ISisento

✳ Operations workspace

Run every stay with clarity.

Bookings, housekeeping, KPIs, and channel-fee finance — one workspace for owners and staff.

🔒 Only your assigned work is visible.

📋 Fee ledgers and finance stay owner-only.

✳ Secure access

Welcome back.

\n {error &&

{error}

}\n \n

\n Guests use the link sent with their booking, or{\" \"}\n look up a stay here.\n

\n \n );\n}\n\napp.post(\"/login\", async (c) => {\n const body = await c.req.parseBody();\n const username = String(body.username || \"\").trim().toLowerCase();\n const password = String(body.password || \"\");\n const res = await sqlite.execute({\n sql: \"SELECT * FROM users WHERE username = ? AND active = 1\",\n args: [username],\n });\n const row = res.rows[0] as any;\n if (!row || !(await verifyPassword(password, row.password_hash, row.salt))) {\n return c.html(, 401);\n }\n const token = await createSession(row.id);\n setSessionCookie(c, token);\n return c.redirect(row.role === \"owner\" ? \"/owner\" : \"/staff\");\n});\n\napp.post(\"/logout\", async (c) => {\n await destroySession(c);\n return c.redirect(\"/\");\n});\n\n// ---------- change password ----------\n\napp.get(\"/change-password\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.redirect(\"/\");\n return c.html(\n \n \n

\n \n

\n ,\n );\n});\n\napp.post(\"/change-password\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.redirect(\"/\");\n const body = await c.req.parseBody();\n const res = await sqlite.execute({ sql: \"SELECT * FROM users WHERE id = ?\", args: [user.id] });\n const row = res.rows[0] as any;\n const ok = await verifyPassword(String(body.current || \"\"), row.password_hash, row.salt);\n if (!ok) {\n return c.html(\n \n \n

Current password is incorrect.

\n Back\n ,\n 401,\n );\n }\n const { hash, salt } = await hashPassword(String(body.next || \"\"));\n await sqlite.execute({ sql: \"UPDATE users SET password_hash = ?, salt = ? WHERE id = ?\", args: [hash, salt, user.id] });\n return c.redirect(user.role === \"owner\" ? \"/owner\" : \"/staff\");\n});\n\n// ---------- guest portal (no login — booking access code) ----------\n\napp.get(\"/guest\", async (c) => {\n const err = c.req.query(\"error\");\n return c.html(\n \n

ISisento

✳ Stay portal

Find your stay.

Enter the access code from your booking confirmation to see arrival guidance and support details.

🏠 Reservation details, at a glance.

🔒 No internal or financial data shown here.

✳ Guest access

Look up your stay.

\n {err &&

Code not found. Check the code and try again.

}\n \n

Staff or owner? Sign in here.

\n ,\n );\n});\n\napp.get(\"/guest/lookup\", async (c) => {\n const code = String(c.req.query(\"code\") || \"\").trim().toUpperCase();\n return c.redirect(`/guest/${encodeURIComponent(code)}`);\n});\n\napp.get(\"/guest/:code\", async (c) => {\n const code = c.req.param(\"code\").trim().toUpperCase();\n const res = await sqlite.execute({\n sql: `SELECT b.*, u.developer, u.location, u.unit_no, u.room\n FROM bookings b JOIN units u ON u.id = b.unit_id\n WHERE b.access_code = ?`,\n args: [code],\n });\n const b = res.rows[0] as any;\n if (!b) return c.redirect(\"/guest?error=1\");\n\n return c.html(\n \n

ISisento stay

✳ Reservation

Welcome, {b.guest_name}

{b.location} — {b.unit_no} ({b.room})

\n\n

Check-in

{b.checkin_date}

Check-out

{b.checkout_date}

Status

{b.status.replace(\"_\", \" \")}

Booked via

{b.channel.replace(\"_\", \".\")}

\n\n

Arrival guidance

{b.arrival_notes || \"Arrival details will be sent closer to your check-in date.\"}

\n\n

Need help?

Support phone: {b.support_phone || \"—\"}

Support email: {b.support_email || \"—\"}

\n\n

\n This portal shows only your reservation details. Internal operations, staff tools, and financial information are not accessible from here.\n

\n ,\n );\n});\n\n// ---------- staff dashboard ----------\n\napp.get(\"/staff\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.redirect(\"/\");\n\n const tasksRes = await sqlite.execute({\n sql: `SELECT t.*, u.location, u.unit_no FROM tasks t JOIN units u ON u.id = t.unit_id\n WHERE t.assigned_to = ? ORDER BY (t.status='done'), t.due_date IS NULL, t.due_date`,\n args: [user.id],\n });\n const tasks = tasksRes.rows as any[];\n\n const notifRes = await sqlite.execute({\n sql: `SELECT * FROM notifications WHERE user_id = ? ORDER BY created_at DESC LIMIT 20`,\n args: [user.id],\n });\n const notifs = notifRes.rows as any[];\n\n const unitsRes = await sqlite.execute(`SELECT * FROM units WHERE active = 1 ORDER BY location`);\n const units = unitsRes.rows as any[];\n\n const total = tasks.length;\n const done = tasks.filter((t) => t.status === \"done\").length;\n const overdue = tasks.filter((t) => t.status !== \"done\" && t.due_date && t.due_date < todayIso()).length;\n const rate = total ? Math.round((done / total) * 100) : 0;\n const hour = new Date().getUTCHours() + 8; // rough PH-time greeting\n const greeting = hour >= 5 && hour < 12 ? \"Good morning\" : hour >= 12 && hour < 18 ? \"Good afternoon\" : \"Good evening\";\n\n return c.html(\n \n \n\n

Assigned

{total}

Completed

{done}

Completion rate

{rate}%

Overdue

{overdue}

\n\n

My checklist

\n {tasks.length === 0 &&

No tasks assigned right now.

}\n {tasks.map((t) => (\n

\n \n

\n {t.task_type}\n {t.description}\n

\n {t.location} · {t.unit_no} {t.due_date ? `· due ${t.due_date}` : \"\"}\n

\n {t.status !== \"done\" && t.due_date && t.due_date < todayIso() && Overdue}\n

\n ))}\n

\n\n

Notifications

\n {notifs.length === 0 &&

Nothing new.

}\n {notifs.map((n) => (\n

\n {n.message}\n

{n.created_at}

\n ))}\n

\n\n

Report an issue or supply need

\n \n

\n\n \n ,\n );\n});\n\napp.post(\"/api/tasks/:id/status\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.json({ error: \"unauthorized\" }, 401);\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({}));\n const status = body.status === \"done\" ? \"done\" : body.status === \"in_progress\" ? \"in_progress\" : \"todo\";\n\n // staff may only update their own tasks; owner may update any\n const check = await sqlite.execute({ sql: \"SELECT assigned_to FROM tasks WHERE id = ?\", args: [id] });\n const row = check.rows[0] as any;\n if (!row) return c.json({ error: \"not found\" }, 404);\n if (user.role !== \"owner\" && row.assigned_to !== user.id) return c.json({ error: \"forbidden\" }, 403);\n\n await sqlite.execute({\n sql: \"UPDATE tasks SET status = ?, completed_at = ? WHERE id = ?\",\n args: [status, status === \"done\" ? new Date().toISOString() : null, id],\n });\n return c.json({ ok: true });\n});\n\napp.post(\"/tasks/create\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.redirect(\"/\");\n const body = await c.req.parseBody();\n await sqlite.execute({\n sql: `INSERT INTO tasks (unit_id, task_type, description, assigned_to, status, due_date, created_by) VALUES (?,?,?,?,?,?,?)`,\n args: [\n Number(body.unit_id), String(body.task_type || \"cleaning\"), String(body.description || \"\"),\n Number(body.assigned_to), \"todo\", String(body.due_date || todayIso()), user.id,\n ],\n });\n return c.redirect(user.role === \"owner\" ? \"/owner\" : \"/staff\");\n});\n\n// ---------- owner dashboard ----------\n\napp.get(\"/owner\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n\n const bookingsRes = await sqlite.execute(\n `SELECT b.*, u.location, u.unit_no FROM bookings b JOIN units u ON u.id = b.unit_id ORDER BY b.checkin_date DESC LIMIT 50`,\n );\n const bookings = bookingsRes.rows as any[];\n\n const totals = bookings.reduce(\n (acc, b) => {\n const net = b.gross_revenue - b.airbnb_fee - b.booking_com_fee - b.other_fee;\n acc.gross += b.gross_revenue; acc.airbnb += b.airbnb_fee; acc.bookingcom += b.booking_com_fee;\n acc.other += b.other_fee; acc.net += net;\n return acc;\n },\n { gross: 0, airbnb: 0, bookingcom: 0, other: 0, net: 0 },\n );\n const feeTotal = totals.airbnb + totals.bookingcom + totals.other;\n const netPct = totals.gross ? Math.round((totals.net / totals.gross) * 1000) / 10 : 0;\n\n const staffKpiRes = await sqlite.execute(\n `SELECT us.id, us.name, us.position,\n COUNT(t.id) as total,\n SUM(CASE WHEN t.status='done' THEN 1 ELSE 0 END) as done,\n SUM(CASE WHEN t.status!='done' AND t.due_date IS NOT NULL AND t.due_date < date('now') THEN 1 ELSE 0 END) as overdue\n FROM users us LEFT JOIN tasks t ON t.assigned_to = us.id\n WHERE us.role = 'staff' AND us.active = 1\n GROUP BY us.id ORDER BY us.name`,\n );\n const staffKpi = staffKpiRes.rows as any[];\n\n const leadsRes = await sqlite.execute(`SELECT * FROM leads ORDER BY created_at DESC`);\n const leads = leadsRes.rows as any[];\n\n const unitsRes = await sqlite.execute(`SELECT * FROM units WHERE active = 1 ORDER BY location`);\n const units = unitsRes.rows as any[];\n\n const unassignedRes = await sqlite.execute(\n `SELECT t.*, u.location, u.unit_no FROM tasks t JOIN units u ON u.id = t.unit_id\n WHERE t.assigned_to IS NULL AND t.status != 'done' ORDER BY t.due_date IS NULL, t.due_date`,\n );\n const unassignedTasks = unassignedRes.rows as any[];\n\n const allStaffRes = await sqlite.execute(`SELECT id, name, position FROM users WHERE role = 'staff' AND active = 1 ORDER BY name`);\n const allStaff = allStaffRes.rows as any[];\n\n const syncQ = c.req.query(\"synced\");\n let syncFlash = null;\n if (syncQ === \"1\") {\n const imported = c.req.query(\"imported\") || \"0\";\n const updated = c.req.query(\"updated\") || \"0\";\n const errors = c.req.query(\"errors\") || \"0\";\n syncFlash = (\n

0 ? \"error\" : \"info\"}`}>\n Sync complete — {imported} new reservation{imported === \"1\" ? \"\" : \"s\"} imported, {updated} updated\n {Number(errors) > 0 ? `, ${errors} feed(s) failed to fetch.` : \".\"}\n

\n );\n }\n\n const statusBadge = (s: string) => {\n const cls = s === \"won\" ? \"ok\" : s === \"lost\" ? \"bad\" : s === \"negotiating\" ? \"warn\" : \"neutral\";\n return {s};\n };\n\n return c.html(\n \n \n\n

Channel-fee ledger

Gross booking revenue

{peso(totals.gross)}

Airbnb fees

{peso(totals.airbnb)}

Booking.com fees

{peso(totals.bookingcom)}

Net payout

{peso(totals.net)}

\n \n \n \n \n \n \n \n \n {bookings.map((b) => {\n const net = b.gross_revenue - b.airbnb_fee - b.booking_com_fee - b.other_fee;\n return (\n \n \n \n \n \n \n \n \n \n \n \n \n );\n })}\n \n

Unit	Guest	Channel	Check-in	Gross	Airbnb fee	Booking.com fee	Other fee	Net payout	Status
{b.location} {b.unit_no}	{b.guest_name}	{b.channel.replace(\"_\", \".\")}	{b.checkin_date}	{peso(b.gross_revenue)}	{b.airbnb_fee ? peso(b.airbnb_fee) : \"—\"}	{b.booking_com_fee ? peso(b.booking_com_fee) : \"—\"}	{b.other_fee ? peso(b.other_fee) : \"—\"}	{peso(net)}	\n {b.status.replace(\"_\", \" \")}\n {Number(b.needs_details) === 1 && (\n \n Needs details{\" \"}\n Add details\n \n )}\n

\n Airbnb and Booking.com don't hand out full reservation data (guest name, price) through calendar feeds — only blocked dates. Rows synced this way show a \"Needs details\" badge until you fill in the guest and revenue info.\n

\n\n

Calendar sync

Airbnb & Booking.com iCal feeds

\n \n

\n {syncFlash}\n

\n \n \n \n {units.map((u) => (\n \n \n \n \n ))}\n \n

Unit	Airbnb iCal URL	Booking.com iCal URL	Last synced
{u.location} {u.unit_no}	\n \n \n \n \n \n \n \n \n {u.ical_last_synced_at ? `Synced ${u.ical_last_synced_at}` : \"Never synced\"}\n \n \n \n

\n Find these under each listing's calendar settings: Airbnb host dashboard → Calendar → Availability settings → Export calendar. Booking.com extranet → Rates & Availability → Sync calendars → Export.\n

\n\n

Owner's financial lens

Portfolio profitability at a glance.

Gross revenue

{peso(totals.gross)}

Across {bookings.length} bookings on record

Platform & other fees

{peso(feeTotal)}

{totals.gross ? Math.round((feeTotal / totals.gross) * 1000) / 10 : 0}% of gross revenue

Net profitability

{netPct}%

{peso(totals.net)} retained

\n\n

Add booking

Unit

Guest name

\n Channel\n \n

Status\n \n

Check-in

Check-out

Gross revenue (₱)

Airbnb fee (₱)

Booking.com fee (₱)

Other fee (₱)

Arrival guidance for guest

Support phone

Support email

\n \n

\n\n

Unassigned tasks

\n {unassignedTasks.length === 0 &&

Nothing unassigned right now.

}\n {unassignedTasks.length > 0 && (\n \n \n \n {unassignedTasks.map((t) => (\n \n \n \n \n \n \n \n ))}\n \n

Unit	Type	Description	Due	Assign to
{t.location} {t.unit_no}	{t.task_type}	{t.description}	{t.due_date \|\| \"—\"}	\n \n \n \n \n

\n )}\n

\n\n

Staff KPI overview

\n \n \n \n {staffKpi.map((s) => {\n const rate = s.total ? Math.round((s.done / s.total) * 100) : 0;\n return (\n \n \n \n \n \n );\n })}\n \n

Staff	Position	Assigned	Completed	Completion rate	Overdue
{s.name}	{s.position}	{s.total}	{s.done}	{rate}%	{s.overdue > 0 ? {s.overdue} : \"0\"}

\n\n

Sales lead tracker — partner websites

\n \n \n \n {leads.map((l) => (\n \n \n \n \n \n \n \n ))}\n \n

Partner	Contact	Status	Potential units	Notes
{l.partner_name} {l.website}	{l.contact_name \|\| \"—\"}	{statusBadge(l.status)}	{l.potential_units ?? \"—\"}	{l.notes}

\n \n

\n\n

Units under management

\n \n \n {units.map((u) => )}\n

Developer	Location	Unit	Room	SQM
{u.developer}	{u.location}	{u.unit_no}	{u.room}	{u.sqm}

\n ,\n );\n});\n\napp.post(\"/bookings/create\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n const body = await c.req.parseBody();\n function code(len = 8) {\n const chars = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n let out = \"\";\n for (let i = 0; i < len; i++) out += chars[Math.floor(Math.random() * chars.length)];\n return out;\n }\n await sqlite.execute({\n sql: `INSERT INTO bookings (unit_id, guest_name, channel, checkin_date, checkout_date, gross_revenue, airbnb_fee, booking_com_fee, other_fee, status, access_code, arrival_notes, support_phone, support_email, created_by)\n VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,\n args: [\n Number(body.unit_id), String(body.guest_name), String(body.channel), String(body.checkin_date), String(body.checkout_date),\n Number(body.gross_revenue || 0), Number(body.airbnb_fee || 0), Number(body.booking_com_fee || 0), Number(body.other_fee || 0),\n String(body.status || \"confirmed\"), code(), String(body.arrival_notes || \"\"), String(body.support_phone || \"\"), String(body.support_email || \"\"),\n user.id,\n ],\n });\n return c.redirect(\"/owner\");\n});\n\napp.post(\"/leads/create\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n const body = await c.req.parseBody();\n await sqlite.execute({\n sql: `INSERT INTO leads (partner_name, website, contact_name, status, potential_units, notes, created_by) VALUES (?,?,?,?,?,?,?)`,\n args: [\n String(body.partner_name), String(body.website || \"\"), String(body.contact_name || \"\"),\n \"new\", body.potential_units ? Number(body.potential_units) : null, String(body.notes || \"\"), user.id,\n ],\n });\n return c.redirect(\"/owner\");\n});\n\napp.post(\"/leads/:id/status\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.json({ error: \"unauthorized\" }, 401);\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({}));\n await sqlite.execute({ sql: \"UPDATE leads SET status = ? WHERE id = ?\", args: [String(body.status), id] });\n return c.json({ ok: true });\n});\n\n// ---------- calendar sync (Airbnb / Booking.com iCal) ----------\n\napp.post(\"/units/:id/ical\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.parseBody();\n await sqlite.execute({\n sql: `UPDATE units SET airbnb_ical_url = ?, booking_com_ical_url = ? WHERE id = ?`,\n args: [String(body.airbnb_ical_url || \"\").trim() || null, String(body.booking_com_ical_url || \"\").trim() || null, id],\n });\n return c.redirect(\"/owner\");\n});\n\napp.post(\"/sync/ical\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n const results = await syncAllCalendars();\n const imported = results.reduce((n, r) => n + r.imported, 0);\n const updated = results.reduce((n, r) => n + r.updated, 0);\n const errors = results.reduce((n, r) => n + r.errors, 0);\n return c.redirect(`/owner?synced=1&imported=${imported}&updated=${updated}&errors=${errors}`);\n});\n\n// ---------- booking edit (fill in details for calendar-synced reservations) ----------\n\napp.get(\"/bookings/:id/edit\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n const id = Number(c.req.param(\"id\"));\n const res = await sqlite.execute({\n sql: `SELECT b.*, u.location, u.unit_no FROM bookings b JOIN units u ON u.id = b.unit_id WHERE b.id = ?`,\n args: [id],\n });\n const b = res.rows[0] as any;\n if (!b) return c.redirect(\"/owner\");\n\n return c.html(\n \n \n

\n \n

\n ,\n );\n});\n\napp.post(\"/bookings/:id/edit\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.parseBody();\n await sqlite.execute({\n sql: `UPDATE bookings SET guest_name = ?, channel = ?, checkin_date = ?, checkout_date = ?, gross_revenue = ?,\n airbnb_fee = ?, booking_com_fee = ?, other_fee = ?, status = ?, arrival_notes = ?, support_phone = ?, support_email = ?,\n needs_details = 0\n WHERE id = ?`,\n args: [\n String(body.guest_name), String(body.channel), String(body.checkin_date), String(body.checkout_date),\n Number(body.gross_revenue || 0), Number(body.airbnb_fee || 0), Number(body.booking_com_fee || 0), Number(body.other_fee || 0),\n String(body.status || \"confirmed\"), String(body.arrival_notes || \"\"), String(body.support_phone || \"\"), String(body.support_email || \"\"),\n id,\n ],\n });\n return c.redirect(\"/owner\");\n});\n\n// ---------- unassigned task quick-assign ----------\n\napp.post(\"/tasks/:id/assign\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.parseBody();\n const assignedTo = Number(body.assigned_to);\n if (!assignedTo) return c.redirect(\"/owner\");\n await sqlite.execute({ sql: `UPDATE tasks SET assigned_to = ? WHERE id = ?`, args: [assignedTo, id] });\n const task = await sqlite.execute({ sql: `SELECT description, task_type FROM tasks WHERE id = ?`, args: [id] });\n const t = task.rows[0] as any;\n if (t) {\n await sqlite.execute({\n sql: `INSERT INTO notifications (user_id, message) VALUES (?, ?)`,\n args: [assignedTo, `New ${t.task_type} task assigned: ${t.description}`],\n });\n }\n return c.redirect(\"/owner\");\n});\n\nexport default app.fetch;\n","isento-ops",[],[198],"f581bec7-394b-46dc-9846-dd5bcd1525ed","ical.ts","e6f3ba08-a0e7-11f1-995e-1607ee4eb77e",17,["D",1787705329769],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n// ---------- minimal ICS parser ----------\n// Airbnb / Booking.com calendar exports only contain block dates (DTSTART/DTEND)\n// and a UID — never guest name or price, by platform design. We import the dates\n// as a placeholder booking and flag it \"needs_details\" for the owner to fill in.\n\ninterface IcsEvent {\n uid: string;\n summary: string;\n dtstart: string; // YYYY-MM-DD\n dtend: string; // YYYY-MM-DD\n}\n\nfunction unfold(text: string): string[] {\n const rawLines = text.split(/\\r\\n|\\n|\\r/);\n const lines: string[] = [];\n for (const line of rawLines) {\n if ((line.startsWith(\" \") || line.startsWith(\"\\t\")) && lines.length > 0) {\n lines[lines.length - 1] += line.slice(1);\n } else {\n lines.push(line);\n }\n }\n return lines;\n}\n\nfunction toIsoDate(raw: string): string | null {\n // raw looks like \"20260901\" or \"20260901T000000Z\"\n const m = raw.match(/^(\\d{4})(\\d{2})(\\d{2})/);\n if (!m) return null;\n return `${m[1]}-${m[2]}-${m[3]}`;\n}\n\nexport function parseIcs(text: string): IcsEvent[] {\n const lines = unfold(text);\n const events: IcsEvent[] = [];\n let cur: Partial | null = null;\n for (const line of lines) {\n if (line.startsWith(\"BEGIN:VEVENT\")) {\n cur = {};\n continue;\n }\n if (line.startsWith(\"END:VEVENT\")) {\n if (cur && cur.uid && cur.dtstart && cur.dtend) {\n events.push({\n uid: cur.uid,\n summary: cur.summary || \"\",\n dtstart: cur.dtstart,\n dtend: cur.dtend,\n });\n }\n cur = null;\n continue;\n }\n if (!cur) continue;\n const idx = line.indexOf(\":\");\n if (idx === -1) continue;\n const key = line.slice(0, idx).split(\";\")[0].toUpperCase();\n const value = line.slice(idx + 1).trim();\n if (key === \"UID\") cur.uid = value;\n else if (key === \"SUMMARY\") cur.summary = value;\n else if (key === \"DTSTART\") {\n const d = toIsoDate(value);\n if (d) cur.dtstart = d;\n } else if (key === \"DTEND\") {\n const d = toIsoDate(value);\n if (d) cur.dtend = d;\n }\n }\n return events;\n}\n\nfunction randomCode(len = 8): string {\n const chars = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n let out = \"\";\n for (let i = 0; i < len; i++) out += chars[Math.floor(Math.random() * chars.length)];\n return out;\n}\n\nasync function syncOneFeed(\n unitId: number,\n url: string,\n channel: \"airbnb\" | \"booking_com\",\n): Promise<{ imported: number; updated: number; errors: number }> {\n let events: IcsEvent[] = [];\n try {\n const res = await fetch(url, { headers: { \"User-Agent\": \"Isento-Sync/1.0\" } });\n if (!res.ok) return { imported: 0, updated: 0, errors: 1 };\n const text = await res.text();\n events = parseIcs(text);\n } catch {\n return { imported: 0, updated: 0, errors: 1 };\n }\n\n let imported = 0;\n let updated = 0;\n\n for (const ev of events) {\n const externalUid = `${channel}:${ev.uid}`;\n const existing = await sqlite.execute({\n sql: `SELECT id, needs_details FROM bookings WHERE external_uid = ?`,\n args: [externalUid],\n });\n const row = existing.rows[0] as any;\n\n if (row) {\n // Only refresh dates — never clobber guest/fee details the owner already entered.\n await sqlite.execute({\n sql: `UPDATE bookings SET checkin_date = ?, checkout_date = ? WHERE id = ?`,\n args: [ev.dtstart, ev.dtend, row.id],\n });\n updated++;\n continue;\n }\n\n const guestLabel = channel === \"airbnb\" ? \"Airbnb guest (pending details)\" : \"Booking.com guest (pending details)\";\n const insertRes = await sqlite.execute({\n sql: `INSERT INTO bookings\n (unit_id, guest_name, channel, checkin_date, checkout_date, gross_revenue, airbnb_fee, booking_com_fee, other_fee,\n status, access_code, external_uid, source, needs_details)\n VALUES (?,?,?,?,?,0,0,0,0,'confirmed',?,?,?,1)`,\n args: [unitId, guestLabel, channel, ev.dtstart, ev.dtend, randomCode(), externalUid, `ical_${channel}`],\n });\n const bookingId = Number(insertRes.lastInsertRowid);\n imported++;\n\n // Auto-create an unassigned turnover-cleaning task for the checkout day, once per booking.\n const existingTask = await sqlite.execute({\n sql: `SELECT id FROM tasks WHERE booking_id = ?`,\n args: [bookingId],\n });\n if (existingTask.rows.length === 0) {\n await sqlite.execute({\n sql: `INSERT INTO tasks (unit_id, booking_id, task_type, description, assigned_to, status, due_date)\n VALUES (?,?,?,?,NULL,'todo',?)`,\n args: [unitId, bookingId, \"cleaning\", \"Turnover clean & inspection (auto-created from calendar sync)\", ev.dtend],\n });\n }\n }\n\n return { imported, updated, errors: 0 };\n}\n\nexport async function syncAllCalendars(): Promise<\n { unitId: number; location: string; unitNo: string; channel: string; imported: number; updated: number; errors: number }[]\n> {\n const unitsRes = await sqlite.execute(\n `SELECT id, location, unit_no, airbnb_ical_url, booking_com_ical_url FROM units WHERE active = 1`,\n );\n const results: { unitId: number; location: string; unitNo: string; channel: string; imported: number; updated: number; errors: number }[] = [];\n\n for (const u of unitsRes.rows as any[]) {\n if (u.airbnb_ical_url) {\n const r = await syncOneFeed(u.id, u.airbnb_ical_url, \"airbnb\");\n results.push({ unitId: u.id, location: u.location, unitNo: u.unit_no, channel: \"airbnb\", ...r });\n }\n if (u.booking_com_ical_url) {\n const r = await syncOneFeed(u.id, u.booking_com_ical_url, \"booking_com\");\n results.push({ unitId: u.id, location: u.location, unitNo: u.unit_no, channel: \"booking_com\", ...r });\n }\n if (u.airbnb_ical_url || u.booking_com_ical_url) {\n await sqlite.execute({\n sql: `UPDATE units SET ical_last_synced_at = datetime('now') WHERE id = ?`,\n args: [u.id],\n });\n }\n }\n\n return results;\n}\n",[],[208],"358f02c6-6eea-4227-b5b4-c4e32b4f51ce","ical-sync-cron.ts","1cb31314-a0e8-11f1-876c-1607ee4eb77e",["D",1787705419944],"interval","import { initDb } from \"./db.ts\";\nimport { syncAllCalendars } from \"./ical.ts\";\n\n// Runs on a schedule (see write_interval_settings) to pull Airbnb / Booking.com\n// iCal feeds for every unit that has one configured, without anyone needing to\n// click \"Sync now\" on the owner dashboard.\nexport default async function (interval: Interval) {\n await initDb();\n const results = await syncAllCalendars();\n const imported = results.reduce((n, r) => n + r.imported, 0);\n const updated = results.reduce((n, r) => n + r.updated, 0);\n const errors = results.reduce((n, r) => n + r.errors, 0);\n console.log(`iCal sync: ${imported} imported, ${updated} updated, ${errors} feed errors (${results.length} feeds checked)`);\n}\n",[],[216],"88d2a8e4-0e49-493a-a517-3be4fcef8650","db.ts","6af305dc-a086-11f1-b89c-1607ee4eb77e",16,["D",1787705274268],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport async function initDb() {\n await sqlite.batch([\n {\n sql: `CREATE TABLE IF NOT EXISTS users (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT NOT NULL,\n username TEXT NOT NULL UNIQUE,\n password_hash TEXT NOT NULL,\n salt TEXT NOT NULL,\n role TEXT NOT NULL CHECK(role IN ('staff','owner')),\n position TEXT,\n active INTEGER NOT NULL DEFAULT 1,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS sessions (\n token TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL REFERENCES users(id),\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n expires_at TEXT NOT NULL\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS units (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n developer TEXT,\n location TEXT,\n unit_no TEXT NOT NULL,\n room TEXT,\n sqm REAL,\n active INTEGER NOT NULL DEFAULT 1\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS bookings (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n unit_id INTEGER NOT NULL REFERENCES units(id),\n guest_name TEXT NOT NULL,\n channel TEXT NOT NULL CHECK(channel IN ('airbnb','booking_com','direct','other')),\n checkin_date TEXT NOT NULL,\n checkout_date TEXT NOT NULL,\n gross_revenue REAL NOT NULL DEFAULT 0,\n airbnb_fee REAL NOT NULL DEFAULT 0,\n booking_com_fee REAL NOT NULL DEFAULT 0,\n other_fee REAL NOT NULL DEFAULT 0,\n status TEXT NOT NULL DEFAULT 'confirmed' CHECK(status IN ('confirmed','checked_in','checked_out','cancelled')),\n access_code TEXT NOT NULL UNIQUE,\n arrival_notes TEXT,\n support_phone TEXT,\n support_email TEXT,\n created_by INTEGER REFERENCES users(id),\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS tasks (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n unit_id INTEGER NOT NULL REFERENCES units(id),\n booking_id INTEGER REFERENCES bookings(id),\n task_type TEXT NOT NULL CHECK(task_type IN ('cleaning','laundry','supplies','repair')),\n description TEXT NOT NULL,\n assigned_to INTEGER REFERENCES users(id),\n status TEXT NOT NULL DEFAULT 'todo' CHECK(status IN ('todo','in_progress','done')),\n due_date TEXT,\n created_by INTEGER REFERENCES users(id),\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n completed_at TEXT\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS notifications (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n user_id INTEGER NOT NULL REFERENCES users(id),\n message TEXT NOT NULL,\n is_read INTEGER NOT NULL DEFAULT 0,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS leads (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n partner_name TEXT NOT NULL,\n website TEXT,\n contact_name TEXT,\n contact_email TEXT,\n contact_phone TEXT,\n status TEXT NOT NULL DEFAULT 'new' CHECK(status IN ('new','contacted','negotiating','won','lost')),\n potential_units INTEGER,\n notes TEXT,\n created_by INTEGER REFERENCES users(id),\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n },\n ]);\n\n await migrate();\n}\n\n// Idempotent column migrations — ALTER TABLE has no IF NOT EXISTS in SQLite,\n// so each addition is wrapped and ignored if the column is already there.\nasync function migrate() {\n const alters = [\n `ALTER TABLE units ADD COLUMN airbnb_ical_url TEXT`,\n `ALTER TABLE units ADD COLUMN booking_com_ical_url TEXT`,\n `ALTER TABLE units ADD COLUMN ical_last_synced_at TEXT`,\n `ALTER TABLE bookings ADD COLUMN external_uid TEXT`,\n `ALTER TABLE bookings ADD COLUMN source TEXT NOT NULL DEFAULT 'manual'`,\n `ALTER TABLE bookings ADD COLUMN needs_details INTEGER NOT NULL DEFAULT 0`,\n ];\n for (const sql of alters) {\n try {\n await sqlite.execute(sql);\n } catch {\n // column already exists — fine\n }\n }\n}\n",[],[224],"51cc9a17-df20-4865-947d-695c7d4d673f","auth.ts","75430aa0-a086-11f1-acf9-1607ee4eb77e",4,["D",1787663477842],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { getCookie, setCookie, deleteCookie } from \"npm:hono@4/cookie\";\nimport type { Context } from \"npm:hono@4\";\n\nconst SESSION_COOKIE = \"isento_session\";\nconst SESSION_DAYS = 14;\n\nfunction toHex(buf: ArrayBuffer): string {\n return Array.from(new Uint8Array(buf)).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction randomHex(bytes: number): string {\n const arr = new Uint8Array(bytes);\n crypto.getRandomValues(arr);\n return toHex(arr.buffer);\n}\n\nasync function pbkdf2(password: string, saltHex: string): Promise {\n const enc = new TextEncoder();\n const keyMaterial = await crypto.subtle.importKey(\n \"raw\",\n enc.encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const saltBytes = new Uint8Array(saltHex.match(/.{2}/g)!.map((h) => parseInt(h, 16)));\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt: saltBytes, iterations: 100_000, hash: \"SHA-256\" },\n keyMaterial,\n 256,\n );\n return toHex(bits);\n}\n\nexport async function hashPassword(password: string): Promise<{ hash: string; salt: string }> {\n const salt = randomHex(16);\n const hash = await pbkdf2(password, salt);\n return { hash, salt };\n}\n\nexport async function verifyPassword(password: string, hash: string, salt: string): Promise {\n const computed = await pbkdf2(password, salt);\n return computed === hash;\n}\n\nexport interface SessionUser {\n id: number;\n name: string;\n username: string;\n role: \"staff\" | \"owner\";\n position: string | null;\n}\n\nexport async function createSession(userId: number): Promise {\n const token = randomHex(32);\n const expires = new Date(Date.now() + SESSION_DAYS * 24 * 60 * 60 * 1000).toISOString();\n await sqlite.execute({\n sql: \"INSERT INTO sessions (token, user_id, expires_at) VALUES (?, ?, ?)\",\n args: [token, userId, expires],\n });\n return token;\n}\n\nexport function setSessionCookie(c: Context, token: string) {\n setCookie(c, SESSION_COOKIE, token, {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n path: \"/\",\n maxAge: SESSION_DAYS * 24 * 60 * 60,\n });\n}\n\nexport function clearSessionCookie(c: Context) {\n deleteCookie(c, SESSION_COOKIE, { path: \"/\" });\n}\n\nexport async function getCurrentUser(c: Context): Promise {\n const token = getCookie(c, SESSION_COOKIE);\n if (!token) return null;\n const res = await sqlite.execute({\n sql: `SELECT u.id, u.name, u.username, u.role, u.position\n FROM sessions s JOIN users u ON u.id = s.user_id\n WHERE s.token = ? AND s.expires_at > datetime('now') AND u.active = 1`,\n args: [token],\n });\n if (res.rows.length === 0) return null;\n return res.rows[0] as unknown as SessionUser;\n}\n\nexport async function destroySession(c: Context) {\n const token = getCookie(c, SESSION_COOKIE);\n if (token) {\n await sqlite.execute({ sql: \"DELETE FROM sessions WHERE token = ?\", args: [token] });\n }\n clearSessionCookie(c);\n}\n",[],[232],["D",1787663386761],[],[18],"0283f0bb-3eb6-4227-a6ce-ec585459436b","favicon.svg","01a0390a-88ed-72fa-80c5-60e4f5bee1e5","01a0390a-88ed-72fa-80c5-6427390b00fe",["D",1787663386761],"\n",[],[79,243],"ac2149a5-8abd-47a6-b7ff-0443a51b949d","counter.ts","01a0390a-88ed-72fa-80c5-5f219145afec",["D",1787663386761],"const count = document.getElementById(\"count\")!;\nconst button = document.getElementById(\"increment\")!;\n\nbutton.addEventListener(\"click\", async () => {\n const res = await fetch(\"/api/increment\", { method: \"POST\" });\n const data = await res.json();\n count.textContent = String(data.count);\n});\n",[],[79,251],"620660df-f130-4cb5-a7f4-15f65c354c51",["D",1787663386761],"directory",[168,169],[79],["D",1787663386761],["D",1789485645684],{"_11":12,"_127":73},{"_11":12,"_122":123,"_72":73,"_30":71,"_124":125,"_126":24},{"_38":113,"_13":16,"_32":35,"_114":75,"_115":-5,"_116":-5,"_117":-5,"_118":-5,"_119":-5,"_120":14,"_121":12},"ctx",{"_53":-5,"_146":300,"_301":302,"_303":304,"_305":24,"_306":24,"_307":24,"_308":87,"_309":-5,"_310":-7,"_311":-7,"_312":26,"_313":24,"_314":24,"_315":-5,"_316":24,"_317":24,"_318":24,"_319":-5},"ENV",{"_271":272,"_273":274,"_275":16,"_276":277,"_278":279,"_280":281,"_282":283,"_284":285,"_286":287,"_288":289,"_290":291,"_292":293,"_294":295,"_296":297,"_298":299},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

{title}

Run every stay with clarity.

Welcome back.

Find your stay.

Look up your stay.

Welcome, {b.guest_name}

Arrival guidance

Need help?

My checklist

Notifications

Report an issue or supply need

Channel-fee ledger

Airbnb & Booking.com iCal feeds

Portfolio profitability at a glance.

Add booking

Unassigned tasks

Staff KPI overview

Sales lead tracker — partner websites

Units under management

History · README.md