[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_258":259,"_260":261},"routes/_app.x.$handle.$name",{"_96":95,"_31":43,"_105":86,"_26":106,"_13":14,"_107":-5,"_11":108,"_109":110,"_111":112,"_113":114,"_115":116,"_20":-5,"_117":-5,"_118":-5,"_119":24,"_120":121,"_122":123,"_124":-5,"_125":-5,"_126":127},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_41":42,"_31":43,"_36":44,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":-5,"_55":24,"_56":-5,"_57":-5,"_58":59,"_60":61,"_62":63,"_64":65,"_66":67,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":24},"version",63,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":33,"_34":35,"_36":37,"_38":14,"_39":40,"_23":24},"previous","deleted",false,"deletedHere","path","backup_now.ts","latestPath","fileId","66d002a4-7f28-11f1-b6a5-1607ee4eb77e","name","fileType","script","content","// Run the daily backup by hand. (The cron calls backup.ts's default export on its own.)\nimport backup from \"./backup.ts\";\nawait backup();\n","createdAt",["D",1783994692529],"branchVersion","branchId","1d7321a2-4f46-4733-b86a-498e1d666a4b","id","9a8f532d-d413-48dd-9c0f-576fd227edcf","money-budget",["D",1783644524287],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Pocket budgeting app — syncs across phone and laptop","imageUrl","9ce636d8-a261-43ee-aad5-aba0afcc9805","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f497e-7eff-7029-9247-01cc1300f2ae","tursoName","9a8f532dd41348dd9c0f576fd227edcf","tursoHostname","9a8f532dd41348dd9c0f576fd227edcf-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789525245864],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_96":95,"_104":100},"org",{"_96":95,"_97":98,"_99":100,"_18":53,"_101":102,"_103":24},"branch",{"_13":85,"_31":86,"_41":40,"_87":42,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":43,"_94":95},"isOwned",70,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","rileys1011","handle","displayName","Riley Smith","avatar","https://lh3.googleusercontent.com/a/ACg8ocKLn-WocVfdzaKwIdLHV1VQfr-Cu-Zr_dXM84NUtd0tHciAd52i=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_41":42,"_31":43,"_36":253,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":-5,"_55":24,"_56":-5,"_57":-5,"_58":59,"_60":61,"_62":63,"_64":65,"_66":254,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":255,"_80":256,"_82":257,"_84":24},"tree",[216,217,218,219,220,221,222,223,224],"files",[216,217,218,219,220,221,222,223,224],"counts",{"_205":59,"_206":152,"_207":59,"_208":209,"_210":211},"contents",[128,129,130,131,132,133,134,135,136],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_41":198,"_31":199,"_29":200,"_140":-5,"_39":40,"_38":201,"_142":24,"_36":202,"_13":59,"_32":33,"_34":203,"_23":24,"_145":-5,"_26":204},{"_41":195,"_31":27,"_29":30,"_140":-5,"_39":40,"_38":14,"_142":123,"_36":196,"_13":59,"_32":33,"_34":35,"_23":24,"_145":-5,"_26":197},{"_41":187,"_31":188,"_29":189,"_140":-5,"_39":40,"_38":190,"_142":123,"_36":191,"_13":192,"_32":33,"_34":193,"_23":24,"_145":-5,"_26":194},{"_41":180,"_31":181,"_29":182,"_140":-5,"_39":40,"_38":183,"_142":123,"_36":184,"_13":59,"_32":153,"_34":185,"_23":24,"_145":-5,"_26":186},{"_41":173,"_31":174,"_29":175,"_140":-5,"_39":40,"_38":176,"_142":123,"_36":177,"_13":59,"_32":20,"_34":178,"_23":24,"_145":-5,"_26":179},{"_41":166,"_31":167,"_29":168,"_140":-5,"_39":40,"_38":169,"_142":123,"_36":170,"_13":59,"_32":20,"_34":171,"_23":24,"_145":-5,"_26":172},{"_41":156,"_31":157,"_29":158,"_140":-5,"_39":40,"_38":159,"_142":123,"_36":160,"_13":161,"_32":162,"_34":163,"_23":24,"_145":164,"_26":165},{"_41":147,"_31":148,"_29":149,"_140":-5,"_39":40,"_38":150,"_142":24,"_36":151,"_13":152,"_32":153,"_34":154,"_23":24,"_145":-5,"_26":155},{"_41":137,"_31":138,"_29":139,"_140":-5,"_39":40,"_38":141,"_142":123,"_36":143,"_13":59,"_32":33,"_34":144,"_23":24,"_145":-5,"_26":146},"c31f8aea-8615-414c-ad4b-6d4c1e0eba66","push.ts","1cf0f1b2-7e82-11f1-b75d-1607ee4eb77e","parentId",47,"latest",["D",1783923272134],"// Web Push sender (lives on main so the cron can use it).\nimport * as webpush from \"jsr:@negrel/webpush\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst PRIV = JSON.parse(Deno.env.get(\"VAPID_PRIVATE_JWK\") || \"{}\");\n\nfunction vapidJwks() {\n const { kty, crv, x, y, d } = PRIV;\n return {\n publicKey: { kty, crv, x, y, key_ops: [\"verify\"], ext: true },\n privateKey: { kty, crv, x, y, d, key_ops: [\"sign\"], ext: true },\n };\n}\n\nlet _server: any = null;\nasync function server() {\n if (_server) return _server;\n const keys = await webpush.importVapidKeys(vapidJwks() as any, { extractable: false });\n _server = await webpush.ApplicationServer.new({\n contactInformation: \"mailto:rileysmith1272@gmail.com\",\n vapidKeys: keys,\n });\n return _server;\n}\n\nexport type Sub = { endpoint: string; p256dh: string; auth: string };\n\nexport async function sendPush(sub: Sub, payload: Record): Promise {\n try {\n const app = await server();\n const subscriber = app.subscribe({\n endpoint: sub.endpoint,\n keys: { p256dh: sub.p256dh, auth: sub.auth },\n } as any);\n await subscriber.pushTextMessage(JSON.stringify(payload), {});\n return true;\n } catch (e: any) {\n const msg = String(e?.message || e);\n if (msg.includes(\"404\") || msg.includes(\"410\") || msg.includes(\"Gone\") || msg.includes(\"NotFound\")) {\n try { await sqlite.execute({ sql: \"DELETE FROM mb_push WHERE endpoint = ?\", args: [sub.endpoint] }); } catch (_) {}\n return false;\n }\n console.log(\"push failed:\", msg);\n return false;\n }\n}\n\nexport async function pushToUser(userId: string, payload: Record): Promise {\n const r = await sqlite.execute({\n sql: \"SELECT endpoint, p256dh, auth FROM mb_push WHERE user_id = ?\",\n args: [userId],\n });\n let ok = 0;\n for (const s of r.rows as unknown as Sub[]) if (await sendPush(s, payload)) ok++;\n return ok;\n}\n","label",[138],"9df48367-009a-4bdc-8d66-09747137e322","notify.ts","2fc67780-7e82-11f1-963c-1607ee4eb77e",61,["D",1783937530728],3,"interval","// Daily notification run. Decides what is worth interrupting someone for, and nothing else.\n//\n// This used to read each user's budget. It CAN'T any more -- everything is encrypted with a key\n// only their browser holds. So the app itself does the thinking and leaves behind a \"hint\": a\n// count and a few dates, and nothing else. That is why the wording below is vague. We genuinely\n// do not know what the bill is, who it's to, or how much it's for -- and that's the point.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { pushToUser } from \"./push.ts\";\n\nconst DAY = 86400000;\nconst fmtDay = (ts: number) => new Date(ts).toLocaleDateString(\"en-NZ\", { day: \"numeric\", month: \"short\" });\n\n/** Don't send the same thing every single day. Remembers what we last told each user. */\nasync function seen(userId: string) {\n return ((await blob.getJSON(\"notif_\" + userId)) ?? {}) as Record;\n}\nasync function markSeen(userId: string, s: Record) {\n await blob.setJSON(\"notif_\" + userId, s);\n}\nfunction due(s: Record, key: string, everyDays: number) {\n const last = s[key] || 0;\n return Date.now() - last > everyDays * DAY;\n}\n\nexport default async function () {\n await run();\n}\n\nasync function run() {\n const users = await sqlite.execute(\n `SELECT DISTINCT u.id, u.username FROM mb_users u JOIN mb_push p ON p.user_id = u.id`,\n );\n console.log(`checking ${users.rows.length} user(s) with notifications on`);\n\n for (const u of users.rows as any[]) {\n const h: any = (await blob.getJSON(\"hint_\" + u.id)) ?? null;\n if (!h) { console.log(`@${u.username}: no hints yet (they need to open the app once)`); continue; }\n const n = h.notify || {};\n if (!n.enabled) { console.log(`@${u.username}: notifications off`); continue; }\n\n // A stale hint means they haven't opened the app in a while. Dates in it may have passed, so\n // we don't trust anything older than a fortnight rather than nag about a bill from last month.\n if (Date.now() - (h.updated || 0) > 14 * DAY) {\n console.log(`@${u.username}: hints are stale, staying quiet`);\n continue;\n }\n\n const s = await seen(u.id);\n const sent: string[] = [];\n const now = Date.now();\n\n // --- transactions waiting to be sorted ---\n if (n.inbox !== false) {\n const c = Math.round(h.inbox || 0);\n if (c > 0 && due(s, \"inbox\", 1)) {\n await pushToUser(u.id, {\n title: c === 1 ? \"1 transaction to sort\" : `${c} transactions to sort`,\n body: \"Your bank sent through new activity.\",\n url: \"/\", tag: \"inbox\",\n });\n s.inbox = now; sent.push(\"inbox\");\n }\n }\n\n // --- a bill lands in the next couple of days ---\n // We know WHEN, not what or how much. So we don't pretend to.\n if (n.bills !== false) {\n const ts = h.billTs || 0;\n if (ts > now && ts <= now + 2 * DAY && due(s, \"bills\", 1)) {\n const more = Math.max(0, Math.round(h.billCount || 0) - 1);\n await pushToUser(u.id, {\n title: \"A bill is due \" + fmtDay(ts),\n body: more > 0 ? `Plus ${more} more around the same time. Open Stash for the details.` : \"Open Stash for the details.\",\n url: \"/\", tag: \"bills\",\n });\n s.bills = now; sent.push(\"bills\");\n }\n }\n\n // --- the forecast says you run out of money ---\n if (n.shortfall !== false) {\n const ts = h.shortfallTs || 0;\n if (ts > now && due(s, \"shortfall\", 7)) {\n await pushToUser(u.id, {\n title: \"You are heading for empty\",\n body: `Your forecast runs out around ${fmtDay(ts)}.`,\n url: \"/\", tag: \"shortfall\",\n });\n s.shortfall = now; sent.push(\"shortfall\");\n }\n }\n\n // --- a fixed mortgage rate is about to end ---\n if (n.refix !== false) {\n const ts = h.refixTs || 0;\n const days = ts ? Math.ceil((ts - now) / DAY) : 0;\n if (days > 0 && days <= 90 && due(s, \"refix\", 30)) {\n await pushToUser(u.id, {\n title: \"Your fixed rate is ending\",\n body: `It comes off in ${days} days. Worth shopping around.`,\n url: \"/\", tag: \"refix\",\n });\n s.refix = now; sent.push(\"refix\");\n }\n }\n\n await markSeen(u.id, s);\n console.log(`@${u.username}: ${sent.length ? \"sent \" + sent.join(\", \") : \"nothing worth saying\"}`);\n }\n\n console.log(\"done\");\n}\n",[148],"ebf230aa-365c-4031-83af-057c4c336440","main.tsx","1a504146-7bf9-11f1-b957-1607ee4eb77e",57,["D",1783930267820],8,"http","// The old (pre-multiuser) copy of Stash used to be served from here. It was three days stale and\n// running against the same live database, which meant anyone still on this URL could write bad\n// state. The app now lives at stash.val.run.\n//\n// This branch exists only to host the scheduled jobs (daily_refresh.ts, notify.ts) and the push\n// sender, because Val Town only runs intervals on `main`.\n//\n// Anything hitting the old URL is sent to the real app rather than a dead page — someone may have\n// it bookmarked or installed on a home screen.\nexport default function (req: Request): Response {\n const url = new URL(req.url);\n return Response.redirect(\"https://stash.val.run\" + url.pathname + url.search, 301);\n}\n","riley-pocket-money",[157],"7260bf76-a81e-44c0-bc1e-0c912ff5f09d","icon192.b64","cbf0c2ee-7c1d-11f1-9082-1607ee4eb77e",38,["D",1783660284254],"iVBORw0KGgoAAAANSUhEUgAAAMAAAADACAYAAABS3GwHAAAHFklEQVR42u3de2iVdRzH8c85u3Pryp7U9qBLp3NzUzNtmpQp2ECthKiQBlEEQhDIgoKVRuBDUA4CFUIQIgopEc1q+0OpLBqaq6VtbVlmzuncTKLtTtqc3of+sAfMu3m3e7bd8zvv15/Lmf3u2+/9nnOuZikBZFRVRgTXC1TvsMb612ARMEwK3CJimBS3RcQwKW6LkGFS2DYxw6SbARYhw6RpbRMzTJrWFiHDpGltEzNMmtY2McOkqG1ihklR28QMk6K2iRkmRW0TM0yK2iZmmBS1TcwwKWqbmGFS1DYxw6SobWKGSVHbxAyTorY5JpjEZjrDpCltEfPIa16/UfmZWeoPBpXzyosciAMGeprIygHzVw6ms7ssQQzKOLUWLiGXUtjsNHpZ8yAelw/q7FMXDJ9geWERvKr08b6qphflzdP4t9+W5OZnVd4Kqq5ZpTOXrunMpIF99YBcLPrKAs+WIdmqPyRk5uUqsst5U1p+M9y+aiOMbLtCTz9myVFvzzYWyBznjxzu9YfN2rN+K9v9RuVn5mlmPzNbdfaZ04ry9frDwrJ8LZaFTr/ZjbW3xfeu3d5rvTKG3rIzS0N4uzt1PXWlt1eir9c5f11tvS1r0lFakoxFRK1Tc0KVdff59W1t3wxTdIdC1YFa1dTdG4uz36+/tj57rVUdW+dt15tt87e0/HeZOnRWfHQZ3Zc76e6TZ8AlqDwzPwXi3bF4vqZ8emlUvi3MnjuHF8u8dfPPKSTOTF2u/68/RKzXO3G+aq6P59rH3zdqf2edzxNRWsB0PxydH1WV/xkfWx+f/HxHRJ/nz2SPB13n7ZoxdHafU/nZ/9wRZm7mkNvbHnkl3zzY5+eOOlL39Uu6R9dYcPRr7O6/H6+7pV/LrmHXvHnvo/GO+5o4Y+QZzsRA0XwUwHi6JVL2VVDrqO2Sp+cqm1PJ2vLdHRz+9Xu5Y4Q8Y3iN6/Bhn/gAAAABJRU5ErkJggg==",[167],"04052dc5-44ea-47d4-8fc5-9827a874a999","icon180.b64","d8eed9a4-7c1d-11f1-979a-1607ee4eb77e",39,["D",1783660306051],"iVBORw0KGgoAAAANSUhEUgAAALQAAAC0CAYAAAA9zQYyAAAGyklEQVR42u3dfWhVdRzH8c85u3Pryp7U9qBLp3NzUzNtmpQp2ECthKiQBlEEQhDIgoKVRuBDUA4CFUIQIgopEc1q+0OpLBqaq6VtbVlmzuncTKLtTtqc3of+sAfMu3m3e7bd8zvv15/Lmf3u2+/9nnOuZikBZFRVRgTXC1TvsMb612ARMEwK3CJimBS3RcQwKW6LkGFS2DYxw6SbARYhw6RpbRMzTJrWFiHDpGltEzNMmtY2McOkqG1ihklR28QMk6K2iRkmRW0TM0yK2iZmmBS1TcwwKWqbmGFS1DYxw6SobWKGSVHbxAyTorY5JpjEZjrDpCltEfPIa16/UfmZWeoPBpXzyosciAMGeprIygHzVw6ms7ssQQzKOLUWLiGXUtjsNHpZ8yAelw/q7FMXDJ9geWERvKr08b6qphflzdP4t9+W5OZnVd4Kqq5ZpTOXrunMpIF99YBcLPrKAs+WIdmqPyRk5uUqsst5U1p+M9y+aiOMbLtCTz9myVFvzzYWyBznjxzu9YfN2rN+K9v9RuVn5mlmPzNbdfaZ04ry9frDwrJ8LZaFTr/ZjbW3xfeu3d5rvTKG3rIzS0N4uzt1PXWlt1eir9c5f11tvS1r0lFakoxFRK1Tc0KVdff59W1t3wxTdIdC1YFa1dTdG4uz36+/tj57rVUdW+dt15tt87e0/HeZOnRWfHQZ3Zc76e6TZ8AlqDwzPwXi3bF4vqZ8emlUvi3MnjuHF8u8dfPPKSTOTF2u/68/RKzXO3G+aq6P59rH3zdqf2edzxNRWsB0PxydH1WV/xkfWx+f/HxHRJ/nz2SPB13n7ZoxdHafU/nZ/9wRZm7mkNvbHnkl3zzY5+eOOlL39Uu6R9dYcPRr7O6/H6+7pV/LrmHXvHnvo/GO+5o4Y+QZzsRA0XwUwHi6JVL2VVDrqO2Sp+cqm1PJ2vLdHRz+9Xu5Y4Q8Y3iN6/Bhn/gAAAABJRU5ErkJggg==",[174],"b2f7f845-f3d6-40b7-ba59-2a54ea24dbb8","daily_refresh.ts","869aea5c-7cb4-11f1-9d8a-1607ee4eb77e",46,["D",1783725021934],"// Daily bank refresh for every connected user.\n// Triggers Akahu to pull fresh transactions so each user's inbox is up to date.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst APP_SECRET = Deno.env.get(\"APP_KEY\") || \"dev-secret\";\nconst enc = new TextEncoder();\nconst dec = new TextDecoder();\nfunction fromHex(h: string) { const a = new Uint8Array(h.length / 2); for (let i = 0; i < a.length; i++) a[i] = parseInt(h.substr(i * 2, 2), 16); return a; }\nasync function aesKey() {\n const base = await crypto.subtle.importKey(\"raw\", enc.encode(APP_SECRET), \"PBKDF2\", false, [\"deriveKey\"]);\n return crypto.subtle.deriveKey({ name: \"PBKDF2\", salt: enc.encode(\"mb-bank-salt\"), iterations: 100000, hash: \"SHA-256\" }, base, { name: \"AES-GCM\", length: 256 }, false, [\"encrypt\", \"decrypt\"]);\n}\nasync function decTok(s: string) {\n const [ivh, cth] = s.split(\":\"); const key = await aesKey();\n const pt = await crypto.subtle.decrypt({ name: \"AES-GCM\", iv: fromHex(ivh) }, key, fromHex(cth));\n return dec.decode(pt);\n}\n\nexport default async function () {\n let ok = 0, fail = 0;\n // mb_bank may not exist yet if no one has connected a bank — guard for that.\n let rows: any[] = [];\n try {\n const r = await sqlite.execute(\"SELECT user_id, akahu_user, akahu_app FROM mb_bank\");\n rows = r.rows as any[];\n } catch (e) { console.log(\"no mb_bank yet\", String(e)); return; }\n for (const row of rows) {\n try {\n const U = await decTok(row.akahu_user);\n const A = await decTok(row.akahu_app);\n const resp = await fetch(\"https://api.akahu.io/v1/refresh\", { method: \"POST\", headers: { Authorization: `Bearer ${U}`, \"X-Akahu-Id\": A } });\n if (resp.ok) ok++; else { fail++; console.log(\"refresh non-ok\", row.user_id, resp.status); }\n } catch (e) { fail++; console.log(\"refresh error\", row.user_id, String(e)); }\n }\n console.log(`daily_refresh done — ok=${ok} fail=${fail} total=${rows.length}`);\n}\n",[181],"23f10352-f0f7-4b8f-a048-275ffab6ffaa","broadcast.ts","4a2692e0-7e82-11f1-9526-1607ee4eb77e",60,["D",1783933117291],7,"// Announce a release. Run this by hand when a \"what's new\" popup goes out.\n// Only reaches people who left \"App updates\" switched on.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { pushToUser } from \"./push.ts\";\n\n// ---- edit these two lines, then run ----\n// Keep this short. The what's-new popup carries the detail — a notification just gets them in.\nconst TITLE = \"New update\";\nconst BODY = \"Come and have a look at what's new.\";\nconst DRY_RUN = true; // safety catch: flip to false only when you actually mean to send\n// ----------------------------------------\n\nconst users = await sqlite.execute(\n `SELECT DISTINCT u.id, u.username FROM mb_users u JOIN mb_push p ON p.user_id = u.id`,\n);\n\nconsole.log(`${DRY_RUN ? \"[DRY RUN] \" : \"\"}\"${TITLE}\"`);\nconsole.log(`${users.rows.length} user(s) have a device subscribed\\n`);\n\nlet total = 0;\nfor (const u of users.rows as any[]) {\n const st: any = (await blob.getJSON(\"bud_\" + u.id)) ?? {};\n const n = st.notify || {};\n if (!n.enabled) { console.log(`@${u.username}: notifications off — skipped`); continue; }\n if (n.updates === false) { console.log(`@${u.username}: opted out of update notices — skipped`); continue; }\n\n if (DRY_RUN) {\n console.log(`@${u.username}: WOULD send`);\n continue;\n }\n const sent = await pushToUser(u.id, { title: TITLE, body: BODY, url: \"/\", tag: \"update\" });\n total += sent;\n console.log(`@${u.username}: sent to ${sent} device(s)`);\n}\n\nconsole.log(`\\n${DRY_RUN ? \"dry run — nothing sent\" : `delivered to ${total} device(s)`}`);\n",[188],"f3bad906-327b-41f0-9d3f-6bbef26f153c",["D",1783994692529],[27],"009c3067-1777-4782-be57-f58725e65b47","backup.ts","5406c3ce-7f28-11f1-9292-1607ee4eb77e",62,["D",1783994661024],"// Daily backup. Runs at 3am NZ.\n//\n// Written the night a bug wrote junk over a live account twice in one second, ate the only\n// previous version, and left a hand-made backup from twelve hours earlier as the sole survivor.\n// That was luck, not a system. This is the system.\n//\n// Two things make it more than just \"copy the file\":\n//\n// 1. It permanently protects the LARGEST version it has ever seen for each user. A budget only\n// grows. So a run of bad writes -- however many -- can never flush the real one out of the\n// backups, which is exactly how the last safety net was defeated.\n//\n// 2. It shouts. If an account suddenly collapses to a fraction of its usual size, that is not\n// normal use, it is corruption. An email goes out the same morning rather than being noticed\n// days later.\n//\n// The backups are of ENCRYPTED data. They are ciphertext, unreadable to whoever holds them --\n// including the person running the backup. They do not undo the encryption.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { email } from \"https://esm.town/v/std/email\";\n\nconst KEEP_DAYS = 14;\nconst SHRINK_ALERT = 0.6; // an account at under 60% of its best-ever size gets flagged\n\nconst sizeOf = (s: any) =>\n !s ? 0\n : s.enc ? (s.ct ? s.ct.length : 0)\n : JSON.stringify(s).length;\n\nconst today = () => new Date().toISOString().slice(0, 10).replace(/-/g, \"\");\nconst dateOfKey = (k: string) => {\n const m = k.match(/_(\\d{8})$/);\n return m ? m[1] : null;\n};\n\nexport default async function () {\n await run();\n}\n\nasync function run() {\n const users = (await sqlite.execute(\"SELECT id, username FROM mb_users ORDER BY created\")).rows as any[];\n const stamp = today();\n const alerts: string[] = [];\n let saved = 0, pruned = 0;\n\n console.log(`backing up ${users.length} user(s) [${stamp}]`);\n\n for (const u of users) {\n const state: any = await blob.getJSON(\"bud_\" + u.id);\n if (!state) { console.log(` @${u.username}: no data, skipping`); continue; }\n\n const size = sizeOf(state);\n const kind = state.enc ? \"encrypted\" : \"PLAINTEXT\";\n\n // --- today's snapshot ---\n const key = \"bak_\" + u.id + \"_\" + stamp;\n await blob.setJSON(key, { saved: Date.now(), username: u.username, size, state });\n\n // verify it actually reads back. A backup you have not read is not a backup.\n const readBack: any = await blob.getJSON(key);\n if (!readBack || sizeOf(readBack.state) !== size) {\n alerts.push(`Backup for @${u.username} did NOT read back correctly.`);\n console.log(` @${u.username}: BACKUP VERIFY FAILED`);\n continue;\n }\n saved++;\n\n // --- the high-water mark: the biggest version ever seen, kept forever ---\n const bestKey = \"bak_\" + u.id + \"_best\";\n const best: any = await blob.getJSON(bestKey);\n const bestSize = best ? best.size : 0;\n\n if (size >= bestSize) {\n await blob.setJSON(bestKey, { saved: Date.now(), username: u.username, size, state });\n console.log(` @${u.username}: ${size} bytes (${kind}) <- new high-water mark`);\n } else {\n const ratio = bestSize ? size / bestSize : 1;\n console.log(` @${u.username}: ${size} bytes (${kind}) best-ever ${bestSize} (${Math.round(ratio * 100)}%)`);\n if (ratio < SHRINK_ALERT) {\n alerts.push(\n `@${u.username} has shrunk to ${size} bytes, from a best-ever ${bestSize} (${Math.round(ratio * 100)}%). ` +\n `That looks like data loss, not normal use. The good version is safe in bak_${u.id}_best.`,\n );\n }\n }\n\n // --- prune anything older than a fortnight (never the high-water mark) ---\n const cutoff = new Date(Date.now() - KEEP_DAYS * 86400000).toISOString().slice(0, 10).replace(/-/g, \"\");\n const all = await blob.list(\"bak_\" + u.id + \"_\");\n for (const b of all as any[]) {\n const d = dateOfKey(b.key);\n if (!d) continue; // \"_best\" has no date: never touched\n if (d < cutoff) { await blob.delete(b.key); pruned++; }\n }\n }\n\n console.log(`\\n${saved} backed up, ${pruned} old snapshots pruned`);\n\n if (alerts.length) {\n console.log(\"\\n!! ALERTS !!\");\n alerts.forEach(a => console.log(\" \" + a));\n try {\n await email({\n subject: \"Stash: possible data loss detected\",\n text: \"The daily backup found something that looks wrong:\\n\\n\" + alerts.map(a => \" - \" + a).join(\"\\n\\n\") +\n \"\\n\\nEvery account's largest-ever version is kept permanently as bak__best, so nothing is gone.\",\n });\n console.log(\" (emailed)\");\n } catch (e) {\n console.log(\" (could not send the email: \" + e + \")\");\n }\n } else {\n console.log(\"nothing looks wrong\");\n }\n}\n",[199],"pulls","branches","forks","envVars",{"_212":214,"_215":59},"connections",{"_212":59,"_213":59},"count","unfilledCount",5,"emptyCount",{"_41":198,"_31":199,"_29":200,"_140":-5,"_39":40,"_38":201,"_142":24,"_36":250,"_13":59,"_32":33,"_34":203,"_23":24,"_145":-5,"_226":251,"_26":252},{"_41":195,"_31":27,"_29":30,"_140":-5,"_39":40,"_38":14,"_142":123,"_36":247,"_13":59,"_32":33,"_34":35,"_23":24,"_145":-5,"_226":248,"_26":249},{"_41":187,"_31":188,"_29":189,"_140":-5,"_39":40,"_38":190,"_142":123,"_36":244,"_13":192,"_32":33,"_34":193,"_23":24,"_145":-5,"_226":245,"_26":246},{"_41":180,"_31":181,"_29":182,"_140":-5,"_39":40,"_38":183,"_142":123,"_36":241,"_13":59,"_32":153,"_34":185,"_23":24,"_145":-5,"_226":242,"_26":243},{"_41":173,"_31":174,"_29":175,"_140":-5,"_39":40,"_38":176,"_142":123,"_36":238,"_13":59,"_32":20,"_34":178,"_23":24,"_145":-5,"_226":239,"_26":240},{"_41":166,"_31":167,"_29":168,"_140":-5,"_39":40,"_38":169,"_142":123,"_36":235,"_13":59,"_32":20,"_34":171,"_23":24,"_145":-5,"_226":236,"_26":237},{"_41":156,"_31":157,"_29":158,"_140":-5,"_39":40,"_38":159,"_142":123,"_36":232,"_13":161,"_32":162,"_34":163,"_23":24,"_145":164,"_226":233,"_26":234},{"_41":147,"_31":148,"_29":149,"_140":-5,"_39":40,"_38":150,"_142":24,"_36":229,"_13":152,"_32":153,"_34":154,"_23":24,"_145":-5,"_226":230,"_26":231},{"_41":137,"_31":138,"_29":139,"_140":-5,"_39":40,"_38":141,"_142":123,"_36":225,"_13":59,"_32":33,"_34":144,"_23":24,"_145":-5,"_226":227,"_26":228},["D",1783923272134],"children",[],[138],["D",1783937530728],[],[148],["D",1783930267820],[],[157],["D",1783660284254],[],[167],["D",1783660306051],[],[174],["D",1783725021934],[],[181],["D",1783933117291],[],[188],["D",1783994692529],[],[27],["D",1783994661024],[],[199],["D",1783644524287],["D",1789525245864],{"_96":95,"_104":100},{"_96":95,"_97":98,"_99":100,"_18":53,"_101":102,"_103":24},{"_13":85,"_31":86,"_41":40,"_87":42,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":43,"_94":95},"ctx",{"_78":-5,"_125":291,"_292":293,"_294":295,"_296":24,"_297":24,"_298":24,"_299":123,"_300":-5,"_301":-7,"_302":-7,"_303":59,"_304":24,"_305":24,"_306":-5,"_307":24,"_308":24,"_309":24,"_310":-5},"ENV",{"_262":263,"_264":265,"_266":86,"_267":268,"_269":270,"_271":272,"_273":274,"_275":276,"_277":278,"_279":280,"_281":282,"_283":284,"_285":286,"_287":288,"_289":290},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v63