[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_257":258,"_259":260},"routes/_app.x.$handle.$name",{"_98":97,"_31":43,"_107":88,"_26":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":24,"_122":123,"_124":57,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_41":42,"_31":43,"_36":44,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":24},"version",17,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":33,"_34":35,"_36":37,"_38":14,"_39":40,"_23":24},"previous","deleted",false,"deletedHere","path","ical.ts","latestPath","fileId","e6f3ba08-a0e7-11f1-995e-1607ee4eb77e","name","fileType","script","content","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n// ---------- minimal ICS parser ----------\n// Airbnb / Booking.com calendar exports only contain block dates (DTSTART/DTEND)\n// and a UID — never guest name or price, by platform design. We import the dates\n// as a placeholder booking and flag it \"needs_details\" for the owner to fill in.\n\ninterface IcsEvent {\n uid: string;\n summary: string;\n dtstart: string; // YYYY-MM-DD\n dtend: string; // YYYY-MM-DD\n}\n\nfunction unfold(text: string): string[] {\n const rawLines = text.split(/\\r\\n|\\n|\\r/);\n const lines: string[] = [];\n for (const line of rawLines) {\n if ((line.startsWith(\" \") || line.startsWith(\"\\t\")) && lines.length > 0) {\n lines[lines.length - 1] += line.slice(1);\n } else {\n lines.push(line);\n }\n }\n return lines;\n}\n\nfunction toIsoDate(raw: string): string | null {\n // raw looks like \"20260901\" or \"20260901T000000Z\"\n const m = raw.match(/^(\\d{4})(\\d{2})(\\d{2})/);\n if (!m) return null;\n return `${m[1]}-${m[2]}-${m[3]}`;\n}\n\nexport function parseIcs(text: string): IcsEvent[] {\n const lines = unfold(text);\n const events: IcsEvent[] = [];\n let cur: Partial | null = null;\n for (const line of lines) {\n if (line.startsWith(\"BEGIN:VEVENT\")) {\n cur = {};\n continue;\n }\n if (line.startsWith(\"END:VEVENT\")) {\n if (cur && cur.uid && cur.dtstart && cur.dtend) {\n events.push({\n uid: cur.uid,\n summary: cur.summary || \"\",\n dtstart: cur.dtstart,\n dtend: cur.dtend,\n });\n }\n cur = null;\n continue;\n }\n if (!cur) continue;\n const idx = line.indexOf(\":\");\n if (idx === -1) continue;\n const key = line.slice(0, idx).split(\";\")[0].toUpperCase();\n const value = line.slice(idx + 1).trim();\n if (key === \"UID\") cur.uid = value;\n else if (key === \"SUMMARY\") cur.summary = value;\n else if (key === \"DTSTART\") {\n const d = toIsoDate(value);\n if (d) cur.dtstart = d;\n } else if (key === \"DTEND\") {\n const d = toIsoDate(value);\n if (d) cur.dtend = d;\n }\n }\n return events;\n}\n\nfunction randomCode(len = 8): string {\n const chars = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n let out = \"\";\n for (let i = 0; i < len; i++) out += chars[Math.floor(Math.random() * chars.length)];\n return out;\n}\n\nasync function syncOneFeed(\n unitId: number,\n url: string,\n channel: \"airbnb\" | \"booking_com\",\n): Promise<{ imported: number; updated: number; errors: number }> {\n let events: IcsEvent[] = [];\n try {\n const res = await fetch(url, { headers: { \"User-Agent\": \"Isento-Sync/1.0\" } });\n if (!res.ok) return { imported: 0, updated: 0, errors: 1 };\n const text = await res.text();\n events = parseIcs(text);\n } catch {\n return { imported: 0, updated: 0, errors: 1 };\n }\n\n let imported = 0;\n let updated = 0;\n\n for (const ev of events) {\n const externalUid = `${channel}:${ev.uid}`;\n const existing = await sqlite.execute({\n sql: `SELECT id, needs_details FROM bookings WHERE external_uid = ?`,\n args: [externalUid],\n });\n const row = existing.rows[0] as any;\n\n if (row) {\n // Only refresh dates — never clobber guest/fee details the owner already entered.\n await sqlite.execute({\n sql: `UPDATE bookings SET checkin_date = ?, checkout_date = ? WHERE id = ?`,\n args: [ev.dtstart, ev.dtend, row.id],\n });\n updated++;\n continue;\n }\n\n const guestLabel = channel === \"airbnb\" ? \"Airbnb guest (pending details)\" : \"Booking.com guest (pending details)\";\n const insertRes = await sqlite.execute({\n sql: `INSERT INTO bookings\n (unit_id, guest_name, channel, checkin_date, checkout_date, gross_revenue, airbnb_fee, booking_com_fee, other_fee,\n status, access_code, external_uid, source, needs_details)\n VALUES (?,?,?,?,?,0,0,0,0,'confirmed',?,?,?,1)`,\n args: [unitId, guestLabel, channel, ev.dtstart, ev.dtend, randomCode(), externalUid, `ical_${channel}`],\n });\n const bookingId = Number(insertRes.lastInsertRowid);\n imported++;\n\n // Auto-create an unassigned turnover-cleaning task for the checkout day, once per booking.\n const existingTask = await sqlite.execute({\n sql: `SELECT id FROM tasks WHERE booking_id = ?`,\n args: [bookingId],\n });\n if (existingTask.rows.length === 0) {\n await sqlite.execute({\n sql: `INSERT INTO tasks (unit_id, booking_id, task_type, description, assigned_to, status, due_date)\n VALUES (?,?,?,?,NULL,'todo',?)`,\n args: [unitId, bookingId, \"cleaning\", \"Turnover clean & inspection (auto-created from calendar sync)\", ev.dtend],\n });\n }\n }\n\n return { imported, updated, errors: 0 };\n}\n\nexport async function syncAllCalendars(): Promise<\n { unitId: number; location: string; unitNo: string; channel: string; imported: number; updated: number; errors: number }[]\n> {\n const unitsRes = await sqlite.execute(\n `SELECT id, location, unit_no, airbnb_ical_url, booking_com_ical_url FROM units WHERE active = 1`,\n );\n const results: { unitId: number; location: string; unitNo: string; channel: string; imported: number; updated: number; errors: number }[] = [];\n\n for (const u of unitsRes.rows as any[]) {\n if (u.airbnb_ical_url) {\n const r = await syncOneFeed(u.id, u.airbnb_ical_url, \"airbnb\");\n results.push({ unitId: u.id, location: u.location, unitNo: u.unit_no, channel: \"airbnb\", ...r });\n }\n if (u.booking_com_ical_url) {\n const r = await syncOneFeed(u.id, u.booking_com_ical_url, \"booking_com\");\n results.push({ unitId: u.id, location: u.location, unitNo: u.unit_no, channel: \"booking_com\", ...r });\n }\n if (u.airbnb_ical_url || u.booking_com_ical_url) {\n await sqlite.execute({\n sql: `UPDATE units SET ical_last_synced_at = datetime('now') WHERE id = ?`,\n args: [u.id],\n });\n }\n }\n\n return results;\n}\n","createdAt",["D",1787705329769],"branchVersion","branchId","700f5db6-dbe9-4221-89f4-c1af68565814","id","f6d544b2-720a-4193-9797-fd95cddc322a","isento",["D",1787663386761],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Isento property ops: staff/owner/guest portals + fee ledger","imageUrl","0d80088e-7112-4b81-b513-1efae25ea3d8","pinnedFileId","01a0390a-88ed-72fa-80c5-6c5a22bf21c2","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a03906-2a46-7197-a3ac-792ee8e04a5c","tursoName","f6d544b2720a41939797fd95cddc322a","tursoHostname","f6d544b2720a41939797fd95cddc322a-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789485645684],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_106":102},"org",{"_98":97,"_99":100,"_101":102,"_18":53,"_103":104,"_105":24},"branch",{"_13":87,"_31":88,"_41":40,"_89":42,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":43,"_96":97},"isOwned",24,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","imeldaedodollon","handle","displayName","imelda edodollon","avatar","https://lh3.googleusercontent.com/a/ACg8ocKr1iICq7J9VyfzCVOdogvCtL322dGPfd-X6jqTWmG5_i8FBgQ=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_41":42,"_31":43,"_36":252,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":253,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":254,"_82":255,"_84":256,"_86":24},"tree",[203,206,207,208,209,210,211,212],"files",[203,204,205,206,207,208,209,210,211,212],"counts",{"_193":61,"_194":144,"_195":61,"_196":197,"_198":199},"contents",[129,130,131,132,133,134,135,136],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_41":188,"_31":48,"_29":189,"_140":-5,"_39":40,"_38":144,"_142":57,"_36":190,"_13":61,"_32":191,"_34":-5,"_23":24,"_146":-5,"_26":192},{"_41":182,"_31":183,"_29":184,"_140":-5,"_39":40,"_38":144,"_142":57,"_36":185,"_13":61,"_32":20,"_34":186,"_23":24,"_146":-5,"_26":187},{"_41":175,"_31":176,"_29":177,"_140":-5,"_39":40,"_38":178,"_142":57,"_36":179,"_13":61,"_32":33,"_34":180,"_23":24,"_146":-5,"_26":181},{"_41":168,"_31":169,"_29":170,"_140":-5,"_39":40,"_38":171,"_142":57,"_36":172,"_13":153,"_32":33,"_34":173,"_23":24,"_146":-5,"_26":174},{"_41":165,"_31":27,"_29":30,"_140":-5,"_39":40,"_38":14,"_142":57,"_36":166,"_13":61,"_32":33,"_34":35,"_23":24,"_146":-5,"_26":167},{"_41":156,"_31":157,"_29":55,"_140":-5,"_39":40,"_38":158,"_142":24,"_36":159,"_13":160,"_32":161,"_34":162,"_23":24,"_146":163,"_26":164},{"_41":148,"_31":149,"_29":150,"_140":-5,"_39":40,"_38":151,"_142":57,"_36":152,"_13":153,"_32":33,"_34":154,"_23":24,"_146":-5,"_26":155},{"_41":137,"_31":138,"_29":139,"_140":-5,"_39":40,"_38":141,"_142":57,"_36":143,"_13":144,"_32":33,"_34":145,"_23":24,"_146":-5,"_26":147},"dfe52ff8-cc6a-4ceb-a690-42b59dce1fc1","views.tsx","9bd444cc-a086-11f1-939f-1607ee4eb77e","parentId",14,"latest",["D",1787704288658],1,"/** @jsxImportSource npm:hono@4/jsx */\n\nexport function peso(n: number): string {\n const v = Math.round((n || 0) * 100) / 100;\n return \"₱\" + v.toLocaleString(\"en-PH\", { minimumFractionDigits: 0, maximumFractionDigits: 2 });\n}\n\nexport const BRAND_CSS = `\n @import url('https://fonts.googleapis.com/css2?family=Playfair+Display:wght@600;700&family=DM+Sans:wght@400;500;600;700&display=swap');\n\n :root{\n --bg:#fdfcf8; --panel:#ffffff; --panel-2:#f5f3ec; --panel-3:#f0eee5;\n --ink:#20302a; --ink-dim:#6d7871; --line:#e8e4d8; --line-soft:#efecdf;\n --sidebar:#1d3737; --sidebar-2:#254545; --sidebar-ink:#f3efe2; --sidebar-ink-dim:#9db2ac;\n --teal:#2b725e; --teal-dark:#1f5d4b; --teal-ink:#ffffff;\n --amber:#e9874a; --amber-bg:#fbe9dc;\n --cream:#f3ecdf;\n --dark-card:#1d3737; --dark-card-2:#254848;\n --ok:#1f7a4d; --ok-bg:#e4f3ea; --bad:#b5462c; --bad-bg:#fbe6df; --warn:#a8721f; --warn-bg:#faf0d8;\n --radius:16px; --radius-sm:10px;\n --shadow:0 1px 2px rgba(29,55,55,.05), 0 10px 30px -14px rgba(29,55,55,.18);\n --font-body:\"DM Sans\",-apple-system,BlinkMacSystemFont,\"Segoe UI\",sans-serif;\n --font-display:\"Playfair Display\",Georgia,serif;\n }\n *{box-sizing:border-box;}\n body{margin:0;background:var(--bg);color:var(--ink);font-family:var(--font-body);line-height:1.5;-webkit-font-smoothing:antialiased;}\n a{color:var(--teal);}\n h1,h2,h3{font-family:var(--font-display);font-weight:600;color:var(--ink);}\n\n /* ---------- app shell ---------- */\n .app-shell{display:flex;min-height:100vh;}\n .sidebar{width:230px;flex-shrink:0;background:var(--sidebar);color:var(--sidebar-ink);display:flex;flex-direction:column;padding:20px 14px;position:sticky;top:0;height:100vh;}\n .sidebar .brand{display:flex;align-items:center;gap:9px;font-weight:700;font-size:16px;padding:6px 8px 22px;letter-spacing:-0.01em;}\n .sidebar .brand .mark{width:26px;height:26px;border-radius:8px;background:var(--sidebar-ink);color:var(--sidebar);display:flex;align-items:center;justify-content:center;font-size:12px;font-weight:800;flex-shrink:0;}\n .sidebar-nav{display:flex;flex-direction:column;gap:2px;flex:1;}\n .nav-item{display:flex;align-items:center;gap:10px;padding:9px 10px;border-radius:9px;color:var(--sidebar-ink-dim);text-decoration:none;font-size:13.5px;font-weight:500;}\n .nav-item .ic{width:16px;text-align:center;font-size:13px;}\n .nav-item:hover{background:var(--sidebar-2);color:var(--sidebar-ink);}\n .nav-item.active{background:var(--sidebar-2);color:var(--sidebar-ink);font-weight:600;}\n .sidebar-bottom{border-top:1px solid rgba(255,255,255,.08);padding-top:14px;margin-top:10px;}\n .user-chip{font-size:12.5px;color:var(--sidebar-ink);margin-bottom:8px;padding:0 8px;}\n .user-chip .role{display:block;color:var(--sidebar-ink-dim);font-size:11.5px;margin-top:1px;}\n .sidebar-bottom form{padding:0 8px;}\n .main{flex:1;min-width:0;}\n .wrap{max-width:1180px;margin:0 auto;padding:30px 32px 70px;}\n\n /* ---------- page header ---------- */\n .eyebrow{display:flex;align-items:center;gap:6px;font-size:11.5px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--amber);margin-bottom:10px;}\n .page-header{display:flex;align-items:flex-start;justify-content:space-between;gap:20px;flex-wrap:wrap;margin-bottom:26px;}\n .page-header h1{font-size:32px;margin:0 0 6px;}\n .page-header .sub{margin:0;max-width:520px;}\n .page-header .actions{display:flex;align-items:center;gap:10px;flex-shrink:0;}\n .sub{color:var(--ink-dim);font-size:14.5px;margin:0 0 20px;}\n\n /* ---------- buttons ---------- */\n .btn{display:inline-flex;align-items:center;gap:6px;border:1px solid var(--line);background:var(--panel);color:var(--ink);\n padding:9px 16px;border-radius:var(--radius-sm);font-size:13.5px;font-weight:600;cursor:pointer;text-decoration:none;font-family:var(--font-body);}\n .btn:hover{background:var(--panel-2);}\n .btn.primary{background:var(--teal);color:var(--teal-ink);border-color:var(--teal);}\n .btn.primary:hover{background:var(--teal-dark);}\n .btn.ghost{background:transparent;border-color:rgba(255,255,255,.18);color:var(--sidebar-ink-dim);}\n .btn.ghost:hover{background:var(--sidebar-2);color:var(--sidebar-ink);}\n .btn.small{padding:6px 12px;font-size:12.5px;}\n .btn.block{width:100%;justify-content:center;}\n\n /* ---------- layout grids & cards ---------- */\n .grid{display:grid;gap:16px;}\n .cols-4{grid-template-columns:repeat(auto-fit,minmax(180px,1fr));}\n .cols-3{grid-template-columns:repeat(auto-fit,minmax(240px,1fr));}\n .cols-2{grid-template-columns:repeat(auto-fit,minmax(320px,1fr));}\n .card{background:var(--panel);border:1px solid var(--line);border-radius:var(--radius);padding:20px 22px;box-shadow:var(--shadow);}\n .card.dark{background:var(--dark-card);color:var(--sidebar-ink);border-color:var(--dark-card);}\n .card.dark .ink-dim, .card.dark .sub{color:var(--sidebar-ink-dim);}\n .card.beige{background:var(--cream);border-color:var(--cream);}\n .stat .k{font-size:11px;letter-spacing:.06em;text-transform:uppercase;color:var(--ink-dim);font-weight:600;}\n .stat .v{font-size:26px;font-weight:700;margin-top:8px;font-family:var(--font-display);}\n .stat .delta{font-size:12px;color:var(--ink-dim);margin-top:6px;}\n section{margin-top:30px;}\n section > h2{font-size:18px;margin:0 0 14px;}\n .section-head{display:flex;align-items:center;justify-content:space-between;gap:12px;margin-bottom:14px;}\n .section-head h2{margin:0;}\n .section-eyebrow{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--ink-dim);margin-bottom:4px;}\n\n table{width:100%;border-collapse:collapse;font-size:13.5px;}\n th{text-align:left;font-size:10.5px;letter-spacing:.06em;text-transform:uppercase;color:var(--ink-dim);font-weight:700;padding:8px 10px;border-bottom:1px solid var(--line);}\n td{padding:11px 10px;border-bottom:1px solid var(--line-soft);vertical-align:top;}\n .table-scroll{overflow-x:auto;}\n .badge{display:inline-block;padding:3px 10px;border-radius:999px;font-size:11.5px;font-weight:600;}\n .badge.ok{background:var(--ok-bg);color:var(--ok);}\n .badge.bad{background:var(--bad-bg);color:var(--bad);}\n .badge.warn{background:var(--warn-bg);color:var(--warn);}\n .badge.neutral{background:var(--panel-3);color:var(--ink-dim);}\n .badge.amber{background:var(--amber-bg);color:var(--amber);}\n\n input,select,textarea{font-family:var(--font-body);font-size:13.5px;padding:9px 11px;border:1px solid var(--line);border-radius:var(--radius-sm);background:var(--panel);color:var(--ink);width:100%;}\n input:focus,select:focus,textarea:focus{outline:2px solid var(--teal);outline-offset:1px;}\n label{font-size:12px;color:var(--ink-dim);display:block;margin-bottom:5px;font-weight:600;}\n .field{margin-bottom:13px;}\n form.inline{display:flex;gap:10px;align-items:end;flex-wrap:wrap;}\n\n /* ---------- login / guest split panel ---------- */\n .auth-wrap{min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px;background:var(--panel-2);}\n .auth-card{max-width:900px;width:100%;background:var(--panel);border-radius:22px;box-shadow:var(--shadow);display:flex;overflow:hidden;min-height:420px;}\n .auth-side{flex:1;background:var(--dark-card);color:var(--sidebar-ink);padding:40px 38px;display:flex;flex-direction:column;justify-content:center;}\n .auth-side .brand{display:flex;align-items:center;gap:9px;font-weight:700;font-size:15px;margin-bottom:26px;}\n .auth-side .brand .mark{width:26px;height:26px;border-radius:8px;background:var(--sidebar-ink);color:var(--dark-card);display:flex;align-items:center;justify-content:center;font-size:12px;font-weight:800;}\n .auth-side .eyebrow{color:var(--amber);}\n .auth-side h1{color:#fff;font-size:34px;line-height:1.15;margin:0 0 14px;}\n .auth-side p{color:var(--sidebar-ink-dim);font-size:14px;line-height:1.6;margin:0 0 22px;max-width:340px;}\n .auth-feature{background:var(--sidebar-2);border-radius:10px;padding:11px 13px;font-size:13px;margin-bottom:8px;color:var(--sidebar-ink);}\n .auth-form{flex:1;padding:44px 40px;display:flex;flex-direction:column;justify-content:center;}\n .auth-form .eyebrow{color:var(--amber);}\n .auth-form h2{font-size:26px;margin:0 0 8px;}\n .auth-form .sub{margin-bottom:24px;}\n .login-card{max-width:380px;width:100%;}\n\n .notice{padding:11px 13px;border-radius:var(--radius-sm);font-size:13px;margin-bottom:14px;}\n .notice.error{background:var(--bad-bg);color:var(--bad);}\n .notice.info{background:var(--panel-3);color:var(--ink-dim);}\n\n .checklist-item{display:flex;align-items:center;gap:12px;padding:13px 0;border-bottom:1px solid var(--line-soft);}\n .checklist-item:last-child{border-bottom:none;}\n .checklist-item input[type=checkbox]{width:auto;flex-shrink:0;accent-color:var(--teal);}\n .checklist-item .desc{flex:1;}\n .checklist-item.done .desc{color:var(--ink-dim);text-decoration:line-through;}\n .tag-type{font-size:10px;text-transform:uppercase;letter-spacing:.05em;font-weight:700;color:var(--teal-dark);background:var(--ok-bg);padding:2px 8px;border-radius:5px;margin-right:8px;}\n\n footer{margin-top:50px;padding-top:16px;border-top:1px solid var(--line);color:var(--ink-dim);font-size:11.5px;display:flex;justify-content:space-between;flex-wrap:wrap;gap:8px;}\n .lock-note{font-size:12.5px;color:var(--ink-dim);background:var(--panel-3);border:1px dashed var(--line);border-radius:var(--radius-sm);padding:11px 13px;margin-top:12px;}\n\n @media (max-width:860px){\n .auth-card{flex-direction:column;}\n .auth-side{padding:30px 28px;}\n }\n @media (max-width:780px){\n .app-shell{flex-direction:column;}\n .sidebar{width:100%;height:auto;position:relative;flex-direction:row;align-items:center;padding:12px 16px;flex-wrap:wrap;gap:10px;}\n .sidebar .brand{padding:0;}\n .sidebar-nav{flex-direction:row;flex:none;}\n .sidebar-bottom{border-top:none;margin:0 0 0 auto;padding:0;display:flex;align-items:center;gap:10px;}\n .user-chip{display:none;}\n .wrap{padding:22px 18px 50px;}\n }\n`;\n\nconst NAV_ICONS: Record = {\n overview: \"◆\",\n staff: \"◇\",\n password: \"●\",\n};\n\nfunction SidebarNav({ user, active }: { user: { role: string }; active: string }) {\n const items: { key: string; label: string; href: string }[] = [];\n items.push({ key: \"overview\", label: \"Overview\", href: user.role === \"owner\" ? \"/owner\" : \"/staff\" });\n if (user.role === \"owner\") {\n items.push({ key: \"staff\", label: \"Staff view\", href: \"/staff\" });\n }\n items.push({ key: \"password\", label: \"Change password\", href: \"/change-password\" });\n return (\n \n );\n}\n\nexport function Layout(\n { title, user, activeNav, children }: {\n title: string;\n user?: { name: string; role: string } | null;\n activeNav?: string;\n children: any;\n },\n) {\n return (\n \n \n {title} · Isento\n \n \n \n \n \n {user\n ? (\n

\n \n

{children}

\n )\n :

{children}

}\n \n \n \n );\n}\n\nexport function PageHeader(\n { eyebrow, title, subtitle, actions }: { eyebrow: string; title: string; subtitle?: string; actions?: any },\n) {\n return (\n \n );\n}\n","label",[138],"6933662b-815b-406a-a9f8-6504e85e1ad7","seed.ts","85f5bc76-a086-11f1-b9a2-1607ee4eb77e",13,["D",1787703979439],2,"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { hashPassword } from \"./auth.ts\";\n\nconst UNITS = [\n { developer: \"Megaworld\", location: \"Venice Luxury Residences BGC\", unit_no: \"3F Domenico\", room: \"1 BR\", sqm: 66 },\n { developer: \"Avida\", location: \"Asten Makati\", unit_no: \"612 Tower 2\", room: \"1 BR\", sqm: 34 },\n { developer: \"SMDC\", location: \"Shell Residences\", unit_no: \"852 Tower A\", room: \"1 BR\", sqm: 38 },\n { developer: \"Amaia Steps\", location: \"Alabang\", unit_no: \"430 Helena\", room: \"Studio\", sqm: 25 },\n { developer: \"Avida\", location: \"Southpoint Makati\", unit_no: \"234 Tower 1\", room: \"1 BR\", sqm: 38 },\n { developer: \"DMCI\", location: \"Alder Taguig\", unit_no: \"912 Manzuria\", room: \"2 BR\", sqm: 54 },\n { developer: \"DMCI\", location: \"Alder Taguig\", unit_no: \"PH 07 Oregon\", room: \"3 BR\", sqm: 98 },\n { developer: \"DMCI\", location: \"Allegra\", unit_no: \"1202 Soraya\", room: \"1 BR\", sqm: 30 },\n { developer: \"DMCI\", location: \"Cubao\", unit_no: \"3811 Oriana\", room: \"2 BR\", sqm: 54 },\n { developer: \"Casa Real\", location: \"Bacolor Pampanga\", unit_no: \"Lot 9 Blk 19\", room: \"4 BR\", sqm: 200 },\n];\n\nconst STAFF = [\n { name: \"Darwin\", username: \"darwin\", position: \"Cleaner\" },\n { name: \"Nur\", username: \"nur\", position: \"Cleaner\" },\n { name: \"Daryl\", username: \"daryl\", position: \"Supplies, Logistics\" },\n { name: \"Nadz\", username: \"nadz\", position: \"Maintenance Technician\" },\n { name: \"Atty. Ivy\", username: \"ivy\", position: \"HR\" },\n];\n\nfunction randomCode(len = 8): string {\n const chars = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n let out = \"\";\n for (let i = 0; i < len; i++) out += chars[Math.floor(Math.random() * chars.length)];\n return out;\n}\n\nexport async function seedIfEmpty() {\n const existing = await sqlite.execute(\"SELECT COUNT(*) as n FROM users\");\n const n = (existing.rows[0] as any).n as number;\n if (n > 0) return { seeded: false };\n\n // --- owner ---\n const ownerPw = await hashPassword(\"Isento#Owner2026\");\n await sqlite.execute({\n sql: `INSERT INTO users (name, username, password_hash, salt, role, position) VALUES (?,?,?,?,?,?)`,\n args: [\"Dr. Meddie Edodollon\", \"meddie\", ownerPw.hash, ownerPw.salt, \"owner\", \"Owner\"],\n });\n\n // --- staff ---\n const staffIds: Record = {};\n for (const s of STAFF) {\n const pw = await hashPassword(`Isento#${s.username[0].toUpperCase()}${s.username.slice(1)}26`);\n const res = await sqlite.execute({\n sql: `INSERT INTO users (name, username, password_hash, salt, role, position) VALUES (?,?,?,?,?,?)`,\n args: [s.name, s.username, pw.hash, pw.salt, \"staff\", s.position],\n });\n staffIds[s.username] = Number(res.lastInsertRowid);\n }\n\n // --- units ---\n const unitIds: number[] = [];\n for (const u of UNITS) {\n const res = await sqlite.execute({\n sql: `INSERT INTO units (developer, location, unit_no, room, sqm) VALUES (?,?,?,?,?)`,\n args: [u.developer, u.location, u.unit_no, u.room, u.sqm],\n });\n unitIds.push(Number(res.lastInsertRowid));\n }\n\n // --- sample bookings (real channel-fee ledger demo data) ---\n const today = new Date();\n const iso = (d: Date) => d.toISOString().slice(0, 10);\n const plus = (days: number) => { const d = new Date(today); d.setDate(d.getDate() + days); return d; };\n\n const bookings = [\n { unitIdx: 0, guest: \"J. Reyes\", channel: \"airbnb\", checkin: plus(-1), checkout: plus(3), gross: 45000, airbnb: 6750, bookingcom: 0, other: 0 },\n { unitIdx: 2, guest: \"M. Santos\", channel: \"booking_com\", checkin: plus(0), checkout: plus(4), gross: 46000, airbnb: 0, bookingcom: 6900, other: 0 },\n { unitIdx: 5, guest: \"A. Cruz\", channel: \"direct\", checkin: plus(2), checkout: plus(6), gross: 32000, airbnb: 0, bookingcom: 0, other: 0 },\n { unitIdx: 8, guest: \"K. Villanueva\", channel: \"airbnb\", checkin: plus(5), checkout: plus(9), gross: 38000, airbnb: 5700, bookingcom: 0, other: 0 },\n ];\n const bookingIds: number[] = [];\n for (const b of bookings) {\n const res = await sqlite.execute({\n sql: `INSERT INTO bookings (unit_id, guest_name, channel, checkin_date, checkout_date, gross_revenue, airbnb_fee, booking_com_fee, other_fee, status, access_code, arrival_notes, support_phone, support_email)\n VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,\n args: [\n unitIds[b.unitIdx], b.guest, b.channel, iso(b.checkin), iso(b.checkout),\n b.gross, b.airbnb, b.bookingcom, b.other, \"confirmed\", randomCode(),\n \"Gate code will be sent 1 day before arrival. Unit is on a mid-floor unit with elevator access. Parking (if booked) is on B2.\",\n \"+63 917 000 1234\", \"stay@isento.app\",\n ],\n });\n bookingIds.push(Number(res.lastInsertRowid));\n }\n\n // --- sample tasks ---\n const tasks = [\n { unitIdx: 0, bookingIdx: 0, type: \"cleaning\", desc: \"Turnover clean before next check-in\", staff: \"darwin\", due: plus(3) },\n { unitIdx: 2, bookingIdx: 1, type: \"laundry\", desc: \"Wash & restock linens (queen set x2)\", staff: \"nadz\", due: plus(0) },\n { unitIdx: 5, bookingIdx: null, type: \"supplies\", desc: \"Refill toiletries, coffee, drinking water\", staff: \"daryl\", due: plus(1) },\n { unitIdx: 8, bookingIdx: 3, type: \"repair\", desc: \"Fix bathroom faucet leak reported by previous guest\", staff: \"daryl\", due: plus(2) },\n { unitIdx: 1, bookingIdx: null, type: \"cleaning\", desc: \"Deep clean — quarterly schedule\", staff: \"nur\", due: plus(4) },\n ];\n for (const t of tasks) {\n await sqlite.execute({\n sql: `INSERT INTO tasks (unit_id, booking_id, task_type, description, assigned_to, status, due_date) VALUES (?,?,?,?,?,?,?)`,\n args: [\n unitIds[t.unitIdx],\n t.bookingIdx === null ? null : bookingIds[t.bookingIdx],\n t.type, t.desc, staffIds[t.staff], \"todo\", iso(t.due),\n ],\n });\n await sqlite.execute({\n sql: `INSERT INTO notifications (user_id, message) VALUES (?, ?)`,\n args: [staffIds[t.staff], `New ${t.type} task assigned: ${t.desc}`],\n });\n }\n\n // --- sample leads ---\n const leads = [\n { partner: \"Airbnb Business Travel Ready Program\", website: \"airbnb.com\", contact: \"Partner Success Team\", status: \"contacted\", units: 10, notes: \"Applying to unlock corporate/long-stay travelers.\" },\n { partner: \"Booking.com Genius Partner Upgrade\", website: \"booking.com\", contact: \"Partner Hub\", status: \"new\", units: 10, notes: \"Requires 3-month track record at 8.5+ rating.\" },\n { partner: \"Agoda Partner Onboarding\", website: \"agoda.com\", contact: \"Agoda YCS Team\", status: \"new\", units: 0, notes: \"Diversify channel mix beyond Airbnb/Booking.com.\" },\n ];\n for (const l of leads) {\n await sqlite.execute({\n sql: `INSERT INTO leads (partner_name, website, contact_name, status, potential_units, notes) VALUES (?,?,?,?,?,?)`,\n args: [l.partner, l.website, l.contact, l.status, l.units, l.notes],\n });\n }\n\n return { seeded: true, units: unitIds.length, staff: STAFF.length, bookings: bookings.length, tasks: tasks.length, leads: leads.length };\n}\n",[149],"914aa84d-68b2-47a0-ab08-0f086885e0fc","index.tsx",15,["D",1787704443213],6,"http","/** @jsxImportSource npm:hono@4/jsx */\nimport { Hono } from \"npm:hono@4\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { initDb } from \"./db.ts\";\nimport { seedIfEmpty } from \"./seed.ts\";\nimport {\n createSession, destroySession, getCurrentUser, hashPassword,\n setSessionCookie, verifyPassword,\n} from \"./auth.ts\";\nimport { Layout, PageHeader, peso } from \"./views.tsx\";\n\nawait initDb();\nawait seedIfEmpty();\n\nconst app = new Hono();\napp.onError((err) => Promise.reject(err));\n\n// ---------- helpers ----------\n\nfunction todayIso() {\n return new Date().toISOString().slice(0, 10);\n}\n\nasync function requireStaff(c: any) {\n const user = await getCurrentUser(c);\n if (!user) return null;\n return user;\n}\n\nasync function requireOwner(c: any) {\n const user = await getCurrentUser(c);\n if (!user || user.role !== \"owner\") return null;\n return user;\n}\n\n// ---------- home / login ----------\n\napp.get(\"/\", async (c) => {\n const user = await getCurrentUser(c);\n if (user) return c.redirect(user.role === \"owner\" ? \"/owner\" : \"/staff\");\n return c.html();\n});\n\nfunction LoginPage({ error }: { error?: string } = {}) {\n return (\n \n

ISisento

✳ Operations workspace

Run every stay with clarity.

Bookings, housekeeping, KPIs, and channel-fee finance — one workspace for owners and staff.

🔒 Only your assigned work is visible.

📋 Fee ledgers and finance stay owner-only.

✳ Secure access

Welcome back.

\n {error &&

{error}

}\n \n

\n Guests use the link sent with their booking, or{\" \"}\n look up a stay here.\n

\n \n );\n}\n\napp.post(\"/login\", async (c) => {\n const body = await c.req.parseBody();\n const username = String(body.username || \"\").trim().toLowerCase();\n const password = String(body.password || \"\");\n const res = await sqlite.execute({\n sql: \"SELECT * FROM users WHERE username = ? AND active = 1\",\n args: [username],\n });\n const row = res.rows[0] as any;\n if (!row || !(await verifyPassword(password, row.password_hash, row.salt))) {\n return c.html(, 401);\n }\n const token = await createSession(row.id);\n setSessionCookie(c, token);\n return c.redirect(row.role === \"owner\" ? \"/owner\" : \"/staff\");\n});\n\napp.post(\"/logout\", async (c) => {\n await destroySession(c);\n return c.redirect(\"/\");\n});\n\n// ---------- change password ----------\n\napp.get(\"/change-password\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.redirect(\"/\");\n return c.html(\n \n \n

\n \n

\n ,\n );\n});\n\napp.post(\"/change-password\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.redirect(\"/\");\n const body = await c.req.parseBody();\n const res = await sqlite.execute({ sql: \"SELECT * FROM users WHERE id = ?\", args: [user.id] });\n const row = res.rows[0] as any;\n const ok = await verifyPassword(String(body.current || \"\"), row.password_hash, row.salt);\n if (!ok) {\n return c.html(\n \n \n

Current password is incorrect.

\n Back\n ,\n 401,\n );\n }\n const { hash, salt } = await hashPassword(String(body.next || \"\"));\n await sqlite.execute({ sql: \"UPDATE users SET password_hash = ?, salt = ? WHERE id = ?\", args: [hash, salt, user.id] });\n return c.redirect(user.role === \"owner\" ? \"/owner\" : \"/staff\");\n});\n\n// ---------- guest portal (no login — booking access code) ----------\n\napp.get(\"/guest\", async (c) => {\n const err = c.req.query(\"error\");\n return c.html(\n \n

ISisento

✳ Stay portal

Find your stay.

Enter the access code from your booking confirmation to see arrival guidance and support details.

🏠 Reservation details, at a glance.

🔒 No internal or financial data shown here.

✳ Guest access

Look up your stay.

\n {err &&

Code not found. Check the code and try again.

}\n \n

Staff or owner? Sign in here.

\n ,\n );\n});\n\napp.get(\"/guest/lookup\", async (c) => {\n const code = String(c.req.query(\"code\") || \"\").trim().toUpperCase();\n return c.redirect(`/guest/${encodeURIComponent(code)}`);\n});\n\napp.get(\"/guest/:code\", async (c) => {\n const code = c.req.param(\"code\").trim().toUpperCase();\n const res = await sqlite.execute({\n sql: `SELECT b.*, u.developer, u.location, u.unit_no, u.room\n FROM bookings b JOIN units u ON u.id = b.unit_id\n WHERE b.access_code = ?`,\n args: [code],\n });\n const b = res.rows[0] as any;\n if (!b) return c.redirect(\"/guest?error=1\");\n\n return c.html(\n \n

ISisento stay

✳ Reservation

Welcome, {b.guest_name}

{b.location} — {b.unit_no} ({b.room})

\n\n

Check-in

{b.checkin_date}

Check-out

{b.checkout_date}

Status

{b.status.replace(\"_\", \" \")}

Booked via

{b.channel.replace(\"_\", \".\")}

\n\n

Arrival guidance

{b.arrival_notes || \"Arrival details will be sent closer to your check-in date.\"}

\n\n

Need help?

Support phone: {b.support_phone || \"—\"}

Support email: {b.support_email || \"—\"}

\n\n

\n This portal shows only your reservation details. Internal operations, staff tools, and financial information are not accessible from here.\n

\n ,\n );\n});\n\n// ---------- staff dashboard ----------\n\napp.get(\"/staff\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.redirect(\"/\");\n\n const tasksRes = await sqlite.execute({\n sql: `SELECT t.*, u.location, u.unit_no FROM tasks t JOIN units u ON u.id = t.unit_id\n WHERE t.assigned_to = ? ORDER BY (t.status='done'), t.due_date IS NULL, t.due_date`,\n args: [user.id],\n });\n const tasks = tasksRes.rows as any[];\n\n const notifRes = await sqlite.execute({\n sql: `SELECT * FROM notifications WHERE user_id = ? ORDER BY created_at DESC LIMIT 20`,\n args: [user.id],\n });\n const notifs = notifRes.rows as any[];\n\n const unitsRes = await sqlite.execute(`SELECT * FROM units WHERE active = 1 ORDER BY location`);\n const units = unitsRes.rows as any[];\n\n const total = tasks.length;\n const done = tasks.filter((t) => t.status === \"done\").length;\n const overdue = tasks.filter((t) => t.status !== \"done\" && t.due_date && t.due_date < todayIso()).length;\n const rate = total ? Math.round((done / total) * 100) : 0;\n const hour = new Date().getUTCHours() + 8; // rough PH-time greeting\n const greeting = hour >= 5 && hour < 12 ? \"Good morning\" : hour >= 12 && hour < 18 ? \"Good afternoon\" : \"Good evening\";\n\n return c.html(\n \n \n\n

Assigned

{total}

Completed

{done}

Completion rate

{rate}%

Overdue

{overdue}

\n\n

My checklist

\n {tasks.length === 0 &&

No tasks assigned right now.

}\n {tasks.map((t) => (\n

\n \n

\n {t.task_type}\n {t.description}\n

\n {t.location} · {t.unit_no} {t.due_date ? `· due ${t.due_date}` : \"\"}\n

\n {t.status !== \"done\" && t.due_date && t.due_date < todayIso() && Overdue}\n

\n ))}\n

\n\n

Notifications

\n {notifs.length === 0 &&

Nothing new.

}\n {notifs.map((n) => (\n

\n {n.message}\n

{n.created_at}

\n ))}\n

\n\n

Report an issue or supply need

\n \n

\n\n \n ,\n );\n});\n\napp.post(\"/api/tasks/:id/status\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.json({ error: \"unauthorized\" }, 401);\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({}));\n const status = body.status === \"done\" ? \"done\" : body.status === \"in_progress\" ? \"in_progress\" : \"todo\";\n\n // staff may only update their own tasks; owner may update any\n const check = await sqlite.execute({ sql: \"SELECT assigned_to FROM tasks WHERE id = ?\", args: [id] });\n const row = check.rows[0] as any;\n if (!row) return c.json({ error: \"not found\" }, 404);\n if (user.role !== \"owner\" && row.assigned_to !== user.id) return c.json({ error: \"forbidden\" }, 403);\n\n await sqlite.execute({\n sql: \"UPDATE tasks SET status = ?, completed_at = ? WHERE id = ?\",\n args: [status, status === \"done\" ? new Date().toISOString() : null, id],\n });\n return c.json({ ok: true });\n});\n\napp.post(\"/tasks/create\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.redirect(\"/\");\n const body = await c.req.parseBody();\n await sqlite.execute({\n sql: `INSERT INTO tasks (unit_id, task_type, description, assigned_to, status, due_date, created_by) VALUES (?,?,?,?,?,?,?)`,\n args: [\n Number(body.unit_id), String(body.task_type || \"cleaning\"), String(body.description || \"\"),\n Number(body.assigned_to), \"todo\", String(body.due_date || todayIso()), user.id,\n ],\n });\n return c.redirect(user.role === \"owner\" ? \"/owner\" : \"/staff\");\n});\n\n// ---------- owner dashboard ----------\n\napp.get(\"/owner\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n\n const bookingsRes = await sqlite.execute(\n `SELECT b.*, u.location, u.unit_no FROM bookings b JOIN units u ON u.id = b.unit_id ORDER BY b.checkin_date DESC LIMIT 50`,\n );\n const bookings = bookingsRes.rows as any[];\n\n const totals = bookings.reduce(\n (acc, b) => {\n const net = b.gross_revenue - b.airbnb_fee - b.booking_com_fee - b.other_fee;\n acc.gross += b.gross_revenue; acc.airbnb += b.airbnb_fee; acc.bookingcom += b.booking_com_fee;\n acc.other += b.other_fee; acc.net += net;\n return acc;\n },\n { gross: 0, airbnb: 0, bookingcom: 0, other: 0, net: 0 },\n );\n const feeTotal = totals.airbnb + totals.bookingcom + totals.other;\n const netPct = totals.gross ? Math.round((totals.net / totals.gross) * 1000) / 10 : 0;\n\n const staffKpiRes = await sqlite.execute(\n `SELECT us.id, us.name, us.position,\n COUNT(t.id) as total,\n SUM(CASE WHEN t.status='done' THEN 1 ELSE 0 END) as done,\n SUM(CASE WHEN t.status!='done' AND t.due_date IS NOT NULL AND t.due_date < date('now') THEN 1 ELSE 0 END) as overdue\n FROM users us LEFT JOIN tasks t ON t.assigned_to = us.id\n WHERE us.role = 'staff' AND us.active = 1\n GROUP BY us.id ORDER BY us.name`,\n );\n const staffKpi = staffKpiRes.rows as any[];\n\n const leadsRes = await sqlite.execute(`SELECT * FROM leads ORDER BY created_at DESC`);\n const leads = leadsRes.rows as any[];\n\n const unitsRes = await sqlite.execute(`SELECT * FROM units WHERE active = 1 ORDER BY location`);\n const units = unitsRes.rows as any[];\n\n const statusBadge = (s: string) => {\n const cls = s === \"won\" ? \"ok\" : s === \"lost\" ? \"bad\" : s === \"negotiating\" ? \"warn\" : \"neutral\";\n return {s};\n };\n\n return c.html(\n \n \n\n

Channel-fee ledger

Gross booking revenue

{peso(totals.gross)}

Airbnb fees

{peso(totals.airbnb)}

Booking.com fees

{peso(totals.bookingcom)}

Net payout

{peso(totals.net)}

\n \n \n \n \n \n \n \n \n {bookings.map((b) => {\n const net = b.gross_revenue - b.airbnb_fee - b.booking_com_fee - b.other_fee;\n return (\n \n \n \n \n \n \n \n \n \n \n \n \n );\n })}\n \n

Unit	Guest	Channel	Check-in	Gross	Airbnb fee	Booking.com fee	Other fee	Net payout	Status
{b.location} {b.unit_no}	{b.guest_name}	{b.channel.replace(\"_\", \".\")}	{b.checkin_date}	{peso(b.gross_revenue)}	{b.airbnb_fee ? peso(b.airbnb_fee) : \"—\"}	{b.booking_com_fee ? peso(b.booking_com_fee) : \"—\"}	{b.other_fee ? peso(b.other_fee) : \"—\"}	{peso(net)}	{b.status.replace(\"_\", \" \")}

\n Live sync with Airbnb and Booking.com is not active yet — bookings and fees above are entered manually until channel-manager credentials are connected. See \"Add booking\" below to log new reservations.\n

\n\n

Owner's financial lens

Portfolio profitability at a glance.

Gross revenue

{peso(totals.gross)}

Across {bookings.length} bookings on record

Platform & other fees

{peso(feeTotal)}

{totals.gross ? Math.round((feeTotal / totals.gross) * 1000) / 10 : 0}% of gross revenue

Net profitability

{netPct}%

{peso(totals.net)} retained

\n\n

Add booking

Unit

Guest name

\n Channel\n \n

Status\n \n

Check-in

Check-out

Gross revenue (₱)

Airbnb fee (₱)

Booking.com fee (₱)

Other fee (₱)

Arrival guidance for guest

Support phone

Support email

\n \n

\n\n

Staff KPI overview

\n \n \n \n {staffKpi.map((s) => {\n const rate = s.total ? Math.round((s.done / s.total) * 100) : 0;\n return (\n \n \n \n \n \n );\n })}\n \n

Staff	Position	Assigned	Completed	Completion rate	Overdue
{s.name}	{s.position}	{s.total}	{s.done}	{rate}%	{s.overdue > 0 ? {s.overdue} : \"0\"}

\n\n

Sales lead tracker — partner websites

\n \n \n \n {leads.map((l) => (\n \n \n \n \n \n \n \n ))}\n \n

Partner	Contact	Status	Potential units	Notes
{l.partner_name} {l.website}	{l.contact_name \|\| \"—\"}	{statusBadge(l.status)}	{l.potential_units ?? \"—\"}	{l.notes}

\n \n

\n\n

Units under management

\n \n \n {units.map((u) => )}\n

Developer	Location	Unit	Room	SQM
{u.developer}	{u.location}	{u.unit_no}	{u.room}	{u.sqm}

\n ,\n );\n});\n\napp.post(\"/bookings/create\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n const body = await c.req.parseBody();\n function code(len = 8) {\n const chars = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n let out = \"\";\n for (let i = 0; i < len; i++) out += chars[Math.floor(Math.random() * chars.length)];\n return out;\n }\n await sqlite.execute({\n sql: `INSERT INTO bookings (unit_id, guest_name, channel, checkin_date, checkout_date, gross_revenue, airbnb_fee, booking_com_fee, other_fee, status, access_code, arrival_notes, support_phone, support_email, created_by)\n VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,\n args: [\n Number(body.unit_id), String(body.guest_name), String(body.channel), String(body.checkin_date), String(body.checkout_date),\n Number(body.gross_revenue || 0), Number(body.airbnb_fee || 0), Number(body.booking_com_fee || 0), Number(body.other_fee || 0),\n String(body.status || \"confirmed\"), code(), String(body.arrival_notes || \"\"), String(body.support_phone || \"\"), String(body.support_email || \"\"),\n user.id,\n ],\n });\n return c.redirect(\"/owner\");\n});\n\napp.post(\"/leads/create\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n const body = await c.req.parseBody();\n await sqlite.execute({\n sql: `INSERT INTO leads (partner_name, website, contact_name, status, potential_units, notes, created_by) VALUES (?,?,?,?,?,?,?)`,\n args: [\n String(body.partner_name), String(body.website || \"\"), String(body.contact_name || \"\"),\n \"new\", body.potential_units ? Number(body.potential_units) : null, String(body.notes || \"\"), user.id,\n ],\n });\n return c.redirect(\"/owner\");\n});\n\napp.post(\"/leads/:id/status\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.json({ error: \"unauthorized\" }, 401);\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({}));\n await sqlite.execute({ sql: \"UPDATE leads SET status = ? WHERE id = ?\", args: [String(body.status), id] });\n return c.json({ ok: true });\n});\n\nexport default app.fetch;\n","isento-ops",[157],"f581bec7-394b-46dc-9846-dd5bcd1525ed",["D",1787705329769],[27],"88d2a8e4-0e49-493a-a517-3be4fcef8650","db.ts","6af305dc-a086-11f1-b89c-1607ee4eb77e",16,["D",1787705274268],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport async function initDb() {\n await sqlite.batch([\n {\n sql: `CREATE TABLE IF NOT EXISTS users (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT NOT NULL,\n username TEXT NOT NULL UNIQUE,\n password_hash TEXT NOT NULL,\n salt TEXT NOT NULL,\n role TEXT NOT NULL CHECK(role IN ('staff','owner')),\n position TEXT,\n active INTEGER NOT NULL DEFAULT 1,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS sessions (\n token TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL REFERENCES users(id),\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n expires_at TEXT NOT NULL\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS units (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n developer TEXT,\n location TEXT,\n unit_no TEXT NOT NULL,\n room TEXT,\n sqm REAL,\n active INTEGER NOT NULL DEFAULT 1\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS bookings (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n unit_id INTEGER NOT NULL REFERENCES units(id),\n guest_name TEXT NOT NULL,\n channel TEXT NOT NULL CHECK(channel IN ('airbnb','booking_com','direct','other')),\n checkin_date TEXT NOT NULL,\n checkout_date TEXT NOT NULL,\n gross_revenue REAL NOT NULL DEFAULT 0,\n airbnb_fee REAL NOT NULL DEFAULT 0,\n booking_com_fee REAL NOT NULL DEFAULT 0,\n other_fee REAL NOT NULL DEFAULT 0,\n status TEXT NOT NULL DEFAULT 'confirmed' CHECK(status IN ('confirmed','checked_in','checked_out','cancelled')),\n access_code TEXT NOT NULL UNIQUE,\n arrival_notes TEXT,\n support_phone TEXT,\n support_email TEXT,\n created_by INTEGER REFERENCES users(id),\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS tasks (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n unit_id INTEGER NOT NULL REFERENCES units(id),\n booking_id INTEGER REFERENCES bookings(id),\n task_type TEXT NOT NULL CHECK(task_type IN ('cleaning','laundry','supplies','repair')),\n description TEXT NOT NULL,\n assigned_to INTEGER REFERENCES users(id),\n status TEXT NOT NULL DEFAULT 'todo' CHECK(status IN ('todo','in_progress','done')),\n due_date TEXT,\n created_by INTEGER REFERENCES users(id),\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n completed_at TEXT\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS notifications (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n user_id INTEGER NOT NULL REFERENCES users(id),\n message TEXT NOT NULL,\n is_read INTEGER NOT NULL DEFAULT 0,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS leads (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n partner_name TEXT NOT NULL,\n website TEXT,\n contact_name TEXT,\n contact_email TEXT,\n contact_phone TEXT,\n status TEXT NOT NULL DEFAULT 'new' CHECK(status IN ('new','contacted','negotiating','won','lost')),\n potential_units INTEGER,\n notes TEXT,\n created_by INTEGER REFERENCES users(id),\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n },\n ]);\n\n await migrate();\n}\n\n// Idempotent column migrations — ALTER TABLE has no IF NOT EXISTS in SQLite,\n// so each addition is wrapped and ignored if the column is already there.\nasync function migrate() {\n const alters = [\n `ALTER TABLE units ADD COLUMN airbnb_ical_url TEXT`,\n `ALTER TABLE units ADD COLUMN booking_com_ical_url TEXT`,\n `ALTER TABLE units ADD COLUMN ical_last_synced_at TEXT`,\n `ALTER TABLE bookings ADD COLUMN external_uid TEXT`,\n `ALTER TABLE bookings ADD COLUMN source TEXT NOT NULL DEFAULT 'manual'`,\n `ALTER TABLE bookings ADD COLUMN needs_details INTEGER NOT NULL DEFAULT 0`,\n ];\n for (const sql of alters) {\n try {\n await sqlite.execute(sql);\n } catch {\n // column already exists — fine\n }\n }\n}\n",[169],"51cc9a17-df20-4865-947d-695c7d4d673f","auth.ts","75430aa0-a086-11f1-acf9-1607ee4eb77e",4,["D",1787663477842],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { getCookie, setCookie, deleteCookie } from \"npm:hono@4/cookie\";\nimport type { Context } from \"npm:hono@4\";\n\nconst SESSION_COOKIE = \"isento_session\";\nconst SESSION_DAYS = 14;\n\nfunction toHex(buf: ArrayBuffer): string {\n return Array.from(new Uint8Array(buf)).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction randomHex(bytes: number): string {\n const arr = new Uint8Array(bytes);\n crypto.getRandomValues(arr);\n return toHex(arr.buffer);\n}\n\nasync function pbkdf2(password: string, saltHex: string): Promise {\n const enc = new TextEncoder();\n const keyMaterial = await crypto.subtle.importKey(\n \"raw\",\n enc.encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const saltBytes = new Uint8Array(saltHex.match(/.{2}/g)!.map((h) => parseInt(h, 16)));\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt: saltBytes, iterations: 100_000, hash: \"SHA-256\" },\n keyMaterial,\n 256,\n );\n return toHex(bits);\n}\n\nexport async function hashPassword(password: string): Promise<{ hash: string; salt: string }> {\n const salt = randomHex(16);\n const hash = await pbkdf2(password, salt);\n return { hash, salt };\n}\n\nexport async function verifyPassword(password: string, hash: string, salt: string): Promise {\n const computed = await pbkdf2(password, salt);\n return computed === hash;\n}\n\nexport interface SessionUser {\n id: number;\n name: string;\n username: string;\n role: \"staff\" | \"owner\";\n position: string | null;\n}\n\nexport async function createSession(userId: number): Promise {\n const token = randomHex(32);\n const expires = new Date(Date.now() + SESSION_DAYS * 24 * 60 * 60 * 1000).toISOString();\n await sqlite.execute({\n sql: \"INSERT INTO sessions (token, user_id, expires_at) VALUES (?, ?, ?)\",\n args: [token, userId, expires],\n });\n return token;\n}\n\nexport function setSessionCookie(c: Context, token: string) {\n setCookie(c, SESSION_COOKIE, token, {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n path: \"/\",\n maxAge: SESSION_DAYS * 24 * 60 * 60,\n });\n}\n\nexport function clearSessionCookie(c: Context) {\n deleteCookie(c, SESSION_COOKIE, { path: \"/\" });\n}\n\nexport async function getCurrentUser(c: Context): Promise {\n const token = getCookie(c, SESSION_COOKIE);\n if (!token) return null;\n const res = await sqlite.execute({\n sql: `SELECT u.id, u.name, u.username, u.role, u.position\n FROM sessions s JOIN users u ON u.id = s.user_id\n WHERE s.token = ? AND s.expires_at > datetime('now') AND u.active = 1`,\n args: [token],\n });\n if (res.rows.length === 0) return null;\n return res.rows[0] as unknown as SessionUser;\n}\n\nexport async function destroySession(c: Context) {\n const token = getCookie(c, SESSION_COOKIE);\n if (token) {\n await sqlite.execute({ sql: \"DELETE FROM sessions WHERE token = ?\", args: [token] });\n }\n clearSessionCookie(c);\n}\n",[176],"944e8a27-f220-4d0e-9d5b-f515fbb9ab5b","README.md","01a0390a-88ed-72fa-80c5-6ae828b904a1",["D",1787663386761],"# hono-jsx-starter\n\nA minimal [Hono](https://hono.dev) + Hono JSX starter for Val Town.\nServer-rendered HTML, no build step, no React.\n\n## Picking a starter\n\n| Starter | When to pick it |\n| --- | --- |\n| [`basic-html-starter`](https://www.val.town/x/templates/basic-html-starter) | Static HTML pages. Sprinkle of vanilla JS. No server-side rendering. |\n| **[`hono-jsx-starter`](https://www.val.town/x/templates/hono-jsx-starter)** *(you're here)* | Dynamic server-rendered HTML with JSX. API routes. No React, no SPA. |\n| [`react-hono-starter`](https://www.val.town/x/templates/react-hono-starter) | Client-side React SPA with a Hono API backend. |\n\n## What's here\n\n```\nindex.tsx Hono app, Layout, routes\npublic/\n favicon.svg Static asset\n counter.ts Tiny client-side script\n```\n\nThe whole app fits in one file. As you grow it, the natural next moves are:\n\n- Pull `Layout` into its own `.tsx` file once you have 3+ pages.\n- Split routes with `app.route(\"/api\", api)` if `/api/*` grows.\n- Add more files under `public/` — they're served by a single\n `app.get(\"/public/*\", ...)` route.\n\n## Patterns worth knowing\n\n**JSX pragma.** Every `.tsx` file that uses JSX needs this at the top:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\n```\n\n**Server state.** The counter on `/` is `let count = 0` at module scope. It\nlives in memory on the Val Town server and survives across requests — but resets\nwhenever the val restarts (deploys, idle timeouts, etc.). For persistent state,\nswap it for [`std/sqlite`](https://www.val.town/x/std/sqlite) or\n[`std/blob`](https://www.val.town/x/std/blob).\n\n**API routes.** The `Increment` button POSTs to `/api/increment`, which returns\nJSON. Mix server-rendered pages and JSON endpoints in the same Hono app:\n\n```ts\napp.post(\"/api/increment\", (c) => c.json({ count: ++count }));\n```\n\n**Static files.** `serveFile` reads the file by path and serves it with the\nright content-type. `.ts` files are transpiled to JS on request by Val Town — so\nyou can write `public/counter.ts` and reference it as\n`

Diff · v17