\n \n

{children}

\n )\n :

{children}

}\n \n \n \n );\n}\n\nexport function PageHeader(\n { eyebrow, title, subtitle, actions }: { eyebrow: string; title: string; subtitle?: string; actions?: any },\n) {\n return (\n \n );\n}\n","label",[18],"pulls","branches","forks","envVars",{"_172":26,"_174":26},"connections",{"_172":26,"_173":26},"count","unfilledCount","emptyCount",{"_33":263,"_13":86,"_64":251,"_43":-5,"_35":36,"_157":160,"_158":94,"_37":264,"_39":26,"_66":265,"_161":-5,"_68":24,"_163":-5,"_187":266,"_17":267},{"_33":256,"_13":257,"_64":258,"_43":251,"_35":36,"_157":160,"_158":94,"_37":259,"_39":26,"_66":67,"_161":260,"_68":24,"_163":-5,"_187":261,"_17":262},{"_33":248,"_13":249,"_64":250,"_43":251,"_35":36,"_157":160,"_158":94,"_37":252,"_39":26,"_66":21,"_161":253,"_68":24,"_163":-5,"_187":254,"_17":255},{"_33":241,"_13":242,"_64":243,"_43":-5,"_35":36,"_157":160,"_158":94,"_37":244,"_39":26,"_66":21,"_161":245,"_68":24,"_163":-5,"_187":246,"_17":247},{"_33":233,"_13":234,"_64":235,"_43":-5,"_35":36,"_157":236,"_158":94,"_37":237,"_39":26,"_66":67,"_161":238,"_68":24,"_163":-5,"_187":239,"_17":240},{"_33":225,"_13":226,"_64":227,"_43":-5,"_35":36,"_157":228,"_158":94,"_37":229,"_39":195,"_66":67,"_161":230,"_68":24,"_163":-5,"_187":231,"_17":232},{"_33":217,"_13":218,"_64":219,"_43":-5,"_35":36,"_157":120,"_158":94,"_37":220,"_39":26,"_66":221,"_161":222,"_68":24,"_163":-5,"_187":223,"_17":224},{"_33":209,"_13":210,"_64":211,"_43":-5,"_35":36,"_157":212,"_158":94,"_37":213,"_39":26,"_66":67,"_161":214,"_68":24,"_163":-5,"_187":215,"_17":216},{"_33":199,"_13":200,"_64":92,"_43":-5,"_35":36,"_157":201,"_158":94,"_37":202,"_39":203,"_66":204,"_161":205,"_68":24,"_163":206,"_187":207,"_17":208},{"_33":190,"_13":191,"_64":192,"_43":-5,"_35":36,"_157":193,"_158":94,"_37":194,"_39":195,"_66":67,"_161":196,"_68":24,"_163":-5,"_187":197,"_17":198},{"_33":156,"_13":18,"_64":65,"_43":-5,"_35":36,"_157":74,"_158":94,"_37":186,"_39":160,"_66":67,"_161":162,"_68":24,"_163":-5,"_187":188,"_17":189},["D",1787704288658],"children",[],[18],"6933662b-815b-406a-a9f8-6504e85e1ad7","seed.ts","85f5bc76-a086-11f1-b9a2-1607ee4eb77e",13,["D",1787703979439],2,"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { hashPassword } from \"./auth.ts\";\n\nconst UNITS = [\n { developer: \"Megaworld\", location: \"Venice Luxury Residences BGC\", unit_no: \"3F Domenico\", room: \"1 BR\", sqm: 66 },\n { developer: \"Avida\", location: \"Asten Makati\", unit_no: \"612 Tower 2\", room: \"1 BR\", sqm: 34 },\n { developer: \"SMDC\", location: \"Shell Residences\", unit_no: \"852 Tower A\", room: \"1 BR\", sqm: 38 },\n { developer: \"Amaia Steps\", location: \"Alabang\", unit_no: \"430 Helena\", room: \"Studio\", sqm: 25 },\n { developer: \"Avida\", location: \"Southpoint Makati\", unit_no: \"234 Tower 1\", room: \"1 BR\", sqm: 38 },\n { developer: \"DMCI\", location: \"Alder Taguig\", unit_no: \"912 Manzuria\", room: \"2 BR\", sqm: 54 },\n { developer: \"DMCI\", location: \"Alder Taguig\", unit_no: \"PH 07 Oregon\", room: \"3 BR\", sqm: 98 },\n { developer: \"DMCI\", location: \"Allegra\", unit_no: \"1202 Soraya\", room: \"1 BR\", sqm: 30 },\n { developer: \"DMCI\", location: \"Cubao\", unit_no: \"3811 Oriana\", room: \"2 BR\", sqm: 54 },\n { developer: \"Casa Real\", location: \"Bacolor Pampanga\", unit_no: \"Lot 9 Blk 19\", room: \"4 BR\", sqm: 200 },\n];\n\nconst STAFF = [\n { name: \"Darwin\", username: \"darwin\", position: \"Cleaner\" },\n { name: \"Nur\", username: \"nur\", position: \"Cleaner\" },\n { name: \"Daryl\", username: \"daryl\", position: \"Supplies, Logistics\" },\n { name: \"Nadz\", username: \"nadz\", position: \"Maintenance Technician\" },\n { name: \"Atty. Ivy\", username: \"ivy\", position: \"HR\" },\n];\n\nfunction randomCode(len = 8): string {\n const chars = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n let out = \"\";\n for (let i = 0; i < len; i++) out += chars[Math.floor(Math.random() * chars.length)];\n return out;\n}\n\nexport async function seedIfEmpty() {\n const existing = await sqlite.execute(\"SELECT COUNT(*) as n FROM users\");\n const n = (existing.rows[0] as any).n as number;\n if (n > 0) return { seeded: false };\n\n // --- owner ---\n const ownerPw = await hashPassword(\"Isento#Owner2026\");\n await sqlite.execute({\n sql: `INSERT INTO users (name, username, password_hash, salt, role, position) VALUES (?,?,?,?,?,?)`,\n args: [\"Dr. Meddie Edodollon\", \"meddie\", ownerPw.hash, ownerPw.salt, \"owner\", \"Owner\"],\n });\n\n // --- staff ---\n const staffIds: Record = {};\n for (const s of STAFF) {\n const pw = await hashPassword(`Isento#${s.username[0].toUpperCase()}${s.username.slice(1)}26`);\n const res = await sqlite.execute({\n sql: `INSERT INTO users (name, username, password_hash, salt, role, position) VALUES (?,?,?,?,?,?)`,\n args: [s.name, s.username, pw.hash, pw.salt, \"staff\", s.position],\n });\n staffIds[s.username] = Number(res.lastInsertRowid);\n }\n\n // --- units ---\n const unitIds: number[] = [];\n for (const u of UNITS) {\n const res = await sqlite.execute({\n sql: `INSERT INTO units (developer, location, unit_no, room, sqm) VALUES (?,?,?,?,?)`,\n args: [u.developer, u.location, u.unit_no, u.room, u.sqm],\n });\n unitIds.push(Number(res.lastInsertRowid));\n }\n\n // --- sample bookings (real channel-fee ledger demo data) ---\n const today = new Date();\n const iso = (d: Date) => d.toISOString().slice(0, 10);\n const plus = (days: number) => { const d = new Date(today); d.setDate(d.getDate() + days); return d; };\n\n const bookings = [\n { unitIdx: 0, guest: \"J. Reyes\", channel: \"airbnb\", checkin: plus(-1), checkout: plus(3), gross: 45000, airbnb: 6750, bookingcom: 0, other: 0 },\n { unitIdx: 2, guest: \"M. Santos\", channel: \"booking_com\", checkin: plus(0), checkout: plus(4), gross: 46000, airbnb: 0, bookingcom: 6900, other: 0 },\n { unitIdx: 5, guest: \"A. Cruz\", channel: \"direct\", checkin: plus(2), checkout: plus(6), gross: 32000, airbnb: 0, bookingcom: 0, other: 0 },\n { unitIdx: 8, guest: \"K. Villanueva\", channel: \"airbnb\", checkin: plus(5), checkout: plus(9), gross: 38000, airbnb: 5700, bookingcom: 0, other: 0 },\n ];\n const bookingIds: number[] = [];\n for (const b of bookings) {\n const res = await sqlite.execute({\n sql: `INSERT INTO bookings (unit_id, guest_name, channel, checkin_date, checkout_date, gross_revenue, airbnb_fee, booking_com_fee, other_fee, status, access_code, arrival_notes, support_phone, support_email)\n VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,\n args: [\n unitIds[b.unitIdx], b.guest, b.channel, iso(b.checkin), iso(b.checkout),\n b.gross, b.airbnb, b.bookingcom, b.other, \"confirmed\", randomCode(),\n \"Gate code will be sent 1 day before arrival. Unit is on a mid-floor unit with elevator access. Parking (if booked) is on B2.\",\n \"+63 917 000 1234\", \"stay@isento.app\",\n ],\n });\n bookingIds.push(Number(res.lastInsertRowid));\n }\n\n // --- sample tasks ---\n const tasks = [\n { unitIdx: 0, bookingIdx: 0, type: \"cleaning\", desc: \"Turnover clean before next check-in\", staff: \"darwin\", due: plus(3) },\n { unitIdx: 2, bookingIdx: 1, type: \"laundry\", desc: \"Wash & restock linens (queen set x2)\", staff: \"nadz\", due: plus(0) },\n { unitIdx: 5, bookingIdx: null, type: \"supplies\", desc: \"Refill toiletries, coffee, drinking water\", staff: \"daryl\", due: plus(1) },\n { unitIdx: 8, bookingIdx: 3, type: \"repair\", desc: \"Fix bathroom faucet leak reported by previous guest\", staff: \"daryl\", due: plus(2) },\n { unitIdx: 1, bookingIdx: null, type: \"cleaning\", desc: \"Deep clean — quarterly schedule\", staff: \"nur\", due: plus(4) },\n ];\n for (const t of tasks) {\n await sqlite.execute({\n sql: `INSERT INTO tasks (unit_id, booking_id, task_type, description, assigned_to, status, due_date) VALUES (?,?,?,?,?,?,?)`,\n args: [\n unitIds[t.unitIdx],\n t.bookingIdx === null ? null : bookingIds[t.bookingIdx],\n t.type, t.desc, staffIds[t.staff], \"todo\", iso(t.due),\n ],\n });\n await sqlite.execute({\n sql: `INSERT INTO notifications (user_id, message) VALUES (?, ?)`,\n args: [staffIds[t.staff], `New ${t.type} task assigned: ${t.desc}`],\n });\n }\n\n // --- sample leads ---\n const leads = [\n { partner: \"Airbnb Business Travel Ready Program\", website: \"airbnb.com\", contact: \"Partner Success Team\", status: \"contacted\", units: 10, notes: \"Applying to unlock corporate/long-stay travelers.\" },\n { partner: \"Booking.com Genius Partner Upgrade\", website: \"booking.com\", contact: \"Partner Hub\", status: \"new\", units: 10, notes: \"Requires 3-month track record at 8.5+ rating.\" },\n { partner: \"Agoda Partner Onboarding\", website: \"agoda.com\", contact: \"Agoda YCS Team\", status: \"new\", units: 0, notes: \"Diversify channel mix beyond Airbnb/Booking.com.\" },\n ];\n for (const l of leads) {\n await sqlite.execute({\n sql: `INSERT INTO leads (partner_name, website, contact_name, status, potential_units, notes) VALUES (?,?,?,?,?,?)`,\n args: [l.partner, l.website, l.contact, l.status, l.units, l.notes],\n });\n }\n\n return { seeded: true, units: unitIds.length, staff: STAFF.length, bookings: bookings.length, tasks: tasks.length, leads: leads.length };\n}\n",[],[191],"f5a1d434-272a-40fa-8203-98cacd398a65","index.tsx",23,["D",1787705410078],12,"http","/** @jsxImportSource npm:hono@4/jsx */\nimport { Hono } from \"npm:hono@4\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { initDb } from \"./db.ts\";\nimport { seedIfEmpty } from \"./seed.ts\";\nimport {\n createSession, destroySession, getCurrentUser, hashPassword,\n setSessionCookie, verifyPassword,\n} from \"./auth.ts\";\nimport { Layout, PageHeader, peso } from \"./views.tsx\";\nimport { syncAllCalendars } from \"./ical.ts\";\n\nawait initDb();\nawait seedIfEmpty();\n\nconst app = new Hono();\napp.onError((err) => Promise.reject(err));\n\n// ---------- helpers ----------\n\nfunction todayIso() {\n return new Date().toISOString().slice(0, 10);\n}\n\nasync function requireStaff(c: any) {\n const user = await getCurrentUser(c);\n if (!user) return null;\n return user;\n}\n\nasync function requireOwner(c: any) {\n const user = await getCurrentUser(c);\n if (!user || user.role !== \"owner\") return null;\n return user;\n}\n\n// ---------- home / login ----------\n\napp.get(\"/\", async (c) => {\n const user = await getCurrentUser(c);\n if (user) return c.redirect(user.role === \"owner\" ? \"/owner\" : \"/staff\");\n return c.html();\n});\n\nfunction LoginPage({ error }: { error?: string } = {}) {\n return (\n \n

ISisento

✳ Operations workspace

Run every stay with clarity.

Bookings, housekeeping, KPIs, and channel-fee finance — one workspace for owners and staff.

🔒 Only your assigned work is visible.

📋 Fee ledgers and finance stay owner-only.

✳ Secure access

Welcome back.

\n {error &&

{error}

}\n \n

\n Guests use the link sent with their booking, or{\" \"}\n look up a stay here.\n

\n \n );\n}\n\napp.post(\"/login\", async (c) => {\n const body = await c.req.parseBody();\n const username = String(body.username || \"\").trim().toLowerCase();\n const password = String(body.password || \"\");\n const res = await sqlite.execute({\n sql: \"SELECT * FROM users WHERE username = ? AND active = 1\",\n args: [username],\n });\n const row = res.rows[0] as any;\n if (!row || !(await verifyPassword(password, row.password_hash, row.salt))) {\n return c.html(, 401);\n }\n const token = await createSession(row.id);\n setSessionCookie(c, token);\n return c.redirect(row.role === \"owner\" ? \"/owner\" : \"/staff\");\n});\n\napp.post(\"/logout\", async (c) => {\n await destroySession(c);\n return c.redirect(\"/\");\n});\n\n// ---------- change password ----------\n\napp.get(\"/change-password\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.redirect(\"/\");\n return c.html(\n \n \n

\n \n

\n ,\n );\n});\n\napp.post(\"/change-password\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.redirect(\"/\");\n const body = await c.req.parseBody();\n const res = await sqlite.execute({ sql: \"SELECT * FROM users WHERE id = ?\", args: [user.id] });\n const row = res.rows[0] as any;\n const ok = await verifyPassword(String(body.current || \"\"), row.password_hash, row.salt);\n if (!ok) {\n return c.html(\n \n \n

Current password is incorrect.

\n Back\n ,\n 401,\n );\n }\n const { hash, salt } = await hashPassword(String(body.next || \"\"));\n await sqlite.execute({ sql: \"UPDATE users SET password_hash = ?, salt = ? WHERE id = ?\", args: [hash, salt, user.id] });\n return c.redirect(user.role === \"owner\" ? \"/owner\" : \"/staff\");\n});\n\n// ---------- guest portal (no login — booking access code) ----------\n\napp.get(\"/guest\", async (c) => {\n const err = c.req.query(\"error\");\n return c.html(\n \n

ISisento

✳ Stay portal

Find your stay.

Enter the access code from your booking confirmation to see arrival guidance and support details.

🏠 Reservation details, at a glance.

🔒 No internal or financial data shown here.

✳ Guest access

Look up your stay.

\n {err &&

Code not found. Check the code and try again.

}\n \n

Staff or owner? Sign in here.

\n ,\n );\n});\n\napp.get(\"/guest/lookup\", async (c) => {\n const code = String(c.req.query(\"code\") || \"\").trim().toUpperCase();\n return c.redirect(`/guest/${encodeURIComponent(code)}`);\n});\n\napp.get(\"/guest/:code\", async (c) => {\n const code = c.req.param(\"code\").trim().toUpperCase();\n const res = await sqlite.execute({\n sql: `SELECT b.*, u.developer, u.location, u.unit_no, u.room\n FROM bookings b JOIN units u ON u.id = b.unit_id\n WHERE b.access_code = ?`,\n args: [code],\n });\n const b = res.rows[0] as any;\n if (!b) return c.redirect(\"/guest?error=1\");\n\n return c.html(\n \n

ISisento stay

✳ Reservation

Welcome, {b.guest_name}

{b.location} — {b.unit_no} ({b.room})

\n\n

Check-in

{b.checkin_date}

Check-out

{b.checkout_date}

Status

{b.status.replace(\"_\", \" \")}

Booked via

{b.channel.replace(\"_\", \".\")}

\n\n

Arrival guidance

{b.arrival_notes || \"Arrival details will be sent closer to your check-in date.\"}

\n\n

Need help?

Support phone: {b.support_phone || \"—\"}

Support email: {b.support_email || \"—\"}

\n\n

\n This portal shows only your reservation details. Internal operations, staff tools, and financial information are not accessible from here.\n

\n ,\n );\n});\n\n// ---------- staff dashboard ----------\n\napp.get(\"/staff\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.redirect(\"/\");\n\n const tasksRes = await sqlite.execute({\n sql: `SELECT t.*, u.location, u.unit_no FROM tasks t JOIN units u ON u.id = t.unit_id\n WHERE t.assigned_to = ? ORDER BY (t.status='done'), t.due_date IS NULL, t.due_date`,\n args: [user.id],\n });\n const tasks = tasksRes.rows as any[];\n\n const notifRes = await sqlite.execute({\n sql: `SELECT * FROM notifications WHERE user_id = ? ORDER BY created_at DESC LIMIT 20`,\n args: [user.id],\n });\n const notifs = notifRes.rows as any[];\n\n const unitsRes = await sqlite.execute(`SELECT * FROM units WHERE active = 1 ORDER BY location`);\n const units = unitsRes.rows as any[];\n\n const total = tasks.length;\n const done = tasks.filter((t) => t.status === \"done\").length;\n const overdue = tasks.filter((t) => t.status !== \"done\" && t.due_date && t.due_date < todayIso()).length;\n const rate = total ? Math.round((done / total) * 100) : 0;\n const hour = new Date().getUTCHours() + 8; // rough PH-time greeting\n const greeting = hour >= 5 && hour < 12 ? \"Good morning\" : hour >= 12 && hour < 18 ? \"Good afternoon\" : \"Good evening\";\n\n return c.html(\n \n \n\n

Assigned

{total}

Completed

{done}

Completion rate

{rate}%

Overdue

{overdue}

\n\n

My checklist

\n {tasks.length === 0 &&

No tasks assigned right now.

}\n {tasks.map((t) => (\n

\n \n

\n {t.task_type}\n {t.description}\n

\n {t.location} · {t.unit_no} {t.due_date ? `· due ${t.due_date}` : \"\"}\n

\n {t.status !== \"done\" && t.due_date && t.due_date < todayIso() && Overdue}\n

\n ))}\n

\n\n

Notifications

\n {notifs.length === 0 &&

Nothing new.

}\n {notifs.map((n) => (\n

\n {n.message}\n

{n.created_at}

\n ))}\n

\n\n

Report an issue or supply need

\n \n

\n\n \n ,\n );\n});\n\napp.post(\"/api/tasks/:id/status\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.json({ error: \"unauthorized\" }, 401);\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({}));\n const status = body.status === \"done\" ? \"done\" : body.status === \"in_progress\" ? \"in_progress\" : \"todo\";\n\n // staff may only update their own tasks; owner may update any\n const check = await sqlite.execute({ sql: \"SELECT assigned_to FROM tasks WHERE id = ?\", args: [id] });\n const row = check.rows[0] as any;\n if (!row) return c.json({ error: \"not found\" }, 404);\n if (user.role !== \"owner\" && row.assigned_to !== user.id) return c.json({ error: \"forbidden\" }, 403);\n\n await sqlite.execute({\n sql: \"UPDATE tasks SET status = ?, completed_at = ? WHERE id = ?\",\n args: [status, status === \"done\" ? new Date().toISOString() : null, id],\n });\n return c.json({ ok: true });\n});\n\napp.post(\"/tasks/create\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.redirect(\"/\");\n const body = await c.req.parseBody();\n await sqlite.execute({\n sql: `INSERT INTO tasks (unit_id, task_type, description, assigned_to, status, due_date, created_by) VALUES (?,?,?,?,?,?,?)`,\n args: [\n Number(body.unit_id), String(body.task_type || \"cleaning\"), String(body.description || \"\"),\n Number(body.assigned_to), \"todo\", String(body.due_date || todayIso()), user.id,\n ],\n });\n return c.redirect(user.role === \"owner\" ? \"/owner\" : \"/staff\");\n});\n\n// ---------- owner dashboard ----------\n\napp.get(\"/owner\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n\n const bookingsRes = await sqlite.execute(\n `SELECT b.*, u.location, u.unit_no FROM bookings b JOIN units u ON u.id = b.unit_id ORDER BY b.checkin_date DESC LIMIT 50`,\n );\n const bookings = bookingsRes.rows as any[];\n\n const totals = bookings.reduce(\n (acc, b) => {\n const net = b.gross_revenue - b.airbnb_fee - b.booking_com_fee - b.other_fee;\n acc.gross += b.gross_revenue; acc.airbnb += b.airbnb_fee; acc.bookingcom += b.booking_com_fee;\n acc.other += b.other_fee; acc.net += net;\n return acc;\n },\n { gross: 0, airbnb: 0, bookingcom: 0, other: 0, net: 0 },\n );\n const feeTotal = totals.airbnb + totals.bookingcom + totals.other;\n const netPct = totals.gross ? Math.round((totals.net / totals.gross) * 1000) / 10 : 0;\n\n const staffKpiRes = await sqlite.execute(\n `SELECT us.id, us.name, us.position,\n COUNT(t.id) as total,\n SUM(CASE WHEN t.status='done' THEN 1 ELSE 0 END) as done,\n SUM(CASE WHEN t.status!='done' AND t.due_date IS NOT NULL AND t.due_date < date('now') THEN 1 ELSE 0 END) as overdue\n FROM users us LEFT JOIN tasks t ON t.assigned_to = us.id\n WHERE us.role = 'staff' AND us.active = 1\n GROUP BY us.id ORDER BY us.name`,\n );\n const staffKpi = staffKpiRes.rows as any[];\n\n const leadsRes = await sqlite.execute(`SELECT * FROM leads ORDER BY created_at DESC`);\n const leads = leadsRes.rows as any[];\n\n const unitsRes = await sqlite.execute(`SELECT * FROM units WHERE active = 1 ORDER BY location`);\n const units = unitsRes.rows as any[];\n\n const unassignedRes = await sqlite.execute(\n `SELECT t.*, u.location, u.unit_no FROM tasks t JOIN units u ON u.id = t.unit_id\n WHERE t.assigned_to IS NULL AND t.status != 'done' ORDER BY t.due_date IS NULL, t.due_date`,\n );\n const unassignedTasks = unassignedRes.rows as any[];\n\n const allStaffRes = await sqlite.execute(`SELECT id, name, position FROM users WHERE role = 'staff' AND active = 1 ORDER BY name`);\n const allStaff = allStaffRes.rows as any[];\n\n const syncQ = c.req.query(\"synced\");\n let syncFlash = null;\n if (syncQ === \"1\") {\n const imported = c.req.query(\"imported\") || \"0\";\n const updated = c.req.query(\"updated\") || \"0\";\n const errors = c.req.query(\"errors\") || \"0\";\n syncFlash = (\n

0 ? \"error\" : \"info\"}`}>\n Sync complete — {imported} new reservation{imported === \"1\" ? \"\" : \"s\"} imported, {updated} updated\n {Number(errors) > 0 ? `, ${errors} feed(s) failed to fetch.` : \".\"}\n

\n );\n }\n\n const statusBadge = (s: string) => {\n const cls = s === \"won\" ? \"ok\" : s === \"lost\" ? \"bad\" : s === \"negotiating\" ? \"warn\" : \"neutral\";\n return {s};\n };\n\n return c.html(\n \n \n\n

Channel-fee ledger

Gross booking revenue

{peso(totals.gross)}

Airbnb fees

{peso(totals.airbnb)}

Booking.com fees

{peso(totals.bookingcom)}

Net payout

{peso(totals.net)}

\n \n \n \n \n \n \n \n \n {bookings.map((b) => {\n const net = b.gross_revenue - b.airbnb_fee - b.booking_com_fee - b.other_fee;\n return (\n \n \n \n \n \n \n \n \n \n \n \n \n );\n })}\n \n

Unit	Guest	Channel	Check-in	Gross	Airbnb fee	Booking.com fee	Other fee	Net payout	Status
{b.location} {b.unit_no}	{b.guest_name}	{b.channel.replace(\"_\", \".\")}	{b.checkin_date}	{peso(b.gross_revenue)}	{b.airbnb_fee ? peso(b.airbnb_fee) : \"—\"}	{b.booking_com_fee ? peso(b.booking_com_fee) : \"—\"}	{b.other_fee ? peso(b.other_fee) : \"—\"}	{peso(net)}	\n {b.status.replace(\"_\", \" \")}\n {Number(b.needs_details) === 1 && (\n \n Needs details{\" \"}\n Add details\n \n )}\n

\n Airbnb and Booking.com don't hand out full reservation data (guest name, price) through calendar feeds — only blocked dates. Rows synced this way show a \"Needs details\" badge until you fill in the guest and revenue info.\n

\n\n

Calendar sync

Airbnb & Booking.com iCal feeds

\n \n

\n {syncFlash}\n

\n \n \n \n {units.map((u) => (\n \n \n \n \n ))}\n \n

Unit	Airbnb iCal URL	Booking.com iCal URL	Last synced
{u.location} {u.unit_no}	\n \n \n \n \n \n \n \n \n {u.ical_last_synced_at ? `Synced ${u.ical_last_synced_at}` : \"Never synced\"}\n \n \n \n

\n Find these under each listing's calendar settings: Airbnb host dashboard → Calendar → Availability settings → Export calendar. Booking.com extranet → Rates & Availability → Sync calendars → Export.\n

\n\n

Owner's financial lens

Portfolio profitability at a glance.

Gross revenue

{peso(totals.gross)}

Across {bookings.length} bookings on record

Platform & other fees

{peso(feeTotal)}

{totals.gross ? Math.round((feeTotal / totals.gross) * 1000) / 10 : 0}% of gross revenue

Net profitability

{netPct}%

{peso(totals.net)} retained

\n\n

Add booking

Unit

Guest name

\n Channel\n \n

Status\n \n

Check-in

Check-out

Gross revenue (₱)

Airbnb fee (₱)

Booking.com fee (₱)

Other fee (₱)

Arrival guidance for guest

Support phone

Support email

\n \n

\n\n

Unassigned tasks

\n {unassignedTasks.length === 0 &&

Nothing unassigned right now.

}\n {unassignedTasks.length > 0 && (\n \n \n \n {unassignedTasks.map((t) => (\n \n \n \n \n \n \n \n ))}\n \n

Unit	Type	Description	Due	Assign to
{t.location} {t.unit_no}	{t.task_type}	{t.description}	{t.due_date \|\| \"—\"}	\n \n \n \n \n

\n )}\n

\n\n

Staff KPI overview

\n \n \n \n {staffKpi.map((s) => {\n const rate = s.total ? Math.round((s.done / s.total) * 100) : 0;\n return (\n \n \n \n \n \n );\n })}\n \n

Staff	Position	Assigned	Completed	Completion rate	Overdue
{s.name}	{s.position}	{s.total}	{s.done}	{rate}%	{s.overdue > 0 ? {s.overdue} : \"0\"}

\n\n

Sales lead tracker — partner websites

\n \n \n \n {leads.map((l) => (\n \n \n \n \n \n \n \n ))}\n \n

Partner	Contact	Status	Potential units	Notes
{l.partner_name} {l.website}	{l.contact_name \|\| \"—\"}	{statusBadge(l.status)}	{l.potential_units ?? \"—\"}	{l.notes}

\n \n

\n\n

Units under management

\n \n \n {units.map((u) => )}\n

Developer	Location	Unit	Room	SQM
{u.developer}	{u.location}	{u.unit_no}	{u.room}	{u.sqm}

\n ,\n );\n});\n\napp.post(\"/bookings/create\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n const body = await c.req.parseBody();\n function code(len = 8) {\n const chars = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n let out = \"\";\n for (let i = 0; i < len; i++) out += chars[Math.floor(Math.random() * chars.length)];\n return out;\n }\n await sqlite.execute({\n sql: `INSERT INTO bookings (unit_id, guest_name, channel, checkin_date, checkout_date, gross_revenue, airbnb_fee, booking_com_fee, other_fee, status, access_code, arrival_notes, support_phone, support_email, created_by)\n VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,\n args: [\n Number(body.unit_id), String(body.guest_name), String(body.channel), String(body.checkin_date), String(body.checkout_date),\n Number(body.gross_revenue || 0), Number(body.airbnb_fee || 0), Number(body.booking_com_fee || 0), Number(body.other_fee || 0),\n String(body.status || \"confirmed\"), code(), String(body.arrival_notes || \"\"), String(body.support_phone || \"\"), String(body.support_email || \"\"),\n user.id,\n ],\n });\n return c.redirect(\"/owner\");\n});\n\napp.post(\"/leads/create\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n const body = await c.req.parseBody();\n await sqlite.execute({\n sql: `INSERT INTO leads (partner_name, website, contact_name, status, potential_units, notes, created_by) VALUES (?,?,?,?,?,?,?)`,\n args: [\n String(body.partner_name), String(body.website || \"\"), String(body.contact_name || \"\"),\n \"new\", body.potential_units ? Number(body.potential_units) : null, String(body.notes || \"\"), user.id,\n ],\n });\n return c.redirect(\"/owner\");\n});\n\napp.post(\"/leads/:id/status\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.json({ error: \"unauthorized\" }, 401);\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({}));\n await sqlite.execute({ sql: \"UPDATE leads SET status = ? WHERE id = ?\", args: [String(body.status), id] });\n return c.json({ ok: true });\n});\n\n// ---------- calendar sync (Airbnb / Booking.com iCal) ----------\n\napp.post(\"/units/:id/ical\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.parseBody();\n await sqlite.execute({\n sql: `UPDATE units SET airbnb_ical_url = ?, booking_com_ical_url = ? WHERE id = ?`,\n args: [String(body.airbnb_ical_url || \"\").trim() || null, String(body.booking_com_ical_url || \"\").trim() || null, id],\n });\n return c.redirect(\"/owner\");\n});\n\napp.post(\"/sync/ical\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n const results = await syncAllCalendars();\n const imported = results.reduce((n, r) => n + r.imported, 0);\n const updated = results.reduce((n, r) => n + r.updated, 0);\n const errors = results.reduce((n, r) => n + r.errors, 0);\n return c.redirect(`/owner?synced=1&imported=${imported}&updated=${updated}&errors=${errors}`);\n});\n\n// ---------- booking edit (fill in details for calendar-synced reservations) ----------\n\napp.get(\"/bookings/:id/edit\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n const id = Number(c.req.param(\"id\"));\n const res = await sqlite.execute({\n sql: `SELECT b.*, u.location, u.unit_no FROM bookings b JOIN units u ON u.id = b.unit_id WHERE b.id = ?`,\n args: [id],\n });\n const b = res.rows[0] as any;\n if (!b) return c.redirect(\"/owner\");\n\n return c.html(\n \n \n

\n \n

\n ,\n );\n});\n\napp.post(\"/bookings/:id/edit\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.parseBody();\n await sqlite.execute({\n sql: `UPDATE bookings SET guest_name = ?, channel = ?, checkin_date = ?, checkout_date = ?, gross_revenue = ?,\n airbnb_fee = ?, booking_com_fee = ?, other_fee = ?, status = ?, arrival_notes = ?, support_phone = ?, support_email = ?,\n needs_details = 0\n WHERE id = ?`,\n args: [\n String(body.guest_name), String(body.channel), String(body.checkin_date), String(body.checkout_date),\n Number(body.gross_revenue || 0), Number(body.airbnb_fee || 0), Number(body.booking_com_fee || 0), Number(body.other_fee || 0),\n String(body.status || \"confirmed\"), String(body.arrival_notes || \"\"), String(body.support_phone || \"\"), String(body.support_email || \"\"),\n id,\n ],\n });\n return c.redirect(\"/owner\");\n});\n\n// ---------- unassigned task quick-assign ----------\n\napp.post(\"/tasks/:id/assign\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.parseBody();\n const assignedTo = Number(body.assigned_to);\n if (!assignedTo) return c.redirect(\"/owner\");\n await sqlite.execute({ sql: `UPDATE tasks SET assigned_to = ? WHERE id = ?`, args: [assignedTo, id] });\n const task = await sqlite.execute({ sql: `SELECT description, task_type FROM tasks WHERE id = ?`, args: [id] });\n const t = task.rows[0] as any;\n if (t) {\n await sqlite.execute({\n sql: `INSERT INTO notifications (user_id, message) VALUES (?, ?)`,\n args: [assignedTo, `New ${t.task_type} task assigned: ${t.description}`],\n });\n }\n return c.redirect(\"/owner\");\n});\n\nexport default app.fetch;\n","isento-ops",[],[200],"f581bec7-394b-46dc-9846-dd5bcd1525ed","ical.ts","e6f3ba08-a0e7-11f1-995e-1607ee4eb77e",17,["D",1787705329769],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n// ---------- minimal ICS parser ----------\n// Airbnb / Booking.com calendar exports only contain block dates (DTSTART/DTEND)\n// and a UID — never guest name or price, by platform design. We import the dates\n// as a placeholder booking and flag it \"needs_details\" for the owner to fill in.\n\ninterface IcsEvent {\n uid: string;\n summary: string;\n dtstart: string; // YYYY-MM-DD\n dtend: string; // YYYY-MM-DD\n}\n\nfunction unfold(text: string): string[] {\n const rawLines = text.split(/\\r\\n|\\n|\\r/);\n const lines: string[] = [];\n for (const line of rawLines) {\n if ((line.startsWith(\" \") || line.startsWith(\"\\t\")) && lines.length > 0) {\n lines[lines.length - 1] += line.slice(1);\n } else {\n lines.push(line);\n }\n }\n return lines;\n}\n\nfunction toIsoDate(raw: string): string | null {\n // raw looks like \"20260901\" or \"20260901T000000Z\"\n const m = raw.match(/^(\\d{4})(\\d{2})(\\d{2})/);\n if (!m) return null;\n return `${m[1]}-${m[2]}-${m[3]}`;\n}\n\nexport function parseIcs(text: string): IcsEvent[] {\n const lines = unfold(text);\n const events: IcsEvent[] = [];\n let cur: Partial | null = null;\n for (const line of lines) {\n if (line.startsWith(\"BEGIN:VEVENT\")) {\n cur = {};\n continue;\n }\n if (line.startsWith(\"END:VEVENT\")) {\n if (cur && cur.uid && cur.dtstart && cur.dtend) {\n events.push({\n uid: cur.uid,\n summary: cur.summary || \"\",\n dtstart: cur.dtstart,\n dtend: cur.dtend,\n });\n }\n cur = null;\n continue;\n }\n if (!cur) continue;\n const idx = line.indexOf(\":\");\n if (idx === -1) continue;\n const key = line.slice(0, idx).split(\";\")[0].toUpperCase();\n const value = line.slice(idx + 1).trim();\n if (key === \"UID\") cur.uid = value;\n else if (key === \"SUMMARY\") cur.summary = value;\n else if (key === \"DTSTART\") {\n const d = toIsoDate(value);\n if (d) cur.dtstart = d;\n } else if (key === \"DTEND\") {\n const d = toIsoDate(value);\n if (d) cur.dtend = d;\n }\n }\n return events;\n}\n\nfunction randomCode(len = 8): string {\n const chars = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n let out = \"\";\n for (let i = 0; i < len; i++) out += chars[Math.floor(Math.random() * chars.length)];\n return out;\n}\n\nasync function syncOneFeed(\n unitId: number,\n url: string,\n channel: \"airbnb\" | \"booking_com\",\n): Promise<{ imported: number; updated: number; errors: number }> {\n let events: IcsEvent[] = [];\n try {\n const res = await fetch(url, { headers: { \"User-Agent\": \"Isento-Sync/1.0\" } });\n if (!res.ok) return { imported: 0, updated: 0, errors: 1 };\n const text = await res.text();\n events = parseIcs(text);\n } catch {\n return { imported: 0, updated: 0, errors: 1 };\n }\n\n let imported = 0;\n let updated = 0;\n\n for (const ev of events) {\n const externalUid = `${channel}:${ev.uid}`;\n const existing = await sqlite.execute({\n sql: `SELECT id, needs_details FROM bookings WHERE external_uid = ?`,\n args: [externalUid],\n });\n const row = existing.rows[0] as any;\n\n if (row) {\n // Only refresh dates — never clobber guest/fee details the owner already entered.\n await sqlite.execute({\n sql: `UPDATE bookings SET checkin_date = ?, checkout_date = ? WHERE id = ?`,\n args: [ev.dtstart, ev.dtend, row.id],\n });\n updated++;\n continue;\n }\n\n const guestLabel = channel === \"airbnb\" ? \"Airbnb guest (pending details)\" : \"Booking.com guest (pending details)\";\n const insertRes = await sqlite.execute({\n sql: `INSERT INTO bookings\n (unit_id, guest_name, channel, checkin_date, checkout_date, gross_revenue, airbnb_fee, booking_com_fee, other_fee,\n status, access_code, external_uid, source, needs_details)\n VALUES (?,?,?,?,?,0,0,0,0,'confirmed',?,?,?,1)`,\n args: [unitId, guestLabel, channel, ev.dtstart, ev.dtend, randomCode(), externalUid, `ical_${channel}`],\n });\n const bookingId = Number(insertRes.lastInsertRowid);\n imported++;\n\n // Auto-create an unassigned turnover-cleaning task for the checkout day, once per booking.\n const existingTask = await sqlite.execute({\n sql: `SELECT id FROM tasks WHERE booking_id = ?`,\n args: [bookingId],\n });\n if (existingTask.rows.length === 0) {\n await sqlite.execute({\n sql: `INSERT INTO tasks (unit_id, booking_id, task_type, description, assigned_to, status, due_date)\n VALUES (?,?,?,?,NULL,'todo',?)`,\n args: [unitId, bookingId, \"cleaning\", \"Turnover clean & inspection (auto-created from calendar sync)\", ev.dtend],\n });\n }\n }\n\n return { imported, updated, errors: 0 };\n}\n\nexport async function syncAllCalendars(): Promise<\n { unitId: number; location: string; unitNo: string; channel: string; imported: number; updated: number; errors: number }[]\n> {\n const unitsRes = await sqlite.execute(\n `SELECT id, location, unit_no, airbnb_ical_url, booking_com_ical_url FROM units WHERE active = 1`,\n );\n const results: { unitId: number; location: string; unitNo: string; channel: string; imported: number; updated: number; errors: number }[] = [];\n\n for (const u of unitsRes.rows as any[]) {\n if (u.airbnb_ical_url) {\n const r = await syncOneFeed(u.id, u.airbnb_ical_url, \"airbnb\");\n results.push({ unitId: u.id, location: u.location, unitNo: u.unit_no, channel: \"airbnb\", ...r });\n }\n if (u.booking_com_ical_url) {\n const r = await syncOneFeed(u.id, u.booking_com_ical_url, \"booking_com\");\n results.push({ unitId: u.id, location: u.location, unitNo: u.unit_no, channel: \"booking_com\", ...r });\n }\n if (u.airbnb_ical_url || u.booking_com_ical_url) {\n await sqlite.execute({\n sql: `UPDATE units SET ical_last_synced_at = datetime('now') WHERE id = ?`,\n args: [u.id],\n });\n }\n }\n\n return results;\n}\n",[],[210],"358f02c6-6eea-4227-b5b4-c4e32b4f51ce","ical-sync-cron.ts","1cb31314-a0e8-11f1-876c-1607ee4eb77e",["D",1787705419944],"interval","import { initDb } from \"./db.ts\";\nimport { syncAllCalendars } from \"./ical.ts\";\n\n// Runs on a schedule (see write_interval_settings) to pull Airbnb / Booking.com\n// iCal feeds for every unit that has one configured, without anyone needing to\n// click \"Sync now\" on the owner dashboard.\nexport default async function (interval: Interval) {\n await initDb();\n const results = await syncAllCalendars();\n const imported = results.reduce((n, r) => n + r.imported, 0);\n const updated = results.reduce((n, r) => n + r.updated, 0);\n const errors = results.reduce((n, r) => n + r.errors, 0);\n console.log(`iCal sync: ${imported} imported, ${updated} updated, ${errors} feed errors (${results.length} feeds checked)`);\n}\n",[],[218],"88d2a8e4-0e49-493a-a517-3be4fcef8650","db.ts","6af305dc-a086-11f1-b89c-1607ee4eb77e",16,["D",1787705274268],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport async function initDb() {\n await sqlite.batch([\n {\n sql: `CREATE TABLE IF NOT EXISTS users (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT NOT NULL,\n username TEXT NOT NULL UNIQUE,\n password_hash TEXT NOT NULL,\n salt TEXT NOT NULL,\n role TEXT NOT NULL CHECK(role IN ('staff','owner')),\n position TEXT,\n active INTEGER NOT NULL DEFAULT 1,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS sessions (\n token TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL REFERENCES users(id),\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n expires_at TEXT NOT NULL\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS units (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n developer TEXT,\n location TEXT,\n unit_no TEXT NOT NULL,\n room TEXT,\n sqm REAL,\n active INTEGER NOT NULL DEFAULT 1\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS bookings (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n unit_id INTEGER NOT NULL REFERENCES units(id),\n guest_name TEXT NOT NULL,\n channel TEXT NOT NULL CHECK(channel IN ('airbnb','booking_com','direct','other')),\n checkin_date TEXT NOT NULL,\n checkout_date TEXT NOT NULL,\n gross_revenue REAL NOT NULL DEFAULT 0,\n airbnb_fee REAL NOT NULL DEFAULT 0,\n booking_com_fee REAL NOT NULL DEFAULT 0,\n other_fee REAL NOT NULL DEFAULT 0,\n status TEXT NOT NULL DEFAULT 'confirmed' CHECK(status IN ('confirmed','checked_in','checked_out','cancelled')),\n access_code TEXT NOT NULL UNIQUE,\n arrival_notes TEXT,\n support_phone TEXT,\n support_email TEXT,\n created_by INTEGER REFERENCES users(id),\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS tasks (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n unit_id INTEGER NOT NULL REFERENCES units(id),\n booking_id INTEGER REFERENCES bookings(id),\n task_type TEXT NOT NULL CHECK(task_type IN ('cleaning','laundry','supplies','repair')),\n description TEXT NOT NULL,\n assigned_to INTEGER REFERENCES users(id),\n status TEXT NOT NULL DEFAULT 'todo' CHECK(status IN ('todo','in_progress','done')),\n due_date TEXT,\n created_by INTEGER REFERENCES users(id),\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n completed_at TEXT\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS notifications (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n user_id INTEGER NOT NULL REFERENCES users(id),\n message TEXT NOT NULL,\n is_read INTEGER NOT NULL DEFAULT 0,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS leads (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n partner_name TEXT NOT NULL,\n website TEXT,\n contact_name TEXT,\n contact_email TEXT,\n contact_phone TEXT,\n status TEXT NOT NULL DEFAULT 'new' CHECK(status IN ('new','contacted','negotiating','won','lost')),\n potential_units INTEGER,\n notes TEXT,\n created_by INTEGER REFERENCES users(id),\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n },\n ]);\n\n await migrate();\n}\n\n// Idempotent column migrations — ALTER TABLE has no IF NOT EXISTS in SQLite,\n// so each addition is wrapped and ignored if the column is already there.\nasync function migrate() {\n const alters = [\n `ALTER TABLE units ADD COLUMN airbnb_ical_url TEXT`,\n `ALTER TABLE units ADD COLUMN booking_com_ical_url TEXT`,\n `ALTER TABLE units ADD COLUMN ical_last_synced_at TEXT`,\n `ALTER TABLE bookings ADD COLUMN external_uid TEXT`,\n `ALTER TABLE bookings ADD COLUMN source TEXT NOT NULL DEFAULT 'manual'`,\n `ALTER TABLE bookings ADD COLUMN needs_details INTEGER NOT NULL DEFAULT 0`,\n ];\n for (const sql of alters) {\n try {\n await sqlite.execute(sql);\n } catch {\n // column already exists — fine\n }\n }\n}\n",[],[226],"51cc9a17-df20-4865-947d-695c7d4d673f","auth.ts","75430aa0-a086-11f1-acf9-1607ee4eb77e",4,["D",1787663477842],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { getCookie, setCookie, deleteCookie } from \"npm:hono@4/cookie\";\nimport type { Context } from \"npm:hono@4\";\n\nconst SESSION_COOKIE = \"isento_session\";\nconst SESSION_DAYS = 14;\n\nfunction toHex(buf: ArrayBuffer): string {\n return Array.from(new Uint8Array(buf)).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction randomHex(bytes: number): string {\n const arr = new Uint8Array(bytes);\n crypto.getRandomValues(arr);\n return toHex(arr.buffer);\n}\n\nasync function pbkdf2(password: string, saltHex: string): Promise {\n const enc = new TextEncoder();\n const keyMaterial = await crypto.subtle.importKey(\n \"raw\",\n enc.encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const saltBytes = new Uint8Array(saltHex.match(/.{2}/g)!.map((h) => parseInt(h, 16)));\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt: saltBytes, iterations: 100_000, hash: \"SHA-256\" },\n keyMaterial,\n 256,\n );\n return toHex(bits);\n}\n\nexport async function hashPassword(password: string): Promise<{ hash: string; salt: string }> {\n const salt = randomHex(16);\n const hash = await pbkdf2(password, salt);\n return { hash, salt };\n}\n\nexport async function verifyPassword(password: string, hash: string, salt: string): Promise {\n const computed = await pbkdf2(password, salt);\n return computed === hash;\n}\n\nexport interface SessionUser {\n id: number;\n name: string;\n username: string;\n role: \"staff\" | \"owner\";\n position: string | null;\n}\n\nexport async function createSession(userId: number): Promise {\n const token = randomHex(32);\n const expires = new Date(Date.now() + SESSION_DAYS * 24 * 60 * 60 * 1000).toISOString();\n await sqlite.execute({\n sql: \"INSERT INTO sessions (token, user_id, expires_at) VALUES (?, ?, ?)\",\n args: [token, userId, expires],\n });\n return token;\n}\n\nexport function setSessionCookie(c: Context, token: string) {\n setCookie(c, SESSION_COOKIE, token, {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n path: \"/\",\n maxAge: SESSION_DAYS * 24 * 60 * 60,\n });\n}\n\nexport function clearSessionCookie(c: Context) {\n deleteCookie(c, SESSION_COOKIE, { path: \"/\" });\n}\n\nexport async function getCurrentUser(c: Context): Promise {\n const token = getCookie(c, SESSION_COOKIE);\n if (!token) return null;\n const res = await sqlite.execute({\n sql: `SELECT u.id, u.name, u.username, u.role, u.position\n FROM sessions s JOIN users u ON u.id = s.user_id\n WHERE s.token = ? AND s.expires_at > datetime('now') AND u.active = 1`,\n args: [token],\n });\n if (res.rows.length === 0) return null;\n return res.rows[0] as unknown as SessionUser;\n}\n\nexport async function destroySession(c: Context) {\n const token = getCookie(c, SESSION_COOKIE);\n if (token) {\n await sqlite.execute({ sql: \"DELETE FROM sessions WHERE token = ?\", args: [token] });\n }\n clearSessionCookie(c);\n}\n",[],[234],"944e8a27-f220-4d0e-9d5b-f515fbb9ab5b","README.md","01a0390a-88ed-72fa-80c5-6ae828b904a1",["D",1787663386761],"# hono-jsx-starter\n\nA minimal [Hono](https://hono.dev) + Hono JSX starter for Val Town.\nServer-rendered HTML, no build step, no React.\n\n## Picking a starter\n\n| Starter | When to pick it |\n| --- | --- |\n| [`basic-html-starter`](https://www.val.town/x/templates/basic-html-starter) | Static HTML pages. Sprinkle of vanilla JS. No server-side rendering. |\n| **[`hono-jsx-starter`](https://www.val.town/x/templates/hono-jsx-starter)** *(you're here)* | Dynamic server-rendered HTML with JSX. API routes. No React, no SPA. |\n| [`react-hono-starter`](https://www.val.town/x/templates/react-hono-starter) | Client-side React SPA with a Hono API backend. |\n\n## What's here\n\n```\nindex.tsx Hono app, Layout, routes\npublic/\n favicon.svg Static asset\n counter.ts Tiny client-side script\n```\n\nThe whole app fits in one file. As you grow it, the natural next moves are:\n\n- Pull `Layout` into its own `.tsx` file once you have 3+ pages.\n- Split routes with `app.route(\"/api\", api)` if `/api/*` grows.\n- Add more files under `public/` — they're served by a single\n `app.get(\"/public/*\", ...)` route.\n\n## Patterns worth knowing\n\n**JSX pragma.** Every `.tsx` file that uses JSX needs this at the top:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\n```\n\n**Server state.** The counter on `/` is `let count = 0` at module scope. It\nlives in memory on the Val Town server and survives across requests — but resets\nwhenever the val restarts (deploys, idle timeouts, etc.). For persistent state,\nswap it for [`std/sqlite`](https://www.val.town/x/std/sqlite) or\n[`std/blob`](https://www.val.town/x/std/blob).\n\n**API routes.** The `Increment` button POSTs to `/api/increment`, which returns\nJSON. Mix server-rendered pages and JSON endpoints in the same Hono app:\n\n```ts\napp.post(\"/api/increment\", (c) => c.json({ count: ++count }));\n```\n\n**Static files.** `serveFile` reads the file by path and serves it with the\nright content-type. `.ts` files are transpiled to JS on request by Val Town — so\nyou can write `public/counter.ts` and reference it as\n`

{title}

Run every stay with clarity.

Welcome back.

Find your stay.

Look up your stay.

Welcome, {b.guest_name}

Arrival guidance

Need help?

My checklist

Notifications

Report an issue or supply need

Channel-fee ledger

Airbnb & Booking.com iCal feeds

Portfolio profitability at a glance.

Add booking

Unassigned tasks

Staff KPI overview

Sales lead tracker — partner websites

Units under management

History · views.tsx