[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_271":272,"_273":274},"routes/_app.x.$handle.$name",{"_96":95,"_31":43,"_105":86,"_26":106,"_13":14,"_107":-5,"_11":108,"_109":110,"_111":112,"_113":114,"_115":116,"_20":-5,"_117":-5,"_118":-5,"_119":24,"_120":121,"_122":123,"_124":-5,"_125":-5,"_126":127},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_41":42,"_31":43,"_36":44,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":-5,"_55":24,"_56":-5,"_57":-5,"_58":59,"_60":61,"_62":63,"_64":65,"_66":67,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":24},"version",65,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":33,"_34":35,"_36":37,"_38":14,"_39":40,"_23":24},"previous","deleted",false,"deletedHere","path","restore.ts","latestPath","fileId","f21acc5e-7f28-11f1-959f-1607ee4eb77e","name","fileType","script","content","// Restore a user from a backup.\n//\n// DRY_RUN is true. It will show you exactly what it would do and change nothing. Set it to false\n// only when you are sure. Restoring the wrong snapshot over good data is its own disaster.\n//\n// WHICH: \"best\" -> the largest version ever seen (almost always the one you want)\n// \"20260714\" -> a specific day's snapshot\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst DRY_RUN = true;\nconst USERNAME = \"rileys\";\nconst WHICH = \"best\";\n\nconst sizeOf = (s: any) =>\n !s ? 0 : s.enc ? (s.ct ? s.ct.length : 0) : JSON.stringify(s).length;\nconst t = (ms: any) => (ms ? new Date(Number(ms)).toISOString().replace(\"T\", \" \").slice(0, 19) : \"-\");\n\nconst u = (await sqlite.execute({ sql: \"SELECT id, username FROM mb_users WHERE username = ?\", args: [USERNAME] })).rows[0] as any;\nif (!u) throw new Error(\"no such user: \" + USERNAME);\n\nconsole.log(\"every backup that exists for @\" + USERNAME + \":\\n\");\nconst all = await blob.list(\"bak_\" + u.id + \"_\");\nconst snaps: any[] = [];\nfor (const b of all as any[]) {\n const s: any = await blob.getJSON(b.key);\n snaps.push({ key: b.key, size: s.size, saved: s.saved, state: s.state });\n}\nsnaps.sort((a, b) => b.saved - a.saved);\nsnaps.forEach(s =>\n console.log(\" \" + s.key.padEnd(48) + String(s.size).padStart(8) + \" bytes \" + t(s.saved) +\n (s.key.endsWith(\"_best\") ? \" <- largest ever seen\" : \"\")));\n\nconst live: any = await blob.getJSON(\"bud_\" + u.id);\nconsole.log(\"\\ncurrently live: \" + sizeOf(live) + \" bytes \" + (live?.enc ? \"(encrypted)\" : \"(plaintext)\"));\n\nconst pick = snaps.find(s => s.key.endsWith(\"_\" + WHICH));\nif (!pick) throw new Error(\"no backup matching: \" + WHICH);\n\nconsole.log(\"\\nwould restore: \" + pick.key + \" (\" + pick.size + \" bytes, from \" + t(pick.saved) + \")\");\nif (pick.size < sizeOf(live)) {\n console.log(\"\\n !! WARNING: that backup is SMALLER than what is live right now.\");\n console.log(\" You would be going backwards. Make sure that is what you want.\");\n}\n\nif (DRY_RUN) {\n console.log(\"\\n[DRY RUN] nothing was changed. Set DRY_RUN = false to actually restore.\");\n} else {\n // never destroy what is there, even when it looks like junk\n await blob.setJSON(\"bud_replaced_\" + Date.now(), live);\n await blob.setJSON(\"bud_\" + u.id, pick.state);\n const back: any = await blob.getJSON(\"bud_\" + u.id);\n console.log(\"\\nrestored. now live: \" + sizeOf(back) + \" bytes\");\n console.log(\"identical to the backup:\", JSON.stringify(back) === JSON.stringify(pick.state));\n console.log(\"the version it replaced was parked, not deleted.\");\n}\n","createdAt",["D",1783994926218],"branchVersion","branchId","1d7321a2-4f46-4733-b86a-498e1d666a4b","id","9a8f532d-d413-48dd-9c0f-576fd227edcf","money-budget",["D",1783644524287],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Pocket budgeting app — syncs across phone and laptop","imageUrl","9ce636d8-a261-43ee-aad5-aba0afcc9805","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f497e-7eff-7029-9247-01cc1300f2ae","tursoName","9a8f532dd41348dd9c0f576fd227edcf","tursoHostname","9a8f532dd41348dd9c0f576fd227edcf-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789525245864],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_96":95,"_104":100},"org",{"_96":95,"_97":98,"_99":100,"_18":53,"_101":102,"_103":24},"branch",{"_13":85,"_31":86,"_41":40,"_87":42,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":43,"_94":95},"isOwned",70,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","rileys1011","handle","displayName","Riley Smith","avatar","https://lh3.googleusercontent.com/a/ACg8ocKLn-WocVfdzaKwIdLHV1VQfr-Cu-Zr_dXM84NUtd0tHciAd52i=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_41":42,"_31":43,"_36":266,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":-5,"_55":24,"_56":-5,"_57":-5,"_58":59,"_60":61,"_62":63,"_64":65,"_66":267,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":268,"_80":269,"_82":270,"_84":24},"tree",[225,226,227,228,229,230,231,232,233,234],"files",[225,226,227,228,229,230,231,232,233,234],"counts",{"_214":59,"_215":156,"_216":59,"_217":218,"_219":220},"contents",[128,129,130,131,132,133,134,135,136,137],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_41":206,"_31":207,"_29":208,"_139":-5,"_39":40,"_38":209,"_140":123,"_36":210,"_13":211,"_32":157,"_34":212,"_23":24,"_142":-5,"_26":213},{"_41":199,"_31":200,"_29":201,"_139":-5,"_39":40,"_38":202,"_140":123,"_36":203,"_13":59,"_32":33,"_34":204,"_23":24,"_142":-5,"_26":205},{"_41":191,"_31":192,"_29":193,"_139":-5,"_39":40,"_38":194,"_140":123,"_36":195,"_13":196,"_32":33,"_34":197,"_23":24,"_142":-5,"_26":198},{"_41":184,"_31":185,"_29":186,"_139":-5,"_39":40,"_38":187,"_140":123,"_36":188,"_13":59,"_32":157,"_34":189,"_23":24,"_142":-5,"_26":190},{"_41":177,"_31":178,"_29":179,"_139":-5,"_39":40,"_38":180,"_140":123,"_36":181,"_13":59,"_32":20,"_34":182,"_23":24,"_142":-5,"_26":183},{"_41":170,"_31":171,"_29":172,"_139":-5,"_39":40,"_38":173,"_140":123,"_36":174,"_13":59,"_32":20,"_34":175,"_23":24,"_142":-5,"_26":176},{"_41":160,"_31":161,"_29":162,"_139":-5,"_39":40,"_38":163,"_140":123,"_36":164,"_13":165,"_32":166,"_34":167,"_23":24,"_142":168,"_26":169},{"_41":151,"_31":152,"_29":153,"_139":-5,"_39":40,"_38":154,"_140":24,"_36":155,"_13":156,"_32":157,"_34":158,"_23":24,"_142":-5,"_26":159},{"_41":144,"_31":145,"_29":146,"_139":-5,"_39":40,"_38":147,"_140":123,"_36":148,"_13":59,"_32":33,"_34":149,"_23":24,"_142":-5,"_26":150},{"_41":138,"_31":27,"_29":30,"_139":-5,"_39":40,"_38":14,"_140":123,"_36":141,"_13":59,"_32":33,"_34":35,"_23":24,"_142":-5,"_26":143},"8777907b-99fe-44f9-a204-fb6caea257be","parentId","latest",["D",1783994926218],"label",[27],"c31f8aea-8615-414c-ad4b-6d4c1e0eba66","push.ts","1cf0f1b2-7e82-11f1-b75d-1607ee4eb77e",47,["D",1783923272134],"// Web Push sender (lives on main so the cron can use it).\nimport * as webpush from \"jsr:@negrel/webpush\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst PRIV = JSON.parse(Deno.env.get(\"VAPID_PRIVATE_JWK\") || \"{}\");\n\nfunction vapidJwks() {\n const { kty, crv, x, y, d } = PRIV;\n return {\n publicKey: { kty, crv, x, y, key_ops: [\"verify\"], ext: true },\n privateKey: { kty, crv, x, y, d, key_ops: [\"sign\"], ext: true },\n };\n}\n\nlet _server: any = null;\nasync function server() {\n if (_server) return _server;\n const keys = await webpush.importVapidKeys(vapidJwks() as any, { extractable: false });\n _server = await webpush.ApplicationServer.new({\n contactInformation: \"mailto:rileysmith1272@gmail.com\",\n vapidKeys: keys,\n });\n return _server;\n}\n\nexport type Sub = { endpoint: string; p256dh: string; auth: string };\n\nexport async function sendPush(sub: Sub, payload: Record): Promise {\n try {\n const app = await server();\n const subscriber = app.subscribe({\n endpoint: sub.endpoint,\n keys: { p256dh: sub.p256dh, auth: sub.auth },\n } as any);\n await subscriber.pushTextMessage(JSON.stringify(payload), {});\n return true;\n } catch (e: any) {\n const msg = String(e?.message || e);\n if (msg.includes(\"404\") || msg.includes(\"410\") || msg.includes(\"Gone\") || msg.includes(\"NotFound\")) {\n try { await sqlite.execute({ sql: \"DELETE FROM mb_push WHERE endpoint = ?\", args: [sub.endpoint] }); } catch (_) {}\n return false;\n }\n console.log(\"push failed:\", msg);\n return false;\n }\n}\n\nexport async function pushToUser(userId: string, payload: Record): Promise {\n const r = await sqlite.execute({\n sql: \"SELECT endpoint, p256dh, auth FROM mb_push WHERE user_id = ?\",\n args: [userId],\n });\n let ok = 0;\n for (const s of r.rows as unknown as Sub[]) if (await sendPush(s, payload)) ok++;\n return ok;\n}\n",[145],"9df48367-009a-4bdc-8d66-09747137e322","notify.ts","2fc67780-7e82-11f1-963c-1607ee4eb77e",61,["D",1783937530728],3,"interval","// Daily notification run. Decides what is worth interrupting someone for, and nothing else.\n//\n// This used to read each user's budget. It CAN'T any more -- everything is encrypted with a key\n// only their browser holds. So the app itself does the thinking and leaves behind a \"hint\": a\n// count and a few dates, and nothing else. That is why the wording below is vague. We genuinely\n// do not know what the bill is, who it's to, or how much it's for -- and that's the point.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { pushToUser } from \"./push.ts\";\n\nconst DAY = 86400000;\nconst fmtDay = (ts: number) => new Date(ts).toLocaleDateString(\"en-NZ\", { day: \"numeric\", month: \"short\" });\n\n/** Don't send the same thing every single day. Remembers what we last told each user. */\nasync function seen(userId: string) {\n return ((await blob.getJSON(\"notif_\" + userId)) ?? {}) as Record;\n}\nasync function markSeen(userId: string, s: Record) {\n await blob.setJSON(\"notif_\" + userId, s);\n}\nfunction due(s: Record, key: string, everyDays: number) {\n const last = s[key] || 0;\n return Date.now() - last > everyDays * DAY;\n}\n\nexport default async function () {\n await run();\n}\n\nasync function run() {\n const users = await sqlite.execute(\n `SELECT DISTINCT u.id, u.username FROM mb_users u JOIN mb_push p ON p.user_id = u.id`,\n );\n console.log(`checking ${users.rows.length} user(s) with notifications on`);\n\n for (const u of users.rows as any[]) {\n const h: any = (await blob.getJSON(\"hint_\" + u.id)) ?? null;\n if (!h) { console.log(`@${u.username}: no hints yet (they need to open the app once)`); continue; }\n const n = h.notify || {};\n if (!n.enabled) { console.log(`@${u.username}: notifications off`); continue; }\n\n // A stale hint means they haven't opened the app in a while. Dates in it may have passed, so\n // we don't trust anything older than a fortnight rather than nag about a bill from last month.\n if (Date.now() - (h.updated || 0) > 14 * DAY) {\n console.log(`@${u.username}: hints are stale, staying quiet`);\n continue;\n }\n\n const s = await seen(u.id);\n const sent: string[] = [];\n const now = Date.now();\n\n // --- transactions waiting to be sorted ---\n if (n.inbox !== false) {\n const c = Math.round(h.inbox || 0);\n if (c > 0 && due(s, \"inbox\", 1)) {\n await pushToUser(u.id, {\n title: c === 1 ? \"1 transaction to sort\" : `${c} transactions to sort`,\n body: \"Your bank sent through new activity.\",\n url: \"/\", tag: \"inbox\",\n });\n s.inbox = now; sent.push(\"inbox\");\n }\n }\n\n // --- a bill lands in the next couple of days ---\n // We know WHEN, not what or how much. So we don't pretend to.\n if (n.bills !== false) {\n const ts = h.billTs || 0;\n if (ts > now && ts <= now + 2 * DAY && due(s, \"bills\", 1)) {\n const more = Math.max(0, Math.round(h.billCount || 0) - 1);\n await pushToUser(u.id, {\n title: \"A bill is due \" + fmtDay(ts),\n body: more > 0 ? `Plus ${more} more around the same time. Open Stash for the details.` : \"Open Stash for the details.\",\n url: \"/\", tag: \"bills\",\n });\n s.bills = now; sent.push(\"bills\");\n }\n }\n\n // --- the forecast says you run out of money ---\n if (n.shortfall !== false) {\n const ts = h.shortfallTs || 0;\n if (ts > now && due(s, \"shortfall\", 7)) {\n await pushToUser(u.id, {\n title: \"You are heading for empty\",\n body: `Your forecast runs out around ${fmtDay(ts)}.`,\n url: \"/\", tag: \"shortfall\",\n });\n s.shortfall = now; sent.push(\"shortfall\");\n }\n }\n\n // --- a fixed mortgage rate is about to end ---\n if (n.refix !== false) {\n const ts = h.refixTs || 0;\n const days = ts ? Math.ceil((ts - now) / DAY) : 0;\n if (days > 0 && days <= 90 && due(s, \"refix\", 30)) {\n await pushToUser(u.id, {\n title: \"Your fixed rate is ending\",\n body: `It comes off in ${days} days. Worth shopping around.`,\n url: \"/\", tag: \"refix\",\n });\n s.refix = now; sent.push(\"refix\");\n }\n }\n\n await markSeen(u.id, s);\n console.log(`@${u.username}: ${sent.length ? \"sent \" + sent.join(\", \") : \"nothing worth saying\"}`);\n }\n\n console.log(\"done\");\n}\n",[152],"ebf230aa-365c-4031-83af-057c4c336440","main.tsx","1a504146-7bf9-11f1-b957-1607ee4eb77e",57,["D",1783930267820],8,"http","// The old (pre-multiuser) copy of Stash used to be served from here. It was three days stale and\n// running against the same live database, which meant anyone still on this URL could write bad\n// state. The app now lives at stash.val.run.\n//\n// This branch exists only to host the scheduled jobs (daily_refresh.ts, notify.ts) and the push\n// sender, because Val Town only runs intervals on `main`.\n//\n// Anything hitting the old URL is sent to the real app rather than a dead page — someone may have\n// it bookmarked or installed on a home screen.\nexport default function (req: Request): Response {\n const url = new URL(req.url);\n return Response.redirect(\"https://stash.val.run\" + url.pathname + url.search, 301);\n}\n","riley-pocket-money",[161],"7260bf76-a81e-44c0-bc1e-0c912ff5f09d","icon192.b64","cbf0c2ee-7c1d-11f1-9082-1607ee4eb77e",38,["D",1783660284254],"iVBORw0KGgoAAAANSUhEUgAAAMAAAADACAYAAABS3GwHAAAHFklEQVR42u3de2iVdRzH8c85u3Pryp7U9qBLp3NzUzNtmpQp2ECthKiQBlEEQhDIgoKVRuBDUA4CFUIQIgopEc1q+0OpLBqaq6VtbVlmzuncTKLtTtqc3of+sAfMu3m3e7bd8zvv15/Lmf3u2+/9nnOuZikBZFRVRgTXC1TvsMb612ARMEwK3CJimBS3RcQwKW6LkGFS2DYxw6SbARYhw6RpbRMzTJrWFiHDpGltEzNMmtY2McOkqG1ihklR28QMk6K2iRkmRW0TM0yK2iZmmBS1TcwwKWqbmGFS1DYxw6SobWKGSVHbxAyTorY5JpjEZjrDpCltEfPIa16/UfmZWeoPBpXzyosciAMGeprIygHzVw6ms7ssQQzKOLUWLiGXUtjsNHpZ8yAelw/q7FMXDJ9geWERvKr08b6qphflzdP4t9+W5OZnVd4Kqq5ZpTOXrunMpIF99YBcLPrKAs+WIdmqPyRk5uUqsst5U1p+M9y+aiOMbLtCTz9myVFvzzYWyBznjxzu9YfN2rN+K9v9RuVn5mlmPzNbdfaZ04ry9frDwrJ8LZaFTr/ZjbW3xfeu3d5rvTKG3rIzS0N4uzt1PXWlt1eir9c5f11tvS1r0lFakoxFRK1Tc0KVdff59W1t3wxTdIdC1YFa1dTdG4uz36+/tj57rVUdW+dt15tt87e0/HeZOnRWfHQZ3Zc76e6TZ8AlqDwzPwXi3bF4vqZ8emlUvi3MnjuHF8u8dfPPKSTOTF2u/68/RKzXO3G+aq6P59rH3zdqf2edzxNRWsB0PxydH1WV/xkfWx+f/HxHRJ/nz2SPB13n7ZoxdHafU/nZ/9wRZm7mkNvbHnkl3zzY5+eOOlL39Uu6R9dYcPRr7O6/H6+7pV/LrmHXvHnvo/GO+5o4Y+QZzsRA0XwUwHi6JVL2VVDrqO2Sp+cqm1PJ2vLdHRz+9Xu5Y4Q8Y3iN6/Bhn/gAAAABJRU5ErkJggg==",[171],"04052dc5-44ea-47d4-8fc5-9827a874a999","icon180.b64","d8eed9a4-7c1d-11f1-979a-1607ee4eb77e",39,["D",1783660306051],"iVBORw0KGgoAAAANSUhEUgAAALQAAAC0CAYAAAA9zQYyAAAGyklEQVR42u3dfWhVdRzH8c85u3Pryp7U9qBLp3NzUzNtmpQp2ECthKiQBlEEQhDIgoKVRuBDUA4CFUIQIgopEc1q+0OpLBqaq6VtbVlmzuncTKLtTtqc3of+sAfMu3m3e7bd8zvv15/Lmf3u2+/9nnOuZikBZFRVRgTXC1TvsMb612ARMEwK3CJimBS3RcQwKW6LkGFS2DYxw6SbARYhw6RpbRMzTJrWFiHDpGltEzNMmtY2McOkqG1ihklR28QMk6K2iRkmRW0TM0yK2iZmmBS1TcwwKWqbmGFS1DYxw6SobWKGSVHbxAyTorY5JpjEZjrDpCltEfPIa16/UfmZWeoPBpXzyosciAMGeprIygHzVw6ms7ssQQzKOLUWLiGXUtjsNHpZ8yAelw/q7FMXDJ9geWERvKr08b6qphflzdP4t9+W5OZnVd4Kqq5ZpTOXrunMpIF99YBcLPrKAs+WIdmqPyRk5uUqsst5U1p+M9y+aiOMbLtCTz9myVFvzzYWyBznjxzu9YfN2rN+K9v9RuVn5mlmPzNbdfaZ04ry9frDwrJ8LZaFTr/ZjbW3xfeu3d5rvTKG3rIzS0N4uzt1PXWlt1eir9c5f11tvS1r0lFakoxFRK1Tc0KVdff59W1t3wxTdIdC1YFa1dTdG4uz36+/tj57rVUdW+dt15tt87e0/HeZOnRWfHQZ3Zc76e6TZ8AlqDwzPwXi3bF4vqZ8emlUvi3MnjuHF8u8dfPPKSTOTF2u/68/RKzXO3G+aq6P59rH3zdqf2edzxNRWsB0PxydH1WV/xkfWx+f/HxHRJ/nz2SPB13n7ZoxdHafU/nZ/9wRZm7mkNvbHnkl3zzY5+eOOlL39Uu6R9dYcPRr7O6/H6+7pV/LrmHXvHnvo/GO+5o4Y+QZzsRA0XwUwHi6JVL2VVDrqO2Sp+cqm1PJ2vLdHRz+9Xu5Y4Q8Y3iN6/Bhn/gAAAABJRU5ErkJggg==",[178],"b2f7f845-f3d6-40b7-ba59-2a54ea24dbb8","daily_refresh.ts","869aea5c-7cb4-11f1-9d8a-1607ee4eb77e",46,["D",1783725021934],"// Daily bank refresh for every connected user.\n// Triggers Akahu to pull fresh transactions so each user's inbox is up to date.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst APP_SECRET = Deno.env.get(\"APP_KEY\") || \"dev-secret\";\nconst enc = new TextEncoder();\nconst dec = new TextDecoder();\nfunction fromHex(h: string) { const a = new Uint8Array(h.length / 2); for (let i = 0; i < a.length; i++) a[i] = parseInt(h.substr(i * 2, 2), 16); return a; }\nasync function aesKey() {\n const base = await crypto.subtle.importKey(\"raw\", enc.encode(APP_SECRET), \"PBKDF2\", false, [\"deriveKey\"]);\n return crypto.subtle.deriveKey({ name: \"PBKDF2\", salt: enc.encode(\"mb-bank-salt\"), iterations: 100000, hash: \"SHA-256\" }, base, { name: \"AES-GCM\", length: 256 }, false, [\"encrypt\", \"decrypt\"]);\n}\nasync function decTok(s: string) {\n const [ivh, cth] = s.split(\":\"); const key = await aesKey();\n const pt = await crypto.subtle.decrypt({ name: \"AES-GCM\", iv: fromHex(ivh) }, key, fromHex(cth));\n return dec.decode(pt);\n}\n\nexport default async function () {\n let ok = 0, fail = 0;\n // mb_bank may not exist yet if no one has connected a bank — guard for that.\n let rows: any[] = [];\n try {\n const r = await sqlite.execute(\"SELECT user_id, akahu_user, akahu_app FROM mb_bank\");\n rows = r.rows as any[];\n } catch (e) { console.log(\"no mb_bank yet\", String(e)); return; }\n for (const row of rows) {\n try {\n const U = await decTok(row.akahu_user);\n const A = await decTok(row.akahu_app);\n const resp = await fetch(\"https://api.akahu.io/v1/refresh\", { method: \"POST\", headers: { Authorization: `Bearer ${U}`, \"X-Akahu-Id\": A } });\n if (resp.ok) ok++; else { fail++; console.log(\"refresh non-ok\", row.user_id, resp.status); }\n } catch (e) { fail++; console.log(\"refresh error\", row.user_id, String(e)); }\n }\n console.log(`daily_refresh done — ok=${ok} fail=${fail} total=${rows.length}`);\n}\n",[185],"23f10352-f0f7-4b8f-a048-275ffab6ffaa","broadcast.ts","4a2692e0-7e82-11f1-9526-1607ee4eb77e",60,["D",1783933117291],7,"// Announce a release. Run this by hand when a \"what's new\" popup goes out.\n// Only reaches people who left \"App updates\" switched on.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { pushToUser } from \"./push.ts\";\n\n// ---- edit these two lines, then run ----\n// Keep this short. The what's-new popup carries the detail — a notification just gets them in.\nconst TITLE = \"New update\";\nconst BODY = \"Come and have a look at what's new.\";\nconst DRY_RUN = true; // safety catch: flip to false only when you actually mean to send\n// ----------------------------------------\n\nconst users = await sqlite.execute(\n `SELECT DISTINCT u.id, u.username FROM mb_users u JOIN mb_push p ON p.user_id = u.id`,\n);\n\nconsole.log(`${DRY_RUN ? \"[DRY RUN] \" : \"\"}\"${TITLE}\"`);\nconsole.log(`${users.rows.length} user(s) have a device subscribed\\n`);\n\nlet total = 0;\nfor (const u of users.rows as any[]) {\n const st: any = (await blob.getJSON(\"bud_\" + u.id)) ?? {};\n const n = st.notify || {};\n if (!n.enabled) { console.log(`@${u.username}: notifications off — skipped`); continue; }\n if (n.updates === false) { console.log(`@${u.username}: opted out of update notices — skipped`); continue; }\n\n if (DRY_RUN) {\n console.log(`@${u.username}: WOULD send`);\n continue;\n }\n const sent = await pushToUser(u.id, { title: TITLE, body: BODY, url: \"/\", tag: \"update\" });\n total += sent;\n console.log(`@${u.username}: sent to ${sent} device(s)`);\n}\n\nconsole.log(`\\n${DRY_RUN ? \"dry run — nothing sent\" : `delivered to ${total} device(s)`}`);\n",[192],"f3bad906-327b-41f0-9d3f-6bbef26f153c","backup_now.ts","66d002a4-7f28-11f1-b6a5-1607ee4eb77e",63,["D",1783994692529],"// Run the daily backup by hand. (The cron calls backup.ts's default export on its own.)\nimport backup from \"./backup.ts\";\nawait backup();\n",[200],"1115b7e1-11a6-4e20-b5f2-c6cf68c8b22f","backup.ts","5406c3ce-7f28-11f1-9292-1607ee4eb77e",64,["D",1783994759193],1,"// Daily backup. Runs at 3am NZ.\n//\n// Written the night a bug wrote junk over a live account twice in one second, ate the only\n// previous version, and left a hand-made backup from twelve hours earlier as the sole survivor.\n// That was luck, not a system. This is the system.\n//\n// Two things make it more than just \"copy the file\":\n//\n// 1. It permanently protects the LARGEST version it has ever seen for each user. A budget only\n// grows. So a run of bad writes -- however many -- can never flush the real one out of the\n// backups, which is exactly how the last safety net was defeated.\n//\n// 2. It shouts. If an account suddenly collapses to a fraction of its usual size, that is not\n// normal use, it is corruption. An email goes out the same morning rather than being noticed\n// days later.\n//\n// The backups are of ENCRYPTED data. They are ciphertext, unreadable to whoever holds them --\n// including the person running the backup. They do not undo the encryption.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { email } from \"https://esm.town/v/std/email\";\n\nconst KEEP_DAYS = 14;\nconst SHRINK_ALERT = 0.6; // an account at under 60% of its best-ever size gets flagged\n\nconst sizeOf = (s: any) =>\n !s ? 0\n : s.enc ? (s.ct ? s.ct.length : 0)\n : JSON.stringify(s).length;\n\nconst today = () => new Date().toISOString().slice(0, 10).replace(/-/g, \"\");\nconst dateOfKey = (k: string) => {\n const m = k.match(/_(\\d{8})$/);\n return m ? m[1] : null;\n};\n\nexport default async function () {\n await run();\n}\n\nasync function run() {\n const users = (await sqlite.execute(\"SELECT id, username FROM mb_users ORDER BY created\")).rows as any[];\n const stamp = today();\n const alerts: string[] = [];\n let saved = 0, pruned = 0;\n\n console.log(`backing up ${users.length} user(s) [${stamp}]`);\n\n for (const u of users) {\n const state: any = await blob.getJSON(\"bud_\" + u.id);\n if (!state) { console.log(` @${u.username}: no data, skipping`); continue; }\n\n const size = sizeOf(state);\n const kind = state.enc ? \"encrypted\" : \"PLAINTEXT\";\n\n // --- today's snapshot ---\n const key = \"bak_\" + u.id + \"_\" + stamp;\n await blob.setJSON(key, { saved: Date.now(), username: u.username, size, state });\n\n // verify it actually reads back. A backup you have not read is not a backup.\n const readBack: any = await blob.getJSON(key);\n if (!readBack || sizeOf(readBack.state) !== size) {\n alerts.push(`Backup for @${u.username} did NOT read back correctly.`);\n console.log(` @${u.username}: BACKUP VERIFY FAILED`);\n continue;\n }\n saved++;\n\n // --- the high-water mark: the biggest version ever seen, kept forever ---\n const bestKey = \"bak_\" + u.id + \"_best\";\n const best: any = await blob.getJSON(bestKey);\n const bestSize = best ? best.size : 0;\n\n if (size >= bestSize) {\n await blob.setJSON(bestKey, { saved: Date.now(), username: u.username, size, state });\n console.log(` @${u.username}: ${size} bytes (${kind}) <- new high-water mark`);\n } else {\n const ratio = bestSize ? size / bestSize : 1;\n console.log(` @${u.username}: ${size} bytes (${kind}) best-ever ${bestSize} (${Math.round(ratio * 100)}%)`);\n if (ratio < SHRINK_ALERT) {\n alerts.push(\n `@${u.username} has shrunk to ${size} bytes, from a best-ever ${bestSize} (${Math.round(ratio * 100)}%). ` +\n `That looks like data loss, not normal use. The good version is safe in bak_${u.id}_best.`,\n );\n }\n }\n\n // --- prune anything older than a fortnight (never the high-water mark) ---\n const cutoff = new Date(Date.now() - KEEP_DAYS * 86400000).toISOString().slice(0, 10).replace(/-/g, \"\");\n const all = await blob.list(\"bak_\" + u.id + \"_\");\n for (const b of all as any[]) {\n const d = dateOfKey(b.key);\n if (!d) continue; // \"_best\" has no date: never touched\n if (d < cutoff) { await blob.delete(b.key); pruned++; }\n }\n }\n\n console.log(`\\n${saved} backed up, ${pruned} old snapshots pruned`);\n\n if (alerts.length) {\n console.log(\"\\n!! ALERTS !!\");\n alerts.forEach(a => console.log(\" \" + a));\n try {\n await email({\n subject: \"Stash: possible data loss detected\",\n text: \"The daily backup found something that looks wrong:\\n\\n\" + alerts.map(a => \" - \" + a).join(\"\\n\\n\") +\n \"\\n\\nEvery account's largest-ever version is kept permanently as bak__best, so nothing is gone.\",\n });\n console.log(\" (emailed)\");\n } catch (e) {\n console.log(\" (could not send the email: \" + e + \")\");\n }\n } else {\n console.log(\"nothing looks wrong\");\n }\n}\n",[207],"pulls","branches","forks","envVars",{"_221":223,"_224":59},"connections",{"_221":59,"_222":59},"count","unfilledCount",5,"emptyCount",{"_41":206,"_31":207,"_29":208,"_139":-5,"_39":40,"_38":209,"_140":123,"_36":263,"_13":211,"_32":157,"_34":212,"_23":24,"_142":-5,"_236":264,"_26":265},{"_41":199,"_31":200,"_29":201,"_139":-5,"_39":40,"_38":202,"_140":123,"_36":260,"_13":59,"_32":33,"_34":204,"_23":24,"_142":-5,"_236":261,"_26":262},{"_41":191,"_31":192,"_29":193,"_139":-5,"_39":40,"_38":194,"_140":123,"_36":257,"_13":196,"_32":33,"_34":197,"_23":24,"_142":-5,"_236":258,"_26":259},{"_41":184,"_31":185,"_29":186,"_139":-5,"_39":40,"_38":187,"_140":123,"_36":254,"_13":59,"_32":157,"_34":189,"_23":24,"_142":-5,"_236":255,"_26":256},{"_41":177,"_31":178,"_29":179,"_139":-5,"_39":40,"_38":180,"_140":123,"_36":251,"_13":59,"_32":20,"_34":182,"_23":24,"_142":-5,"_236":252,"_26":253},{"_41":170,"_31":171,"_29":172,"_139":-5,"_39":40,"_38":173,"_140":123,"_36":248,"_13":59,"_32":20,"_34":175,"_23":24,"_142":-5,"_236":249,"_26":250},{"_41":160,"_31":161,"_29":162,"_139":-5,"_39":40,"_38":163,"_140":123,"_36":245,"_13":165,"_32":166,"_34":167,"_23":24,"_142":168,"_236":246,"_26":247},{"_41":151,"_31":152,"_29":153,"_139":-5,"_39":40,"_38":154,"_140":24,"_36":242,"_13":156,"_32":157,"_34":158,"_23":24,"_142":-5,"_236":243,"_26":244},{"_41":144,"_31":145,"_29":146,"_139":-5,"_39":40,"_38":147,"_140":123,"_36":239,"_13":59,"_32":33,"_34":149,"_23":24,"_142":-5,"_236":240,"_26":241},{"_41":138,"_31":27,"_29":30,"_139":-5,"_39":40,"_38":14,"_140":123,"_36":235,"_13":59,"_32":33,"_34":35,"_23":24,"_142":-5,"_236":237,"_26":238},["D",1783994926218],"children",[],[27],["D",1783923272134],[],[145],["D",1783937530728],[],[152],["D",1783930267820],[],[161],["D",1783660284254],[],[171],["D",1783660306051],[],[178],["D",1783725021934],[],[185],["D",1783933117291],[],[192],["D",1783994692529],[],[200],["D",1783994759193],[],[207],["D",1783644524287],["D",1789525245864],{"_96":95,"_104":100},{"_96":95,"_97":98,"_99":100,"_18":53,"_101":102,"_103":24},{"_13":85,"_31":86,"_41":40,"_87":42,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":43,"_94":95},"ctx",{"_78":-5,"_125":304,"_305":306,"_307":308,"_309":24,"_310":24,"_311":24,"_312":123,"_313":-5,"_314":-7,"_315":-7,"_316":59,"_317":24,"_318":24,"_319":-5,"_320":24,"_321":24,"_322":24,"_323":-5},"ENV",{"_275":276,"_277":278,"_279":86,"_280":281,"_282":283,"_284":285,"_286":287,"_288":289,"_290":291,"_292":293,"_294":295,"_296":297,"_298":299,"_300":301,"_302":303},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v65