Travel in Promise Luxury

Premium bus travel redefined — comfort, reliability, and elegance on every journey.

\n From\n \n

\n To\n \n

\n Date\n \n

\n \n

\n\n \n

Our Luxury Fleet

Travel in comfort with Promise Luxury — branded coaches across Kenya

\n $\"Promise$ \n

\n PromiseLuxury Express\n

56-seater · AC · Entertainment

\n $\"Promise$ \n

\n VIP Sleeper\n

Reclining leather · Blankets · Snacks

\n $\"Promise$ \n

\n PromiseLuxury Coach\n

Onboard WiFi · USB charging · Wi-Fi

\n\n

Popular Routes

Handpicked journeys with our signature luxury service

\n Express\n

Nairobi → Mombasa

KSh 1,500≈ 6 hrs

\n VIP Sleeper\n

Nairobi → Kisumu

KSh 1,200≈ 5 hrs

\n Express\n

Nairobi → Nakuru

KSh 600≈ 2.5 hrs

\n VIP Sleeper\n

Mombasa → Nairobi

KSh 1,500≈ 6 hrs

\n Express\n

Nairobi → Eldoret

KSh 1,000≈ 4 hrs

\n Express\n

Kisumu → Nairobi

KSh 1,200≈ 5 hrs

\n\n

Why Promise Luxury?

Every detail crafted for a premium travel experience

🚌

Luxury Fleet

Reclining leather seats, AC, onboard entertainment on every bus.

🔒

Secure Booking

Pay with card or M-Pesa. Your seat is guaranteed instantly.

⚡

Instant Tickets

Get your QR-coded PDF ticket immediately after payment.

⭐

Member Rewards

Faster checkout, saved details, and exclusive member perks.

\n\n

Ready to Travel in Luxury?

Join thousands of travelers who choose Promise Luxury every day.

\n \n

\n\n \n\n\n","label",[18],"pulls","branches","forks","envVars",{"_174":176,"_177":176},"connections",{"_174":26,"_175":26},"count","unfilledCount",3,"emptyCount",{"_32":246,"_13":247,"_65":248,"_42":-5,"_34":35,"_160":249,"_161":84,"_36":250,"_38":39,"_67":21,"_163":251,"_68":24,"_165":-5,"_193":252,"_17":253},{"_32":238,"_13":239,"_65":240,"_42":-5,"_34":35,"_160":110,"_161":84,"_36":241,"_38":242,"_67":21,"_163":243,"_68":24,"_165":-5,"_193":244,"_17":245},{"_32":231,"_13":232,"_65":233,"_42":-5,"_34":35,"_160":39,"_161":84,"_36":234,"_38":26,"_67":220,"_163":235,"_68":24,"_165":-5,"_193":236,"_17":237},{"_32":224,"_13":225,"_65":226,"_42":-5,"_34":35,"_160":39,"_161":84,"_36":227,"_38":26,"_67":21,"_163":228,"_68":24,"_165":-5,"_193":229,"_17":230},{"_32":214,"_13":215,"_65":216,"_42":-5,"_34":35,"_160":217,"_161":84,"_36":218,"_38":219,"_67":220,"_163":221,"_68":24,"_165":-5,"_193":222,"_17":223},{"_32":159,"_13":18,"_65":66,"_42":-5,"_34":35,"_160":39,"_161":84,"_36":211,"_38":26,"_67":21,"_163":164,"_68":24,"_165":-5,"_193":212,"_17":213},{"_32":204,"_13":205,"_65":206,"_42":-5,"_34":35,"_160":39,"_161":84,"_36":207,"_38":26,"_67":21,"_163":208,"_68":24,"_165":-5,"_193":209,"_17":210},{"_32":196,"_13":197,"_65":82,"_42":-5,"_34":35,"_160":198,"_161":84,"_36":199,"_38":176,"_67":200,"_163":201,"_68":24,"_165":-5,"_193":202,"_17":203},{"_32":187,"_13":188,"_65":189,"_42":-5,"_34":35,"_160":190,"_161":84,"_36":191,"_38":39,"_67":21,"_163":192,"_68":24,"_165":-5,"_193":194,"_17":195},"2aa79ccc-9c80-4853-ae5e-8f44cdd7aabf","styles.css","019f287e-d617-7416-9a40-ae567afa2f12",5,["D",1783090860439],":root {\n --green: #0A8F3C;\n --green-dark: #076d2e;\n --blue: #1A56DB;\n --red: #DC2626;\n --gold: #D4AF37;\n --dark: #1F2937;\n --white: #FFFFFF;\n --gray-50: #F9FAFB;\n --gray-100: #F3F4F6;\n --gray-200: #E5E7EB;\n --gray-400: #9CA3AF;\n}\n* { margin: 0; padding: 0; box-sizing: border-box; }\nbody { font-family: 'Inter', sans-serif; color: var(--dark); background: var(--gray-50); }\n\n/* Nav */\nnav {\n background: var(--green); padding: 0.85rem 2rem;\n display: flex; align-items: center; justify-content: space-between;\n position: sticky; top: 0; z-index: 100;\n box-shadow: 0 2px 12px rgba(0,0,0,.12);\n}\n.logo { font-family: 'Playfair Display', serif; font-size: 1.6rem; font-weight: 900; color: var(--white); letter-spacing: .5px; text-decoration: none; }\n.logo span { color: var(--gold); }\n.logo::after { content: ''; display: block; height: 2px; width: 60%; margin: 2px auto 0; background: var(--gold); border-radius: 2px; }\n.nav-links { display: flex; gap: 1.75rem; align-items: center; }\n.nav-links a { color: rgba(255,255,255,.9); text-decoration: none; font-weight: 500; font-size: .92rem; transition: color .2s; cursor: pointer; }\n.nav-links a:hover { color: var(--gold); }\n.nav-links .btn { background: var(--blue); color: var(--white); padding: .5rem 1.25rem; border-radius: 8px; font-weight: 600; }\n.nav-links .btn-red { background: var(--red); }\n.nav-links .btn:hover { opacity: .9; color: var(--white); }\n\n/* Cards */\n.card {\n background: var(--white); border-radius: 16px; padding: 2rem;\n max-width: 520px; margin: 3rem auto; box-shadow: 0 12px 40px rgba(0,0,0,.1);\n}\n.card.wide { max-width: 900px; }\n\n/* Forms */\n.form-group { margin-bottom: 1.25rem; }\n.form-group label { display: block; font-size: .8rem; font-weight: 600; color: var(--gray-400); margin-bottom: .35rem; text-transform: uppercase; letter-spacing: .5px; }\n.form-group input, .form-group select, .form-group textarea {\n width: 100%; padding: .75rem 1rem; border: 2px solid var(--gray-200);\n border-radius: 10px; font-size: 1rem; font-family: 'Inter', sans-serif; transition: border-color .2s;\n}\n.form-group input:focus, .form-group select:focus, .form-group textarea:focus { outline: none; border-color: var(--green); }\n.btn {\n background: var(--red); color: var(--white); border: none; padding: .8rem 2rem;\n border-radius: 10px; font-size: 1rem; font-weight: 700; cursor: pointer;\n font-family: 'Inter', sans-serif; transition: background .2s; width: 100%;\n}\n.btn:hover { background: #b91c1c; }\n.btn-green { background: var(--green); }\n.btn-green:hover { background: var(--green-dark); }\n.btn-blue { background: var(--blue); }\n.btn-blue:hover { background: #1742b0; }\n.btn-sm { padding: .4rem 1rem; font-size: .85rem; width: auto; }\n\n/* Tabs */\n.tabs { display: flex; gap: 0; margin-bottom: 1.5rem; border-bottom: 2px solid var(--gray-200); }\n.tab { padding: .75rem 1.5rem; font-weight: 600; cursor: pointer; color: var(--gray-400); border-bottom: 3px solid transparent; margin-bottom: -2px; transition: all .2s; }\n.tab.active { color: var(--green); border-color: var(--green); }\n.tab:hover { color: var(--green); }\n\n/* Tables */\ntable { width: 100%; border-collapse: collapse; margin-top: 1rem; }\nth { text-align: left; padding: .75rem 1rem; background: var(--gray-100); font-size: .8rem; font-weight: 600; color: var(--gray-400); text-transform: uppercase; letter-spacing: .5px; }\ntd { padding: .75rem 1rem; border-bottom: 1px solid var(--gray-200); font-size: .9rem; }\ntr:hover { background: var(--gray-50); }\n\n/* Badge */\n.badge { display: inline-block; background: rgba(10,143,60,.1); color: var(--green); font-size: .75rem; font-weight: 600; padding: .2rem .6rem; border-radius: 20px; }\n.badge-blue { background: rgba(26,86,219,.1); color: var(--blue); }\n.badge-red { background: rgba(220,38,38,.1); color: var(--red); }\n\n/* Alert */\n.alert { padding: .75rem 1rem; border-radius: 10px; margin-bottom: 1rem; font-size: .9rem; font-weight: 500; }\n.alert-error { background: rgba(220,38,38,.1); color: var(--red); }\n.alert-success { background: rgba(10,143,60,.1); color: var(--green); }\n.alert-info { background: rgba(26,86,219,.1); color: var(--blue); }\n\n/* Section */\n.section { max-width: 1080px; margin: 0 auto; padding: 2rem; }\n.section-title { font-size: 1.5rem; font-weight: 700; margin-bottom: 1rem; }\n.section-title::after { content: ''; display: block; width: 50px; height: 3px; background: var(--green); margin: .5rem 0 0; border-radius: 2px; }\n\n/* Stats */\n.stats { display: grid; grid-template-columns: repeat(3, 1fr); gap: 1.5rem; margin-bottom: 2rem; }\n.stat-card { background: var(--white); border-radius: 14px; padding: 1.5rem; box-shadow: 0 4px 16px rgba(0,0,0,.06); }\n.stat-card .num { font-size: 2rem; font-weight: 800; color: var(--green); }\n.stat-card .label { font-size: .85rem; color: var(--gray-400); margin-top: .25rem; }\n\n/* Grid */\n.grid-2 { display: grid; grid-template-columns: 1fr 1fr; gap: 2rem; }\n.hidden { display: none; }\n\n@media (max-width: 768px) {\n .grid-2 { grid-template-columns: 1fr; }\n .stats { grid-template-columns: 1fr; }\n .nav-links { gap: 1rem; }\n}\n\n\n/* ============ ADMIN LAYOUT ============ */\n.admin-wrapper { display: flex; min-height: 100vh; }\n.admin-sidebar {\n width: 240px; background: var(--dark); color: #fff; display: flex; flex-direction: column;\n position: fixed; top: 0; left: 0; bottom: 0; z-index: 200; transition: transform .3s;\n}\n.admin-sidebar .brand {\n font-family: 'Playfair Display', serif; font-size: 1.4rem; font-weight: 900;\n padding: 1.5rem 1.5rem 1rem; color: #fff; text-decoration: none;\n}\n.admin-sidebar .brand span { color: var(--gold); }\n.admin-sidebar .nav-item {\n display: flex; align-items: center; gap: .75rem; padding: .85rem 1.5rem;\n color: rgba(255,255,255,.65); cursor: pointer; transition: all .2s;\n font-size: .9rem; font-weight: 500; border-left: 3px solid transparent;\n}\n.admin-sidebar .nav-item:hover { color: #fff; background: rgba(255,255,255,.05); }\n.admin-sidebar .nav-item.active { color: #fff; background: rgba(10,143,60,.15); border-color: var(--green); }\n.admin-sidebar .nav-item .icon { font-size: 1.1rem; width: 24px; text-align: center; }\n.admin-sidebar .nav-spacer { flex: 1; }\n.admin-sidebar .nav-item.logout { color: rgba(220,38,38,.7); border-top: 1px solid rgba(255,255,255,.1); }\n.admin-sidebar .nav-item.logout:hover { color: #fff; background: rgba(220,38,38,.15); }\n\n.admin-main { flex: 1; margin-left: 240px; padding: 2rem; min-width: 0; }\n.admin-header { display: flex; justify-content: space-between; align-items: center; margin-bottom: 2rem; }\n.admin-header h1 { font-size: 1.6rem; font-weight: 700; font-family: 'Playfair Display', serif; }\n.admin-header .sub { font-size: .85rem; color: var(--gray-400); margin-top: .25rem; }\n\n/* KPI Cards */\n.kpi-grid { display: grid; grid-template-columns: repeat(4, 1fr); gap: 1.5rem; margin-bottom: 2rem; }\n.kpi-card { background: var(--white); border-radius: 14px; padding: 1.5rem; box-shadow: 0 4px 16px rgba(0,0,0,.06); position: relative; overflow: hidden; }\n.kpi-card .kpi-icon { position: absolute; top: 1rem; right: 1rem; font-size: 2rem; opacity: .15; }\n.kpi-card .kpi-num { font-size: 1.8rem; font-weight: 800; }\n.kpi-card .kpi-label { font-size: .8rem; color: var(--gray-400); margin-top: .25rem; text-transform: uppercase; letter-spacing: .5px; }\n.kpi-card.green .kpi-num { color: var(--green); }\n.kpi-card.blue .kpi-num { color: var(--blue); }\n.kpi-card.red .kpi-num { color: var(--red); }\n.kpi-card.gold .kpi-num { color: var(--gold); }\n\n/* Admin panels */\n.admin-panel { background: var(--white); border-radius: 14px; padding: 1.5rem; box-shadow: 0 4px 16px rgba(0,0,0,.06); margin-bottom: 2rem; }\n.admin-panel h3 { font-size: 1.1rem; font-weight: 700; margin-bottom: 1rem; }\n.admin-toolbar { display: flex; gap: 1rem; align-items: center; margin-bottom: 1rem; flex-wrap: wrap; }\n.admin-toolbar input[type=\"text\"], .admin-toolbar select {\n padding: .5rem .75rem; border: 2px solid var(--gray-200); border-radius: 8px;\n font-size: .9rem; font-family: 'Inter', sans-serif;\n}\n.admin-toolbar input:focus, .admin-toolbar select:focus { outline: none; border-color: var(--green); }\n.admin-table { width: 100%; border-collapse: collapse; }\n.admin-table th { text-align: left; padding: .6rem .75rem; background: var(--gray-100); font-size: .75rem; font-weight: 600; color: var(--gray-400); text-transform: uppercase; letter-spacing: .5px; white-space: nowrap; }\n.admin-table td { padding: .6rem .75rem; border-bottom: 1px solid var(--gray-200); font-size: .85rem; white-space: nowrap; }\n.admin-table tr:hover { background: var(--gray-50); }\n.admin-table-wrap { overflow-x: auto; }\n\n/* Action buttons in tables */\n.act-btn { border: none; border-radius: 6px; padding: .3rem .6rem; font-size: .78rem; font-weight: 600; cursor: pointer; margin-right: .25rem; }\n.act-btn.approve { background: rgba(10,143,60,.12); color: var(--green); }\n.act-btn.approve:hover { background: var(--green); color: #fff; }\n.act-btn.cancel { background: rgba(220,38,38,.1); color: var(--red); }\n.act-btn.cancel:hover { background: var(--red); color: #fff; }\n.act-btn.edit { background: rgba(26,86,219,.1); color: var(--blue); }\n.act-btn.edit:hover { background: var(--blue); color: #fff; }\n.act-btn.delete { background: rgba(220,38,38,.1); color: var(--red); }\n.act-btn.delete:hover { background: var(--red); color: #fff; }\n\n/* Modal */\n.modal-overlay { position: fixed; inset: 0; background: rgba(0,0,0,.5); z-index: 300; display: flex; align-items: center; justify-content: center; }\n.modal { background: var(--white); border-radius: 16px; padding: 2rem; width: 90%; max-width: 480px; box-shadow: 0 20px 60px rgba(0,0,0,.2); }\n.modal h3 { font-size: 1.2rem; font-weight: 700; margin-bottom: 1.5rem; }\n.modal .modal-actions { display: flex; gap: .75rem; margin-top: 1.5rem; }\n.modal .modal-actions .btn { width: auto; flex: 1; }\n\n/* Sidebar toggle (mobile) */\n.sidebar-toggle { display: none; background: var(--dark); color: #fff; border: none; padding: .5rem .75rem; border-radius: 8px; cursor: pointer; font-size: 1.2rem; }\n\n@media (max-width: 900px) {\n .kpi-grid { grid-template-columns: repeat(2, 1fr); }\n .admin-sidebar { transform: translateX(-100%); }\n .admin-sidebar.open { transform: translateX(0); }\n .admin-main { margin-left: 0; }\n .sidebar-toggle { display: block; }\n}\n","children",[],[188],"a5ef19c8-68ec-4419-93b7-026e7156091a","serve.ts",8,["D",1783091141479],"http","import { Hono } from \"npm:hono\";\nimport { staticHTTPServer } from \"https://esm.town/v/std/utils/index.ts\";\nimport {\n initDB,\n hashPassword,\n createSession,\n getSession,\n deleteSession,\n getCustomerByEmail,\n createCustomer,\n getAllCustomers,\n getAdminByEmail,\n getAllRoutes,\n getRouteById,\n createRoute,\n updateRoute,\n deleteRoute,\n createBooking,\n updateBookingPayment,\n updateBookingStatus,\n cancelBooking,\n deleteCustomer,\n getDashboardStats,\n getBookedSeats,\n getBookingById,\n getBookingsByCustomer,\n getAllBookings,\n getAllSettings,\n setSettings,\n getSetting,\n} from \"./db.ts\";\nimport {\n getTokenFromRequest,\n getAuthContext,\n requireAuth,\n} from \"./auth.ts\";\n\nawait initDB();\n\nconst app = new Hono();\napp.onError((err) => Promise.reject(err));\n\nfunction setSessionCookie(res: Response, token: string): Response {\n res.headers.set(\"Set-Cookie\", `session=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=604800`);\n return res;\n}\n\n// ============ CUSTOMER AUTH ============\napp.post(\"/api/auth/register\", async (c) => {\n const { name, email, password, phone } = await c.req.json();\n if (!name || !email || !password) return c.json({ error: \"Name, email, and password are required\" }, 400);\n if (await getCustomerByEmail(email)) return c.json({ error: \"Email already registered\" }, 409);\n const hash = await hashPassword(password);\n const user = await createCustomer(name, email, hash, phone || \"\");\n const token = await createSession(\"customer\", (user as any).id);\n return setSessionCookie(c.json({ user }), token);\n});\n\napp.post(\"/api/auth/login\", async (c) => {\n const { email, password } = await c.req.json();\n if (!email || !password) return c.json({ error: \"Email and password required\" }, 400);\n const customer = await getCustomerByEmail(email) as any;\n if (!customer || customer.password !== await hashPassword(password)) {\n return c.json({ error: \"Invalid email or password\" }, 401);\n }\n const token = await createSession(\"customer\", customer.id);\n const { password: _, ...user } = customer;\n return setSessionCookie(c.json({ user }), token);\n});\n\napp.post(\"/api/auth/logout\", async (c) => {\n const token = getTokenFromRequest(c.req.raw);\n if (token) await deleteSession(token);\n return c.json({ ok: true }, 200, { \"Set-Cookie\": \"session=; Path=/; HttpOnly; Max-Age=0\" });\n});\n\napp.get(\"/api/auth/me\", async (c) => {\n const ctx = await getAuthContext(c.req.raw);\n if (!ctx) return c.json({ user: null });\n return c.json({ user: ctx.user, type: ctx.type });\n});\n\n// ============ ADMIN AUTH ============\napp.post(\"/api/admin/login\", async (c) => {\n const { email, password } = await c.req.json();\n if (!email || !password) return c.json({ error: \"Email and password required\" }, 400);\n const admin = await getAdminByEmail(email) as any;\n if (!admin || admin.password !== await hashPassword(password)) {\n return c.json({ error: \"Invalid admin credentials\" }, 401);\n }\n const token = await createSession(\"admin\", admin.id);\n const { password: _, ...user } = admin;\n return setSessionCookie(c.json({ user }), token);\n});\n\napp.post(\"/api/admin/logout\", async (c) => {\n const token = getTokenFromRequest(c.req.raw);\n if (token) await deleteSession(token);\n return c.json({ ok: true }, 200, { \"Set-Cookie\": \"session=; Path=/; HttpOnly; Max-Age=0\" });\n});\n\n// ============ ADMIN SETTINGS ============\napp.get(\"/api/admin/settings\", async (c) => {\n const admin = await requireAuth(c.req.raw, \"admin\");\n if (!admin) return c.json({ error: \"Admin access required\" }, 403);\n return c.json({ settings: await getAllSettings() });\n});\n\napp.put(\"/api/admin/settings\", async (c) => {\n const admin = await requireAuth(c.req.raw, \"admin\");\n if (!admin) return c.json({ error: \"Admin access required\" }, 403);\n const body = await c.req.json();\n await setSettings(body);\n return c.json({ ok: true });\n});\n\n// ============ ROUTES (public) ============\napp.get(\"/api/routes\", async (c) => c.json({ routes: await getAllRoutes() }));\n\n// ============ SEAT AVAILABILITY ============\napp.get(\"/api/seats\", async (c) => {\n const routeId = Number(c.req.query(\"routeId\"));\n const date = c.req.query(\"date\");\n if (!routeId || !date) return c.json({ error: \"routeId and date required\" }, 400);\n const booked = await getBookedSeats(routeId, date);\n return c.json({ bookedSeats: booked });\n});\n\n// ============ BOOKINGS ============\napp.post(\"/api/bookings\", async (c) => {\n const user = await requireAuth(c.req.raw, \"customer\");\n if (!user) return c.json({ error: \"Please log in\" }, 401);\n const { routeId, travelDate, seatNumber, passengerName, passengerPhone, paymentMethod } = await c.req.json();\n if (!routeId || !travelDate || !seatNumber) return c.json({ error: \"Route, date, and seat are required\" }, 400);\n\n // Check seat not already booked\n const booked = await getBookedSeats(Number(routeId), travelDate);\n if (booked.includes(seatNumber)) return c.json({ error: \"This seat is already booked\" }, 409);\n\n const booking = await createBooking(\n (user as any).id, Number(routeId), travelDate, seatNumber,\n passengerName || (user as any).name,\n passengerPhone || (user as any).phone || \"\",\n paymentMethod || \"pending\",\n );\n return c.json({ booking });\n});\n\napp.get(\"/api/bookings\", async (c) => {\n const user = await requireAuth(c.req.raw, \"customer\");\n if (!user) return c.json({ error: \"Please log in\" }, 401);\n return c.json({ bookings: await getBookingsByCustomer((user as any).id) });\n});\n\n// ============ M-PESA STK PUSH ============\napp.post(\"/api/payment/mpesa\", async (c) => {\n const user = await requireAuth(c.req.raw, \"customer\");\n if (!user) return c.json({ error: \"Please log in\" }, 401);\n const { bookingId, phone } = await c.req.json();\n if (!bookingId || !phone) return c.json({ error: \"Booking ID and phone number required\" }, 400);\n\n const booking = await getBookingById(Number(bookingId)) as any;\n if (!booking) return c.json({ error: \"Booking not found\" }, 404);\n\n const amount = Math.ceil(booking.price);\n const adminPhone = await getSetting(\"mpesa_phone\");\n const mpesaTill = await getSetting(\"mpesa_till\");\n\n // Check if M-Pesa Daraja credentials are configured (settings first, then env vars)\n const consumerKey = (await getSetting(\"mpesa_consumer_key\")) || Deno.env.get(\"MPESA_CONSUMER_KEY\");\n const consumerSecret = (await getSetting(\"mpesa_consumer_secret\")) || Deno.env.get(\"MPESA_CONSUMER_SECRET\");\n const shortcode = (await getSetting(\"mpesa_shortcode\")) || Deno.env.get(\"MPESA_SHORTCODE\") || mpesaTill;\n const passkey = (await getSetting(\"mpesa_passkey\")) || Deno.env.get(\"MPESA_PASSKEY\");\n\n if (!consumerKey || !consumerSecret || !shortcode || !passkey) {\n // Demo mode — simulate STK push\n await updateBookingPayment(Number(bookingId), \"paid (demo)\", phone);\n return c.json({\n success: true,\n demo: true,\n message: \"STK push sent (demo mode). In production, configure M-Pesa Daraja API credentials.\",\n customerMessage: `STK push sent to ${phone}. Enter your M-Pesa PIN to complete payment of KSh ${amount}. (Demo: payment auto-confirmed)`,\n });\n }\n\n try {\n // 1. Get OAuth token\n const auth = btoa(`${consumerKey}:${consumerSecret}`);\n const tokenRes = await fetch(\"https://sandbox.safaricom.co.ke/oauth/v1/generate?grant_type=client_credentials\", {\n headers: { Authorization: `Basic ${auth}` },\n });\n const tokenData = await tokenRes.json();\n\n // 2. Send STK Push\n const timestamp = new Date().toISOString().replace(/[^0-9]/g, \"\").slice(0, 14);\n const password = btoa(`${shortcode}${passkey}${timestamp}`);\n const callbackUrl = `${new URL(c.req.url).origin}/api/payment/mpesa/callback`;\n const formattedPhone = phone.startsWith(\"0\") ? \"254\" + phone.slice(1) : phone.startsWith(\"254\") ? phone : \"254\" + phone;\n\n const stkRes = await fetch(\"https://sandbox.safaricom.co.ke/mpesa/stkpush/v1/processrequest\", {\n method: \"POST\",\n headers: { Authorization: `Bearer ${tokenData.access_token}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n BusinessShortCode: shortcode,\n Password: password,\n Timestamp: timestamp,\n TransactionType: \"CustomerBuyGoodsOnline\",\n Amount: amount,\n PartyA: formattedPhone,\n PartyB: shortcode,\n PhoneNumber: formattedPhone,\n CallBackURL: callbackUrl,\n AccountReference: `PL-BOOKING-${bookingId}`,\n TransactionDesc: `Promise Luxury booking #${bookingId}`,\n }),\n });\n const stkData = await stkRes.json();\n\n if (stkData.ResponseCode === \"0\") {\n await updateBookingPayment(Number(bookingId), \"stk_sent\", phone);\n return c.json({\n success: true,\n message: `STK push sent to ${phone}. Check your phone and enter M-Pesa PIN to pay KSh ${amount}.`,\n checkoutRequestId: stkData.CheckoutRequestID,\n });\n } else {\n return c.json({ success: false, error: stkData.errorMessage || \"STK push failed\" }, 400);\n }\n } catch (err) {\n return c.json({ success: false, error: \"M-Pesa request failed: \" + (err as Error).message }, 500);\n }\n});\n\n// M-Pesa callback (Safaricom calls this after customer completes payment)\napp.post(\"/api/payment/mpesa/callback\", async (c) => {\n try {\n const body = await c.req.json();\n const result = body?.Body?.stkCallback;\n if (result?.ResultCode === 0) {\n // Payment successful — extract booking ID from AccountReference\n const ref = result.CallbackMetadata?.Item?.find((i: any) => i.Name === \"AccountReference\")?.Value || \"\";\n const match = ref.match(/BOOKING-(\\d+)/);\n if (match) {\n await updateBookingPayment(Number(match[1]), \"paid\");\n }\n }\n } catch (_) { /* ignore parse errors */ }\n return c.json({ ok: true });\n});\n\n// ============ CARD PAYMENT (returns admin bank details) ============\napp.get(\"/api/payment/card\", async (c) => {\n const user = await requireAuth(c.req.raw, \"customer\");\n if (!user) return c.json({ error: \"Please log in\" }, 401);\n const settings = await getAllSettings();\n return c.json({\n bank: {\n bank_name: settings.bank_name || \"Not configured\",\n account_name: settings.bank_account_name || \"Not configured\",\n account_number: settings.bank_account_number || \"Not configured\",\n branch: settings.bank_branch || \"Not configured\",\n swift_code: settings.bank_swift || \"Not configured\",\n },\n });\n});\n\n// Confirm card payment (customer says they've transferred)\napp.post(\"/api/payment/card/confirm\", async (c) => {\n const user = await requireAuth(c.req.raw, \"customer\");\n if (!user) return c.json({ error: \"Please log in\" }, 401);\n const { bookingId } = await c.req.json();\n if (!bookingId) return c.json({ error: \"Booking ID required\" }, 400);\n await updateBookingPayment(Number(bookingId), \"awaiting_verification\");\n return c.json({ success: true, message: \"Payment submitted for verification. You'll be notified once confirmed.\" });\n});\n\n// ============ ADMIN ROUTES ============\napp.get(\"/api/admin/dashboard\", async (c) => {\n const admin = await requireAuth(c.req.raw, \"admin\");\n if (!admin) return c.json({ error: \"Admin access required\" }, 403);\n const [bookings, customers, settings] = await Promise.all([getAllBookings(), getAllCustomers(), getAllSettings()]);\n return c.json({ bookings, customers, settings });\n});\n\napp.post(\"/api/admin/routes\", async (c) => {\n const admin = await requireAuth(c.req.raw, \"admin\");\n if (!admin) return c.json({ error: \"Admin access required\" }, 403);\n const { from_city, to_city, price, duration, bus_type } = await c.req.json();\n if (!from_city || !to_city || !price || !duration || !bus_type) return c.json({ error: \"All fields required\" }, 400);\n await createRoute(from_city, to_city, Number(price), duration, bus_type);\n return c.json({ ok: true });\n});\n\napp.put(\"/api/admin/routes/:id\", async (c) => {\n const admin = await requireAuth(c.req.raw, \"admin\");\n if (!admin) return c.json({ error: \"Admin access required\" }, 403);\n const { from_city, to_city, price, duration, bus_type } = await c.req.json();\n await updateRoute(Number(c.req.param(\"id\")), from_city, to_city, Number(price), duration, bus_type);\n return c.json({ ok: true });\n});\n\napp.delete(\"/api/admin/routes/:id\", async (c) => {\n const admin = await requireAuth(c.req.raw, \"admin\");\n if (!admin) return c.json({ error: \"Admin access required\" }, 403);\n await deleteRoute(Number(c.req.param(\"id\")));\n return c.json({ ok: true });\n});\n\n// ============ ADMIN BOOKINGS MANAGEMENT ============\napp.patch(\"/api/admin/bookings/:id/status\", async (c) => {\n const admin = await requireAuth(c.req.raw, \"admin\");\n if (!admin) return c.json({ error: \"Admin access required\" }, 403);\n const { paymentStatus } = await c.req.json();\n const valid = [\"paid\", \"pending\", \"awaiting_verification\", \"stk_sent\", \"cancelled\", \"paid (demo)\"];\n if (!valid.includes(paymentStatus)) return c.json({ error: \"Invalid status\" }, 400);\n await updateBookingStatus(Number(c.req.param(\"id\")), paymentStatus);\n return c.json({ ok: true });\n});\n\napp.delete(\"/api/admin/bookings/:id\", async (c) => {\n const admin = await requireAuth(c.req.raw, \"admin\");\n if (!admin) return c.json({ error: \"Admin access required\" }, 403);\n await cancelBooking(Number(c.req.param(\"id\")));\n return c.json({ ok: true });\n});\n\n// ============ ADMIN CUSTOMERS MANAGEMENT ============\napp.delete(\"/api/admin/customers/:id\", async (c) => {\n const admin = await requireAuth(c.req.raw, \"admin\");\n if (!admin) return c.json({ error: \"Admin access required\" }, 403);\n await deleteCustomer(Number(c.req.param(\"id\")));\n return c.json({ ok: true });\n});\n\n// ============ ADMIN STATS ============\napp.get(\"/api/admin/stats\", async (c) => {\n const admin = await requireAuth(c.req.raw, \"admin\");\n if (!admin) return c.json({ error: \"Admin access required\" }, 403);\n return c.json({ stats: await getDashboardStats() });\n});\n\n// Wrap Hono so 404s fall through to static server\nasync function handler(req: Request): Promise {\n const res = await app.fetch(req);\n if (res.status === 404) return null;\n return res;\n}\n\nexport default staticHTTPServer(import.meta.url, handler);\n",[],[197],"bdb81db8-50cf-4558-97f9-a115f85018bb","login.html","019f287e-d617-7416-9a40-a77497c6a62e",["D",1783090828722],"\n\n\n \n \n Login — Promise Luxury\n \n \n \n \n \n\n\n \n\n

\n \n

\n\n

\n\n \n \n\n \n \n

\n\n \n\n\n",[],[205],["D",1783090828722],[],[18],"095aca39-1f34-48f8-a55b-01a70aaf552b","db.ts","019f287e-d617-7416-9a40-9d7cd48c9aef",9,["D",1783091141492],2,"script","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport async function initDB() {\n await sqlite.batch([\n { sql: `CREATE TABLE IF NOT EXISTS customers (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT NOT NULL,\n email TEXT UNIQUE NOT NULL,\n password TEXT NOT NULL,\n phone TEXT,\n created_at TEXT DEFAULT (datetime('now'))\n )` },\n { sql: `CREATE TABLE IF NOT EXISTS admins (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT NOT NULL,\n email TEXT UNIQUE NOT NULL,\n password TEXT NOT NULL,\n created_at TEXT DEFAULT (datetime('now'))\n )` },\n { sql: `CREATE TABLE IF NOT EXISTS routes (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n from_city TEXT NOT NULL,\n to_city TEXT NOT NULL,\n price REAL NOT NULL,\n duration TEXT NOT NULL,\n bus_type TEXT NOT NULL,\n created_at TEXT DEFAULT (datetime('now'))\n )` },\n { sql: `CREATE TABLE IF NOT EXISTS bookings (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n customer_id INTEGER NOT NULL,\n route_id INTEGER NOT NULL,\n travel_date TEXT NOT NULL,\n seat_number TEXT NOT NULL,\n passenger_name TEXT NOT NULL,\n passenger_phone TEXT NOT NULL,\n status TEXT DEFAULT 'confirmed',\n payment_method TEXT DEFAULT 'pending',\n payment_status TEXT DEFAULT 'pending',\n payment_phone TEXT,\n created_at TEXT DEFAULT (datetime('now')),\n FOREIGN KEY (customer_id) REFERENCES customers(id),\n FOREIGN KEY (route_id) REFERENCES routes(id)\n )` },\n { sql: `CREATE TABLE IF NOT EXISTS sessions (\n token TEXT PRIMARY KEY,\n user_type TEXT NOT NULL,\n user_id INTEGER NOT NULL,\n expires_at TEXT NOT NULL\n )` },\n { sql: `CREATE TABLE IF NOT EXISTS settings (\n key TEXT PRIMARY KEY,\n value TEXT\n )` },\n ]);\n\n // Migrate: add payment columns if they don't exist\n const cols = [\"payment_method\", \"payment_status\", \"payment_phone\"];\n for (const col of cols) {\n try {\n await sqlite.execute(`ALTER TABLE bookings ADD COLUMN ${col} TEXT`);\n } catch (_) { /* column already exists */ }\n }\n\n // Seed admin\n const admin = await sqlite.execute({\n sql: \"SELECT id FROM admins WHERE email = ?\",\n args: [\"admin@promise.co.ke\"],\n });\n if (admin.rows.length === 0) {\n const hash = await hashPassword(\"admin123\");\n await sqlite.execute({\n sql: \"INSERT INTO admins (name, email, password) VALUES (?, ?, ?)\",\n args: [\"Admin\", \"admin@promise.co.ke\", hash],\n });\n }\n\n // Seed routes\n const routes = await sqlite.execute(\"SELECT COUNT(*) as count FROM routes\");\n if ((routes.rows[0] as any).count === 0) {\n await sqlite.batch([\n { sql: \"INSERT INTO routes (from_city, to_city, price, duration, bus_type) VALUES ('Nairobi', 'Mombasa', 1500, '6 hrs', 'Express')\" },\n { sql: \"INSERT INTO routes (from_city, to_city, price, duration, bus_type) VALUES ('Nairobi', 'Kisumu', 1200, '5 hrs', 'VIP Sleeper')\" },\n { sql: \"INSERT INTO routes (from_city, to_city, price, duration, bus_type) VALUES ('Nairobi', 'Nakuru', 600, '2.5 hrs', 'Express')\" },\n { sql: \"INSERT INTO routes (from_city, to_city, price, duration, bus_type) VALUES ('Mombasa', 'Nairobi', 1500, '6 hrs', 'VIP Sleeper')\" },\n { sql: \"INSERT INTO routes (from_city, to_city, price, duration, bus_type) VALUES ('Nairobi', 'Eldoret', 1000, '4 hrs', 'Express')\" },\n { sql: \"INSERT INTO routes (from_city, to_city, price, duration, bus_type) VALUES ('Kisumu', 'Nairobi', 1200, '5 hrs', 'Express')\" },\n ]);\n }\n\n // Seed default settings\n const defaults: Record = {\n mpesa_phone: \"\",\n mpesa_till: \"\",\n mpesa_consumer_key: \"\",\n mpesa_consumer_secret: \"\",\n mpesa_shortcode: \"\",\n mpesa_passkey: \"\",\n bank_name: \"\",\n bank_account_name: \"\",\n bank_account_number: \"\",\n bank_branch: \"\",\n bank_swift: \"\",\n };\n for (const [key, value] of Object.entries(defaults)) {\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO settings (key, value) VALUES (?, ?)\",\n args: [key, value],\n });\n }\n}\n\n// --- Settings ---\nexport async function getSetting(key: string): Promise {\n const result = await sqlite.execute({\n sql: \"SELECT value FROM settings WHERE key = ?\",\n args: [key],\n });\n return (result.rows[0] as any)?.value || \"\";\n}\n\nexport async function getAllSettings(): Promise> {\n const result = await sqlite.execute(\"SELECT key, value FROM settings\");\n const settings: Record = {};\n for (const row of result.rows as any[]) {\n settings[row.key] = row.value || \"\";\n }\n return settings;\n}\n\nexport async function setSetting(key: string, value: string) {\n await sqlite.execute({\n sql: \"INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = ?\",\n args: [key, value, value],\n });\n}\n\nexport async function setSettings(settings: Record) {\n for (const [key, value] of Object.entries(settings)) {\n await setSetting(key, value);\n }\n}\n\n// --- Auth helpers ---\nexport async function hashPassword(password: string): Promise {\n const data = new TextEncoder().encode(password + \"promise_luxury_salt\");\n const hash = await crypto.subtle.digest(\"SHA-256\", data);\n return Array.from(new Uint8Array(hash))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n}\n\nexport async function createSession(userType: string, userId: number): Promise {\n const token = crypto.randomUUID();\n const expires = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString();\n await sqlite.execute({\n sql: \"INSERT INTO sessions (token, user_type, user_id, expires_at) VALUES (?, ?, ?, ?)\",\n args: [token, userType, userId, expires],\n });\n return token;\n}\n\nexport async function getSession(token: string) {\n if (!token) return null;\n const result = await sqlite.execute({\n sql: \"SELECT * FROM sessions WHERE token = ? AND expires_at > datetime('now')\",\n args: [token],\n });\n if (result.rows.length === 0) return null;\n const row = result.rows[0] as any;\n\n if (row.user_type === \"customer\") {\n const user = await sqlite.execute({\n sql: \"SELECT id, name, email, phone FROM customers WHERE id = ?\",\n args: [row.user_id],\n });\n return user.rows.length > 0\n ? { type: \"customer\", user: user.rows[0] }\n : null;\n } else {\n const user = await sqlite.execute({\n sql: \"SELECT id, name, email FROM admins WHERE id = ?\",\n args: [row.user_id],\n });\n return user.rows.length > 0\n ? { type: \"admin\", user: user.rows[0] }\n : null;\n }\n}\n\nexport async function deleteSession(token: string) {\n await sqlite.execute({\n sql: \"DELETE FROM sessions WHERE token = ?\",\n args: [token],\n });\n}\n\n// --- Customer queries ---\nexport async function getCustomerByEmail(email: string) {\n const result = await sqlite.execute({\n sql: \"SELECT * FROM customers WHERE email = ?\",\n args: [email],\n });\n return result.rows[0] || null;\n}\n\nexport async function createCustomer(name: string, email: string, password: string, phone: string) {\n await sqlite.execute({\n sql: \"INSERT INTO customers (name, email, password, phone) VALUES (?, ?, ?, ?)\",\n args: [name, email, password, phone],\n });\n const result = await sqlite.execute({\n sql: \"SELECT id, name, email, phone FROM customers WHERE email = ?\",\n args: [email],\n });\n return result.rows[0];\n}\n\nexport async function getAllCustomers() {\n const result = await sqlite.execute(\n \"SELECT id, name, email, phone, created_at FROM customers ORDER BY created_at DESC\",\n );\n return result.rows;\n}\n\n// --- Admin queries ---\nexport async function getAdminByEmail(email: string) {\n const result = await sqlite.execute({\n sql: \"SELECT * FROM admins WHERE email = ?\",\n args: [email],\n });\n return result.rows[0] || null;\n}\n\n// --- Route queries ---\nexport async function getAllRoutes() {\n const result = await sqlite.execute(\"SELECT * FROM routes ORDER BY from_city, to_city\");\n return result.rows;\n}\n\nexport async function getRouteById(id: number) {\n const result = await sqlite.execute({\n sql: \"SELECT * FROM routes WHERE id = ?\",\n args: [id],\n });\n return result.rows[0] || null;\n}\n\nexport async function createRoute(from_city: string, to_city: string, price: number, duration: string, bus_type: string) {\n await sqlite.execute({\n sql: \"INSERT INTO routes (from_city, to_city, price, duration, bus_type) VALUES (?, ?, ?, ?, ?)\",\n args: [from_city, to_city, price, duration, bus_type],\n });\n}\n\nexport async function updateRoute(id: number, from_city: string, to_city: string, price: number, duration: string, bus_type: string) {\n await sqlite.execute({\n sql: \"UPDATE routes SET from_city = ?, to_city = ?, price = ?, duration = ?, bus_type = ? WHERE id = ?\",\n args: [from_city, to_city, price, duration, bus_type, id],\n });\n}\n\nexport async function deleteRoute(id: number) {\n await sqlite.execute({\n sql: \"DELETE FROM routes WHERE id = ?\",\n args: [id],\n });\n}\n\n// --- Booking queries ---\nexport async function createBooking(customerId: number, routeId: number, travelDate: string, seatNumber: string, passengerName: string, passengerPhone: string, paymentMethod: string) {\n await sqlite.execute({\n sql: \"INSERT INTO bookings (customer_id, route_id, travel_date, seat_number, passenger_name, passenger_phone, payment_method, payment_status) VALUES (?, ?, ?, ?, ?, ?, ?, ?)\",\n args: [customerId, routeId, travelDate, seatNumber, passengerName, passengerPhone, paymentMethod, \"pending\"],\n });\n const result = await sqlite.execute({\n sql: \"SELECT * FROM bookings WHERE customer_id = ? ORDER BY created_at DESC LIMIT 1\",\n args: [customerId],\n });\n return result.rows[0];\n}\n\nexport async function updateBookingPayment(bookingId: number, status: string, phone?: string) {\n await sqlite.execute({\n sql: \"UPDATE bookings SET payment_status = ?, payment_phone = COALESCE(?, payment_phone) WHERE id = ?\",\n args: [status, phone ?? null, bookingId],\n });\n}\n\nexport async function getBookedSeats(routeId: number, travelDate: string) {\n const result = await sqlite.execute({\n sql: \"SELECT seat_number FROM bookings WHERE route_id = ? AND travel_date = ? AND payment_status != 'cancelled'\",\n args: [routeId, travelDate],\n });\n return (result.rows as any[]).map(r => r.seat_number);\n}\n\nexport async function getBookingById(id: number) {\n const result = await sqlite.execute({\n sql: `SELECT b.*, r.from_city, r.to_city, r.price, r.duration, r.bus_type\n FROM bookings b JOIN routes r ON b.route_id = r.id WHERE b.id = ?`,\n args: [id],\n });\n return result.rows[0] || null;\n}\n\nexport async function getBookingsByCustomer(customerId: number) {\n const result = await sqlite.execute({\n sql: `SELECT b.*, r.from_city, r.to_city, r.price, r.duration, r.bus_type\n FROM bookings b JOIN routes r ON b.route_id = r.id\n WHERE b.customer_id = ? ORDER BY b.travel_date DESC`,\n args: [customerId],\n });\n return result.rows;\n}\n\nexport async function getAllBookings() {\n const result = await sqlite.execute(\n `SELECT b.*, r.from_city, r.to_city, r.price, r.bus_type, c.name as customer_name, c.email as customer_email\n FROM bookings b\n JOIN routes r ON b.route_id = r.id\n JOIN customers c ON b.customer_id = c.id\n ORDER BY b.created_at DESC`,\n );\n return result.rows;\n}\n\nexport async function updateBookingStatus(bookingId: number, paymentStatus: string) {\n await sqlite.execute({\n sql: \"UPDATE bookings SET payment_status = ? WHERE id = ?\",\n args: [paymentStatus, bookingId],\n });\n}\n\nexport async function cancelBooking(bookingId: number) {\n await sqlite.execute({\n sql: \"UPDATE bookings SET payment_status = 'cancelled', status = 'cancelled' WHERE id = ?\",\n args: [bookingId],\n });\n}\n\nexport async function deleteCustomer(customerId: number) {\n await sqlite.execute({ sql: \"DELETE FROM bookings WHERE customer_id = ?\", args: [customerId] });\n await sqlite.execute({ sql: \"DELETE FROM sessions WHERE user_id = ? AND user_type = 'customer'\", args: [customerId] });\n await sqlite.execute({ sql: \"DELETE FROM customers WHERE id = ?\", args: [customerId] });\n}\n\nexport async function getDashboardStats() {\n const totalRevenue = await sqlite.execute(\n `SELECT COALESCE(SUM(r.price), 0) as total FROM bookings b JOIN routes r ON b.route_id = r.id\n WHERE b.payment_status IN ('paid', 'paid (demo)')`,\n );\n const pendingRevenue = await sqlite.execute(\n `SELECT COALESCE(SUM(r.price), 0) as total FROM bookings b JOIN routes r ON b.route_id = r.id\n WHERE b.payment_status IN ('pending', 'stk_sent', 'awaiting_verification')`,\n );\n const totalBookings = await sqlite.execute(\"SELECT COUNT(*) as count FROM bookings WHERE payment_status != 'cancelled'\");\n const paidBookings = await sqlite.execute(\"SELECT COUNT(*) as count FROM bookings WHERE payment_status IN ('paid', 'paid (demo)')\");\n const totalCustomers = await sqlite.execute(\"SELECT COUNT(*) as count FROM customers\");\n const totalRoutes = await sqlite.execute(\"SELECT COUNT(*) as count FROM routes\");\n const todayBookings = await sqlite.execute(\"SELECT COUNT(*) as count FROM bookings WHERE DATE(created_at) = DATE('now') AND payment_status != 'cancelled'\");\n\n return {\n totalRevenue: (totalRevenue.rows[0] as any).total,\n pendingRevenue: (pendingRevenue.rows[0] as any).total,\n totalBookings: (totalBookings.rows[0] as any).count,\n paidBookings: (paidBookings.rows[0] as any).count,\n totalCustomers: (totalCustomers.rows[0] as any).count,\n totalRoutes: (totalRoutes.rows[0] as any).count,\n todayBookings: (todayBookings.rows[0] as any).count,\n };\n}\n",[],[215],"b1466e51-e1b6-49d2-b20f-f256a2e805a5","dashboard.html","019f287e-d617-7416-9a40-99160fabc579",["D",1783090828722],"\n\n\n \n \n Dashboard — Promise Luxury\n \n \n \n \n \n\n\n \n\n

\n\n

\n \n

\n $\"Promise$ \n

PromiseLuxury Coach

Reclining seats · AC · Entertainment

\n\n

1. Route & Date

2. Select Seat

3. Payment

\n\n \n

\n Select Route\n \n

\n Travel Date\n \n

\n Passenger Name\n \n

\n Passenger Phone\n \n

\n \n

\n\n \n

Available\n

Selected\n

Booked\n

\n \n \n

\n\n \n

\n\n

\n Choose Payment Method\n

📱 M-Pesa

Pay via STK push — enter your M-Pesa PIN on your phone

💳 Card / Bank Transfer

Transfer to our bank account — details provided after booking

\n\n \n

\n M-Pesa Phone Number\n \n

\n \n

You'll receive an M-Pesa prompt on your phone. Enter your PIN to complete payment.

\n\n \n

\n \n

Your booking will be pending until the admin verifies your payment.

\n\n \n

✅

Booking Confirmed!

\n \n

\n\n \n

My Bookings

\n\n \n\n\n",[],[225],"aebd77da-c17f-4a63-8db1-89b29adc197c","auth.ts","019f287e-d617-7416-9a40-97d145532e81",["D",1783090828722],"import {\n initDB,\n hashPassword,\n createSession,\n getSession,\n deleteSession,\n} from \"./db.ts\";\n\nexport {\n initDB,\n hashPassword,\n createSession,\n getSession,\n deleteSession,\n};\n\n// Extract session token from request cookies\nexport function getTokenFromRequest(req: Request): string | null {\n const cookie = req.headers.get(\"cookie\") || \"\";\n const match = cookie.match(/session=([^;]+)/);\n return match ? match[1] : null;\n}\n\n// Auth middleware helper — returns the auth context or null\nexport async function getAuthContext(req: Request) {\n const token = getTokenFromRequest(req);\n if (!token) return null;\n return await getSession(token);\n}\n\n// Require a specific user type, returns user or null\nexport async function requireAuth(req: Request, type: \"customer\" | \"admin\") {\n const ctx = await getAuthContext(req);\n if (!ctx || ctx.type !== type) return null;\n return ctx.user;\n}\n",[],[232],"237eb584-bf54-4db9-ba19-41ef9329ff04","admin.html","019f287e-d617-7416-9a40-925d8fbb0bf9",["D",1783091184300],4,"\n\n\n \n \n Admin Panel — Promise Luxury\n \n \n \n \n\n\n\n\n\n\n\n

\n \n \n\n \n

\n \n

\n\n \n

Dashboard Overview

Real-time business metrics

💰

KSh 0

Total Revenue

🎫

Total Bookings

⏳

KSh 0

Pending Revenue

👥

Customers

Paid Bookings

Active Routes

Today's Bookings

Recent Bookings

\n\n \n

Route Management

Add, edit, and manage bus routes

Add New Route

\n \n

All Routes

\n\n \n

Booking Management

Verify payments and manage bookings

\n \n

\n\n \n

Customer Management

View and manage registered customers

\n \n

\n\n \n

Payment Settings

Configure M-Pesa and bank transfer details

M-Pesa sends an STK push to the customer's phone. Card/Bank shows your account details for transfer.

📱 M-Pesa Settings

M-Pesa Phone (Receives Payments)

M-Pesa Till/Paybill Number

Customer enters their phone, gets an STK push, and pays. Money goes to your Till/Paybill.

🔐 Daraja API Credentials

Consumer Key

Consumer Secret

Shortcode (Paybill/Till)

Passkey (Lipa Na M-Pesa)

Get these from the Safaricom Daraja portal. Without all 4 fields, payments run in demo mode.

💳 Card / Bank Transfer

Bank Name

Account Name

Account Number

Branch

SWIFT Code

\n\n

\n\n\n\n\n",[],[239],"480f2a58-018e-497a-bb1a-3490aaead471","README.md","019f287e-d617-7416-9a40-8c2651f1168b",7,["D",1783090930785],"# Promise Luxury\n\nPremium bus booking platform for Kenya — landing page, customer panel, full admin panel, M-Pesa & card payments, visual seat selection.\n\n## Live Links\n\n| Page | URL |\n|------|-----|\n| Landing Page | https://promise_luxury--019f287ed61774169a40abfff66213ec.web.val.run |\n| Customer Login/Register | https://promise_luxury--019f287ed61774169a40abfff66213ec.web.val.run/login.html |\n| Customer Dashboard (Book + Pay) | https://promise_luxury--019f287ed61774169a40abfff66213ec.web.val.run/dashboard.html |\n| Admin Panel | https://promise_luxury--019f287ed61774169a40abfff66213ec.web.val.run/admin.html |\n\n## Demo Admin Credentials\n- **Email:** admin@promise.co.ke\n- **Password:** admin123\n\n## Features\n\n### Admin Panel (Full Management)\n- **Sidebar layout** with Overview, Routes, Bookings, Customers, Settings\n- **KPI Dashboard**: Total revenue, pending revenue, bookings, customers, paid bookings, active routes, today's bookings\n- **Booking Management**: Verify payments, cancel bookings, search & filter by status/payment\n- **Customer Management**: View customers with booking counts, search by name/email/phone, delete customers\n- **Route Management**: Add, edit (inline), and delete routes with bus type selection\n- **Payment Settings**: Configure M-Pesa phone/till, bank account details\n\n### Customer\n- Register & login\n- 3-step booking: Route & Date → Visual Seat Selection → Payment\n- M-Pesa STK Push payment (enter phone, get prompt on your phone)\n- Card/Bank Transfer payment (see admin's bank details)\n- View booking history with payment status\n\n### Landing Page\n- Luxury bus photo gallery (branded \"Promise Luxury\")\n- Popular routes, features, CTA\n\n## M-Pesa Production Setup\n\nFor real M-Pesa STK push (currently in demo mode), set these env vars:\n\n👉 Add MPESA_CONSUMER_KEY here: https://www.val.town/x/promise_luxury/promise-luxury/environment-variables?key=MPESA_CONSUMER_KEY\n👉 Add MPESA_CONSUMER_SECRET here: https://www.val.town/x/promise_luxury/promise-luxury/environment-variables?key=MPESA_CONSUMER_SECRET\n👉 Add MPESA_SHORTCODE here: https://www.val.town/x/promise_luxury/promise-luxury/environment-variables?key=MPESA_SHORTCODE\n👉 Add MPESA_PASSKEY here: https://www.val.town/x/promise_luxury/promise-luxury/environment-variables?key=MPESA_PASSKEY\n\nGet these from https://developer.safaricom.co.ke (Daraja API portal).\n\n## Architecture\n- `serve.ts` — Hono HTTP handler: API routes + static file serving\n- `db.ts` — SQLite database (schema, queries, seeding, settings, stats)\n- `auth.ts` — Session/cookie-based authentication\n- `index.html` — Landing page with bus gallery\n- `login.html` — Customer login/register\n- `dashboard.html` — 3-step booking flow with bus seat map + payment\n- `admin.html` — Full admin panel with sidebar, KPIs, booking/customer management\n- `styles.css` — Shared styles + admin layout\n",[],[247],["D",1783090828722],["D",1789524079207],{"_11":12,"_126":-5},{"_11":12,"_121":122,"_69":-5,"_30":-5,"_123":124,"_125":24},{"_38":110,"_13":16,"_32":35,"_111":71,"_112":62,"_113":63,"_114":75,"_115":116,"_117":118,"_119":14,"_120":12},"ctx",{"_51":-5,"_147":292,"_293":294,"_295":296,"_297":24,"_298":24,"_299":24,"_300":84,"_301":-5,"_302":-7,"_303":-7,"_304":26,"_305":24,"_306":24,"_307":-5,"_308":24,"_309":24,"_310":24,"_311":-5},"ENV",{"_263":264,"_265":266,"_267":16,"_268":269,"_270":271,"_272":273,"_274":275,"_276":277,"_278":279,"_280":281,"_282":283,"_284":285,"_286":287,"_288":289,"_290":291},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Travel in Promise Luxury

Our Luxury Fleet

Popular Routes

Why Promise Luxury?

Luxury Fleet

Secure Booking

Instant Tickets

Member Rewards

Ready to Travel in Luxury?

PromiseLuxury Coach

Booking Confirmed!

My Bookings

Admin Login

Dashboard Overview

Recent Bookings

Route Management

Add New Route

All Routes

Booking Management

Customer Management

Payment Settings

📱 M-Pesa Settings

🔐 Daraja API Credentials

💳 Card / Bank Transfer

History · index.html