[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_153":154,"_155":156},"routes/_app.x.$handle.$name",{"_96":95,"_32":45,"_103":86,"_27":53,"_13":14,"_104":-5,"_11":105,"_106":107,"_108":109,"_110":111,"_112":113,"_20":-5,"_114":-5,"_115":-5,"_116":25,"_117":118,"_119":58,"_120":-5,"_121":-5,"_122":123},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":25},"version",16,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","542d956e-aaf0-11f1-bf78-1607ee4eb77e","name","fileType","http","content","/**\n * Good Maid Cleaning — payment + booking relay\n * --------------------------------------------------\n * Jobber is no longer part of this system at all — everything Jobber used\n * to do (hold the schedule, tell you if someone's a new customer, host\n * your cleaners' job list) now lives right here in this file and in your\n * admin tools page. You can ignore/delete the old Jobber relay val; nothing\n * calls out to it anymore.\n *\n * What it does, in order, on a normal booking:\n * 1. Checkout asks this file \"what would this actually cost?\" — it checks\n * your OWN saved bookings for a matching email/phone (returning\n * customer = no discount), then starts a real Stripe charge for the\n * real final amount. The card is captured immediately once confirmed\n * — never held-and-authorized.\n * 2. Once Stripe confirms the charge succeeded, checkout calls this file\n * again to \"finalize\": a permanent record of the booking gets saved\n * here (this IS the schedule now — no separate system to sync with),\n * and the confirmation email (with the cancel link) goes out.\n * 3. The manage/cancel page on your site calls back here to look up a\n * booking and, if asked, cancel it. It never refunds automatically.\n * Refunds are a manual call: if a cancelled customer follows up\n * asking for their money back, refund them by hand from the Stripe\n * dashboard (Payments → find the charge → Refund).\n * 4. Referrals: every booking's own reference doubles as that customer's\n * referral code. If a NEW customer checks out using someone else's\n * code, they get $20 off (step 1, same \"genuinely new\" check as\n * FIRST20) — and the moment their booking is finalized (step 2), the\n * referrer automatically gets emailed a one-time $20 reward code for\n * their own next clean. See the \"referral program\" block below.\n * 5. Cleaners: you (the admin) assign a cleaner to each booking from the\n * admin tools page. Each cleaner has their own account on the new\n * cleaner portal page (cleaner_portal.html) where they log in and see\n * only their own upcoming jobs — address, time, customer contact, and\n * any entry instructions/special requests the customer left at\n * booking. See §11.\n *\n * You should not need to understand this file. Paste it in over your\n * existing relay val, add the Env Variables listed below, and you're done\n * — the address stays the same.\n *\n * ───────────────────────── Env Variables to add ─────────────────────────\n * STRIPE_SECRET_KEY — already set from before, leave as-is.\n * EMAILJS_PRIVATE_KEY — EmailJS → Account → API Keys → \"Private Key\".\n * You'll need to turn on \"Allow API calls from\n * non-browser applications\" there too — EmailJS\n * blocks server-to-server sends without it.\n * ADMIN_KEY — make up any private password-like string.\n * This protects every admin-only endpoint (the\n * add-on charge tool, deleting bookings, adding\n * cleaners, assigning jobs) so a stranger can't\n * do any of that. Keep it somewhere safe — you\n * paste it into the admin tools page whenever\n * you need it.\n *\n * ─────────────────── One more EmailJS template to create ───────────────────\n * You'll need a THIRD EmailJS template (in addition to your confirmation\n * and cancellation ones) for the \"your friend just booked — here's your\n * reward\" email. Create it in EmailJS, copy its Template ID, and paste it\n * in as EMAILJS_REFERRAL_TEMPLATE_ID below (replacing the placeholder\n * \"template_referral_reward\"). It needs these merge fields: {{first_name}},\n * {{friend_name}}, {{reward_code}}, {{reward_amount}}, {{to_email}}.\n */\n\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst STRIPE_SECRET_KEY = Deno.env.get(\"STRIPE_SECRET_KEY\") || \"\";\nconst EMAILJS_PRIVATE_KEY = Deno.env.get(\"EMAILJS_PRIVATE_KEY\") || \"\";\nconst ADMIN_KEY = Deno.env.get(\"ADMIN_KEY\") || \"\";\n\n// Same EmailJS account/templates the site already uses client-side.\nconst EMAILJS_SERVICE_ID = \"service_cyo16xr\";\nconst EMAILJS_PUBLIC_KEY = \"DL65duWxLjOFYthmI\";\nconst EMAILJS_CONFIRM_TEMPLATE_ID = \"template_8mnm8mm\"; // your existing confirmation template — add {{cancel_url}} and {{discount_line}} to it, see checklist\nconst EMAILJS_CANCEL_TEMPLATE_ID = \"template_pr5rcah\"; // NEW template you'll create — see checklist for the exact fields it needs\n\nconst SITE_URL = \"https://goodmaidcleaning.com\";\nconst DISCOUNT_DOLLARS = 20; // first-clean discount, via the FIRST20 code\n\n// The promo code customers type in on the payment page. Change this\n// anytime you want a new code — just paste the updated file back in.\nconst PROMO_CODE = \"FIRST20\";\n\n// ───────────────────────── referral program ─────────────────────────\n// Every confirmed booking's own reference (e.g. \"GM-AB3XZ9\") doubles as\n// that customer's personal referral code — nothing extra to generate or\n// look up. A friend enters it as their promo code at checkout (or follows\n// a ?ref=GM-AB3XZ9 link, which the site auto-fills for them): they get\n// REFERRAL_FRIEND_DOLLARS off, checked against your own saved bookings\n// exactly like FIRST20 so it only ever works for a genuinely new customer.\n// The moment that\n// friend's booking is finalized, the referrer gets a one-time reward code\n// emailed to them automatically, worth REFERRAL_REWARD_DOLLARS off their\n// next clean — see genRewardCode()/saveRewardCode() below.\nconst REFERRAL_FRIEND_DOLLARS = 20;\nconst REFERRAL_REWARD_DOLLARS = 20;\n// NEW template you'll create in EmailJS for the \"your friend just booked —\n// here's your reward code\" email — see checklist for the exact fields it\n// needs ({{first_name}}, {{friend_name}}, {{reward_code}}, {{reward_amount}}).\nconst EMAILJS_REFERRAL_TEMPLATE_ID = \"template_referral_reward\";\n\nconst CORS_HEADERS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"POST, GET, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n};\nfunction json(data: any, status = 200) {\n return Response.json(data, { status, headers: CORS_HEADERS });\n}\n\n// ───────────────────────── booking storage (blob) ─────────────────────────\n// Each booking is saved as its own blob keyed by reference, plus a tiny\n// index blob mapping the private cancel token to that reference so the\n// cancel link never has to expose or guess a reference number.\nfunction bookingKey(reference: string) { return `booking:${reference}`; }\nfunction tokenKey(token: string) { return `token:${token}`; }\nasync function saveBooking(b: Record) {\n await blob.setJSON(bookingKey(b.reference), b);\n await blob.setJSON(tokenKey(b.cancelToken), b.reference);\n}\nasync function getBookingByReference(reference: string) {\n return await blob.getJSON(bookingKey(reference));\n}\nasync function getBookingByToken(token: string) {\n const reference = await blob.getJSON(tokenKey(token));\n if (!reference) return null;\n return await getBookingByReference(reference);\n}\n// Every \"booking:\" record, loaded at once — the same read every admin list\n// view uses. Small helper so the new-customer check and the cleaner-jobs\n// list don't each repeat this.\nasync function getAllBookings(): Promise[]> {\n const keys = await blob.list(\"booking:\");\n const bookings = await Promise.all(keys.map((k: any) => blob.getJSON(k.key)));\n return bookings.filter(Boolean) as Record[];\n}\nfunction normalizePhone(phone: string) {\n return String(phone || \"\").replace(/\\D/g, \"\");\n}\nfunction randomToken() {\n const bytes = new Uint8Array(24);\n crypto.getRandomValues(bytes);\n return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\nfunction genReference() {\n const chars = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n let ref = \"GM-\";\n for (let i = 0; i < 6; i++) ref += chars[Math.floor(Math.random() * chars.length)];\n return ref;\n}\n\n// A referrer's earned reward — one-time use, worth REFERRAL_REWARD_DOLLARS\n// off their next clean. Deliberately a different prefix (\"THANKS-\") than\n// booking references (\"GM-\") so the two code types can never collide or be\n// confused with each other when someone types one in at checkout.\nfunction rewardKey(code: string) { return `reward:${code}`; }\nasync function saveRewardCode(code: string, data: Record) {\n await blob.setJSON(rewardKey(code), data);\n}\nasync function getRewardCode(code: string) {\n return await blob.getJSON(rewardKey(code));\n}\nfunction genRewardCode() {\n const chars = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n let code = \"THANKS-\";\n for (let i = 0; i < 6; i++) code += chars[Math.floor(Math.random() * chars.length)];\n return code;\n}\n\n// ───────────────────────── Vancouver-local time math ─────────────────────────\n// Booking dates/times are always Metro Vancouver local time. This compares\n// \"now\" and \"the scheduled visit\" as plain Vancouver wall-clock, which\n// sidesteps PST/PDT daylight-saving math entirely rather than getting it\n// subtly wrong twice a year.\n// Converts any real timestamp (a Date) into \"Vancouver wall-clock, expressed\n// as if it were UTC\" — the same units scheduledWallClockMs() below uses for\n// a booking's date/time. Diffing two values in these units gives a correct\n// hour count without ever touching real UTC-offset math or DST by hand.\nfunction vancouverWallMs(d: Date) {\n const parts = new Intl.DateTimeFormat(\"en-US\", {\n timeZone: \"America/Vancouver\", hour12: false,\n year: \"numeric\", month: \"2-digit\", day: \"2-digit\",\n hour: \"2-digit\", minute: \"2-digit\", second: \"2-digit\",\n }).formatToParts(d).reduce((acc: any, p) => { acc[p.type] = p.value; return acc; }, {});\n return Date.UTC(+parts.year, +parts.month - 1, +parts.day, +parts.hour, +parts.minute, +parts.second);\n}\nfunction vancouverNowMs() { return vancouverWallMs(new Date()); }\nfunction scheduledWallClockMs(scheduledDate: string, scheduledTime24h: string) {\n const [y, m, d] = scheduledDate.split(\"-\").map(Number);\n const [hh, mm] = (scheduledTime24h || \"09:00\").split(\":\").map(Number);\n return Date.UTC(y, m - 1, d, hh, mm, 0);\n}\nfunction hoursUntil(scheduledDate: string, scheduledTime24h: string) {\n return (scheduledWallClockMs(scheduledDate, scheduledTime24h) - vancouverNowMs()) / 3600000;\n}\n\n// ───────────────────────── Stripe (raw REST) ─────────────────────────\nasync function stripeRequest(method: string, path: string, body?: Record) {\n const form = body\n ? Object.entries(body).map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(String(v))}`).join(\"&\")\n : undefined;\n const res = await fetch(`https://api.stripe.com/v1/${path}`, {\n method,\n headers: {\n Authorization: `Bearer ${STRIPE_SECRET_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: form,\n });\n const data = await res.json();\n if (!res.ok) throw new Error(data.error?.message || `Stripe ${path} failed (${res.status})`);\n return data;\n}\nasync function findOrCreateStripeCustomer(email: string, name: string) {\n if (email) {\n const list = await stripeRequest(\"GET\", `customers?email=${encodeURIComponent(email)}&limit=1`);\n if (list.data?.length) return list.data[0].id;\n }\n const created = await stripeRequest(\"POST\", \"customers\", { email: email || \"\", name: name || \"\" });\n return created.id;\n}\n// Note: there is deliberately no automatic refund function anywhere in\n// this file. Cancelling (§5-6) only ever marks a booking cancelled; the\n// admin bookings list works out and shows whether a refund is owed.\n// Issuing it is always a manual step from the Stripe dashboard\n// (Payments → find the charge → Refund).\n\n// ───────────────────────── new-customer check (local — no Jobber) ─────────────────────────\n// FIRST20 and referral codes only work for a genuinely new customer. This\n// used to ask Jobber; now it just checks your own saved bookings for a\n// non-cancelled one with a matching email or phone number. Matches the\n// same \"default to no discount on any doubt\" behavior the Jobber version\n// had, so nothing gets more generous by accident.\nasync function isNewCustomerLocally(email: string, phone: string): Promise {\n const normEmail = String(email || \"\").trim().toLowerCase();\n const normPhone = normalizePhone(phone);\n if (!normEmail && !normPhone) return true;\n const all = await getAllBookings();\n const hasExisting = all.some((b) => {\n if (b.status === \"cancelled\") return false;\n const bEmail = String(b.customerEmail || \"\").trim().toLowerCase();\n const bPhone = normalizePhone(b.customerPhone || \"\");\n return (normEmail && bEmail === normEmail) || (normPhone && bPhone === normPhone);\n });\n return !hasExisting;\n}\n\n// ───────────────────────── cleaner accounts (auth) ─────────────────────────\n// Lightweight password auth, built from Deno's own Web Crypto — no extra\n// library needed. Passwords are never stored in plain text: PBKDF2 with a\n// random salt per cleaner, same well-established approach behind most\n// small web apps' login systems.\nfunction bytesToHex(bytes: Uint8Array) {\n return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\nfunction hexToBytes(hex: string) {\n const bytes = new Uint8Array(hex.length / 2);\n for (let i = 0; i < bytes.length; i++) bytes[i] = parseInt(hex.substr(i * 2, 2), 16);\n return bytes;\n}\nasync function hashPassword(password: string, saltHex?: string) {\n const salt = saltHex ? hexToBytes(saltHex) : crypto.getRandomValues(new Uint8Array(16));\n const keyMaterial = await crypto.subtle.importKey(\"raw\", new TextEncoder().encode(password), \"PBKDF2\", false, [\"deriveBits\"]);\n const bits = await crypto.subtle.deriveBits({ name: \"PBKDF2\", salt, iterations: 100000, hash: \"SHA-256\" }, keyMaterial, 256);\n return { hash: bytesToHex(new Uint8Array(bits)), salt: bytesToHex(salt) };\n}\nasync function verifyPassword(password: string, hash: string, salt: string) {\n const check = await hashPassword(password, salt);\n return check.hash === hash;\n}\n// Short, readable temp password — Henry copies this from the admin page and\n// texts/emails it to the cleaner himself (no automated email needed, so\n// this never touches your EmailJS template limit). Avoids ambiguous\n// characters (0/O, 1/I/l) so it's easy to read back over the phone.\nfunction genTempPassword() {\n const chars = \"ABCDEFGHJKMNPQRSTUVWXYZ23456789\";\n let out = \"\";\n for (let i = 0; i < 8; i++) out += chars[Math.floor(Math.random() * chars.length)];\n return out;\n}\nfunction genCleanerId() {\n const bytes = new Uint8Array(8);\n crypto.getRandomValues(bytes);\n return \"cln_\" + bytesToHex(bytes);\n}\nfunction cleanerKey(id: string) { return `cleaner:${id}`; }\nfunction cleanerEmailKey(email: string) { return `cleaneremail:${String(email).trim().toLowerCase()}`; }\nfunction cleanerSessionKey(token: string) { return `cleanersession:${token}`; }\nconst CLEANER_SESSION_DAYS = 60;\n\nasync function saveCleaner(c: Record) {\n await blob.setJSON(cleanerKey(c.id), c);\n await blob.setJSON(cleanerEmailKey(c.email), c.id);\n}\nasync function getCleanerById(id: string) {\n return await blob.getJSON(cleanerKey(id));\n}\nasync function getCleanerByEmail(email: string) {\n const id = await blob.getJSON(cleanerEmailKey(email));\n if (!id) return null;\n return await getCleanerById(id);\n}\nasync function createCleanerSession(cleanerId: string) {\n const token = randomToken();\n const expiresAt = new Date(Date.now() + CLEANER_SESSION_DAYS * 86400000).toISOString();\n await blob.setJSON(cleanerSessionKey(token), { cleanerId, expiresAt });\n return token;\n}\n// Returns the logged-in cleaner's record, or null if the token is missing,\n// unknown, expired, or the account's been deactivated in the meantime.\nasync function getCleanerFromToken(token: string) {\n if (!token) return null;\n const session = await blob.getJSON(cleanerSessionKey(token));\n if (!session) return null;\n if (new Date(session.expiresAt).getTime() < Date.now()) return null;\n const cleaner = await getCleanerById(session.cleanerId);\n if (!cleaner || cleaner.active === false) return null;\n return cleaner;\n}\nfunction cleanerPublicView(c: Record) {\n return { id: c.id, name: c.name, email: c.email, phone: c.phone, active: c.active !== false, createdAt: c.createdAt };\n}\n\n// ───────────────────────── Email (EmailJS REST) ─────────────────────────\nasync function sendEmail(templateId: string, toEmail: string, params: Record) {\n if (!toEmail) return;\n try {\n const res = await fetch(\"https://api.emailjs.com/api/v1.0/email/send\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n service_id: EMAILJS_SERVICE_ID,\n template_id: templateId,\n user_id: EMAILJS_PUBLIC_KEY,\n accessToken: EMAILJS_PRIVATE_KEY,\n template_params: { to_email: toEmail, ...params },\n }),\n });\n if (!res.ok) console.log(\"EmailJS send failed:\", res.status, await res.text());\n } catch (err: any) {\n console.log(\"EmailJS send threw:\", err.message || String(err));\n }\n}\n\n// A plain-text fallback straight to Henry's inbox via FormSubmit — not\n// currently called by anything below, but kept here ready to use for any\n// future \"something went wrong, tell Henry directly\" alert.\nasync function alertHenry(subject: string, lines: Record) {\n try {\n const fd = new FormData();\n fd.set(\"_subject\", subject);\n Object.entries(lines).forEach(([k, v]) => fd.set(k, v));\n await fetch(\"https://formsubmit.co/ajax/ee6b06d638357bffe3e89c2579084290\", {\n method: \"POST\",\n headers: { Accept: \"application/json\" },\n body: fd,\n });\n } catch (err: any) {\n console.log(\"alertHenry failed:\", err.message || String(err));\n }\n}\n\n// ───────────────────────── §1–3: price + charge ─────────────────────────\n// Default POST body: { basePrice, name, email, phone, address, reference?, promoCode? }\n//\n// The discount is NEVER automatic anymore. It only applies when a promo\n// code is sent here as `promoCode` — either the customer typed one in, or\n// the site auto-filled it from a referral link. There are three kinds of\n// code, told apart by their shape:\n// FIRST20 — the general first-clean code, requires a genuinely\n// new customer (checked against your own saved\n// bookings — the browser can't skip or fake this).\n// GM-XXXXXX — someone's own booking reference, shared as a referral\n// code/link. Same \"must be a genuinely new customer\"\n// check as FIRST20 — which also means the referrer\n// can't just reuse their own code on themselves.\n// THANKS-XXXXXX — a reward code a referrer already earned (see\n// handleFinalize below). No new-customer check here —\n// by definition they're already a customer — it just\n// has to be a real, unused reward.\nasync function handlePrice(req: Request) {\n const body = await req.json();\n const basePrice = Math.round(Number(body.basePrice) * 100) / 100;\n if (!basePrice || basePrice <= 0) return json({ error: \"Missing or invalid amount.\" }, 400);\n\n const promoCode = String(body.promoCode || \"\").trim();\n const upper = promoCode.toUpperCase();\n let discount = 0;\n let promoApplied = false;\n let promoError = \"\";\n let referralCode = \"\"; // set when a FRIEND is redeeming someone else's referral code\n let rewardCode = \"\"; // set when a REFERRER is redeeming their own earned reward\n\n async function checkNewCustomer(): Promise {\n try {\n return await isNewCustomerLocally(body.email || \"\", body.phone || \"\");\n } catch (err: any) {\n console.log(\"Eligibility check failed, defaulting to no discount:\", err.message || String(err));\n return false;\n }\n }\n const NOT_FIRST_TIME_ERROR = \"This code is for first-time customers only — looks like you've already got a booking with us on file.\";\n\n if (promoCode) {\n if (upper === PROMO_CODE.toUpperCase()) {\n if (await checkNewCustomer()) { discount = DISCOUNT_DOLLARS; promoApplied = true; }\n else promoError = NOT_FIRST_TIME_ERROR;\n\n } else if (upper.startsWith(\"THANKS-\")) {\n const reward = await getRewardCode(upper);\n if (!reward) promoError = \"That code isn't valid.\";\n else if (reward.used) promoError = \"That code has already been used.\";\n else { discount = Number(reward.amount) || REFERRAL_REWARD_DOLLARS; promoApplied = true; rewardCode = upper; }\n\n } else if (upper.startsWith(\"GM-\")) {\n const referrerBooking = await getBookingByReference(upper);\n if (!referrerBooking || referrerBooking.status === \"cancelled\") {\n promoError = \"That code isn't valid.\";\n } else if (await checkNewCustomer()) {\n discount = REFERRAL_FRIEND_DOLLARS; promoApplied = true; referralCode = upper;\n } else {\n promoError = NOT_FIRST_TIME_ERROR;\n }\n\n } else {\n promoError = \"That code isn't valid.\";\n }\n }\n\n const finalPrice = Math.max(0, basePrice - discount);\n const reference = body.reference || genReference();\n\n const customerId = await findOrCreateStripeCustomer(body.email || \"\", body.name || \"\");\n const intent = await stripeRequest(\"POST\", \"payment_intents\", {\n amount: String(Math.round(finalPrice * 100)),\n currency: \"cad\",\n customer: customerId,\n \"payment_method_types[]\": \"card\",\n setup_future_usage: \"off_session\", // keeps the card on file for a possible add-on charge later (§7)\n description: `Good Maid Cleaning booking ${reference}`,\n receipt_email: body.email || \"\",\n \"metadata[reference]\": reference,\n \"metadata[discount]\": String(discount),\n \"metadata[referralCode]\": referralCode,\n \"metadata[rewardCode]\": rewardCode,\n });\n\n return json({ clientSecret: intent.client_secret, reference, basePrice, discount, finalPrice, promoApplied, promoError });\n}\n\n// ───────────────────────── §1–4: finalize after a successful charge ─────────────────────────\n// Body: { paymentIntentId, reference, booking: { ...contact + service details } }\nasync function handleFinalize(req: Request) {\n const body = await req.json();\n const { paymentIntentId, booking } = body;\n if (!paymentIntentId || !booking) return json({ error: \"Missing paymentIntentId or booking.\" }, 400);\n\n // Never trust the browser's word that a charge went through — ask Stripe.\n const intent = await stripeRequest(\"GET\", `payment_intents/${paymentIntentId}`);\n if (intent.status !== \"succeeded\") {\n return json({ error: \"Payment has not succeeded — booking was not created.\" }, 402);\n }\n\n const reference = intent.metadata?.reference || body.reference || genReference();\n const discount = Number(intent.metadata?.discount || 0);\n const referralCode = intent.metadata?.referralCode || \"\";\n const rewardCode = intent.metadata?.rewardCode || \"\";\n const finalPrice = intent.amount_received / 100;\n const cancelToken = randomToken();\n\n const record = {\n reference, cancelToken, status: \"confirmed\",\n customerName: booking.name || \"\", customerEmail: booking.email || \"\", customerPhone: booking.phone || \"\",\n address: booking.address || \"\", unit: booking.unit || \"\", city: booking.city || \"\", postal: booking.postal || \"\",\n serviceLabel: booking.serviceLabel || \"\", dateLabel: booking.dateLabel || \"\", timeLabel: booking.timeLabel || \"\",\n scheduledDate: booking.scheduledDate, scheduledTime24h: booking.scheduledTime24h,\n entryInstructions: booking.entryInstructions || \"\", specialNotes: booking.specialNotes || \"\",\n basePriceCents: intent.amount_received + Math.round(discount * 100), discountCents: Math.round(discount * 100), finalPriceCents: intent.amount_received,\n stripePaymentIntentId: paymentIntentId, stripeCustomerId: intent.customer, stripePaymentMethodId: intent.payment_method,\n assignedCleanerId: null, assignedCleanerName: null,\n refunded: false,\n referredBy: referralCode || null, // the referrer's code, if this booking came from one — just for your own records\n createdAt: new Date().toISOString(), cancelledAt: null,\n };\n await saveBooking(record);\n\n // A reward code just got spent (a referrer redeeming their own earned\n // discount) — mark it used right here, only once payment is genuinely\n // confirmed, so it can never be redeemed a second time.\n if (rewardCode) {\n const reward = await getRewardCode(rewardCode);\n if (reward) {\n reward.used = true;\n reward.usedAt = new Date().toISOString();\n reward.usedByReference = reference;\n await saveRewardCode(rewardCode, reward);\n }\n }\n\n // This booking was made using someone ELSE's referral code — a real,\n // verified new customer just booked because of them. Mint that referrer\n // a fresh one-time reward code for their own next clean and email it to\n // them automatically, no action needed from Henry.\n if (referralCode) {\n const referrerBooking = await getBookingByReference(referralCode);\n if (referrerBooking?.customerEmail) {\n const newReward = genRewardCode();\n await saveRewardCode(newReward, {\n email: referrerBooking.customerEmail,\n amount: REFERRAL_REWARD_DOLLARS,\n used: false,\n earnedFromReference: reference,\n createdAt: new Date().toISOString(),\n });\n await sendEmail(EMAILJS_REFERRAL_TEMPLATE_ID, referrerBooking.customerEmail, {\n first_name: (referrerBooking.customerName || \"\").trim().split(/\\s+/)[0] || \"there\",\n friend_name: (booking.name || \"\").trim().split(/\\s+/)[0] || \"Your friend\",\n reward_code: newReward,\n reward_amount: REFERRAL_REWARD_DOLLARS.toFixed(2),\n });\n }\n }\n\n const discountLine = discount <= 0 ? \"\"\n : referralCode ? `Includes a $${discount.toFixed(2)} referral discount.`\n : rewardCode ? `Includes a $${discount.toFixed(2)} referral reward.`\n : `Includes a $${discount.toFixed(2)} first-clean discount.`;\n\n const cancelUrl = `${SITE_URL}/manage.html?t=${cancelToken}`;\n await sendEmail(EMAILJS_CONFIRM_TEMPLATE_ID, booking.email, {\n first_name: (booking.name || \"\").trim().split(/\\s+/)[0] || \"there\",\n reference,\n service: booking.serviceLabel,\n date: booking.dateLabel,\n time: booking.timeLabel,\n address: `${booking.address || \"\"}${booking.unit ? \" #\" + booking.unit : \"\"}, ${booking.city || \"\"}`,\n price: finalPrice.toFixed(2),\n discount_line: discountLine,\n referral_code: reference,\n cancel_url: cancelUrl,\n });\n\n return json({ reference, cancelUrl });\n}\n\n// ───────────────────────── §5–6: look up a booking — by its cancel link, or by Henry looking up a reference ─────────────────────────\n// Two ways in, same response shape: the customer's self-serve link supplies\n// ?t= (proves it's their booking without any login); Henry's admin\n// tools page supplies ?ref=&adminKey= instead, so he can\n// pull up a caller's exact booking by their confirmation number before\n// cancelling it or adding a charge (§6/§7).\nasync function handleManage(req: Request) {\n const params = new URL(req.url).searchParams;\n const token = params.get(\"t\");\n const reference = params.get(\"ref\");\n const adminKey = params.get(\"adminKey\");\n\n let b: Record | null = null;\n if (token) {\n b = await getBookingByToken(token);\n } else if (reference && adminKey) {\n if (adminKey !== ADMIN_KEY) return json({ error: \"Not authorized.\" }, 401);\n b = await getBookingByReference(reference);\n } else {\n return json({ error: \"Provide a token, or a reference + adminKey.\" }, 400);\n }\n if (!b) return json({ error: \"We couldn't find that booking.\" }, 404);\n\n const hrs = hoursUntil(b.scheduledDate, b.scheduledTime24h);\n return json({\n reference: b.reference, status: b.status,\n customerName: b.customerName, customerEmail: b.customerEmail, customerPhone: b.customerPhone,\n serviceLabel: b.serviceLabel, dateLabel: b.dateLabel, timeLabel: b.timeLabel,\n address: `${b.address}${b.unit ? \" #\" + b.unit : \"\"}, ${b.city}`,\n price: (b.finalPriceCents / 100).toFixed(2),\n refunded: !!b.refunded,\n hoursUntil: hrs,\n hasCardOnFile: !!(b.stripeCustomerId && b.stripePaymentMethodId),\n entryInstructions: b.entryInstructions || \"\",\n specialNotes: b.specialNotes || \"\",\n assignedCleanerId: b.assignedCleanerId || null,\n assignedCleanerName: b.assignedCleanerName || null,\n // For the admin tools detail view's \"booked on / cancelled on\" timeline\n // and its \"open in Maps\" link. Harmless to also return on the\n // customer-facing manage link — nothing sensitive here.\n createdAt: b.createdAt || null,\n cancelledAt: b.cancelledAt || null,\n rawAddress: `${b.address || \"\"}${b.unit ? \" #\" + b.unit : \"\"}, ${b.city || \"\"}, BC`,\n });\n}\n\n// ───────────────────────── §5–6: cancellation — the ONE shared code path ─────────────────────────\n// Used by both the customer's self-serve link and Henry's phone/email\n// fallback. Cancelling just marks the booking cancelled here — it never\n// touches Stripe. Refunds are a deliberate, manual decision: if a customer\n// follows up asking for their money back, refund them by hand from the\n// Stripe dashboard (Payments → find the charge → Refund), then optionally\n// mark them refunded with the admin tools page so the record here matches.\nasync function performCancellation(b: Record) {\n if (b.status === \"cancelled\") return { alreadyCancelled: true, refunded: !!b.refunded };\n\n b.status = \"cancelled\";\n b.cancelledAt = new Date().toISOString();\n await saveBooking(b);\n\n await sendEmail(EMAILJS_CANCEL_TEMPLATE_ID, b.customerEmail, {\n first_name: (b.customerName || \"\").trim().split(/\\s+/)[0] || \"there\",\n reference: b.reference,\n service: b.serviceLabel,\n date: b.dateLabel,\n time: b.timeLabel,\n price: (b.finalPriceCents / 100).toFixed(2),\n });\n\n return { alreadyCancelled: false, refunded: !!b.refunded };\n}\n\n// Body: EITHER { token } for the self-serve link, OR\n// { reference, adminKey } for Henry's phone/email fallback (§6).\nasync function handleCancel(req: Request) {\n const body = await req.json();\n let b: Record | null = null;\n\n if (body.token) {\n b = await getBookingByToken(body.token);\n } else if (body.reference && body.adminKey) {\n if (body.adminKey !== ADMIN_KEY) return json({ error: \"Not authorized.\" }, 401);\n b = await getBookingByReference(body.reference);\n } else {\n return json({ error: \"Provide a token, or a reference + adminKey.\" }, 400);\n }\n if (!b) return json({ error: \"We couldn't find that booking.\" }, 404);\n\n const outcome = await performCancellation(b);\n return json(outcome);\n}\n\n// ───────────────────────── §7: add-on charge (Henry only) ─────────────────────────\n// Body: { reference, adminKey, amount, description }\nasync function handleAddon(req: Request) {\n const body = await req.json();\n if (body.adminKey !== ADMIN_KEY) return json({ error: \"Not authorized.\" }, 401);\n const amountCents = Math.round(Number(body.amount) * 100);\n if (!amountCents || amountCents <= 0) return json({ error: \"Invalid amount.\" }, 400);\n\n const b = await getBookingByReference(body.reference);\n if (!b) return json({ error: \"We couldn't find that booking.\" }, 404);\n if (!b.stripeCustomerId || !b.stripePaymentMethodId) {\n return json({ error: \"No card on file for this booking — ask the customer for a new card instead.\" }, 400);\n }\n\n try {\n const intent = await stripeRequest(\"POST\", \"payment_intents\", {\n amount: String(amountCents),\n currency: \"cad\",\n customer: b.stripeCustomerId,\n payment_method: b.stripePaymentMethodId,\n off_session: \"true\",\n confirm: \"true\",\n description: body.description || `Add-on charge for booking ${b.reference}`,\n });\n return json({ success: intent.status === \"succeeded\", status: intent.status });\n } catch (err: any) {\n return json({ error: `Charge failed: ${err.message} — the card on file may need the customer to provide a new one.` }, 402);\n }\n}\n\n// ───────────────────────── §8: mark a booking refunded (record-keeping only) ─────────────────────────\n// Cancelling never touches Stripe (see §5–6 above) — refunds are always a\n// manual decision made by hand in the Stripe dashboard. This endpoint does\n// NOT issue a refund; it just updates this booking's own record to say one\n// was given, once Henry has actually done it in Stripe, so the admin tools\n// page shows the right thing next time this booking is looked up.\n// Body: { reference, adminKey }\nasync function handleMarkRefunded(req: Request) {\n const body = await req.json();\n if (body.adminKey !== ADMIN_KEY) return json({ error: \"Not authorized.\" }, 401);\n const b = await getBookingByReference(body.reference);\n if (!b) return json({ error: \"We couldn't find that booking.\" }, 404);\n b.refunded = true;\n await saveBooking(b);\n return json({ success: true, refunded: true });\n}\n\n// ───────────────────────── §9: list all bookings (admin) ─────────────────────────\n// Powers the \"All bookings\" view in admin tools — a read-only list of every\n// saved booking, newest first, so Henry can see everything at a glance\n// instead of looking each one up by reference number one at a time.\nasync function handleListBookings(req: Request) {\n const params = new URL(req.url).searchParams;\n const adminKey = params.get(\"adminKey\");\n if (adminKey !== ADMIN_KEY) return json({ error: \"Not authorized.\" }, 401);\n\n // Only \"booking:\" keys are real bookings — the \"token:\" blobs are just an\n // internal lookup index pointing at those same records, so listing this\n // one prefix is all that's needed.\n const keys = await blob.list(\"booking:\");\n const bookings = await Promise.all(keys.map((k: any) => blob.getJSON(k.key)));\n\n const list = bookings\n .filter(Boolean)\n .map((b: any) => {\n // Was this cancelled with 24+ hours' notice? Computed from the\n // moment it was actually cancelled, not \"now\" — a booking cancelled\n // last month for a visit that was scheduled next week still correctly\n // shows as \"refund owed\" today. Only meaningful for cancelled,\n // not-yet-refunded bookings.\n let refundOwed = false;\n if (b.status === \"cancelled\" && !b.refunded && b.scheduledDate && b.cancelledAt) {\n const scheduledMs = scheduledWallClockMs(b.scheduledDate, b.scheduledTime24h || \"09:00\");\n const cancelledMs = vancouverWallMs(new Date(b.cancelledAt));\n refundOwed = (scheduledMs - cancelledMs) / 3600000 >= 24;\n }\n return {\n reference: b.reference,\n status: b.status,\n customerName: b.customerName || \"\",\n customerEmail: b.customerEmail || \"\",\n customerPhone: b.customerPhone || \"\",\n serviceLabel: b.serviceLabel || \"\",\n dateLabel: b.dateLabel || \"\",\n timeLabel: b.timeLabel || \"\",\n scheduledDate: b.scheduledDate || \"\",\n scheduledTime24h: b.scheduledTime24h || \"\",\n city: b.city || \"\",\n address: b.address || \"\", unit: b.unit || \"\",\n price: ((b.finalPriceCents || 0) / 100).toFixed(2),\n refunded: !!b.refunded,\n refundOwed,\n entryInstructions: b.entryInstructions || \"\",\n specialNotes: b.specialNotes || \"\",\n assignedCleanerId: b.assignedCleanerId || null,\n assignedCleanerName: b.assignedCleanerName || null,\n createdAt: b.createdAt || \"\",\n cancelledAt: b.cancelledAt || null,\n };\n })\n // Newest-created first.\n .sort((a: any, b: any) => (b.createdAt || \"\").localeCompare(a.createdAt || \"\"));\n\n return json({ bookings: list });\n}\n\n// ───────────────────────── §10: delete bookings (admin) ─────────────────────────\n// Real deletes — these permanently remove blob records with no undo. Only\n// ever reachable with the admin key. Deleting a booking here does NOT touch\n// Stripe (any real charge stays on your Stripe dashboard exactly as it is —\n// this only clears our own records of it).\nasync function handleDeleteBooking(req: Request) {\n const body = await req.json();\n if (body.adminKey !== ADMIN_KEY) return json({ error: \"Not authorized.\" }, 401);\n const b = await getBookingByReference(body.reference);\n if (!b) return json({ error: \"We couldn't find that booking.\" }, 404);\n await blob.delete(bookingKey(b.reference));\n if (b.cancelToken) await blob.delete(tokenKey(b.cancelToken));\n return json({ success: true, deleted: b.reference });\n}\n\n// Wipes every booking record in one go (plus their token index blobs and\n// every referral reward code, since those were only ever minted from these\n// same test bookings). Meant for clearing out test data before a real\n// launch — there's no way to undo this, so admin_tools.html makes the\n// person type a confirmation phrase before it ever calls this.\nasync function handleDeleteAllBookings(req: Request) {\n const body = await req.json();\n if (body.adminKey !== ADMIN_KEY) return json({ error: \"Not authorized.\" }, 401);\n\n const bookingKeys = await blob.list(\"booking:\");\n const bookings = await Promise.all(bookingKeys.map((k: any) => blob.getJSON(k.key)));\n\n let count = 0;\n for (const b of bookings) {\n if (!b) continue;\n await blob.delete(bookingKey(b.reference));\n if (b.cancelToken) await blob.delete(tokenKey(b.cancelToken));\n count++;\n }\n\n const rewardKeys = await blob.list(\"reward:\");\n for (const k of rewardKeys as any[]) {\n await blob.delete(k.key);\n }\n\n return json({ success: true, deletedBookings: count, deletedRewardCodes: rewardKeys.length });\n}\n\n// ───────────────────────── §11: cleaner accounts (admin-managed) ─────────────────────────\n// Henry adds each cleaner by name/email/phone from the admin tools page.\n// This mints a random temp password, saves the account, and hands the temp\n// password back ONCE in the response — it is never stored in plain text and\n// never emailed automatically (see the file-header note on EmailJS's\n// template limit). Henry copies it from the admin page and texts/tells it\n// to the cleaner himself; they're prompted to set their own password the\n// first time they log in to the cleaner portal (handleCleanerSetPassword).\n// Body: { adminKey, name, email, phone }\nasync function handleCleanerCreate(req: Request) {\n const body = await req.json();\n if (body.adminKey !== ADMIN_KEY) return json({ error: \"Not authorized.\" }, 401);\n const name = String(body.name || \"\").trim();\n const email = String(body.email || \"\").trim().toLowerCase();\n const phone = String(body.phone || \"\").trim();\n if (!name || !email) return json({ error: \"Name and email are required.\" }, 400);\n\n const existing = await getCleanerByEmail(email);\n if (existing) return json({ error: \"A cleaner with that email already exists.\" }, 400);\n\n const tempPassword = genTempPassword();\n const { hash, salt } = await hashPassword(tempPassword);\n const cleaner = {\n id: genCleanerId(), name, email, phone,\n passwordHash: hash, passwordSalt: salt,\n mustChangePassword: true, active: true,\n createdAt: new Date().toISOString(),\n };\n await saveCleaner(cleaner);\n return json({ success: true, cleanerId: cleaner.id, tempPassword });\n}\n\n// Read-only list for the admin tools page's Cleaners section and its\n// \"assign a cleaner to this booking\" dropdown. Never returns password data.\nasync function handleCleanerList(req: Request) {\n const params = new URL(req.url).searchParams;\n if (params.get(\"adminKey\") !== ADMIN_KEY) return json({ error: \"Not authorized.\" }, 401);\n const keys = await blob.list(\"cleaner:\");\n const cleaners = await Promise.all(keys.map((k: any) => blob.getJSON(k.key)));\n const list = cleaners.filter(Boolean).map(cleanerPublicView)\n .sort((a: any, b: any) => (a.name || \"\").localeCompare(b.name || \"\"));\n return json({ cleaners: list });\n}\n\n// Toggle a cleaner active/inactive rather than deleting them, so their name\n// stays attached to past jobs in the record — an inactive cleaner just\n// can't log in or be assigned new jobs.\n// Body: { adminKey, cleanerId, active }\nasync function handleCleanerSetActive(req: Request) {\n const body = await req.json();\n if (body.adminKey !== ADMIN_KEY) return json({ error: \"Not authorized.\" }, 401);\n const cleaner = await getCleanerById(body.cleanerId);\n if (!cleaner) return json({ error: \"We couldn't find that cleaner.\" }, 404);\n cleaner.active = !!body.active;\n await saveCleaner(cleaner);\n return json({ success: true, active: cleaner.active });\n}\n\n// Mints a fresh temp password for a cleaner who forgot theirs — same\n// \"shown once, relayed by hand\" pattern as creating one.\n// Body: { adminKey, cleanerId }\nasync function handleCleanerResetPassword(req: Request) {\n const body = await req.json();\n if (body.adminKey !== ADMIN_KEY) return json({ error: \"Not authorized.\" }, 401);\n const cleaner = await getCleanerById(body.cleanerId);\n if (!cleaner) return json({ error: \"We couldn't find that cleaner.\" }, 404);\n const tempPassword = genTempPassword();\n const { hash, salt } = await hashPassword(tempPassword);\n cleaner.passwordHash = hash;\n cleaner.passwordSalt = salt;\n cleaner.mustChangePassword = true;\n await saveCleaner(cleaner);\n return json({ success: true, tempPassword });\n}\n\n// Assigns (or un-assigns, with an empty cleanerId) a cleaner to a booking —\n// this is what makes the job show up on that cleaner's portal job list.\n// Body: { adminKey, reference, cleanerId }\nasync function handleAssignCleaner(req: Request) {\n const body = await req.json();\n if (body.adminKey !== ADMIN_KEY) return json({ error: \"Not authorized.\" }, 401);\n const b = await getBookingByReference(body.reference);\n if (!b) return json({ error: \"We couldn't find that booking.\" }, 404);\n\n if (!body.cleanerId) {\n b.assignedCleanerId = null;\n b.assignedCleanerName = null;\n } else {\n const cleaner = await getCleanerById(body.cleanerId);\n if (!cleaner) return json({ error: \"We couldn't find that cleaner.\" }, 404);\n b.assignedCleanerId = cleaner.id;\n b.assignedCleanerName = cleaner.name;\n }\n await saveBooking(b);\n return json({ success: true, assignedCleanerId: b.assignedCleanerId, assignedCleanerName: b.assignedCleanerName });\n}\n\n// ───────────────────────── §11: cleaner portal (cleaner-facing) ─────────────────────────\n// Everything below is called from cleaner_portal.html, never from the main\n// booking site or admin tools. Sessions are a random opaque token (same\n// shape as a cancel token), good for 60 days, stored client-side the same\n// way admin tools stores its admin key.\n// Body: { email, password }\nasync function handleCleanerLogin(req: Request) {\n const body = await req.json();\n const email = String(body.email || \"\").trim().toLowerCase();\n const password = String(body.password || \"\");\n if (!email || !password) return json({ error: \"Enter your email and password.\" }, 400);\n\n const cleaner = await getCleanerByEmail(email);\n if (!cleaner || cleaner.active === false) return json({ error: \"That email and password don't match an active account.\" }, 401);\n const ok = await verifyPassword(password, cleaner.passwordHash, cleaner.passwordSalt);\n if (!ok) return json({ error: \"That email and password don't match an active account.\" }, 401);\n\n const token = await createCleanerSession(cleaner.id);\n return json({ success: true, token, mustChangePassword: !!cleaner.mustChangePassword, name: cleaner.name });\n}\n\n// Lets a cleaner set their own password — required the first time they log\n// in with a temp password, and available any time after from a \"change\n// password\" link in the portal.\n// Body: { token, newPassword }\nasync function handleCleanerSetPassword(req: Request) {\n const body = await req.json();\n const cleaner = await getCleanerFromToken(body.token);\n if (!cleaner) return json({ error: \"Your session has expired — please log in again.\" }, 401);\n const newPassword = String(body.newPassword || \"\");\n if (newPassword.length < 6) return json({ error: \"Please choose a password at least 6 characters long.\" }, 400);\n\n const { hash, salt } = await hashPassword(newPassword);\n cleaner.passwordHash = hash;\n cleaner.passwordSalt = salt;\n cleaner.mustChangePassword = false;\n await saveCleaner(cleaner);\n return json({ success: true });\n}\n\n// Body: { token }\nasync function handleCleanerLogout(req: Request) {\n const body = await req.json();\n if (body.token) await blob.delete(cleanerSessionKey(body.token));\n return json({ success: true });\n}\n\n// A cleaner's own upcoming jobs — everything they need to do the job and\n// nothing they don't: no pricing, no payment info, no other cleaners' jobs.\n// Sorted soonest-first; past/cancelled jobs are left out so the portal\n// always just shows \"what's next.\"\nasync function handleCleanerMyJobs(req: Request) {\n const params = new URL(req.url).searchParams;\n const cleaner = await getCleanerFromToken(params.get(\"token\") || \"\");\n if (!cleaner) return json({ error: \"Your session has expired — please log in again.\" }, 401);\n\n const all = await getAllBookings();\n const todayWall = vancouverNowMs();\n const jobs = all\n .filter((b) => b.assignedCleanerId === cleaner.id && b.status !== \"cancelled\")\n .filter((b) => scheduledWallClockMs(b.scheduledDate, b.scheduledTime24h || \"09:00\") >= todayWall - 6 * 3600000) // keep today's job visible even a few hours after start\n .map((b) => ({\n reference: b.reference,\n customerName: b.customerName || \"\",\n customerPhone: b.customerPhone || \"\",\n address: `${b.address || \"\"}${b.unit ? \" #\" + b.unit : \"\"}`,\n city: b.city || \"\",\n rawAddress: `${b.address || \"\"}${b.unit ? \" #\" + b.unit : \"\"}, ${b.city || \"\"}, BC`,\n serviceLabel: b.serviceLabel || \"\",\n dateLabel: b.dateLabel || \"\",\n timeLabel: b.timeLabel || \"\",\n scheduledDate: b.scheduledDate || \"\",\n scheduledTime24h: b.scheduledTime24h || \"\",\n entryInstructions: b.entryInstructions || \"\",\n specialNotes: b.specialNotes || \"\",\n }))\n .sort((a, b) => (a.scheduledDate + a.scheduledTime24h).localeCompare(b.scheduledDate + b.scheduledTime24h));\n\n return json({ name: cleaner.name, jobs });\n}\n\n// ───────────────────────── router ─────────────────────────\nexport default async function (req: Request): Promise {\n if (req.method === \"OPTIONS\") return new Response(null, { headers: CORS_HEADERS });\n if (!STRIPE_SECRET_KEY) return json({ error: \"STRIPE_SECRET_KEY isn't set. Add it under this val's Env Variables.\" }, 500);\n\n const url = new URL(req.url);\n const path = url.pathname.replace(/\\/$/, \"\");\n\n try {\n if (req.method === \"GET\" && path === \"/manage\") return await handleManage(req);\n if (req.method === \"GET\" && path === \"/bookings\") return await handleListBookings(req);\n if (req.method === \"GET\" && path === \"/cleaners\") return await handleCleanerList(req);\n if (req.method === \"GET\" && path === \"/cleaner/jobs\") return await handleCleanerMyJobs(req);\n if (req.method === \"POST\") {\n const clone = req.clone();\n const body = await clone.json().catch(() => ({}));\n if (body.action === \"finalize\") return await handleFinalize(req);\n if (body.action === \"cancel\") return await handleCancel(req);\n if (body.action === \"addon\") return await handleAddon(req);\n if (body.action === \"markRefunded\") return await handleMarkRefunded(req);\n if (body.action === \"deleteBooking\") return await handleDeleteBooking(req);\n if (body.action === \"deleteAllBookings\") return await handleDeleteAllBookings(req);\n if (body.action === \"cleanerCreate\") return await handleCleanerCreate(req);\n if (body.action === \"cleanerSetActive\") return await handleCleanerSetActive(req);\n if (body.action === \"cleanerResetPassword\") return await handleCleanerResetPassword(req);\n if (body.action === \"assignCleaner\") return await handleAssignCleaner(req);\n if (body.action === \"cleanerLogin\") return await handleCleanerLogin(req);\n if (body.action === \"cleanerSetPassword\") return await handleCleanerSetPassword(req);\n if (body.action === \"cleanerLogout\") return await handleCleanerLogout(req);\n // No action — this is the original \"start a payment\" behavior.\n return await handlePrice(req);\n }\n return new Response(\n \"Good Maid Cleaning — payment + booking relay. Your website POSTs booking details here.\",\n { headers: { \"Content-Type\": \"text/plain\", ...CORS_HEADERS } },\n );\n } catch (err: any) {\n console.log(\"Relay error:\", err.message || String(err));\n return json({ error: err.message || String(err) }, 500);\n }\n}","/**\n * Good Maid Cleaning — payment + booking relay\n * --------------------------------------------------\n * Jobber is no longer part of this system at all — everything Jobber used\n * to do (hold the schedule, tell you if someone's a new customer, host\n * your cleaners' job list) now lives right here in this file and in your\n * admin tools page. You can ignore/delete the old Jobber relay val; nothing\n * calls out to it anymore.\n *\n * What it does, in order, on a normal booking:\n * 1. Checkout asks this file \"what would this actually cost?\" — it checks\n * your OWN saved bookings for a matching email/phone (returning\n * customer = no discount), then starts a real Stripe charge for the\n * real final amount. The card is captured immediately once confirmed\n * — never held-and-authorized.\n * 2. Once Stripe confirms the charge succeeded, checkout calls this file\n * again to \"finalize\": a permanent record of the booking gets saved\n * here (this IS the schedule now — no separate system to sync with),\n * and the confirmation email (with the cancel link) goes out.\n * 3. The manage/cancel page on your site calls back here to look up a\n * booking and, if asked, cancel it. It never refunds automatically.\n * Refunds are a manual call: if a cancelled customer follows up\n * asking for their money back, refund them by hand from the Stripe\n * dashboard (Payments → find the charge → Refund).\n * 4. Referrals: every booking's own reference doubles as that customer's\n * referral code. If a NEW customer checks out using someone else's\n * code, they get $20 off (step 1, same \"genuinely new\" check as\n * FIRST20) — and the moment their booking is finalized (step 2), the\n * referrer automatically gets emailed a one-time $20 reward code for\n * their own next clean. See the \"referral program\" block below.\n * 5. Cleaners: you (the admin) assign a cleaner to each booking from the\n * admin tools page. Each cleaner has their own account on the new\n * cleaner portal page (cleaner_portal.html) where they log in and see\n * only their own upcoming jobs — address, time, customer contact, and\n * any entry instructions/special requests the customer left at\n * booking. See §11.\n *\n * You should not need to understand this file. Paste it in over your\n * existing relay val, add the Env Variables listed below, and you're done\n * — the address stays the same.\n *\n * ───────────────────────── Env Variables to add ─────────────────────────\n * STRIPE_SECRET_KEY — already set from before, leave as-is.\n * EMAILJS_PRIVATE_KEY — EmailJS → Account → API Keys → \"Private Key\".\n * You'll need to turn on \"Allow API calls from\n * non-browser applications\" there too — EmailJS\n * blocks server-to-server sends without it.\n * ADMIN_KEY — make up any private password-like string.\n * This protects every admin-only endpoint (the\n * add-on charge tool, deleting bookings, adding\n * cleaners, assigning jobs) so a stranger can't\n * do any of that. Keep it somewhere safe — you\n * paste it into the admin tools page whenever\n * you need it.\n *\n * ─────────────────── One more EmailJS template to create ───────────────────\n * You'll need a THIRD EmailJS template (in addition to your confirmation\n * and cancellation ones) for the \"your friend just booked — here's your\n * reward\" email. Create it in EmailJS, copy its Template ID, and paste it\n * in as EMAILJS_REFERRAL_TEMPLATE_ID below (replacing the placeholder\n * \"template_referral_reward\"). It needs these merge fields: {{first_name}},\n * {{friend_name}}, {{reward_code}}, {{reward_amount}}, {{to_email}}.\n */\n\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst STRIPE_SECRET_KEY = Deno.env.get(\"STRIPE_SECRET_KEY\") || \"\";\nconst EMAILJS_PRIVATE_KEY = Deno.env.get(\"EMAILJS_PRIVATE_KEY\") || \"\";\nconst ADMIN_KEY = Deno.env.get(\"ADMIN_KEY\") || \"\";\n\n// Same EmailJS account/templates the site already uses client-side.\nconst EMAILJS_SERVICE_ID = \"service_cyo16xr\";\nconst EMAILJS_PUBLIC_KEY = \"DL65duWxLjOFYthmI\";\nconst EMAILJS_CONFIRM_TEMPLATE_ID = \"template_8mnm8mm\"; // your existing confirmation template — add {{cancel_url}} and {{discount_line}} to it, see checklist\nconst EMAILJS_CANCEL_TEMPLATE_ID = \"template_pr5rcah\"; // NEW template you'll create — see checklist for the exact fields it needs\n\nconst SITE_URL = \"https://goodmaidcleaning.com\";\nconst DISCOUNT_DOLLARS = 20; // first-clean discount, via the FIRST20 code\n\n// The promo code customers type in on the payment page. Change this\n// anytime you want a new code — just paste the updated file back in.\nconst PROMO_CODE = \"FIRST20\";\n\n// ───────────────────────── referral program ─────────────────────────\n// Every confirmed booking's own reference (e.g. \"GM-AB3XZ9\") doubles as\n// that customer's personal referral code — nothing extra to generate or\n// look up. A friend enters it as their promo code at checkout (or follows\n// a ?ref=GM-AB3XZ9 link, which the site auto-fills for them): they get\n// REFERRAL_FRIEND_DOLLARS off, checked against your own saved bookings\n// exactly like FIRST20 so it only ever works for a genuinely new customer.\n// The moment that\n// friend's booking is finalized, the referrer gets a one-time reward code\n// emailed to them automatically, worth REFERRAL_REWARD_DOLLARS off their\n// next clean — see genRewardCode()/saveRewardCode() below.\nconst REFERRAL_FRIEND_DOLLARS = 20;\nconst REFERRAL_REWARD_DOLLARS = 20;\n// NEW template you'll create in EmailJS for the \"your friend just booked —\n// here's your reward code\" email — see checklist for the exact fields it\n// needs ({{first_name}}, {{friend_name}}, {{reward_code}}, {{reward_amount}}).\nconst EMAILJS_REFERRAL_TEMPLATE_ID = \"template_referral_reward\";\n\nconst CORS_HEADERS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"POST, GET, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n};\nfunction json(data: any, status = 200) {\n return Response.json(data, { status, headers: CORS_HEADERS });\n}\n\n// ───────────────────────── booking storage (blob) ─────────────────────────\n// Each booking is saved as its own blob keyed by reference, plus a tiny\n// index blob mapping the private cancel token to that reference so the\n// cancel link never has to expose or guess a reference number.\nfunction bookingKey(reference: string) {\n return `booking:${reference}`;\n}\nfunction tokenKey(token: string) {\n return `token:${token}`;\n}\nasync function saveBooking(b: Record) {\n await blob.setJSON(bookingKey(b.reference), b);\n await blob.setJSON(tokenKey(b.cancelToken), b.reference);\n}\nasync function getBookingByReference(reference: string) {\n return await blob.getJSON(bookingKey(reference));\n}\nasync function getBookingByToken(token: string) {\n const reference = await blob.getJSON(tokenKey(token));\n if (!reference) return null;\n return await getBookingByReference(reference);\n}\n// Every \"booking:\" record, loaded at once — the same read every admin list\n// view uses. Small helper so the new-customer check and the cleaner-jobs\n// list don't each repeat this.\nasync function getAllBookings(): Promise[]> {\n const keys = await blob.list(\"booking:\");\n const bookings = await Promise.all(keys.map((k: any) => blob.getJSON(k.key)));\n return bookings.filter(Boolean) as Record[];\n}\nfunction normalizePhone(phone: string) {\n return String(phone || \"\").replace(/\\D/g, \"\");\n}\nfunction randomToken() {\n const bytes = new Uint8Array(24);\n crypto.getRandomValues(bytes);\n return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\nfunction genReference() {\n const chars = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n let ref = \"GM-\";\n for (let i = 0; i < 6; i++) {\n ref += chars[Math.floor(Math.random() * chars.length)];\n }\n return ref;\n}\n\n// A referrer's earned reward — one-time use, worth REFERRAL_REWARD_DOLLARS\n// off their next clean. Deliberately a different prefix (\"THANKS-\") than\n// booking references (\"GM-\") so the two code types can never collide or be\n// confused with each other when someone types one in at checkout.\nfunction rewardKey(code: string) {\n return `reward:${code}`;\n}\nasync function saveRewardCode(code: string, data: Record) {\n await blob.setJSON(rewardKey(code), data);\n}\nasync function getRewardCode(code: string) {\n return await blob.getJSON(rewardKey(code));\n}\nfunction genRewardCode() {\n const chars = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n let code = \"THANKS-\";\n for (let i = 0; i < 6; i++) {\n code += chars[Math.floor(Math.random() * chars.length)];\n }\n return code;\n}\n\n// ───────────────────────── Vancouver-local time math ─────────────────────────\n// Booking dates/times are always Metro Vancouver local time. This compares\n// \"now\" and \"the scheduled visit\" as plain Vancouver wall-clock, which\n// sidesteps PST/PDT daylight-saving math entirely rather than getting it\n// subtly wrong twice a year.\n// Converts any real timestamp (a Date) into \"Vancouver wall-clock, expressed\n// as if it were UTC\" — the same units scheduledWallClockMs() below uses for\n// a booking's date/time. Diffing two values in these units gives a correct\n// hour count without ever touching real UTC-offset math or DST by hand.\nfunction vancouverWallMs(d: Date) {\n const parts = new Intl.DateTimeFormat(\"en-US\", {\n timeZone: \"America/Vancouver\",\n hour12: false,\n year: \"numeric\",\n month: \"2-digit\",\n day: \"2-digit\",\n hour: \"2-digit\",\n minute: \"2-digit\",\n second: \"2-digit\",\n }).formatToParts(d).reduce((acc: any, p) => {\n acc[p.type] = p.value;\n return acc;\n }, {});\n return Date.UTC(\n +parts.year,\n +parts.month - 1,\n +parts.day,\n +parts.hour,\n +parts.minute,\n +parts.second,\n );\n}\nfunction vancouverNowMs() {\n return vancouverWallMs(new Date());\n}\nfunction scheduledWallClockMs(scheduledDate: string, scheduledTime24h: string) {\n const [y, m, d] = scheduledDate.split(\"-\").map(Number);\n const [hh, mm] = (scheduledTime24h || \"09:00\").split(\":\").map(Number);\n return Date.UTC(y, m - 1, d, hh, mm, 0);\n}\nfunction hoursUntil(scheduledDate: string, scheduledTime24h: string) {\n return (scheduledWallClockMs(scheduledDate, scheduledTime24h) -\n vancouverNowMs()) / 3600000;\n}\n\n// ───────────────────────── Stripe (raw REST) ─────────────────────────\nasync function stripeRequest(\n method: string,\n path: string,\n body?: Record,\n) {\n const form = body\n ? Object.entries(body).map(([k, v]) =>\n `${encodeURIComponent(k)}=${encodeURIComponent(String(v))}`\n ).join(\"&\")\n : undefined;\n const res = await fetch(`https://api.stripe.com/v1/${path}`, {\n method,\n headers: {\n Authorization: `Bearer ${STRIPE_SECRET_KEY}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: form,\n });\n const data = await res.json();\n if (!res.ok) {\n throw new Error(\n data.error?.message || `Stripe ${path} failed (${res.status})`,\n );\n }\n return data;\n}\nasync function findOrCreateStripeCustomer(email: string, name: string) {\n if (email) {\n const list = await stripeRequest(\n \"GET\",\n `customers?email=${encodeURIComponent(email)}&limit=1`,\n );\n if (list.data?.length) return list.data[0].id;\n }\n const created = await stripeRequest(\"POST\", \"customers\", {\n email: email || \"\",\n name: name || \"\",\n });\n return created.id;\n}\n// Note: there is deliberately no automatic refund function anywhere in\n// this file. Cancelling (§5-6) only ever marks a booking cancelled; the\n// admin bookings list works out and shows whether a refund is owed.\n// Issuing it is always a manual step from the Stripe dashboard\n// (Payments → find the charge → Refund).\n\n// ───────────────────────── new-customer check (local — no Jobber) ─────────────────────────\n// FIRST20 and referral codes only work for a genuinely new customer. This\n// used to ask Jobber; now it just checks your own saved bookings for a\n// non-cancelled one with a matching email or phone number. Matches the\n// same \"default to no discount on any doubt\" behavior the Jobber version\n// had, so nothing gets more generous by accident.\nasync function isNewCustomerLocally(\n email: string,\n phone: string,\n): Promise {\n const normEmail = String(email || \"\").trim().toLowerCase();\n const normPhone = normalizePhone(phone);\n if (!normEmail && !normPhone) return true;\n const all = await getAllBookings();\n const hasExisting = all.some((b) => {\n if (b.status === \"cancelled\") return false;\n const bEmail = String(b.customerEmail || \"\").trim().toLowerCase();\n const bPhone = normalizePhone(b.customerPhone || \"\");\n return (normEmail && bEmail === normEmail) ||\n (normPhone && bPhone === normPhone);\n });\n return !hasExisting;\n}\n\n// ───────────────────────── cleaner accounts (auth) ─────────────────────────\n// Lightweight password auth, built from Deno's own Web Crypto — no extra\n// library needed. Passwords are never stored in plain text: PBKDF2 with a\n// random salt per cleaner, same well-established approach behind most\n// small web apps' login systems.\nfunction bytesToHex(bytes: Uint8Array) {\n return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\nfunction hexToBytes(hex: string) {\n const bytes = new Uint8Array(hex.length / 2);\n for (let i = 0; i < bytes.length; i++) {\n bytes[i] = parseInt(hex.substr(i * 2, 2), 16);\n }\n return bytes;\n}\nasync function hashPassword(password: string, saltHex?: string) {\n const salt = saltHex\n ? hexToBytes(saltHex)\n : crypto.getRandomValues(new Uint8Array(16));\n const keyMaterial = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt, iterations: 100000, hash: \"SHA-256\" },\n keyMaterial,\n 256,\n );\n return { hash: bytesToHex(new Uint8Array(bits)), salt: bytesToHex(salt) };\n}\nasync function verifyPassword(password: string, hash: string, salt: string) {\n const check = await hashPassword(password, salt);\n return check.hash === hash;\n}\n// Short, readable temp password — Henry copies this from the admin page and\n// texts/emails it to the cleaner himself (no automated email needed, so\n// this never touches your EmailJS template limit). Avoids ambiguous\n// characters (0/O, 1/I/l) so it's easy to read back over the phone.\nfunction genTempPassword() {\n const chars = \"ABCDEFGHJKMNPQRSTUVWXYZ23456789\";\n let out = \"\";\n for (let i = 0; i < 8; i++) {\n out += chars[Math.floor(Math.random() * chars.length)];\n }\n return out;\n}\nfunction genCleanerId() {\n const bytes = new Uint8Array(8);\n crypto.getRandomValues(bytes);\n return \"cln_\" + bytesToHex(bytes);\n}\nfunction cleanerKey(id: string) {\n return `cleaner:${id}`;\n}\nfunction cleanerEmailKey(email: string) {\n return `cleaneremail:${String(email).trim().toLowerCase()}`;\n}\nfunction cleanerSessionKey(token: string) {\n return `cleanersession:${token}`;\n}\nconst CLEANER_SESSION_DAYS = 60;\n\nasync function saveCleaner(c: Record) {\n await blob.setJSON(cleanerKey(c.id), c);\n await blob.setJSON(cleanerEmailKey(c.email), c.id);\n}\nasync function getCleanerById(id: string) {\n return await blob.getJSON(cleanerKey(id));\n}\nasync function getCleanerByEmail(email: string) {\n const id = await blob.getJSON(cleanerEmailKey(email));\n if (!id) return null;\n return await getCleanerById(id);\n}\nasync function createCleanerSession(cleanerId: string) {\n const token = randomToken();\n const expiresAt = new Date(Date.now() + CLEANER_SESSION_DAYS * 86400000)\n .toISOString();\n await blob.setJSON(cleanerSessionKey(token), { cleanerId, expiresAt });\n return token;\n}\n// Returns the logged-in cleaner's record, or null if the token is missing,\n// unknown, expired, or the account's been deactivated in the meantime.\nasync function getCleanerFromToken(token: string) {\n if (!token) return null;\n const session = await blob.getJSON(cleanerSessionKey(token));\n if (!session) return null;\n if (new Date(session.expiresAt).getTime() < Date.now()) return null;\n const cleaner = await getCleanerById(session.cleanerId);\n if (!cleaner || cleaner.active === false) return null;\n return cleaner;\n}\nfunction cleanerPublicView(c: Record) {\n return {\n id: c.id,\n name: c.name,\n email: c.email,\n phone: c.phone,\n active: c.active !== false,\n createdAt: c.createdAt,\n };\n}\n\n// ───────────────────────── Email (EmailJS REST) ─────────────────────────\nasync function sendEmail(\n templateId: string,\n toEmail: string,\n params: Record,\n) {\n if (!toEmail) return;\n try {\n const res = await fetch(\"https://api.emailjs.com/api/v1.0/email/send\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n service_id: EMAILJS_SERVICE_ID,\n template_id: templateId,\n user_id: EMAILJS_PUBLIC_KEY,\n accessToken: EMAILJS_PRIVATE_KEY,\n template_params: { to_email: toEmail, ...params },\n }),\n });\n if (!res.ok) {\n console.log(\"EmailJS send failed:\", res.status, await res.text());\n }\n } catch (err: any) {\n console.log(\"EmailJS send threw:\", err.message || String(err));\n }\n}\n\n// A plain-text fallback straight to Henry's inbox via FormSubmit — not\n// currently called by anything below, but kept here ready to use for any\n// future \"something went wrong, tell Henry directly\" alert.\nasync function alertHenry(subject: string, lines: Record) {\n try {\n const fd = new FormData();\n fd.set(\"_subject\", subject);\n Object.entries(lines).forEach(([k, v]) => fd.set(k, v));\n await fetch(\"https://formsubmit.co/ajax/ee6b06d638357bffe3e89c2579084290\", {\n method: \"POST\",\n headers: { Accept: \"application/json\" },\n body: fd,\n });\n } catch (err: any) {\n console.log(\"alertHenry failed:\", err.message || String(err));\n }\n}\n\n// ───────────────────────── Jobber (kept in sync, read-only from here) ─────────────────────────\n// This file remains the source of truth (booking storage, cleaner accounts,\n// admin tools all still live here) but every finalized/cancelled booking is\n// ALSO mirrored into Jobber, using the existing Jobber connector val (which\n// already holds a working OAuth connection and knows Jobber exact field\n// names). Failures here never block a booking or its cancellation -- the\n// customer already paid, or already got cancelled/handled -- they just alert\n// Henry so the Jobber side can be fixed up by hand.\nconst JOBBER_CONNECTOR_URL =\n \"https://goodmaidcleaning--ff4c00a8abf811f1941b1607ee4eb77e.web.val.run\";\n\nasync function createJobberJob(\n record: Record,\n recurring: boolean,\n frequency: string,\n) {\n const nameParts = String(record.customerName || \"\").trim().split(/\\s+/);\n const firstName = nameParts.shift() || \"\";\n const lastName = nameParts.join(\" \");\n const noteParts = [\n record.unit ? `Unit/Suite: ${record.unit}` : \"\",\n record.entryInstructions\n ? `Entry instructions: ${record.entryInstructions}`\n : \"\",\n record.specialNotes || \"\",\n ].filter(Boolean);\n const payload = {\n firstName,\n lastName,\n email: record.customerEmail || \"\",\n phone: record.customerPhone || \"\",\n address: {\n street: record.address || \"\",\n city: record.city || \"\",\n province: \"BC\",\n postalCode: record.postal || \"\",\n country: \"Canada\",\n },\n serviceType: record.serviceLabel || \"Cleaning\",\n reference: record.reference || \"\",\n notes: noteParts.join(\" -- \"),\n scheduledDate: record.scheduledDate || \"\",\n scheduledTime: record.scheduledTime24h || \"\",\n quotedPrice: record.finalPriceCents / 100,\n recurring: !!recurring,\n frequency: frequency || \"\",\n };\n const res = await fetch(JOBBER_CONNECTOR_URL, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(payload),\n });\n return await res.json();\n}\n\nasync function cancelJobberJob(jobberJobId: string) {\n const res = await fetch(JOBBER_CONNECTOR_URL, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ action: \"cancelJob\", jobberJobId }),\n });\n return await res.json();\n}\n\n// ───────────────────────── §1–3: price + charge ─────────────────────────\n// Default POST body: { basePrice, name, email, phone, address, reference?, promoCode? }\n//\n// The discount is NEVER automatic anymore. It only applies when a promo\n// code is sent here as `promoCode` — either the customer typed one in, or\n// the site auto-filled it from a referral link. There are three kinds of\n// code, told apart by their shape:\n// FIRST20 — the general first-clean code, requires a genuinely\n// new customer (checked against your own saved\n// bookings — the browser can't skip or fake this).\n// GM-XXXXXX — someone's own booking reference, shared as a referral\n// code/link. Same \"must be a genuinely new customer\"\n// check as FIRST20 — which also means the referrer\n// can't just reuse their own code on themselves.\n// THANKS-XXXXXX — a reward code a referrer already earned (see\n// handleFinalize below). No new-customer check here —\n// by definition they're already a customer — it just\n// has to be a real, unused reward.\nasync function handlePrice(req: Request) {\n const body = await req.json();\n const basePrice = Math.round(Number(body.basePrice) * 100) / 100;\n if (!basePrice || basePrice <= 0) {\n return json({ error: \"Missing or invalid amount.\" }, 400);\n }\n\n const promoCode = String(body.promoCode || \"\").trim();\n const upper = promoCode.toUpperCase();\n let discount = 0;\n let promoApplied = false;\n let promoError = \"\";\n let referralCode = \"\"; // set when a FRIEND is redeeming someone else's referral code\n let rewardCode = \"\"; // set when a REFERRER is redeeming their own earned reward\n\n async function checkNewCustomer(): Promise {\n try {\n return await isNewCustomerLocally(body.email || \"\", body.phone || \"\");\n } catch (err: any) {\n console.log(\n \"Eligibility check failed, defaulting to no discount:\",\n err.message || String(err),\n );\n return false;\n }\n }\n const NOT_FIRST_TIME_ERROR =\n \"This code is for first-time customers only — looks like you've already got a booking with us on file.\";\n\n if (promoCode) {\n if (upper === PROMO_CODE.toUpperCase()) {\n if (await checkNewCustomer()) {\n discount = DISCOUNT_DOLLARS;\n promoApplied = true;\n } else promoError = NOT_FIRST_TIME_ERROR;\n } else if (upper.startsWith(\"THANKS-\")) {\n const reward = await getRewardCode(upper);\n if (!reward) promoError = \"That code isn't valid.\";\n else if (reward.used) promoError = \"That code has already been used.\";\n else {\n discount = Number(reward.amount) || REFERRAL_REWARD_DOLLARS;\n promoApplied = true;\n rewardCode = upper;\n }\n } else if (upper.startsWith(\"GM-\")) {\n const referrerBooking = await getBookingByReference(upper);\n if (!referrerBooking || referrerBooking.status === \"cancelled\") {\n promoError = \"That code isn't valid.\";\n } else if (await checkNewCustomer()) {\n discount = REFERRAL_FRIEND_DOLLARS;\n promoApplied = true;\n referralCode = upper;\n } else {\n promoError = NOT_FIRST_TIME_ERROR;\n }\n } else {\n promoError = \"That code isn't valid.\";\n }\n }\n\n const finalPrice = Math.max(0, basePrice - discount);\n const reference = body.reference || genReference();\n\n const customerId = await findOrCreateStripeCustomer(\n body.email || \"\",\n body.name || \"\",\n );\n const intent = await stripeRequest(\"POST\", \"payment_intents\", {\n amount: String(Math.round(finalPrice * 100)),\n currency: \"cad\",\n customer: customerId,\n \"payment_method_types[]\": \"card\",\n setup_future_usage: \"off_session\", // keeps the card on file for a possible add-on charge later (§7)\n description: `Good Maid Cleaning booking ${reference}`,\n receipt_email: body.email || \"\",\n \"metadata[reference]\": reference,\n \"metadata[discount]\": String(discount),\n \"metadata[referralCode]\": referralCode,\n \"metadata[rewardCode]\": rewardCode,\n });\n\n return json({\n clientSecret: intent.client_secret,\n reference,\n basePrice,\n discount,\n finalPrice,\n promoApplied,\n promoError,\n });\n}\n\n// ───────────────────────── §1–4: finalize after a successful charge ─────────────────────────\n// Body: { paymentIntentId, reference, booking: { ...contact + service details } }\nasync function handleFinalize(req: Request) {\n const body = await req.json();\n const { paymentIntentId, booking } = body;\n if (!paymentIntentId || !booking) {\n return json({ error: \"Missing paymentIntentId or booking.\" }, 400);\n }\n\n // Never trust the browser's word that a charge went through — ask Stripe.\n const intent = await stripeRequest(\n \"GET\",\n `payment_intents/${paymentIntentId}`,\n );\n if (intent.status !== \"succeeded\") {\n return json({\n error: \"Payment has not succeeded — booking was not created.\",\n }, 402);\n }\n\n const reference = intent.metadata?.reference || body.reference ||\n genReference();\n const discount = Number(intent.metadata?.discount || 0);\n const referralCode = intent.metadata?.referralCode || \"\";\n const rewardCode = intent.metadata?.rewardCode || \"\";\n const finalPrice = intent.amount_received / 100;\n const cancelToken = randomToken();\n\n const record = {\n reference,\n cancelToken,\n status: \"confirmed\",\n customerName: booking.name || \"\",\n customerEmail: booking.email || \"\",\n customerPhone: booking.phone || \"\",\n address: booking.address || \"\",\n unit: booking.unit || \"\",\n city: booking.city || \"\",\n postal: booking.postal || \"\",\n serviceLabel: booking.serviceLabel || \"\",\n dateLabel: booking.dateLabel || \"\",\n timeLabel: booking.timeLabel || \"\",\n scheduledDate: booking.scheduledDate,\n scheduledTime24h: booking.scheduledTime24h,\n entryInstructions: booking.entryInstructions || \"\",\n specialNotes: booking.specialNotes || \"\",\n basePriceCents: intent.amount_received + Math.round(discount * 100),\n discountCents: Math.round(discount * 100),\n finalPriceCents: intent.amount_received,\n stripePaymentIntentId: paymentIntentId,\n stripeCustomerId: intent.customer,\n stripePaymentMethodId: intent.payment_method,\n assignedCleanerId: null,\n assignedCleanerName: null,\n refunded: false,\n referredBy: referralCode || null, // the referrer's code, if this booking came from one — just for your own records\n createdAt: new Date().toISOString(),\n cancelledAt: null,\n };\n await saveBooking(record);\n\n // Mirror this booking into Jobber too -- never let a Jobber problem\n // block the booking itself, since the customer already paid.\n try {\n const jobberResult = await createJobberJob(\n record,\n !!booking.recurring,\n booking.frequency || \"\",\n );\n if (jobberResult?.ok) {\n record.jobberJobId = jobberResult.job?.id || null;\n record.jobberJobNumber = jobberResult.job?.jobNumber || null;\n record.jobberClientId = jobberResult.clientId || null;\n await saveBooking(record);\n } else {\n console.log(\"Jobber job creation failed:\", JSON.stringify(jobberResult));\n await alertHenry(\"Booking saved, but Jobber job creation failed\", {\n \"What happened\":\n \"This booking was saved on the site and the customer was charged, but creating the matching job in Jobber failed. Add it to Jobber manually.\",\n \"Reference\": record.reference,\n \"Customer\": record.customerName || \"\",\n \"Error\": JSON.stringify(jobberResult?.error || jobberResult),\n });\n }\n } catch (err: any) {\n console.log(\"Jobber job creation threw:\", err.message || String(err));\n await alertHenry(\"Booking saved, but Jobber job creation failed\", {\n \"What happened\":\n \"This booking was saved on the site and the customer was charged, but creating the matching job in Jobber threw an error. Add it to Jobber manually.\",\n \"Reference\": record.reference,\n \"Customer\": record.customerName || \"\",\n \"Error\": err.message || String(err),\n });\n }\n\n // A reward code just got spent (a referrer redeeming their own earned\n // discount) — mark it used right here, only once payment is genuinely\n // confirmed, so it can never be redeemed a second time.\n if (rewardCode) {\n const reward = await getRewardCode(rewardCode);\n if (reward) {\n reward.used = true;\n reward.usedAt = new Date().toISOString();\n reward.usedByReference = reference;\n await saveRewardCode(rewardCode, reward);\n }\n }\n\n // This booking was made using someone ELSE's referral code — a real,\n // verified new customer just booked because of them. Mint that referrer\n // a fresh one-time reward code for their own next clean and email it to\n // them automatically, no action needed from Henry.\n if (referralCode) {\n const referrerBooking = await getBookingByReference(referralCode);\n if (referrerBooking?.customerEmail) {\n const newReward = genRewardCode();\n await saveRewardCode(newReward, {\n email: referrerBooking.customerEmail,\n amount: REFERRAL_REWARD_DOLLARS,\n used: false,\n earnedFromReference: reference,\n createdAt: new Date().toISOString(),\n });\n await sendEmail(\n EMAILJS_REFERRAL_TEMPLATE_ID,\n referrerBooking.customerEmail,\n {\n first_name:\n (referrerBooking.customerName || \"\").trim().split(/\\s+/)[0] ||\n \"there\",\n friend_name: (booking.name || \"\").trim().split(/\\s+/)[0] ||\n \"Your friend\",\n reward_code: newReward,\n reward_amount: REFERRAL_REWARD_DOLLARS.toFixed(2),\n },\n );\n }\n }\n\n const discountLine = discount <= 0\n ? \"\"\n : referralCode\n ? `Includes a $${discount.toFixed(2)} referral discount.`\n : rewardCode\n ? `Includes a $${discount.toFixed(2)} referral reward.`\n : `Includes a $${discount.toFixed(2)} first-clean discount.`;\n\n const cancelUrl = `${SITE_URL}/manage.html?t=${cancelToken}`;\n await sendEmail(EMAILJS_CONFIRM_TEMPLATE_ID, booking.email, {\n first_name: (booking.name || \"\").trim().split(/\\s+/)[0] || \"there\",\n reference,\n service: booking.serviceLabel,\n date: booking.dateLabel,\n time: booking.timeLabel,\n address: `${booking.address || \"\"}${\n booking.unit ? \" #\" + booking.unit : \"\"\n }, ${booking.city || \"\"}`,\n price: finalPrice.toFixed(2),\n discount_line: discountLine,\n referral_code: reference,\n cancel_url: cancelUrl,\n });\n\n return json({ reference, cancelUrl });\n}\n\n// ───────────────────────── §5–6: look up a booking — by its cancel link, or by Henry looking up a reference ─────────────────────────\n// Two ways in, same response shape: the customer's self-serve link supplies\n// ?t= (proves it's their booking without any login); Henry's admin\n// tools page supplies ?ref=&adminKey= instead, so he can\n// pull up a caller's exact booking by their confirmation number before\n// cancelling it or adding a charge (§6/§7).\nasync function handleManage(req: Request) {\n const params = new URL(req.url).searchParams;\n const token = params.get(\"t\");\n const reference = params.get(\"ref\");\n const adminKey = params.get(\"adminKey\");\n\n let b: Record | null = null;\n if (token) {\n b = await getBookingByToken(token);\n } else if (reference && adminKey) {\n if (adminKey !== ADMIN_KEY) return json({ error: \"Not authorized.\" }, 401);\n b = await getBookingByReference(reference);\n } else {\n return json({ error: \"Provide a token, or a reference + adminKey.\" }, 400);\n }\n if (!b) return json({ error: \"We couldn't find that booking.\" }, 404);\n\n const hrs = hoursUntil(b.scheduledDate, b.scheduledTime24h);\n return json({\n reference: b.reference,\n status: b.status,\n customerName: b.customerName,\n customerEmail: b.customerEmail,\n customerPhone: b.customerPhone,\n serviceLabel: b.serviceLabel,\n dateLabel: b.dateLabel,\n timeLabel: b.timeLabel,\n address: `${b.address}${b.unit ? \" #\" + b.unit : \"\"}, ${b.city}`,\n price: (b.finalPriceCents / 100).toFixed(2),\n refunded: !!b.refunded,\n hoursUntil: hrs,\n hasCardOnFile: !!(b.stripeCustomerId && b.stripePaymentMethodId),\n entryInstructions: b.entryInstructions || \"\",\n specialNotes: b.specialNotes || \"\",\n assignedCleanerId: b.assignedCleanerId || null,\n assignedCleanerName: b.assignedCleanerName || null,\n // For the admin tools detail view's \"booked on / cancelled on\" timeline\n // and its \"open in Maps\" link. Harmless to also return on the\n // customer-facing manage link — nothing sensitive here.\n createdAt: b.createdAt || null,\n cancelledAt: b.cancelledAt || null,\n rawAddress: `${b.address || \"\"}${b.unit ? \" #\" + b.unit : \"\"}, ${\n b.city || \"\"\n }, BC`,\n });\n}\n\n// ───────────────────────── §5–6: cancellation — the ONE shared code path ─────────────────────────\n// Used by both the customer's self-serve link and Henry's phone/email\n// fallback. Cancelling just marks the booking cancelled here — it never\n// touches Stripe. Refunds are a deliberate, manual decision: if a customer\n// follows up asking for their money back, refund them by hand from the\n// Stripe dashboard (Payments → find the charge → Refund), then optionally\n// mark them refunded with the admin tools page so the record here matches.\nasync function performCancellation(b: Record) {\n if (b.status === \"cancelled\") {\n return { alreadyCancelled: true, refunded: !!b.refunded };\n }\n\n b.status = \"cancelled\";\n b.cancelledAt = new Date().toISOString();\n await saveBooking(b);\n\n if (b.jobberJobId) {\n try {\n const jobberResult = await cancelJobberJob(b.jobberJobId);\n if (!jobberResult?.ok) {\n console.log(\"Jobber cancelJob failed:\", JSON.stringify(jobberResult));\n await alertHenry(\n \"Booking cancelled, but Jobber job could not be closed\",\n {\n \"What happened\":\n \"This booking was cancelled on the site, but Jobber own job could not be closed automatically. Please close/remove it in Jobber by hand.\",\n \"Reference\": b.reference,\n \"Jobber job id\": b.jobberJobId,\n \"Error\": JSON.stringify(jobberResult?.error || jobberResult),\n },\n );\n }\n } catch (err: any) {\n console.log(\"Jobber cancelJob threw:\", err.message || String(err));\n await alertHenry(\n \"Booking cancelled, but Jobber job could not be closed\",\n {\n \"What happened\":\n \"This booking was cancelled on the site, but calling Jobber to close the job threw an error. Please close/remove it in Jobber by hand.\",\n \"Reference\": b.reference,\n \"Jobber job id\": b.jobberJobId,\n \"Error\": err.message || String(err),\n },\n );\n }\n }\n\n await sendEmail(EMAILJS_CANCEL_TEMPLATE_ID, b.customerEmail, {\n first_name: (b.customerName || \"\").trim().split(/\\s+/)[0] || \"there\",\n reference: b.reference,\n service: b.serviceLabel,\n date: b.dateLabel,\n time: b.timeLabel,\n price: (b.finalPriceCents / 100).toFixed(2),\n });\n\n return { alreadyCancelled: false, refunded: !!b.refunded };\n}\n\n// Body: EITHER { token } for the self-serve link, OR\n// { reference, adminKey } for Henry's phone/email fallback (§6).\nasync function handleCancel(req: Request) {\n const body = await req.json();\n let b: Record | null = null;\n\n if (body.token) {\n b = await getBookingByToken(body.token);\n } else if (body.reference && body.adminKey) {\n if (body.adminKey !== ADMIN_KEY) {\n return json({ error: \"Not authorized.\" }, 401);\n }\n b = await getBookingByReference(body.reference);\n } else {\n return json({ error: \"Provide a token, or a reference + adminKey.\" }, 400);\n }\n if (!b) return json({ error: \"We couldn't find that booking.\" }, 404);\n\n const outcome = await performCancellation(b);\n return json(outcome);\n}\n\n// ───────────────────────── §7: add-on charge (Henry only) ─────────────────────────\n// Body: { reference, adminKey, amount, description }\nasync function handleAddon(req: Request) {\n const body = await req.json();\n if (body.adminKey !== ADMIN_KEY) {\n return json({ error: \"Not authorized.\" }, 401);\n }\n const amountCents = Math.round(Number(body.amount) * 100);\n if (!amountCents || amountCents <= 0) {\n return json({ error: \"Invalid amount.\" }, 400);\n }\n\n const b = await getBookingByReference(body.reference);\n if (!b) return json({ error: \"We couldn't find that booking.\" }, 404);\n if (!b.stripeCustomerId || !b.stripePaymentMethodId) {\n return json({\n error:\n \"No card on file for this booking — ask the customer for a new card instead.\",\n }, 400);\n }\n\n try {\n const intent = await stripeRequest(\"POST\", \"payment_intents\", {\n amount: String(amountCents),\n currency: \"cad\",\n customer: b.stripeCustomerId,\n payment_method: b.stripePaymentMethodId,\n off_session: \"true\",\n confirm: \"true\",\n description: body.description ||\n `Add-on charge for booking ${b.reference}`,\n });\n return json({\n success: intent.status === \"succeeded\",\n status: intent.status,\n });\n } catch (err: any) {\n return json({\n error:\n `Charge failed: ${err.message} — the card on file may need the customer to provide a new one.`,\n }, 402);\n }\n}\n\n// ───────────────────────── §8: mark a booking refunded (record-keeping only) ─────────────────────────\n// Cancelling never touches Stripe (see §5–6 above) — refunds are always a\n// manual decision made by hand in the Stripe dashboard. This endpoint does\n// NOT issue a refund; it just updates this booking's own record to say one\n// was given, once Henry has actually done it in Stripe, so the admin tools\n// page shows the right thing next time this booking is looked up.\n// Body: { reference, adminKey }\nasync function handleMarkRefunded(req: Request) {\n const body = await req.json();\n if (body.adminKey !== ADMIN_KEY) {\n return json({ error: \"Not authorized.\" }, 401);\n }\n const b = await getBookingByReference(body.reference);\n if (!b) return json({ error: \"We couldn't find that booking.\" }, 404);\n b.refunded = true;\n await saveBooking(b);\n return json({ success: true, refunded: true });\n}\n\n// ───────────────────────── §9: list all bookings (admin) ─────────────────────────\n// Powers the \"All bookings\" view in admin tools — a read-only list of every\n// saved booking, newest first, so Henry can see everything at a glance\n// instead of looking each one up by reference number one at a time.\nasync function handleListBookings(req: Request) {\n const params = new URL(req.url).searchParams;\n const adminKey = params.get(\"adminKey\");\n if (adminKey !== ADMIN_KEY) return json({ error: \"Not authorized.\" }, 401);\n\n // Only \"booking:\" keys are real bookings — the \"token:\" blobs are just an\n // internal lookup index pointing at those same records, so listing this\n // one prefix is all that's needed.\n const keys = await blob.list(\"booking:\");\n const bookings = await Promise.all(keys.map((k: any) => blob.getJSON(k.key)));\n\n const list = bookings\n .filter(Boolean)\n .map((b: any) => {\n // Was this cancelled with 24+ hours' notice? Computed from the\n // moment it was actually cancelled, not \"now\" — a booking cancelled\n // last month for a visit that was scheduled next week still correctly\n // shows as \"refund owed\" today. Only meaningful for cancelled,\n // not-yet-refunded bookings.\n let refundOwed = false;\n if (\n b.status === \"cancelled\" && !b.refunded && b.scheduledDate &&\n b.cancelledAt\n ) {\n const scheduledMs = scheduledWallClockMs(\n b.scheduledDate,\n b.scheduledTime24h || \"09:00\",\n );\n const cancelledMs = vancouverWallMs(new Date(b.cancelledAt));\n refundOwed = (scheduledMs - cancelledMs) / 3600000 >= 24;\n }\n return {\n reference: b.reference,\n status: b.status,\n customerName: b.customerName || \"\",\n customerEmail: b.customerEmail || \"\",\n customerPhone: b.customerPhone || \"\",\n serviceLabel: b.serviceLabel || \"\",\n dateLabel: b.dateLabel || \"\",\n timeLabel: b.timeLabel || \"\",\n scheduledDate: b.scheduledDate || \"\",\n scheduledTime24h: b.scheduledTime24h || \"\",\n city: b.city || \"\",\n address: b.address || \"\",\n unit: b.unit || \"\",\n price: ((b.finalPriceCents || 0) / 100).toFixed(2),\n refunded: !!b.refunded,\n refundOwed,\n entryInstructions: b.entryInstructions || \"\",\n specialNotes: b.specialNotes || \"\",\n assignedCleanerId: b.assignedCleanerId || null,\n assignedCleanerName: b.assignedCleanerName || null,\n createdAt: b.createdAt || \"\",\n cancelledAt: b.cancelledAt || null,\n };\n })\n // Newest-created first.\n .sort((a: any, b: any) =>\n (b.createdAt || \"\").localeCompare(a.createdAt || \"\")\n );\n\n return json({ bookings: list });\n}\n\n// ───────────────────────── §10: delete bookings (admin) ─────────────────────────\n// Real deletes — these permanently remove blob records with no undo. Only\n// ever reachable with the admin key. Deleting a booking here does NOT touch\n// Stripe (any real charge stays on your Stripe dashboard exactly as it is —\n// this only clears our own records of it).\nasync function handleDeleteBooking(req: Request) {\n const body = await req.json();\n if (body.adminKey !== ADMIN_KEY) {\n return json({ error: \"Not authorized.\" }, 401);\n }\n const b = await getBookingByReference(body.reference);\n if (!b) return json({ error: \"We couldn't find that booking.\" }, 404);\n await blob.delete(bookingKey(b.reference));\n if (b.cancelToken) await blob.delete(tokenKey(b.cancelToken));\n return json({ success: true, deleted: b.reference });\n}\n\n// Wipes every booking record in one go (plus their token index blobs and\n// every referral reward code, since those were only ever minted from these\n// same test bookings). Meant for clearing out test data before a real\n// launch — there's no way to undo this, so admin_tools.html makes the\n// person type a confirmation phrase before it ever calls this.\nasync function handleDeleteAllBookings(req: Request) {\n const body = await req.json();\n if (body.adminKey !== ADMIN_KEY) {\n return json({ error: \"Not authorized.\" }, 401);\n }\n\n const bookingKeys = await blob.list(\"booking:\");\n const bookings = await Promise.all(\n bookingKeys.map((k: any) => blob.getJSON(k.key)),\n );\n\n let count = 0;\n for (const b of bookings) {\n if (!b) continue;\n await blob.delete(bookingKey(b.reference));\n if (b.cancelToken) await blob.delete(tokenKey(b.cancelToken));\n count++;\n }\n\n const rewardKeys = await blob.list(\"reward:\");\n for (const k of rewardKeys as any[]) {\n await blob.delete(k.key);\n }\n\n return json({\n success: true,\n deletedBookings: count,\n deletedRewardCodes: rewardKeys.length,\n });\n}\n\n// ───────────────────────── §11: cleaner accounts (admin-managed) ─────────────────────────\n// Henry adds each cleaner by name/email/phone from the admin tools page.\n// This mints a random temp password, saves the account, and hands the temp\n// password back ONCE in the response — it is never stored in plain text and\n// never emailed automatically (see the file-header note on EmailJS's\n// template limit). Henry copies it from the admin page and texts/tells it\n// to the cleaner himself; they're prompted to set their own password the\n// first time they log in to the cleaner portal (handleCleanerSetPassword).\n// Body: { adminKey, name, email, phone }\nasync function handleCleanerCreate(req: Request) {\n const body = await req.json();\n if (body.adminKey !== ADMIN_KEY) {\n return json({ error: \"Not authorized.\" }, 401);\n }\n const name = String(body.name || \"\").trim();\n const email = String(body.email || \"\").trim().toLowerCase();\n const phone = String(body.phone || \"\").trim();\n if (!name || !email) {\n return json({ error: \"Name and email are required.\" }, 400);\n }\n\n const existing = await getCleanerByEmail(email);\n if (existing) {\n return json({ error: \"A cleaner with that email already exists.\" }, 400);\n }\n\n const tempPassword = genTempPassword();\n const { hash, salt } = await hashPassword(tempPassword);\n const cleaner = {\n id: genCleanerId(),\n name,\n email,\n phone,\n passwordHash: hash,\n passwordSalt: salt,\n mustChangePassword: true,\n active: true,\n createdAt: new Date().toISOString(),\n };\n await saveCleaner(cleaner);\n return json({ success: true, cleanerId: cleaner.id, tempPassword });\n}\n\n// Read-only list for the admin tools page's Cleaners section and its\n// \"assign a cleaner to this booking\" dropdown. Never returns password data.\nasync function handleCleanerList(req: Request) {\n const params = new URL(req.url).searchParams;\n if (params.get(\"adminKey\") !== ADMIN_KEY) {\n return json({ error: \"Not authorized.\" }, 401);\n }\n const keys = await blob.list(\"cleaner:\");\n const cleaners = await Promise.all(keys.map((k: any) => blob.getJSON(k.key)));\n const list = cleaners.filter(Boolean).map(cleanerPublicView)\n .sort((a: any, b: any) => (a.name || \"\").localeCompare(b.name || \"\"));\n return json({ cleaners: list });\n}\n\n// Toggle a cleaner active/inactive rather than deleting them, so their name\n// stays attached to past jobs in the record — an inactive cleaner just\n// can't log in or be assigned new jobs.\n// Body: { adminKey, cleanerId, active }\nasync function handleCleanerSetActive(req: Request) {\n const body = await req.json();\n if (body.adminKey !== ADMIN_KEY) {\n return json({ error: \"Not authorized.\" }, 401);\n }\n const cleaner = await getCleanerById(body.cleanerId);\n if (!cleaner) return json({ error: \"We couldn't find that cleaner.\" }, 404);\n cleaner.active = !!body.active;\n await saveCleaner(cleaner);\n return json({ success: true, active: cleaner.active });\n}\n\n// Mints a fresh temp password for a cleaner who forgot theirs — same\n// \"shown once, relayed by hand\" pattern as creating one.\n// Body: { adminKey, cleanerId }\nasync function handleCleanerResetPassword(req: Request) {\n const body = await req.json();\n if (body.adminKey !== ADMIN_KEY) {\n return json({ error: \"Not authorized.\" }, 401);\n }\n const cleaner = await getCleanerById(body.cleanerId);\n if (!cleaner) return json({ error: \"We couldn't find that cleaner.\" }, 404);\n const tempPassword = genTempPassword();\n const { hash, salt } = await hashPassword(tempPassword);\n cleaner.passwordHash = hash;\n cleaner.passwordSalt = salt;\n cleaner.mustChangePassword = true;\n await saveCleaner(cleaner);\n return json({ success: true, tempPassword });\n}\n\n// Assigns (or un-assigns, with an empty cleanerId) a cleaner to a booking —\n// this is what makes the job show up on that cleaner's portal job list.\n// Body: { adminKey, reference, cleanerId }\nasync function handleAssignCleaner(req: Request) {\n const body = await req.json();\n if (body.adminKey !== ADMIN_KEY) {\n return json({ error: \"Not authorized.\" }, 401);\n }\n const b = await getBookingByReference(body.reference);\n if (!b) return json({ error: \"We couldn't find that booking.\" }, 404);\n\n if (!body.cleanerId) {\n b.assignedCleanerId = null;\n b.assignedCleanerName = null;\n } else {\n const cleaner = await getCleanerById(body.cleanerId);\n if (!cleaner) return json({ error: \"We couldn't find that cleaner.\" }, 404);\n b.assignedCleanerId = cleaner.id;\n b.assignedCleanerName = cleaner.name;\n }\n await saveBooking(b);\n return json({\n success: true,\n assignedCleanerId: b.assignedCleanerId,\n assignedCleanerName: b.assignedCleanerName,\n });\n}\n\n// ───────────────────────── §11: cleaner portal (cleaner-facing) ─────────────────────────\n// Everything below is called from cleaner_portal.html, never from the main\n// booking site or admin tools. Sessions are a random opaque token (same\n// shape as a cancel token), good for 60 days, stored client-side the same\n// way admin tools stores its admin key.\n// Body: { email, password }\nasync function handleCleanerLogin(req: Request) {\n const body = await req.json();\n const email = String(body.email || \"\").trim().toLowerCase();\n const password = String(body.password || \"\");\n if (!email || !password) {\n return json({ error: \"Enter your email and password.\" }, 400);\n }\n\n const cleaner = await getCleanerByEmail(email);\n if (!cleaner || cleaner.active === false) {\n return json({\n error: \"That email and password don't match an active account.\",\n }, 401);\n }\n const ok = await verifyPassword(\n password,\n cleaner.passwordHash,\n cleaner.passwordSalt,\n );\n if (!ok) {\n return json({\n error: \"That email and password don't match an active account.\",\n }, 401);\n }\n\n const token = await createCleanerSession(cleaner.id);\n return json({\n success: true,\n token,\n mustChangePassword: !!cleaner.mustChangePassword,\n name: cleaner.name,\n });\n}\n\n// Lets a cleaner set their own password — required the first time they log\n// in with a temp password, and available any time after from a \"change\n// password\" link in the portal.\n// Body: { token, newPassword }\nasync function handleCleanerSetPassword(req: Request) {\n const body = await req.json();\n const cleaner = await getCleanerFromToken(body.token);\n if (!cleaner) {\n return json(\n { error: \"Your session has expired — please log in again.\" },\n 401,\n );\n }\n const newPassword = String(body.newPassword || \"\");\n if (newPassword.length < 6) {\n return json({\n error: \"Please choose a password at least 6 characters long.\",\n }, 400);\n }\n\n const { hash, salt } = await hashPassword(newPassword);\n cleaner.passwordHash = hash;\n cleaner.passwordSalt = salt;\n cleaner.mustChangePassword = false;\n await saveCleaner(cleaner);\n return json({ success: true });\n}\n\n// Body: { token }\nasync function handleCleanerLogout(req: Request) {\n const body = await req.json();\n if (body.token) await blob.delete(cleanerSessionKey(body.token));\n return json({ success: true });\n}\n\n// A cleaner's own upcoming jobs — everything they need to do the job and\n// nothing they don't: no pricing, no payment info, no other cleaners' jobs.\n// Sorted soonest-first; past/cancelled jobs are left out so the portal\n// always just shows \"what's next.\"\nasync function handleCleanerMyJobs(req: Request) {\n const params = new URL(req.url).searchParams;\n const cleaner = await getCleanerFromToken(params.get(\"token\") || \"\");\n if (!cleaner) {\n return json(\n { error: \"Your session has expired — please log in again.\" },\n 401,\n );\n }\n\n const all = await getAllBookings();\n const todayWall = vancouverNowMs();\n const jobs = all\n .filter((b) =>\n b.assignedCleanerId === cleaner.id && b.status !== \"cancelled\"\n )\n .filter((b) =>\n scheduledWallClockMs(b.scheduledDate, b.scheduledTime24h || \"09:00\") >=\n todayWall - 6 * 3600000\n ) // keep today's job visible even a few hours after start\n .map((b) => ({\n reference: b.reference,\n customerName: b.customerName || \"\",\n customerPhone: b.customerPhone || \"\",\n address: `${b.address || \"\"}${b.unit ? \" #\" + b.unit : \"\"}`,\n city: b.city || \"\",\n rawAddress: `${b.address || \"\"}${b.unit ? \" #\" + b.unit : \"\"}, ${\n b.city || \"\"\n }, BC`,\n serviceLabel: b.serviceLabel || \"\",\n dateLabel: b.dateLabel || \"\",\n timeLabel: b.timeLabel || \"\",\n scheduledDate: b.scheduledDate || \"\",\n scheduledTime24h: b.scheduledTime24h || \"\",\n entryInstructions: b.entryInstructions || \"\",\n specialNotes: b.specialNotes || \"\",\n }))\n .sort((a, b) =>\n (a.scheduledDate + a.scheduledTime24h).localeCompare(\n b.scheduledDate + b.scheduledTime24h,\n )\n );\n\n return json({ name: cleaner.name, jobs });\n}\n\n// ───────────────────────── router ─────────────────────────\nexport default async function (req: Request): Promise {\n if (req.method === \"OPTIONS\") {\n return new Response(null, { headers: CORS_HEADERS });\n }\n if (!STRIPE_SECRET_KEY) {\n return json({\n error:\n \"STRIPE_SECRET_KEY isn't set. Add it under this val's Env Variables.\",\n }, 500);\n }\n\n const url = new URL(req.url);\n const path = url.pathname.replace(/\\/$/, \"\");\n\n try {\n if (req.method === \"GET\" && path === \"/manage\") {\n return await handleManage(req);\n }\n if (req.method === \"GET\" && path === \"/bookings\") {\n return await handleListBookings(req);\n }\n if (req.method === \"GET\" && path === \"/cleaners\") {\n return await handleCleanerList(req);\n }\n if (req.method === \"GET\" && path === \"/cleaner/jobs\") {\n return await handleCleanerMyJobs(req);\n }\n if (req.method === \"POST\") {\n const clone = req.clone();\n const body = await clone.json().catch(() => ({}));\n if (body.action === \"finalize\") return await handleFinalize(req);\n if (body.action === \"cancel\") return await handleCancel(req);\n if (body.action === \"addon\") return await handleAddon(req);\n if (body.action === \"markRefunded\") return await handleMarkRefunded(req);\n if (body.action === \"deleteBooking\") {\n return await handleDeleteBooking(req);\n }\n if (body.action === \"deleteAllBookings\") {\n return await handleDeleteAllBookings(req);\n }\n if (body.action === \"cleanerCreate\") {\n return await handleCleanerCreate(req);\n }\n if (body.action === \"cleanerSetActive\") {\n return await handleCleanerSetActive(req);\n }\n if (body.action === \"cleanerResetPassword\") {\n return await handleCleanerResetPassword(req);\n }\n if (body.action === \"assignCleaner\") {\n return await handleAssignCleaner(req);\n }\n if (body.action === \"cleanerLogin\") return await handleCleanerLogin(req);\n if (body.action === \"cleanerSetPassword\") {\n return await handleCleanerSetPassword(req);\n }\n if (body.action === \"cleanerLogout\") {\n return await handleCleanerLogout(req);\n }\n // No action — this is the original \"start a payment\" behavior.\n return await handlePrice(req);\n }\n return new Response(\n \"Good Maid Cleaning — payment + booking relay. Your website POSTs booking details here.\",\n { headers: { \"Content-Type\": \"text/plain\", ...CORS_HEADERS } },\n );\n } catch (err: any) {\n console.log(\"Relay error:\", err.message || String(err));\n return json({ error: err.message || String(err) }, 500);\n }\n}","createdAt",["D",1789429515596],"branchVersion","branchId","048abbb8-4f23-4e25-9a2a-f303da251163","id","8404c8b3-4aa5-43b8-8583-ddc128d651ed","goodmaid-stripe",["D",1788808460593],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","2cd2bd26-9686-4dcd-a759-914e239335a0","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a07323-8ac8-72a9-899a-bc2445c41a3d","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_96":95,"_102":53},"org",{"_96":95,"_97":53,"_98":53,"_18":55,"_99":100,"_101":25},"branch",{"_13":85,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"isOwned",19,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","goodmaidcleaning","handle","displayName","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":149,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":150,"_80":151,"_82":152,"_84":25},"tree",[144],"files",[144],"counts",{"_132":62,"_133":134,"_135":62,"_136":137,"_138":139},"contents",[124],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":125,"_32":28,"_30":31,"_126":-5,"_41":42,"_40":14,"_127":25,"_38":128,"_13":129,"_33":34,"_35":37,"_24":25,"_130":-5,"_27":131},"52c60f29-a4d6-465c-bdc0-0bbf1c8dfc96","parentId","latest",["D",1789429515596],15,"label",[28],"pulls","branches",1,"forks","envVars",{"_140":142,"_143":62},"connections",{"_140":62,"_141":62},"count","unfilledCount",3,"emptyCount",{"_43":125,"_32":28,"_30":31,"_126":-5,"_41":42,"_40":14,"_127":25,"_38":145,"_13":129,"_33":34,"_35":37,"_24":25,"_130":-5,"_146":147,"_27":148},["D",1789429515596],"children",[],[28],["D",1788808460593],{"_96":95,"_102":53},{"_96":95,"_97":53,"_98":53,"_18":55,"_99":100,"_101":25},{"_13":85,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"ctx",{"_78":-5,"_121":186,"_187":188,"_189":190,"_191":25,"_192":25,"_193":25,"_194":58,"_195":-5,"_196":-7,"_197":-7,"_198":62,"_199":25,"_200":25,"_201":-5,"_202":25,"_203":25,"_204":25,"_205":-5},"ENV",{"_157":158,"_159":160,"_161":86,"_162":163,"_164":165,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","fdb67791413f4386b4dbf18f354029a617f6160f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v16