[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_153":154,"_155":156},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_115":-5,"_20":116,"_22":117,"_118":119,"_120":121,"_25":122,"_24":-5,"_123":-5,"_124":-5,"_125":53,"_126":127,"_128":44,"_129":-5,"_130":-5,"_131":132},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","ramerdfs","name","ascend","branchName","main","version","path","","project",{"_33":61,"_13":14,"_45":62,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":-5,"_69":-5,"_70":71,"_72":-5,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":94,"_95":96,"_97":98,"_99":53},"tree",[56],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":55},"id","326aa392-3f37-11f1-9a01-42b51c65c3df","new-file-323.ts","fileId","40a945b6-1a5d-11f1-bcbb-42dde27851f2","parentId","branchId","ba2a690c-1a5c-11f1-b7b3-42dde27851f2","branchVersion",18,"latest",true,"createdAt",["D",1776964172656],15,"fileType","http","content","import { blob } from \"https://esm.town/v/std/blob\";\n\n// ============================================================\n// CONFIG\n// ============================================================\n\nconst DB_KEY = \"ascend_db\";\nconst PW_SALT = \"_ascend_salt_2026\";\nconst AI_MODEL = \"claude-sonnet-4-20250514\";\nconst MONTHLY_LIMIT = 50;\n// Anything earlier than year 2000 (946684800000 ms) is treated as bogus data.\n// This protects against the old `current_period_end` bug that wrote 0/null.\nconst MIN_VALID_MS = 946684800000;\n\nfunction env(name) {\n return Deno.env.get(name);\n}\n\n// ============================================================\n// DATABASE (single blob)\n// ============================================================\n\nasync function loadDB() {\n try {\n var data = await blob.getJSON(DB_KEY);\n if (data && data.users && data.sessions) return data;\n } catch (e) {}\n return { users: {}, sessions: {} };\n}\n\nasync function saveDB(data) {\n await blob.setJSON(DB_KEY, data);\n}\n\n// ============================================================\n// HTTP HELPERS\n// ============================================================\n\nfunction json(data, status) {\n return new Response(JSON.stringify(data), {\n status: status || 200,\n headers: {\n \"Content-Type\": \"application/json\",\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, Stripe-Signature\",\n },\n });\n}\n\nasync function readBody(req) {\n try {\n return await req.json();\n } catch (e) {\n return {};\n }\n}\n\n// ============================================================\n// AUTH HELPERS\n// ============================================================\n\nfunction createToken() {\n var chars = \"abcdefghijklmnopqrstuvwxyz0123456789\";\n var out = \"\";\n for (var i = 0; i < 40; i++) {\n out += chars.charAt(Math.floor(Math.random() * chars.length));\n }\n return out;\n}\n\nfunction generateCode() {\n // 8-digit code as string (preserves leading zeros)\n var code = \"\";\n for (var i = 0; i < 8; i++) {\n code += Math.floor(Math.random() * 10).toString();\n }\n return code;\n}\n\nasync function hashPassword(password) {\n var encoder = new TextEncoder();\n var data = encoder.encode(password + PW_SALT);\n var buf = await crypto.subtle.digest(\"SHA-256\", data);\n return Array.from(new Uint8Array(buf))\n .map(function (b) {\n return b.toString(16).padStart(2, \"0\");\n })\n .join(\"\");\n}\n\n// Returns { db, email, user } on success, or null if the token is invalid.\nasync function authenticate(token) {\n if (!token) return null;\n var db = await loadDB();\n var session = db.sessions[token];\n if (!session) return null;\n var user = db.users[session.email];\n if (!user) return null;\n return { db: db, email: session.email, user: user };\n}\n\n// Invalidate every session for a given email (used after password reset).\nfunction invalidateSessionsFor(db, email) {\n var tokens = Object.keys(db.sessions);\n for (var i = 0; i < tokens.length; i++) {\n if (db.sessions[tokens[i]].email === email) {\n delete db.sessions[tokens[i]];\n }\n }\n}\n\n// ============================================================\n// STRIPE HELPERS\n// ============================================================\n\nasync function callStripe(endpoint, params) {\n var r = await fetch(\"https://api.stripe.com/v1/\" + endpoint, {\n method: \"POST\",\n headers: {\n \"Authorization\": \"Bearer \" + env(\"STRIPE_SECRET_KEY\"),\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams(params).toString(),\n });\n return await r.json();\n}\n\nasync function getFromStripe(endpoint) {\n var r = await fetch(\"https://api.stripe.com/v1/\" + endpoint, {\n headers: { \"Authorization\": \"Bearer \" + env(\"STRIPE_SECRET_KEY\") },\n });\n return await r.json();\n}\n\n// Reads current_period_end from a subscription object, handling both:\n// - New API (2025-03-31+): sub.items.data[0].current_period_end\n// - Old API: sub.current_period_end\nfunction extractPeriodEnd(sub) {\n if (!sub) return 0;\n if (\n sub.items && sub.items.data && sub.items.data[0] &&\n sub.items.data[0].current_period_end\n ) {\n return sub.items.data[0].current_period_end;\n }\n if (sub.current_period_end) return sub.current_period_end;\n return 0;\n}\n\nfunction formatDate(ms) {\n return new Date(ms).toLocaleDateString(\"en-US\", {\n month: \"long\",\n day: \"numeric\",\n year: \"numeric\",\n });\n}\n\nasync function verifyWebhookSignature(req, rawBody) {\n var secret = env(\"STRIPE_WEBHOOK_SECRET\");\n if (!secret) return true;\n\n var sigHeader = req.headers.get(\"stripe-signature\");\n if (!sigHeader) return false;\n\n var parts = {};\n var items = sigHeader.split(\",\");\n for (var i = 0; i < items.length; i++) {\n var kv = items[i].split(\"=\");\n if (kv.length === 2) parts[kv[0]] = kv[1];\n }\n if (!parts.t || !parts.v1) return false;\n\n var nowSec = Math.floor(Date.now() / 1000);\n if (Math.abs(nowSec - parseInt(parts.t)) > 300) return false;\n\n var encoder = new TextEncoder();\n var key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n var sigBuf = await crypto.subtle.sign(\n \"HMAC\",\n key,\n encoder.encode(parts.t + \".\" + rawBody),\n );\n var sigHex = Array.from(new Uint8Array(sigBuf))\n .map(function (b) {\n return b.toString(16).padStart(2, \"0\");\n })\n .join(\"\");\n return sigHex === parts.v1;\n}\n\n// ============================================================\n// AI HELPER\n// ============================================================\n\nasync function callAnthropic(systemPrompt, userContent, maxTokens) {\n var r = await fetch(\"https://api.anthropic.com/v1/messages\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"x-api-key\": env(\"ANTHROPIC_API_KEY\"),\n \"anthropic-version\": \"2023-06-01\",\n },\n body: JSON.stringify({\n model: AI_MODEL,\n max_tokens: maxTokens || 4096,\n system: systemPrompt || \"\",\n messages: [{ role: \"user\", content: userContent }],\n }),\n });\n if (!r.ok) throw new Error(\"AI error \" + r.status);\n return await r.json();\n}\n\n// ============================================================\n// EMAIL HELPER (Resend)\n// ============================================================\n\nasync function sendEmail(to, subject, html) {\n var apiKey = env(\"RESEND_API_KEY\");\n if (!apiKey) {\n console.log(\"RESEND_API_KEY not set — email NOT sent to \" + to);\n return { error: \"Email service not configured\" };\n }\n var from = env(\"FROM_EMAIL\") || \"Ascend Solutions \";\n try {\n var r = await fetch(\"https://api.resend.com/emails\", {\n method: \"POST\",\n headers: {\n \"Authorization\": \"Bearer \" + apiKey,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n from: from,\n to: [to],\n subject: subject,\n html: html,\n }),\n });\n var data = await r.json();\n if (!r.ok) {\n console.log(\"Email send error for \" + to + \": \" + JSON.stringify(data));\n return { error: (data && data.message) || \"Failed to send email\" };\n }\n return { success: true };\n } catch (e) {\n console.log(\"Email send exception for \" + to + \": \" + e.message);\n return { error: e.message };\n }\n}\n\nfunction passwordResetEmailHTML(code) {\n return '

' +\n '

Reset your password

' +\n '

Use the code below to reset your Ascend Solutions password. This code expires in 15 minutes.

' +\n '

' +\n    code + \"

\" +\n \"

Didn't request this? You can safely ignore this email — your password hasn't changed.

\" +\n '

' +\n '

Ascend Solutions

' +\n \"

\";\n}\n\n// ============================================================\n// USAGE LIMITS\n// ============================================================\n\nfunction usageForThisMonth(user) {\n var now = new Date();\n var monthKey = now.getFullYear() + \"-\" + now.getMonth();\n if (!user.usage) user.usage = {};\n if (!user.usage[monthKey]) user.usage[monthKey] = 0;\n return {\n monthKey: monthKey,\n current: user.usage[monthKey],\n limit: MONTHLY_LIMIT,\n exceeded: user.usage[monthKey] >= MONTHLY_LIMIT,\n };\n}\n\n// ============================================================\n// ASCEND AI SYSTEM PROMPT\n// ============================================================\n\nvar ASCEND_AI_PROMPT =\n 'You are Ascend AI by Ascend Solutions — an expert AI business advisor for beginners. You ONLY discuss entrepreneurship. Give structured, specific, actionable advice.\\n\\nGiven a user\\'s business idea, skills, goals, budget, and timeline, respond with ONLY valid JSON (no markdown, no backticks):\\n\\n{\"viability\":{\"score\":<1-10>,\"summary\":\"<2 sentences>\",\"strengths\":[\"\",\"\",\"\"],\"risks\":[\"\",\"\",\"\"]},\"monetization\":[{\"strategy\":\"\",\"description\":\"<1 sentence>\",\"potential\":\"\"},{\"strategy\":\"\",\"description\":\"<1 sentence>\",\"potential\":\"\"},{\"strategy\":\"\",\"description\":\"<1 sentence>\",\"potential\":\"\"}],\"actionPlan\":[{\"week\":\"Week 1\",\"title\":\"\",\"tasks\":[\"\",\"\",\"\"]},{\"week\":\"Week 2\",\"title\":\"\",\"tasks\":[\"\",\"\",\"\"]},{\"week\":\"Week 3\",\"title\":\"\",\"tasks\":[\"\",\"\",\"\"]},{\"week\":\"Week 4\",\"title\":\"\",\"tasks\":[\"\",\"\",\"\"]}],\"tools\":[{\"name\":\"\",\"purpose\":\"\",\"cost\":\"\"},{\"name\":\"\",\"purpose\":\"\",\"cost\":\"\"},{\"name\":\"\",\"purpose\":\"\",\"cost\":\"\"}],\"nextStep\":\"\"}\\n\\nBe specific to their idea. No generic advice.';\n\n// ============================================================\n// MAIN HANDLER\n// ============================================================\n\nexport default async function (req) {\n if (req.method === \"OPTIONS\") return json({ ok: true });\n\n var url = new URL(req.url);\n var path = url.pathname;\n var SITE = env(\"SITE_URL\");\n\n // ---------- POST /checkout ----------\n if (path === \"/checkout\" && req.method === \"POST\") {\n var body = await readBody(req);\n\n if (body.token && !body.resubscribe) {\n var auth = await authenticate(body.token);\n if (\n auth && auth.user.subscriptionActive && !auth.user.cancelAtPeriodEnd\n ) {\n return json({ error: \"You already have an active subscription.\" }, 400);\n }\n }\n\n var params = {\n \"mode\": \"subscription\",\n \"line_items[0][price]\": env(\"STRIPE_PRICE_ID\"),\n \"line_items[0][quantity]\": \"1\",\n \"success_url\": SITE + \"/success.html?session_id={CHECKOUT_SESSION_ID}\",\n \"cancel_url\": SITE + \"/cancel.html\",\n };\n if (body.email) params[\"customer_email\"] = body.email;\n\n var session = await callStripe(\"checkout/sessions\", params);\n if (session.error) {\n console.log(\"Checkout error: \" + session.error.message);\n return json({ error: session.error.message }, 400);\n }\n console.log(\"Checkout session created: \" + session.id);\n return json({ url: session.url });\n }\n\n // ---------- POST /verify-payment ----------\n if (path === \"/verify-payment\" && req.method === \"POST\") {\n var body = await readBody(req);\n if (!body.session_id) return json({ error: \"No session ID provided\" }, 400);\n\n try {\n var session = await getFromStripe(\"checkout/sessions/\" + body.session_id);\n if (session.error) return json({ error: session.error.message }, 400);\n if (session.payment_status !== \"paid\") {\n return json({ error: \"Payment not confirmed\" }, 400);\n }\n\n var email = session.customer_email ||\n (session.customer_details && session.customer_details.email) ||\n \"unknown\";\n\n var db = await loadDB();\n\n if (db.users[email] && db.users[email].passwordHash) {\n var existing = db.users[email];\n existing.subscriptionActive = true;\n existing.stripeCustomer = session.customer;\n existing.cancelAtPeriodEnd = false;\n existing.accessExpiresAt = null;\n var tk = createToken();\n db.sessions[tk] = { email: email, created: Date.now() };\n await saveDB(db);\n console.log(\"Resubscribed: \" + email);\n return json({\n success: true,\n token: tk,\n email: email,\n needsPassword: false,\n });\n }\n\n db.users[email] = {\n stripeCustomer: session.customer,\n subscriptionActive: true,\n passwordHash: null,\n created: Date.now(),\n };\n await saveDB(db);\n console.log(\"New subscriber (needs password): \" + email);\n return json({ success: true, email: email, needsPassword: true });\n } catch (e) {\n console.log(\"Verify-payment error: \" + e.message);\n return json({ error: e.message }, 500);\n }\n }\n\n // ---------- POST /set-password ----------\n if (path === \"/set-password\" && req.method === \"POST\") {\n var body = await readBody(req);\n if (!body.email || !body.password) {\n return json({ error: \"Email and password required\" }, 400);\n }\n if (body.password.length < 6) {\n return json({ error: \"Password must be at least 6 characters\" }, 400);\n }\n\n var db = await loadDB();\n var user = db.users[body.email];\n if (!user) return json({ error: \"Account not found\" }, 404);\n\n user.passwordHash = await hashPassword(body.password);\n var tk = createToken();\n db.sessions[tk] = { email: body.email, created: Date.now() };\n await saveDB(db);\n\n console.log(\"Password set: \" + body.email);\n return json({ success: true, token: tk, email: body.email });\n }\n\n // ---------- POST /login ----------\n if (path === \"/login\" && req.method === \"POST\") {\n var body = await readBody(req);\n if (!body.email || !body.password) {\n return json({ error: \"Email and password required\" }, 400);\n }\n\n var db = await loadDB();\n var user = db.users[body.email];\n if (!user) return json({ error: \"No account found with this email.\" }, 401);\n if (!user.subscriptionActive) {\n return json({\n error: \"Your subscription is inactive. Please resubscribe.\",\n }, 401);\n }\n if (!user.passwordHash) {\n return json({\n error:\n \"Please complete your account setup. Check your email for the setup link.\",\n }, 401);\n }\n\n var inputHash = await hashPassword(body.password);\n if (inputHash !== user.passwordHash) {\n return json({ error: \"Incorrect password.\" }, 401);\n }\n\n var tk = createToken();\n db.sessions[tk] = { email: body.email, created: Date.now() };\n await saveDB(db);\n\n console.log(\"Login: \" + body.email);\n return json({ token: tk, email: body.email });\n }\n\n // ---------- POST /request-password-reset ----------\n // Sends an 8-digit reset code to the user's email.\n // Always returns success to prevent email enumeration.\n if (path === \"/request-password-reset\" && req.method === \"POST\") {\n var body = await readBody(req);\n if (!body.email) return json({ error: \"Email required\" }, 400);\n\n var db = await loadDB();\n var user = db.users[body.email];\n\n if (user) {\n var code = generateCode();\n user.resetCode = code;\n user.resetCodeExpires = Date.now() + 15 * 60 * 1000; // 15 min\n user.resetCodeAttempts = 0;\n await saveDB(db);\n\n var result = await sendEmail(\n body.email,\n \"Your Ascend Solutions password reset code\",\n passwordResetEmailHTML(code),\n );\n if (result.error) {\n console.log(\n \"Password reset email failed for \" + body.email + \": \" + result.error,\n );\n } else {\n console.log(\"Password reset code sent to \" + body.email);\n }\n } else {\n console.log(\"Password reset requested for unknown email: \" + body.email);\n }\n\n // Always respond identically (prevents email enumeration)\n return json({ success: true });\n }\n\n // ---------- POST /verify-reset-code ----------\n // Validates the 8-digit code and issues a short-lived reset token.\n if (path === \"/verify-reset-code\" && req.method === \"POST\") {\n var body = await readBody(req);\n if (!body.email || !body.code) {\n return json({ error: \"Email and code required\" }, 400);\n }\n\n var db = await loadDB();\n var user = db.users[body.email];\n if (!user || !user.resetCode) {\n return json({ error: \"Invalid or expired code.\" }, 400);\n }\n\n if (!user.resetCodeExpires || Date.now() > user.resetCodeExpires) {\n user.resetCode = null;\n user.resetCodeExpires = null;\n user.resetCodeAttempts = 0;\n await saveDB(db);\n return json(\n { error: \"Code has expired. Please request a new one.\" },\n 400,\n );\n }\n\n if (!user.resetCodeAttempts) user.resetCodeAttempts = 0;\n if (user.resetCodeAttempts >= 5) {\n user.resetCode = null;\n user.resetCodeExpires = null;\n user.resetCodeAttempts = 0;\n await saveDB(db);\n return json({\n error: \"Too many failed attempts. Please request a new code.\",\n }, 429);\n }\n\n if (user.resetCode !== body.code) {\n user.resetCodeAttempts += 1;\n await saveDB(db);\n return json({ error: \"Invalid code.\" }, 400);\n }\n\n // Success — issue a reset token and clear the code\n var resetToken = createToken();\n user.resetToken = resetToken;\n user.resetTokenExpires = Date.now() + 10 * 60 * 1000; // 10 min\n user.resetCode = null;\n user.resetCodeExpires = null;\n user.resetCodeAttempts = 0;\n await saveDB(db);\n\n console.log(\"Reset code verified for \" + body.email);\n return json({ success: true, resetToken: resetToken });\n }\n\n // ---------- POST /reset-password ----------\n // Uses the reset token to set a new password, then logs the user in.\n if (path === \"/reset-password\" && req.method === \"POST\") {\n var body = await readBody(req);\n if (!body.email || !body.resetToken || !body.password) {\n return json(\n { error: \"Email, reset token, and new password required\" },\n 400,\n );\n }\n if (body.password.length < 6) {\n return json({ error: \"Password must be at least 6 characters\" }, 400);\n }\n\n var db = await loadDB();\n var user = db.users[body.email];\n if (!user || !user.resetToken) {\n return json({ error: \"Invalid reset session.\" }, 400);\n }\n if (user.resetToken !== body.resetToken) {\n return json({ error: \"Invalid reset session.\" }, 400);\n }\n if (!user.resetTokenExpires || Date.now() > user.resetTokenExpires) {\n user.resetToken = null;\n user.resetTokenExpires = null;\n await saveDB(db);\n return json({ error: \"Reset session expired. Please start over.\" }, 400);\n }\n\n // Update password and invalidate every existing session for this user\n user.passwordHash = await hashPassword(body.password);\n user.resetToken = null;\n user.resetTokenExpires = null;\n invalidateSessionsFor(db, body.email);\n\n // Issue a fresh session so the user is instantly logged in\n var tk = createToken();\n db.sessions[tk] = { email: body.email, created: Date.now() };\n await saveDB(db);\n\n console.log(\"Password reset: \" + body.email);\n return json({ success: true, token: tk, email: body.email });\n }\n\n // ---------- POST /verify ----------\n if (path === \"/verify\" && req.method === \"POST\") {\n var body = await readBody(req);\n if (!body.token) return json({ valid: false });\n\n var db = await loadDB();\n var session = db.sessions[body.token];\n if (!session) return json({ valid: false });\n\n var user = db.users[session.email];\n if (!user) return json({ valid: false });\n\n // SELF-HEAL: old accounts cancelled before the extractPeriodEnd fix have\n // accessExpiresAt = null/0/NaN. Re-fetch from Stripe to recover the real date.\n if (\n user.cancelAtPeriodEnd &&\n (!user.accessExpiresAt || user.accessExpiresAt < MIN_VALID_MS) &&\n user.stripeCustomer\n ) {\n try {\n var subs = await getFromStripe(\n \"subscriptions?customer=\" + user.stripeCustomer + \"&limit=10\",\n );\n if (subs.data) {\n for (var i = 0; i < subs.data.length; i++) {\n var s = subs.data[i];\n if (s.cancel_at_period_end) {\n var pe = extractPeriodEnd(s);\n if (pe > 0) {\n user.accessExpiresAt = pe * 1000;\n await saveDB(db);\n console.log(\"Self-healed accessExpiresAt for \" + session.email);\n break;\n }\n }\n }\n }\n } catch (e) {\n console.log(\"Self-heal failed for \" + session.email + \": \" + e.message);\n }\n }\n\n if (\n user.cancelAtPeriodEnd && user.accessExpiresAt &&\n user.accessExpiresAt >= MIN_VALID_MS\n ) {\n if (Date.now() > user.accessExpiresAt) {\n user.subscriptionActive = false;\n user.cancelAtPeriodEnd = false;\n user.accessExpiresAt = null;\n await saveDB(db);\n return json({ valid: false });\n }\n }\n\n if (!user.subscriptionActive) return json({ valid: false });\n\n var result = { valid: true, email: session.email };\n if (\n user.cancelAtPeriodEnd && user.accessExpiresAt &&\n user.accessExpiresAt >= MIN_VALID_MS\n ) {\n result.cancelPending = true;\n result.expiresAt = formatDate(user.accessExpiresAt);\n result.expiresAtMs = user.accessExpiresAt;\n }\n return json(result);\n }\n\n // ---------- POST /cancel ----------\n if (path === \"/cancel\" && req.method === \"POST\") {\n var body = await readBody(req);\n var auth = await authenticate(body.token);\n if (!auth) return json({ error: \"Not authenticated\" }, 401);\n if (!auth.user.subscriptionActive) {\n return json({ error: \"No active subscription\" }, 400);\n }\n\n try {\n var subs = await getFromStripe(\n \"subscriptions?customer=\" + auth.user.stripeCustomer + \"&status=active\",\n );\n if (subs.data && subs.data.length > 0) {\n var sub = subs.data[0];\n var updated = await callStripe(\"subscriptions/\" + sub.id, {\n \"cancel_at_period_end\": \"true\",\n });\n\n auth.user.cancelAtPeriodEnd = true;\n var periodEnd = extractPeriodEnd(updated) || extractPeriodEnd(sub);\n if (periodEnd === 0) {\n var refetched = await getFromStripe(\"subscriptions/\" + sub.id);\n periodEnd = extractPeriodEnd(refetched);\n }\n if (periodEnd > 0) auth.user.accessExpiresAt = periodEnd * 1000;\n }\n await saveDB(auth.db);\n console.log(\"Cancel-at-period-end: \" + auth.email);\n\n var expStr =\n (auth.user.accessExpiresAt && auth.user.accessExpiresAt >= MIN_VALID_MS)\n ? formatDate(auth.user.accessExpiresAt)\n : \"the end of your billing period\";\n return json({ success: true, expiresAt: expStr });\n } catch (e) {\n return json({ error: e.message }, 500);\n }\n }\n\n // ---------- POST /reactivate ----------\n if (path === \"/reactivate\" && req.method === \"POST\") {\n var body = await readBody(req);\n var auth = await authenticate(body.token);\n if (!auth) return json({ error: \"Not authenticated\" }, 401);\n if (!auth.user.cancelAtPeriodEnd) {\n return json(\n { error: \"Subscription is not scheduled for cancellation.\" },\n 400,\n );\n }\n\n try {\n var subs = await getFromStripe(\n \"subscriptions?customer=\" + auth.user.stripeCustomer + \"&status=active\",\n );\n if (!subs.data || subs.data.length === 0) {\n return json({ error: \"No active subscription found.\" }, 400);\n }\n await callStripe(\"subscriptions/\" + subs.data[0].id, {\n \"cancel_at_period_end\": \"false\",\n });\n auth.user.cancelAtPeriodEnd = false;\n auth.user.accessExpiresAt = null;\n await saveDB(auth.db);\n console.log(\"Reactivated: \" + auth.email);\n return json({ success: true });\n } catch (e) {\n return json({ error: e.message }, 500);\n }\n }\n\n // ---------- POST /generate (Ascend AI) ----------\n if (path === \"/generate\" && req.method === \"POST\") {\n var body = await readBody(req);\n var auth = await authenticate(body.token);\n if (!auth) return json({ error: \"Not authenticated\" }, 401);\n if (!auth.user.subscriptionActive) {\n return json({ error: \"Subscription inactive\" }, 403);\n }\n\n if (\n !body.idea || !body.skills || !body.goals || !body.budget ||\n !body.timeline\n ) {\n return json({ error: \"Missing fields\" }, 400);\n }\n\n var usage = usageForThisMonth(auth.user);\n if (usage.exceeded) {\n return json({\n error: \"You've reached your limit of \" + usage.limit +\n \" generations this month.\",\n }, 429);\n }\n auth.user.usage[usage.monthKey] += 1;\n await saveDB(auth.db);\n\n console.log(\n \"Ascend AI for \" + auth.email + \" (\" + auth.user.usage[usage.monthKey] +\n \"/\" + usage.limit + \")\",\n );\n\n try {\n var content = \"Business Idea: \" + body.idea +\n \"\\nSkills: \" + body.skills +\n \"\\nGoals: \" + body.goals +\n \"\\nBudget: \" + body.budget +\n \"\\nTimeline: \" + body.timeline +\n \"\\n\\nGenerate my startup plan as JSON.\";\n var aiData = await callAnthropic(ASCEND_AI_PROMPT, content);\n return json(aiData);\n } catch (e) {\n return json({ error: \"AI error: \" + e.message }, 500);\n }\n }\n\n // ---------- POST /generate-deck (generic AI generation) ----------\n if (path === \"/generate-deck\" && req.method === \"POST\") {\n var body = await readBody(req);\n var auth = await authenticate(body.token);\n if (!auth) return json({ error: \"Not authenticated\" }, 401);\n if (!auth.user.subscriptionActive) {\n return json({ error: \"Subscription inactive\" }, 403);\n }\n if (!body.prompt) return json({ error: \"Missing prompt\" }, 400);\n\n var usage = usageForThisMonth(auth.user);\n if (usage.exceeded) {\n return json({\n error: \"You've reached your limit of \" + usage.limit +\n \" generations this month.\",\n }, 429);\n }\n auth.user.usage[usage.monthKey] += 1;\n await saveDB(auth.db);\n\n console.log(\n \"Generate-deck for \" + auth.email + \" (\" +\n auth.user.usage[usage.monthKey] + \"/\" + usage.limit + \")\",\n );\n\n try {\n var aiData = await callAnthropic(body.systemPrompt, body.prompt);\n return json(aiData);\n } catch (e) {\n return json({ error: \"AI error: \" + e.message }, 500);\n }\n }\n\n // ---------- POST /save-tasks ----------\n if (path === \"/save-tasks\" && req.method === \"POST\") {\n var body = await readBody(req);\n var auth = await authenticate(body.token);\n if (!auth) return json({ error: \"Not authenticated\" }, 401);\n if (!auth.user.subscriptionActive) {\n return json({ error: \"Subscription inactive\" }, 403);\n }\n\n auth.user.taskCoach = body.taskData;\n await saveDB(auth.db);\n return json({ success: true });\n }\n\n // ---------- POST /load-tasks ----------\n if (path === \"/load-tasks\" && req.method === \"POST\") {\n var body = await readBody(req);\n var auth = await authenticate(body.token);\n if (!auth) return json({ error: \"Not authenticated\" }, 401);\n if (!auth.user.subscriptionActive) {\n return json({ error: \"Subscription inactive\" }, 403);\n }\n\n return json({ success: true, taskData: auth.user.taskCoach || {} });\n }\n\n // ---------- POST /webhook ----------\n if (path === \"/webhook\" && req.method === \"POST\") {\n var rawBody = await req.text();\n\n var verified = await verifyWebhookSignature(req, rawBody);\n if (!verified) {\n console.log(\"Webhook signature verification FAILED — rejecting\");\n return json({ error: \"Invalid signature\" }, 401);\n }\n if (!env(\"STRIPE_WEBHOOK_SECRET\")) {\n console.log(\n \"⚠️ STRIPE_WEBHOOK_SECRET not set — webhook is unverified (anyone could POST here)\",\n );\n }\n\n var event = {};\n try {\n event = JSON.parse(rawBody);\n } catch (e) {\n return json({ error: \"Invalid JSON\" }, 400);\n }\n\n if (event.type === \"customer.subscription.deleted\") {\n var customerId = event.data.object.customer;\n var db = await loadDB();\n var emails = Object.keys(db.users);\n for (var i = 0; i < emails.length; i++) {\n if (db.users[emails[i]].stripeCustomer === customerId) {\n db.users[emails[i]].subscriptionActive = false;\n db.users[emails[i]].cancelAtPeriodEnd = false;\n db.users[emails[i]].accessExpiresAt = null;\n console.log(\"Webhook cancelled: \" + emails[i]);\n break;\n }\n }\n await saveDB(db);\n }\n return json({ received: true });\n }\n\n // ---------- GET /stats ----------\n if (path === \"/stats\") {\n var db = await loadDB();\n var emails = Object.keys(db.users);\n var active = 0;\n for (var i = 0; i < emails.length; i++) {\n if (db.users[emails[i]].subscriptionActive) active++;\n }\n return json({ totalUsers: emails.length, activeSubscribers: active });\n }\n\n return json({ error: \"Not found\" }, 404);\n}","deleted",false,"label",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":59,"_18":60},["D",1776964172656],"children",[],[35],"ba2a22e4-1a5c-11f1-b7b3-42dde27851f2",["D",1772912098779],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","019cc6af-d31c-709b-94d5-361390ba7044","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",1,"orgId","019cc6af-d31c-709b-94d5-3a994057bf86","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_114":110},"org",{"_11":12,"_108":-5,"_109":110,"_70":71,"_111":112,"_113":53},"branch",{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18zQWJTa0V5WEZGMW4zSG4ySkk5R2FsVVhGcFMifQ","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":61,"_13":14,"_45":149,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":-5,"_69":-5,"_70":71,"_72":-5,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":150,"_95":151,"_97":152,"_99":53},[146],"files",[146],"counts",{"_135":136,"_137":77,"_138":136,"_31":139,"_140":141},[133],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":134},[35],"pulls",0,"branches","forks",{"_142":144,"_145":136},"connections",{"_142":136,"_143":136},"count","unfilledCount",5,"emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":147,"_18":148},[],[35],["D",1772912098779],{"_11":12,"_114":110},{"_11":12,"_108":-5,"_109":110,"_70":71,"_111":112,"_113":53},{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"ctx",{"_93":-5,"_130":186,"_187":188,"_189":190,"_191":53,"_192":53,"_193":53,"_194":44,"_195":-5,"_196":-7,"_197":-7,"_198":136,"_199":53,"_200":53,"_201":-5,"_202":53,"_203":53,"_204":53,"_205":-5},"ENV",{"_157":158,"_159":160,"_161":16,"_162":163,"_164":165,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]