"_23":271,"_140":272,"_145":273,"_157":22},["D",1774012210756],{"_97":98,"_138":139},{"_97":98,"_142":139,"_14":118,"_143":144},{"_104":147,"_99":45,"_107":148,"_149":108,"_150":-5,"_151":-5,"_152":-5,"_153":-5,"_154":-5,"_155":100,"_156":98},{"_107":192,"_99":103,"_163":193,"_165":-5,"_166":148,"_167":194,"_168":169,"_109":275,"_104":196,"_172":173,"_174":197,"_176":22,"_177":-5,"_102":276},["D",1774872861560],[103],"history",[279,281,286,291,296,302,308,313],{"_107":192,"_166":148,"_163":193,"_99":103,"_174":197,"_172":173,"_104":196,"_165":-5,"_109":280,"_167":194,"_177":-5},["D",1774872861560],{"_107":282,"_166":148,"_163":193,"_99":103,"_174":283,"_172":217,"_104":236,"_165":-5,"_109":284,"_167":285,"_177":-5},"d0f470e4-29f5-11f1-80f4-42dde27851f2","// PlatingPro — Auth + User Management (V22)\nimport { sql, ok, err, audit } from \"./ppShared.ts\";\nimport * as bcrypt from \"https://deno.land/x/bcrypt@v0.4.1/mod.ts\";\n\nexport async function login(b: any, req?: Request): Promise {\n const { username, password } = b;\n if (!username || !password) return err(\"Required\", 400, req);\n const r = await sql`SELECT id,username,display_name,role,password FROM pp_users WHERE username=${username.toLowerCase().trim()} AND active=true`;\n if (!r || r.length === 0) return err(\"Invalid credentials\", 401, req);\n const u = r[0];\n const isHashed = u.password?.startsWith(\"$2\");\n let valid = false;\n if (isHashed) {\n valid = await bcrypt.compare(password, u.password);\n } else {\n valid = u.password === password;\n if (valid) {\n const hashed = await bcrypt.hash(password);\n await sql`UPDATE pp_users SET password=${hashed} WHERE id=${u.id}`;\n }\n }\n if (!valid) return err(\"Invalid credentials\", 401, req);\n const t = crypto.randomUUID();\n await sql`INSERT INTO pp_sessions(token,user_name,role) VALUES(${t},${u.username},${u.role})`;\n return ok({ token: t, user: { username: u.username, name: u.display_name, role: u.role } }, req);\n}\n\nexport async function verifyToken(t: string): Promise {\n if (!t) return null;\n const r = await sql`SELECT user_name,role FROM pp_sessions WHERE token=${t} AND expires_at>NOW()`;\n return r?.[0] || null;\n}\n\nexport async function logout(token: string, req?: Request): Promise {\n await sql`DELETE FROM pp_sessions WHERE token=${token}`;\n return ok({ success: true }, req);\n}\n\n// Revoke all sessions for the currently logged-in user (self-service)\nexport async function revokeSelfSessions(userName: string, currentToken: string, req?: Request): Promise {\n await sql`DELETE FROM pp_sessions WHERE user_name=${userName}`;\n await audit(userName, \"REVOKE_ALL_SESSIONS\", \"auth\", { note: \"self-requested\" });\n return ok({ success: true }, req);\n}\n\n// Admin: revoke all sessions for any user by id\nexport async function revokeUserSessions(b: any, req?: Request): Promise {\n if (!b.id) return err(\"id required\", 400, req);\n await sql`DELETE FROM pp_sessions WHERE user_name=(SELECT username FROM pp_users WHERE id=${b.id})`;\n return ok({ success: true }, req);\n}\n\nexport async function getUsers(req?: Request): Promise {\n return ok({ users: await sql`SELECT id,username,display_name,role,active,created_at FROM pp_users ORDER BY id` }, req);\n}\n\nexport async function addUser(b: any, callerName: string, req?: Request): Promise {\n if (!b.username || !b.password || !b.display_name) return err(\"username, password, display_name required\", 400, req);\n try {\n const hashed = await bcrypt.hash(b.password);\n const r = await sql`INSERT INTO pp_users(username,password,display_name,role) VALUES(${b.username.toLowerCase().trim()},${hashed},${b.display_name},${b.role || \"viewer\"}) RETURNING id,username,display_name,role`;\n await audit(callerName, \"CREATE_USER\", \"users\", { username: b.username, role: b.role });\n return ok({ user: r[0] }, req);\n } catch (_) { return err(\"Username already exists\", 409, req); }\n}\n\nexport async function deleteUser(b: any, callerName: string, req?: Request): Promise {\n if (!b.id) return err(\"id required\", 400, req);\n await sql`DELETE FROM pp_sessions WHERE user_name=(SELECT username FROM pp_users WHERE id=${b.id})`;\n await sql`DELETE FROM pp_users WHERE id=${b.id}`;\n await audit(callerName, \"DELETE_USER\", \"users\", { id: b.id });\n return ok({ success: true }, req);\n}\n\nexport async function updateUser(b: any, callerName: string, req?: Request): Promise {\n if (!b.id) return err(\"id required\", 400, req);\n if (b.password) {\n const hashed = await bcrypt.hash(b.password);\n await sql`UPDATE pp_users SET display_name=COALESCE(${b.display_name},display_name),role=COALESCE(${b.role},role),password=${hashed},active=COALESCE(${b.active},active) WHERE id=${b.id}`;\n } else {\n await sql`UPDATE pp_users SET display_name=COALESCE(${b.display_name},display_name),role=COALESCE(${b.role},role),active=COALESCE(${b.active},active) WHERE id=${b.id}`;\n }\n await audit(callerName, \"UPDATE_USER\", \"users\", { id: b.id, role: b.role });\n return ok({ success: true }, req);\n}\n",["D",1774627117438],92,{"_107":287,"_166":148,"_163":193,"_99":103,"_174":288,"_172":217,"_104":206,"_165":-5,"_109":289,"_167":290,"_177":-5},"473e5236-29a8-11f1-a16c-42dde27851f2","// PlatingPro [V22-final] — Auth + User Management (V22)\nimport { sql, ok, err, audit } from \"./ppShared.ts\";\nimport * as bcrypt from \"https://deno.land/x/bcrypt@v0.4.1/mod.ts\";\n\nexport async function login(b: any, req?: Request): Promise {\n const { username, password } = b;\n if (!username || !password) return err(\"Required\", 400, req);\n const r = await sql`SELECT id,username,display_name,role,password FROM pp_users WHERE username=${username.toLowerCase().trim()} AND active=true`;\n if (!r || r.length === 0) return err(\"Invalid credentials\", 401, req);\n const u = r[0];\n const isHashed = u.password?.startsWith(\"$2\");\n let valid = false;\n if (isHashed) {\n valid = await bcrypt.compare(password, u.password);\n } else {\n valid = u.password === password;\n if (valid) {\n const hashed = await bcrypt.hash(password);\n await sql`UPDATE pp_users SET password=${hashed} WHERE id=${u.id}`;\n }\n }\n if (!valid) return err(\"Invalid credentials\", 401, req);\n const t = crypto.randomUUID();\n await sql`INSERT INTO pp_sessions(token,user_name,role) VALUES(${t},${u.username},${u.role})`;\n return ok({ token: t, user: { username: u.username, name: u.display_name, role: u.role } }, req);\n}\n\nexport async function verifyToken(t: string): Promise {\n if (!t) return null;\n const r = await sql`SELECT user_name,role FROM pp_sessions WHERE token=${t} AND expires_at>NOW()`;\n return r?.[0] || null;\n}\n\nexport async function logout(token: string, req?: Request): Promise {\n await sql`DELETE FROM pp_sessions WHERE token=${token}`;\n return ok({ success: true }, req);\n}\n\n// Revoke all sessions for the currently logged-in user (self-service)\nexport async function revokeSelfSessions(userName: string, currentToken: string, req?: Request): Promise {\n await sql`DELETE FROM pp_sessions WHERE user_name=${userName}`;\n await audit(userName, \"REVOKE_ALL_SESSIONS\", \"auth\", { note: \"self-requested\" });\n return ok({ success: true }, req);\n}\n\n// Admin: revoke all sessions for any user by id\nexport async function revokeUserSessions(b: any, req?: Request): Promise {\n if (!b.id) return err(\"id required\", 400, req);\n await sql`DELETE FROM pp_sessions WHERE user_name=(SELECT username FROM pp_users WHERE id=${b.id})`;\n return ok({ success: true }, req);\n}\n\nexport async function getUsers(req?: Request): Promise {\n return ok({ users: await sql`SELECT id,username,display_name,role,active,created_at FROM pp_users ORDER BY id` }, req);\n}\n\nexport async function addUser(b: any, callerName: string, req?: Request): Promise {\n if (!b.username || !b.password || !b.display_name) return err(\"username, password, display_name required\", 400, req);\n try {\n const hashed = await bcrypt.hash(b.password);\n const r = await sql`INSERT INTO pp_users(username,password,display_name,role) VALUES(${b.username.toLowerCase().trim()},${hashed},${b.display_name},${b.role || \"viewer\"}) RETURNING id,username,display_name,role`;\n await audit(callerName, \"CREATE_USER\", \"users\", { username: b.username, role: b.role });\n return ok({ user: r[0] }, req);\n } catch (_) { return err(\"Username already exists\", 409, req); }\n}\n\nexport async function deleteUser(b: any, callerName: string, req?: Request): Promise {\n if (!b.id) return err(\"id required\", 400, req);\n await sql`DELETE FROM pp_sessions WHERE user_name=(SELECT username FROM pp_users WHERE id=${b.id})`;\n await sql`DELETE FROM pp_users WHERE id=${b.id}`;\n await audit(callerName, \"DELETE_USER\", \"users\", { id: b.id });\n return ok({ success: true }, req);\n}\n\nexport async function updateUser(b: any, callerName: string, req?: Request): Promise {\n if (!b.id) return err(\"id required\", 400, req);\n if (b.password) {\n const hashed = await bcrypt.hash(b.password);\n await sql`UPDATE pp_users SET display_name=COALESCE(${b.display_name},display_name),role=COALESCE(${b.role},role),password=${hashed},active=COALESCE(${b.active},active) WHERE id=${b.id}`;\n } else {\n await sql`UPDATE pp_users SET display_name=COALESCE(${b.display_name},display_name),role=COALESCE(${b.role},role),active=COALESCE(${b.active},active) WHERE id=${b.id}`;\n }\n await audit(callerName, \"UPDATE_USER\", \"users\", { id: b.id, role: b.role });\n return ok({ success: true }, req);\n}\n",["D",1774593815071],77,{"_107":292,"_166":148,"_163":193,"_99":103,"_174":283,"_172":217,"_104":293,"_165":-5,"_109":294,"_167":295,"_177":-5},"9a956290-29a7-11f1-a63b-42dde27851f2",4,["D",1774593525480],68,{"_107":297,"_166":148,"_163":193,"_99":103,"_174":298,"_172":217,"_104":299,"_165":-5,"_109":300,"_167":301,"_177":-5},"dcf2b3a8-29a3-11f1-a661-42dde27851f2","// PlatingPro — Auth + User Management (V22)\nimport { sql, ok, err, audit } from \"./ppShared.ts\";\nimport * as bcrypt from \"https://deno.land/x/bcrypt@v0.4.1/mod.ts\";\n\n// FIX 6: Login — fetch user first, compare password safely, rehash plaintext on the fly\nexport async function login(b: any): Promise {\n const { username, password } = b;\n if (!username || !password) return err(\"Required\");\n const r = await sql`SELECT id,username,display_name,role,password FROM pp_users WHERE username=${username.toLowerCase().trim()} AND active=true`;\n if (!r || r.length === 0) return err(\"Invalid credentials\", 401);\n const u = r[0];\n\n const isHashed = u.password?.startsWith(\"$2\");\n let valid = false;\n if (isHashed) {\n valid = await bcrypt.compare(password, u.password);\n } else {\n // Plaintext fallback — allow once, then rehash automatically\n valid = u.password === password;\n if (valid) {\n const hashed = await bcrypt.hash(password);\n await sql`UPDATE pp_users SET password=${hashed} WHERE id=${u.id}`;\n }\n }\n if (!valid) return err(\"Invalid credentials\", 401);\n\n const t = crypto.randomUUID();\n // FIX: Explicit 8-hour session expiry (configurable via SESSION_HOURS env)\n const hours = parseInt(Deno.env.get(\"SESSION_HOURS\") || \"8\");\n await sql`INSERT INTO pp_sessions(token,user_name,role,expires_at)VALUES(${t},${u.username},${u.role},NOW()+INTERVAL'1 hour'*${hours})`;\n // Housekeeping: clean up expired sessions (silent, non-blocking)\n sql`DELETE FROM pp_sessions WHERE expires_at{});\n return ok({ token: t, user: { username: u.username, name: u.display_name, role: u.role } });\n}\n\nexport async function verifyToken(t: string): Promise {\n if (!t) return null;\n const r = await sql`SELECT user_name,role FROM pp_sessions WHERE token=${t} AND expires_at>NOW()`;\n return r?.[0] || null;\n}\n\n// FIX 7: Logout — delete session\nexport async function logout(token: string): Promise {\n await sql`DELETE FROM pp_sessions WHERE token=${token}`;\n return ok({ success: true });\n}\n\n// FIX 8: Revoke all sessions for a user (admin action)\nexport async function revokeUserSessions(b: any): Promise {\n if (!b.id) return err(\"id required\");\n await sql`DELETE FROM pp_sessions WHERE user_name=(SELECT username FROM pp_users WHERE id=${b.id})`;\n return ok({ success: true });\n}\n\n// All user management — admin only (enforced in main.ts)\nexport async function getUsers(): Promise {\n return ok({ users: await sql`SELECT id,username,display_name,role,active,created_at FROM pp_users ORDER BY id` });\n}\n\nexport async function addUser(b: any, callerName: string): Promise {\n if (!b.username || !b.password || !b.display_name) return err(\"username, password, display_name required\");\n try {\n // FIX 9: Hash password on creation\n const hashed = await bcrypt.hash(b.password);\n const r = await sql`INSERT INTO pp_users(username,password,display_name,role)VALUES(${b.username.toLowerCase().trim()},${hashed},${b.display_name},${b.role || \"viewer\"})RETURNING id,username,display_name,role`;\n await audit(callerName, \"CREATE_USER\", \"users\", { username: b.username, role: b.role });\n return ok({ user: r[0] });\n } catch (_) { return err(\"Username already exists\"); }\n}\n\nexport async function deleteUser(b: any, callerName: string): Promise {\n if (!b.id) return err(\"id required\");\n await sql`DELETE FROM pp_sessions WHERE user_name=(SELECT username FROM pp_users WHERE id=${b.id})`;\n await sql`DELETE FROM pp_users WHERE id=${b.id}`;\n await audit(callerName, \"DELETE_USER\", \"users\", { id: b.id });\n return ok({ success: true });\n}\n\nexport async function updateUser(b: any, callerName: string): Promise {\n if (!b.id) return err(\"id required\");\n if (b.password) {\n // FIX 10: Hash password on update too\n const hashed = await bcrypt.hash(b.password);\n await sql`UPDATE pp_users SET display_name=COALESCE(${b.display_name},display_name),role=COALESCE(${b.role},role),password=${hashed},active=COALESCE(${b.active},active)WHERE id=${b.id}`;\n } else {\n await sql`UPDATE pp_users SET display_name=COALESCE(${b.display_name},display_name),role=COALESCE(${b.role},role),active=COALESCE(${b.active},active)WHERE id=${b.id}`;\n }\n await audit(callerName, \"UPDATE_USER\", \"users\", { id: b.id, role: b.role });\n return ok({ success: true });\n}\n",3,["D",1774591918834],59,{"_107":303,"_166":148,"_163":193,"_99":103,"_174":304,"_172":217,"_104":305,"_165":-5,"_109":306,"_167":307,"_177":-5},"35585432-29a2-11f1-8df4-42dde27851f2","// PlatingPro — Auth + User Management (V22)\nimport { sql, ok, err, audit } from \"./ppShared.ts\";\nimport * as bcrypt from \"https://deno.land/x/bcrypt@v0.4.1/mod.ts\";\n\n// FIX 6: Login — fetch user first, compare password safely, rehash plaintext on the fly\nexport async function login(b: any): Promise {\n const { username, password } = b;\n if (!username || !password) return err(\"Required\");\n const r = await sql`SELECT id,username,display_name,role,password FROM pp_users WHERE username=${username.toLowerCase().trim()} AND active=true`;\n if (!r || r.length === 0) return err(\"Invalid credentials\", 401);\n const u = r[0];\n\n const isHashed = u.password?.startsWith(\"$2\");\n let valid = false;\n if (isHashed) {\n valid = await bcrypt.compare(password, u.password);\n } else {\n // Plaintext fallback — allow once, then rehash automatically\n valid = u.password === password;\n if (valid) {\n const hashed = await bcrypt.hash(password);\n await sql`UPDATE pp_users SET password=${hashed} WHERE id=${u.id}`;\n }\n }\n if (!valid) return err(\"Invalid credentials\", 401);\n\n const t = crypto.randomUUID();\n await sql`INSERT INTO pp_sessions(token,user_name,role)VALUES(${t},${u.username},${u.role})`;\n return ok({ token: t, user: { username: u.username, name: u.display_name, role: u.role } });\n}\n\nexport async function verifyToken(t: string): Promise {\n if (!t) return null;\n const r = await sql`SELECT user_name,role FROM pp_sessions WHERE token=${t} AND expires_at>NOW()`;\n return r?.[0] || null;\n}\n\n// FIX 7: Logout — delete session\nexport async function logout(token: string): Promise {\n await sql`DELETE FROM pp_sessions WHERE token=${token}`;\n return ok({ success: true });\n}\n\n// FIX 8: Revoke all sessions for a user (admin action)\nexport async function revokeUserSessions(b: any): Promise {\n if (!b.id) return err(\"id required\");\n await sql`DELETE FROM pp_sessions WHERE user_name=(SELECT username FROM pp_users WHERE id=${b.id})`;\n return ok({ success: true });\n}\n\n// All user management — admin only (enforced in main.ts)\nexport async function getUsers(): Promise {\n return ok({ users: await sql`SELECT id,username,display_name,role,active,created_at FROM pp_users ORDER BY id` });\n}\n\nexport async function addUser(b: any, callerName: string): Promise {\n if (!b.username || !b.password || !b.display_name) return err(\"username, password, display_name required\");\n try {\n // FIX 9: Hash password on creation\n const hashed = await bcrypt.hash(b.password);\n const r = await sql`INSERT INTO pp_users(username,password,display_name,role)VALUES(${b.username.toLowerCase().trim()},${hashed},${b.display_name},${b.role || \"viewer\"})RETURNING id,username,display_name,role`;\n await audit(callerName, \"CREATE_USER\", \"users\", { username: b.username, role: b.role });\n return ok({ user: r[0] });\n } catch (_) { return err(\"Username already exists\"); }\n}\n\nexport async function deleteUser(b: any, callerName: string): Promise {\n if (!b.id) return err(\"id required\");\n await sql`DELETE FROM pp_sessions WHERE user_name=(SELECT username FROM pp_users WHERE id=${b.id})`;\n await sql`DELETE FROM pp_users WHERE id=${b.id}`;\n await audit(callerName, \"DELETE_USER\", \"users\", { id: b.id });\n return ok({ success: true });\n}\n\nexport async function updateUser(b: any, callerName: string): Promise {\n if (!b.id) return err(\"id required\");\n if (b.password) {\n // FIX 10: Hash password on update too\n const hashed = await bcrypt.hash(b.password);\n await sql`UPDATE pp_users SET display_name=COALESCE(${b.display_name},display_name),role=COALESCE(${b.role},role),password=${hashed},active=COALESCE(${b.active},active)WHERE id=${b.id}`;\n } else {\n await sql`UPDATE pp_users SET display_name=COALESCE(${b.display_name},display_name),role=COALESCE(${b.role},role),active=COALESCE(${b.active},active)WHERE id=${b.id}`;\n }\n await audit(callerName, \"UPDATE_USER\", \"users\", { id: b.id, role: b.role });\n return ok({ success: true });\n}\n",2,["D",1774591208145],45,{"_107":309,"_166":148,"_163":193,"_99":103,"_174":310,"_172":217,"_104":246,"_165":-5,"_109":311,"_167":312,"_177":-5},"a7b4ad82-299d-11f1-bfcd-42dde27851f2","// PlatingPro — Auth + User Management (V21)\n// Valid roles: admin | management | operator\nimport { sql, ok, err } from \"./ppShared.ts\";\n\nexport async function login(b: any): Promise {\n const { username, password } = b;\n if (!username || !password) return err(\"Required\");\n const r = await sql`SELECT id,username,display_name,role FROM pp_users WHERE username=${username.toLowerCase().trim()} AND password=${password} AND active=true`;\n if (!r || r.length === 0) return err(\"Invalid credentials\", 401);\n const u = r[0];\n const t = crypto.randomUUID();\n await sql`INSERT INTO pp_sessions(token,user_name,role)VALUES(${t},${u.username},${u.role})`;\n return ok({ token: t, user: { username: u.username, name: u.display_name, role: u.role } });\n}\n\nexport async function verifyToken(t: string): Promise {\n if (!t) return null;\n const r = await sql`SELECT user_name,role FROM pp_sessions WHERE token=${t} AND expires_at>NOW()`;\n return r?.[0] || null;\n}\n\nexport async function getUsers(): Promise {\n return ok({ users: await sql`SELECT id,username,display_name,role,active,created_at FROM pp_users ORDER BY id` });\n}\n\nexport async function addUser(b: any): Promise {\n if (!b.username || !b.password || !b.display_name) return err(\"username, password, display_name required\");\n try {\n const r = await sql`INSERT INTO pp_users(username,password,display_name,role)VALUES(${b.username.toLowerCase().trim()},${b.password},${b.display_name},${b.role||'operator'})RETURNING id,username,display_name,role`;\n return ok({ user: r[0] });\n } catch (e: any) { return err(\"Username already exists\"); }\n}\n\nexport async function deleteUser(b: any): Promise {\n if (!b.id) return err(\"id required\");\n await sql`DELETE FROM pp_sessions WHERE user_name=(SELECT username FROM pp_users WHERE id=${b.id})`;\n await sql`DELETE FROM pp_users WHERE id=${b.id}`;\n return ok({ success: true });\n}\n\nexport async function updateUser(b: any): Promise {\n if (!b.id) return err(\"id required\");\n if (b.password) {\n await sql`UPDATE pp_users SET display_name=COALESCE(${b.display_name},display_name),role=COALESCE(${b.role},role),password=${b.password},active=COALESCE(${b.active},active)WHERE id=${b.id}`;\n } else {\n await sql`UPDATE pp_users SET display_name=COALESCE(${b.display_name},display_name),role=COALESCE(${b.role},role),active=COALESCE(${b.active},active)WHERE id=${b.id}`;\n }\n return ok({ success: true });\n}\n",["D",1774589252533],42,{"_107":314,"_166":148,"_163":193,"_99":103,"_174":315,"_172":217,"_104":33,"_165":-5,"_109":316,"_167":317,"_177":-5},"0d4b7bf6-2810-11f1-bc65-42dde27851f2","// PlatingPro — Auth + User Management (V20)\nimport { sql, ok, err } from \"./ppShared.ts\";\n\nexport async function login(b: any): Promise {\n const { username, password } = b;\n if (!username || !password) return err(\"Required\");\n const r = await sql`SELECT id,username,display_name,role FROM pp_users WHERE username=${username.toLowerCase().trim()} AND password=${password} AND active=true`;\n if (!r || r.length === 0) return err(\"Invalid credentials\", 401);\n const u = r[0];\n const t = crypto.randomUUID();\n await sql`INSERT INTO pp_sessions(token,user_name,role)VALUES(${t},${u.username},${u.role})`;\n return ok({ token: t, user: { username: u.username, name: u.display_name, role: u.role } });\n}\n\nexport async function verifyToken(t: string): Promise {\n if (!t) return null;\n const r = await sql`SELECT user_name,role FROM pp_sessions WHERE token=${t} AND expires_at>NOW()`;\n return r?.[0] || null;\n}\n\nexport async function getUsers(): Promise {\n return ok({ users: await sql`SELECT id,username,display_name,role,active,created_at FROM pp_users ORDER BY id` });\n}\n\nexport async function addUser(b: any): Promise {\n if (!b.username || !b.password || !b.display_name) return err(\"username, password, display_name required\");\n try {\n const r = await sql`INSERT INTO pp_users(username,password,display_name,role)VALUES(${b.username.toLowerCase().trim()},${b.password},${b.display_name},${b.role||'viewer'})RETURNING id,username,display_name,role`;\n return ok({ user: r[0] });\n } catch (e: any) { return err(\"Username already exists\"); }\n}\n\nexport async function deleteUser(b: any): Promise {\n if (!b.id) return err(\"id required\");\n await sql`DELETE FROM pp_sessions WHERE user_name=(SELECT username FROM pp_users WHERE id=${b.id})`;\n await sql`DELETE FROM pp_users WHERE id=${b.id}`;\n return ok({ success: true });\n}\n\nexport async function updateUser(b: any): Promise {\n if (!b.id) return err(\"id required\");\n if (b.password) {\n await sql`UPDATE pp_users SET display_name=COALESCE(${b.display_name},display_name),role=COALESCE(${b.role},role),password=${b.password},active=COALESCE(${b.active},active)WHERE id=${b.id}`;\n } else {\n await sql`UPDATE pp_users SET display_name=COALESCE(${b.display_name},display_name),role=COALESCE(${b.role},role),active=COALESCE(${b.active},active)WHERE id=${b.id}`;\n }\n return ok({ success: true });\n}\n",["D",1774418483274],30,"versions",[320,322,323,324,325,326,327,328],{"_257":279,"_321":281},"previous",{"_257":281,"_321":286},{"_257":286,"_321":291},{"_257":291,"_321":296},{"_257":296,"_321":302},{"_257":302,"_321":308},{"_257":308,"_321":313},{"_257":313,"_321":-5},"versionNumber","page","hasNext","actionData","errors"]

abhishekplating

PlatingPro

History for ppAuth.ts