[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_322":323,"_324":325},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_107":-7,"_108":109,"_31":-7,"_110":-5,"_15":111,"_112":113,"_114":115,"_116":117,"_118":119,"_120":-5,"_121":-5,"_122":-5,"_123":54,"_124":125,"_126":127,"_128":-5,"_129":-5,"_130":131},"routes/_app.x.$handle.$name.branches",{"_11":12,"_13":14,"_15":16,"_17":18},"handle","rileys1011","name","money-budget","project",{"_22":30,"_13":14,"_24":52,"_37":-5,"_53":54,"_55":56,"_57":56,"_58":59,"_60":-5,"_61":62,"_63":-5,"_64":54,"_65":-5,"_66":-5,"_67":68,"_69":70,"_71":72,"_73":74,"_75":76,"_77":-5,"_78":79,"_80":79,"_81":82,"_83":82,"_84":82,"_85":79,"_86":79,"_87":88,"_89":90,"_91":92,"_93":54},"branches",[19,20,21],{"_22":45,"_24":46,"_26":47,"_13":48,"_29":30,"_31":49,"_33":38,"_34":50,"_35":51,"_37":-5},{"_22":38,"_24":39,"_26":40,"_13":41,"_29":30,"_31":42,"_33":23,"_34":43,"_35":44,"_37":-5},{"_22":23,"_24":25,"_26":27,"_13":28,"_29":30,"_31":32,"_33":-5,"_34":-5,"_35":36,"_37":-5},"id","1d7321a2-4f46-4733-b86a-498e1d666a4b","createdAt",["D",1783644524292],"updatedAt",["D",1784024173742],"main","projectId","9a8f532d-d413-48dd-9c0f-576fd227edcf","version",70,"forkedBranchId","forkedBranchVersion","lockfileKey","1784024174095-esm.town_v_rileys1011_money-budget@70-main","deletedAt","ed4a7306-ec27-4f91-a09a-f7efb782a629",["D",1783660915265],["D",1785909687930],"multiuser",391,43,"1785909688215-esm.town_v_rileys1011_money-budget@391-multiuser","992028c1-0e1a-4905-b495-6ef0897aceb0",["D",1783925106524],["D",1785909692145],"dev",465,240,"1785909692511-esm.town_v_rileys1011_money-budget@465-dev",["D",1783644524287],"legacyEnvVars",false,"privacy","public","httpPrivacy","description","Pocket budgeting app — syncs across phone and laptop","imageUrl","userId","9ce636d8-a261-43ee-aad5-aba0afcc9805","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f497e-7eff-7029-9247-01cc1300f2ae","tursoName","9a8f532dd41348dd9c0f576fd227edcf","tursoHostname","9a8f532dd41348dd9c0f576fd227edcf-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789525245864],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_106":102},"org",{"_11":12,"_99":100,"_101":102,"_61":62,"_103":104,"_105":54},"branch",{"_31":32,"_13":28,"_22":23,"_29":30,"_33":-5,"_34":-5,"_94":-5,"_95":-5,"_96":-5,"_97":14,"_98":12},"isOwned","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Riley Smith","avatar","https://lh3.googleusercontent.com/a/ACg8ocKLn-WocVfdzaKwIdLHV1VQfr-Cu-Zr_dXM84NUtd0tHciAd52i=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","path","","adoptOrgId",{"_22":30,"_13":14,"_24":317,"_37":-5,"_53":54,"_55":56,"_57":56,"_58":59,"_60":-5,"_61":62,"_63":-5,"_64":54,"_65":-5,"_66":-5,"_67":68,"_69":70,"_71":72,"_73":74,"_75":318,"_77":-5,"_78":79,"_80":79,"_81":82,"_83":82,"_84":82,"_85":79,"_86":79,"_87":319,"_89":320,"_91":321,"_93":54},"tree",[264,265,266,267,268,269,270,271,272,273,274,275,276],"files",[264,265,266,267,268,269,270,271,272,273,274,275,276],"counts",{"_253":68,"_17":254,"_255":68,"_256":257,"_258":259},"contents",[132,133,134,135,136,137,138,139,140,141,142,143,144],"file","upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_22":246,"_13":247,"_147":248,"_149":-5,"_150":23,"_151":249,"_153":127,"_24":250,"_31":214,"_155":175,"_157":251,"_159":54,"_160":-5,"_108":252},{"_22":239,"_13":240,"_147":241,"_149":-5,"_150":23,"_151":242,"_153":127,"_24":243,"_31":68,"_155":156,"_157":244,"_159":54,"_160":-5,"_108":245},{"_22":231,"_13":232,"_147":233,"_149":-5,"_150":23,"_151":234,"_153":127,"_24":235,"_31":236,"_155":156,"_157":237,"_159":54,"_160":-5,"_108":238},{"_22":224,"_13":225,"_147":226,"_149":-5,"_150":23,"_151":227,"_153":127,"_24":228,"_31":68,"_155":175,"_157":229,"_159":54,"_160":-5,"_108":230},{"_22":217,"_13":218,"_147":219,"_149":-5,"_150":23,"_151":220,"_153":127,"_24":221,"_31":68,"_155":156,"_157":222,"_159":54,"_160":-5,"_108":223},{"_22":209,"_13":210,"_147":211,"_149":-5,"_150":23,"_151":212,"_153":127,"_24":213,"_31":214,"_155":175,"_157":215,"_159":54,"_160":-5,"_108":216},{"_22":202,"_13":203,"_147":204,"_149":-5,"_150":23,"_151":205,"_153":127,"_24":206,"_31":68,"_155":120,"_157":207,"_159":54,"_160":-5,"_108":208},{"_22":195,"_13":196,"_147":197,"_149":-5,"_150":23,"_151":198,"_153":127,"_24":199,"_31":68,"_155":120,"_157":200,"_159":54,"_160":-5,"_108":201},{"_22":185,"_13":186,"_147":187,"_149":-5,"_150":23,"_151":188,"_153":127,"_24":189,"_31":190,"_155":191,"_157":192,"_159":54,"_160":193,"_108":194},{"_22":178,"_13":179,"_147":180,"_149":-5,"_150":23,"_151":32,"_153":127,"_24":181,"_31":182,"_155":156,"_157":183,"_159":54,"_160":-5,"_108":184},{"_22":169,"_13":170,"_147":171,"_149":-5,"_150":23,"_151":172,"_153":127,"_24":173,"_31":174,"_155":175,"_157":176,"_159":54,"_160":-5,"_108":177},{"_22":162,"_13":163,"_147":164,"_149":-5,"_150":23,"_151":165,"_153":127,"_24":166,"_31":68,"_155":156,"_157":167,"_159":54,"_160":-5,"_108":168},{"_22":145,"_13":146,"_147":148,"_149":-5,"_150":23,"_151":152,"_153":127,"_24":154,"_31":68,"_155":156,"_157":158,"_159":54,"_160":-5,"_108":161},"8777907b-99fe-44f9-a204-fb6caea257be","restore.ts","fileId","f21acc5e-7f28-11f1-959f-1607ee4eb77e","parentId","branchId","branchVersion",65,"latest",["D",1783994926218],"fileType","script","content","// Restore a user from a backup.\n//\n// DRY_RUN is true. It will show you exactly what it would do and change nothing. Set it to false\n// only when you are sure. Restoring the wrong snapshot over good data is its own disaster.\n//\n// WHICH: \"best\" -> the largest version ever seen (almost always the one you want)\n// \"20260714\" -> a specific day's snapshot\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst DRY_RUN = true;\nconst USERNAME = \"rileys\";\nconst WHICH = \"best\";\n\nconst sizeOf = (s: any) =>\n !s ? 0 : s.enc ? (s.ct ? s.ct.length : 0) : JSON.stringify(s).length;\nconst t = (ms: any) => (ms ? new Date(Number(ms)).toISOString().replace(\"T\", \" \").slice(0, 19) : \"-\");\n\nconst u = (await sqlite.execute({ sql: \"SELECT id, username FROM mb_users WHERE username = ?\", args: [USERNAME] })).rows[0] as any;\nif (!u) throw new Error(\"no such user: \" + USERNAME);\n\nconsole.log(\"every backup that exists for @\" + USERNAME + \":\\n\");\nconst all = await blob.list(\"bak_\" + u.id + \"_\");\nconst snaps: any[] = [];\nfor (const b of all as any[]) {\n const s: any = await blob.getJSON(b.key);\n snaps.push({ key: b.key, size: s.size, saved: s.saved, state: s.state });\n}\nsnaps.sort((a, b) => b.saved - a.saved);\nsnaps.forEach(s =>\n console.log(\" \" + s.key.padEnd(48) + String(s.size).padStart(8) + \" bytes \" + t(s.saved) +\n (s.key.endsWith(\"_best\") ? \" <- largest ever seen\" : \"\")));\n\nconst live: any = await blob.getJSON(\"bud_\" + u.id);\nconsole.log(\"\\ncurrently live: \" + sizeOf(live) + \" bytes \" + (live?.enc ? \"(encrypted)\" : \"(plaintext)\"));\n\nconst pick = snaps.find(s => s.key.endsWith(\"_\" + WHICH));\nif (!pick) throw new Error(\"no backup matching: \" + WHICH);\n\nconsole.log(\"\\nwould restore: \" + pick.key + \" (\" + pick.size + \" bytes, from \" + t(pick.saved) + \")\");\nif (pick.size < sizeOf(live)) {\n console.log(\"\\n !! WARNING: that backup is SMALLER than what is live right now.\");\n console.log(\" You would be going backwards. Make sure that is what you want.\");\n}\n\nif (DRY_RUN) {\n console.log(\"\\n[DRY RUN] nothing was changed. Set DRY_RUN = false to actually restore.\");\n} else {\n // never destroy what is there, even when it looks like junk\n await blob.setJSON(\"bud_replaced_\" + Date.now(), live);\n await blob.setJSON(\"bud_\" + u.id, pick.state);\n const back: any = await blob.getJSON(\"bud_\" + u.id);\n console.log(\"\\nrestored. now live: \" + sizeOf(back) + \" bytes\");\n console.log(\"identical to the backup:\", JSON.stringify(back) === JSON.stringify(pick.state));\n console.log(\"the version it replaced was parked, not deleted.\");\n}\n","deleted","label",[146],"c31f8aea-8615-414c-ad4b-6d4c1e0eba66","push.ts","1cf0f1b2-7e82-11f1-b75d-1607ee4eb77e",47,["D",1783923272134],"// Web Push sender (lives on main so the cron can use it).\nimport * as webpush from \"jsr:@negrel/webpush\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst PRIV = JSON.parse(Deno.env.get(\"VAPID_PRIVATE_JWK\") || \"{}\");\n\nfunction vapidJwks() {\n const { kty, crv, x, y, d } = PRIV;\n return {\n publicKey: { kty, crv, x, y, key_ops: [\"verify\"], ext: true },\n privateKey: { kty, crv, x, y, d, key_ops: [\"sign\"], ext: true },\n };\n}\n\nlet _server: any = null;\nasync function server() {\n if (_server) return _server;\n const keys = await webpush.importVapidKeys(vapidJwks() as any, { extractable: false });\n _server = await webpush.ApplicationServer.new({\n contactInformation: \"mailto:rileysmith1272@gmail.com\",\n vapidKeys: keys,\n });\n return _server;\n}\n\nexport type Sub = { endpoint: string; p256dh: string; auth: string };\n\nexport async function sendPush(sub: Sub, payload: Record): Promise {\n try {\n const app = await server();\n const subscriber = app.subscribe({\n endpoint: sub.endpoint,\n keys: { p256dh: sub.p256dh, auth: sub.auth },\n } as any);\n await subscriber.pushTextMessage(JSON.stringify(payload), {});\n return true;\n } catch (e: any) {\n const msg = String(e?.message || e);\n if (msg.includes(\"404\") || msg.includes(\"410\") || msg.includes(\"Gone\") || msg.includes(\"NotFound\")) {\n try { await sqlite.execute({ sql: \"DELETE FROM mb_push WHERE endpoint = ?\", args: [sub.endpoint] }); } catch (_) {}\n return false;\n }\n console.log(\"push failed:\", msg);\n return false;\n }\n}\n\nexport async function pushToUser(userId: string, payload: Record): Promise {\n const r = await sqlite.execute({\n sql: \"SELECT endpoint, p256dh, auth FROM mb_push WHERE user_id = ?\",\n args: [userId],\n });\n let ok = 0;\n for (const s of r.rows as unknown as Sub[]) if (await sendPush(s, payload)) ok++;\n return ok;\n}\n",[163],"cadb9f64-ada4-42bd-ba1b-177a4895ed1c","notify.ts","2fc67780-7e82-11f1-963c-1607ee4eb77e",69,["D",1784018436248],4,"interval","// Daily notification run. Decides what is worth interrupting someone for, and nothing else.\n//\n// This used to read each user's budget. It CAN'T any more -- everything is encrypted with a key\n// only their browser holds. So the app itself does the thinking and leaves behind a \"hint\": a\n// count and a few dates, and nothing else. That is why the wording below is vague. We genuinely\n// do not know what the bill is, who it's to, or how much it's for -- and that's the point.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { pushToUser } from \"./push.ts\";\n\nconst DAY = 86400000;\nconst fmtDay = (ts: number) => new Date(ts).toLocaleDateString(\"en-NZ\", { day: \"numeric\", month: \"short\" });\n\n/** Don't send the same thing every single day. Remembers what we last told each user. */\nasync function seen(userId: string) {\n return ((await blob.getJSON(\"notif_\" + userId)) ?? {}) as Record;\n}\nasync function markSeen(userId: string, s: Record) {\n await blob.setJSON(\"notif_\" + userId, s);\n}\nfunction due(s: Record, key: string, everyDays: number) {\n const last = s[key] || 0;\n return Date.now() - last > everyDays * DAY;\n}\n\nexport default async function () {\n await run();\n}\n\nasync function run() {\n const users = await sqlite.execute(\n `SELECT DISTINCT u.id, u.username FROM mb_users u JOIN mb_push p ON p.user_id = u.id`,\n );\n console.log(`checking ${users.rows.length} user(s) with notifications on`);\n\n for (const u of users.rows as any[]) {\n const h: any = (await blob.getJSON(\"hint_\" + u.id)) ?? null;\n if (!h) { console.log(`@${u.username}: no hints yet (they need to open the app once)`); continue; }\n const n = h.notify || {};\n if (!n.enabled) { console.log(`@${u.username}: notifications off`); continue; }\n\n // A stale hint means they haven't opened the app in a while. Dates in it may have passed, so\n // we don't trust anything older than a fortnight rather than nag about a bill from last month.\n if (Date.now() - (h.updated || 0) > 14 * DAY) {\n console.log(`@${u.username}: hints are stale, staying quiet`);\n continue;\n }\n\n const s = await seen(u.id);\n const sent: string[] = [];\n const now = Date.now();\n\n // --- transactions waiting to be sorted ---\n if (n.inbox !== false) {\n const c = Math.round(h.inbox || 0);\n if (c > 0 && due(s, \"inbox\", 1)) {\n await pushToUser(u.id, {\n title: c === 1 ? \"1 transaction to sort\" : `${c} transactions to sort`,\n body: \"Your bank sent through new activity.\",\n url: \"/app\", tag: \"inbox\", // \"/\" is the marketing page now\n });\n s.inbox = now; sent.push(\"inbox\");\n }\n }\n\n // --- a bill lands in the next couple of days ---\n // We know WHEN, not what or how much. So we don't pretend to.\n if (n.bills !== false) {\n const ts = h.billTs || 0;\n if (ts > now && ts <= now + 2 * DAY && due(s, \"bills\", 1)) {\n const more = Math.max(0, Math.round(h.billCount || 0) - 1);\n await pushToUser(u.id, {\n title: \"A bill is due \" + fmtDay(ts),\n body: more > 0 ? `Plus ${more} more around the same time. Open Stash for the details.` : \"Open Stash for the details.\",\n url: \"/app\", tag: \"bills\",\n });\n s.bills = now; sent.push(\"bills\");\n }\n }\n\n // --- the forecast says you run out of money ---\n if (n.shortfall !== false) {\n const ts = h.shortfallTs || 0;\n if (ts > now && due(s, \"shortfall\", 7)) {\n await pushToUser(u.id, {\n title: \"You are heading for empty\",\n body: `Your forecast runs out around ${fmtDay(ts)}.`,\n url: \"/app\", tag: \"shortfall\",\n });\n s.shortfall = now; sent.push(\"shortfall\");\n }\n }\n\n // --- a fixed mortgage rate is about to end ---\n if (n.refix !== false) {\n const ts = h.refixTs || 0;\n const days = ts ? Math.ceil((ts - now) / DAY) : 0;\n if (days > 0 && days <= 90 && due(s, \"refix\", 30)) {\n await pushToUser(u.id, {\n title: \"Your fixed rate is ending\",\n body: `It comes off in ${days} days. Worth shopping around.`,\n url: \"/app\", tag: \"refix\",\n });\n s.refix = now; sent.push(\"refix\");\n }\n }\n\n await markSeen(u.id, s);\n console.log(`@${u.username}: ${sent.length ? \"sent \" + sent.join(\", \") : \"nothing worth saying\"}`);\n }\n\n console.log(\"done\");\n}\n",[170],"d6c416c6-0bd2-4fb9-83bb-cd60e4b0739f","make_demo.ts","019f5f62-b70e-7089-a423-4465607fd457",["D",1784024173742],2,"// Creates (or rebuilds) the encrypted demo account. Uses the exact same key derivation as the\n// browser, so the account opens normally with just the username and password.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { DEMO, SUMMARY } from \"./demo_data.ts\";\n\nconst USERNAME = \"demo\";\nconst PASSWORD = \"demo-stash-2026\";\nconst ITER = 250000;\n\nconst te = new TextEncoder(), td = new TextDecoder();\nconst hex = (b: ArrayBuffer) => [...new Uint8Array(b)].map(x => x.toString(16).padStart(2, \"0\")).join(\"\");\nconst rand = (n: number) => hex(crypto.getRandomValues(new Uint8Array(n)).buffer);\nconst fromHex = (h: string) => { const a = new Uint8Array(h.length / 2); for (let i = 0; i < a.length; i++) a[i] = parseInt(h.substr(i * 2, 2), 16); return a; };\nconst b64 = (b: ArrayBuffer) => btoa(String.fromCharCode(...new Uint8Array(b)));\nconst unb64 = (s: string) => Uint8Array.from(atob(s), c => c.charCodeAt(0));\nconst sha256hex = async (s: string) => hex(await crypto.subtle.digest(\"SHA-256\", te.encode(s)));\nconst normCode = (c: string) => String(c || \"\").toUpperCase().replace(/[^A-Z0-9]/g, \"\");\n\nasync function hashPw(pw: string, saltHex: string) {\n const k = await crypto.subtle.importKey(\"raw\", te.encode(pw), \"PBKDF2\", false, [\"deriveBits\"]);\n return hex(await crypto.subtle.deriveBits({ name: \"PBKDF2\", salt: fromHex(saltHex), iterations: 120000, hash: \"SHA-256\" }, k, 256));\n}\nasync function derive(secret: string, saltStr: string, usage: \"bits\" | \"key\"): Promise {\n const base = await crypto.subtle.importKey(\"raw\", te.encode(secret), \"PBKDF2\", false, [\"deriveBits\", \"deriveKey\"]);\n const salt = te.encode(saltStr);\n if (usage === \"bits\") return hex(await crypto.subtle.deriveBits({ name: \"PBKDF2\", salt, iterations: ITER, hash: \"SHA-256\" }, base, 256));\n return crypto.subtle.deriveKey({ name: \"PBKDF2\", salt, iterations: ITER, hash: \"SHA-256\" }, base, { name: \"AES-GCM\", length: 256 }, false, [\"encrypt\", \"decrypt\"]);\n}\nconst authKeyFrom = (pw: string, s: string) => derive(pw, s + \"|auth\", \"bits\") as Promise;\nconst encKeyFrom = (pw: string, s: string) => derive(pw, s + \"|enc\", \"key\") as Promise;\nconst rcKeyFrom = (c: string, s: string) => derive(c, s + \"|rc\", \"key\") as Promise;\nasync function seal(key: CryptoKey, txt: string) {\n const iv = crypto.getRandomValues(new Uint8Array(12));\n return { iv: b64(iv.buffer), ct: b64(await crypto.subtle.encrypt({ name: \"AES-GCM\", iv }, key, te.encode(txt))) };\n}\nasync function open(key: CryptoKey, box: any) {\n return td.decode(await crypto.subtle.decrypt({ name: \"AES-GCM\", iv: unb64(box.iv) }, key, unb64(box.ct)));\n}\nconst dkToKey = (dkHex: string) => crypto.subtle.importKey(\"raw\", fromHex(dkHex), { name: \"AES-GCM\" }, false, [\"encrypt\", \"decrypt\"]);\nfunction makeRecoveryCode() {\n const abc = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n const b = crypto.getRandomValues(new Uint8Array(16));\n let s = \"\"; for (let i = 0; i < 16; i++) s += abc[b[i] % 32];\n return \"STASH-\" + s.slice(0, 4) + \"-\" + s.slice(4, 8) + \"-\" + s.slice(8, 12) + \"-\" + s.slice(12, 16);\n}\n\n/**\n * Rebuild the demo account from scratch.\n *\n * The demo's credentials are PUBLIC -- they go to Akahu, and eventually onto the landing page.\n * That means anybody can log in and change anything in it: rename the pockets, delete the lot,\n * or write something unpleasant where a reviewer will see it. So it cannot be a thing we set up\n * once; it has to be rebuilt on a schedule. `demo_reset.ts` calls this nightly.\n *\n * Exported rather than run at import, so the cron and the manual script share one implementation.\n * Running this file directly still resets the demo -- see the bottom.\n */\nexport async function rebuildDemo() {\n// wipe any previous demo so this can be re-run any time to reset it\n//\n// NOT wiped: mb_logins. The sign-in history is the only record of who has been poking at the demo,\n// and the demo is the one account whose password is public. Blowing that away nightly would mean\n// permanently never being able to answer \"has anyone actually opened this?\" -- a question that has\n// already been asked once, and which could not be answered precisely because a rebuild had eaten\n// the evidence. The rows keep the old user_id and the username 'demo'; they age out after 90 days\n// like everyone else's.\nconst old = await sqlite.execute({ sql: \"SELECT id FROM mb_users WHERE username = ?\", args: [USERNAME] });\nfor (const o of old.rows as any[]) {\n await sqlite.execute({ sql: \"DELETE FROM mb_sessions WHERE user_id = ?\", args: [o.id] });\n await sqlite.execute({ sql: \"DELETE FROM mb_bank WHERE user_id = ?\", args: [o.id] });\n await sqlite.execute({ sql: \"DELETE FROM mb_push WHERE user_id = ?\", args: [o.id] });\n await sqlite.execute({ sql: \"DELETE FROM mb_users WHERE id = ?\", args: [o.id] });\n try { await blob.delete(\"bud_\" + o.id); } catch (_) {}\n try { await blob.delete(\"hint_\" + o.id); } catch (_) {}\n console.log(\"removed the previous demo account (its sign-in history is deliberately kept)\");\n}\n\n// build the identity exactly as the browser would\nconst id = rand(12);\nconst dk = rand(32), kdfSalt = rand(16), rcSalt = rand(16), salt = rand(16);\nconst code = makeRecoveryCode();\nconst authKey = await authKeyFrom(PASSWORD, kdfSalt);\nconst dkPw = JSON.stringify(await seal(await encKeyFrom(PASSWORD, kdfSalt), dk));\nconst dkRc = JSON.stringify(await seal(await rcKeyFrom(normCode(code), rcSalt), dk));\n\n// plan is set EXPLICITLY, and to 'free'. Two reasons, both learned the hard way:\n// - leaving it NULL means it depends on a migration happening to run later. That is exactly how\n// every new signup once silently became Pro.\n// - the demo should show what a real new user actually gets. A demo on a plan nobody can have is\n// a lie, and a lie in a demo is the worst possible place for one.\nawait sqlite.execute({\n sql: `INSERT INTO mb_users (id, username, pass_hash, salt, created, recovery_lookup, kdf_salt, rc_salt, dk_pw, dk_rc, auth_v, plan)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 2, 'free')`,\n args: [id, USERNAME, await hashPw(authKey, salt), salt, Date.now(), await sha256hex(normCode(code)), kdfSalt, rcSalt, dkPw, dkRc],\n});\n\nconst box = await seal(await dkToKey(dk), JSON.stringify(DEMO));\nconst encrypted = { enc: 1, iv: box.iv, ct: box.ct, updated: Date.now() };\nawait blob.setJSON(\"bud_\" + id, encrypted);\n\n// The pristine copy. /api/demo/reset restores from this when a visitor leaves, so whatever they did\n// while looking around does not greet the next person.\n//\n// It has to be written HERE, in the same breath as the account, because the ciphertext is only\n// meaningful against the data key this rebuild just generated. A pristine copy from a previous\n// rebuild would be undecryptable junk -- and the app would show an empty budget, which is precisely\n// the failure the whole \"my account keeps resetting\" saga was about. Same rebuild, same key, same\n// blob. Never separate these two lines.\nawait blob.setJSON(\"demo_clean\", encrypted);\n\n// ---- verify it actually opens, the same way the app will ----\nconst row = (await sqlite.execute({ sql: \"SELECT kdf_salt, dk_pw, pass_hash, salt FROM mb_users WHERE id = ?\", args: [id] })).rows[0] as any;\nconst ok1 = (await hashPw(await authKeyFrom(PASSWORD, row.kdf_salt), row.salt)) === row.pass_hash;\nconst dkBack = await open(await encKeyFrom(PASSWORD, row.kdf_salt), JSON.parse(row.dk_pw));\nconst stored: any = await blob.getJSON(\"bud_\" + id);\nconst back = JSON.parse(await open(await dkToKey(dkBack), stored));\n\nconsole.log(\"\\nlogin with the password works: \", ok1);\nconsole.log(\"data key unwraps: \", dkBack === dk);\nconsole.log(\"budget decrypts back identically: \", JSON.stringify(back) === JSON.stringify(DEMO));\nconsole.log(\"stored blob is ciphertext: \", !!stored.enc && !stored.accounts);\nconsole.log(\"no bank connected: \", (await sqlite.execute({ sql: \"SELECT 1 FROM mb_bank WHERE user_id = ?\", args: [id] })).rows.length === 0);\n\nconst money = (v: number) => \"$\" + v.toLocaleString(\"en-NZ\", { minimumFractionDigits: 2, maximumFractionDigits: 2 });\nconsole.log(\"\\n--- what's in it ---\");\nconsole.log(\" pockets: \", SUMMARY.pockets, \"across 2 accounts\");\nconsole.log(\" transactions: \", SUMMARY.txns, \"over ~9 months\");\nconsole.log(\" net worth graph:\", SUMMARY.snaps, \"daily snapshots\");\nconsole.log(\" inbox: \", DEMO.inbox.length, \"waiting to be sorted\");\nconsole.log(\" bills detected: \", DEMO.bills.length);\nconsole.log(\" goals: \", DEMO.goals.length);\nconsole.log(\" cash: \", money(SUMMARY.cash));\nconsole.log(\" assets: \", money(SUMMARY.assets), \"(house, KiwiSaver, investments, car)\");\nconsole.log(\" debts: \", money(SUMMARY.debts), \"(mortgage w/ fixed+floating splits, car loan)\");\nconsole.log(\" net worth: \", money(SUMMARY.net));\n\nconsole.log(\"\\n=== give these to Akahu ===\");\nconsole.log(\" https://stash.val.run\");\nconsole.log(\" username: \" + USERNAME);\nconsole.log(\" password: \" + PASSWORD);\nconsole.log(\"\\n(recovery code, keep somewhere or ignore: \" + code + \")\");\nconsole.log(\"Re-run this file any time to reset the demo back to a clean state.\");\n\n return { ok: ok1 && dkBack === dk && JSON.stringify(back) === JSON.stringify(DEMO), id };\n}\n\n// Running this file directly resets the demo. Importing it (as the nightly cron does) does not --\n// an import that silently wipes an account would be a nasty little trap to leave lying around.\nif (import.meta.main) await rebuildDemo();\n",[179],"ebf230aa-365c-4031-83af-057c4c336440","main.tsx","1a504146-7bf9-11f1-b957-1607ee4eb77e",57,["D",1783930267820],8,"http","// The old (pre-multiuser) copy of Stash used to be served from here. It was three days stale and\n// running against the same live database, which meant anyone still on this URL could write bad\n// state. The app now lives at stash.val.run.\n//\n// This branch exists only to host the scheduled jobs (daily_refresh.ts, notify.ts) and the push\n// sender, because Val Town only runs intervals on `main`.\n//\n// Anything hitting the old URL is sent to the real app rather than a dead page — someone may have\n// it bookmarked or installed on a home screen.\nexport default function (req: Request): Response {\n const url = new URL(req.url);\n return Response.redirect(\"https://stash.val.run\" + url.pathname + url.search, 301);\n}\n","riley-pocket-money",[186],"7260bf76-a81e-44c0-bc1e-0c912ff5f09d","icon192.b64","cbf0c2ee-7c1d-11f1-9082-1607ee4eb77e",38,["D",1783660284254],"iVBORw0KGgoAAAANSUhEUgAAAMAAAADACAYAAABS3GwHAAAHFklEQVR42u3de2iVdRzH8c85u3Pryp7U9qBLp3NzUzNtmpQp2ECthKiQBlEEQhDIgoKVRuBDUA4CFUIQIgopEc1q+0OpLBqaq6VtbVlmzuncTKLtTtqc3of+sAfMu3m3e7bd8zvv15/Lmf3u2+/9nnOuZikBZFRVRgTXC1TvsMb612ARMEwK3CJimBS3RcQwKW6LkGFS2DYxw6SbARYhw6RpbRMzTJrWFiHDpGltEzNMmtY2McOkqG1ihklR28QMk6K2iRkmRW0TM0yK2iZmmBS1TcwwKWqbmGFS1DYxw6SobWKGSVHbxAyTorY5JpjEZjrDpCltEfPIa16/UfmZWeoPBpXzyosciAMGeprIygHzVw6ms7ssQQzKOLUWLiGXUtjsNHpZ8yAelw/q7FMXDJ9geWERvKr08b6qphflzdP4t9+W5OZnVd4Kqq5ZpTOXrunMpIF99YBcLPrKAs+WIdmqPyRk5uUqsst5U1p+M9y+aiOMbLtCTz9myVFvzzYWyBznjxzu9YfN2rN+K9v9RuVn5mlmPzNbdfaZ04ry9frDwrJ8LZaFTr/ZjbW3xfeu3d5rvTKG3rIzS0N4uzt1PXWlt1eir9c5f11tvS1r0lFakoxFRK1Tc0KVdff59W1t3wxTdIdC1YFa1dTdG4uz36+/tj57rVUdW+dt15tt87e0/HeZOnRWfHQZ3Zc76e6TZ8AlqDwzPwXi3bF4vqZ8emlUvi3MnjuHF8u8dfPPKSTOTF2u/68/RKzXO3G+aq6P59rH3zdqf2edzxNRWsB0PxydH1WV/xkfWx+f/HxHRJ/nz2SPB13n7ZoxdHafU/nZ/9wRZm7mkNvbHnkl3zzY5+eOOlL39Uu6R9dYcPRr7O6/H6+7pV/LrmHXvHnvo/GO+5o4Y+QZzsRA0XwUwHi6JVL2VVDrqO2Sp+cqm1PJ2vLdHRz+9Xu5Y4Q8Y3iN6/Bhn/gAAAABJRU5ErkJggg==",[196],"04052dc5-44ea-47d4-8fc5-9827a874a999","icon180.b64","d8eed9a4-7c1d-11f1-979a-1607ee4eb77e",39,["D",1783660306051],"iVBORw0KGgoAAAANSUhEUgAAALQAAAC0CAYAAAA9zQYyAAAGyklEQVR42u3dfWhVdRzH8c85u3Pryp7U9qBLp3NzUzNtmpQp2ECthKiQBlEEQhDIgoKVRuBDUA4CFUIQIgopEc1q+0OpLBqaq6VtbVlmzuncTKLtTtqc3of+sAfMu3m3e7bd8zvv15/Lmf3u2+/9nnOuZikBZFRVRgTXC1TvsMb612ARMEwK3CJimBS3RcQwKW6LkGFS2DYxw6SbARYhw6RpbRMzTJrWFiHDpGltEzNMmtY2McOkqG1ihklR28QMk6K2iRkmRW0TM0yK2iZmmBS1TcwwKWqbmGFS1DYxw6SobWKGSVHbxAyTorY5JpjEZjrDpCltEfPIa16/UfmZWeoPBpXzyosciAMGeprIygHzVw6ms7ssQQzKOLUWLiGXUtjsNHpZ8yAelw/q7FMXDJ9geWERvKr08b6qphflzdP4t9+W5OZnVd4Kqq5ZpTOXrunMpIF99YBcLPrKAs+WIdmqPyRk5uUqsst5U1p+M9y+aiOMbLtCTz9myVFvzzYWyBznjxzu9YfN2rN+K9v9RuVn5mlmPzNbdfaZ04ry9frDwrJ8LZaFTr/ZjbW3xfeu3d5rvTKG3rIzS0N4uzt1PXWlt1eir9c5f11tvS1r0lFakoxFRK1Tc0KVdff59W1t3wxTdIdC1YFa1dTdG4uz36+/tj57rVUdW+dt15tt87e0/HeZOnRWfHQZ3Zc76e6TZ8AlqDwzPwXi3bF4vqZ8emlUvi3MnjuHF8u8dfPPKSTOTF2u/68/RKzXO3G+aq6P59rH3zdqf2edzxNRWsB0PxydH1WV/xkfWx+f/HxHRJ/nz2SPB13n7ZoxdHafU/nZ/9wRZm7mkNvbHnkl3zzY5+eOOlL39Uu6R9dYcPRr7O6/H6+7pV/LrmHXvHnvo/GO+5o4Y+QZzsRA0XwUwHi6JVL2VVDrqO2Sp+cqm1PJ2vLdHRz+9Xu5Y4Q8Y3iN6/Bhn/gAAAABJRU5ErkJggg==",[203],"2a4dd4d8-c1d2-4df2-8eb8-ec6bed4bec47","demo_reset.ts","019f5f62-b70e-7089-a423-4f9e21b7dd77",67,["D",1784011741967],1,"// Nightly: put the demo account back exactly as it was.\n//\n// The demo's username and password are public by design -- they go to Akahu, and to anyone who\n// wants a look before signing up. Public credentials mean anyone can log in and change anything:\n// rename the pockets, delete the transactions, or leave something obscene where a reviewer or a\n// prospective user will find it. A demo that anyone can vandalise is worse than no demo.\n//\n// So it gets rebuilt every night, from the same data, every time. Nothing in it is real, nothing\n// in it is anyone's, and nothing anyone does to it survives the night.\n//\n// Lives on `main` because that is the only branch where crons run. Runs at 14:30 UTC = 2:30am NZ,\n// half an hour before the backup job, so a wrecked demo is never what gets backed up.\nimport { rebuildDemo } from \"./make_demo.ts\";\n\nexport default async function () {\n const started = Date.now();\n try {\n const r = await rebuildDemo();\n // rebuildDemo verifies its own work: it logs back in, unwraps the key and decrypts the budget.\n // If that check ever fails, the demo is broken and saying so loudly beats a silent green tick.\n if (!r.ok) {\n console.error(\"DEMO RESET FAILED ITS OWN VERIFICATION -- the demo account may not open\");\n throw new Error(\"demo verification failed\");\n }\n console.log(`demo reset ok in ${Date.now() - started}ms`);\n } catch (e) {\n console.error(\"demo reset threw:\", (e as Error).message);\n throw e; // let it show up as a failed run rather than a quiet no-op\n }\n}\n",[210],"be80c881-0222-424a-bb84-48182152e0fc","demo_data.ts","019f5f62-b70e-7089-a423-484ff4f6537b",66,["D",1784011732755],"// Builds a believable 9-month budget for the demo account. Pure data — no side effects.\nconst DAY = 86400000;\nconst NOW = Date.now();\nconst r2 = (v: number) => Math.round((v + Number.EPSILON) * 100) / 100;\nlet seed = 20260713;\nconst rnd = () => { seed = (seed * 1103515245 + 12345) & 0x7fffffff; return seed / 0x7fffffff; };\nconst jitter = (v: number, pct: number) => r2(v * (1 + (rnd() - 0.5) * 2 * pct));\nconst pick = (a: T[]): T => a[Math.floor(rnd() * a.length)];\nlet n = 0;\nconst uid = () => \"demo\" + (n++).toString(36) + Math.floor(rnd() * 1e6).toString(36);\n\nconst DAYS = 274; // ~9 months of history\nconst START = NOW - DAYS * DAY;\n\n// ---- accounts and pockets ----\nconst P = (name: string, amount: number, freq: string, balance: number) => ({ id: uid(), name, balance, amount, freq });\n\nconst everyday = {\n id: uid(),\n name: \"Everyday\",\n showInPayday: true,\n pockets: [\n P(\"Rent\", 260, \"weekly\", 260),\n P(\"Groceries\", 130, \"weekly\", 84.15),\n P(\"Power\", 75, \"fortnightly\", 112.4),\n P(\"Internet\", 45, \"fortnightly\", 45),\n P(\"Phone\", 20, \"fortnightly\", 31.5),\n P(\"Petrol\", 60, \"fortnightly\", 38.2),\n P(\"Eating out\", 55, \"fortnightly\", 22.8),\n P(\"Coffee\", 25, \"fortnightly\", 11.5),\n P(\"Gym\", 25, \"fortnightly\", 25),\n P(\"Subscriptions\", 22, \"fortnightly\", 14.01),\n P(\"Car costs\", 50, \"fortnightly\", 462.75),\n P(\"Clothes\", 30, \"fortnightly\", 187.4),\n P(\"Gifts\", 20, \"fortnightly\", 143.6),\n P(\"Fun money\", 80, \"fortnightly\", 56.9),\n ],\n};\nconst savings = {\n id: uid(),\n name: \"Savings\",\n showInPayday: true,\n pockets: [\n P(\"Emergency fund\", 100, \"fortnightly\", 5240),\n P(\"Holiday\", 120, \"fortnightly\", 2870),\n P(\"House repairs\", 60, \"fortnightly\", 1615),\n ],\n};\nconst accounts = [everyday, savings];\nconst pk = (acc: any, name: string) => acc.pockets.find((p: any) => p.name === name);\n\n// ---- transaction history ----\nconst txns: any[] = [];\nconst spend = (ts: number, acc: any, pocket: any, amount: number, note: string) =>\n txns.push({ id: uid(), ts, type: \"spend\", account: acc.id, pocketId: pocket.id, amount: r2(amount), note, label: pocket.name });\n\nconst SHOPS = [\"New World\", \"Pak'nSave\", \"Countdown\", \"Four Square\"];\nconst CAFES = [\"Coffee Supreme\", \"Mojo\", \"The Daily\", \"Ozone\"];\nconst EATS = [\"Hell Pizza\", \"Burger Fuel\", \"Sal's Pizza\", \"Thai Bowl\", \"Sushi Ichiban\"];\nconst FUEL = [\"Z Energy\", \"BP Connect\", \"Mobil\", \"Gull\"];\n\nfor (let d = 0; d < DAYS; d++) {\n const ts = START + d * DAY + 9 * 3600000 + Math.floor(rnd() * 8 * 3600000);\n const dow = new Date(ts).getDay();\n\n // payday, fortnightly on Thursdays\n if (dow === 4 && Math.floor(d / 7) % 2 === 0) {\n txns.push({ id: uid(), ts, type: \"income\", account: \"\", pocketId: \"\", amount: jitter(2620, 0.06), note: \"Wages\", label: \"Pay\", payday: true });\n }\n if (dow === 2) spend(ts, everyday, pk(everyday, \"Rent\"), 260, \"Rent\"); // weekly\n if (dow === 0 || dow === 4) spend(ts, everyday, pk(everyday, \"Groceries\"), jitter(62, 0.35), pick(SHOPS));\n if (rnd() < 0.55) spend(ts, everyday, pk(everyday, \"Coffee\"), jitter(5.5, 0.2), pick(CAFES));\n if (rnd() < 0.16) spend(ts, everyday, pk(everyday, \"Eating out\"), jitter(28, 0.5), pick(EATS));\n if (d % 12 === 3) spend(ts, everyday, pk(everyday, \"Petrol\"), jitter(78, 0.2), pick(FUEL));\n if (d % 30 === 5) spend(ts, everyday, pk(everyday, \"Power\"), jitter(148, 0.25), \"Contact Energy\");\n if (d % 30 === 9) spend(ts, everyday, pk(everyday, \"Internet\"), 89.95, \"2degrees Broadband\");\n if (d % 30 === 12) spend(ts, everyday, pk(everyday, \"Phone\"), 40, \"One NZ\");\n if (d % 30 === 15) spend(ts, everyday, pk(everyday, \"Subscriptions\"), 24.99, \"Spotify\");\n if (d % 30 === 16) spend(ts, everyday, pk(everyday, \"Subscriptions\"), 19.99, \"Netflix\");\n if (d % 14 === 2) spend(ts, everyday, pk(everyday, \"Gym\"), 24.5, \"Les Mills\");\n if (rnd() < 0.07) spend(ts, everyday, pk(everyday, \"Fun money\"), jitter(35, 0.7), pick([\"Mitre 10\", \"Kmart\", \"The Warehouse\", \"JB Hi-Fi\", \"Whitcoulls\"]));\n if (rnd() < 0.03) spend(ts, everyday, pk(everyday, \"Clothes\"), jitter(75, 0.6), pick([\"Hallenstein\", \"Barkers\", \"Glassons\", \"Rebel Sport\"]));\n if (rnd() < 0.02) spend(ts, everyday, pk(everyday, \"Gifts\"), jitter(45, 0.5), \"Gift\");\n if (rnd() < 0.04) spend(ts, everyday, pk(everyday, \"Car costs\"), jitter(120, 0.8), pick([\"VTNZ\", \"Repco\", \"Tyre shop\", \"Car service\"]));\n}\ntxns.sort((a, b) => a.ts - b.ts);\n\n// ---- bills the app has detected ----\nconst bill = (name: string, amount: number, freq: string, nextInDays: number, kind: string, acc?: any, pocket?: any, extra: any = {}) =>\n Object.assign({ id: uid(), key: \"spend|\" + name.toLowerCase(), name, amount, kind, freq, nextTs: NOW + nextInDays * DAY, account: acc ? acc.id : \"\", pocketId: pocket ? pocket.id : \"\", source: \"auto\" }, extra);\n\nconst bills = [\n bill(\"Wages\", 2620, \"fortnightly\", 4, \"income\", undefined, undefined, { key: \"income|wages\", varies: true, source: \"picked\", sources: [\"wages\"] }),\n bill(\"Rent\", 260, \"weekly\", 1, \"bill\", everyday, pk(everyday, \"Rent\")),\n bill(\"Power\", 148, \"monthly\", 2, \"bill\", everyday, pk(everyday, \"Power\"), { varies: true }),\n bill(\"2degrees Broadband\", 89.95, \"monthly\", 6, \"bill\", everyday, pk(everyday, \"Internet\")),\n bill(\"One NZ\", 40, \"monthly\", 9, \"bill\", everyday, pk(everyday, \"Phone\")),\n bill(\"Spotify\", 24.99, \"monthly\", 12, \"bill\", everyday, pk(everyday, \"Subscriptions\")),\n bill(\"Netflix\", 19.99, \"monthly\", 13, \"bill\", everyday, pk(everyday, \"Subscriptions\")),\n bill(\"Les Mills\", 24.5, \"fortnightly\", 5, \"bill\", everyday, pk(everyday, \"Gym\")),\n];\n\n// ---- things still waiting in the inbox ----\nconst inbox = [\n { id: \"demo_in_1\", date: new Date(NOW - 1 * DAY).toISOString(), amount: -42.9, description: \"PAK N SAVE 4412\", merchant: \"Pak'nSave\", category: \"Groceries\", account: \"Everyday\" },\n { id: \"demo_in_2\", date: new Date(NOW - 1 * DAY).toISOString(), amount: -18.5, description: \"MOJO COFFEE\", merchant: \"Mojo\", category: \"Cafe\", account: \"Everyday\" },\n { id: \"demo_in_3\", date: new Date(NOW - 2 * DAY).toISOString(), amount: -129, description: \"REPCO 118\", merchant: \"Repco\", category: \"Automotive\", account: \"Everyday\" },\n { id: \"demo_in_4\", date: new Date(NOW - 3 * DAY).toISOString(), amount: -64.2, description: \"Z ENERGY GREENLANE\", merchant: \"Z Energy\", category: \"Fuel\", account: \"Everyday\" },\n { id: \"demo_in_5\", date: new Date(NOW - 4 * DAY).toISOString(), amount: -230, description: \"AA INSURANCE PREMIUM\", merchant: \"AA Insurance\", category: \"Insurance\", account: \"Everyday\" },\n];\nconst done = [\n { id: \"demo_dn_1\", date: new Date(NOW - 5 * DAY).toISOString(), amount: -24.99, description: \"SPOTIFY NZ\", merchant: \"Spotify\", category: \"Subscriptions\", account: \"Everyday\", resolution: \"Auto-filed to Subscriptions (rule)\", resolvedAt: NOW - 5 * DAY },\n { id: \"demo_dn_2\", date: new Date(NOW - 6 * DAY).toISOString(), amount: -61.4, description: \"NEW WORLD METRO\", merchant: \"New World\", category: \"Groceries\", account: \"Everyday\", resolution: \"Auto-filed to Groceries (rule)\", resolvedAt: NOW - 6 * DAY },\n { id: \"demo_dn_3\", date: new Date(NOW - 8 * DAY).toISOString(), amount: 2634.18, description: \"SALARY\", merchant: \"\", category: \"\", account: \"Everyday\", resolution: \"Filed as payday\", resolvedAt: NOW - 8 * DAY },\n];\n\nconst rules = [\n { id: uid(), match: \"New World\", account: everyday.id, pocketId: pk(everyday, \"Groceries\").id, mode: \"auto\" },\n { id: uid(), match: \"Pak'nSave\", account: everyday.id, pocketId: pk(everyday, \"Groceries\").id, mode: \"auto\" },\n { id: uid(), match: \"Z Energy\", account: everyday.id, pocketId: pk(everyday, \"Petrol\").id, mode: \"auto\" },\n { id: uid(), match: \"Spotify\", account: everyday.id, pocketId: pk(everyday, \"Subscriptions\").id, mode: \"auto\" },\n { id: uid(), match: \"Transfer to savings\", account: \"\", pocketId: \"\", mode: \"ignore\" },\n];\n\nconst goals = [\n { id: uid(), name: \"Japan trip\", target: 6000, date: \"2027-03-01\", scope: \"pocket\", account: savings.id, pocketId: pk(savings, \"Holiday\").id },\n { id: uid(), name: \"6 months emergency fund\", target: 12000, date: \"\", scope: \"pocket\", account: savings.id, pocketId: pk(savings, \"Emergency fund\").id },\n];\n\n// ---- assets, debts, and the net-worth history behind the graph ----\nconst assets = [\n { id: uid(), name: \"House\", type: \"Property\", balance: 735000, updated: NOW },\n { id: uid(), name: \"KiwiSaver\", type: \"Investment\", balance: 31480, updated: NOW },\n { id: uid(), name: \"Investments\", type: \"Investment\", balance: 9260, updated: NOW },\n { id: uid(), name: \"Car\", type: \"Vehicle\", balance: 11500, updated: NOW },\n];\nconst debts = [\n {\n id: uid(), name: \"Home loan\", kind: \"mortgage\", splits: [\n { id: uid(), name: \"Fixed portion\", type: \"fixed\", balance: 372000, rate: 5.79, repayment: 1180, freq: \"fortnightly\", fixedUntil: new Date(NOW + 61 * DAY).toISOString().slice(0, 10) },\n { id: uid(), name: \"Floating portion\", type: \"floating\", balance: 84000, rate: 7.19, repayment: 320, freq: \"fortnightly\", fixedUntil: \"\" },\n ],\n },\n { id: uid(), name: \"Car loan\", kind: \"loan\", balance: 6180, rate: 9.95, repayment: 145, freq: \"fortnightly\" },\n];\n\nconst cashNow = r2(accounts.reduce((t, a) => t + a.pockets.reduce((x: number, p: any) => x + p.balance, 0), 0));\nconst assetsNow = assets.reduce((t, a) => t + a.balance, 0);\nconst debtsNow = debts.reduce((t: number, d: any) =>\n t + (d.splits ? d.splits.reduce((x: number, s: any) => x + s.balance, 0) : d.balance), 0);\n\n// walk backwards so today's snapshot is exactly what the app shows\nconst snaps: any[] = [];\nfor (let d = DAYS; d >= 0; d--) {\n const ts = NOW - d * DAY;\n const back = d / DAYS;\n const cash = r2(cashNow - back * 3100 + (rnd() - 0.5) * 260);\n const asset = r2(assetsNow - back * 6900 - (rnd() - 0.5) * 400);\n const debt = r2(debtsNow + back * 11800 + (rnd() - 0.5) * 300);\n snaps.push({ d: new Date(ts).toISOString().slice(0, 10), ts, cash, assets: asset, debts: debt, net: r2(cash + asset - debt) });\n}\n\nexport const DEMO = {\n version: 4,\n updated: NOW,\n payFreq: \"fortnightly\",\n accounts,\n paydayLines: [],\n txns,\n inbox,\n handled: [],\n done,\n goals,\n rules,\n autoMatchPockets: true,\n worth: { assets, debts, snaps },\n bills,\n billsSkip: [],\n notify: { enabled: false, updates: true, shortfall: true, bills: true, refix: true, inbox: true },\n};\n\nexport const SUMMARY = {\n txns: txns.length,\n cash: cashNow,\n assets: assetsNow,\n debts: debtsNow,\n net: r2(cashNow + assetsNow - debtsNow),\n snaps: snaps.length,\n pockets: accounts.reduce((t, a) => t + a.pockets.length, 0),\n};\n",[218],"b2f7f845-f3d6-40b7-ba59-2a54ea24dbb8","daily_refresh.ts","869aea5c-7cb4-11f1-9d8a-1607ee4eb77e",46,["D",1783725021934],"// Daily bank refresh for every connected user.\n// Triggers Akahu to pull fresh transactions so each user's inbox is up to date.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst APP_SECRET = Deno.env.get(\"APP_KEY\") || \"dev-secret\";\nconst enc = new TextEncoder();\nconst dec = new TextDecoder();\nfunction fromHex(h: string) { const a = new Uint8Array(h.length / 2); for (let i = 0; i < a.length; i++) a[i] = parseInt(h.substr(i * 2, 2), 16); return a; }\nasync function aesKey() {\n const base = await crypto.subtle.importKey(\"raw\", enc.encode(APP_SECRET), \"PBKDF2\", false, [\"deriveKey\"]);\n return crypto.subtle.deriveKey({ name: \"PBKDF2\", salt: enc.encode(\"mb-bank-salt\"), iterations: 100000, hash: \"SHA-256\" }, base, { name: \"AES-GCM\", length: 256 }, false, [\"encrypt\", \"decrypt\"]);\n}\nasync function decTok(s: string) {\n const [ivh, cth] = s.split(\":\"); const key = await aesKey();\n const pt = await crypto.subtle.decrypt({ name: \"AES-GCM\", iv: fromHex(ivh) }, key, fromHex(cth));\n return dec.decode(pt);\n}\n\nexport default async function () {\n let ok = 0, fail = 0;\n // mb_bank may not exist yet if no one has connected a bank — guard for that.\n let rows: any[] = [];\n try {\n const r = await sqlite.execute(\"SELECT user_id, akahu_user, akahu_app FROM mb_bank\");\n rows = r.rows as any[];\n } catch (e) { console.log(\"no mb_bank yet\", String(e)); return; }\n for (const row of rows) {\n try {\n const U = await decTok(row.akahu_user);\n const A = await decTok(row.akahu_app);\n const resp = await fetch(\"https://api.akahu.io/v1/refresh\", { method: \"POST\", headers: { Authorization: `Bearer ${U}`, \"X-Akahu-Id\": A } });\n if (resp.ok) ok++; else { fail++; console.log(\"refresh non-ok\", row.user_id, resp.status); }\n } catch (e) { fail++; console.log(\"refresh error\", row.user_id, String(e)); }\n }\n console.log(`daily_refresh done — ok=${ok} fail=${fail} total=${rows.length}`);\n}\n",[225],"23f10352-f0f7-4b8f-a048-275ffab6ffaa","broadcast.ts","4a2692e0-7e82-11f1-9526-1607ee4eb77e",60,["D",1783933117291],7,"// Announce a release. Run this by hand when a \"what's new\" popup goes out.\n// Only reaches people who left \"App updates\" switched on.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { pushToUser } from \"./push.ts\";\n\n// ---- edit these two lines, then run ----\n// Keep this short. The what's-new popup carries the detail — a notification just gets them in.\nconst TITLE = \"New update\";\nconst BODY = \"Come and have a look at what's new.\";\nconst DRY_RUN = true; // safety catch: flip to false only when you actually mean to send\n// ----------------------------------------\n\nconst users = await sqlite.execute(\n `SELECT DISTINCT u.id, u.username FROM mb_users u JOIN mb_push p ON p.user_id = u.id`,\n);\n\nconsole.log(`${DRY_RUN ? \"[DRY RUN] \" : \"\"}\"${TITLE}\"`);\nconsole.log(`${users.rows.length} user(s) have a device subscribed\\n`);\n\nlet total = 0;\nfor (const u of users.rows as any[]) {\n const st: any = (await blob.getJSON(\"bud_\" + u.id)) ?? {};\n const n = st.notify || {};\n if (!n.enabled) { console.log(`@${u.username}: notifications off — skipped`); continue; }\n if (n.updates === false) { console.log(`@${u.username}: opted out of update notices — skipped`); continue; }\n\n if (DRY_RUN) {\n console.log(`@${u.username}: WOULD send`);\n continue;\n }\n const sent = await pushToUser(u.id, { title: TITLE, body: BODY, url: \"/\", tag: \"update\" });\n total += sent;\n console.log(`@${u.username}: sent to ${sent} device(s)`);\n}\n\nconsole.log(`\\n${DRY_RUN ? \"dry run — nothing sent\" : `delivered to ${total} device(s)`}`);\n",[232],"f3bad906-327b-41f0-9d3f-6bbef26f153c","backup_now.ts","66d002a4-7f28-11f1-b6a5-1607ee4eb77e",63,["D",1783994692529],"// Run the daily backup by hand. (The cron calls backup.ts's default export on its own.)\nimport backup from \"./backup.ts\";\nawait backup();\n",[240],"1115b7e1-11a6-4e20-b5f2-c6cf68c8b22f","backup.ts","5406c3ce-7f28-11f1-9292-1607ee4eb77e",64,["D",1783994759193],"// Daily backup. Runs at 3am NZ.\n//\n// Written the night a bug wrote junk over a live account twice in one second, ate the only\n// previous version, and left a hand-made backup from twelve hours earlier as the sole survivor.\n// That was luck, not a system. This is the system.\n//\n// Two things make it more than just \"copy the file\":\n//\n// 1. It permanently protects the LARGEST version it has ever seen for each user. A budget only\n// grows. So a run of bad writes -- however many -- can never flush the real one out of the\n// backups, which is exactly how the last safety net was defeated.\n//\n// 2. It shouts. If an account suddenly collapses to a fraction of its usual size, that is not\n// normal use, it is corruption. An email goes out the same morning rather than being noticed\n// days later.\n//\n// The backups are of ENCRYPTED data. They are ciphertext, unreadable to whoever holds them --\n// including the person running the backup. They do not undo the encryption.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { email } from \"https://esm.town/v/std/email\";\n\nconst KEEP_DAYS = 14;\nconst SHRINK_ALERT = 0.6; // an account at under 60% of its best-ever size gets flagged\n\nconst sizeOf = (s: any) =>\n !s ? 0\n : s.enc ? (s.ct ? s.ct.length : 0)\n : JSON.stringify(s).length;\n\nconst today = () => new Date().toISOString().slice(0, 10).replace(/-/g, \"\");\nconst dateOfKey = (k: string) => {\n const m = k.match(/_(\\d{8})$/);\n return m ? m[1] : null;\n};\n\nexport default async function () {\n await run();\n}\n\nasync function run() {\n const users = (await sqlite.execute(\"SELECT id, username FROM mb_users ORDER BY created\")).rows as any[];\n const stamp = today();\n const alerts: string[] = [];\n let saved = 0, pruned = 0;\n\n console.log(`backing up ${users.length} user(s) [${stamp}]`);\n\n for (const u of users) {\n const state: any = await blob.getJSON(\"bud_\" + u.id);\n if (!state) { console.log(` @${u.username}: no data, skipping`); continue; }\n\n const size = sizeOf(state);\n const kind = state.enc ? \"encrypted\" : \"PLAINTEXT\";\n\n // --- today's snapshot ---\n const key = \"bak_\" + u.id + \"_\" + stamp;\n await blob.setJSON(key, { saved: Date.now(), username: u.username, size, state });\n\n // verify it actually reads back. A backup you have not read is not a backup.\n const readBack: any = await blob.getJSON(key);\n if (!readBack || sizeOf(readBack.state) !== size) {\n alerts.push(`Backup for @${u.username} did NOT read back correctly.`);\n console.log(` @${u.username}: BACKUP VERIFY FAILED`);\n continue;\n }\n saved++;\n\n // --- the high-water mark: the biggest version ever seen, kept forever ---\n const bestKey = \"bak_\" + u.id + \"_best\";\n const best: any = await blob.getJSON(bestKey);\n const bestSize = best ? best.size : 0;\n\n if (size >= bestSize) {\n await blob.setJSON(bestKey, { saved: Date.now(), username: u.username, size, state });\n console.log(` @${u.username}: ${size} bytes (${kind}) <- new high-water mark`);\n } else {\n const ratio = bestSize ? size / bestSize : 1;\n console.log(` @${u.username}: ${size} bytes (${kind}) best-ever ${bestSize} (${Math.round(ratio * 100)}%)`);\n if (ratio < SHRINK_ALERT) {\n alerts.push(\n `@${u.username} has shrunk to ${size} bytes, from a best-ever ${bestSize} (${Math.round(ratio * 100)}%). ` +\n `That looks like data loss, not normal use. The good version is safe in bak_${u.id}_best.`,\n );\n }\n }\n\n // --- prune anything older than a fortnight (never the high-water mark) ---\n const cutoff = new Date(Date.now() - KEEP_DAYS * 86400000).toISOString().slice(0, 10).replace(/-/g, \"\");\n const all = await blob.list(\"bak_\" + u.id + \"_\");\n for (const b of all as any[]) {\n const d = dateOfKey(b.key);\n if (!d) continue; // \"_best\" has no date: never touched\n if (d < cutoff) { await blob.delete(b.key); pruned++; }\n }\n }\n\n console.log(`\\n${saved} backed up, ${pruned} old snapshots pruned`);\n\n if (alerts.length) {\n console.log(\"\\n!! ALERTS !!\");\n alerts.forEach(a => console.log(\" \" + a));\n try {\n await email({\n subject: \"Stash: possible data loss detected\",\n text: \"The daily backup found something that looks wrong:\\n\\n\" + alerts.map(a => \" - \" + a).join(\"\\n\\n\") +\n \"\\n\\nEvery account's largest-ever version is kept permanently as bak__best, so nothing is gone.\",\n });\n console.log(\" (emailed)\");\n } catch (e) {\n console.log(\" (could not send the email: \" + e + \")\");\n }\n } else {\n console.log(\"nothing looks wrong\");\n }\n}\n",[247],"pulls",3,"forks","envVars",{"_260":262,"_263":68},"connections",{"_260":68,"_261":68},"count","unfilledCount",5,"emptyCount",{"_22":246,"_13":247,"_147":248,"_149":-5,"_150":23,"_151":249,"_153":127,"_24":314,"_31":214,"_155":175,"_157":251,"_159":54,"_160":-5,"_278":315,"_108":316},{"_22":239,"_13":240,"_147":241,"_149":-5,"_150":23,"_151":242,"_153":127,"_24":311,"_31":68,"_155":156,"_157":244,"_159":54,"_160":-5,"_278":312,"_108":313},{"_22":231,"_13":232,"_147":233,"_149":-5,"_150":23,"_151":234,"_153":127,"_24":308,"_31":236,"_155":156,"_157":237,"_159":54,"_160":-5,"_278":309,"_108":310},{"_22":224,"_13":225,"_147":226,"_149":-5,"_150":23,"_151":227,"_153":127,"_24":305,"_31":68,"_155":175,"_157":229,"_159":54,"_160":-5,"_278":306,"_108":307},{"_22":217,"_13":218,"_147":219,"_149":-5,"_150":23,"_151":220,"_153":127,"_24":302,"_31":68,"_155":156,"_157":222,"_159":54,"_160":-5,"_278":303,"_108":304},{"_22":209,"_13":210,"_147":211,"_149":-5,"_150":23,"_151":212,"_153":127,"_24":299,"_31":214,"_155":175,"_157":215,"_159":54,"_160":-5,"_278":300,"_108":301},{"_22":202,"_13":203,"_147":204,"_149":-5,"_150":23,"_151":205,"_153":127,"_24":296,"_31":68,"_155":120,"_157":207,"_159":54,"_160":-5,"_278":297,"_108":298},{"_22":195,"_13":196,"_147":197,"_149":-5,"_150":23,"_151":198,"_153":127,"_24":293,"_31":68,"_155":120,"_157":200,"_159":54,"_160":-5,"_278":294,"_108":295},{"_22":185,"_13":186,"_147":187,"_149":-5,"_150":23,"_151":188,"_153":127,"_24":290,"_31":190,"_155":191,"_157":192,"_159":54,"_160":193,"_278":291,"_108":292},{"_22":178,"_13":179,"_147":180,"_149":-5,"_150":23,"_151":32,"_153":127,"_24":287,"_31":182,"_155":156,"_157":183,"_159":54,"_160":-5,"_278":288,"_108":289},{"_22":169,"_13":170,"_147":171,"_149":-5,"_150":23,"_151":172,"_153":127,"_24":284,"_31":174,"_155":175,"_157":176,"_159":54,"_160":-5,"_278":285,"_108":286},{"_22":162,"_13":163,"_147":164,"_149":-5,"_150":23,"_151":165,"_153":127,"_24":281,"_31":68,"_155":156,"_157":167,"_159":54,"_160":-5,"_278":282,"_108":283},{"_22":145,"_13":146,"_147":148,"_149":-5,"_150":23,"_151":152,"_153":127,"_24":277,"_31":68,"_155":156,"_157":158,"_159":54,"_160":-5,"_278":279,"_108":280},["D",1783994926218],"children",[],[146],["D",1783923272134],[],[163],["D",1784018436248],[],[170],["D",1784024173742],[],[179],["D",1783930267820],[],[186],["D",1783660284254],[],[196],["D",1783660306051],[],[203],["D",1784011741967],[],[210],["D",1784011732755],[],[218],["D",1783725021934],[],[225],["D",1783933117291],[],[232],["D",1783994692529],[],[240],["D",1783994759193],[],[247],["D",1783644524287],["D",1789525245864],{"_11":12,"_106":102},{"_11":12,"_99":100,"_101":102,"_61":62,"_103":104,"_105":54},{"_31":32,"_13":28,"_22":23,"_29":30,"_33":-5,"_34":-5,"_94":-5,"_95":-5,"_96":-5,"_97":14,"_98":12},"ctx",{"_87":-5,"_129":355,"_356":357,"_358":359,"_360":54,"_361":54,"_362":54,"_363":127,"_364":-5,"_365":-7,"_366":-7,"_367":68,"_368":54,"_369":54,"_370":-5,"_371":54,"_372":54,"_373":54,"_374":-5},"ENV",{"_326":327,"_328":329,"_330":28,"_331":332,"_333":334,"_335":336,"_337":338,"_339":340,"_341":342,"_343":344,"_345":346,"_347":348,"_349":350,"_351":352,"_353":354},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Branches3

Branches
3