[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_184":185,"_186":187},"routes/_app.x.$handle.$name",{"_16":17,"_20":21,"_88":70,"_89":90,"_68":-7,"_91":-5,"_13":92,"_93":94,"_11":95,"_96":97,"_98":99,"_100":-5,"_101":-5,"_102":-5,"_103":26,"_104":105,"_106":38,"_107":-5,"_108":-5,"_109":110},"routes/_app.x.$handle.$name.search.$(branch)",{"_11":12,"_13":14,"_15":-5,"_16":17},"files",[],"project",{"_18":19,"_20":21,"_22":23,"_24":-5,"_25":26,"_27":28,"_29":28,"_30":31,"_32":-5,"_33":34,"_35":36,"_37":38,"_39":-5,"_40":-5,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":-5,"_52":53,"_54":53,"_55":56,"_57":56,"_58":56,"_59":53,"_60":53,"_61":62,"_63":64,"_65":66,"_67":26},"query","handle","alshell7","id","88b1089d-48df-407b-b419-33dcd82b50f6","name","deskday-office","createdAt",["D",1784853174535],"deletedAt","legacyEnvVars",false,"privacy","public","httpPrivacy","description","Deskday coworking attendance system.","imageUrl","userId","1c0af5f4-5486-4207-b370-2ccd83bc1dcf","pinnedFileId","37968216-86f7-11f1-ab95-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f90d7-9872-7518-b6a7-7f6420c76125","tursoName","88b1089d48df407bb41933dcd82b50f6","tursoHostname","88b1089d48df407bb41933dcd82b50f6-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789474853273],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_16":17,"_87":83},"org",{"_16":17,"_80":81,"_82":83,"_33":34,"_84":85,"_86":26},"branch",{"_68":69,"_20":70,"_18":71,"_72":19,"_73":-5,"_74":-5,"_75":-5,"_76":-5,"_77":-5,"_78":21,"_79":17},"isOwned","version",4,"main","ac350c9b-3d14-48d7-be4b-0821edb789ad","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","alshell 7","avatar","https://lh3.googleusercontent.com/a/ACg8ocIgzGkcs1h98if29Hwf_aAP4jTjWQLgwQAaxKmdWUK166qTecxnAw=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","path","","adoptOrgId",{"_18":19,"_20":21,"_22":179,"_24":-5,"_25":26,"_27":28,"_29":28,"_30":31,"_32":-5,"_33":34,"_35":36,"_37":38,"_39":-5,"_40":-5,"_41":42,"_43":44,"_45":46,"_47":48,"_49":180,"_51":-5,"_52":53,"_54":53,"_55":56,"_57":56,"_58":56,"_59":53,"_60":53,"_61":181,"_63":182,"_65":183,"_67":26},"tree",[162,163,164,165],[162,163,164,165],"counts",{"_152":42,"_153":134,"_154":42,"_155":156,"_157":158},"contents",[111,112,113,114],"file","upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_18":145,"_20":146,"_117":147,"_119":-5,"_120":71,"_121":148,"_123":38,"_22":149,"_68":42,"_125":100,"_126":150,"_128":26,"_129":-5,"_89":151},{"_18":138,"_20":139,"_117":36,"_119":-5,"_120":71,"_121":69,"_123":38,"_22":140,"_68":42,"_125":141,"_126":142,"_128":26,"_129":143,"_89":144},{"_18":131,"_20":132,"_117":133,"_119":-5,"_120":71,"_121":134,"_123":38,"_22":135,"_68":42,"_125":100,"_126":136,"_128":26,"_129":-5,"_89":137},{"_18":115,"_20":116,"_117":118,"_119":-5,"_120":71,"_121":122,"_123":38,"_22":124,"_68":42,"_125":100,"_126":127,"_128":26,"_129":-5,"_89":130},"54444841-317d-4bfc-958b-79e55a362fe0","ui.ts","fileId","37545134-86f7-11f1-9904-1607ee4eb77e","parentId","branchId","branchVersion",3,"latest",["D",1784853176831],"fileType","content","export function renderAppPage(nonce: string): string {\n return `\n\n\n \n \n \n \n Deskday — Coworking attendance\n \n\n\n

\n \n\n

Ready for today

Good to see you.

Enter your membership phone number and 4-digit PIN. One tap records today's attendance.

\n \n \n

iYour PIN is checked securely and is never stored in readable form. Five failed attempts temporarily pause access.

\n \n \n

\n\n \n\n

\n \n\n

Attendance

A clear view of today's desk.

\n \n

\n Month billable\n —\n Day passes + monthly packages\n

\n In today\n —\n members\n

\n Day-pass billable\n —\n this month\n

\n Monthly packages\n —\n this month\n

\n Amount due\n —\n after payments and prepaid credit\n

Office activity

\n Last 42 days\n

Attendance log

\n Loading…\n

\n \n \n \n

Member	Time	Plan	Terms	Billable	Due

\n\n \n\n

Billing

Invoice-ready member totals for the selected month.

\n \n

\n Total to invoice\n —\n Full monthly packages; no proration\n

\n Day passes\n —\n Attendance charges\n

\n Packages\n —\n Active during month\n

\n Amount due\n —\n Postpaid items\n

Invoice summary

—

\n \n \n \n

Member	Plan	Terms	Attendance	Billable	Due

\n\n \n

\n\n \n\n \n\n

\n\n \n\n`;\n}\n","deleted","label",[116],"e3ba90a0-a693-485c-8ba2-8e7e0b435999","migrations.ts","36c7f7ca-86f7-11f1-8b55-1607ee4eb77e",1,["D",1784853175921],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\ntype Migration = {\n version: number;\n name: string;\n statements: string[];\n};\n\n// Version 4 intentionally performs a clean reset. The product owner chose a\n// fresh database over backward compatibility for this final data model.\nconst migrations: Migration[] = [\n {\n version: 4,\n name: \"compact pin payments and attendance schema\",\n statements: [\n `DROP TABLE IF EXISTS invoices`,\n `DROP TABLE IF EXISTS attendance`,\n `DROP TABLE IF EXISTS monthly_charges`,\n `DROP TABLE IF EXISTS payments`,\n `DROP TABLE IF EXISTS member_plan_history`,\n `DROP TABLE IF EXISTS admin_sessions`,\n `DROP TABLE IF EXISTS audit_log`,\n `DROP TABLE IF EXISTS rate_limits`,\n `DROP TABLE IF EXISTS members`,\n `DROP TABLE IF EXISTS admins`,\n `DROP TABLE IF EXISTS app_settings`,\n `CREATE TABLE app_settings (\n key TEXT PRIMARY KEY,\n value TEXT NOT NULL,\n updated_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n `CREATE TABLE admins (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n identifier TEXT NOT NULL UNIQUE COLLATE NOCASE,\n password_salt TEXT NOT NULL,\n password_hash TEXT NOT NULL,\n password_iterations INTEGER NOT NULL,\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n last_login_at TEXT\n )`,\n `CREATE TABLE admin_sessions (\n token_hash TEXT PRIMARY KEY,\n admin_id INTEGER NOT NULL REFERENCES admins(id) ON DELETE CASCADE,\n csrf_token TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n `CREATE TABLE members (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT NOT NULL,\n phone TEXT NOT NULL UNIQUE,\n pin_salt TEXT NOT NULL,\n pin_hash TEXT NOT NULL,\n pin_iterations INTEGER NOT NULL,\n active INTEGER NOT NULL DEFAULT 1 CHECK (active IN (0, 1)),\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n updated_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n `CREATE TABLE member_plan_history (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n member_id INTEGER NOT NULL REFERENCES members(id) ON DELETE CASCADE,\n plan_type TEXT NOT NULL CHECK (plan_type IN ('day', 'monthly')),\n rate_cents INTEGER NOT NULL CHECK (rate_cents >= 0),\n payment_term TEXT NOT NULL CHECK (payment_term IN ('prepaid', 'postpaid')),\n effective_from TEXT NOT NULL,\n effective_to TEXT,\n CHECK (effective_to IS NULL OR effective_to >= effective_from)\n )`,\n `CREATE TABLE attendance (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n member_id INTEGER NOT NULL REFERENCES members(id) ON DELETE RESTRICT,\n attendance_date TEXT NOT NULL,\n punched_at TEXT NOT NULL,\n plan_type_snapshot TEXT NOT NULL CHECK (plan_type_snapshot IN ('day', 'monthly')),\n charge_cents INTEGER NOT NULL CHECK (charge_cents >= 0),\n payment_term_snapshot TEXT NOT NULL CHECK (payment_term_snapshot IN ('prepaid', 'postpaid')),\n source TEXT NOT NULL DEFAULT 'today' CHECK (source IN ('today', 'member_backfill')),\n UNIQUE (member_id, attendance_date)\n )`,\n `CREATE TABLE monthly_charges (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n member_id INTEGER NOT NULL REFERENCES members(id) ON DELETE RESTRICT,\n billing_month TEXT NOT NULL,\n rate_cents INTEGER NOT NULL CHECK (rate_cents >= 0),\n payment_term_snapshot TEXT NOT NULL CHECK (payment_term_snapshot IN ('prepaid', 'postpaid')),\n UNIQUE (member_id, billing_month)\n )`,\n `CREATE TABLE payments (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n member_id INTEGER NOT NULL REFERENCES members(id) ON DELETE RESTRICT,\n amount_cents INTEGER NOT NULL CHECK (amount_cents > 0),\n paid_on TEXT NOT NULL,\n allocation_type TEXT NOT NULL CHECK (allocation_type IN ('prepaid_credit', 'period_payment')),\n period_type TEXT CHECK (period_type IN ('day', 'month')),\n period_key TEXT,\n note TEXT,\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n CHECK (\n (allocation_type = 'prepaid_credit' AND period_type IS NULL AND period_key IS NULL)\n OR\n (allocation_type = 'period_payment' AND period_type IS NOT NULL AND period_key IS NOT NULL)\n )\n )`,\n `CREATE TABLE rate_limits (\n bucket_key TEXT NOT NULL,\n window_start INTEGER NOT NULL,\n attempts INTEGER NOT NULL DEFAULT 1,\n PRIMARY KEY (bucket_key, window_start)\n )`,\n `CREATE INDEX idx_attendance_date ON attendance(attendance_date)`,\n `CREATE INDEX idx_plan_history_dates\n ON member_plan_history(member_id, effective_from, effective_to)`,\n `CREATE INDEX idx_payments_member_period\n ON payments(member_id, allocation_type, period_key)`,\n `CREATE INDEX idx_sessions_expiry ON admin_sessions(expires_at)`,\n `INSERT INTO app_settings (key, value) VALUES\n ('day_price_cents', '15000'),\n ('monthly_price_cents', '450000'),\n ('currency', 'INR'),\n ('timezone', 'Asia/Kolkata'),\n ('office_name', 'Deskday Coworking')`,\n ],\n },\n {\n version: 5,\n name: \"admin recorded attendance source\",\n statements: [\n `CREATE TABLE attendance_v5 (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n member_id INTEGER NOT NULL REFERENCES members(id) ON DELETE RESTRICT,\n attendance_date TEXT NOT NULL,\n punched_at TEXT NOT NULL,\n plan_type_snapshot TEXT NOT NULL CHECK (plan_type_snapshot IN ('day', 'monthly')),\n charge_cents INTEGER NOT NULL CHECK (charge_cents >= 0),\n payment_term_snapshot TEXT NOT NULL CHECK (payment_term_snapshot IN ('prepaid', 'postpaid')),\n source TEXT NOT NULL DEFAULT 'today'\n CHECK (source IN ('today', 'member_backfill', 'admin')),\n UNIQUE (member_id, attendance_date)\n )`,\n `INSERT INTO attendance_v5\n (id, member_id, attendance_date, punched_at, plan_type_snapshot,\n charge_cents, payment_term_snapshot, source)\n SELECT id, member_id, attendance_date, punched_at, plan_type_snapshot,\n charge_cents, payment_term_snapshot, source\n FROM attendance`,\n `DROP TABLE attendance`,\n `ALTER TABLE attendance_v5 RENAME TO attendance`,\n `CREATE INDEX idx_attendance_date ON attendance(attendance_date)`,\n ],\n },\n];\n\nlet migrationPromise: Promise | undefined;\n\nexport function runMigrations(): Promise {\n migrationPromise ??= migrate();\n return migrationPromise;\n}\n\nasync function migrate(): Promise {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS schema_migrations (\n version INTEGER PRIMARY KEY,\n name TEXT NOT NULL,\n applied_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`);\n\n const applied = await sqlite.execute(\n \"SELECT version FROM schema_migrations ORDER BY version\",\n );\n const versions = new Set(applied.rows.map((row) => Number(row.version)));\n\n for (const migration of migrations) {\n if (versions.has(migration.version)) continue;\n await sqlite.batch([\n ...migration.statements.map((sql) => ({ sql, args: [] })),\n {\n sql: `INSERT INTO schema_migrations (version, name) VALUES (?, ?)`,\n args: [migration.version, migration.name],\n },\n ], \"write\");\n }\n}\n",[132],"fd8a5b41-499c-4820-a710-e69f51d8e9fa","main.ts",["D",1784853177273],"http","import { Hono } from \"npm:hono@4.7.2\";\nimport type { Context, Next } from \"npm:hono@4.7.2\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { runMigrations } from \"./migrations.ts\";\nimport { renderAppPage } from \"./ui.ts\";\nimport {\n generateInvoicePdf,\n getMemberBilling,\n invoiceNumber,\n materializeMonthlyCharges,\n type BillingPeriod,\n} from \"./billing.ts\";\n\ntype AdminSession = {\n adminId: number;\n identifier: string;\n csrfToken: string;\n};\n\ntype AppEnv = {\n Variables: {\n adminSession: AdminSession;\n };\n};\n\nclass ApiError extends Error {\n constructor(\n public status: number,\n public code: string,\n message: string,\n public details?: Record,\n ) {\n super(message);\n }\n}\n\nconst app = new Hono();\nconst SESSION_COOKIE = \"deskday_session\";\nconst SESSION_HOURS = 12;\nconst ADMIN_IDENTIFIER = \"admin@office\";\nconst PASSWORD_ITERATIONS = 310_000;\nconst PIN_ITERATIONS = 120_000;\n\napp.use(\"*\", async (c, next) => {\n await runMigrations();\n await next();\n c.header(\"Cache-Control\", \"no-store\");\n c.header(\"X-Content-Type-Options\", \"nosniff\");\n c.header(\"Referrer-Policy\", \"same-origin\");\n c.header(\"Permissions-Policy\", \"camera=(), microphone=(), geolocation=()\");\n c.header(\"X-Frame-Options\", \"DENY\");\n});\n\napp.onError((error, c) => {\n if (error instanceof ApiError) {\n return c.json(\n {\n ok: false,\n error: {\n code: error.code,\n message: error.message,\n details: error.details,\n },\n },\n error.status as 400,\n );\n }\n\n console.error(\"Unhandled request error\", error);\n return c.json(\n {\n ok: false,\n error: {\n code: \"INTERNAL_ERROR\",\n message: \"Something went wrong. Please try again.\",\n },\n },\n 500,\n );\n});\n\napp.post(\"/api/system/reset-database\", async (c) => {\n const configuredToken = Deno.env.get(\"RESET_TOKEN\") || \"\";\n const suppliedToken = c.req.header(\"Authorization\")?.replace(/^Bearer\\s+/i, \"\") ||\n \"\";\n if (\n !configuredToken ||\n !suppliedToken ||\n !timingSafeEqual(configuredToken, suppliedToken) ||\n c.req.header(\"X-Reset-Confirmation\") !== \"RESET DESKDAY\"\n ) {\n throw new ApiError(403, \"RESET_REJECTED\", \"Database reset rejected.\");\n }\n await sqlite.batch([\n { sql: \"DELETE FROM attendance\", args: [] },\n { sql: \"DELETE FROM monthly_charges\", args: [] },\n { sql: \"DELETE FROM payments\", args: [] },\n { sql: \"DELETE FROM member_plan_history\", args: [] },\n { sql: \"DELETE FROM admin_sessions\", args: [] },\n { sql: \"DELETE FROM rate_limits\", args: [] },\n { sql: \"DELETE FROM members\", args: [] },\n { sql: \"DELETE FROM admins\", args: [] },\n { sql: \"DELETE FROM app_settings\", args: [] },\n {\n sql: `INSERT INTO app_settings (key, value) VALUES\n ('day_price_cents', '15000'),\n ('monthly_price_cents', '450000'),\n ('currency', 'INR'),\n ('timezone', 'Asia/Kolkata'),\n ('office_name', 'Deskday Coworking')`,\n args: [],\n },\n {\n sql: `DELETE FROM sqlite_sequence\n WHERE name IN (\n 'attendance', 'monthly_charges', 'payments', 'member_plan_history',\n 'members', 'admins'\n )`,\n args: [],\n },\n ], \"write\");\n return c.json({ ok: true, reset: true });\n});\n\napp.get(\"/api/bootstrap\", async (c) => {\n const adminCount = await scalar(\n \"SELECT COUNT(*) AS count FROM admins\",\n [],\n \"count\",\n );\n const settings = await getSettings();\n const license = getLicense(settings.timezone);\n const session = await getAdminSession(c.req.raw);\n\n return c.json({\n ok: true,\n needsSetup: adminCount === 0,\n setupReady: Boolean(Deno.env.get(\"SETUP_TOKEN\")),\n license,\n admin: session\n ? {\n identifier: session.identifier,\n csrfToken: session.csrfToken,\n }\n : null,\n publicSettings: {\n currency: settings.currency,\n timezone: settings.timezone,\n officeName: settings.officeName,\n },\n });\n});\n\napp.post(\"/api/admin/setup\", async (c) => {\n assertSameOrigin(c.req.raw);\n await enforceRateLimit(c.req.raw, \"admin-setup\", 5, 15 * 60);\n\n const existing = await scalar(\n \"SELECT COUNT(*) AS count FROM admins\",\n [],\n \"count\",\n );\n if (existing > 0) {\n throw new ApiError(409, \"SETUP_COMPLETE\", \"Admin setup is already complete.\");\n }\n\n const configuredToken = Deno.env.get(\"SETUP_TOKEN\");\n if (!configuredToken) {\n throw new ApiError(\n 503,\n \"SETUP_TOKEN_MISSING\",\n \"Add a SETUP_TOKEN environment variable in Val Town, then redeploy.\",\n );\n }\n\n const body = await readJson(c);\n assertLicenseActive((await getSettings()).timezone);\n const suppliedToken = requiredString(body.setupToken, \"Setup token\", 256);\n const password = validatePassword(body.password);\n\n if (!timingSafeEqual(suppliedToken, configuredToken)) {\n throw new ApiError(403, \"SETUP_TOKEN_INVALID\", \"The setup token is not valid.\");\n }\n\n const salt = randomToken(18);\n const passwordHash = await derivePasswordHash(\n password,\n salt,\n PASSWORD_ITERATIONS,\n );\n\n try {\n const result = await sqlite.execute({\n sql: `INSERT INTO admins\n (identifier, password_salt, password_hash, password_iterations)\n VALUES (?, ?, ?, ?)\n RETURNING id`,\n args: [\n ADMIN_IDENTIFIER,\n salt,\n passwordHash,\n PASSWORD_ITERATIONS,\n ],\n });\n const adminId = Number(result.rows[0].id);\n const session = await createSession(adminId);\n setSessionCookie(c, session.rawToken);\n return c.json({\n ok: true,\n admin: {\n identifier: ADMIN_IDENTIFIER,\n csrfToken: session.csrfToken,\n },\n }, 201);\n } catch (error) {\n if (String(error).toLowerCase().includes(\"unique\")) {\n throw new ApiError(\n 409,\n \"SETUP_COMPLETE\",\n \"Admin setup was completed by another request.\",\n );\n }\n throw error;\n }\n});\n\napp.post(\"/api/admin/login\", async (c) => {\n assertSameOrigin(c.req.raw);\n await enforceRateLimit(c.req.raw, \"admin-login\", 5, 15 * 60);\n\n const body = await readJson(c);\n const identifier = requiredString(body.identifier, \"Identifier\", 100)\n .toLowerCase();\n const password = requiredString(body.password, \"Password\", 200);\n\n const result = await sqlite.execute({\n sql: `SELECT id, identifier, password_salt, password_hash, password_iterations\n FROM admins WHERE identifier = ? COLLATE NOCASE LIMIT 1`,\n args: [identifier],\n });\n const row = result.rows[0];\n\n const fallbackSalt = \"Rgvf8SkM5stTKeSxFo2M7EFx\";\n const actualHash = row\n ? await derivePasswordHash(\n password,\n String(row.password_salt),\n Number(row.password_iterations),\n )\n : await derivePasswordHash(\n password,\n fallbackSalt,\n PASSWORD_ITERATIONS,\n );\n\n if (\n !row ||\n !timingSafeEqual(actualHash, String(row.password_hash))\n ) {\n throw new ApiError(\n 401,\n \"LOGIN_FAILED\",\n \"The identifier or password is incorrect.\",\n );\n }\n\n const adminId = Number(row.id);\n await sqlite.execute({\n sql: \"UPDATE admins SET last_login_at = datetime('now') WHERE id = ?\",\n args: [adminId],\n });\n const session = await createSession(adminId);\n setSessionCookie(c, session.rawToken);\n\n return c.json({\n ok: true,\n admin: {\n identifier: String(row.identifier),\n csrfToken: session.csrfToken,\n },\n });\n});\n\napp.post(\"/api/punch\", async (c) => {\n assertSameOrigin(c.req.raw);\n const body = await readJson(c);\n const phone = normalizeIndianPhone(body.phone);\n const pin = validatePin(body.pin);\n await enforceRateLimit(c.req.raw, `member:${phone}`, 5, 15 * 60);\n const settings = await getSettings();\n assertLicenseActive(settings.timezone);\n const date = officeDate(settings.timezone);\n const member = await authenticateMember(phone, pin, date);\n const punch = await recordAttendance(member, date, \"today\");\n await materializeMonthlyCharges(Number(member.id), date.slice(0, 7));\n\n return c.json({\n ok: true,\n punch: { ...punch, currency: settings.currency },\n }, 201);\n});\n\napp.post(\"/api/member/history\", async (c) => {\n assertSameOrigin(c.req.raw);\n const body = await readJson(c);\n const phone = normalizeIndianPhone(body.phone);\n const pin = validatePin(body.pin);\n await enforceRateLimit(c.req.raw, `member:${phone}`, 5, 15 * 60);\n const settings = await getSettings();\n const today = officeDate(settings.timezone);\n const month = validateMonth(\n typeof body.month === \"string\"\n ? body.month\n : today.slice(0, 7),\n );\n const member = await authenticateMember(phone, pin, today, false, false);\n const billing = await getMemberBilling(Number(member.id), \"month\", month);\n return c.json({\n ok: true,\n billing,\n currency: settings.currency,\n timezone: settings.timezone,\n officeName: settings.officeName,\n backfill: {\n allowed: Number(member.active) === 1 && String(member.plan_type) === \"day\",\n earliestDate: addDays(today, -30),\n latestDate: addDays(today, -1),\n },\n });\n});\n\napp.post(\"/api/member/backfill\", async (c) => {\n assertSameOrigin(c.req.raw);\n const body = await readJson(c);\n const phone = normalizeIndianPhone(body.phone);\n const pin = validatePin(body.pin);\n await enforceRateLimit(c.req.raw, `member:${phone}`, 5, 15 * 60);\n const settings = await getSettings();\n assertLicenseActive(settings.timezone);\n const today = officeDate(settings.timezone);\n const date = validateDate(requiredString(body.date, \"Attendance date\", 10));\n if (date >= today || date < addDays(today, -30)) {\n throw new ApiError(\n 400,\n \"BACKFILL_RANGE\",\n \"Choose a previous date from the last 30 days.\",\n );\n }\n const member = await authenticateMember(phone, pin, date, true, true, true);\n if (String(member.plan_type) !== \"day\") {\n throw new ApiError(\n 403,\n \"DAY_PASS_ONLY\",\n \"Previous-day entries are available only to day-pass members.\",\n );\n }\n const punch = await recordAttendance(member, date, \"member_backfill\");\n return c.json({\n ok: true,\n punch: { ...punch, currency: settings.currency },\n }, 201);\n});\n\napp.use(\"/api/admin/*\", requireAdmin);\n\napp.post(\"/api/admin/logout\", async (c) => {\n assertCsrf(c);\n const rawToken = getCookie(c.req.raw, SESSION_COOKIE);\n if (rawToken) {\n await sqlite.execute({\n sql: \"DELETE FROM admin_sessions WHERE token_hash = ?\",\n args: [await sha256(rawToken)],\n });\n }\n clearSessionCookie(c);\n return c.json({ ok: true });\n});\n\napp.use(\"/api/admin/*\", requireActiveLicense);\n\napp.get(\"/api/admin/members\", async (c) => {\n const result = await sqlite.execute(\n `SELECT\n m.id,\n m.name,\n m.phone,\n m.active,\n m.created_at,\n ph.plan_type,\n ph.rate_cents,\n ph.payment_term,\n ph.effective_from\n FROM members m\n LEFT JOIN member_plan_history ph ON ph.id = (\n SELECT id FROM member_plan_history\n WHERE member_id = m.id\n ORDER BY effective_from DESC, id DESC\n LIMIT 1\n )\n ORDER BY m.active DESC, m.name COLLATE NOCASE`,\n );\n return c.json({ ok: true, members: result.rows.map(memberRow) });\n});\n\napp.post(\"/api/admin/members\", async (c) => {\n assertCsrf(c);\n const body = await readJson(c);\n const name = requiredString(body.name, \"Name\", 100);\n const phone = normalizeIndianPhone(body.phone);\n const pin = validatePin(body.pin);\n const planType = validatePlan(body.planType);\n const paymentTerm = validatePaymentTerm(body.paymentTerm);\n const settings = await getSettings();\n const date = officeDate(settings.timezone);\n const rateCents = typeof body.rate === \"string\"\n ? parseMoney(body.rate, \"Member price\")\n : planType === \"day\"\n ? settings.dayPriceCents\n : settings.monthlyPriceCents;\n const prepaidAmountCents = paymentTerm === \"prepaid\" &&\n typeof body.prepaidAmount === \"string\" && body.prepaidAmount.trim()\n ? parseMoney(body.prepaidAmount, \"Opening prepaid amount\")\n : 0;\n const pinSalt = randomToken(18);\n const pinHash = await derivePasswordHash(pin, pinSalt, PIN_ITERATIONS);\n\n try {\n await assertPhoneAvailable(phone);\n const statements: Array<{ sql: string; args: Array }> = [\n {\n sql: `INSERT INTO members\n (name, phone, pin_salt, pin_hash, pin_iterations)\n VALUES (?, ?, ?, ?, ?)`,\n args: [name, phone, pinSalt, pinHash, PIN_ITERATIONS],\n },\n {\n sql: `INSERT INTO member_plan_history\n (member_id, plan_type, rate_cents, payment_term, effective_from)\n VALUES (last_insert_rowid(), ?, ?, ?, ?)`,\n args: [planType, rateCents, paymentTerm, date],\n },\n ];\n if (prepaidAmountCents > 0) {\n statements.push({\n sql: `INSERT INTO payments\n (member_id, amount_cents, paid_on, allocation_type, note)\n VALUES (\n (SELECT id FROM members WHERE phone = ?),\n ?, ?, 'prepaid_credit', 'Opening balance'\n )`,\n args: [phone, prepaidAmountCents, date],\n });\n }\n await sqlite.batch(statements, \"write\");\n const inserted = await sqlite.execute({\n sql: \"SELECT id FROM members WHERE phone = ? LIMIT 1\",\n args: [phone],\n });\n const memberId = Number(inserted.rows[0].id);\n return c.json({\n ok: true,\n member: {\n id: memberId,\n name,\n phone,\n active: true,\n planType,\n rateCents,\n paymentTerm,\n prepaidAmountCents,\n effectiveFrom: date,\n },\n }, 201);\n } catch (error) {\n if (String(error).toLowerCase().includes(\"unique\")) {\n throw new ApiError(\n 409,\n \"PHONE_EXISTS\",\n \"A member with this phone number already exists.\",\n );\n }\n throw error;\n }\n});\n\napp.patch(\"/api/admin/members/:id\", async (c) => {\n assertCsrf(c);\n const memberId = positiveId(c.req.param(\"id\"));\n const body = await readJson(c);\n const name = requiredString(body.name, \"Name\", 100);\n const phone = normalizeIndianPhone(body.phone);\n const newPin = typeof body.pin === \"string\" && body.pin.trim()\n ? validatePin(body.pin)\n : null;\n const planType = validatePlan(body.planType);\n const paymentTerm = validatePaymentTerm(body.paymentTerm);\n const active = Boolean(body.active);\n const settings = await getSettings();\n const date = officeDate(settings.timezone);\n const yesterday = addDays(date, -1);\n\n const currentResult = await sqlite.execute({\n sql: `SELECT\n m.id,\n m.active,\n ph.id AS plan_id,\n ph.plan_type,\n ph.rate_cents,\n ph.payment_term,\n ph.effective_from,\n ph.effective_to\n FROM members m\n LEFT JOIN member_plan_history ph ON ph.id = (\n SELECT id FROM member_plan_history\n WHERE member_id = m.id\n ORDER BY effective_from DESC, id DESC\n LIMIT 1\n )\n WHERE m.id = ? LIMIT 1`,\n args: [memberId],\n });\n const current = currentResult.rows[0];\n if (!current) {\n throw new ApiError(404, \"MEMBER_NOT_FOUND\", \"Member not found.\");\n }\n\n try {\n await assertPhoneAvailable(phone, memberId);\n if (newPin) {\n const pinSalt = randomToken(18);\n const pinHash = await derivePasswordHash(newPin, pinSalt, PIN_ITERATIONS);\n await sqlite.execute({\n sql: `UPDATE members\n SET name = ?, phone = ?, active = ?, pin_salt = ?, pin_hash = ?,\n pin_iterations = ?, updated_at = datetime('now')\n WHERE id = ?`,\n args: [\n name,\n phone,\n active ? 1 : 0,\n pinSalt,\n pinHash,\n PIN_ITERATIONS,\n memberId,\n ],\n });\n } else {\n await sqlite.execute({\n sql: `UPDATE members\n SET name = ?, phone = ?, active = ?, updated_at = datetime('now')\n WHERE id = ?`,\n args: [name, phone, active ? 1 : 0, memberId],\n });\n }\n } catch (error) {\n if (String(error).toLowerCase().includes(\"unique\")) {\n throw new ApiError(\n 409,\n \"PHONE_EXISTS\",\n \"A member with this phone number already exists.\",\n );\n }\n throw error;\n }\n\n const wasActive = Number(current.active) === 1;\n const currentPlanId = current.plan_id ? Number(current.plan_id) : null;\n const currentPlan = current.plan_type ? String(current.plan_type) : null;\n const rateCents = typeof body.rate === \"string\"\n ? parseMoney(body.rate, \"Member price\")\n : Number(current.rate_cents ?? (\n planType === \"day\"\n ? settings.dayPriceCents\n : settings.monthlyPriceCents\n ));\n const configChanged = currentPlan !== planType ||\n Number(current.rate_cents) !== rateCents ||\n String(current.payment_term) !== paymentTerm;\n\n if (!active && wasActive && currentPlanId) {\n await sqlite.execute({\n sql: \"UPDATE member_plan_history SET effective_to = ? WHERE id = ?\",\n args: [date, currentPlanId],\n });\n } else if (active && !wasActive) {\n await sqlite.execute({\n sql: `INSERT INTO member_plan_history\n (member_id, plan_type, rate_cents, payment_term, effective_from)\n VALUES (?, ?, ?, ?, ?)`,\n args: [memberId, planType, rateCents, paymentTerm, date],\n });\n } else if (active && configChanged) {\n if (String(current.effective_from) === date && currentPlanId) {\n await sqlite.execute({\n sql: `UPDATE member_plan_history\n SET plan_type = ?, rate_cents = ?, payment_term = ?,\n effective_to = NULL\n WHERE id = ?`,\n args: [planType, rateCents, paymentTerm, currentPlanId],\n });\n } else {\n if (currentPlanId && current.effective_to === null) {\n await sqlite.execute({\n sql: \"UPDATE member_plan_history SET effective_to = ? WHERE id = ?\",\n args: [yesterday, currentPlanId],\n });\n }\n await sqlite.execute({\n sql: `INSERT INTO member_plan_history\n (member_id, plan_type, rate_cents, payment_term, effective_from)\n VALUES (?, ?, ?, ?, ?)`,\n args: [memberId, planType, rateCents, paymentTerm, date],\n });\n }\n }\n if (configChanged || active !== wasActive) {\n await sqlite.execute({\n sql: `DELETE FROM monthly_charges\n WHERE member_id = ? AND billing_month >= ?`,\n args: [memberId, date.slice(0, 7)],\n });\n }\n\n return c.json({ ok: true });\n});\n\napp.get(\"/api/admin/members/:id/history\", async (c) => {\n const memberId = positiveId(c.req.param(\"id\"));\n const settings = await getSettings();\n const month = validateMonth(\n c.req.query(\"month\") ||\n officeDate(settings.timezone).slice(0, 7),\n );\n const billing = await getMemberBilling(memberId, \"month\", month);\n if (!billing) {\n throw new ApiError(404, \"MEMBER_NOT_FOUND\", \"Member not found.\");\n }\n return c.json({\n ok: true,\n billing,\n currency: settings.currency,\n timezone: settings.timezone,\n });\n});\n\napp.post(\"/api/admin/attendance\", async (c) => {\n assertCsrf(c);\n const body = await readJson(c);\n const memberId = positiveId(String(body.memberId ?? \"\"));\n const settings = await getSettings();\n const today = officeDate(settings.timezone);\n const date = validateDate(requiredString(body.date, \"Attendance date\", 10));\n if (date > today) {\n throw new ApiError(\n 400,\n \"FUTURE_ATTENDANCE\",\n \"Attendance cannot be added for a future date.\",\n );\n }\n const identityResult = await sqlite.execute({\n sql: \"SELECT id, name FROM members WHERE id = ? LIMIT 1\",\n args: [memberId],\n });\n const identity = identityResult.rows[0];\n const plan = identity\n ? await resolveAttendancePlan(memberId, date, true)\n : null;\n const member = identity && plan ? { ...identity, ...plan } : null;\n if (!member) {\n throw new ApiError(\n 404,\n \"MEMBER_PLAN_NOT_FOUND\",\n identity\n ? \"Only day-pass members can use their current rate for dates before their plan began.\"\n : \"Member not found.\",\n );\n }\n const punch = await recordAttendance(member, date, \"admin\");\n await materializeMonthlyCharges(memberId, date.slice(0, 7));\n return c.json({\n ok: true,\n punch: { ...punch, currency: settings.currency },\n }, 201);\n});\n\napp.post(\"/api/admin/payments\", async (c) => {\n assertCsrf(c);\n const body = await readJson(c);\n const memberId = positiveId(String(body.memberId ?? \"\"));\n const amountCents = parseMoney(body.amount, \"Payment amount\");\n if (amountCents <= 0) {\n throw new ApiError(400, \"INVALID_PRICE\", \"Payment amount must be above zero.\");\n }\n const periodType = body.periodType === \"day\" ? \"day\" : \"month\";\n const periodKey = periodType === \"day\"\n ? validateDate(requiredString(body.periodKey, \"Payment period\", 10))\n : validateMonth(requiredString(body.periodKey, \"Payment period\", 7));\n const settings = await getSettings();\n const paidOn = officeDate(settings.timezone);\n const memberResult = await sqlite.execute({\n sql: `SELECT ph.payment_term\n FROM members m\n JOIN member_plan_history ph ON ph.id = (\n SELECT id FROM member_plan_history\n WHERE member_id = m.id\n ORDER BY effective_from DESC, id DESC LIMIT 1\n )\n WHERE m.id = ? LIMIT 1`,\n args: [memberId],\n });\n const member = memberResult.rows[0];\n if (!member) {\n throw new ApiError(404, \"MEMBER_NOT_FOUND\", \"Member not found.\");\n }\n const prepaid = String(member.payment_term) === \"prepaid\";\n await sqlite.execute({\n sql: `INSERT INTO payments (\n member_id, amount_cents, paid_on, allocation_type,\n period_type, period_key, note\n ) VALUES (?, ?, ?, ?, ?, ?, ?)`,\n args: prepaid\n ? [\n memberId,\n amountCents,\n paidOn,\n \"prepaid_credit\",\n null,\n null,\n \"Prepaid credit\",\n ]\n : [\n memberId,\n amountCents,\n paidOn,\n \"period_payment\",\n periodType,\n periodKey,\n \"Payment received\",\n ],\n });\n const billing = await getMemberBilling(memberId, periodType, periodKey);\n return c.json({ ok: true, billing }, 201);\n});\n\napp.get(\"/api/admin/invoice\", async (c) => {\n const memberId = positiveId(c.req.query(\"memberId\") || \"\");\n const periodType = c.req.query(\"period\") as BillingPeriod;\n if (periodType !== \"day\" && periodType !== \"month\") {\n throw new ApiError(\n 400,\n \"INVALID_PERIOD\",\n \"Choose a day or month invoice.\",\n );\n }\n const rawPeriod = periodType === \"day\"\n ? c.req.query(\"date\") || \"\"\n : c.req.query(\"month\") || \"\";\n const periodKey = periodType === \"day\"\n ? validateDate(rawPeriod)\n : validateMonth(rawPeriod);\n const billing = await getMemberBilling(memberId, periodType, periodKey);\n if (!billing) {\n throw new ApiError(404, \"MEMBER_NOT_FOUND\", \"Member not found.\");\n }\n\n const settings = await getSettings();\n const number = invoiceNumber(billing);\n\n const pdf = generateInvoicePdf(\n billing,\n settings.officeName,\n officeDate(settings.timezone),\n );\n return new Response(pdf, {\n headers: {\n \"Content-Type\": \"application/pdf\",\n \"Content-Disposition\": `attachment; filename=\"${number}.pdf\"`,\n \"Cache-Control\": \"no-store\",\n },\n });\n});\n\napp.put(\"/api/admin/settings\", async (c) => {\n assertCsrf(c);\n const body = await readJson(c);\n const dayPriceCents = parseMoney(body.dayPrice, \"Day-pass price\");\n const monthlyPriceCents = parseMoney(\n body.monthlyPrice,\n \"Monthly package price\",\n );\n const currency = \"INR\";\n const officeName = requiredString(body.officeName, \"Office name\", 80);\n const timezone = requiredString(body.timezone, \"Timezone\", 80);\n try {\n new Intl.DateTimeFormat(\"en\", { timeZone: timezone }).format();\n } catch {\n throw new ApiError(400, \"INVALID_TIMEZONE\", \"Enter a valid IANA timezone.\");\n }\n\n const values: Array<[string, string]> = [\n [\"day_price_cents\", String(dayPriceCents)],\n [\"monthly_price_cents\", String(monthlyPriceCents)],\n [\"currency\", currency],\n [\"timezone\", timezone],\n [\"office_name\", officeName],\n ];\n for (const [key, value] of values) {\n await sqlite.execute({\n sql: `INSERT INTO app_settings (key, value, updated_at)\n VALUES (?, ?, datetime('now'))\n ON CONFLICT(key) DO UPDATE SET\n value = excluded.value,\n updated_at = datetime('now')`,\n args: [key, value],\n });\n }\n\n return c.json({\n ok: true,\n settings: {\n dayPriceCents,\n monthlyPriceCents,\n currency,\n timezone,\n officeName,\n },\n });\n});\n\napp.get(\"/api/admin/dashboard\", async (c) => {\n const settings = await getSettings();\n const defaultDate = officeDate(settings.timezone);\n const date = validateDate(c.req.query(\"date\") || defaultDate);\n const month = validateMonth(c.req.query(\"month\") || date.slice(0, 7));\n const memberQuery = (c.req.query(\"member\") || \"\").trim().slice(0, 100);\n const planQuery = c.req.query(\"plan\") || \"all\";\n if (![\"all\", \"day\", \"monthly\"].includes(planQuery)) {\n throw new ApiError(400, \"INVALID_PLAN\", \"Invalid plan filter.\");\n }\n\n const monthStart = `${month}-01`;\n const monthEnd = endOfMonth(month);\n const attendanceArgs: Array = [date];\n let attendanceWhere = \"a.attendance_date = ?\";\n if (memberQuery) {\n attendanceWhere += \" AND (m.name LIKE ? OR m.phone LIKE ?)\";\n attendanceArgs.push(`%${memberQuery}%`, `%${memberQuery.replace(/\\D/g, \"\")}%`);\n }\n if (planQuery !== \"all\") {\n attendanceWhere += \" AND a.plan_type_snapshot = ?\";\n attendanceArgs.push(planQuery);\n }\n\n const attendanceResult = await sqlite.execute({\n sql: `SELECT\n a.id,\n a.attendance_date,\n a.punched_at,\n a.plan_type_snapshot,\n a.charge_cents,\n a.payment_term_snapshot,\n a.source,\n m.id AS member_id,\n m.name,\n m.phone\n FROM attendance a\n JOIN members m ON m.id = a.member_id\n WHERE ${attendanceWhere}\n ORDER BY a.punched_at DESC`,\n args: attendanceArgs,\n });\n\n const dailyResult = await sqlite.execute({\n sql: `SELECT\n COUNT(*) AS people,\n COALESCE(SUM(charge_cents), 0) AS total_cents,\n COALESCE(SUM(CASE\n WHEN payment_term_snapshot = 'postpaid' THEN charge_cents\n ELSE 0\n END), 0) AS due_cents\n FROM attendance WHERE attendance_date = ?`,\n args: [date],\n });\n const monthlyDayResult = await sqlite.execute({\n sql: `SELECT\n COUNT(*) AS punches,\n COUNT(DISTINCT member_id) AS members,\n COALESCE(SUM(charge_cents), 0) AS total_cents,\n COALESCE(SUM(CASE\n WHEN payment_term_snapshot = 'postpaid' THEN charge_cents\n ELSE 0\n END), 0) AS due_cents\n FROM attendance\n WHERE attendance_date BETWEEN ? AND ?\n AND plan_type_snapshot = 'day'`,\n args: [monthStart, monthEnd],\n });\n const billingMembersResult = await sqlite.execute(\n \"SELECT id FROM members ORDER BY name COLLATE NOCASE\",\n );\n const planCountResult = await sqlite.execute(\n `SELECT\n SUM(CASE WHEN latest.plan_type = 'day' AND m.active = 1 THEN 1 ELSE 0 END) AS day_count,\n SUM(CASE WHEN latest.plan_type = 'monthly' AND m.active = 1 THEN 1 ELSE 0 END) AS monthly_count\n FROM members m\n LEFT JOIN member_plan_history latest ON latest.id = (\n SELECT id FROM member_plan_history\n WHERE member_id = m.id\n ORDER BY effective_from DESC, id DESC\n LIMIT 1\n )`,\n );\n const activityResult = await sqlite.execute({\n sql: `SELECT attendance_date, COUNT(*) AS people\n FROM attendance\n WHERE attendance_date BETWEEN ? AND ?\n GROUP BY attendance_date\n ORDER BY attendance_date`,\n args: [addDays(date, -41), date],\n });\n\n const billings = (await Promise.all(\n billingMembersResult.rows.map((row) =>\n getMemberBilling(Number(row.id), \"month\", month)\n ),\n )).filter((billing) =>\n billing && (\n billing.amountCents > 0 ||\n billing.paymentsCents > 0 ||\n billing.attendanceCount > 0\n )\n );\n const invoices = billings.map((billing) => ({\n memberId: billing!.member.id,\n name: billing!.member.name,\n phone: billing!.member.phone,\n planType: billing!.planType,\n amountCents: billing!.amountCents,\n paymentsCents: billing!.paymentsCents,\n dueCents: billing!.dueCents,\n prepaidBalanceCents: billing!.prepaidBalanceCents,\n paymentTerm: billing!.paymentTerm,\n attendanceCount: billing!.attendanceCount,\n }));\n const dayTotal = Number(monthlyDayResult.rows[0]?.total_cents ?? 0);\n const packageTotal = billings.reduce(\n (sum, billing) =>\n sum + billing!.lines.filter((line) =>\n line.description.startsWith(\"Monthly\")\n ).reduce((lineSum, line) => lineSum + line.amountCents, 0),\n 0,\n );\n const monthDue = invoices.reduce((sum, line) => sum + line.dueCents, 0);\n const todayMemberIds = [\n ...new Set(attendanceResult.rows.map((row) => Number(row.member_id))),\n ];\n const dayBillings = (await Promise.all(\n todayMemberIds.map((id) => getMemberBilling(id, \"day\", date)),\n )).filter(Boolean);\n const dailyDueCents = dayBillings.reduce(\n (sum, billing) => sum + (billing?.dueCents ?? 0),\n 0,\n );\n const dayBillingByMember = new Map(\n dayBillings.map((billing) => [\n billing!.member.id,\n billing!,\n ]),\n );\n\n return c.json({\n ok: true,\n context: { date, month, today: defaultDate },\n settings,\n summary: {\n dailyPeople: Number(dailyResult.rows[0]?.people ?? 0),\n dailyBillableCents: Number(dailyResult.rows[0]?.total_cents ?? 0),\n dailyDueCents,\n monthDayPassCents: dayTotal,\n monthPackageCents: packageTotal,\n monthTotalCents: dayTotal + packageTotal,\n monthDueCents: monthDue,\n monthDayPunches: Number(monthlyDayResult.rows[0]?.punches ?? 0),\n dayMembers: Number(planCountResult.rows[0]?.day_count ?? 0),\n monthlyMembers: Number(planCountResult.rows[0]?.monthly_count ?? 0),\n },\n attendance: attendanceResult.rows.map((row) => ({\n id: Number(row.id),\n date: String(row.attendance_date),\n punchedAt: String(row.punched_at),\n planType: String(row.plan_type_snapshot),\n chargeCents: Number(row.charge_cents),\n dueCents: dayBillingByMember.get(Number(row.member_id))?.dueCents ?? 0,\n paymentTerm: String(row.payment_term_snapshot),\n source: String(row.source),\n member: {\n id: Number(row.member_id),\n name: String(row.name),\n phone: String(row.phone),\n },\n })),\n activity: activityResult.rows.map((row) => ({\n date: String(row.attendance_date),\n people: Number(row.people),\n })),\n invoices,\n });\n});\n\napp.get(\"/\", (c) => {\n const nonce = randomToken(18);\n c.header(\n \"Content-Security-Policy\",\n [\n \"default-src 'self'\",\n `script-src 'nonce-${nonce}'`,\n `style-src 'nonce-${nonce}'`,\n \"img-src 'self' data:\",\n \"font-src 'self'\",\n \"connect-src 'self'\",\n \"base-uri 'none'\",\n \"form-action 'self'\",\n \"frame-ancestors 'none'\",\n ].join(\"; \"),\n );\n return c.html(renderAppPage(nonce));\n});\n\napp.notFound((c) => {\n if (c.req.path.startsWith(\"/api/\")) {\n return c.json({\n ok: false,\n error: { code: \"NOT_FOUND\", message: \"Endpoint not found.\" },\n }, 404);\n }\n return c.redirect(\"/\");\n});\n\nasync function requireAdmin(c: Context, next: Next) {\n const session = await getAdminSession(c.req.raw);\n if (!session) {\n throw new ApiError(401, \"ADMIN_REQUIRED\", \"Please sign in as an admin.\");\n }\n c.set(\"adminSession\", session);\n await next();\n}\n\nasync function requireActiveLicense(_c: Context, next: Next) {\n const settings = await getSettings();\n assertLicenseActive(settings.timezone);\n await next();\n}\n\nfunction assertCsrf(c: Context) {\n assertSameOrigin(c.req.raw);\n const supplied = c.req.header(\"X-CSRF-Token\") || \"\";\n const expected = c.get(\"adminSession\").csrfToken;\n if (!supplied || !timingSafeEqual(supplied, expected)) {\n throw new ApiError(403, \"CSRF_FAILED\", \"Please refresh and try again.\");\n }\n}\n\nfunction assertSameOrigin(request: Request) {\n const origin = request.headers.get(\"Origin\");\n if (origin && origin !== new URL(request.url).origin) {\n throw new ApiError(403, \"ORIGIN_REJECTED\", \"Cross-origin request rejected.\");\n }\n}\n\nasync function getAdminSession(\n request: Request,\n): Promise {\n const rawToken = getCookie(request, SESSION_COOKIE);\n if (!rawToken) return null;\n const tokenHash = await sha256(rawToken);\n const result = await sqlite.execute({\n sql: `SELECT\n s.admin_id,\n s.csrf_token,\n a.identifier\n FROM admin_sessions s\n JOIN admins a ON a.id = s.admin_id\n WHERE s.token_hash = ? AND datetime(s.expires_at) > datetime('now')\n LIMIT 1`,\n args: [tokenHash],\n });\n const row = result.rows[0];\n if (!row) return null;\n return {\n adminId: Number(row.admin_id),\n identifier: String(row.identifier),\n csrfToken: String(row.csrf_token),\n };\n}\n\nasync function createSession(adminId: number) {\n const rawToken = randomToken(32);\n const csrfToken = randomToken(24);\n const tokenHash = await sha256(rawToken);\n const expiresAt = new Date(\n Date.now() + SESSION_HOURS * 60 * 60 * 1000,\n ).toISOString();\n\n await sqlite.execute({\n sql: `INSERT INTO admin_sessions\n (token_hash, admin_id, csrf_token, expires_at)\n VALUES (?, ?, ?, ?)`,\n args: [tokenHash, adminId, csrfToken, expiresAt],\n });\n if (Math.random() < 0.05) {\n await sqlite.execute(\n \"DELETE FROM admin_sessions WHERE datetime(expires_at) <= datetime('now')\",\n );\n }\n return { rawToken, csrfToken };\n}\n\nfunction setSessionCookie(c: Context, rawToken: string) {\n c.header(\n \"Set-Cookie\",\n `${SESSION_COOKIE}=${rawToken}; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=${\n SESSION_HOURS * 60 * 60\n }`,\n );\n}\n\nfunction clearSessionCookie(c: Context) {\n c.header(\n \"Set-Cookie\",\n `${SESSION_COOKIE}=; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=0`,\n );\n}\n\nfunction getCookie(request: Request, name: string): string | null {\n const cookie = request.headers.get(\"Cookie\") || \"\";\n for (const part of cookie.split(\";\")) {\n const [key, ...value] = part.trim().split(\"=\");\n if (key === name) return value.join(\"=\");\n }\n return null;\n}\n\nasync function enforceRateLimit(\n request: Request,\n scope: string,\n limit: number,\n windowSeconds: number,\n) {\n const forwarded = request.headers.get(\"x-forwarded-for\")?.split(\",\")[0]\n .trim();\n const ip = request.headers.get(\"cf-connecting-ip\") || forwarded || \"unknown\";\n const bucketKey = await sha256(`${scope}:${ip}`);\n const nowSeconds = Math.floor(Date.now() / 1000);\n const windowStart = Math.floor(nowSeconds / windowSeconds) * windowSeconds;\n const result = await sqlite.execute({\n sql: `INSERT INTO rate_limits (bucket_key, window_start, attempts)\n VALUES (?, ?, 1)\n ON CONFLICT(bucket_key, window_start)\n DO UPDATE SET attempts = attempts + 1\n RETURNING attempts`,\n args: [bucketKey, windowStart],\n });\n const attempts = Number(result.rows[0].attempts);\n\n if (Math.random() < 0.03) {\n await sqlite.execute({\n sql: \"DELETE FROM rate_limits WHERE window_start < ?\",\n args: [nowSeconds - 24 * 60 * 60],\n });\n }\n if (attempts > limit) {\n throw new ApiError(\n 429,\n \"RATE_LIMITED\",\n \"Too many attempts. Please wait and try again.\",\n );\n }\n}\n\nasync function authenticateMember(\n phone: string,\n pin: string,\n date: string,\n requireActive = true,\n planAtDate = true,\n allowCurrentDayPassFallback = false,\n): Promise> {\n const result = await sqlite.execute({\n sql: `SELECT\n m.id, m.name, m.active, m.pin_salt, m.pin_hash, m.pin_iterations\n FROM members m\n WHERE m.phone = ?\n AND (? = 0 OR m.active = 1)\n LIMIT 1`,\n args: [phone, requireActive ? 1 : 0],\n });\n const identity = result.rows[0];\n const fallbackSalt = \"8FSy_T6mKVxiFeN_65Qog8MO\";\n const actualHash = identity\n ? await derivePasswordHash(\n pin,\n String(identity.pin_salt),\n Number(identity.pin_iterations),\n )\n : await derivePasswordHash(pin, fallbackSalt, PIN_ITERATIONS);\n if (!identity || !timingSafeEqual(actualHash, String(identity.pin_hash))) {\n throw new ApiError(\n 401,\n \"MEMBER_AUTH_FAILED\",\n \"The phone number or 4-digit PIN is incorrect.\",\n );\n }\n const plan = planAtDate\n ? await resolveAttendancePlan(\n Number(identity.id),\n date,\n allowCurrentDayPassFallback,\n )\n : await getLatestMemberPlan(Number(identity.id));\n if (!plan) {\n throw new ApiError(\n 409,\n \"MEMBER_PLAN_NOT_FOUND\",\n \"No membership plan is available for that date.\",\n );\n }\n return { ...identity, ...plan };\n}\n\nasync function getLatestMemberPlan(\n memberId: number,\n): Promise | null> {\n const result = await sqlite.execute({\n sql: `SELECT plan_type, rate_cents, payment_term\n FROM member_plan_history\n WHERE member_id = ?\n ORDER BY effective_from DESC, id DESC\n LIMIT 1`,\n args: [memberId],\n });\n return result.rows[0] ?? null;\n}\n\nasync function resolveAttendancePlan(\n memberId: number,\n date: string,\n allowCurrentDayPassFallback: boolean,\n): Promise | null> {\n const result = await sqlite.execute({\n sql: `SELECT plan_type, rate_cents, payment_term\n FROM member_plan_history\n WHERE member_id = ?\n AND effective_from <= ?\n AND (effective_to IS NULL OR effective_to >= ?)\n ORDER BY effective_from DESC, id DESC\n LIMIT 1`,\n args: [memberId, date, date],\n });\n if (result.rows[0]) return result.rows[0];\n if (!allowCurrentDayPassFallback) return null;\n const latest = await getLatestMemberPlan(memberId);\n return latest && String(latest.plan_type) === \"day\" ? latest : null;\n}\n\nasync function recordAttendance(\n member: Record,\n date: string,\n source: \"today\" | \"member_backfill\" | \"admin\",\n) {\n const punchedAt = new Date().toISOString();\n const chargeCents = String(member.plan_type) === \"day\"\n ? Number(member.rate_cents)\n : 0;\n const inserted = await sqlite.execute({\n sql: `INSERT OR IGNORE INTO attendance\n (member_id, attendance_date, punched_at, plan_type_snapshot, charge_cents,\n payment_term_snapshot, source)\n VALUES (?, ?, ?, ?, ?, ?, ?)\n RETURNING id`,\n args: [\n Number(member.id),\n date,\n punchedAt,\n String(member.plan_type),\n chargeCents,\n String(member.payment_term),\n source,\n ],\n });\n if (inserted.rows.length === 0) {\n const existing = await sqlite.execute({\n sql: `SELECT punched_at FROM attendance\n WHERE member_id = ? AND attendance_date = ? LIMIT 1`,\n args: [Number(member.id), date],\n });\n throw new ApiError(\n 409,\n \"ALREADY_PUNCHED\",\n `${String(member.name).split(\" \")[0]} already has an entry for ${date}.`,\n {\n name: String(member.name),\n date,\n punchedAt: String(existing.rows[0]?.punched_at ?? punchedAt),\n },\n );\n }\n return {\n name: String(member.name),\n date,\n punchedAt,\n planType: String(member.plan_type),\n paymentTerm: String(member.payment_term),\n chargeCents,\n source,\n };\n}\n\nasync function getSettings() {\n const result = await sqlite.execute(\n \"SELECT key, value FROM app_settings\",\n );\n const values = Object.fromEntries(\n result.rows.map((row) => [String(row.key), String(row.value)]),\n );\n return {\n dayPriceCents: Number(values.day_price_cents ?? 0),\n monthlyPriceCents: Number(values.monthly_price_cents ?? 0),\n currency: \"INR\",\n timezone: values.timezone || \"Asia/Kolkata\",\n officeName: values.office_name || \"Deskday Coworking\",\n };\n}\n\nfunction getLicense(timezone: string) {\n const today = officeDate(timezone);\n const raw = Deno.env.get(\"LICENSE_EXPIRES_ON\")?.trim() || \"\";\n let expirationDate: string | null = null;\n if (/^\\d{4}-\\d{2}-\\d{2}$/.test(raw)) {\n const parsed = new Date(`${raw}T00:00:00Z`);\n if (\n !Number.isNaN(parsed.valueOf()) &&\n parsed.toISOString().slice(0, 10) === raw\n ) {\n expirationDate = raw;\n }\n }\n if (!expirationDate) {\n return {\n configured: false,\n active: false,\n expirationDate: null,\n daysLeft: null,\n message:\n \"The software license is inactive. Contact labs@autoficial.ltd for software licensing.\",\n };\n }\n const daysLeft = Math.round(\n (\n Date.parse(`${expirationDate}T00:00:00Z`) -\n Date.parse(`${today}T00:00:00Z`)\n ) / 86_400_000,\n );\n return {\n configured: true,\n active: daysLeft >= 0,\n expirationDate,\n daysLeft,\n message: daysLeft < 0\n ? `The software license expired on ${expirationDate}. Contact labs@autoficial.ltd to renew it.`\n : daysLeft === 0\n ? \"The software license expires today.\"\n : `The software license has ${daysLeft} days remaining.`,\n };\n}\n\nfunction assertLicenseActive(timezone: string) {\n const license = getLicense(timezone);\n if (!license.active) {\n throw new ApiError(\n 403,\n license.configured ? \"LICENSE_EXPIRED\" : \"LICENSE_NOT_CONFIGURED\",\n license.message,\n { license },\n );\n }\n}\n\nasync function scalar(\n sql: string,\n args: Array,\n key: string,\n): Promise {\n const result = await sqlite.execute({ sql, args });\n return Number(result.rows[0]?.[key] ?? 0);\n}\n\nasync function readJson(c: Context): Promise> {\n try {\n const body = await c.req.json();\n if (!body || typeof body !== \"object\" || Array.isArray(body)) {\n throw new Error(\"not an object\");\n }\n return body as Record;\n } catch {\n throw new ApiError(400, \"INVALID_JSON\", \"Send a valid JSON request.\");\n }\n}\n\nfunction requiredString(value: unknown, label: string, max: number): string {\n if (typeof value !== \"string\" || !value.trim()) {\n throw new ApiError(400, \"VALIDATION_ERROR\", `${label} is required.`);\n }\n const trimmed = value.trim();\n if (trimmed.length > max) {\n throw new ApiError(\n 400,\n \"VALIDATION_ERROR\",\n `${label} is too long.`,\n );\n }\n return trimmed;\n}\n\nfunction validatePassword(value: unknown): string {\n const password = requiredString(value, \"Password\", 200);\n if (\n password.length < 12 ||\n !/[a-z]/i.test(password) ||\n !/\\d/.test(password)\n ) {\n throw new ApiError(\n 400,\n \"WEAK_PASSWORD\",\n \"Use at least 12 characters with at least one letter and one number.\",\n );\n }\n return password;\n}\n\nfunction validatePin(value: unknown): string {\n const pin = requiredString(value, \"4-digit PIN\", 4);\n if (!/^\\d{4}$/.test(pin)) {\n throw new ApiError(\n 400,\n \"INVALID_PIN\",\n \"Enter a 4-digit numeric PIN.\",\n );\n }\n return pin;\n}\n\nfunction normalizeIndianPhone(value: unknown): string {\n const raw = requiredString(value, \"Phone number\", 40);\n let digits = raw.replace(/\\D/g, \"\");\n if (digits.length === 12 && digits.startsWith(\"91\")) {\n digits = digits.slice(2);\n }\n if (!/^[6-9]\\d{9}$/.test(digits)) {\n throw new ApiError(\n 400,\n \"INVALID_PHONE\",\n \"Enter a valid 10-digit Indian mobile number beginning with 6, 7, 8, or 9.\",\n );\n }\n return digits;\n}\n\nasync function assertPhoneAvailable(\n phone: string,\n excludeMemberId?: number,\n): Promise {\n const result = await sqlite.execute({\n sql: `SELECT id FROM members\n WHERE phone IN (?, ?)\n AND (? IS NULL OR id != ?)\n LIMIT 1`,\n args: [phone, `91${phone}`, excludeMemberId ?? null, excludeMemberId ?? null],\n });\n if (result.rows.length) {\n throw new ApiError(\n 409,\n \"PHONE_EXISTS\",\n \"A member with this phone number already exists.\",\n );\n }\n}\n\nfunction validatePlan(value: unknown): \"day\" | \"monthly\" {\n if (value !== \"day\" && value !== \"monthly\") {\n throw new ApiError(\n 400,\n \"INVALID_PLAN\",\n \"Choose a day pass or monthly pass.\",\n );\n }\n return value;\n}\n\nfunction validatePaymentTerm(value: unknown): \"prepaid\" | \"postpaid\" {\n if (value !== \"prepaid\" && value !== \"postpaid\") {\n throw new ApiError(\n 400,\n \"INVALID_PAYMENT_TERM\",\n \"Choose prepaid or postpaid billing.\",\n );\n }\n return value;\n}\n\nfunction parseMoney(value: unknown, label: string): number {\n const raw = requiredString(value, label, 20);\n if (!/^\\d{1,9}(\\.\\d{1,2})?$/.test(raw)) {\n throw new ApiError(\n 400,\n \"INVALID_PRICE\",\n `${label} must be a positive amount with up to two decimals.`,\n );\n }\n const [whole, fraction = \"\"] = raw.split(\".\");\n const cents = Number(whole) * 100 + Number(fraction.padEnd(2, \"0\"));\n if (!Number.isSafeInteger(cents)) {\n throw new ApiError(400, \"INVALID_PRICE\", `${label} is too large.`);\n }\n return cents;\n}\n\nfunction positiveId(value: string): number {\n const id = Number(value);\n if (!Number.isSafeInteger(id) || id <= 0) {\n throw new ApiError(400, \"INVALID_ID\", \"Invalid member id.\");\n }\n return id;\n}\n\nfunction validateDate(value: string): string {\n if (!/^\\d{4}-\\d{2}-\\d{2}$/.test(value)) {\n throw new ApiError(400, \"INVALID_DATE\", \"Use a valid date.\");\n }\n const parsed = new Date(`${value}T00:00:00Z`);\n if (Number.isNaN(parsed.valueOf()) || parsed.toISOString().slice(0, 10) !== value) {\n throw new ApiError(400, \"INVALID_DATE\", \"Use a valid date.\");\n }\n return value;\n}\n\nfunction validateMonth(value: string): string {\n if (!/^\\d{4}-(0[1-9]|1[0-2])$/.test(value)) {\n throw new ApiError(400, \"INVALID_MONTH\", \"Use a valid month.\");\n }\n return value;\n}\n\nfunction endOfMonth(month: string): string {\n const [year, monthNumber] = month.split(\"-\").map(Number);\n return new Date(Date.UTC(year, monthNumber, 0)).toISOString().slice(0, 10);\n}\n\nfunction addDays(date: string, amount: number): string {\n const parsed = new Date(`${date}T00:00:00Z`);\n parsed.setUTCDate(parsed.getUTCDate() + amount);\n return parsed.toISOString().slice(0, 10);\n}\n\nfunction officeDate(timezone: string): string {\n const parts = new Intl.DateTimeFormat(\"en-CA\", {\n timeZone: timezone,\n year: \"numeric\",\n month: \"2-digit\",\n day: \"2-digit\",\n }).formatToParts(new Date());\n const part = (type: Intl.DateTimeFormatPartTypes) =>\n parts.find((item) => item.type === type)?.value || \"\";\n return `${part(\"year\")}-${part(\"month\")}-${part(\"day\")}`;\n}\n\nfunction memberRow(row: Record) {\n return {\n id: Number(row.id),\n name: String(row.name),\n phone: indianLocalPhone(String(row.phone)),\n active: Number(row.active) === 1,\n createdAt: String(row.created_at),\n planType: row.plan_type ? String(row.plan_type) : \"day\",\n rateCents: Number(row.rate_cents ?? 0),\n paymentTerm: row.payment_term === \"prepaid\" ? \"prepaid\" : \"postpaid\",\n effectiveFrom: row.effective_from ? String(row.effective_from) : null,\n };\n}\n\nfunction indianLocalPhone(phone: string): string {\n return phone.length === 12 && phone.startsWith(\"91\")\n ? phone.slice(2)\n : phone;\n}\n\nasync function derivePasswordHash(\n password: string,\n salt: string,\n iterations: number,\n): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n {\n name: \"PBKDF2\",\n hash: \"SHA-256\",\n salt: base64UrlDecode(salt) as BufferSource,\n iterations,\n },\n key,\n 256,\n );\n return base64UrlEncode(new Uint8Array(bits));\n}\n\nasync function sha256(value: string): Promise {\n const digest = await crypto.subtle.digest(\n \"SHA-256\",\n new TextEncoder().encode(value),\n );\n return base64UrlEncode(new Uint8Array(digest));\n}\n\nfunction randomToken(bytes: number): string {\n return base64UrlEncode(crypto.getRandomValues(new Uint8Array(bytes)));\n}\n\nfunction timingSafeEqual(a: string, b: string): boolean {\n const aBytes = new TextEncoder().encode(a);\n const bBytes = new TextEncoder().encode(b);\n const length = Math.max(aBytes.length, bBytes.length);\n let mismatch = aBytes.length ^ bBytes.length;\n for (let index = 0; index < length; index++) {\n mismatch |= (aBytes[index] ?? 0) ^ (bBytes[index] ?? 0);\n }\n return mismatch === 0;\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n let binary = \"\";\n for (const byte of bytes) binary += String.fromCharCode(byte);\n return btoa(binary)\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=+$/g, \"\");\n}\n\nfunction base64UrlDecode(value: string): Uint8Array {\n const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const padding = \"=\".repeat((4 - normalized.length % 4) % 4);\n const binary = atob(normalized + padding);\n return Uint8Array.from(binary, (char) => char.charCodeAt(0));\n}\n\nexport default app.fetch;\n","am-deskday",[139],"8cfa449e-5801-4e7e-9cbf-022cba9a97c0","billing.ts","36fb7aaa-86f7-11f1-a4b2-1607ee4eb77e",2,["D",1784853176255],"import { jsPDF } from \"npm:jspdf@4.2.1\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport type BillingPeriod = \"day\" | \"month\";\nexport type PaymentTerm = \"prepaid\" | \"postpaid\" | \"mixed\";\n\nexport type BillingResult = {\n member: { id: number; name: string; phone: string; active: boolean };\n periodType: BillingPeriod;\n periodKey: string;\n periodStart: string;\n periodEnd: string;\n planType: \"day\" | \"monthly\" | \"mixed\";\n paymentTerm: PaymentTerm;\n currentPlanType: \"day\" | \"monthly\" | null;\n currentPaymentTerm: \"prepaid\" | \"postpaid\" | null;\n amountCents: number;\n paymentsCents: number;\n dueCents: number;\n prepaidBalanceCents: number;\n attendanceCount: number;\n attendance: Array<{\n date: string;\n punchedAt: string;\n planType: \"day\" | \"monthly\";\n chargeCents: number;\n paymentTerm: \"prepaid\" | \"postpaid\";\n source: \"today\" | \"member_backfill\" | \"admin\";\n }>;\n lines: Array<{\n description: string;\n quantity: number;\n unitCents: number;\n amountCents: number;\n paymentTerm: \"prepaid\" | \"postpaid\";\n }>;\n};\n\nexport async function materializeMonthlyCharges(\n memberId: number,\n throughMonth: string,\n): Promise {\n await sqlite.execute({\n sql: `WITH RECURSIVE months(month) AS (\n SELECT MIN(substr(effective_from, 1, 7))\n FROM member_plan_history\n WHERE member_id = ? AND plan_type = 'monthly'\n UNION ALL\n SELECT strftime('%Y-%m', date(month || '-01', '+1 month'))\n FROM months\n WHERE month IS NOT NULL AND month < ?\n )\n INSERT OR IGNORE INTO monthly_charges (\n member_id, billing_month, rate_cents, payment_term_snapshot\n )\n SELECT\n ?,\n months.month,\n (\n SELECT ph.rate_cents\n FROM member_plan_history ph\n WHERE ph.member_id = ?\n AND ph.plan_type = 'monthly'\n AND ph.effective_from <= date(months.month || '-01', '+1 month', '-1 day')\n AND (ph.effective_to IS NULL OR ph.effective_to >= months.month || '-01')\n ORDER BY ph.effective_from DESC, ph.id DESC\n LIMIT 1\n ),\n (\n SELECT ph.payment_term\n FROM member_plan_history ph\n WHERE ph.member_id = ?\n AND ph.plan_type = 'monthly'\n AND ph.effective_from <= date(months.month || '-01', '+1 month', '-1 day')\n AND (ph.effective_to IS NULL OR ph.effective_to >= months.month || '-01')\n ORDER BY ph.effective_from DESC, ph.id DESC\n LIMIT 1\n )\n FROM months\n WHERE months.month IS NOT NULL\n AND months.month <= ?\n AND EXISTS (\n SELECT 1\n FROM member_plan_history ph\n WHERE ph.member_id = ?\n AND ph.plan_type = 'monthly'\n AND ph.effective_from <= date(months.month || '-01', '+1 month', '-1 day')\n AND (ph.effective_to IS NULL OR ph.effective_to >= months.month || '-01')\n )`,\n args: [\n memberId,\n throughMonth,\n memberId,\n memberId,\n memberId,\n throughMonth,\n memberId,\n ],\n });\n}\n\nexport async function getMemberBilling(\n memberId: number,\n periodType: BillingPeriod,\n periodKey: string,\n): Promise {\n const memberResult = await sqlite.execute({\n sql: \"SELECT id, name, phone, active FROM members WHERE id = ? LIMIT 1\",\n args: [memberId],\n });\n const member = memberResult.rows[0];\n if (!member) return null;\n\n const periodStart = periodType === \"day\" ? periodKey : `${periodKey}-01`;\n const periodEnd = periodType === \"day\" ? periodKey : endOfMonth(periodKey);\n await materializeMonthlyCharges(memberId, periodEnd.slice(0, 7));\n\n const [attendanceResult, monthlyResult, paymentResult, balanceResult, currentPlanResult] =\n await Promise.all([\n sqlite.execute({\n sql: `SELECT attendance_date, punched_at, plan_type_snapshot,\n charge_cents, payment_term_snapshot, source\n FROM attendance\n WHERE member_id = ? AND attendance_date BETWEEN ? AND ?\n ORDER BY attendance_date DESC, punched_at DESC`,\n args: [memberId, periodStart, periodEnd],\n }),\n periodType === \"month\"\n ? sqlite.execute({\n sql: `SELECT rate_cents, payment_term_snapshot\n FROM monthly_charges\n WHERE member_id = ? AND billing_month = ? LIMIT 1`,\n args: [memberId, periodKey],\n })\n : Promise.resolve({ rows: [] }),\n sqlite.execute({\n sql: `SELECT COALESCE(SUM(amount_cents), 0) AS amount\n FROM payments\n WHERE member_id = ?\n AND allocation_type = 'period_payment'\n AND period_type = ? AND period_key = ?`,\n args: [memberId, periodType, periodKey],\n }),\n sqlite.execute({\n sql: `SELECT\n COALESCE((\n SELECT SUM(amount_cents) FROM payments\n WHERE member_id = ?\n AND allocation_type = 'prepaid_credit'\n AND paid_on <= ?\n ), 0) AS credits,\n COALESCE((\n SELECT SUM(charge_cents) FROM attendance\n WHERE member_id = ?\n AND payment_term_snapshot = 'prepaid'\n AND attendance_date <= ?\n ), 0) + COALESCE((\n SELECT SUM(rate_cents) FROM monthly_charges\n WHERE member_id = ?\n AND payment_term_snapshot = 'prepaid'\n AND billing_month <= ?\n ), 0) AS usage`,\n args: [\n memberId,\n periodEnd,\n memberId,\n periodEnd,\n memberId,\n periodEnd.slice(0, 7),\n ],\n }),\n sqlite.execute({\n sql: `SELECT plan_type, payment_term\n FROM member_plan_history\n WHERE member_id = ?\n AND effective_from <= ?\n AND (effective_to IS NULL OR effective_to >= ?)\n ORDER BY effective_from DESC, id DESC LIMIT 1`,\n args: [memberId, periodEnd, periodEnd],\n }),\n ]);\n\n const attendance = attendanceResult.rows.map((row) => ({\n date: String(row.attendance_date),\n punchedAt: String(row.punched_at),\n planType: String(row.plan_type_snapshot) as \"day\" | \"monthly\",\n chargeCents: Number(row.charge_cents),\n paymentTerm: String(row.payment_term_snapshot) as\n | \"prepaid\"\n | \"postpaid\",\n source: String(row.source) as \"today\" | \"member_backfill\" | \"admin\",\n }));\n\n const lines: BillingResult[\"lines\"] = [];\n const monthlyRow = monthlyResult.rows[0];\n if (monthlyRow) {\n lines.push({\n description: `Monthly workspace package — ${periodKey}`,\n quantity: 1,\n unitCents: Number(monthlyRow.rate_cents),\n amountCents: Number(monthlyRow.rate_cents),\n paymentTerm: String(monthlyRow.payment_term_snapshot) as\n | \"prepaid\"\n | \"postpaid\",\n });\n }\n\n const dayGroups = new Map();\n for (const entry of attendance) {\n if (entry.planType !== \"day\") continue;\n const key = `${entry.chargeCents}:${entry.paymentTerm}`;\n const group = dayGroups.get(key) ?? {\n quantity: 0,\n unitCents: entry.chargeCents,\n paymentTerm: entry.paymentTerm,\n };\n group.quantity += 1;\n dayGroups.set(key, group);\n }\n for (const group of dayGroups.values()) {\n lines.push({\n description: `Day-pass attendance — ${periodKey}`,\n quantity: group.quantity,\n unitCents: group.unitCents,\n amountCents: group.quantity * group.unitCents,\n paymentTerm: group.paymentTerm,\n });\n }\n\n const amountCents = lines.reduce((sum, line) => sum + line.amountCents, 0);\n const postpaidCharges = lines.reduce(\n (sum, line) =>\n sum + (line.paymentTerm === \"postpaid\" ? line.amountCents : 0),\n 0,\n );\n const paymentsCents = Number(paymentResult.rows[0]?.amount ?? 0);\n const credits = Number(balanceResult.rows[0]?.credits ?? 0);\n const usage = Number(balanceResult.rows[0]?.usage ?? 0);\n const prepaidBalanceCents = credits - usage;\n const hasPrepaid = lines.some((line) => line.paymentTerm === \"prepaid\");\n const dueCents = Math.max(postpaidCharges - paymentsCents, 0) +\n (hasPrepaid ? Math.max(-prepaidBalanceCents, 0) : 0);\n const hasPostpaid = lines.some((line) => line.paymentTerm === \"postpaid\");\n const paymentTerm: PaymentTerm = hasPrepaid && hasPostpaid\n ? \"mixed\"\n : hasPrepaid\n ? \"prepaid\"\n : hasPostpaid\n ? \"postpaid\"\n : (currentPlanResult.rows[0]?.payment_term === \"prepaid\"\n ? \"prepaid\"\n : \"postpaid\");\n const hasMonthly = lines.some((line) =>\n line.description.startsWith(\"Monthly\")\n );\n const hasDay = lines.some((line) => line.description.startsWith(\"Day-pass\"));\n const currentPlan = currentPlanResult.rows[0];\n\n return {\n member: {\n id: Number(member.id),\n name: String(member.name),\n phone: String(member.phone),\n active: Number(member.active) === 1,\n },\n periodType,\n periodKey,\n periodStart,\n periodEnd,\n planType: hasMonthly && hasDay ? \"mixed\" : hasMonthly ? \"monthly\" : \"day\",\n paymentTerm,\n currentPlanType: currentPlan\n ? String(currentPlan.plan_type) as \"day\" | \"monthly\"\n : null,\n currentPaymentTerm: currentPlan\n ? String(currentPlan.payment_term) as \"prepaid\" | \"postpaid\"\n : null,\n amountCents,\n paymentsCents,\n dueCents,\n prepaidBalanceCents,\n attendanceCount: attendance.length,\n attendance,\n lines,\n };\n}\n\nexport function invoiceNumber(billing: BillingResult): string {\n const period = billing.periodKey.replaceAll(\"-\", \"\");\n const type = billing.periodType === \"day\" ? \"DAY\" : \"MON\";\n return `DD-${type}-${period}-${String(billing.member.id).padStart(4, \"0\")}`;\n}\n\nexport function generateInvoicePdf(\n billing: BillingResult,\n officeName: string,\n generatedOn: string,\n): ArrayBuffer {\n const doc = new jsPDF({ unit: \"mm\", format: \"a4\" });\n const pageWidth = doc.internal.pageSize.getWidth();\n const green = [35, 100, 64] as [number, number, number];\n const ink = [29, 42, 34] as [number, number, number];\n const muted = [91, 105, 96] as [number, number, number];\n const pale = [239, 247, 241] as [number, number, number];\n\n doc.setFillColor(...green);\n doc.rect(0, 0, pageWidth, 34, \"F\");\n doc.setTextColor(255, 255, 255);\n doc.setFont(\"helvetica\", \"bold\");\n doc.setFontSize(19);\n doc.text(cleanPdfText(officeName), 16, 16);\n doc.setFont(\"helvetica\", \"normal\");\n doc.setFontSize(9);\n doc.text(\"Coworking attendance invoice\", 16, 23);\n doc.setFont(\"helvetica\", \"bold\");\n doc.setFontSize(15);\n doc.text(\"INVOICE\", pageWidth - 16, 16, { align: \"right\" });\n doc.setFont(\"helvetica\", \"normal\");\n doc.setFontSize(8);\n doc.text(invoiceNumber(billing), pageWidth - 16, 23, { align: \"right\" });\n\n doc.setTextColor(...ink);\n doc.setFontSize(8);\n doc.setFont(\"helvetica\", \"bold\");\n doc.text(\"BILLED TO\", 16, 48);\n doc.setFont(\"helvetica\", \"normal\");\n doc.setFontSize(11);\n doc.text(cleanPdfText(billing.member.name), 16, 55);\n doc.setFontSize(9);\n doc.setTextColor(...muted);\n doc.text(formatIndianPhone(billing.member.phone), 16, 61);\n\n doc.setTextColor(...ink);\n doc.setFontSize(8);\n doc.setFont(\"helvetica\", \"bold\");\n doc.text(\"DETAILS\", 116, 48);\n doc.setFont(\"helvetica\", \"normal\");\n doc.setFontSize(9);\n doc.text(`Issued: ${generatedOn}`, 116, 55);\n doc.text(\n `Period: ${billing.periodStart}${\n billing.periodEnd === billing.periodStart ? \"\" : ` to ${billing.periodEnd}`\n }`,\n 116,\n 61,\n );\n doc.text(`Terms: ${termLabel(billing.paymentTerm)}`, 116, 67);\n\n let y = 80;\n doc.setFillColor(...pale);\n doc.rect(16, y, pageWidth - 32, 10, \"F\");\n doc.setTextColor(...ink);\n doc.setFont(\"helvetica\", \"bold\");\n doc.setFontSize(8);\n doc.text(\"DESCRIPTION\", 20, y + 6.5);\n doc.text(\"QTY\", 132, y + 6.5, { align: \"right\" });\n doc.text(\"RATE\", 158, y + 6.5, { align: \"right\" });\n doc.text(\"AMOUNT\", pageWidth - 20, y + 6.5, { align: \"right\" });\n y += 10;\n\n doc.setFont(\"helvetica\", \"normal\");\n for (const line of billing.lines) {\n doc.setDrawColor(225, 232, 227);\n doc.line(16, y + 13, pageWidth - 16, y + 13);\n doc.setTextColor(...ink);\n doc.setFontSize(9);\n doc.text(cleanPdfText(line.description), 20, y + 6);\n doc.setFontSize(7.5);\n doc.setTextColor(...muted);\n doc.text(termLabel(line.paymentTerm), 20, y + 10.5);\n doc.setFontSize(9);\n doc.setTextColor(...ink);\n doc.text(String(line.quantity), 132, y + 7, { align: \"right\" });\n doc.text(formatInr(line.unitCents), 158, y + 7, { align: \"right\" });\n doc.text(formatInr(line.amountCents), pageWidth - 20, y + 7, {\n align: \"right\",\n });\n y += 14;\n }\n if (billing.lines.length === 0) {\n doc.setTextColor(...muted);\n doc.setFontSize(9);\n doc.text(\"No billable attendance for this period.\", 20, y + 8);\n y += 18;\n }\n\n y = Math.max(y + 8, 150);\n const summary = [\n [\"Billable total\", billing.amountCents],\n [\"Payments recorded\", -billing.paymentsCents],\n ] as const;\n for (const [label, amount] of summary) {\n doc.setTextColor(...muted);\n doc.setFontSize(9);\n doc.text(label, 140, y, { align: \"right\" });\n doc.setTextColor(...ink);\n doc.setFont(\"helvetica\", \"bold\");\n doc.text(formatInr(amount), pageWidth - 20, y, { align: \"right\" });\n y += 8;\n }\n if (billing.paymentTerm !== \"postpaid\") {\n doc.setTextColor(...muted);\n doc.setFont(\"helvetica\", \"normal\");\n doc.text(\"Prepaid balance\", 140, y, { align: \"right\" });\n doc.setTextColor(...ink);\n doc.setFont(\"helvetica\", \"bold\");\n doc.text(formatInr(billing.prepaidBalanceCents), pageWidth - 20, y, {\n align: \"right\",\n });\n y += 9;\n }\n doc.setFillColor(...(billing.dueCents > 0 ? green : pale));\n doc.roundedRect(116, y - 5, pageWidth - 132, 18, 2, 2, \"F\");\n const dueTextColor = (billing.dueCents > 0\n ? [255, 255, 255]\n : ink) as [number, number, number];\n doc.setTextColor(...dueTextColor);\n doc.setFontSize(9);\n doc.text(billing.dueCents > 0 ? \"AMOUNT DUE\" : \"SETTLED\", 121, y + 2);\n doc.setFontSize(13);\n doc.text(formatInr(billing.dueCents), pageWidth - 20, y + 4, {\n align: \"right\",\n });\n\n doc.setFont(\"helvetica\", \"normal\");\n doc.setTextColor(...muted);\n doc.setFontSize(8);\n doc.text(\"Generated from recorded attendance and payments.\", 16, 278);\n doc.text(\n `Attendance recorded: ${billing.attendanceCount} day${\n billing.attendanceCount === 1 ? \"\" : \"s\"\n }`,\n pageWidth - 16,\n 278,\n { align: \"right\" },\n );\n return doc.output(\"arraybuffer\");\n}\n\nfunction endOfMonth(month: string): string {\n const [year, monthNumber] = month.split(\"-\").map(Number);\n return new Date(Date.UTC(year, monthNumber, 0)).toISOString().slice(0, 10);\n}\n\nfunction formatInr(cents: number): string {\n const prefix = cents < 0 ? \"-INR \" : \"INR \";\n return `${prefix}${(Math.abs(cents) / 100).toLocaleString(\"en-IN\", {\n minimumFractionDigits: 2,\n maximumFractionDigits: 2,\n })}`;\n}\n\nfunction termLabel(term: PaymentTerm): string {\n return term === \"prepaid\"\n ? \"Prepaid\"\n : term === \"postpaid\"\n ? \"Postpaid\"\n : \"Mixed terms\";\n}\n\nfunction formatIndianPhone(phone: string): string {\n const local = phone.startsWith(\"91\") && phone.length === 12\n ? phone.slice(2)\n : phone;\n return local.length === 10\n ? `+91 ${local.slice(0, 5)} ${local.slice(5)}`\n : `+${phone}`;\n}\n\nfunction cleanPdfText(value: string): string {\n return value.replace(/[^\\x20-\\x7E]/g, \" \").replace(/\\s+/g, \" \").trim();\n}\n",[146],"pulls","branches","forks","envVars",{"_159":148,"_161":42},"connections",{"_159":42,"_160":42},"count","unfilledCount","emptyCount",{"_18":145,"_20":146,"_117":147,"_119":-5,"_120":71,"_121":148,"_123":38,"_22":176,"_68":42,"_125":100,"_126":150,"_128":26,"_129":-5,"_167":177,"_89":178},{"_18":138,"_20":139,"_117":36,"_119":-5,"_120":71,"_121":69,"_123":38,"_22":173,"_68":42,"_125":141,"_126":142,"_128":26,"_129":143,"_167":174,"_89":175},{"_18":131,"_20":132,"_117":133,"_119":-5,"_120":71,"_121":134,"_123":38,"_22":170,"_68":42,"_125":100,"_126":136,"_128":26,"_129":-5,"_167":171,"_89":172},{"_18":115,"_20":116,"_117":118,"_119":-5,"_120":71,"_121":122,"_123":38,"_22":166,"_68":42,"_125":100,"_126":127,"_128":26,"_129":-5,"_167":168,"_89":169},["D",1784853176831],"children",[],[116],["D",1784853175921],[],[132],["D",1784853177273],[],[139],["D",1784853176255],[],[146],["D",1784853174535],["D",1789474853273],{"_16":17,"_87":83},{"_16":17,"_80":81,"_82":83,"_33":34,"_84":85,"_86":26},{"_68":69,"_20":70,"_18":71,"_72":19,"_73":-5,"_74":-5,"_75":-5,"_76":-5,"_77":-5,"_78":21,"_79":17},"ctx",{"_61":-5,"_108":217,"_218":219,"_220":221,"_222":26,"_223":26,"_224":26,"_225":38,"_226":-5,"_227":-7,"_228":-7,"_229":42,"_230":26,"_231":26,"_232":-5,"_233":26,"_234":26,"_235":26,"_236":-5},"ENV",{"_188":189,"_190":191,"_192":70,"_193":194,"_195":196,"_197":198,"_199":200,"_201":202,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":214,"_215":216},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Good to see you.

Your month

Admin sign in

Secure first setup

License expired

Attendance

Office activity

Attendance log

Members

Directory

Billing

Invoice summary

Settings

Add member

Member history

Search