[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_246":247,"_248":249},"routes/_app.x.$handle.$name",{"_99":98,"_32":45,"_108":89,"_27":109,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_20":-5,"_120":-5,"_121":-5,"_122":25,"_123":124,"_125":58,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",8,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","index.tsx","latestPath","fileId","01a0390a-88ed-72fa-80c5-6c5a22bf21c2","name","fileType","http","content","/** @jsxImportSource npm:hono@4/jsx */\nimport { Hono } from \"npm:hono@4\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { initDb } from \"./db.ts\";\nimport { seedIfEmpty } from \"./seed.ts\";\nimport {\n createSession, destroySession, getCurrentUser, hashPassword,\n setSessionCookie, verifyPassword,\n} from \"./auth.ts\";\nimport { Layout, peso } from \"./views.tsx\";\n\nawait initDb();\nawait seedIfEmpty();\n\nconst app = new Hono();\napp.onError((err) => Promise.reject(err));\n\n// ---------- helpers ----------\n\nfunction todayIso() {\n return new Date().toISOString().slice(0, 10);\n}\n\nasync function requireStaff(c: any) {\n const user = await getCurrentUser(c);\n if (!user) return null;\n return user;\n}\n\nasync function requireOwner(c: any) {\n const user = await getCurrentUser(c);\n if (!user || user.role !== \"owner\") return null;\n return user;\n}\n\n// ---------- home / login ----------\n\napp.get(\"/\", async (c) => {\n const user = await getCurrentUser(c);\n if (user) return c.redirect(user.role === \"owner\" ? \"/owner\" : \"/staff\");\n return c.html();\n});\n\nfunction LoginPage({ error }: { error?: string } = {}) {\n return (\n \n

\n IS\n Isento\n

\n {error &&

{error}

}\n \n

\n Staff and owner accounts only. Guests use the link sent with their booking, or{\" \"}\n look up a stay here.\n

\n \n );\n}\n\napp.post(\"/login\", async (c) => {\n const body = await c.req.parseBody();\n const username = String(body.username || \"\").trim().toLowerCase();\n const password = String(body.password || \"\");\n const res = await sqlite.execute({\n sql: \"SELECT * FROM users WHERE username = ? AND active = 1\",\n args: [username],\n });\n const row = res.rows[0] as any;\n if (!row || !(await verifyPassword(password, row.password_hash, row.salt))) {\n return c.html(, 401);\n }\n const token = await createSession(row.id);\n setSessionCookie(c, token);\n return c.redirect(row.role === \"owner\" ? \"/owner\" : \"/staff\");\n});\n\napp.post(\"/logout\", async (c) => {\n await destroySession(c);\n return c.redirect(\"/\");\n});\n\n// ---------- change password ----------\n\napp.get(\"/change-password\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.redirect(\"/\");\n return c.html(\n \n

Change password

\n \n

\n ,\n );\n});\n\napp.post(\"/change-password\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.redirect(\"/\");\n const body = await c.req.parseBody();\n const res = await sqlite.execute({ sql: \"SELECT * FROM users WHERE id = ?\", args: [user.id] });\n const row = res.rows[0] as any;\n const ok = await verifyPassword(String(body.current || \"\"), row.password_hash, row.salt);\n if (!ok) {\n return c.html(\n \n

Change password

Current password is incorrect.

\n Back\n ,\n 401,\n );\n }\n const { hash, salt } = await hashPassword(String(body.next || \"\"));\n await sqlite.execute({ sql: \"UPDATE users SET password_hash = ?, salt = ? WHERE id = ?\", args: [hash, salt, user.id] });\n return c.redirect(user.role === \"owner\" ? \"/owner\" : \"/staff\");\n});\n\n// ---------- guest portal (no login — booking access code) ----------\n\napp.get(\"/guest\", async (c) => {\n const err = c.req.query(\"error\");\n return c.html(\n \n \n ,\n );\n});\n\napp.get(\"/guest/lookup\", async (c) => {\n const code = String(c.req.query(\"code\") || \"\").trim().toUpperCase();\n return c.redirect(`/guest/${encodeURIComponent(code)}`);\n});\n\napp.get(\"/guest/:code\", async (c) => {\n const code = c.req.param(\"code\").trim().toUpperCase();\n const res = await sqlite.execute({\n sql: `SELECT b.*, u.developer, u.location, u.unit_no, u.room\n FROM bookings b JOIN units u ON u.id = b.unit_id\n WHERE b.access_code = ?`,\n args: [code],\n });\n const b = res.rows[0] as any;\n if (!b) return c.redirect(\"/guest?error=1\");\n\n return c.html(\n \n

ISIsento Stay

Welcome, {b.guest_name}

{b.location} — {b.unit_no} ({b.room})

\n\n

Check-in

{b.checkin_date}

Check-out

{b.checkout_date}

Status

{b.status.replace(\"_\", \" \")}

Booked via

{b.channel.replace(\"_\", \".\")}

\n\n

Arrival guidance

{b.arrival_notes || \"Arrival details will be sent closer to your check-in date.\"}

\n\n

Need help?

Support phone: {b.support_phone || \"—\"}

Support email: {b.support_email || \"—\"}

\n\n

\n This portal shows only your reservation details. Internal operations, staff tools, and financial information are not accessible from here.\n

\n ,\n );\n});\n\n// ---------- staff dashboard ----------\n\napp.get(\"/staff\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.redirect(\"/\");\n\n const tasksRes = await sqlite.execute({\n sql: `SELECT t.*, u.location, u.unit_no FROM tasks t JOIN units u ON u.id = t.unit_id\n WHERE t.assigned_to = ? ORDER BY (t.status='done'), t.due_date IS NULL, t.due_date`,\n args: [user.id],\n });\n const tasks = tasksRes.rows as any[];\n\n const notifRes = await sqlite.execute({\n sql: `SELECT * FROM notifications WHERE user_id = ? ORDER BY created_at DESC LIMIT 20`,\n args: [user.id],\n });\n const notifs = notifRes.rows as any[];\n\n const total = tasks.length;\n const done = tasks.filter((t) => t.status === \"done\").length;\n const overdue = tasks.filter((t) => t.status !== \"done\" && t.due_date && t.due_date < todayIso()).length;\n const rate = total ? Math.round((done / total) * 100) : 0;\n\n return c.html(\n \n

Hi {user.name.split(\" \")[0]}

{user.position} · your tasks, notifications, and KPI.

\n\n

Assigned

{total}

Completed

{done}

Completion rate

{rate}%

Overdue

{overdue}

\n\n

My checklist

\n {tasks.length === 0 &&

No tasks assigned right now.

}\n {tasks.map((t) => (\n

\n \n

\n {t.task_type}\n {t.description}\n

\n {t.location} · {t.unit_no} {t.due_date ? `· due ${t.due_date}` : \"\"}\n

\n {t.status !== \"done\" && t.due_date && t.due_date < todayIso() && Overdue}\n

\n ))}\n

\n\n

Notifications

\n {notifs.length === 0 &&

Nothing new.

}\n {notifs.map((n) => (\n

\n {n.message}\n

{n.created_at}

\n ))}\n

\n\n

Report an issue or supply need

\n \n

\n\n

Change password

\n\n \n ,\n );\n});\n\nfunction UnitOptions() {\n return null; // replaced server-side below via renderUnitOptions\n}\n\napp.post(\"/api/tasks/:id/status\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.json({ error: \"unauthorized\" }, 401);\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({}));\n const status = body.status === \"done\" ? \"done\" : body.status === \"in_progress\" ? \"in_progress\" : \"todo\";\n\n // staff may only update their own tasks; owner may update any\n const check = await sqlite.execute({ sql: \"SELECT assigned_to FROM tasks WHERE id = ?\", args: [id] });\n const row = check.rows[0] as any;\n if (!row) return c.json({ error: \"not found\" }, 404);\n if (user.role !== \"owner\" && row.assigned_to !== user.id) return c.json({ error: \"forbidden\" }, 403);\n\n await sqlite.execute({\n sql: \"UPDATE tasks SET status = ?, completed_at = ? WHERE id = ?\",\n args: [status, status === \"done\" ? new Date().toISOString() : null, id],\n });\n return c.json({ ok: true });\n});\n\napp.post(\"/tasks/create\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.redirect(\"/\");\n const body = await c.req.parseBody();\n await sqlite.execute({\n sql: `INSERT INTO tasks (unit_id, task_type, description, assigned_to, status, due_date, created_by) VALUES (?,?,?,?,?,?,?)`,\n args: [\n Number(body.unit_id), String(body.task_type || \"cleaning\"), String(body.description || \"\"),\n Number(body.assigned_to), \"todo\", String(body.due_date || todayIso()), user.id,\n ],\n });\n return c.redirect(user.role === \"owner\" ? \"/owner\" : \"/staff\");\n});\n\n// ---------- owner dashboard ----------\n\napp.get(\"/owner\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n\n const bookingsRes = await sqlite.execute(\n `SELECT b.*, u.location, u.unit_no FROM bookings b JOIN units u ON u.id = b.unit_id ORDER BY b.checkin_date DESC LIMIT 50`,\n );\n const bookings = bookingsRes.rows as any[];\n\n const totals = bookings.reduce(\n (acc, b) => {\n const net = b.gross_revenue - b.airbnb_fee - b.booking_com_fee - b.other_fee;\n acc.gross += b.gross_revenue; acc.airbnb += b.airbnb_fee; acc.bookingcom += b.booking_com_fee;\n acc.other += b.other_fee; acc.net += net;\n return acc;\n },\n { gross: 0, airbnb: 0, bookingcom: 0, other: 0, net: 0 },\n );\n\n const staffKpiRes = await sqlite.execute(\n `SELECT us.id, us.name, us.position,\n COUNT(t.id) as total,\n SUM(CASE WHEN t.status='done' THEN 1 ELSE 0 END) as done,\n SUM(CASE WHEN t.status!='done' AND t.due_date IS NOT NULL AND t.due_date < date('now') THEN 1 ELSE 0 END) as overdue\n FROM users us LEFT JOIN tasks t ON t.assigned_to = us.id\n WHERE us.role = 'staff' AND us.active = 1\n GROUP BY us.id ORDER BY us.name`,\n );\n const staffKpi = staffKpiRes.rows as any[];\n\n const leadsRes = await sqlite.execute(`SELECT * FROM leads ORDER BY created_at DESC`);\n const leads = leadsRes.rows as any[];\n\n const unitsRes = await sqlite.execute(`SELECT * FROM units WHERE active = 1 ORDER BY location`);\n const units = unitsRes.rows as any[];\n\n const statusBadge = (s: string) => {\n const cls = s === \"won\" ? \"ok\" : s === \"lost\" ? \"bad\" : s === \"negotiating\" ? \"warn\" : \"neutral\";\n return {s};\n };\n\n return c.html(\n \n

Owner dashboard

Finance, KPIs, and the partner pipeline — visible to owners only.

\n\n

Channel-fee ledger

Gross booking revenue

{peso(totals.gross)}

Airbnb fees

{peso(totals.airbnb)}

Booking.com fees

{peso(totals.bookingcom)}

Net payout

{peso(totals.net)}

\n \n \n \n \n \n \n \n \n {bookings.map((b) => {\n const net = b.gross_revenue - b.airbnb_fee - b.booking_com_fee - b.other_fee;\n return (\n \n \n \n \n \n \n \n \n \n \n \n \n );\n })}\n \n

Unit	Guest	Channel	Check-in	Gross	Airbnb fee	Booking.com fee	Other fee	Net payout	Status
{b.location} {b.unit_no}	{b.guest_name}	{b.channel.replace(\"_\", \".\")}	{b.checkin_date}	{peso(b.gross_revenue)}	{b.airbnb_fee ? peso(b.airbnb_fee) : \"—\"}	{b.booking_com_fee ? peso(b.booking_com_fee) : \"—\"}	{b.other_fee ? peso(b.other_fee) : \"—\"}	{peso(net)}	{b.status.replace(\"_\", \" \")}

\n Live sync with Airbnb and Booking.com is not active yet — bookings and fees above are entered manually until channel-manager credentials are connected. See \"Add booking\" below to log new reservations.\n

\n\n

Add booking

Unit

Guest name

\n Channel\n \n

Status\n \n

Check-in

Check-out

Gross revenue (₱)

Airbnb fee (₱)

Booking.com fee (₱)

Other fee (₱)

Arrival guidance for guest

Support phone

Support email

\n \n

\n\n

Staff KPI overview

\n \n \n \n {staffKpi.map((s) => {\n const rate = s.total ? Math.round((s.done / s.total) * 100) : 0;\n return (\n \n \n \n \n \n );\n })}\n \n

Staff	Position	Assigned	Completed	Completion rate	Overdue
{s.name}	{s.position}	{s.total}	{s.done}	{rate}%	{s.overdue > 0 ? {s.overdue} : \"0\"}

\n\n

Sales lead tracker — partner websites

\n \n \n \n {leads.map((l) => (\n \n \n \n \n \n \n \n ))}\n \n

Partner	Contact	Status	Potential units	Notes
{l.partner_name} {l.website}	{l.contact_name \|\| \"—\"}	{statusBadge(l.status)}	{l.potential_units ?? \"—\"}	{l.notes}

\n \n

\n\n

Units under management

\n \n \n {units.map((u) => )}\n

Developer	Location	Unit	Room	SQM
{u.developer}	{u.location}	{u.unit_no}	{u.room}	{u.sqm}

\n\n

Change password

\n IS\n Isento\n

\n {error &&

{error}

}\n \n

\n Staff and owner accounts only. Guests use the link sent with their booking, or{\" \"}\n look up a stay here.\n

Change password

\n \n

Change password

Current password is incorrect.

ISIsento Stay

Welcome, {b.guest_name}

{b.location} — {b.unit_no} ({b.room})

\n\n

Check-in

{b.checkin_date}

Check-out

{b.checkout_date}

Status

{b.status.replace(\"_\", \" \")}

Booked via

{b.channel.replace(\"_\", \".\")}

\n\n

Arrival guidance

{b.arrival_notes || \"Arrival details will be sent closer to your check-in date.\"}

\n\n

Need help?

Support phone: {b.support_phone || \"—\"}

Support email: {b.support_email || \"—\"}

\n\n

\n This portal shows only your reservation details. Internal operations, staff tools, and financial information are not accessible from here.\n

\n ,\n );\n});\n\n// ---------- staff dashboard ----------\n\napp.get(\"/staff\", async (c) => {\n const user = await requireStaff(c);\n if (!user) return c.redirect(\"/\");\n\n const tasksRes = await sqlite.execute({\n sql: `SELECT t.*, u.location, u.unit_no FROM tasks t JOIN units u ON u.id = t.unit_id\n WHERE t.assigned_to = ? ORDER BY (t.status='done'), t.due_date IS NULL, t.due_date`,\n args: [user.id],\n });\n const tasks = tasksRes.rows as any[];\n\n const notifRes = await sqlite.execute({\n sql: `SELECT * FROM notifications WHERE user_id = ? ORDER BY created_at DESC LIMIT 20`,\n args: [user.id],\n });\n const notifs = notifRes.rows as any[];\n\n const unitsRes = await sqlite.execute(`SELECT * FROM units WHERE active = 1 ORDER BY location`);\n const units = unitsRes.rows as any[];\n\n const total = tasks.length;\n const done = tasks.filter((t) => t.status === \"done\").length;\n const overdue = tasks.filter((t) => t.status !== \"done\" && t.due_date && t.due_date < todayIso()).length;\n const rate = total ? Math.round((done / total) * 100) : 0;\n\n return c.html(\n \n

Hi {user.name.split(\" \")[0]}

{user.position} · your tasks, notifications, and KPI.

\n\n

Assigned

{total}

Completed

{done}

Completion rate

{rate}%

Overdue

{overdue}

\n\n

My checklist

\n {tasks.length === 0 &&

No tasks assigned right now.

}\n {tasks.map((t) => (\n

\n \n

\n {t.task_type}\n {t.description}\n

\n {t.location} · {t.unit_no} {t.due_date ? `· due ${t.due_date}` : \"\"}\n

\n {t.status !== \"done\" && t.due_date && t.due_date < todayIso() && Overdue}\n

\n ))}\n

\n\n

Notifications

\n {notifs.length === 0 &&

Nothing new.

}\n {notifs.map((n) => (\n

\n {n.message}\n

{n.created_at}

\n ))}\n

\n\n

Report an issue or supply need

\n \n

\n\n

Change password

Owner dashboard

Finance, KPIs, and the partner pipeline — visible to owners only.

\n\n

Channel-fee ledger

Gross booking revenue

{peso(totals.gross)}

Airbnb fees

{peso(totals.airbnb)}

Booking.com fees

{peso(totals.bookingcom)}

Net payout

{peso(totals.net)}

\n \n \n \n \n \n \n \n \n {bookings.map((b) => {\n const net = b.gross_revenue - b.airbnb_fee - b.booking_com_fee - b.other_fee;\n return (\n \n \n \n \n \n \n \n \n \n \n \n \n );\n })}\n \n

Unit	Guest	Channel	Check-in	Gross	Airbnb fee	Booking.com fee	Other fee	Net payout	Status
{b.location} {b.unit_no}	{b.guest_name}	{b.channel.replace(\"_\", \".\")}	{b.checkin_date}	{peso(b.gross_revenue)}	{b.airbnb_fee ? peso(b.airbnb_fee) : \"—\"}	{b.booking_com_fee ? peso(b.booking_com_fee) : \"—\"}	{b.other_fee ? peso(b.other_fee) : \"—\"}	{peso(net)}	{b.status.replace(\"_\", \" \")}

\n\n

Add booking

Unit

Guest name

\n Channel\n \n

Status\n \n

Check-in

Check-out

Gross revenue (₱)

Airbnb fee (₱)

Booking.com fee (₱)

Other fee (₱)

Arrival guidance for guest

Support phone

Support email

\n \n

\n\n

Staff KPI overview

\n \n \n \n {staffKpi.map((s) => {\n const rate = s.total ? Math.round((s.done / s.total) * 100) : 0;\n return (\n \n \n \n \n \n );\n })}\n \n

Staff	Position	Assigned	Completed	Completion rate	Overdue
{s.name}	{s.position}	{s.total}	{s.done}	{rate}%	{s.overdue > 0 ? {s.overdue} : \"0\"}

\n\n

Sales lead tracker — partner websites

\n \n \n \n {leads.map((l) => (\n \n \n \n \n \n \n \n ))}\n \n

Partner	Contact	Status	Potential units	Notes
{l.partner_name} {l.website}	{l.contact_name \|\| \"—\"}	{statusBadge(l.status)}	{l.potential_units ?? \"—\"}	{l.notes}

\n \n

\n\n

Units under management

\n \n \n {units.map((u) => )}\n

Developer	Location	Unit	Room	SQM
{u.developer}	{u.location}	{u.unit_no}	{u.room}	{u.sqm}

\n\n

Change password

\n ,\n );\n});\n\napp.post(\"/bookings/create\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n const body = await c.req.parseBody();\n function code(len = 8) {\n const chars = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n let out = \"\";\n for (let i = 0; i < len; i++) out += chars[Math.floor(Math.random() * chars.length)];\n return out;\n }\n await sqlite.execute({\n sql: `INSERT INTO bookings (unit_id, guest_name, channel, checkin_date, checkout_date, gross_revenue, airbnb_fee, booking_com_fee, other_fee, status, access_code, arrival_notes, support_phone, support_email, created_by)\n VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,\n args: [\n Number(body.unit_id), String(body.guest_name), String(body.channel), String(body.checkin_date), String(body.checkout_date),\n Number(body.gross_revenue || 0), Number(body.airbnb_fee || 0), Number(body.booking_com_fee || 0), Number(body.other_fee || 0),\n String(body.status || \"confirmed\"), code(), String(body.arrival_notes || \"\"), String(body.support_phone || \"\"), String(body.support_email || \"\"),\n user.id,\n ],\n });\n return c.redirect(\"/owner\");\n});\n\napp.post(\"/leads/create\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.redirect(\"/\");\n const body = await c.req.parseBody();\n await sqlite.execute({\n sql: `INSERT INTO leads (partner_name, website, contact_name, status, potential_units, notes, created_by) VALUES (?,?,?,?,?,?,?)`,\n args: [\n String(body.partner_name), String(body.website || \"\"), String(body.contact_name || \"\"),\n \"new\", body.potential_units ? Number(body.potential_units) : null, String(body.notes || \"\"), user.id,\n ],\n });\n return c.redirect(\"/owner\");\n});\n\napp.post(\"/leads/:id/status\", async (c) => {\n const user = await requireOwner(c);\n if (!user) return c.json({ error: \"unauthorized\" }, 401);\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({}));\n await sqlite.execute({ sql: \"UPDATE leads SET status = ? WHERE id = ?\", args: [String(body.status), id] });\n return c.json({ ok: true });\n});\n\nexport default app.fetch;\n","createdAt",["D",1787663631517],"branchVersion","branchId","700f5db6-dbe9-4221-89f4-c1af68565814","id","f6d544b2-720a-4193-9797-fd95cddc322a","isento",["D",1787663386761],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Isento property ops: staff/owner/guest portals + fee ledger","imageUrl","0d80088e-7112-4b81-b513-1efae25ea3d8","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a03906-2a46-7197-a3ac-792ee8e04a5c","tursoName","f6d544b2720a41939797fd95cddc322a","tursoHostname","f6d544b2720a41939797fd95cddc322a-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789485645684],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_107":103},"org",{"_99":98,"_100":101,"_102":103,"_18":55,"_104":105,"_106":25},"branch",{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"isOwned",24,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","imeldaedodollon","handle","displayName","imelda edodollon","avatar","https://lh3.googleusercontent.com/a/ACg8ocKr1iICq7J9VyfzCVOdogvCtL322dGPfd-X6jqTWmG5_i8FBgQ=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":241,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":242,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":243,"_83":244,"_85":245,"_87":25},"tree",[196,199,200,201,202,203,204],"files",[196,197,198,199,200,201,202,203,204],"counts",{"_186":62,"_187":165,"_188":62,"_189":190,"_191":192},"contents",[130,131,132,133,134,135,136],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":181,"_32":50,"_30":182,"_140":-5,"_41":42,"_40":165,"_142":58,"_38":183,"_13":62,"_33":184,"_35":-5,"_24":25,"_146":-5,"_27":185},{"_43":175,"_32":176,"_30":177,"_140":-5,"_41":42,"_40":165,"_142":58,"_38":178,"_13":62,"_33":20,"_35":179,"_24":25,"_146":-5,"_27":180},{"_43":168,"_32":169,"_30":170,"_140":-5,"_41":42,"_40":171,"_142":58,"_38":172,"_13":62,"_33":144,"_35":173,"_24":25,"_146":-5,"_27":174},{"_43":160,"_32":161,"_30":162,"_140":-5,"_41":42,"_40":163,"_142":25,"_38":164,"_13":165,"_33":144,"_35":166,"_24":25,"_146":-5,"_27":167},{"_43":155,"_32":28,"_30":31,"_140":-5,"_41":42,"_40":14,"_142":25,"_38":156,"_13":157,"_33":34,"_35":37,"_24":25,"_146":158,"_27":159},{"_43":148,"_32":149,"_30":150,"_140":-5,"_41":42,"_40":151,"_142":25,"_38":152,"_13":62,"_33":144,"_35":153,"_24":25,"_146":-5,"_27":154},{"_43":137,"_32":138,"_30":139,"_140":-5,"_41":42,"_40":141,"_142":25,"_38":143,"_13":62,"_33":144,"_35":145,"_24":25,"_146":-5,"_27":147},"bb0a898d-4c94-445c-96cb-2abc2e3ddd40","views.tsx","9bd444cc-a086-11f1-939f-1607ee4eb77e","parentId",6,"latest",["D",1787663542551],"script","/** @jsxImportSource npm:hono@4/jsx */\n\nexport function peso(n: number): string {\n const v = Math.round((n || 0) * 100) / 100;\n return \"₱\" + v.toLocaleString(\"en-PH\", { minimumFractionDigits: 0, maximumFractionDigits: 2 });\n}\n\nexport const BRAND_CSS = `\n :root{\n --bg:#f2f5f4; --panel:#ffffff; --panel-2:#eef2f1; --ink:#132521; --ink-dim:#54655f;\n --line:#d6dfdb; --line-soft:#e6ebe9; --teal:#0e5c52; --teal-ink:#ffffff; --amber:#b5651d;\n --ok:#1f7a4d; --ok-bg:#e4f3ea; --bad:#a5432c; --bad-bg:#fbe9e4; --warn:#8a6a1f; --warn-bg:#faf1dc;\n --radius:10px; --shadow:0 1px 2px rgba(19,37,33,.06), 0 6px 18px -10px rgba(19,37,33,.18);\n }\n @media (prefers-color-scheme: dark){\n :root:not([data-theme=\"light\"]){\n --bg:#0d1614; --panel:#132320; --panel-2:#0f1c19; --ink:#e9f1ee; --ink-dim:#9db3ac;\n --line:#26433c; --line-soft:#1c332d; --teal:#3fa393; --teal-ink:#06120f; --amber:#e0975a;\n --ok:#6fce97; --ok-bg:#123322; --bad:#e0715f; --bad-bg:#331b16; --warn:#e0c25a; --warn-bg:#332c14;\n --shadow:0 1px 2px rgba(0,0,0,.3), 0 6px 18px -10px rgba(0,0,0,.5);\n }\n }\n :root[data-theme=\"dark\"]{\n --bg:#0d1614; --panel:#132320; --panel-2:#0f1c19; --ink:#e9f1ee; --ink-dim:#9db3ac;\n --line:#26433c; --line-soft:#1c332d; --teal:#3fa393; --teal-ink:#06120f; --amber:#e0975a;\n --ok:#6fce97; --ok-bg:#123322; --bad:#e0715f; --bad-bg:#331b16; --warn:#e0c25a; --warn-bg:#332c14;\n --shadow:0 1px 2px rgba(0,0,0,.3), 0 6px 18px -10px rgba(0,0,0,.5);\n }\n *{box-sizing:border-box;}\n body{margin:0;background:var(--bg);color:var(--ink);font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Karla,sans-serif;line-height:1.5;}\n a{color:var(--teal);}\n .topbar{display:flex;align-items:center;gap:14px;padding:12px 20px;background:var(--panel);border-bottom:1px solid var(--line);position:sticky;top:0;z-index:10;flex-wrap:wrap;}\n .brand{font-weight:800;font-size:18px;letter-spacing:-0.01em;display:flex;align-items:center;gap:8px;}\n .brand .mark{width:26px;height:26px;border-radius:7px;background:var(--teal);color:var(--teal-ink);display:flex;align-items:center;justify-content:center;font-size:13px;font-weight:800;}\n .topbar .who{margin-left:auto;display:flex;align-items:center;gap:12px;font-size:13px;color:var(--ink-dim);flex-wrap:wrap;}\n .topbar form{display:inline;}\n .btn{display:inline-flex;align-items:center;gap:6px;border:1px solid var(--line);background:var(--panel);color:var(--ink);\n padding:7px 14px;border-radius:8px;font-size:13.5px;cursor:pointer;text-decoration:none;font-family:inherit;}\n .btn:hover{background:var(--panel-2);}\n .btn.primary{background:var(--teal);color:var(--teal-ink);border-color:var(--teal);}\n .btn.primary:hover{opacity:.92;}\n .btn.small{padding:4px 10px;font-size:12px;}\n .wrap{max-width:1100px;margin:0 auto;padding:22px 18px 60px;}\n h1{font-size:24px;font-weight:800;margin:0 0 6px;}\n h2{font-size:17px;font-weight:800;margin:0 0 12px;}\n .sub{color:var(--ink-dim);font-size:14px;margin:0 0 20px;}\n .grid{display:grid;gap:14px;}\n .cols-4{grid-template-columns:repeat(auto-fit,minmax(160px,1fr));}\n .cols-2{grid-template-columns:repeat(auto-fit,minmax(320px,1fr));}\n .card{background:var(--panel);border:1px solid var(--line);border-radius:var(--radius);padding:16px 18px;box-shadow:var(--shadow);}\n .stat .k{font-size:11px;letter-spacing:.06em;text-transform:uppercase;color:var(--ink-dim);}\n .stat .v{font-size:22px;font-weight:800;margin-top:4px;}\n section{margin-top:28px;}\n table{width:100%;border-collapse:collapse;font-size:13.5px;}\n th{text-align:left;font-size:11px;letter-spacing:.05em;text-transform:uppercase;color:var(--ink-dim);padding:8px 10px;border-bottom:1px solid var(--line);}\n td{padding:9px 10px;border-bottom:1px solid var(--line-soft);vertical-align:top;}\n .table-scroll{overflow-x:auto;}\n .badge{display:inline-block;padding:2px 9px;border-radius:999px;font-size:11.5px;font-weight:600;}\n .badge.ok{background:var(--ok-bg);color:var(--ok);}\n .badge.bad{background:var(--bad-bg);color:var(--bad);}\n .badge.warn{background:var(--warn-bg);color:var(--warn);}\n .badge.neutral{background:var(--panel-2);color:var(--ink-dim);}\n input,select,textarea{font-family:inherit;font-size:13.5px;padding:8px 10px;border:1px solid var(--line);border-radius:7px;background:var(--panel);color:var(--ink);width:100%;}\n label{font-size:12px;color:var(--ink-dim);display:block;margin-bottom:4px;}\n .field{margin-bottom:12px;}\n form.inline{display:flex;gap:8px;align-items:end;flex-wrap:wrap;}\n .login-wrap{min-height:100vh;display:flex;align-items:center;justify-content:center;padding:20px;}\n .login-card{max-width:380px;width:100%;background:var(--panel);border:1px solid var(--line);border-radius:14px;padding:30px 28px;box-shadow:var(--shadow);}\n .login-tabs{display:flex;gap:6px;margin-bottom:18px;background:var(--panel-2);padding:4px;border-radius:9px;}\n .login-tabs a{flex:1;text-align:center;padding:7px 0;border-radius:6px;font-size:13px;text-decoration:none;color:var(--ink-dim);font-weight:600;}\n .login-tabs a.active{background:var(--panel);color:var(--ink);box-shadow:var(--shadow);}\n .notice{padding:10px 12px;border-radius:8px;font-size:13px;margin-bottom:14px;}\n .notice.error{background:var(--bad-bg);color:var(--bad);}\n .notice.info{background:var(--panel-2);color:var(--ink-dim);}\n .checklist-item{display:flex;align-items:center;gap:10px;padding:10px 0;border-bottom:1px solid var(--line-soft);}\n .checklist-item:last-child{border-bottom:none;}\n .checklist-item .desc{flex:1;}\n .checklist-item.done .desc{color:var(--ink-dim);text-decoration:line-through;}\n .tag-type{font-size:10.5px;text-transform:uppercase;letter-spacing:.04em;color:var(--ink-dim);background:var(--panel-2);padding:1px 7px;border-radius:5px;margin-right:6px;}\n footer{margin-top:50px;padding-top:16px;border-top:1px solid var(--line);color:var(--ink-dim);font-size:11.5px;display:flex;justify-content:space-between;flex-wrap:wrap;gap:8px;}\n .lock-note{font-size:12px;color:var(--ink-dim);background:var(--panel-2);border:1px dashed var(--line);border-radius:8px;padding:10px 12px;margin-top:10px;}\n @media (max-width:640px){ .topbar .who{width:100%;justify-content:flex-start;margin-left:0;} }\n`;\n\nexport function Layout(\n { title, user, activeNav, children }: { title: string; user?: { name: string; role: string } | null; activeNav?: string; children: any },\n) {\n return (\n \n \n {title} · Isento\n \n \n \n \n \n \n

{children}

\n \n \n \n );\n}\n","label",[138],"bf7b6b40-a63d-4aed-82d1-5fda67dbc27a","seed.ts","85f5bc76-a086-11f1-b9a2-1607ee4eb77e",5,["D",1787663505866],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { hashPassword } from \"./auth.ts\";\n\nconst UNITS = [\n { developer: \"Megaworld\", location: \"Venice Luxury Residences BGC\", unit_no: \"3F Domenico\", room: \"1 BR\", sqm: 66 },\n { developer: \"Avida\", location: \"Asten Makati\", unit_no: \"612 Tower 2\", room: \"1 BR\", sqm: 34 },\n { developer: \"SMDC\", location: \"Shell Residences\", unit_no: \"852 Tower A\", room: \"1 BR\", sqm: 38 },\n { developer: \"Amaia Steps\", location: \"Alabang\", unit_no: \"430 Helena\", room: \"Studio\", sqm: 25 },\n { developer: \"Avida\", location: \"Southpoint Makati\", unit_no: \"234 Tower 1\", room: \"1 BR\", sqm: 38 },\n { developer: \"DMCI\", location: \"Alder Taguig\", unit_no: \"912 Manzuria\", room: \"2 BR\", sqm: 54 },\n { developer: \"DMCI\", location: \"Alder Taguig\", unit_no: \"PH 07 Oregon\", room: \"3 BR\", sqm: 98 },\n { developer: \"DMCI\", location: \"Allegra\", unit_no: \"1202 Soraya\", room: \"1 BR\", sqm: 30 },\n { developer: \"DMCI\", location: \"Cubao\", unit_no: \"3811 Oriana\", room: \"2 BR\", sqm: 54 },\n { developer: \"Casa Real\", location: \"Bacolor Pampanga\", unit_no: \"Lot 9 Blk 19\", room: \"4 BR\", sqm: 200 },\n];\n\nconst STAFF = [\n { name: \"Darwin\", username: \"darwin\", position: \"Cleaner\" },\n { name: \"Daryl\", username: \"daryl\", position: \"Maintenance Technician\" },\n { name: \"Nadz\", username: \"nadz\", position: \"Property Coordinator\" },\n { name: \"Jomar\", username: \"jomar\", position: \"Cleaner\" },\n];\n\nfunction randomCode(len = 8): string {\n const chars = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n let out = \"\";\n for (let i = 0; i < len; i++) out += chars[Math.floor(Math.random() * chars.length)];\n return out;\n}\n\nexport async function seedIfEmpty() {\n const existing = await sqlite.execute(\"SELECT COUNT(*) as n FROM users\");\n const n = (existing.rows[0] as any).n as number;\n if (n > 0) return { seeded: false };\n\n // --- owner ---\n const ownerPw = await hashPassword(\"Isento#Owner2026\");\n await sqlite.execute({\n sql: `INSERT INTO users (name, username, password_hash, salt, role, position) VALUES (?,?,?,?,?,?)`,\n args: [\"Dr. Meddie Edodollon\", \"meddie\", ownerPw.hash, ownerPw.salt, \"owner\", \"Owner\"],\n });\n\n // --- staff ---\n const staffIds: Record = {};\n for (const s of STAFF) {\n const pw = await hashPassword(`Isento#${s.username[0].toUpperCase()}${s.username.slice(1)}26`);\n const res = await sqlite.execute({\n sql: `INSERT INTO users (name, username, password_hash, salt, role, position) VALUES (?,?,?,?,?,?)`,\n args: [s.name, s.username, pw.hash, pw.salt, \"staff\", s.position],\n });\n staffIds[s.username] = Number(res.lastInsertRowid);\n }\n\n // --- units ---\n const unitIds: number[] = [];\n for (const u of UNITS) {\n const res = await sqlite.execute({\n sql: `INSERT INTO units (developer, location, unit_no, room, sqm) VALUES (?,?,?,?,?)`,\n args: [u.developer, u.location, u.unit_no, u.room, u.sqm],\n });\n unitIds.push(Number(res.lastInsertRowid));\n }\n\n // --- sample bookings (real channel-fee ledger demo data) ---\n const today = new Date();\n const iso = (d: Date) => d.toISOString().slice(0, 10);\n const plus = (days: number) => { const d = new Date(today); d.setDate(d.getDate() + days); return d; };\n\n const bookings = [\n { unitIdx: 0, guest: \"J. Reyes\", channel: \"airbnb\", checkin: plus(-1), checkout: plus(3), gross: 45000, airbnb: 6750, bookingcom: 0, other: 0 },\n { unitIdx: 2, guest: \"M. Santos\", channel: \"booking_com\", checkin: plus(0), checkout: plus(4), gross: 46000, airbnb: 0, bookingcom: 6900, other: 0 },\n { unitIdx: 5, guest: \"A. Cruz\", channel: \"direct\", checkin: plus(2), checkout: plus(6), gross: 32000, airbnb: 0, bookingcom: 0, other: 0 },\n { unitIdx: 8, guest: \"K. Villanueva\", channel: \"airbnb\", checkin: plus(5), checkout: plus(9), gross: 38000, airbnb: 5700, bookingcom: 0, other: 0 },\n ];\n const bookingIds: number[] = [];\n for (const b of bookings) {\n const res = await sqlite.execute({\n sql: `INSERT INTO bookings (unit_id, guest_name, channel, checkin_date, checkout_date, gross_revenue, airbnb_fee, booking_com_fee, other_fee, status, access_code, arrival_notes, support_phone, support_email)\n VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,\n args: [\n unitIds[b.unitIdx], b.guest, b.channel, iso(b.checkin), iso(b.checkout),\n b.gross, b.airbnb, b.bookingcom, b.other, \"confirmed\", randomCode(),\n \"Gate code will be sent 1 day before arrival. Unit is on a mid-floor unit with elevator access. Parking (if booked) is on B2.\",\n \"+63 917 000 1234\", \"stay@isento.app\",\n ],\n });\n bookingIds.push(Number(res.lastInsertRowid));\n }\n\n // --- sample tasks ---\n const tasks = [\n { unitIdx: 0, bookingIdx: 0, type: \"cleaning\", desc: \"Turnover clean before next check-in\", staff: \"darwin\", due: plus(3) },\n { unitIdx: 2, bookingIdx: 1, type: \"laundry\", desc: \"Wash & restock linens (queen set x2)\", staff: \"nadz\", due: plus(0) },\n { unitIdx: 5, bookingIdx: null, type: \"supplies\", desc: \"Refill toiletries, coffee, drinking water\", staff: \"daryl\", due: plus(1) },\n { unitIdx: 8, bookingIdx: 3, type: \"repair\", desc: \"Fix bathroom faucet leak reported by previous guest\", staff: \"daryl\", due: plus(2) },\n { unitIdx: 1, bookingIdx: null, type: \"cleaning\", desc: \"Deep clean — quarterly schedule\", staff: \"jomar\", due: plus(4) },\n ];\n for (const t of tasks) {\n await sqlite.execute({\n sql: `INSERT INTO tasks (unit_id, booking_id, task_type, description, assigned_to, status, due_date) VALUES (?,?,?,?,?,?,?)`,\n args: [\n unitIds[t.unitIdx],\n t.bookingIdx === null ? null : bookingIds[t.bookingIdx],\n t.type, t.desc, staffIds[t.staff], \"todo\", iso(t.due),\n ],\n });\n await sqlite.execute({\n sql: `INSERT INTO notifications (user_id, message) VALUES (?, ?)`,\n args: [staffIds[t.staff], `New ${t.type} task assigned: ${t.desc}`],\n });\n }\n\n // --- sample leads ---\n const leads = [\n { partner: \"Airbnb Business Travel Ready Program\", website: \"airbnb.com\", contact: \"Partner Success Team\", status: \"contacted\", units: 10, notes: \"Applying to unlock corporate/long-stay travelers.\" },\n { partner: \"Booking.com Genius Partner Upgrade\", website: \"booking.com\", contact: \"Partner Hub\", status: \"new\", units: 10, notes: \"Requires 3-month track record at 8.5+ rating.\" },\n { partner: \"Agoda Partner Onboarding\", website: \"agoda.com\", contact: \"Agoda YCS Team\", status: \"new\", units: 0, notes: \"Diversify channel mix beyond Airbnb/Booking.com.\" },\n ];\n for (const l of leads) {\n await sqlite.execute({\n sql: `INSERT INTO leads (partner_name, website, contact_name, status, potential_units, notes) VALUES (?,?,?,?,?,?)`,\n args: [l.partner, l.website, l.contact, l.status, l.units, l.notes],\n });\n }\n\n return { seeded: true, units: unitIds.length, staff: STAFF.length, bookings: bookings.length, tasks: tasks.length, leads: leads.length };\n}\n",[149],"c517cd18-4c8a-486e-a0ff-ff02f528dd40",["D",1787663631517],2,"isento-ops",[28],"254683cd-86f9-42b6-8d01-071940764677","db.ts","6af305dc-a086-11f1-b89c-1607ee4eb77e",3,["D",1787663465447],1,"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport async function initDb() {\n await sqlite.batch([\n {\n sql: `CREATE TABLE IF NOT EXISTS users (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT NOT NULL,\n username TEXT NOT NULL UNIQUE,\n password_hash TEXT NOT NULL,\n salt TEXT NOT NULL,\n role TEXT NOT NULL CHECK(role IN ('staff','owner')),\n position TEXT,\n active INTEGER NOT NULL DEFAULT 1,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS sessions (\n token TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL REFERENCES users(id),\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n expires_at TEXT NOT NULL\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS units (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n developer TEXT,\n location TEXT,\n unit_no TEXT NOT NULL,\n room TEXT,\n sqm REAL,\n active INTEGER NOT NULL DEFAULT 1\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS bookings (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n unit_id INTEGER NOT NULL REFERENCES units(id),\n guest_name TEXT NOT NULL,\n channel TEXT NOT NULL CHECK(channel IN ('airbnb','booking_com','direct','other')),\n checkin_date TEXT NOT NULL,\n checkout_date TEXT NOT NULL,\n gross_revenue REAL NOT NULL DEFAULT 0,\n airbnb_fee REAL NOT NULL DEFAULT 0,\n booking_com_fee REAL NOT NULL DEFAULT 0,\n other_fee REAL NOT NULL DEFAULT 0,\n status TEXT NOT NULL DEFAULT 'confirmed' CHECK(status IN ('confirmed','checked_in','checked_out','cancelled')),\n access_code TEXT NOT NULL UNIQUE,\n arrival_notes TEXT,\n support_phone TEXT,\n support_email TEXT,\n created_by INTEGER REFERENCES users(id),\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS tasks (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n unit_id INTEGER NOT NULL REFERENCES units(id),\n booking_id INTEGER REFERENCES bookings(id),\n task_type TEXT NOT NULL CHECK(task_type IN ('cleaning','laundry','supplies','repair')),\n description TEXT NOT NULL,\n assigned_to INTEGER REFERENCES users(id),\n status TEXT NOT NULL DEFAULT 'todo' CHECK(status IN ('todo','in_progress','done')),\n due_date TEXT,\n created_by INTEGER REFERENCES users(id),\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n completed_at TEXT\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS notifications (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n user_id INTEGER NOT NULL REFERENCES users(id),\n message TEXT NOT NULL,\n is_read INTEGER NOT NULL DEFAULT 0,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS leads (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n partner_name TEXT NOT NULL,\n website TEXT,\n contact_name TEXT,\n contact_email TEXT,\n contact_phone TEXT,\n status TEXT NOT NULL DEFAULT 'new' CHECK(status IN ('new','contacted','negotiating','won','lost')),\n potential_units INTEGER,\n notes TEXT,\n created_by INTEGER REFERENCES users(id),\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n },\n ]);\n}\n",[161],"51cc9a17-df20-4865-947d-695c7d4d673f","auth.ts","75430aa0-a086-11f1-acf9-1607ee4eb77e",4,["D",1787663477842],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { getCookie, setCookie, deleteCookie } from \"npm:hono@4/cookie\";\nimport type { Context } from \"npm:hono@4\";\n\nconst SESSION_COOKIE = \"isento_session\";\nconst SESSION_DAYS = 14;\n\nfunction toHex(buf: ArrayBuffer): string {\n return Array.from(new Uint8Array(buf)).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction randomHex(bytes: number): string {\n const arr = new Uint8Array(bytes);\n crypto.getRandomValues(arr);\n return toHex(arr.buffer);\n}\n\nasync function pbkdf2(password: string, saltHex: string): Promise {\n const enc = new TextEncoder();\n const keyMaterial = await crypto.subtle.importKey(\n \"raw\",\n enc.encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const saltBytes = new Uint8Array(saltHex.match(/.{2}/g)!.map((h) => parseInt(h, 16)));\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt: saltBytes, iterations: 100_000, hash: \"SHA-256\" },\n keyMaterial,\n 256,\n );\n return toHex(bits);\n}\n\nexport async function hashPassword(password: string): Promise<{ hash: string; salt: string }> {\n const salt = randomHex(16);\n const hash = await pbkdf2(password, salt);\n return { hash, salt };\n}\n\nexport async function verifyPassword(password: string, hash: string, salt: string): Promise {\n const computed = await pbkdf2(password, salt);\n return computed === hash;\n}\n\nexport interface SessionUser {\n id: number;\n name: string;\n username: string;\n role: \"staff\" | \"owner\";\n position: string | null;\n}\n\nexport async function createSession(userId: number): Promise {\n const token = randomHex(32);\n const expires = new Date(Date.now() + SESSION_DAYS * 24 * 60 * 60 * 1000).toISOString();\n await sqlite.execute({\n sql: \"INSERT INTO sessions (token, user_id, expires_at) VALUES (?, ?, ?)\",\n args: [token, userId, expires],\n });\n return token;\n}\n\nexport function setSessionCookie(c: Context, token: string) {\n setCookie(c, SESSION_COOKIE, token, {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n path: \"/\",\n maxAge: SESSION_DAYS * 24 * 60 * 60,\n });\n}\n\nexport function clearSessionCookie(c: Context) {\n deleteCookie(c, SESSION_COOKIE, { path: \"/\" });\n}\n\nexport async function getCurrentUser(c: Context): Promise {\n const token = getCookie(c, SESSION_COOKIE);\n if (!token) return null;\n const res = await sqlite.execute({\n sql: `SELECT u.id, u.name, u.username, u.role, u.position\n FROM sessions s JOIN users u ON u.id = s.user_id\n WHERE s.token = ? AND s.expires_at > datetime('now') AND u.active = 1`,\n args: [token],\n });\n if (res.rows.length === 0) return null;\n return res.rows[0] as unknown as SessionUser;\n}\n\nexport async function destroySession(c: Context) {\n const token = getCookie(c, SESSION_COOKIE);\n if (token) {\n await sqlite.execute({ sql: \"DELETE FROM sessions WHERE token = ?\", args: [token] });\n }\n clearSessionCookie(c);\n}\n",[169],"944e8a27-f220-4d0e-9d5b-f515fbb9ab5b","README.md","01a0390a-88ed-72fa-80c5-6ae828b904a1",["D",1787663386761],"# hono-jsx-starter\n\nA minimal [Hono](https://hono.dev) + Hono JSX starter for Val Town.\nServer-rendered HTML, no build step, no React.\n\n## Picking a starter\n\n| Starter | When to pick it |\n| --- | --- |\n| [`basic-html-starter`](https://www.val.town/x/templates/basic-html-starter) | Static HTML pages. Sprinkle of vanilla JS. No server-side rendering. |\n| **[`hono-jsx-starter`](https://www.val.town/x/templates/hono-jsx-starter)** *(you're here)* | Dynamic server-rendered HTML with JSX. API routes. No React, no SPA. |\n| [`react-hono-starter`](https://www.val.town/x/templates/react-hono-starter) | Client-side React SPA with a Hono API backend. |\n\n## What's here\n\n```\nindex.tsx Hono app, Layout, routes\npublic/\n favicon.svg Static asset\n counter.ts Tiny client-side script\n```\n\nThe whole app fits in one file. As you grow it, the natural next moves are:\n\n- Pull `Layout` into its own `.tsx` file once you have 3+ pages.\n- Split routes with `app.route(\"/api\", api)` if `/api/*` grows.\n- Add more files under `public/` — they're served by a single\n `app.get(\"/public/*\", ...)` route.\n\n## Patterns worth knowing\n\n**JSX pragma.** Every `.tsx` file that uses JSX needs this at the top:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\n```\n\n**Server state.** The counter on `/` is `let count = 0` at module scope. It\nlives in memory on the Val Town server and survives across requests — but resets\nwhenever the val restarts (deploys, idle timeouts, etc.). For persistent state,\nswap it for [`std/sqlite`](https://www.val.town/x/std/sqlite) or\n[`std/blob`](https://www.val.town/x/std/blob).\n\n**API routes.** The `Increment` button POSTs to `/api/increment`, which returns\nJSON. Mix server-rendered pages and JSON endpoints in the same Hono app:\n\n```ts\napp.post(\"/api/increment\", (c) => c.json({ count: ++count }));\n```\n\n**Static files.** `serveFile` reads the file by path and serves it with the\nright content-type. `.ts` files are transpiled to JS on request by Val Town — so\nyou can write `public/counter.ts` and reference it as\n`

Change password

Change password

Find your stay

Welcome, {b.guest_name}

Arrival guidance

Need help?

Hi {user.name.split(\" \")[0]}

My checklist

Notifications

Report an issue or supply need

Owner dashboard

Channel-fee ledger

Add booking

Staff KPI overview

Sales lead tracker — partner websites

Units under management

Change password

Change password

Find your stay

Welcome, {b.guest_name}

Arrival guidance

Need help?

Hi {user.name.split(\" \")[0]}

My checklist

Notifications

Report an issue or supply need

Owner dashboard

Channel-fee ledger

Add booking

Staff KPI overview

Sales lead tracker — partner websites

Units under management

Diff · v8