Stash

Welcome back

\n Username\n \n Password\n \n

\n \n

New here? Create an account

Enter PIN

Quick unlock

\n \n

Use password instead

\n\n

Stash

Accounts

Inbox

Goals

Stats

\n\n

\n \n \n \n \n

\n\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n",[145],"c8bc0bd01896a55030b2e239feb53e077683ce75e4744041f9cc117ca7ad0ce2","ab7e85aa-dac4-4d18-a091-0d4ec8c857a1","019f4a79-aa80-769e-a1a0-4aa08060a090",["D",1783992377175],183,"\n\n\n\n\n\n\n\n\n\n\n\n\nStash — Pocket Budget\n\n\n\n\n

Stash

Welcome back

\n Username\n \n Password\n \n

\n \n

New here? Create an account

Enter PIN

Quick unlock

\n \n

Use password instead

\n\n

Stash

Accounts

Inbox

Goals

Stats

\n\n

\n \n \n \n \n

\n\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n",[145],"51529d49a81b8b8bb04cf099e87726deff7c4a0f0542504f85956a40921bd5a4",{"_74":289,"_76":-7,"_78":290},{"_74":280,"_76":-7,"_78":281},{"_74":271,"_76":-7,"_78":272},{"_74":262,"_76":-7,"_78":263},{"_74":253,"_76":-7,"_78":254},{"_74":244,"_76":-7,"_78":245},{"_74":235,"_76":-7,"_78":236},{"_74":225,"_76":-7,"_78":226},{"_74":215,"_76":-7,"_78":216},{"_74":206,"_76":-7,"_78":207},{"_74":196,"_76":-7,"_78":197},{"_74":186,"_76":-7,"_78":187},{"_74":177,"_76":-7,"_78":178},"syntax_check.ts",{"_32":179,"_13":177,"_81":180,"_83":-5,"_84":59,"_85":181,"_87":26,"_34":182,"_41":103,"_90":91,"_92":183,"_66":51,"_94":-5,"_95":-7,"_74":184,"_97":185},"a4e58f8f-7d54-45d7-adca-f0e6c9dd55dc","06f523e8-80d4-11f1-a098-1607ee4eb77e",423,["D",1784178356304],"import { readFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n\n/**\n * Parses every inline \n\n\n\n

Spend what's actually yours.

Your bank shows you one number. Rent is in that number. So is power, and the\n car rego you forgot about. Stash splits your pay into pockets, so the balance you see is a\n balance you can trust.

\n Start free\n Look around first →\n

No bank login. · No ads. · \n Encrypted on your device. · Made in New Zealand.

\n\n

Your banking app

$2,431.68

Available balance

Rent, due Thursday?

Power?

Car rego?

Actually spendable?

Stash

$186.40

Actually spendable

Rent, due Thursday$1,100.00

Power$140.00

Car rego$105.28

Savings — don't touch$900.00

Same account. Same money. One of these two numbers is a lie.

\n\n

How it works

Three things, and none of them require handing over your internet banking password.

◑

Pockets, not a lump sum

Rent, groceries, petrol, savings — each gets its own pocket. On payday, Stash shares your\n pay across all of them in a single tap, and the leftover is genuinely leftover.

↥

Drop in a bank statement

Export a PDF or CSV from your banking app. Stash reads it on your device and files each\n transaction against a pocket. It even reconciles against the totals your bank printed, and\n refuses to import if the maths doesn't agree.

↗

See where you're heading

Net worth, assets, debts, and a forecast that tells you if you're about to run out —\n before you run out, rather than after.

\n\n

Your money is nobody else's business.

Your budget is encrypted on your device with a key made from your password. The key never\n leaves your phone. The server stores scrambled text it cannot read — which means nobody who\n runs Stash can see your balances, your transactions or what you spend it on. Not the developer.\n Not anyone who steals the database.

We'd rather tell you the limit than oversell it: read\n exactly what we store, and what encryption can't protect you from.

\n\n

Free. All of it.

Everything above is the whole app. There is no upgrade to buy, and there may\n never be one.

Available now

Everything, forever

Unlimited pockets and accounts
PDF and CSV statement import
Payday, forecasting, net worth
End-to-end encryption
Export or delete your data any time

Not built yet

Automatic bank feed

Only if enough people want it

Transactions arrive on their own
No statement to import
Costs real money to run, so it would be paid
Register interest inside the app
Everything free today stays free

\n\n\n\n\n`;\n}\n",[196],"655833b2ed0d40baa57a2898a83c6f344b12513fb187ce583bdb398f82880aaf","restore_check.ts",{"_32":208,"_13":206,"_81":209,"_83":-5,"_84":59,"_85":210,"_87":26,"_34":211,"_41":202,"_90":91,"_92":212,"_66":51,"_94":-5,"_95":-7,"_74":213,"_97":214},"069e50e3-4904-4314-9c26-e964096b5f6f","febae648-83be-11f1-a922-1607ee4eb77e",439,["D",1784506505722],"import { DOMParser } from \"https://deno.land/x/deno_dom@v0.1.45/deno-dom-wasm.ts\";\nimport { readFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n\n/**\n * Tests the \"put back\" control on ignored History rows.\n *\n * The FIRST version of this test asserted that index.html contained the string\n * `onclick=\"doUndo('restore:'+${JSON.stringify(d.id)})\"`. It passed. The button was completely\n * dead. JSON.stringify emits DOUBLE quotes, the onclick attribute is delimited by double quotes,\n * so the browser terminated the attribute early and the handler was never wired up. The test\n * confirmed I had typed what I intended to type and told me nothing whatsoever about whether it\n * worked -- which is the exact trap already named elsewhere in this repo's tests.\n *\n * So this version does not grep. It runs renderHistory's real row template, parses the HTML it\n * produces, reads the onclick attribute back out of the DOM, and then EXECUTES it against a stub\n * doUndo to prove the right id arrives at the other end.\n */\nconst html = await readFile(\"/index.html\", import.meta.url);\n\nfunction lift(name: string): string {\n const start = html.indexOf(\"function \" + name + \"(\");\n if (start < 0) throw new Error(name + \" not found\");\n let i = html.indexOf(\"{\", start), depth = 0;\n for (; i < html.length; i++) {\n if (html[i] === \"{\") depth++;\n else if (html[i] === \"}\") { depth--; if (depth === 0) { i++; break; } }\n }\n return html.slice(start, i);\n}\n\nlet fails = 0;\nconst ok = (c: boolean, l: string, d = \"\") => {\n if (!c) fails++;\n console.log(`${c ? \"PASS\" : \"FAIL\"} ${l}${!c && d ? \" -- \" + d : \"\"}`);\n};\n\n/* ---------- 1. the state round trip, using the app's real functions ---------- */\nconst F = new Function(\n [lift(\"markHandled\"), lift(\"resolveInbox\"), lift(\"restoreDone\")].join(\"\\n\\n\") +\n \"\\nreturn { resolveInbox, restoreDone };\",\n)();\n\nconst PAYDAY = {\n id: \"imp_epic20jul\", date: \"2026-07-20T00:00:00.000Z\", amount: 365.10,\n description: \"Epic Health H Wages Epic\", merchant: \"\", account: \"Imported\",\n};\nconst s: any = { inbox: [PAYDAY], handled: [], done: [] };\n\nF.resolveInbox(s, \"imp_epic20jul\", \"Ignored\");\nok(s.inbox.length === 0 && s.done.length === 1, \"ignore moves it to History, does not delete it\");\nok(s.done[0].amount === 365.10, \"the amount is untouched\");\n\nF.restoreDone(s, \"imp_epic20jul\");\nok(s.inbox.length === 1 && s.inbox[0].amount === 365.10, \"restoreDone puts it back with its amount\");\nok(!(\"resolution\" in s.inbox[0]), \"the Ignored tag is stripped\");\nok(!s.handled.includes(\"imp_epic20jul\"), \"it is off the handled list, so it will not be re-filtered\");\n\n/* ---------- 2. the ROW, rendered and parsed as real HTML ---------- */\nconst rh = html.slice(html.indexOf(\"function renderHistory\"));\nconst tail = rh.slice(rh.indexOf(\"} else { const d=x.d;\"), rh.indexOf(\"}).join('');\"));\n/* Cut at the END of the return statement. Slicing to the end of `tail` also swallowed the `}` that\n closes the else-block, which is a syntax error the moment you try to compile it. */\nconst rowTemplate = tail.slice(tail.indexOf(\"return `\"), tail.lastIndexOf(\"`;\") + 2);\nok(rowTemplate.startsWith(\"return `\"), \"found the done-row template\");\nok(rowTemplate.endsWith(\"`;\"), \"and cut it cleanly at the end of the return\");\n\nconst renderRow = new Function(\"d\", \"x\", \"esc\", \"money\", `\n const dd = new Date(x.ts);\n const when = dd.toLocaleDateString(undefined,{day:'numeric',month:'short'});\n const inn = d.amount >= 0;\n ${rowTemplate}\n`);\nconst esc = (v: any) => String(v == null ? \"\" : v).replace(/[&<>\"']/g, (c) =>\n ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\", \"'\": \"'\" } as any)[c]);\nconst money = (v: number) => (v < 0 ? \"-$\" : \"$\") + Math.abs(v).toFixed(2);\n\nconst done = { ...PAYDAY, resolution: \"Ignored\", resolvedAt: Date.parse(\"2026-07-20\") };\nconst rowHtml = renderRow(done, { ts: done.resolvedAt }, esc, money);\nconsole.log(\"\\nrendered row:\\n \", rowHtml.replace(/>\\n <\"));\n\nconst doc = new DOMParser().parseFromString(\n `${rowHtml}`, \"text/html\") as any;\n\nconst links = Array.from(doc.querySelectorAll(\".link\")) as any[];\nconst put = links.find((el) => el.textContent.trim() === \"put back\");\nok(!!put, \"the row really contains a 'put back' control after parsing\");\n\nconst handler = put ? put.getAttribute(\"onclick\") : null;\nconsole.log(\"\\nparsed onclick attribute:\", JSON.stringify(handler));\nok(!!handler, \"the control has an onclick attribute that survived parsing\");\n\n/* THE ASSERTIONS THAT WOULD HAVE CAUGHT THE BUG.\n With the JSON.stringify version the attribute parsed as `doUndo('restore:'+` -- truncated at the\n stray double quote, and unrunnable. Balanced quotes and parens are the whole ballgame here. */\nif (handler) {\n ok(handler.includes(\"imp_epic20jul\"), \"the id survived into the attribute\", handler);\n ok((handler.match(/\$/g) || []).length === (handler.match(/\$/g) || []).length,\n \"parentheses in the handler are balanced\", handler);\n ok(!handler.includes('\"'), \"no stray double quote truncating the attribute\", handler);\n}\n\n/* ---------- 3. actually RUN the handler ---------- */\nlet calledWith: string | null = null;\nif (handler) {\n try {\n new Function(\"doUndo\", handler)((tok: string) => { calledWith = tok; });\n ok(true, \"the handler executes without throwing\");\n } catch (e) {\n ok(false, \"the handler executes without throwing\", (e as Error).message);\n }\n}\nok(calledWith === \"restore:imp_epic20jul\",\n \"it calls doUndo with the right restore token\", String(calledWith));\n\n/* ---------- 4. and the token routes to restoreDone ---------- */\nif (calledWith) {\n const id = (calledWith as string).slice(8);\n ok(id === \"imp_epic20jul\", \"doUndo's slice(8) recovers the exact id\", id);\n}\nok(/token\\.indexOf\$'restore:'\$===0/.test(html), \"doUndo recognises restore tokens\");\n\n/* ---------- 5. the existing undo control must be untouched ---------- */\nconst txnRow = rh.slice(rh.indexOf('return `

${label}'));\nok(/onclick=\"doUndo\$'\\$\\{t\\.id\\}'\$\"/.test(txnRow.slice(0, 600)),\n \"the original spend/payday undo control is unchanged\");\n\nconsole.log(`\\n${fails === 0 ? \"ALL CHECKS PASSED\" : fails + \" CHECK(S) FAILED\"}`);\nif (fails) throw new Error(\"put back is not working - do not ship\");\n",[206],"ae1649f35384ac7724ac66a11705e8b91498dc23b6062cc30acfe1352e0d8d56","rehearsal.ts",{"_32":217,"_13":215,"_81":218,"_83":-5,"_84":59,"_85":219,"_87":26,"_34":220,"_41":221,"_90":91,"_92":222,"_66":51,"_94":-5,"_95":-7,"_74":223,"_97":224},"68d948d4-a3ca-43e7-9071-2767ec6b1c3b","019f5f46-f252-7122-a3ed-dcb46c445f23",302,["D",1784024977245],12,"// A STRANGER'S FIRST DAY.\n//\n// Nobody has ever created a Stash account from nothing and used it. Everything built so far has\n// been tested on accounts that already had data in them. This walks the exact path a new person\n// takes, using the real shipped code, and reports what they actually experience.\n//\n// Cleanup only ever touches the throwaway user it created. (An earlier version of this script\n// cleared the whole rate-limit table, which would have unlocked every account on the server.)\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\n(globalThis as any).window = globalThis;\nawait import(\"./csv.js\");\nconst CSV = (globalThis as any).CSV;\n\n// Points at LIVE. To rehearse a change before it ships, swap this for the dev branch's endpoint,\n// run it there, and swap it back before merging.\nconst B = \"https://stash.val.run\";\nconst U = \"zz_new_\" + Math.random().toString(36).slice(2, 6);\nconst PW = \"brand-new-user-1\";\nconst ITER = 250000;\n\nconst te = new TextEncoder(), td = new TextDecoder();\nconst hex = (b: ArrayBuffer) => [...new Uint8Array(b)].map(x => x.toString(16).padStart(2, \"0\")).join(\"\");\nconst rand = (n: number) => hex(crypto.getRandomValues(new Uint8Array(n)).buffer);\nconst fromHex = (h: string) => Uint8Array.from(h.match(/../g)!.map(x => parseInt(x, 16)));\nconst b64 = (b: ArrayBuffer) => btoa(String.fromCharCode(...new Uint8Array(b)));\nconst unb64 = (s: string) => Uint8Array.from(atob(s), c => c.charCodeAt(0));\nconst sha256hex = async (s: string) => hex(await crypto.subtle.digest(\"SHA-256\", te.encode(s)));\nasync function derive(secret: string, salt: string, usage: \"bits\" | \"key\"): Promise {\n const base = await crypto.subtle.importKey(\"raw\", te.encode(secret), \"PBKDF2\", false, [\"deriveBits\", \"deriveKey\"]);\n const s = te.encode(salt);\n if (usage === \"bits\") return hex(await crypto.subtle.deriveBits({ name: \"PBKDF2\", salt: s, iterations: ITER, hash: \"SHA-256\" }, base, 256));\n return crypto.subtle.deriveKey({ name: \"PBKDF2\", salt: s, iterations: ITER, hash: \"SHA-256\" }, base, { name: \"AES-GCM\", length: 256 }, false, [\"encrypt\", \"decrypt\"]);\n}\nconst seal = async (k: CryptoKey, txt: string) => {\n const iv = crypto.getRandomValues(new Uint8Array(12));\n return { iv: b64(iv.buffer), ct: b64(await crypto.subtle.encrypt({ name: \"AES-GCM\", iv }, k, te.encode(txt))) };\n};\nconst open = async (k: CryptoKey, box: any) =>\n td.decode(await crypto.subtle.decrypt({ name: \"AES-GCM\", iv: unb64(box.iv) }, k, unb64(box.ct)));\nconst dkKey = (h: string) => crypto.subtle.importKey(\"raw\", fromHex(h), { name: \"AES-GCM\" }, false, [\"encrypt\", \"decrypt\"]);\nconst post = (p: string, body: any, tok?: string) =>\n fetch(B + p, { method: \"POST\", headers: Object.assign({ \"content-type\": \"application/json\" }, tok ? { authorization: \"Bearer \" + tok } : {}), body: JSON.stringify(body) });\nconst get = (p: string, tok: string) => fetch(B + p, { headers: { authorization: \"Bearer \" + tok }, cache: \"no-store\" as any });\n\nlet pass = 0, fail = 0;\nconst notes: string[] = [];\nconst ok = (n: string, c: boolean, e = \"\") => { if (c) { pass++; console.log(\" ok \" + n); } else { fail++; console.log(\" FAIL \" + n + (e ? \" -> \" + e : \"\")); } };\nconst gap = (s: string) => { notes.push(s); console.log(\" GAP \" + s); };\n\nconsole.log(\"STEP 1 — they sign up\");\nconst DK = rand(32), kdfSalt = rand(16), rcSalt = rand(16);\nconst CODE = \"STASHAAAABBBBCCCCDDDD\";\nconst su = await post(\"/api/signup\", {\n username: U,\n authKey: await derive(PW, kdfSalt + \"|auth\", \"bits\"), kdfSalt, rcSalt,\n dkPw: JSON.stringify(await seal(await derive(PW, kdfSalt + \"|enc\", \"key\"), DK)),\n dkRc: JSON.stringify(await seal(await derive(CODE, rcSalt + \"|rc\", \"key\"), DK)),\n recoveryLookup: await sha256hex(CODE),\n});\nconst sj = await su.json();\nok(\"signup works\", su.status === 200 && !!sj.token, JSON.stringify(sj));\nlet TOK = sj.token;\nconst uid = (await sqlite.execute({ sql: \"SELECT id, plan FROM mb_users WHERE username = ?\", args: [U] })).rows[0] as any;\nok(\"they land on the free plan\", uid.plan === \"free\");\nconst me = await (await get(\"/api/me\", TOK)).json();\nok(\"account is encrypted from the very first moment\", me.v === 2);\n\nconsole.log(\"\\nSTEP 2 — what do they actually SEE?\");\nconst first: any = await (await get(\"/api/state\", TOK)).json();\nconsole.log(\" the server returns:\", JSON.stringify(first));\nif (!first || !first.accounts) {\n gap(\"A brand new account has NO state on the server. Whatever they see is whatever the browser \" +\n \"invents. Nobody has ever looked at that first screen.\");\n}\n\nconsole.log(\"\\nSTEP 3 — they set themselves up (accounts + pockets)\");\nconst budget: any = {\n version: 4, updated: Date.now(), payFreq: \"fortnightly\",\n accounts: [{\n id: \"a1\", name: \"Everyday\", showInPayday: true,\n pockets: [\n { id: \"p1\", name: \"Groceries\", balance: 0, amount: 120, freq: \"fortnightly\" },\n { id: \"p2\", name: \"Petrol\", balance: 0, amount: 60, freq: \"fortnightly\" },\n { id: \"p3\", name: \"Fun\", balance: 0, amount: 80, freq: \"fortnightly\" },\n ],\n }],\n txns: [], inbox: [], handled: [], done: [], goals: [], rules: [],\n autoMatchPockets: true, worth: { assets: [], debts: [], snaps: [] },\n bills: [], billsSkip: [], notify: { enabled: false },\n};\nconst put = async (s: any) => {\n const box = await seal(await dkKey(DK), JSON.stringify(s));\n return post(\"/api/state\", { enc: 1, iv: box.iv, ct: box.ct, updated: Date.now(), loaded: true }, TOK);\n};\nok(\"they can save their first budget\", (await put(budget)).status === 200);\n\nconsole.log(\"\\nSTEP 4 — they import a statement (the only way in, on the free plan)\");\nconst csv = [\n \"Type,Details,Particulars,Code,Reference,Amount,Date\",\n \"Eftpos,COUNTDOWN 4412,,,,-42.90,05/07/2026\",\n \"Eftpos,Z ENERGY,,,,-64.20,06/07/2026\",\n \"Direct Credit,WAGES,SALARY,,,1200.00,03/07/2026\",\n].join(\"\\n\");\nconst det = CSV.read(csv);\nconst built = CSV.build(det, det.map, det.order, \"Everyday\");\nbuilt.items.forEach((i: any) => i.id = CSV.fingerprint(i));\nok(\"the statement parses\", built.items.length === 3, \"got \" + built.items.length);\nok(\" wages arrive as money IN\", built.items.find((i: any) => /wages/i.test(i.description))?.amount === 1200);\nbudget.inbox = built.items;\nok(\"the import saves\", (await put(budget)).status === 200);\n\nconsole.log(\"\\nSTEP 5 — they sort it, and run their first payday\");\nbudget.inbox = [];\nbudget.done = built.items.filter((i: any) => i.amount < 0).map((i: any) => ({ ...i, resolution: \"Filed\" }));\nbudget.txns = [\n { id: \"t1\", ts: Date.now(), type: \"spend\", account: \"a1\", pocketId: \"p1\", amount: 42.9, note: \"Countdown\", label: \"Groceries\" },\n { id: \"t2\", ts: Date.now(), type: \"spend\", account: \"a1\", pocketId: \"p2\", amount: 64.2, note: \"Z Energy\", label: \"Petrol\" },\n { id: \"t3\", ts: Date.now(), type: \"payday\", amount: 260, label: \"Payday\",\n meta: [{ account: \"a1\", pocketId: \"p1\", amount: 120 }, { account: \"a1\", pocketId: \"p2\", amount: 60 }, { account: \"a1\", pocketId: \"p3\", amount: 80 }] },\n];\nbudget.accounts[0].pockets[0].balance = 77.1;\nbudget.accounts[0].pockets[1].balance = -4.2;\nbudget.accounts[0].pockets[2].balance = 80;\nok(\"payday and spends save\", (await put(budget)).status === 200);\n\nconsole.log(\"\\nSTEP 6 — they close the app and come back tomorrow\");\nconst ai = await (await post(\"/api/authinfo\", { username: U })).json();\nconst lg = await (await post(\"/api/login\", { username: U, authKey: await derive(PW, ai.kdfSalt + \"|auth\", \"bits\") })).json();\nok(\"they can log back in\", !!lg.token);\nconst dk2 = await open(await derive(PW, lg.kdfSalt + \"|enc\", \"key\"), JSON.parse(lg.dkPw));\nok(\"their key rebuilds from the password alone\", dk2 === DK);\nconst backState = JSON.parse(await open(await dkKey(dk2), await (await get(\"/api/state\", lg.token)).json()));\nok(\"EVERYTHING is still there\", JSON.stringify(backState) === JSON.stringify(budget));\nok(\" 3 pockets\", backState.accounts[0].pockets.length === 3);\nok(\" the payday is recorded\", backState.txns.some((t: any) => t.type === \"payday\"));\nTOK = lg.token;\n\nconsole.log(\"\\nSTEP 7 — the things they will inevitably want\");\nok(\"bank feed correctly blocked on free\", (await post(\"/api/bank/connect\", { userToken: \"x\", appToken: \"y\" }, TOK)).status === 402);\nok(\"they can register interest in Pro\", (await post(\"/api/waitlist\", { email: \"new@example.com\", wouldPay: \"yes\", price: 5 }, TOK)).status === 200);\nok(\"they can back up their own data\", (await post(\"/api/backup/now\", {}, TOK)).status === 200);\n\nconsole.log(\"\\nSTEP 8 — will they ever get a notification?\");\nconst hint: any = await blob.getJSON(\"hint_\" + uid.id);\nif (!hint) gap(\"No notification hints exist for this user. Hints are only written by the browser, so the nightly cron has nothing to act on until they open the app at least once with notifications on.\");\n\n// ============================================================\nconsole.log(\"\\nSTEP 9 — they change their mind and want to leave\");\n\n// wrong password: refused\nconst bad = await post(\"/api/account/delete\", { authKey: await derive(\"wrong-password\", ai.kdfSalt + \"|auth\", \"bits\"), confirm: U }, TOK);\nok(\"a wrong password cannot delete the account\", bad.status === 403, \"got \" + bad.status);\n\n// right password, but they did not type their username: refused\nconst noConf = await post(\"/api/account/delete\", { authKey: await derive(PW, ai.kdfSalt + \"|auth\", \"bits\"), confirm: \"\" }, TOK);\nok(\"deleting needs the username typed out, not just a tap\", noConf.status === 400, \"got \" + noConf.status);\n\n// still all there\nok(\"nothing was deleted by the failed attempts\", !!(await blob.getJSON(\"bud_\" + uid.id)));\n\n// and now for real\nconst gone = await post(\"/api/account/delete\", { authKey: await derive(PW, ai.kdfSalt + \"|auth\", \"bits\"), confirm: U }, TOK);\nok(\"the account deletes\", gone.status === 200, await gone.text());\n\nconst user = await sqlite.execute({ sql: \"SELECT id FROM mb_users WHERE username = ?\", args: [U] });\nok(\" the user row is gone\", user.rows.length === 0);\nok(\" the budget is gone\", !(await blob.getJSON(\"bud_\" + uid.id)));\nok(\" the previous version is gone\", !(await blob.getJSON(\"bud_prev_\" + uid.id)));\nok(\" the hints are gone\", !(await blob.getJSON(\"hint_\" + uid.id)));\nconst baks = await blob.list(\"bak_\" + uid.id + \"_\");\nok(\" every backup is gone\", (baks as any[]).length === 0, (baks as any[]).length + \" left\");\nconst sess = await sqlite.execute({ sql: \"SELECT token FROM mb_sessions WHERE user_id = ?\", args: [uid.id] });\nok(\" the sessions are gone\", sess.rows.length === 0);\nconst wlrow = await sqlite.execute({ sql: \"SELECT user_id FROM mb_waitlist WHERE user_id = ?\", args: [uid.id] });\nok(\" the waitlist entry is gone\", wlrow.rows.length === 0);\nconst after = await get(\"/api/state\", TOK);\nok(\" their old session no longer works\", after.status === 401);\nconsole.log(\" -> delete means delete. Nothing is left for anyone, including the developer.\");\n\nconsole.log(\"\\n=== cleanup ===\");\nawait sqlite.execute({ sql: \"DELETE FROM mb_throttle WHERE k = ?\", args: [\"login:u:\" + U] });\nawait sqlite.execute({ sql: \"DELETE FROM mb_throttle WHERE k = ?\", args: [\"backup:\" + uid.id] });\nawait sqlite.execute({ sql: \"DELETE FROM mb_throttle WHERE k = ?\", args: [\"pw:\" + uid.id] });\nconsole.log(\"(the account deleted itself, which is rather the point)\");\n\nconsole.log(\"\\n\" + pass + \" ok, \" + fail + \" failed\");\nconsole.log(\"\\n=== WHAT A STRANGER RUNS INTO ===\");\nnotes.forEach((n, i) => console.log(\" \" + (i + 1) + \". \" + n));\n",[215],"9a57f05b231b4e757fb312acc99332d86471584995d5081c380052306a0da276","rc_check.ts",{"_32":227,"_13":225,"_81":228,"_83":-5,"_84":59,"_85":229,"_87":26,"_34":230,"_41":231,"_90":91,"_92":232,"_66":51,"_94":-5,"_95":-7,"_74":233,"_97":234},"feced685-b7bd-460c-854c-f923078a26f0","4328051e-7f86-11f1-bf01-1607ee4eb77e",383,["D",1784035161188],3,"import { readFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n// main.tsx uses std/sqlite/main.ts. std/sqlite2 is a DIFFERENT database -- pointing this check at\n// it made \"no such table: mb_users\" look like a schema failure when it was really a wrong-DB failure.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n/**\n * Checks the recovery-code hardening.\n *\n * Written to test the THING, not my own comments. An earlier test in this repo passed because its\n * regex was matching the explanatory comment I had just written directly above the code, which is\n * worse than no test at all -- it is a test that reports success at the exact moment it should fail.\n * So: every needle below is matched against source with comments STRIPPED.\n */\n\nconst raw = await readFile(\"/index.html\", import.meta.url);\nconst main = await readFile(\"/main.tsx\", import.meta.url);\n\n// strip /* block */ and // line comments and HTML comments, so nothing can match prose\nconst strip = (s: string) =>\n s.replace(/\\/\\*[\\s\\S]*?\\*\\//g, \" \")\n .replace(//g, \" \")\n .replace(/^\\s*\\/\\/.*$/gm, \" \");\n\nconst html = strip(raw);\nconst srv = strip(main);\n\nlet fails = 0;\nconst ok = (cond: boolean, label: string, detail = \"\") => {\n if (!cond) fails++;\n console.log(`${cond ? \"PASS\" : \"FAIL\"} ${label}${detail && !cond ? \" -- \" + detail : \"\"}`);\n};\n\nconsole.log(\"--- client ---\");\n\n// 1. The lock exists and closeSheet is actually wrapped.\nok(/window\\.closeSheet\\s*=\\s*function/.test(html), \"closeSheet is overridden\");\nok(/if\$window\\.__rcLock\$\\s*return;/.test(html), \"the override short-circuits while __rcLock is set\");\n\n// 2. showRecoveryCode sets the lock. If it does not, everything above is decoration.\nconst srcIdx = html.lastIndexOf(\"window.showRecoveryCode\");\nok(srcIdx > -1, \"showRecoveryCode is (re)defined\");\nconst srcBody = html.slice(srcIdx, srcIdx + 400);\nok(/__rcLock\\s*=\\s*true/.test(srcBody), \"showRecoveryCode sets __rcLock = true\");\n\n// 3. MINE must be the last definition, or the old dismissable one wins.\nconst defs = [...html.matchAll(/window\\.showRecoveryCode\\s*=/g)].map((m) => m.index!);\nok(defs.length >= 1, \"showRecoveryCode definitions found\", `${defs.length}`);\n// Cut at the end of the function body, not at a fixed offset. A fixed 400-char window ran straight\n// past the closing brace and swallowed the NEXT statement (the rcDone override), so the \"no rcDone\n// escape\" assertion below failed on code that was not part of the function at all.\nconst defStart = defs[defs.length - 1];\nconst defEnd = html.indexOf(\"};\", defStart);\nconst lastDef = html.slice(defStart, defEnd > -1 ? defEnd + 2 : defStart + 400);\nok(/__rcLock/.test(lastDef), \"the LAST definition of showRecoveryCode is the hardened one\");\n\n// 4. The proof step must not be skippable, and must not leave the code on screen.\nok(/window\\.rcVerify\\s*=/.test(html), \"rcVerify exists\");\nok(/rcFinish\$\$/.test(html), \"rcVerify can reach rcFinish\");\nconst step2 = html.slice(html.indexOf(\"window.rcStep2\"), html.indexOf(\"window.rcVerify\"));\nok(!/esc\$window\\.__rc\$/.test(step2), \"step 2 does NOT print the code on screen\");\nok(/esc\$window\\.__rc\$/.test(html), \"step 1 DOES print the code on screen\");\n\n// 5. rcFinish must clear the lock BEFORE closing, or the wrapper swallows its own closeSheet().\nconst fin = html.slice(html.indexOf(\"function rcFinish\"), html.indexOf(\"function rcFinish\") + 400);\nconst lockClear = fin.indexOf(\"__rcLock = false\");\nconst closeCall = fin.indexOf(\"closeSheet()\");\nok(lockClear > -1 && closeCall > -1 && lockClear < closeCall, \"rcFinish clears the lock before closeSheet()\");\n\n// 6. The old one-tap escape must be gone from the live path.\n// The string onclick=\"rcDone()\" still exists in the OLD showRecoveryCode, which is now dead code\n// (mine is defined later and wins). So grepping the whole file is the wrong test -- it fails on\n// a corpse. What actually matters is: (a) the winning definition does not use it, and (b) rcDone\n// itself no longer skips the proof step, in case anything ever calls it again.\nok(!/rcDone/.test(lastDef), \"the winning showRecoveryCode does not offer an rcDone() escape\");\nconst doneDefs = [...html.matchAll(/window\\.rcDone\\s*=/g)].map((m) => m.index!);\nok(doneDefs.length > 0, \"rcDone is redefined\");\nconst lastDone = html.slice(doneDefs[doneDefs.length - 1], doneDefs[doneDefs.length - 1] + 200);\nok(/rcStep2/.test(lastDone), \"the LAST rcDone routes to the proof step instead of finishing\");\n\n// 7. Scope: the recurring bug in this codebase is reading a top-level `let` off window.\n// STATE/TOKEN/USERNAME/view are `let`. window.TOKEN is undefined, forever, silently.\nconst myBlock = html.slice(html.lastIndexOf(\"RECOVERY CODE HARDENING\") > -1 ? html.lastIndexOf(\"function gv(id)\") : 0);\nok(!/window\\.(TOKEN|STATE|USERNAME|view)\\b/.test(myBlock), \"does not read TOKEN/STATE/USERNAME/view off window\");\n\n// 8. Only colours that actually exist in the palette.\nconst declared = new Set([...raw.matchAll(/--([a-z-]+)\\s*:/g)].map((m) => m[1]));\nconst used = [...myBlock.matchAll(/var\\(--([a-z-]+)/g)].map((m) => m[1]);\nconst bogus = [...new Set(used)].filter((v) => !declared.has(v));\nok(bogus.length === 0, \"every CSS var used is really declared\", bogus.join(\", \"));\n\nconsole.log(\"\\n--- server ---\");\nok(/ADD COLUMN rc_ack INTEGER/.test(srv), \"rc_ack column is added\");\nok(/api\\/account\\/recovery\\/ack/.test(srv), \"the ack endpoint exists\");\nok(/rc_ack\\s*=\\s*\\?/.test(srv), \"the ack endpoint writes rc_ack\");\nok(/rcAck/.test(srv), \"/api/me returns rcAck\");\n\n// Minting a new code MUST reset the flag -- a fresh code has not been saved by anyone.\nconst mints = [...srv.matchAll(/UPDATE mb_users SET recovery_lookup[^\"]*/g)].map((m) => m[0]);\nok(mints.length > 0, \"found the statements that mint a code\", `${mints.length}`);\nok(mints.every((s) => /rc_ack = NULL/.test(s)), \"EVERY code-minting UPDATE clears rc_ack\", mints.filter((s) => !/rc_ack = NULL/.test(s)).join(\" | \"));\n\nconsole.log(\"\\n--- live schema ---\");\nconst cols = await sqlite.execute(\"PRAGMA table_info(mb_users)\");\nconst names = cols.rows.map((r: any) => r[1] ?? r.name);\nok(names.includes(\"rc_ack\"), \"rc_ack exists on the real table\", names.join(\",\"));\n\nconst who = await sqlite.execute(\n \"SELECT username, rc_ack, recovery_lookup IS NOT NULL AS has_rc FROM mb_users ORDER BY username\",\n);\nconsole.log(\"\\nAccounts and whether they have confirmed saving their code:\");\nfor (const r of who.rows as any[]) {\n const [u, ack, has] = [r[0] ?? r.username, r[1] ?? r.rc_ack, r[2] ?? r.has_rc];\n console.log(` ${String(u).padEnd(12)} code:${has ? \"yes\" : \"NO \"} confirmed:${ack ? new Date(Number(ack)).toISOString().slice(0, 10) : \"never\"}`);\n}\n\nconsole.log(`\\n${fails === 0 ? \"ALL CHECKS PASSED\" : fails + \" CHECK(S) FAILED\"}`);\nif (fails) throw new Error(\"recovery-code hardening is not sound - do not ship\");\n",[225],"d8f9c6ef15182411d5216583ddd274cabce28580a9270aba2de7548b7d71e57a","legal.ts",{"_32":237,"_13":235,"_81":238,"_83":-5,"_84":59,"_85":239,"_87":26,"_34":240,"_41":114,"_90":91,"_92":241,"_66":51,"_94":-5,"_95":-7,"_74":242,"_97":243},"609599fb-3b62-4035-a656-71212307fc70","6c25fb36-7f4c-11f1-a48c-1607ee4eb77e",221,["D",1784015454111],"/**\n * Privacy policy and terms, served at /privacy and /terms.\n *\n * These are written against what the code ACTUALLY does -- the sqlite schema, the blob keys, and\n * the hints file were all read before a word of this was written. If you change what Stash stores,\n * change this file in the same commit. A privacy policy that describes a system you no longer run\n * is worse than none: it is a false statement about how you handle someone's money data.\n *\n * Not legal advice, and not written by a lawyer. It is an honest, specific description of the\n * system, written to meet the Privacy Act 2020's information principles. If Stash ever takes money\n * or connects strangers' banks, get it looked at by someone qualified.\n */\n\n// Both confirmed by Riley, 14 Jul 2026.\nconst OPERATOR = \"Riley Smith\";\n\n// A personal address, used deliberately for now. Worth knowing what that costs: it is published on\n// a public page, so it will be scraped and it will get spam, and it ties the project to a personal\n// inbox. The cheap fix, whenever it is wanted, is a domain plus free forwarding (Cloudflare Email\n// Routing) -- change this one line and both pages follow.\nconst CONTACT = \"rileysmith1272@gmail.com\";\nconst UPDATED = \"14 July 2026\";\n\nconst CSS = `\n :root{--bg:#0f1115;--card:#171a21;--ink:#e8eaf0;--dim:#9aa3b2;--line:#252a34;--accent:#5b8cff}\n *{box-sizing:border-box}\n body{margin:0;background:var(--bg);color:var(--ink);\n font:16px/1.65 -apple-system,BlinkMacSystemFont,\"Segoe UI\",Roboto,sans-serif;\n -webkit-text-size-adjust:100%}\n .wrap{max-width:760px;margin:0 auto;padding:28px 20px 80px}\n a{color:var(--accent)}\n .back{display:inline-block;margin-bottom:28px;color:var(--dim);text-decoration:none;font-size:14px}\n .back:hover{color:var(--ink)}\n h1{font-size:28px;margin:0 0 6px;letter-spacing:-.3px}\n .upd{color:var(--dim);font-size:13px;margin:0 0 28px}\n h2{font-size:19px;margin:36px 0 10px;letter-spacing:-.2px}\n h3{font-size:16px;margin:24px 0 6px}\n p,li{color:#cfd5e0}\n li{margin:6px 0}\n .lede{background:var(--card);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:0 0 8px}\n .lede p{margin:0 0 10px}\n .lede p:last-child{margin:0}\n table{width:100%;border-collapse:collapse;margin:14px 0;font-size:14.5px;display:block;overflow-x:auto}\n th,td{text-align:left;padding:10px 12px;border-bottom:1px solid var(--line);vertical-align:top}\n th{color:var(--dim);font-weight:600;white-space:nowrap}\n code{background:#0b0d11;border:1px solid var(--line);border-radius:5px;padding:1px 5px;font-size:13px}\n .warn{border-left:3px solid #e0a458;background:#1b1710;border-radius:0 10px 10px 0;padding:14px 16px;margin:18px 0}\n .warn strong{color:#f0c07a}\n footer{margin-top:56px;padding-top:20px;border-top:1px solid var(--line);color:var(--dim);font-size:13px}\n`;\n\nconst shell = (title: string, body: string) =>\n `\n\n\n${title} — Stash\n\n

\n← Back to Stash\n${body}\n\n

`;\n\n/* ------------------------------------------------------------------ privacy */\n\nconst PRIVACY = `\n

Privacy Policy

Last updated ${UPDATED}

\n\n

The short version. Your budget is encrypted inside your own browser, with a key\n derived from your password. Stash's server only ever receives the scrambled result. The operator\n cannot read your transactions, balances, pockets or assets — not because of a policy, but because\n the server does not hold the key.

Stash does not sell your data, does not run ads, does not use tracking or analytics, and does not\n share your information with anyone except the small number of suppliers listed below that are needed\n to actually run the app.

There is one honest limit on all of this, and it is set out in full under\n “What encryption does not protect you from”. Please read it.

\n\n

1. Who is responsible

Stash is operated by ${OPERATOR}, an individual based in New Zealand. Under the Privacy Act 2020\nthat makes the operator an “agency”, and this policy explains how your personal information is\nhandled. You can reach us at ${CONTACT}.

\n\n

2. What Stash collects, and why

Only what the app needs to function. There is no analytics, no advertising, no profiling and no\nthird-party trackers on any page.

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

What	Why	Can the operator read it?
Your username	To identify your account.	Yes. It does not have to be your real name, and we suggest it isn't.
Your password	To log you in and to unlock your data.	No — it is never sent to the server. Your browser stretches it into a separate\nlogin key, and only that key is sent. The server stores a salted PBKDF2 hash of that key, so even the\nkey itself is not recoverable from the database.
Your budget — transactions, pockets, balances, assets, bills, notes, history	It is the app.	No. Encrypted with AES-GCM in your browser before it is sent. The server stores\nciphertext and could not decrypt it if it wanted to.
A small “hints” record	So the daily reminder job can decide whether to notify you, without being able to read your budget.	Yes — this part is not encrypted, and you should know exactly what is in it. It\nholds: your notification on/off settings; a count of transactions waiting to be sorted; and up\nto three dates — when your next bill is due, when your forecast runs out of money, and when a\nfixed mortgage rate ends. It contains no amounts, no payees, no account numbers and no descriptions.\nTurn notifications off and it is not used.
Push notification subscription — only if you turn notifications on	To send the reminder to your device.	Yes: an anonymous device address issued by your browser vendor, plus its encryption keys. It\nidentifies a browser, not a person.
Your IP address	Rate limiting only — to stop someone brute-forcing logins.	Yes, briefly. It is stored against a counter that expires automatically (within an hour for\nsignups, 15 minutes for logins) and is then gone.
A session token	To keep you logged in.	Yes. Expires; deleted when you log out.
Your email address — optional, and blank is a perfectly good answer	One thing only: to warn you if there is a security problem with Stash. No\nnewsletters, no product updates, no marketing, ever. If you don't give one, the account works\nexactly the same — you simply can't be warned directly.	Yes. You can add, change or remove it at any time in Settings, and removing it means we hold\nnone.
A record of sign-ins to your account	So you can see whether anyone else has been in it. Every attempt, successful or failed, with the\ntime, the IP address it came from and the browser used. Stash shows this list to you\n— Settings → Recent sign-ins. That is what it is for.	Yes. Kept for 90 days, then deleted automatically. Deleted immediately if you delete your account.\nThis does mean Stash stores your IP address against your account for that period; it is the only way\na sign-in record can tell you anything useful, and we would rather you could catch an intruder than\nprotect you from a fact you already gave your internet provider.
Error reports	So a bug that breaks the app for you gets noticed. Users don't file bug reports, they just stop\nopening the app.	Yes: an error message, a stack trace, the app version and your browser type. Never your\nbudget, balances, transactions or any field value — a stack trace names functions and line\nnumbers, not the numbers in your account.
Feedback you send us	To read it and fix things.	Yes — whatever you choose to type, plus your username.
Waitlist details — only if you fill in the waitlist form	To gauge whether the paid version is worth building, and to tell you if it ships.	Yes: your email address, whether you'd pay, what price you'd pay, and any note. You can ask us to\ndelete this at any time.
Bank connection — not available to anyone at present	Would let Stash fetch transactions automatically via Akahu.	See section 6. This is the one part that would not be end-to-end encrypted, and it\nis switched off for all accounts today.

\n\n

Stash does not ask for your date of birth, your address, your phone number, your IRD number or your\nbank login. It never will. If a page claiming to be Stash asks you for your internet banking password,\nit is not us — close it.

\n\n

3. What Stash does not do

No advertising, and no selling or renting of personal information to anyone, ever.
No analytics or tracking scripts — no Google Analytics, no pixels, no fingerprinting.
No sharing of your financial data with any third party.
No emails to you other than ones you have asked for or that we are legally required to send.

\n\n

4. What encryption does not protect you from

This is the part most apps leave out, so here it is plainly.

Stash's encryption happens in JavaScript that the Stash server sends to your browser. That\nmeans the encryption protects you from the server reading stored data — a leaked database, a\nstolen backup, a curious operator — and it does so completely.

It does not protect you from a malicious or compromised version of the app itself. If\nsomeone took control of the server, they could serve altered code that captured your data before it was\nencrypted. This is true of every web app that claims end-to-end encryption, including the well-known\nones; it is a property of the web, not a flaw unique to Stash. The only real cures are running code you\ncompiled yourself, or independently verifying what is served. We would rather tell you this than let the\nword “encrypted” do work it hasn't earned.

Encryption also cannot protect data on a device someone else can unlock. Use a screen lock.

\n\n

5. Where your data lives, and who else touches it

Stash runs on Val Town, a hosting provider whose servers are in the United States.\nYour encrypted budget and the items in the table above are stored there. That is a cross-border\ndisclosure under Information Privacy Principle 12: your budget itself is encrypted before it ever\nleaves your device, so what is transferred is unreadable ciphertext.

The only other parties involved:

Your browser vendor's push service (Google, Apple or Mozilla, depending on your\ndevice) — only if you turn notifications on, and only to deliver the notification. The content of a\nStash notification never contains an amount or a payee, precisely because the server does not know them.
Akahu — only for bank connections, which are currently switched off for everyone.

Nobody else. No advertisers, no data brokers, no analytics vendors.

\n\n

6. Bank connections (Akahu)

The paid “Pro” tier would connect your bank through Akahu,\nNew Zealand's open banking provider. It is not available to any user today and will not be\nturned on for anyone until Stash is properly accredited.

Being straight with you about the design: a bank connection needs a token that the server can\nuse to fetch your transactions in the background. A server that can use a token is a server that can read\nit. So the bank connection is the one feature that cannot be end-to-end encrypted the way the rest of\nStash is. The tokens would be encrypted at rest with a server-held key — which protects against a database\nleak, but not against the operator. If and when this ships, that trade-off will be stated at the point you\nturn it on, not buried here.

\n\n

7. Backups

Stash backs up accounts nightly, keeps 14 days of them, and permanently keeps one “best known” copy as\ninsurance against corruption. Backups are copies of your encrypted data — they are as\nunreadable to us as the live copy. You can also take a backup yourself at any time from Settings. When you\ndelete your account, every backup of it is deleted with it.

\n\n

8. How long it is kept

Your account data is kept until you delete it. Sessions expire on their own. Rate-limit records expire\nwithin the hour. We do not keep data we no longer need.

\n\n

9. Deleting your account, and getting your data out

Both live in Settings, and both work without asking us for anything:

Export my data — downloads everything as a file. It is produced in your browser,\nbecause your browser is the only place your data can be read.
Delete my account — permanently removes your account, your budget, every backup of\nit, your hints, your notification settings, your email address, your sign-in history, any error reports\nfrom your account, and your waitlist entry. It asks for your password and your username first, because\nit cannot be undone. There is no grace period and no copy left behind.

\n\n

10. Your rights

Under the Privacy Act 2020 you can ask for access to the personal information we hold about you\n(Principle 6) and ask us to correct it (Principle 7). In practice the app gives you both directly, but you\nare welcome to ask us instead: ${CONTACT}. We will respond within 20\nworking days.

If you are not happy with how we have handled your information, you can complain to the\nOffice of the Privacy Commissioner — privacy.org.nz,\n0800 803 909.

\n\n

11. If something goes wrong

If there is a privacy breach that is likely to cause serious harm, we will notify the Office of the\nPrivacy Commissioner and the people affected as soon as practicable — we aim to notify the Commissioner\nwithin 72 hours of establishing that a breach is notifiable, in line with their guidance.

How we would reach you: by email, if you gave us one — that is the only thing an\nemail address is used for. If you did not, we will use a notice in the app, a push notification if you\nhave them switched on, and a prominent notice on this site. That is a weaker channel, and it is the\nhonest reason the email field exists at all.

\n\n

12. Children

Stash is not aimed at children under 13 and we don't knowingly hold their information. If you believe a\nchild has created an account, email us and we will remove it.

\n\n

13. Changes to this policy

If this policy changes in a way that matters, the date at the top changes and the app tells you the next\ntime you open it. We will not quietly widen what we collect.

\n`;\n\n/* -------------------------------------------------------------------- terms */\n\nconst TERMS = `\n

Terms of Use

Last updated ${UPDATED}

\n\n

The short version. Stash is free, it is made by one person, it is not a bank and it\n is not financial advice. Your data is encrypted with your password — if you lose both your\n password and your recovery code, your data is gone permanently and nobody, including us, can get it\n back. Please read section 4.

\n\n

1. Who you are agreeing with

Stash is provided by ${OPERATOR}, an individual in New Zealand (\"we\", \"us\"). By creating an account you\nagree to these terms. If you don't, don't use it — and if you've already signed up, delete your account in\nSettings.

\n\n

2. Stash is free, and comes as-is

Stash costs nothing and is provided \"as is\", without warranties of any kind. It is a personal project,\nnot a company with a support desk. We try hard to keep it working and to keep your data safe, but we can't\npromise it will always be available, always correct, or free of bugs. Nothing in these terms limits any\nrights you have under New Zealand law that cannot lawfully be excluded.

\n\n

3. It is not financial advice

Stash shows you your own numbers and does arithmetic on them. It does not give financial advice, and\nnothing in it is a recommendation to spend, save, borrow, invest or do anything else with your money. Its\nforecasts are projections from what you have entered — they are not predictions, and they will be wrong if\nyour inputs are wrong. Decisions about your money are yours. If you need advice, talk to someone licensed\nto give it.

Imported transactions and connected balances can be incomplete or out of date. Your bank's own\nrecords are the authoritative ones, not Stash's. Do not rely on Stash to tell you whether a\npayment will clear.

\n\n

4. Your password is the only key — losing it means losing your data

Read this one properly. Your budget is encrypted with a key derived from your password.\nWe do not have that key, and we cannot reset it. This is the whole point: it is why we cannot read your\ndata, and it is why we cannot rescue it either.

You are given a recovery code when you sign up. It is the only other way in. Write it\ndown and keep it somewhere that is not your phone.

If you lose your password and your recovery code, your data is permanently and irrecoverably\ngone. Not \"gone unless you email support\" — actually gone. We will not be able to help you, no\nmatter how much we would like to. There is no back door, by design.

Keeping your password and recovery code safe is your responsibility, as is anything done by someone you\nlet into your account.

\n\n

5. The paid tier does not exist yet

Stash is currently free, in full. A paid \"Pro\" tier — mainly automatic bank\nconnection — is something we would like to build, but it depends on accreditation and on enough\npeople wanting it. It may never be released.

Joining the waitlist costs nothing, commits you to nothing, and is not a pre-order or a purchase. If Pro\never ships, everything that is free today stays free — we will not take a feature away from you and sell it\nback.

\n\n

6. Using Stash sensibly

Don't try to break into other people's accounts, don't attack or overload the service, don't use it for\nanything illegal, and don't upload other people's financial information without their say-so. We may\nsuspend or remove an account that does these things.

\n\n

7. If Stash shuts down

This is a personal project and it may not run forever. If it is going to be shut down, we will give you\nreasonable notice in the app and leave the export tool working so you can take your data with you. We\nwon't sell your data as part of any wind-down — it is encrypted, so there would be nothing to sell.

\n\n

8. Liability

To the extent the law allows, we are not liable for any loss arising from your use of Stash — including\nfinancial loss from decisions you make using it, loss of data, or the service being unavailable. Stash is\nfree, and this limit is part of why we can offer it at all. Again, nothing here removes rights you have\nunder New Zealand law that cannot be excluded.

\n\n

9. Changes

We may update these terms. If a change is significant, the app will tell you. Carrying on using Stash\nafter that means you accept the new terms.

\n\n

10. Law

These terms are governed by New Zealand law, and the New Zealand courts have jurisdiction.

\n\n

11. Contact

${CONTACT}

\n`;\n\nexport const privacyHtml = () => shell(\"Privacy Policy\", PRIVACY);\nexport const termsHtml = () => shell(\"Terms of Use\", TERMS);\n",[235],"dcea4f4b2952a4e85212a64a8e24b8b3ac371a218119734ad6a1dea433bfbec2","import_check.ts",{"_32":246,"_13":244,"_81":247,"_83":-5,"_84":59,"_85":248,"_87":26,"_34":249,"_41":231,"_90":91,"_92":250,"_66":51,"_94":-5,"_95":-7,"_74":251,"_97":252},"78f0b93b-0916-4956-b1e7-a5a071cea967","e18a687a-80c9-11f1-94b2-1607ee4eb77e",401,["D",1784174043546],"// linkedom drags in a native canvas binary that will not build here, so: deno-dom (wasm).\nimport { DOMParser } from \"https://deno.land/x/deno_dom@v0.1.45/deno-dom-wasm.ts\";\nimport { readFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n\n/**\n * Proves the Import card survives the free-user bank strip.\n *\n * This does not grep for the fix -- it BUILDS the DOM the app actually produces and runs both the\n * old and the new strip logic over it. A grep would only confirm I typed what I meant to type; it\n * would not have caught the original bug, because the original code also *looked* right and even\n * had a comment promising that Import would survive.\n *\n * The structure below is the one cardifyFolds() creates: it wraps each details.fold in a .card, so\n * the bank card and the import card end up nested INSIDE another .card.\n */\n\nconst SETTINGS = `\n

How you're paid

\n\n

Bank & import

Connect your bank

Checking...

\n \n

Import transactions

\n \n

\n\n

Security

`;\n\nconst parse = (body: string) =>\n new DOMParser().parseFromString(`${body}`, \"text/html\") as any;\nconst build = () => parse(SETTINGS);\n\nconst survey = (doc: any) => ({\n bank: !!Array.from(doc.querySelectorAll(\".acct-name\")).some((h: any) => h.textContent.trim() === \"Connect your bank\"),\n imp: !!Array.from(doc.querySelectorAll(\".acct-name\")).some((h: any) => h.textContent.trim() === \"Import transactions\"),\n paid: !!Array.from(doc.querySelectorAll(\".acct-name\")).some((h: any) => h.textContent.trim() === \"How you're paid\"),\n sec: !!Array.from(doc.querySelectorAll(\".acct-name\")).some((h: any) => h.textContent.trim() === \"Security\"),\n fold: !!doc.querySelector(\"details.fold\"),\n});\n\n// ---- the OLD logic, verbatim, to demonstrate the bug is real and not my imagination ----\nfunction stripOld(doc: any) {\n const cards = doc.querySelectorAll(\".card\");\n for (let i = 0; i < cards.length; i++) {\n const h = cards[i].querySelector(\".acct-name\");\n if (h && h.textContent.trim().toLowerCase() === \"connect your bank\") {\n if (cards[i].parentNode) cards[i].parentNode.removeChild(cards[i]);\n }\n }\n}\n\n// ---- the NEW logic, verbatim from index.html ----\nfunction stripNew(doc: any) {\n const heads = doc.querySelectorAll(\".acct-name\");\n for (let i = 0; i < heads.length; i++) {\n if (heads[i].textContent.trim().toLowerCase() !== \"connect your bank\") continue;\n const card = heads[i].closest ? heads[i].closest(\".card\") : null;\n if (card && card.parentNode) card.parentNode.removeChild(card);\n }\n}\n\nlet fails = 0;\nconst ok = (cond: boolean, label: string) => {\n if (!cond) fails++;\n console.log(`${cond ? \"PASS\" : \"FAIL\"} ${label}`);\n};\n\nconsole.log(\"--- reproduce the bug with the OLD code ---\");\nconst a = build();\nstripOld(a);\nconst ra = survey(a);\nconsole.log(\" \", JSON.stringify(ra));\nok(ra.bank === false, \"old code did remove the bank card\");\nok(ra.imp === false, \"old code ALSO removed Import (this is the reported bug)\");\nok(ra.fold === false, \"old code took the whole fold with it\");\n\nconsole.log(\"\\n--- the NEW code ---\");\nconst b = build();\nstripNew(b);\nconst rb = survey(b);\nconsole.log(\" \", JSON.stringify(rb));\nok(rb.bank === false, \"bank card is gone\");\nok(rb.imp === true, \"IMPORT SURVIVES\");\nok(rb.fold === true, \"the fold itself survives\");\nok(rb.paid === true, \"unrelated card above is untouched\");\nok(rb.sec === true, \"unrelated card below is untouched\");\n\n// The Accounts page draws the bank card WITHOUT a fold wrapper. The fix must handle that too.\nconsole.log(\"\\n--- flat layout (Accounts page, no fold wrapper) ---\");\nconst flat = parse(`

Connect your bank

Import transactions

`);\nstripNew(flat);\nconst rf = survey(flat);\nconsole.log(\" \", JSON.stringify(rf));\nok(rf.bank === false, \"flat: bank card removed\");\nok(rf.imp === true, \"flat: import survives\");\n\n// A pro user must see both.\nconsole.log(\"\\n--- pro user: strip does not run at all ---\");\nconst pro = build();\nconst rp = survey(pro);\nok(rp.bank === true && rp.imp === true, \"pro: both cards present when strip is skipped\");\n\n// And the real file must contain the fixed form, not the old one.\nconsole.log(\"\\n--- source ---\");\nconst html = await readFile(\"/index.html\", import.meta.url);\nconst body = html.replace(/\\/\\*[\\s\\S]*?\\*\\//g, \" \"); // drop comments so prose cannot match\nok(/heads\\[i\\]\\.closest/.test(body), \"index.html uses the closest() form\");\nok(!/var cards = document\\.querySelectorAll\$'\\.card'\$/.test(body), \"the old querySelectorAll('.card') loop is gone\");\nok(/onclick=\"openImport\$\$\"/.test(body), \"an Import entry point still exists in the settings markup\");\n\nconsole.log(`\\n${fails === 0 ? \"ALL CHECKS PASSED\" : fails + \" CHECK(S) FAILED\"}`);\nif (fails) throw new Error(\"import card is not safe - do not ship\");\n",[244],"e8d65e1dd44ae6c8e51c621b0a20209281c763fcfd4bbe8d9e05d6ee3f7e16e7","freq_check.ts",{"_32":255,"_13":253,"_81":256,"_83":-5,"_84":59,"_85":257,"_87":26,"_34":258,"_41":192,"_90":91,"_92":259,"_66":51,"_94":-5,"_95":-7,"_74":260,"_97":261},"a2ae3814-b88e-4b69-afbd-ce817413d21f","cb37090a-83eb-11f1-9bf1-1607ee4eb77e",447,["D",1784518496028],"import { readFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n\n/**\n * A month is now 4 weeks. This checks the REAL perPayday, lifted out of index.html and executed,\n * not a retyped copy -- and it checks that every duplicate of the frequency table moved together.\n *\n * The duplicate-table check is the one that matters most. The weeks-per-period map is written out\n * three separate times in this file. Change one and miss another and the setup wizard previews\n * \"$100 a week\" while the app then tops the pocket up by $92.31, which reads as the app silently\n * altering your budget behind your back.\n */\nconst html = await readFile(\"/index.html\", import.meta.url);\n\nlet fails = 0;\nconst ok = (c: boolean, l: string, d = \"\") => {\n if (!c) fails++;\n console.log(`${c ? \"PASS\" : \"FAIL\"} ${l}${!c && d ? \" -- \" + d : \"\"}`);\n};\n\n/* ---------- lift the real money functions ---------- */\nconst decl = html.slice(html.indexOf(\"const FREQS=\"), html.indexOf(\"function blankState()\"));\nconst F = new Function(\n \"round2\",\n decl + \"\\nreturn { FREQS, freqWeeks, perPayday, pkAmount, pkFreq };\",\n)((v: number) => Math.round((v + Number.EPSILON) * 100) / 100);\n\nconsole.log(\"weeks per period, as the app sees it:\");\nfor (const [key, , weeks] of F.FREQS) console.log(` ${String(key).padEnd(12)} ${weeks}`);\n\n/* ---------- the headline behaviour ---------- */\nconsole.log(\"\\n--- a month is 4 weeks ---\");\nok(F.freqWeeks(\"monthly\") === 4, \"monthly === 4 weeks\", String(F.freqWeeks(\"monthly\")));\nok(F.freqWeeks(\"weekly\") === 1, \"weekly unchanged\");\nok(F.freqWeeks(\"fortnightly\") === 2, \"fortnightly unchanged\");\nok(F.freqWeeks(\"annually\") === 52, \"yearly still 52, as decided\");\n\nconst pocket = (amount: number, freq: string) => ({ name: \"x\", amount, freq, balance: 0 });\n\nconsole.log(\"\\n--- $400/month, by pay cycle ---\");\nconst rent = pocket(400, \"monthly\");\nconst wk = F.perPayday({ payFreq: \"weekly\" }, rent);\nconst fn = F.perPayday({ payFreq: \"fortnightly\" }, rent);\nconst mo = F.perPayday({ payFreq: \"monthly\" }, rent);\nconsole.log(` weekly pay ${wk}`);\nconsole.log(` fortnightly pay ${fn}`);\nconsole.log(` monthly pay ${mo}`);\nok(wk === 100, \"weekly pay tops up $100 (400/4)\", String(wk));\nok(fn === 200, \"fortnightly pay tops up $200\", String(fn));\nok(mo === 400, \"monthly pay tops up the whole $400\", String(mo));\n\n/* The scope answer was \"everywhere\", so fortnightly must use the same basis. */\nok(fn === wk * 2, \"fortnightly is exactly twice weekly - one consistent rule\", `${fn} vs ${wk * 2}`);\n\nconsole.log(\"\\n--- the surplus is real and is the accepted trade-off ---\");\nconst perYear = wk * 52;\nconst billsPerYear = 400 * 12;\nconsole.log(` set aside/yr ${perYear} bills/yr ${billsPerYear} surplus ${perYear - billsPerYear}`);\nok(perYear === 5200, \"a year of weekly top-ups sets aside $5,200\", String(perYear));\nok(perYear - billsPerYear === 400, \"which is one extra month's bill of buffer\", String(perYear - billsPerYear));\nok(perYear > billsPerYear, \"it over-funds, never under-funds - the safe direction\");\n\nconsole.log(\"\\n--- other frequencies are untouched ---\");\nok(F.perPayday({ payFreq: \"weekly\" }, pocket(100, \"weekly\")) === 100, \"weekly pocket, weekly pay\");\nok(F.perPayday({ payFreq: \"weekly\" }, pocket(200, \"fortnightly\")) === 100, \"fortnightly pocket halves\");\nconst yr = F.perPayday({ payFreq: \"weekly\" }, pocket(1200, \"annually\"));\nok(yr === 23.08, \"yearly pocket still divides by 52\", String(yr));\n\nconsole.log(\"\\n--- the known quirk, stated out loud ---\");\nconst asMonthly = F.perPayday({ payFreq: \"weekly\" }, pocket(100, \"monthly\"));\nconsole.log(` $100/month -> ${asMonthly}/wk $1200/year -> ${yr}/wk`);\nok(asMonthly === 25 && yr === 23.08,\n \"same bill entered monthly vs yearly disagrees, as accepted when this was chosen\");\n\n/* ---------- every copy of the table moved together ---------- */\n/* Two corrections to this section, both mine, both caught by running it:\n\n 1. Searching the raw file for \"52/12\" flagged the COMMENT that explains the change. Strip\n comments first, or the test fails on its own documentation.\n\n 2. Matching every `monthly:` swept up two tables that mean completely different things:\n PPY = {weekly:52, fortnightly:26, monthly:12} -- payments per YEAR\n PER = {weekly:7, fortnightly:14, monthly:30.44} -- days per period\n Neither is a weeks-per-period table and neither must ever become 4. Forcing them would\n misstate annual bill totals and break next-due-date scheduling.\n The weeks tables are identifiable by weekly:1 -- one week per week. */\nconsole.log(\"\\n--- no stale copies of the old constant ---\");\nconst code = html.replace(/\\/\\*[\\s\\S]*?\\*\\//g, \" \").replace(/^\\s*\\/\\/.*$/gm, \" \");\nconst stale = (code.match(/52\\s*\\/\\s*12/g) || []).length;\nok(stale === 0, \"no 52/12 left in actual CODE\", `${stale} still present`);\n\nconst weekTables = code.match(/\\{\\s*weekly\\s*:\\s*1\\s*,[^}]*\\}/g) || [];\nconsole.log(\" weeks-per-period tables:\", JSON.stringify(weekTables));\nok(weekTables.length >= 2, \"found the inline copies of the weeks table\", `${weekTables.length}`);\nok(weekTables.every((t) => /monthly\\s*:\\s*4\\b/.test(t)),\n \"EVERY weeks table says monthly:4\", weekTables.filter((t) => !/monthly\\s*:\\s*4\\b/.test(t)).join(\" | \"));\nok(weekTables.every((t) => /annually\\s*:\\s*52\\b/.test(t)), \"and every one still says annually:52\");\n\n/* The unrelated tables must be LEFT ALONE. Assert that explicitly, so a future edit that\n \"helpfully\" makes everything 4 gets caught here. */\nconsole.log(\"\\n--- unrelated tables deliberately untouched ---\");\nok(/weekly\\s*:\\s*52\\s*,\\s*fortnightly\\s*:\\s*26\\s*,\\s*monthly\\s*:\\s*12/.test(code),\n \"payments-per-year still 12 months in a year\");\nok(/monthly\\s*:\\s*30\\.44/.test(code), \"days-per-month still 30.44 for bill due dates\");\n\n/* The FREQS table itself must be the 4 form, and there must be only one FREQS. */\nok((html.match(/const FREQS=/g) || []).length === 1, \"exactly one FREQS declaration\");\nok(/\\['monthly','Monthly',4\\]/.test(html), \"FREQS carries monthly = 4\");\n\nconsole.log(`\\n${fails === 0 ? \"ALL CHECKS PASSED\" : fails + \" CHECK(S) FAILED\"}`);\nif (fails) throw new Error(\"frequency change is not sound - do not ship\");\n",[253],"dce7d2647ebcbc87446fb56e08403fa5111c073ea5cbde354d380637603f2556","fixes_check.ts",{"_32":264,"_13":262,"_81":265,"_83":-5,"_84":59,"_85":266,"_87":26,"_34":267,"_41":202,"_90":91,"_92":268,"_66":51,"_94":-5,"_95":-7,"_74":269,"_97":270},"ea93e14f-96d1-422a-919e-1ab6bea25898","c388aa48-9092-11f1-94bf-1607ee4eb77e",464,["D",1785909609378],"import { readFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n\n/**\n * Three separate bug fixes, tested against the real code lifted from index.html -- not retyped.\n * 1. the \"numbers don't match\" false alarm when items sit unsorted in the inbox\n * 2. payday \"skip\" as a two-way toggle\n * 3. the inbox filter dead-end when one account is emptied\n */\nconst html = await readFile(\"/index.html\", import.meta.url);\n\nlet fails = 0;\nconst ok = (c: boolean, l: string, d = \"\") => {\n if (!c) fails++;\n console.log(`${c ? \"PASS\" : \"FAIL\"} ${l}${!c && d ? \" -- \" + d : \"\"}`);\n};\n\nfunction lift(name: string): string {\n const start = html.indexOf(\"function \" + name + \"(\");\n if (start < 0) throw new Error(name + \" not found\");\n let i = html.indexOf(\"{\", start), depth = 0;\n for (; i < html.length; i++) {\n if (html[i] === \"{\") depth++;\n else if (html[i] === \"}\") { depth--; if (depth === 0) return html.slice(start, i + 1); }\n }\n throw new Error(\"unbalanced \" + name);\n}\n\n/* ==================================================================== BUG 1: reconcile */\nconsole.log(\"=== BUG 1: mismatch warning respects unsorted inbox ===\");\n/* Lift the exact reconcile + unfiledInbox, wire the globals they read. */\nconst recSrc = lift(\"unfiledInbox\") + \"\\n\" + lift(\"reconcile\");\nconst makeReconcile = new Function(\n \"STATE\", \"r2\", \"acctTotal\",\n recSrc + \"\\nreturn reconcile;\",\n);\nconst r2 = (v: number) => Math.round((v + Number.EPSILON) * 100) / 100;\nconst acctTotal = (a: any) => r2((a.pockets || []).reduce((t: number, p: any) => t + p.balance, 0));\n\n// Ella-style: one linked account, pockets total $1050, and a $50 spend still unsorted in the inbox.\n// The bank has already dropped to $1000. Old code (pending-only) would cry \"off by $50\". It must not.\nconst STATE1: any = {\n accounts: [{ id: \"acc1\", bankId: \"bank1\", pockets: [{ balance: 1050 }] }],\n inbox: [{ id: \"t1\", accountId: \"bank1\", amount: -50 }], // unfiled spend, NOT tagged pending\n};\nconst bank = { accounts: [{ id: \"bank1\", balance: 1000 }] };\nlet res = makeReconcile(STATE1, r2, acctTotal)(bank);\nconsole.log(\" \", JSON.stringify(res.map((x: any) => ({ app: x.app, expected: x.expected, off: x.off }))));\nok(res[0].off === false, \"unfiled ordinary spend => NOT flagged (the reported false alarm)\");\nok(res[0].expected === 1050, \"expected = bank 1000 minus the -50 unfiled = 1050\", String(res[0].expected));\n\n// A genuine discrepancy with nothing in the inbox must STILL be caught.\nconst STATE2: any = {\n accounts: [{ id: \"acc1\", bankId: \"bank1\", pockets: [{ balance: 1080 }] }],\n inbox: [],\n};\nres = makeReconcile(STATE2, r2, acctTotal)({ accounts: [{ id: \"bank1\", balance: 1000 }] });\nok(res[0].off === true && res[0].diff === 80, \"a real $80 discrepancy is still flagged\", JSON.stringify(res[0]));\n\n// An unfiled INCOME (+415) while bank is higher must also reconcile to zero.\nconst STATE3: any = {\n accounts: [{ id: \"acc1\", bankId: \"bank1\", pockets: [{ balance: 1000 }] }],\n inbox: [{ id: \"t2\", accountId: \"bank1\", amount: 415 }],\n};\nres = makeReconcile(STATE3, r2, acctTotal)({ accounts: [{ id: \"bank1\", balance: 1415 }] });\nok(res[0].off === false, \"unfiled income also reconciles, not flagged\", JSON.stringify(res[0]));\n\n// The old bug, reproduced: if we restrict to pending only, the first case WOULD wrongly flag.\nconst oldUnfiled = (S: any, bankId: string) =>\n r2((S.inbox || []).reduce((s: number, it: any) => s + ((it.pending && it.accountId === bankId) ? (it.amount || 0) : 0), 0));\nconst oldExpected = r2(1000 - oldUnfiled(STATE1, \"bank1\"));\nok(oldExpected === 1000 && Math.abs(1050 - oldExpected) >= 0.01,\n \"(old pending-only logic WOULD have falsely flagged this — confirming the bug was real)\");\n\n/* ==================================================================== BUG 2: skip toggle */\nconsole.log(\"\\n=== BUG 2: payday skip is a two-way toggle ===\");\nconst skipSrc = lift(\"skipRow\");\nok(/dataset\\.skipped==='1'/.test(skipSrc), \"skipRow branches on a skipped flag\");\nok(/dataset\\.prev=inp\\.value/.test(skipSrc), \"it remembers the previous amount before zeroing\");\nok(/inp\\.value=\\(el\\.dataset\\.prev/.test(skipSrc), \"it restores that amount on the second tap\");\n\n/* Run the real skipRow against a mock node with true property semantics. deno-dom does not reflect\n .value / .dataset writes back through getAttribute the way a browser does, which made the first\n attempt at this test report false failures on working code. Plain objects model exactly the\n property accesses skipRow performs -- dataset, .value, .textContent, .style, closest,\n parentElement.querySelector -- so this exercises the logic precisely. */\nconst input: any = { value: \"92.31\" };\nconst rowEl: any = { style: {} };\nconst span: any = {\n dataset: {},\n style: {},\n textContent: \"skip\",\n parentElement: { querySelector: (s: string) => (s === \"input\" ? input : null) },\n closest: (s: string) => (s === \".pay-row\" ? rowEl : null),\n};\nconst runSkip = new Function(\"el\", \"payTotal\", skipSrc + \"\\nskipRow(el);\");\nconst noop = () => {};\n\nrunSkip(span, noop); // first tap -> skip\nok(input.value === \"0\" || input.value === 0, \"first tap zeroes the amount\", String(input.value));\nok(span.dataset.prev === \"92.31\", \"and stashes the original 92.31\", span.dataset.prev);\nok(span.textContent === \"restore\", \"control now reads 'restore'\", span.textContent);\nok(rowEl.style.opacity === \"0.55\", \"the row dims when skipped\", rowEl.style.opacity);\n\nrunSkip(span, noop); // second tap -> restore\nok(input.value === \"92.31\", \"second tap restores 92.31\", String(input.value));\nok(span.textContent === \"skip\", \"control reads 'skip' again\", span.textContent);\nok(rowEl.style.opacity === \"\", \"the row un-dims\", JSON.stringify(rowEl.style.opacity));\n\n// A third tap must skip again -- prove it is a genuine toggle, not a one-shot pair.\nrunSkip(span, noop);\nok(input.value === \"0\" || input.value === 0, \"third tap skips again (real toggle)\", String(input.value));\n\n/* ==================================================================== BUG 3: inbox filter */\nconsole.log(\"\\n=== BUG 3: inbox filter is not a dead-end ===\");\nconst riSrc = lift(\"renderInbox\");\nok(/if\$inboxFilter && !box\\.some\\(it=>\\(it\\.account\\|\\|''\$===inboxFilter\\)\\) inboxFilter=''/.test(riSrc),\n \"renderInbox drops a stale filter to All\");\n\n// Simulate the reset logic exactly as written.\nfunction sanitize(inboxFilter: string, box: any[]): string {\n if (inboxFilter && !box.some((it) => (it.account || \"\") === inboxFilter)) inboxFilter = \"\";\n return inboxFilter;\n}\n// Filtered to \"everyday\", and every everyday item has been cleared; only \"main\" items remain.\nok(sanitize(\"everyday\", [{ account: \"main\" }, { account: \"main\" }]) === \"\",\n \"clearing the filtered account resets to All so other items show\");\n// Still items in the filtered account => keep the filter.\nok(sanitize(\"everyday\", [{ account: \"everyday\" }, { account: \"main\" }]) === \"everyday\",\n \"filter is kept while its account still has items\");\n// Empty inbox => filter clears, no crash.\nok(sanitize(\"main\", []) === \"\", \"empty inbox clears the filter\");\n// No filter => stays no filter.\nok(sanitize(\"\", [{ account: \"main\" }]) === \"\", \"no filter stays no filter\");\n\nconsole.log(`\\n${fails === 0 ? \"ALL CHECKS PASSED\" : fails + \" CHECK(S) FAILED\"}`);\nif (fails) throw new Error(\"one or more fixes are not sound - do not ship\");\n",[262],"c664d8a53db22d6eb90f186165441e81f10dddcb9b0a2fadea51d54eb70568e7","drop_tester.ts",{"_32":273,"_13":271,"_81":274,"_83":-5,"_84":59,"_85":275,"_87":26,"_34":276,"_41":103,"_90":91,"_92":277,"_66":51,"_94":-5,"_95":-7,"_74":278,"_97":279},"7ee48a98-70f5-4870-8092-7b31e09365dc","f6213e36-7f88-11f1-96c8-1607ee4eb77e",389,["D",1784036164621],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\n/**\n * Deletes exactly one account: `tester`. Nothing else, ever.\n *\n * This is destructive and irreversible -- the budget blob is encrypted and there is no backup of it.\n * So the guards below are not ceremony. The script refuses to run if the world does not look exactly\n * the way I expect: if an account I did not anticipate has appeared, or if any of the accounts that\n * must survive is missing. A delete script that \"adapts\" to a surprise is a delete script that\n * eventually deletes the wrong thing.\n */\n\nconst DOOMED = [\"tester\"];\nconst KEEPERS = [\"rileys\", \"ellas\", \"demo\"];\n\nconst all = (await sqlite.execute(\"SELECT id, username FROM mb_users\")).rows as any[];\nconst rows = all.map((r) => ({ id: String(r[0] ?? r.id), username: String(r[1] ?? r.username) }));\nconst names = rows.map((r) => r.username).sort();\n\nconsole.log(\"accounts present:\", names.join(\", \"));\n\n// Guard 1: everything that must survive, must exist. If a keeper is already gone, something is very\n// wrong and this is not the script to be running.\nfor (const k of KEEPERS) {\n if (!names.includes(k)) throw new Error(`ABORT: keeper \"${k}\" is missing. Refusing to delete anything.`);\n}\n\n// Guard 2: no strangers. If an account exists that is neither a keeper nor on the doomed list, stop\n// and let a human look. It might be a real user who signed up five minutes ago.\nconst unexpected = names.filter((n) => !KEEPERS.includes(n) && !DOOMED.includes(n));\nif (unexpected.length) {\n throw new Error(`ABORT: unexpected account(s) present: ${unexpected.join(\", \")}. Refusing to guess.`);\n}\n\nconst targets = rows.filter((r) => DOOMED.includes(r.username));\nif (!targets.length) {\n console.log(\"\\nNothing to do - `tester` does not exist.\");\n} else {\n for (const t of targets) {\n console.log(`\\ndeleting ${t.username} (${t.id})`);\n\n // the encrypted budget, and the unencrypted notification hints\n for (const key of [`bud_${t.id}`, `hints_${t.id}`]) {\n try {\n await blob.delete(key);\n console.log(` blob ${key}`);\n } catch (_) {\n console.log(` blob ${key} (none)`);\n }\n }\n\n for (const [table, col] of [\n [\"mb_sessions\", \"user_id\"],\n [\"mb_push\", \"user_id\"],\n [\"mb_logins\", \"user_id\"],\n [\"mb_errors\", \"user_id\"],\n [\"mb_waitlist\", \"user_id\"],\n [\"mb_users\", \"id\"],\n ] as const) {\n try {\n const r = await sqlite.execute({ sql: `DELETE FROM ${table} WHERE ${col} = ?`, args: [t.id] });\n console.log(` sql ${table} (${r.rowsAffected ?? 0})`);\n } catch (e) {\n console.log(` sql ${table} - ${(e as Error).message}`);\n }\n }\n\n // feedback is keyed by username, not id\n try {\n const r = await sqlite.execute({ sql: \"DELETE FROM mb_feedback WHERE username = ?\", args: [t.username] });\n console.log(` sql mb_feedback (${r.rowsAffected ?? 0})`);\n } catch (e) {\n console.log(` sql mb_feedback - ${(e as Error).message}`);\n }\n }\n}\n\nconst left = ((await sqlite.execute(\"SELECT username FROM mb_users ORDER BY username\")).rows as any[])\n .map((r) => String(r[0] ?? r.username));\nconsole.log(\"\\naccounts remaining:\", left.join(\", \"));\n\nfor (const k of KEEPERS) {\n if (!left.includes(k)) throw new Error(`PANIC: keeper \"${k}\" is gone after the delete.`);\n}\nfor (const d of DOOMED) {\n if (left.includes(d)) throw new Error(`FAILED: \"${d}\" is still there.`);\n}\nconsole.log(\"\\nDone. Keepers intact.\");\n",[271],"22d13b605883fff499b970ad768ad7c40272a3fa1e5f329147fa179b811677cc","demo_reset.ts",{"_32":282,"_13":280,"_81":283,"_83":-5,"_84":59,"_85":284,"_87":26,"_34":285,"_41":103,"_90":91,"_92":286,"_66":51,"_94":-5,"_95":-7,"_74":287,"_97":288},"344171dc-dee8-4aed-8683-964438b2f178","7b8fcef0-7f4f-11f1-90c2-1607ee4eb77e",202,["D",1784011477709],"// Nightly: put the demo account back exactly as it was.\n//\n// The demo's username and password are public by design -- they go to Akahu, and to anyone who\n// wants a look before signing up. Public credentials mean anyone can log in and change anything:\n// rename the pockets, delete the transactions, or leave something obscene where a reviewer or a\n// prospective user will find it. A demo that anyone can vandalise is worse than no demo.\n//\n// So it gets rebuilt every night, from the same data, every time. Nothing in it is real, nothing\n// in it is anyone's, and nothing anyone does to it survives the night.\n//\n// Lives on `main` because that is the only branch where crons run. Runs at 14:30 UTC = 2:30am NZ,\n// half an hour before the backup job, so a wrecked demo is never what gets backed up.\nimport { rebuildDemo } from \"./make_demo.ts\";\n\nexport default async function () {\n const started = Date.now();\n try {\n const r = await rebuildDemo();\n // rebuildDemo verifies its own work: it logs back in, unwraps the key and decrypts the budget.\n // If that check ever fails, the demo is broken and saying so loudly beats a silent green tick.\n if (!r.ok) {\n console.error(\"DEMO RESET FAILED ITS OWN VERIFICATION -- the demo account may not open\");\n throw new Error(\"demo verification failed\");\n }\n console.log(`demo reset ok in ${Date.now() - started}ms`);\n } catch (e) {\n console.error(\"demo reset threw:\", (e as Error).message);\n throw e; // let it show up as a failed run rather than a quiet no-op\n }\n}\n",[280],"d6c517d581fb3bef40b05a9385cb8f1b699879fd018b4805725b751e39c0399a","BREACH_PLAN.md",{"_32":291,"_13":289,"_81":292,"_83":-5,"_84":59,"_85":293,"_87":26,"_34":294,"_41":103,"_90":153,"_92":295,"_66":51,"_94":-5,"_95":-7,"_74":296,"_97":297},"5e34cb4d-e4f4-4bd6-8fe2-8c7e76bf2eb6","d354dec6-7f4c-11f1-b8cf-1607ee4eb77e",173,["D",1784010336484],"# Stash — privacy breach response plan\n\nInternal. Not served to users. Written 14 July 2026.\n\nThis exists so that the worst hour of this project is not also the hour you have to invent a\nprocess. Read it now, while nothing is on fire. The whole thing takes ten minutes.\n\n**Who runs this:** Riley. There is nobody else. That is a real weakness — see §7.\n\n---\n\n## 1. What a breach actually looks like here\n\nA privacy breach under the Privacy Act 2020 is unauthorised access to, disclosure of, alteration\nof, or **loss of** personal information. Loss counts. The data-loss incident on 13 July 2026 — where\na bad deploy overwrote a live account with junk — was, technically, a privacy breach affecting one\nperson who happened to be the operator.\n\nRealistic scenarios, roughly in order of likelihood:\n\n| # | Scenario | Is user data exposed? |\n|---|---|---|\n| 1 | A deploy bug destroys or corrupts user data | No, but data is **lost** — still a breach |\n| 2 | Val Town account compromised (password/token stolen) | See §2 — this is the bad one |\n| 3 | The SQLite database or blobs leak | Budget data is **ciphertext**. Usernames, hints, waitlist emails are not |\n| 4 | An access-control bug serves user A's blob to user B | Ciphertext, so B cannot read it — but it is still unauthorised disclosure |\n| 5 | A user's own password is guessed | Their data is exposed, to whoever guessed it |\n| 6 | Akahu tokens leak (only if Pro ever ships) | Yes, and badly. Bank transaction access |\n\n## 2. The one that matters: Val Town account compromise\n\nEncryption means a stolen *database* is close to harmless. It does **not** mean a stolen *account*\nis harmless, because whoever holds the Val Town login can **change the JavaScript that Stash serves**\nand capture passwords and plaintext from the next person who logs in.\n\nSo: **the Val Town login is the crown jewel, not the database.** Protect it accordingly —\nstrong unique password, 2FA on, and never paste the API token anywhere.\n\nIf you ever suspect it is compromised, that is a **live, ongoing** breach, not a historical one.\nTake the app offline first and ask questions second. Every minute it is up, it is harvesting.\n\n## 3. What to do, in order\n\n**Contain (minutes, not hours).**\n1. If the server may be serving malicious code: **take Stash offline.** A blank page beats a\n compromised one. Do this before investigating.\n2. Rotate: Val Town password + 2FA, `APP_KEY`, VAPID keys, Akahu tokens.\n3. Invalidate every session: `DELETE FROM mb_sessions`. Everyone gets logged out. Fine.\n4. Do **not** delete logs, blobs or backups. You will need them, and destroying evidence of a\n breach is its own problem.\n\n**Assess (same day).**\n5. What was taken or lost, whose, and when. Write it down as you go — memory is unreliable and you\n will be stressed.\n6. Ask the s.113 question honestly: **is serious harm likely?** Consider the sensitivity (this is\n financial data — treat it as sensitive), whether it was protected (encrypted budget = a strong\n mitigating factor; usernames, hints and waitlist emails = not protected), who has it, and whether\n it can still be misused. Do not talk yourself out of it because notifying is embarrassing.\n\n**Notify (as soon as practicable; target within 72 hours of deciding it is notifiable).**\n7. **Office of the Privacy Commissioner** via NotifyUs — \n You can notify while still investigating. Do not sit on it waiting for a complete picture.\n8. **Affected people.** See §4 — this is the gap.\n9. If Akahu is involved: tell Akahu immediately. It is their accreditation on the line too.\n\n**Fix and learn.**\n10. Patch the cause. Then write the postmortem into `SECURITY_NOTES.md`, including what let it\n happen. The gravestone comments in `index.html` exist for exactly this reason and they work.\n\n## 4. The hole: there is no way to email users\n\n**Stash does not collect email addresses.** That is good for privacy and bad for exactly one thing —\nthe Privacy Act obligation to notify affected individuals directly. Right now the only channels are:\n\n- a banner inside the app (only reaches people who open it),\n- a push notification (only people who turned them on),\n- a public notice on the site (s.116 allows public notice where individual notice is not reasonably\n practicable — this is the fallback, and it is a fallback, not a plan).\n\n**Recommendation:** add an *optional* email field at signup, used only for security notices. Say so\nplainly at the point of asking. It is a small privacy cost for a real ability to warn people that\ntheir money data is at risk. Until that exists, this plan cannot fully meet the notification duty,\nand the privacy policy says so honestly rather than pretending otherwise.\n\n## 5. Numbers to have to hand\n\n- Office of the Privacy Commissioner — 0800 803 909 — privacy.org.nz\n- NotifyUs (self-assessment + notification tool) — privacy.org.nz/responsibilities/privacy-breaches/notify-us/\n- Val Town support — for hosting-side incidents\n- Akahu support — only relevant if a bank feed is ever live\n- CERT NZ () — worth reporting an attack to, separate from the Privacy\n Commissioner\n\n## 6. What is already in place\n\n- Budget data is end-to-end encrypted; the server cannot read it, so a database leak is far less severe.\n- Nightly verified backups, 14-day retention, plus a permanently protected best-known copy, so\n scenario 1 is recoverable.\n- A shrink guard on `/api/state` that refuses a write which would collapse an account, plus rolling\n version history.\n- Rate limiting on login, signup and recovery.\n- Account deletion purges backups too, so \"delete\" means deleted.\n\n## 7. The honest weaknesses\n\n- **One person.** If Riley is asleep, on a plane, or ill, nothing in §3 happens. There is no\n on-call, no second pair of eyes, and no one to notice a breach at 2am.\n- **No monitoring or alerting.** Nothing would tell you a breach was under way. The backup job's\n size-drop alert is the only automated warning of anything, and it only catches data *loss*.\n- **No email channel to users** (§4).\n- **The operator serves the JavaScript.** This is the ceiling on the encryption and it cannot be\n fixed by policy. It is disclosed in the privacy policy rather than hidden.\n\nNone of these are reasons not to launch a free tool to a handful of people. All of them are reasons\nnot to hold strangers' bank credentials — which is exactly why the bank feed is off.\n",[289],"b0ed16617ec979d6a3f904702975da9b05fc48d756abc2032bee985dd312060b",["D",1783644524287],"legacyEnvVars","httpPrivacy","description","Pocket budgeting app — syncs across phone and laptop","imageUrl","userId","9ce636d8-a261-43ee-aad5-aba0afcc9805","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","tursoName","9a8f532dd41348dd9c0f576fd227edcf","tursoHostname","9a8f532dd41348dd9c0f576fd227edcf-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789525245864],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_339":335},"org",{"_11":12,"_332":333,"_334":335,"_304":305,"_336":337,"_338":51},"branch","displayName","Riley Smith","avatar","https://lh3.googleusercontent.com/a/ACg8ocKLn-WocVfdzaKwIdLHV1VQfr-Cu-Zr_dXM84NUtd0tHciAd52i=s96-c","tier","free","canRestrictVals","profileImageUrl","","adoptOrgId",{"_32":40,"_13":14,"_34":577,"_49":-5,"_299":51,"_52":53,"_300":53,"_301":302,"_303":-5,"_304":305,"_306":-5,"_307":51,"_308":-5,"_309":-5,"_310":103,"_55":56,"_311":312,"_313":314,"_315":578,"_317":-5,"_318":319,"_320":319,"_321":322,"_323":322,"_324":322,"_325":319,"_326":319,"_327":579,"_329":580,"_331":581,"_50":51},"tree",[490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515],"files",[490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515],"counts",{"_480":103,"_481":231,"_482":103,"_483":484,"_485":486},"contents",[364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389],"upstreamProject","upstreamBranch",{"_32":33,"_34":362,"_36":363,"_13":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":-5,"_50":51,"_52":53,"_54":12,"_55":56,"_57":14},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1783660915265],["D",1785909687930],{"_32":291,"_13":289,"_81":292,"_83":-5,"_84":59,"_85":293,"_87":26,"_34":478,"_41":103,"_90":153,"_92":295,"_66":51,"_94":-5,"_74":479},{"_32":472,"_13":473,"_81":474,"_83":-5,"_84":59,"_85":405,"_87":26,"_34":475,"_41":192,"_90":153,"_92":476,"_66":51,"_94":-5,"_74":477},{"_32":466,"_13":467,"_81":468,"_83":-5,"_84":59,"_85":405,"_87":26,"_34":469,"_41":89,"_90":91,"_92":470,"_66":51,"_94":-5,"_74":471},{"_32":460,"_13":461,"_81":462,"_83":-5,"_84":59,"_85":405,"_87":26,"_34":463,"_41":192,"_90":91,"_92":464,"_66":51,"_94":-5,"_74":465},{"_32":454,"_13":455,"_81":456,"_83":-5,"_84":59,"_85":405,"_87":26,"_34":457,"_41":192,"_90":91,"_92":458,"_66":51,"_94":-5,"_74":459},{"_32":282,"_13":280,"_81":283,"_83":-5,"_84":59,"_85":284,"_87":26,"_34":452,"_41":103,"_90":91,"_92":286,"_66":51,"_94":-5,"_74":453},{"_32":273,"_13":271,"_81":274,"_83":-5,"_84":59,"_85":275,"_87":26,"_34":450,"_41":103,"_90":91,"_92":277,"_66":51,"_94":-5,"_74":451},{"_32":264,"_13":262,"_81":265,"_83":-5,"_84":59,"_85":266,"_87":26,"_34":448,"_41":202,"_90":91,"_92":268,"_66":51,"_94":-5,"_74":449},{"_32":255,"_13":253,"_81":256,"_83":-5,"_84":59,"_85":257,"_87":26,"_34":446,"_41":192,"_90":91,"_92":259,"_66":51,"_94":-5,"_74":447},{"_32":440,"_13":441,"_81":442,"_83":-5,"_84":59,"_85":192,"_87":26,"_34":443,"_41":103,"_90":153,"_92":444,"_66":51,"_94":-5,"_74":445},{"_32":434,"_13":435,"_81":436,"_83":-5,"_84":59,"_85":192,"_87":26,"_34":437,"_41":103,"_90":153,"_92":438,"_66":51,"_94":-5,"_74":439},{"_32":246,"_13":244,"_81":247,"_83":-5,"_84":59,"_85":248,"_87":26,"_34":432,"_41":231,"_90":91,"_92":250,"_66":51,"_94":-5,"_74":433},{"_32":148,"_13":145,"_81":149,"_83":-5,"_84":59,"_85":150,"_87":26,"_34":430,"_41":152,"_90":153,"_92":154,"_66":51,"_94":-5,"_74":431},{"_32":237,"_13":235,"_81":238,"_83":-5,"_84":59,"_85":239,"_87":26,"_34":428,"_41":114,"_90":91,"_92":241,"_66":51,"_94":-5,"_74":429},{"_32":128,"_13":125,"_81":129,"_83":-5,"_84":59,"_85":130,"_87":26,"_34":426,"_41":132,"_90":133,"_92":134,"_66":51,"_94":-5,"_74":427},{"_32":110,"_13":107,"_81":111,"_83":-5,"_84":59,"_85":112,"_87":26,"_34":424,"_41":114,"_90":91,"_92":115,"_66":51,"_94":-5,"_74":425},{"_32":80,"_13":75,"_81":82,"_83":-5,"_84":59,"_85":86,"_87":26,"_34":422,"_41":89,"_90":91,"_92":93,"_66":51,"_94":-5,"_74":423},{"_32":415,"_13":416,"_81":417,"_83":-5,"_84":59,"_85":405,"_87":26,"_34":418,"_41":419,"_90":91,"_92":420,"_66":51,"_94":-5,"_74":421},{"_32":409,"_13":410,"_81":411,"_83":-5,"_84":59,"_85":405,"_87":26,"_34":412,"_41":202,"_90":91,"_92":413,"_66":51,"_94":-5,"_74":414},{"_32":402,"_13":403,"_81":404,"_83":-5,"_84":59,"_85":405,"_87":26,"_34":406,"_41":192,"_90":91,"_92":407,"_66":51,"_94":-5,"_74":408},{"_32":227,"_13":225,"_81":228,"_83":-5,"_84":59,"_85":229,"_87":26,"_34":400,"_41":231,"_90":91,"_92":232,"_66":51,"_94":-5,"_74":401},{"_32":217,"_13":215,"_81":218,"_83":-5,"_84":59,"_85":219,"_87":26,"_34":398,"_41":221,"_90":91,"_92":222,"_66":51,"_94":-5,"_74":399},{"_32":208,"_13":206,"_81":209,"_83":-5,"_84":59,"_85":210,"_87":26,"_34":396,"_41":202,"_90":91,"_92":212,"_66":51,"_94":-5,"_74":397},{"_32":198,"_13":196,"_81":199,"_83":-5,"_84":59,"_85":200,"_87":26,"_34":394,"_41":202,"_90":91,"_92":203,"_66":51,"_94":-5,"_74":395},{"_32":188,"_13":186,"_81":189,"_83":-5,"_84":59,"_85":190,"_87":26,"_34":392,"_41":192,"_90":91,"_92":193,"_66":51,"_94":-5,"_74":393},{"_32":179,"_13":177,"_81":180,"_83":-5,"_84":59,"_85":181,"_87":26,"_34":390,"_41":103,"_90":91,"_92":183,"_66":51,"_94":-5,"_74":391},["D",1784178356304],[177],["D",1784178851281],[186],["D",1784027783103],[196],["D",1784506505722],[206],["D",1784024977245],[215],["D",1784035161188],[225],"26d9d4d0-c2cc-4636-840e-a66bf949d44c","push.ts","019f5a38-e791-737e-9b19-7b663eadd916",161,["D",1784009912922],"// Web Push sender. Shared by the HTTP val (test push) and the cron (real notifications).\nimport * as webpush from \"jsr:@negrel/webpush\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst PRIV = JSON.parse(Deno.env.get(\"VAPID_PRIVATE_JWK\") || \"{}\");\n\n/** The library wants a JWK pair. We stored the private JWK, which already carries x and y. */\nfunction vapidJwks() {\n const { kty, crv, x, y, d } = PRIV;\n return {\n publicKey: { kty, crv, x, y, key_ops: [\"verify\"], ext: true },\n privateKey: { kty, crv, x, y, d, key_ops: [\"sign\"], ext: true },\n };\n}\n\nlet _server: any = null;\nasync function server() {\n if (_server) return _server;\n const keys = await webpush.importVapidKeys(vapidJwks() as any, { extractable: false });\n _server = await webpush.ApplicationServer.new({\n contactInformation: \"mailto:rileysmith1272@gmail.com\",\n vapidKeys: keys,\n });\n return _server;\n}\n\nexport type Sub = { endpoint: string; p256dh: string; auth: string };\n\n/** Send one notification. Returns true if delivered, false if the subscription is dead (and prunes it). */\nexport async function sendPush(sub: Sub, payload: Record): Promise {\n try {\n const app = await server();\n const subscriber = app.subscribe({\n endpoint: sub.endpoint,\n keys: { p256dh: sub.p256dh, auth: sub.auth },\n } as any);\n await subscriber.pushTextMessage(JSON.stringify(payload), {});\n return true;\n } catch (e: any) {\n const msg = String(e?.message || e);\n // 404/410 mean the browser threw the subscription away — stop trying forever\n if (msg.includes(\"404\") || msg.includes(\"410\") || msg.includes(\"Gone\") || msg.includes(\"NotFound\")) {\n try {\n await sqlite.execute({ sql: \"DELETE FROM mb_push WHERE endpoint = ?\", args: [sub.endpoint] });\n console.log(\"pruned dead subscription\");\n } catch (_) {}\n return false;\n }\n console.log(\"push failed:\", msg);\n return false;\n }\n}\n\n/** Every subscription belonging to a user (they may have several devices). */\nexport async function subsFor(userId: string): Promise {\n const r = await sqlite.execute({\n sql: \"SELECT endpoint, p256dh, auth FROM mb_push WHERE user_id = ?\",\n args: [userId],\n });\n return r.rows as unknown as Sub[];\n}\n\n/** Send to all of a user's devices. Returns how many got through. */\nexport async function pushToUser(userId: string, payload: Record): Promise {\n const subs = await subsFor(userId);\n let ok = 0;\n for (const s of subs) if (await sendPush(s, payload)) ok++;\n return ok;\n}\n",[403],"1a86a15a-6c0c-4ec7-a931-ca7423d39168","pdfstmt.js","2a04eab2-7f12-11f1-9397-1607ee4eb77e",["D",1784009912922],"/* Bank statement PDF import. Runs entirely in the browser -- the statement is never uploaded.\n\n A PDF has no columns, only text at positions. On an ANZ statement the Withdrawals and Deposits\n columns are told apart ONLY by where they sit horizontally, and that is exactly the kind of\n thing that fails silently and turns wages into a spend.\n\n So the columns are not used at all. Every row also prints the RUNNING BALANCE, so the sign comes\n from arithmetic: if the balance went 765.56 -> 665.56, that 100.00 was money out. Nothing to\n misread.\n\n The statement then marks its own homework: it prints its own totals. If the parse does not\n reproduce them to the cent, nothing is imported. A CSV carries no such check, which makes this\n the more trustworthy of the two importers. */\n(function(){\n var MON = ['Jan','Feb','Mar','Apr','May','Jun','Jul','Aug','Sep','Oct','Nov','Dec'];\n var NUM = '[\\\\d,]+\\\\.\\\\d{2}';\n var f = function(s){ return parseFloat(String(s).replace(/,/g, '')); };\n var squash = function(s){ return String(s).replace(/\\s+/g, '').toLowerCase(); };\n var r2 = function(v){ return Math.round((v + Number.EPSILON) * 100) / 100; };\n\n var ROW = new RegExp('^(\\\\d{1,2})\\\\s+(' + MON.join('|') + ')\\\\s+(.+?)\\\\s+(' + NUM + ')\\\\s+(' + NUM + ')\\\\s*$');\n var NUMS = new RegExp(NUM, 'g');\n var ONLY_NUMS = /^[\\s$()+\\-0-9.,]+$/;\n\n /* ---- pdf.js, loaded only when someone actually imports a PDF ---- */\n var pdfjsReady = null;\n function loadPdfJs(){\n if(pdfjsReady) return pdfjsReady;\n pdfjsReady = new Promise(function(resolve, reject){\n if(window.pdfjsLib){ resolve(window.pdfjsLib); return; }\n var s = document.createElement('script');\n s.src = 'https://cdnjs.cloudflare.com/ajax/libs/pdf.js/3.11.174/pdf.min.js';\n s.onload = function(){\n try{\n window.pdfjsLib.GlobalWorkerOptions.workerSrc =\n 'https://cdnjs.cloudflare.com/ajax/libs/pdf.js/3.11.174/pdf.worker.min.js';\n resolve(window.pdfjsLib);\n }catch(e){ reject(e); }\n };\n s.onerror = function(){ reject(new Error('Could not load the PDF reader.')); };\n document.head.appendChild(s);\n });\n return pdfjsReady;\n }\n\n /* Group positioned text back into lines.\n\n This needs a TOLERANCE, not exact matching. Cells in one visual row are often a fraction of a\n point apart vertically, and bucketing too tightly tears a row in half -- which is how the\n totals row got separated from its own numbers, leaving the statement with nothing to check\n itself against. 2.5pt is about a third of a line: loose enough to hold a row together, tight\n enough never to merge two. */\n var Y_TOL = 2.5;\n function linesFrom(items){\n var got = [];\n items.forEach(function(it){\n if(!it.str || !it.str.trim()) return;\n got.push({ y: it.transform[5], x: it.transform[4], s: it.str, w: it.width || 0 });\n });\n got.sort(function(a, b){ return b.y - a.y; }); // PDF y grows upwards\n\n var groups = [], cur = null;\n got.forEach(function(it){\n if(!cur || Math.abs(cur.y - it.y) > Y_TOL){\n cur = { y: it.y, parts: [it] };\n groups.push(cur);\n } else {\n cur.parts.push(it);\n }\n });\n\n return groups.map(function(g){\n var parts = g.parts.sort(function(a, b){ return a.x - b.x; });\n var out = '';\n for(var i = 0; i < parts.length; i++){\n if(i){\n var gap = parts[i].x - (parts[i-1].x + parts[i-1].w);\n if(gap > 1) out += ' ';\n }\n out += parts[i].s;\n }\n return out.replace(/\\s+/g, ' ').trim();\n }).filter(function(l){ return l; });\n }\n\n /* \"Statement period 24 May 2026 - 23 Jun 2026\". Rows only say \"24 May\", so the year comes from\n here. Statements can straddle new year, so the year rolls when the months wrap. */\n function periodOf(lines){\n for(var i = 0; i < lines.length; i++){\n if(squash(lines[i]).indexOf('statementperiod') < 0) continue;\n var m = lines[i].match(new RegExp('(\\\\d{1,2})\\\\s*(' + MON.join('|') + ')\\\\w*\\\\s*(\\\\d{4})\\\\s*-\\\\s*(\\\\d{1,2})\\\\s*(' + MON.join('|') + ')\\\\w*\\\\s*(\\\\d{4})'));\n if(m) return { startMon: MON.indexOf(m[2]), startYear: +m[3], endMon: MON.indexOf(m[5]), endYear: +m[6] };\n }\n return null;\n }\n\n /* Pull the figures belonging to a label. If the label's own line does not carry them (some\n layouts put the label and its amounts in separate cells), keep reading the lines below --\n but ONLY while they contain nothing except numbers, so a transaction row can never be\n mistaken for a total. */\n function figuresFor(lines, i){\n var out = (lines[i].match(NUMS) || []);\n for(var j = i + 1; j < lines.length && out.length < 3; j++){\n if(!ONLY_NUMS.test(lines[j])) break;\n out = out.concat(lines[j].match(NUMS) || []);\n }\n return out.map(f);\n }\n\n function parseLines(lines){\n var period = periodOf(lines);\n var sections = [], cur = null, problems = [];\n\n var yearFor = function(mi){\n if(!period) return new Date().getFullYear();\n if(period.startYear === period.endYear) return period.startYear;\n return mi >= period.startMon ? period.startYear : period.endYear;\n };\n\n lines.forEach(function(line, i){\n var sq = squash(line);\n\n if(sq.indexOf('openingbalance') >= 0){\n var n = figuresFor(lines, i);\n if(n.length){\n cur = { opening: n[n.length - 1], bal: n[n.length - 1], txns: [], totals: null, pageTotal: null };\n sections.push(cur);\n }\n return;\n }\n if(sq.indexOf('balancebroughtforward') >= 0){\n var b = figuresFor(lines, i);\n if(cur && b.length && Math.abs(b[b.length - 1] - cur.bal) > 0.005){\n problems.push('The balance carried over between pages does not line up (' +\n b[b.length - 1].toFixed(2) + ' on the page, ' + cur.bal.toFixed(2) + ' from the transactions).');\n }\n return;\n }\n if(sq.indexOf('totalsatendofperiod') >= 0){\n var t = figuresFor(lines, i);\n if(cur && t.length >= 3) cur.totals = { out: t[0], in: t[1], closing: t[2] };\n return;\n }\n if(sq.indexOf('totalsatendofpage') >= 0){\n // per-page subtotal. Not a transaction -- but its closing figure is a useful backstop if\n // the end-of-period totals turn out to be missing.\n var pt = figuresFor(lines, i);\n if(cur && pt.length >= 3) cur.pageTotal = { closing: pt[2] };\n return;\n }\n\n var m = ROW.exec(line);\n if(!m || !cur) return;\n\n var day = +m[1], mi = MON.indexOf(m[2]), desc = m[3].trim();\n var amt = f(m[4]), newBal = f(m[5]);\n var delta = r2(newBal - cur.bal);\n\n /* The printed amount must equal the balance movement. If it does not, the row has been\n misread -- say so rather than guess. */\n if(Math.abs(Math.abs(delta) - amt) > 0.005){\n problems.push('A row does not add up: \"' + line.slice(0, 60) + '\"');\n return;\n }\n\n cur.txns.push({\n date: new Date(yearFor(mi), mi, day, 12).toISOString(),\n amount: delta, // sign from the balance, never from the column\n description: clean(desc),\n raw: desc,\n merchant: '',\n category: '',\n });\n cur.bal = newBal;\n });\n\n /* --- the statement checks the parse --- */\n var checks = [];\n sections.forEach(function(s){\n var out = r2(-s.txns.filter(function(t){ return t.amount < 0; }).reduce(function(a, t){ return a + t.amount; }, 0));\n var inn = r2(s.txns.filter(function(t){ return t.amount > 0; }).reduce(function(a, t){ return a + t.amount; }, 0));\n\n if(s.totals){\n var okOut = Math.abs(out - s.totals.out) < 0.005;\n var okIn = Math.abs(inn - s.totals.in) < 0.005;\n var okBal = Math.abs(s.bal - s.totals.closing) < 0.005;\n checks.push({\n opening: s.opening, closing: s.bal, moneyOut: out, moneyIn: inn,\n saysOut: s.totals.out, saysIn: s.totals.in, saysClosing: s.totals.closing,\n basis: 'the totals printed on the statement',\n ok: okOut && okIn && okBal,\n });\n if(!okOut) problems.push('Money out came to ' + out.toFixed(2) + ' but the statement says ' + s.totals.out.toFixed(2) + '.');\n if(!okIn) problems.push('Money in came to ' + inn.toFixed(2) + ' but the statement says ' + s.totals.in.toFixed(2) + '.');\n if(!okBal) problems.push('The closing balance came to ' + s.bal.toFixed(2) + ' but the statement says ' + s.totals.closing.toFixed(2) + '.');\n return;\n }\n\n /* No end-of-period totals on this statement. The running balance is still a real check:\n opening plus every transaction must land exactly on the closing balance the bank printed. */\n if(s.pageTotal){\n var okClose = Math.abs(s.bal - s.pageTotal.closing) < 0.005;\n checks.push({\n opening: s.opening, closing: s.bal, moneyOut: out, moneyIn: inn,\n saysOut: out, saysIn: inn, saysClosing: s.pageTotal.closing,\n basis: 'the closing balance printed on the statement',\n ok: okClose,\n });\n if(!okClose) problems.push('The closing balance came to ' + s.bal.toFixed(2) + ' but the statement says ' + s.pageTotal.closing.toFixed(2) + '.');\n return;\n }\n\n problems.push('The statement totals could not be found, so the figures could not be checked.');\n });\n\n var txns = [];\n sections.forEach(function(s){ txns = txns.concat(s.txns); });\n\n return {\n txns: txns,\n checks: checks,\n problems: problems,\n lines: lines, // so the app can show exactly what was read, if it goes wrong\n /* the whole point: only true if the figures prove out against the bank's own numbers */\n verified: sections.length > 0 && problems.length === 0 && checks.length > 0 &&\n checks.every(function(c){ return c.ok; }),\n period: period,\n };\n }\n\n /* \"DD 01-0495-0390687-20 Clothes\" -> \"Clothes\". Drops the two-letter transaction code and any\n NZ account numbers, which are noise once the transaction is in a pocket. */\n var CODES = ['AP','AT','BP','CQ','DC','DD','ED','EP','FX','IA','IF','IP','VT'];\n function clean(d){\n var s = String(d).trim();\n var first = s.split(/\\s+/)[0];\n if(CODES.indexOf(first) >= 0) s = s.slice(first.length).trim();\n s = s.replace(/\\b\\d{2}-\\d{4}-\\d{7}-\\d{2}\\b/g, '').trim();\n return s.replace(/\\s+/g, ' ').trim() || String(d).trim();\n }\n\n window.PDFSTMT = {\n parseLines: parseLines, // exported so it can be unit-tested without a browser\n linesFrom: linesFrom,\n clean: clean,\n parse: async function(arrayBuffer){\n var pdfjs = await loadPdfJs();\n var doc = await pdfjs.getDocument({ data: arrayBuffer }).promise;\n var lines = [];\n for(var p = 1; p <= doc.numPages; p++){\n var page = await doc.getPage(p);\n var content = await page.getTextContent();\n lines = lines.concat(linesFrom(content.items));\n }\n return parseLines(lines);\n },\n };\n})();\n",[410],"2ebc1af7-4be3-4044-8168-0fb8577d11b5","pdf_test.ts","a5efc746-7f12-11f1-9d56-1607ee4eb77e",["D",1784009912922],4,"// PDF statement parser. Synthetic ANZ-shaped statements -- same layout, invented numbers.\n// (The real statement was verified separately and never stored here.)\n(globalThis as any).window = globalThis;\n(globalThis as any).document = { createElement: () => ({}), head: { appendChild: () => {} } };\nawait import(\"./pdfstmt.js\");\nconst P = (globalThis as any).PDFSTMT;\n\nlet pass = 0, fail = 0;\nconst ok = (n: string, c: boolean, e = \"\") => {\n if (c) { pass++; console.log(\" PASS \" + n); }\n else { fail++; console.log(\" FAIL \" + n + (e ? \" -> \" + e : \"\")); }\n};\n\n// Note the deliberate quirks of a real ANZ export: words glued together with no spaces\n// (\"Openingbalance\"), the per-page subtotal line, the carry-forward line, and amounts whose\n// column can only be told apart by the running balance.\nconst good = [\n \"Statement of Accounts\",\n \"Online Account\",\n \"Statementperiod 24 May 2026 - 23 Jun 2026\",\n \"Date Transactiontypeanddetails Withdrawals Deposits Balance\",\n \"24 May Openingbalance 1,000.00\",\n \"25 May DD 01-0495-0390687-20 Groceries 150.00 850.00\",\n \"26 May DC Some Employer wages Wages 500.00 1,350.00\",\n \"29 May GROSS CREDIT INTEREST PAID 0.35 1,350.35\",\n \"29 May WITHHOLDING TAX PAID 0.04 1,350.31\",\n \"Totalsatendofpage $150.04 $500.35 $1,350.31\",\n \"Page 1 of 2\",\n \"Online Account- continued\",\n \"Date Transactiontypeanddetails Withdrawals Deposits Balance\",\n \"Balancebroughtforwardfrompreviouspage 1,350.31\",\n \"02 Jun DD AA INSURANCE PRE AMC036774334 158.38 1,191.93\",\n \"23 Jun DC Some Employer wages Wages 308.07 1,500.00\",\n \"Totalsatendofpage $158.38 $308.07 $1,500.00\",\n \"Totalsatendofperiod $308.42 $808.42 $1,500.00\",\n];\n\nconsole.log(\"=== a well-formed statement ===\");\n{\n const r = P.parseLines(good);\n ok(\"found the period\", !!r.period && r.period.startYear === 2026);\n // groceries, wages, interest, tax (page 1), AA insurance, wages (page 2)\n ok(\"parsed 6 transactions\", r.txns.length === 6, \"got \" + r.txns.length);\n ok(\"no problems\", r.problems.length === 0, JSON.stringify(r.problems));\n ok(\">>> VERIFIED against the statement's own totals\", r.verified === true);\n\n const c = r.checks[0];\n ok(\"opening 1000.00\", c.opening === 1000);\n ok(\"closing 1500.00\", c.closing === 1500);\n ok(\"money out matches (308.42)\", Math.abs(c.moneyOut - 308.42) < 0.005, \"\" + c.moneyOut);\n ok(\"money in matches (808.42)\", Math.abs(c.moneyIn - 808.42) < 0.005, \"\" + c.moneyIn);\n\n const t = r.txns;\n ok(\"groceries booked as money OUT\", t[0].amount === -150);\n ok(\"wages booked as money IN\", t[1].amount === 500);\n ok(\"interest is a credit\", t[2].amount === 0.35);\n ok(\"withholding tax is a debit\", t[3].amount === -0.04);\n ok(\"first row on page 2, after the carry-forward\", t[4].amount === -158.38, \"\" + t[4].amount);\n ok(\"last row on page 2\", t[5].amount === 308.07, \"\" + t[5].amount);\n ok(\"dates get the year from the period\", t[0].date.slice(0, 10) === \"2026-05-25\", t[0].date);\n ok(\"descriptions are cleaned up\", t[0].description === \"Groceries\", t[0].description);\n ok(\"the per-page subtotal is not treated as a transaction\", !t.some((x: any) => Math.abs(x.amount) === 150.04));\n}\n\nconsole.log(\"\\n=== the sign comes from the BALANCE, not the column ===\");\n{\n // Same amount, same day. Only the balance movement says which way the money went.\n const tricky = [\n \"Statementperiod 01 Jul 2026 - 31 Jul 2026\",\n \"01 Jul Openingbalance 500.00\",\n \"02 Jul DD Mystery 100.00 400.00\", // out\n \"03 Jul DC Mystery 100.00 500.00\", // in -- identical amount and text\n \"Totalsatendofperiod $100.00 $100.00 $500.00\",\n ];\n const r = P.parseLines(tricky);\n ok(\"two identical-looking rows, opposite signs\", r.txns[0].amount === -100 && r.txns[1].amount === 100);\n ok(\"still verifies\", r.verified === true);\n}\n\nconsole.log(\"\\n=== a statement that straddles new year ===\");\n{\n const ny = [\n \"Statementperiod 24 Dec 2025 - 23 Jan 2026\",\n \"24 Dec Openingbalance 100.00\",\n \"27 Dec DD Christmas 50.00 50.00\",\n \"05 Jan DC Refund 25.00 75.00\",\n \"Totalsatendofperiod $50.00 $25.00 $75.00\",\n ];\n const r = P.parseLines(ny);\n ok(\"December is 2025\", r.txns[0].date.slice(0, 10) === \"2025-12-27\", r.txns[0].date);\n ok(\"January is 2026\", r.txns[1].date.slice(0, 10) === \"2026-01-05\", r.txns[1].date);\n ok(\"verifies\", r.verified === true);\n}\n\nconsole.log(\"\\n=== IT MUST REFUSE when the numbers do not add up ===\");\n{\n // A row has been misread: the amount doesn't match the balance movement.\n const broken = good.slice();\n broken[5] = \"25 May DD 01-0495-0390687-20 Groceries 150.00 860.00\"; // balance is wrong\n const r = P.parseLines(broken);\n ok(\"spots the bad row\", r.problems.length > 0);\n ok(\">>> REFUSES to verify\", r.verified === false);\n console.log(\" it said: \" + r.problems[0]);\n}\n{\n // Everything parses, but our totals don't reproduce the bank's. Must not import.\n const cooked = good.slice();\n cooked[cooked.length - 1] = \"Totalsatendofperiod $999.99 $808.42 $1,500.00\";\n const r = P.parseLines(cooked);\n ok(\"catches a totals mismatch\", r.verified === false);\n console.log(\" it said: \" + r.problems[0]);\n}\n{\n // No end-of-period totals, but the page subtotals still give a closing balance to check against.\n // Opening + every transaction must land exactly on it, which is a real check -- so this SHOULD\n // still verify. Losing that fallback is what broke the real ANZ import.\n const noPeriodTotals = good.filter(l => !l.startsWith(\"Totalsatendofperiod\"));\n const r = P.parseLines(noPeriodTotals);\n ok(\"falls back to the closing balance and still verifies\", r.verified === true, JSON.stringify(r.problems));\n ok(\" and says what it checked against\", r.checks[0].basis.includes(\"closing balance\"));\n}\n{\n // Nothing at all to check against: no totals, no subtotals. Must refuse.\n const nothing = good.filter(l => !/^Totalsatendof/.test(l));\n const r = P.parseLines(nothing);\n ok(\"refuses when there is nothing whatsoever to check against\", r.verified === false);\n console.log(\" it said: \" + r.problems[0]);\n}\n{\n // The fallback must still CATCH a bad parse, not just wave it through.\n const bent = good.filter(l => !l.startsWith(\"Totalsatendofperiod\")).slice();\n bent[bent.length - 1] = \"Totalsatendofpage $158.38 $308.07 $9,999.99\";\n const r = P.parseLines(bent);\n ok(\"the fallback still refuses a wrong closing balance\", r.verified === false);\n}\n{\n const r = P.parseLines([\"this is not a bank statement\", \"just some words\"]);\n ok(\"junk in, nothing out, no crash\", r.verified === false && r.txns.length === 0);\n}\n\nconsole.log(\"\\n\" + pass + \" passed, \" + fail + \" failed\");\n",[416],["D",1784018167414],[75],["D",1784023962750],[107],["D",1784034643304],[125],["D",1784015454111],[235],["D",1785909498308],[145],["D",1784174043546],[244],"fb306433-3d4e-4c09-8c03-8baf96387fea","icon192.b64","019f5a38-e791-737e-9b19-6fd132541b63",["D",1783925106582],"iVBORw0KGgoAAAANSUhEUgAAAMAAAADACAYAAABS3GwHAAAHFklEQVR42u3de2iVdRzH8c85u3Pryp7U9qBLp3NzUzNtmpQp2ECthKiQBlEEQhDIgoKVRuBDUA4CFUIQIgopEc1q+0OpLBqaq6VtbVlmzuncTKLtTtqc3of+sAfMu3m3e7bd8zvv15/Lmf3u2+/9nnOuZikBZFRVRgTXC1TvsMb612ARMEwK3CJimBS3RcQwKW6LkGFS2DYxw6SbARYhw6RpbRMzTJrWFiHDpGltEzNMmtY2McOkqG1ihklR28QMk6K2iRkmRW0TM0yK2iZmmBS1TcwwKWqbmGFS1DYxw6SobWKGSVHbxAyTorY5JpjEZjrDpCltEfPIa16/UfmZWeoPBpXzyosciAMGeprIygHzVw6ms7ssQQzKOLUWLiGXUtjsNHpZ8yAelw/q7FMXDJ9geWERvKr08b6qphflzdP4t9+W5OZnVd4Kqq5ZpTOXrunMpIF99YBcLPrKAs+WIdmqPyRk5uUqsst5U1p+M9y+aiOMbLtCTz9myVFvzzYWyBznjxzu9YfN2rN+K9v9RuVn5mlmPzNbdfaZ04ry9frDwrJ8LZaFTr/ZjbW3xfeu3d5rvTKG3rIzS0N4uzt1PXWlt1eir9c5f11tvS1r0lFakoxFRK1Tc0KVdff59W1t3wxTdIdC1YFa1dTdG4uz36+/tj57rVUdW+dt15tt87e0/HeZOnRWfHQZ3Zc76e6TZ8AlqDwzPwXi3bF4vqZ8emlUvi3MnjuHF8u8dfPPKSTOTF2u/68/RKzXO3G+aq6P59rH3zdqf2edzxNRWsB0PxydH1WV/xkfWx+f/HxHRJ/nz2SPB13n7ZoxdHafU/nZ/9wRZm7mkNvbHnkl3zzY5+eOOlL39Uu6R9dYcPRr7O6/H6+7pV/LrmHXvHnvo/GO+5o4Y+QZzsRA0XwUwHi6JVL2VVDrqO2Sp+cqm1PJ2vLdHRz+9Xu5Y4Q8Y3iN6/Bhn/gAAAABJRU5ErkJggg==",[435],"c3a717d8-4ab6-465a-883a-8129db544837","icon180.b64","019f5a38-e791-737e-9b19-6bce69d3d8ee",["D",1783925106582],"iVBORw0KGgoAAAANSUhEUgAAALQAAAC0CAYAAAA9zQYyAAAGyklEQVR42u3dfWhVdRzH8c85u3Pryp7U9qBLp3NzUzNtmpQp2ECthKiQBlEEQhDIgoKVRuBDUA4CFUIQIgopEc1q+0OpLBqaq6VtbVlmzuncTKLtTtqc3of+sAfMu3m3e7bd8zvv15/Lmf3u2+/9nnOuZikBZFRVRgTXC1TvsMb612ARMEwK3CJimBS3RcQwKW6LkGFS2DYxw6SbARYhw6RpbRMzTJrWFiHDpGltEzNMmtY2McOkqG1ihklR28QMk6K2iRkmRW0TM0yK2iZmmBS1TcwwKWqbmGFS1DYxw6SobWKGSVHbxAyTorY5JpjEZjrDpCltEfPIa16/UfmZWeoPBpXzyosciAMGeprIygHzVw6ms7ssQQzKOLUWLiGXUtjsNHpZ8yAelw/q7FMXDJ9geWERvKr08b6qphflzdP4t9+W5OZnVd4Kqq5ZpTOXrunMpIF99YBcLPrKAs+WIdmqPyRk5uUqsst5U1p+M9y+aiOMbLtCTz9myVFvzzYWyBznjxzu9YfN2rN+K9v9RuVn5mlmPzNbdfaZ04ry9frDwrJ8LZaFTr/ZjbW3xfeu3d5rvTKG3rIzS0N4uzt1PXWlt1eir9c5f11tvS1r0lFakoxFRK1Tc0KVdff59W1t3wxTdIdC1YFa1dTdG4uz36+/tj57rVUdW+dt15tt87e0/HeZOnRWfHQZ3Zc76e6TZ8AlqDwzPwXi3bF4vqZ8emlUvi3MnjuHF8u8dfPPKSTOTF2u/68/RKzXO3G+aq6P59rH3zdqf2edzxNRWsB0PxydH1WV/xkfWx+f/HxHRJ/nz2SPB13n7ZoxdHafU/nZ/9wRZm7mkNvbHnkl3zzY5+eOOlL39Uu6R9dYcPRr7O6/H6+7pV/LrmHXvHnvo/GO+5o4Y+QZzsRA0XwUwHi6JVL2VVDrqO2Sp+cqm1PJ2vLdHRz+9Xu5Y4Q8Y3iN6/Bhn/gAAAABJRU5ErkJggg==",[441],["D",1784518496028],[253],["D",1785909609378],[262],["D",1784036164621],[271],["D",1784011477709],[280],"c61649a6-49fc-4971-b4f1-1fe712c3dfee","demo_data.ts","cd942e54-7eae-11f1-aca3-1607ee4eb77e",["D",1784009912922],"// Builds a believable 9-month budget for the demo account. Pure data — no side effects.\nconst DAY = 86400000;\nconst NOW = Date.now();\nconst r2 = (v: number) => Math.round((v + Number.EPSILON) * 100) / 100;\nlet seed = 20260713;\nconst rnd = () => { seed = (seed * 1103515245 + 12345) & 0x7fffffff; return seed / 0x7fffffff; };\nconst jitter = (v: number, pct: number) => r2(v * (1 + (rnd() - 0.5) * 2 * pct));\nconst pick = (a: T[]): T => a[Math.floor(rnd() * a.length)];\nlet n = 0;\nconst uid = () => \"demo\" + (n++).toString(36) + Math.floor(rnd() * 1e6).toString(36);\n\nconst DAYS = 274; // ~9 months of history\nconst START = NOW - DAYS * DAY;\n\n// ---- accounts and pockets ----\nconst P = (name: string, amount: number, freq: string, balance: number) => ({ id: uid(), name, balance, amount, freq });\n\nconst everyday = {\n id: uid(),\n name: \"Everyday\",\n showInPayday: true,\n pockets: [\n P(\"Rent\", 260, \"weekly\", 260),\n P(\"Groceries\", 130, \"weekly\", 84.15),\n P(\"Power\", 75, \"fortnightly\", 112.4),\n P(\"Internet\", 45, \"fortnightly\", 45),\n P(\"Phone\", 20, \"fortnightly\", 31.5),\n P(\"Petrol\", 60, \"fortnightly\", 38.2),\n P(\"Eating out\", 55, \"fortnightly\", 22.8),\n P(\"Coffee\", 25, \"fortnightly\", 11.5),\n P(\"Gym\", 25, \"fortnightly\", 25),\n P(\"Subscriptions\", 22, \"fortnightly\", 14.01),\n P(\"Car costs\", 50, \"fortnightly\", 462.75),\n P(\"Clothes\", 30, \"fortnightly\", 187.4),\n P(\"Gifts\", 20, \"fortnightly\", 143.6),\n P(\"Fun money\", 80, \"fortnightly\", 56.9),\n ],\n};\nconst savings = {\n id: uid(),\n name: \"Savings\",\n showInPayday: true,\n pockets: [\n P(\"Emergency fund\", 100, \"fortnightly\", 5240),\n P(\"Holiday\", 120, \"fortnightly\", 2870),\n P(\"House repairs\", 60, \"fortnightly\", 1615),\n ],\n};\nconst accounts = [everyday, savings];\nconst pk = (acc: any, name: string) => acc.pockets.find((p: any) => p.name === name);\n\n// ---- transaction history ----\nconst txns: any[] = [];\nconst spend = (ts: number, acc: any, pocket: any, amount: number, note: string) =>\n txns.push({ id: uid(), ts, type: \"spend\", account: acc.id, pocketId: pocket.id, amount: r2(amount), note, label: pocket.name });\n\nconst SHOPS = [\"New World\", \"Pak'nSave\", \"Countdown\", \"Four Square\"];\nconst CAFES = [\"Coffee Supreme\", \"Mojo\", \"The Daily\", \"Ozone\"];\nconst EATS = [\"Hell Pizza\", \"Burger Fuel\", \"Sal's Pizza\", \"Thai Bowl\", \"Sushi Ichiban\"];\nconst FUEL = [\"Z Energy\", \"BP Connect\", \"Mobil\", \"Gull\"];\n\nfor (let d = 0; d < DAYS; d++) {\n const ts = START + d * DAY + 9 * 3600000 + Math.floor(rnd() * 8 * 3600000);\n const dow = new Date(ts).getDay();\n\n // payday, fortnightly on Thursdays\n if (dow === 4 && Math.floor(d / 7) % 2 === 0) {\n txns.push({ id: uid(), ts, type: \"income\", account: \"\", pocketId: \"\", amount: jitter(2620, 0.06), note: \"Wages\", label: \"Pay\", payday: true });\n }\n if (dow === 2) spend(ts, everyday, pk(everyday, \"Rent\"), 260, \"Rent\"); // weekly\n if (dow === 0 || dow === 4) spend(ts, everyday, pk(everyday, \"Groceries\"), jitter(62, 0.35), pick(SHOPS));\n if (rnd() < 0.55) spend(ts, everyday, pk(everyday, \"Coffee\"), jitter(5.5, 0.2), pick(CAFES));\n if (rnd() < 0.16) spend(ts, everyday, pk(everyday, \"Eating out\"), jitter(28, 0.5), pick(EATS));\n if (d % 12 === 3) spend(ts, everyday, pk(everyday, \"Petrol\"), jitter(78, 0.2), pick(FUEL));\n if (d % 30 === 5) spend(ts, everyday, pk(everyday, \"Power\"), jitter(148, 0.25), \"Contact Energy\");\n if (d % 30 === 9) spend(ts, everyday, pk(everyday, \"Internet\"), 89.95, \"2degrees Broadband\");\n if (d % 30 === 12) spend(ts, everyday, pk(everyday, \"Phone\"), 40, \"One NZ\");\n if (d % 30 === 15) spend(ts, everyday, pk(everyday, \"Subscriptions\"), 24.99, \"Spotify\");\n if (d % 30 === 16) spend(ts, everyday, pk(everyday, \"Subscriptions\"), 19.99, \"Netflix\");\n if (d % 14 === 2) spend(ts, everyday, pk(everyday, \"Gym\"), 24.5, \"Les Mills\");\n if (rnd() < 0.07) spend(ts, everyday, pk(everyday, \"Fun money\"), jitter(35, 0.7), pick([\"Mitre 10\", \"Kmart\", \"The Warehouse\", \"JB Hi-Fi\", \"Whitcoulls\"]));\n if (rnd() < 0.03) spend(ts, everyday, pk(everyday, \"Clothes\"), jitter(75, 0.6), pick([\"Hallenstein\", \"Barkers\", \"Glassons\", \"Rebel Sport\"]));\n if (rnd() < 0.02) spend(ts, everyday, pk(everyday, \"Gifts\"), jitter(45, 0.5), \"Gift\");\n if (rnd() < 0.04) spend(ts, everyday, pk(everyday, \"Car costs\"), jitter(120, 0.8), pick([\"VTNZ\", \"Repco\", \"Tyre shop\", \"Car service\"]));\n}\ntxns.sort((a, b) => a.ts - b.ts);\n\n// ---- bills the app has detected ----\nconst bill = (name: string, amount: number, freq: string, nextInDays: number, kind: string, acc?: any, pocket?: any, extra: any = {}) =>\n Object.assign({ id: uid(), key: \"spend|\" + name.toLowerCase(), name, amount, kind, freq, nextTs: NOW + nextInDays * DAY, account: acc ? acc.id : \"\", pocketId: pocket ? pocket.id : \"\", source: \"auto\" }, extra);\n\nconst bills = [\n bill(\"Wages\", 2620, \"fortnightly\", 4, \"income\", undefined, undefined, { key: \"income|wages\", varies: true, source: \"picked\", sources: [\"wages\"] }),\n bill(\"Rent\", 260, \"weekly\", 1, \"bill\", everyday, pk(everyday, \"Rent\")),\n bill(\"Power\", 148, \"monthly\", 2, \"bill\", everyday, pk(everyday, \"Power\"), { varies: true }),\n bill(\"2degrees Broadband\", 89.95, \"monthly\", 6, \"bill\", everyday, pk(everyday, \"Internet\")),\n bill(\"One NZ\", 40, \"monthly\", 9, \"bill\", everyday, pk(everyday, \"Phone\")),\n bill(\"Spotify\", 24.99, \"monthly\", 12, \"bill\", everyday, pk(everyday, \"Subscriptions\")),\n bill(\"Netflix\", 19.99, \"monthly\", 13, \"bill\", everyday, pk(everyday, \"Subscriptions\")),\n bill(\"Les Mills\", 24.5, \"fortnightly\", 5, \"bill\", everyday, pk(everyday, \"Gym\")),\n];\n\n// ---- things still waiting in the inbox ----\nconst inbox = [\n { id: \"demo_in_1\", date: new Date(NOW - 1 * DAY).toISOString(), amount: -42.9, description: \"PAK N SAVE 4412\", merchant: \"Pak'nSave\", category: \"Groceries\", account: \"Everyday\" },\n { id: \"demo_in_2\", date: new Date(NOW - 1 * DAY).toISOString(), amount: -18.5, description: \"MOJO COFFEE\", merchant: \"Mojo\", category: \"Cafe\", account: \"Everyday\" },\n { id: \"demo_in_3\", date: new Date(NOW - 2 * DAY).toISOString(), amount: -129, description: \"REPCO 118\", merchant: \"Repco\", category: \"Automotive\", account: \"Everyday\" },\n { id: \"demo_in_4\", date: new Date(NOW - 3 * DAY).toISOString(), amount: -64.2, description: \"Z ENERGY GREENLANE\", merchant: \"Z Energy\", category: \"Fuel\", account: \"Everyday\" },\n { id: \"demo_in_5\", date: new Date(NOW - 4 * DAY).toISOString(), amount: -230, description: \"AA INSURANCE PREMIUM\", merchant: \"AA Insurance\", category: \"Insurance\", account: \"Everyday\" },\n];\nconst done = [\n { id: \"demo_dn_1\", date: new Date(NOW - 5 * DAY).toISOString(), amount: -24.99, description: \"SPOTIFY NZ\", merchant: \"Spotify\", category: \"Subscriptions\", account: \"Everyday\", resolution: \"Auto-filed to Subscriptions (rule)\", resolvedAt: NOW - 5 * DAY },\n { id: \"demo_dn_2\", date: new Date(NOW - 6 * DAY).toISOString(), amount: -61.4, description: \"NEW WORLD METRO\", merchant: \"New World\", category: \"Groceries\", account: \"Everyday\", resolution: \"Auto-filed to Groceries (rule)\", resolvedAt: NOW - 6 * DAY },\n { id: \"demo_dn_3\", date: new Date(NOW - 8 * DAY).toISOString(), amount: 2634.18, description: \"SALARY\", merchant: \"\", category: \"\", account: \"Everyday\", resolution: \"Filed as payday\", resolvedAt: NOW - 8 * DAY },\n];\n\nconst rules = [\n { id: uid(), match: \"New World\", account: everyday.id, pocketId: pk(everyday, \"Groceries\").id, mode: \"auto\" },\n { id: uid(), match: \"Pak'nSave\", account: everyday.id, pocketId: pk(everyday, \"Groceries\").id, mode: \"auto\" },\n { id: uid(), match: \"Z Energy\", account: everyday.id, pocketId: pk(everyday, \"Petrol\").id, mode: \"auto\" },\n { id: uid(), match: \"Spotify\", account: everyday.id, pocketId: pk(everyday, \"Subscriptions\").id, mode: \"auto\" },\n { id: uid(), match: \"Transfer to savings\", account: \"\", pocketId: \"\", mode: \"ignore\" },\n];\n\nconst goals = [\n { id: uid(), name: \"Japan trip\", target: 6000, date: \"2027-03-01\", scope: \"pocket\", account: savings.id, pocketId: pk(savings, \"Holiday\").id },\n { id: uid(), name: \"6 months emergency fund\", target: 12000, date: \"\", scope: \"pocket\", account: savings.id, pocketId: pk(savings, \"Emergency fund\").id },\n];\n\n// ---- assets, debts, and the net-worth history behind the graph ----\nconst assets = [\n { id: uid(), name: \"House\", type: \"Property\", balance: 735000, updated: NOW },\n { id: uid(), name: \"KiwiSaver\", type: \"Investment\", balance: 31480, updated: NOW },\n { id: uid(), name: \"Investments\", type: \"Investment\", balance: 9260, updated: NOW },\n { id: uid(), name: \"Car\", type: \"Vehicle\", balance: 11500, updated: NOW },\n];\nconst debts = [\n {\n id: uid(), name: \"Home loan\", kind: \"mortgage\", splits: [\n { id: uid(), name: \"Fixed portion\", type: \"fixed\", balance: 372000, rate: 5.79, repayment: 1180, freq: \"fortnightly\", fixedUntil: new Date(NOW + 61 * DAY).toISOString().slice(0, 10) },\n { id: uid(), name: \"Floating portion\", type: \"floating\", balance: 84000, rate: 7.19, repayment: 320, freq: \"fortnightly\", fixedUntil: \"\" },\n ],\n },\n { id: uid(), name: \"Car loan\", kind: \"loan\", balance: 6180, rate: 9.95, repayment: 145, freq: \"fortnightly\" },\n];\n\nconst cashNow = r2(accounts.reduce((t, a) => t + a.pockets.reduce((x: number, p: any) => x + p.balance, 0), 0));\nconst assetsNow = assets.reduce((t, a) => t + a.balance, 0);\nconst debtsNow = debts.reduce((t: number, d: any) =>\n t + (d.splits ? d.splits.reduce((x: number, s: any) => x + s.balance, 0) : d.balance), 0);\n\n// walk backwards so today's snapshot is exactly what the app shows\nconst snaps: any[] = [];\nfor (let d = DAYS; d >= 0; d--) {\n const ts = NOW - d * DAY;\n const back = d / DAYS;\n const cash = r2(cashNow - back * 3100 + (rnd() - 0.5) * 260);\n const asset = r2(assetsNow - back * 6900 - (rnd() - 0.5) * 400);\n const debt = r2(debtsNow + back * 11800 + (rnd() - 0.5) * 300);\n snaps.push({ d: new Date(ts).toISOString().slice(0, 10), ts, cash, assets: asset, debts: debt, net: r2(cash + asset - debt) });\n}\n\nexport const DEMO = {\n version: 4,\n updated: NOW,\n payFreq: \"fortnightly\",\n accounts,\n paydayLines: [],\n txns,\n inbox,\n handled: [],\n done,\n goals,\n rules,\n autoMatchPockets: true,\n worth: { assets, debts, snaps },\n bills,\n billsSkip: [],\n notify: { enabled: false, updates: true, shortfall: true, bills: true, refix: true, inbox: true },\n};\n\nexport const SUMMARY = {\n txns: txns.length,\n cash: cashNow,\n assets: assetsNow,\n debts: debtsNow,\n net: r2(cashNow + assetsNow - debtsNow),\n snaps: snaps.length,\n pockets: accounts.reduce((t, a) => t + a.pockets.length, 0),\n};\n",[455],"99694a55-68a8-4137-b7c2-8389247fa54b","csv_test.ts","2f3fa710-7f0d-11f1-a074-1607ee4eb77e",["D",1784009912922],"// Tests the statement parser against the shapes NZ bank exports actually come in, plus the\n// horrible edge cases. The parser is format-agnostic by design -- these are here to prove it\n// copes, NOT to hard-code any bank's layout.\n(globalThis as any).window = globalThis;\nawait import(\"./csv.js\");\nconst CSV = (globalThis as any).CSV;\n\nlet pass = 0, fail = 0;\nconst ok = (n: string, c: boolean, extra = \"\") => {\n if (c) { pass++; console.log(\" PASS \" + n); }\n else { fail++; console.log(\" FAIL \" + n + (extra ? \" -> \" + extra : \"\")); }\n};\nconst d = (ts: number) => new Date(ts).toISOString().slice(0, 10);\n\n// ---------------------------------------------------------------- amounts\nconsole.log(\"=== money parsing ===\");\nconst A = CSV.parseAmount;\nok(\"plain negative\", A(\"-42.50\") === -42.5);\nok(\"dollar sign + thousands\", A(\"$1,234.56\") === 1234.56);\nok(\"brackets mean negative\", A(\"(1,234.56)\") === -1234.56);\nok(\"trailing minus\", A(\"42.50-\") === -42.5);\nok(\"blank is null\", A(\"\") === null);\nok(\"zero\", A(\"0.00\") === 0);\nok(\"no false positive on text\", A(\"Countdown\") === null);\n\n// ---------------------------------------------------------------- dates\nconsole.log(\"\\n=== date parsing ===\");\nconst P = CSV.parseDate;\nok(\"NZ day-first 05/07/2026 = 5 July\", d(P(\"05/07/2026\", \"DMY\")) === \"2026-07-05\");\nok(\"US month-first 05/07/2026 = 5 May\", d(P(\"05/07/2026\", \"MDY\")) === \"2026-05-07\");\nok(\"ISO\", d(P(\"2026-07-05\", \"DMY\")) === \"2026-07-05\");\nok(\"2-digit year\", d(P(\"05/07/26\", \"DMY\")) === \"2026-07-05\");\nok(\"written month\", d(P(\"14 Jul 2026\", \"DMY\")) === \"2026-07-14\");\nok(\"rubbish is null\", P(\"not a date\", \"DMY\") === null);\nok(\"impossible month rejected\", P(\"05/19/2026\", \"DMY\") === null);\n\nconsole.log(\"\\n=== day-first vs month-first detection ===\");\nok(\"sees 25/01 and knows it's day-first\", CSV.dateOrder([\"01/02/2026\", \"25/01/2026\"]) === \"DMY\");\nok(\"sees 01/25 and knows it's month-first\", CSV.dateOrder([\"02/01/2026\", \"01/25/2026\"]) === \"MDY\");\nok(\"ambiguous defaults to NZ day-first\", CSV.dateOrder([\"01/02/2026\", \"03/04/2026\"]) === \"DMY\");\n\n// ---------------------------------------------------------------- whole files\nfunction run(name: string, text: string, expect: any) {\n console.log(\"\\n=== \" + name + \" ===\");\n const det = CSV.read(text);\n const built = CSV.build(det, det.map, det.order, \"Everyday\");\n const items = built.items;\n const hdr = det.headerIdx >= 0 ? det.header : [];\n console.log(\" detected: date=\" + (hdr[det.map.date] ?? det.map.date) +\n \" amount=\" + (det.map.amount >= 0 ? (hdr[det.map.amount] ?? det.map.amount) : \"debit/credit pair\") +\n \" desc=\" + (hdr[det.map.desc] ?? det.map.desc) + \" order=\" + det.order);\n ok(\"row count\", items.length === expect.count, \"got \" + items.length + \" want \" + expect.count);\n if (items.length) {\n ok(\"first date \" + d(Date.parse(items[0].date)), d(Date.parse(items[0].date)) === expect.firstDate, \"got \" + d(Date.parse(items[0].date)));\n ok(\"first amount \" + items[0].amount, items[0].amount === expect.firstAmount, \"got \" + items[0].amount);\n ok(\"first description mentions \" + expect.descHas, String(items[0].description).toLowerCase().includes(expect.descHas.toLowerCase()), \"got \" + items[0].description);\n const total = Math.round(items.reduce((t: number, i: any) => t + i.amount, 0) * 100) / 100;\n ok(\"net total \" + total, total === expect.total, \"got \" + total);\n const debits = items.filter((i: any) => i.amount < 0).length;\n ok(\"debits/credits split \" + debits + \"/\" + (items.length - debits), debits === expect.debits);\n }\n return items;\n}\n\n// ANZ-style: Type, Details, Particulars, Code, Reference, Amount, Date\nrun(\"ANZ-style (amount and date at the end)\", [\n \"Type,Details,Particulars,Code,Reference,Amount,Date,ForeignCurrencyAmount,ConversionCharge\",\n \"Eftpos,COUNTDOWN 4412,,,,-42.90,05/07/2026,,\",\n \"Direct Credit,WAGES,SALARY,,,2620.00,03/07/2026,,\",\n \"Bank Fee,MONTHLY FEE,,,,-5.00,01/07/2026,,\",\n].join(\"\\n\"), { count: 3, firstDate: \"2026-07-05\", firstAmount: -42.9, descHas: \"countdown\", total: 2572.1, debits: 2 });\n\n// ASB-style: preamble junk lines, THEN headers\nrun(\"ASB-style (preamble rows before the header)\", [\n \"Created date / time : 14 July 2026 / 09:12:05\",\n \"Bank 12; Branch 3011; Account 0123456-50 (Streamline)\",\n \"From date 20260601\",\n \"To date 20260714\",\n \"\",\n \"Date,Unique Id,Tran Type,Cheque Number,Payee,Memo,Amount\",\n \"2026-07-05,2026070501,EFTPOS,,NEW WORLD METRO,,-61.40\",\n \"2026-07-03,2026070301,CREDIT,,SALARY,PAY,2634.18\",\n \"2026-07-02,2026070201,DEBIT,,SPOTIFY NZ,,-24.99\",\n].join(\"\\n\"), { count: 3, firstDate: \"2026-07-05\", firstAmount: -61.4, descHas: \"new world\", total: 2547.79, debits: 2 });\n\n// Kiwibank-style: SEPARATE debit and credit columns, plus a running balance to trip us up\nrun(\"Kiwibank-style (separate debit/credit columns + balance)\", [\n \"Account number,Date,Memo/Description,Source Code,Amount (credit),Amount (debit),Balance\",\n \"38-9012-0123456-00,05/07/2026,Z ENERGY GREENLANE,POS,,64.20,1935.80\",\n \"38-9012-0123456-00,03/07/2026,SALARY,DC,2620.00,,2000.00\",\n \"38-9012-0123456-00,01/07/2026,LES MILLS,DD,,24.50,-620.00\",\n].join(\"\\n\"), { count: 3, firstDate: \"2026-07-05\", firstAmount: -64.2, descHas: \"z energy\", total: 2531.3, debits: 2 });\n\n// Westpac-style with quoted fields containing commas\nrun(\"quoted fields with commas inside\", [\n \"Date,Amount,Other Party,Description,Reference\",\n '05/07/2026,-129.00,\"REPCO 118, GREENLANE\",\"Car parts, oil\",',\n '03/07/2026,2620.00,\"EMPLOYER LTD\",\"Salary\",PAY',\n].join(\"\\n\"), { count: 2, firstDate: \"2026-07-05\", firstAmount: -129, descHas: \"repco\", total: 2491, debits: 1 });\n\n// Semicolon-delimited, European decimals\nrun(\"semicolons and comma decimals\", [\n \"Date;Description;Amount\",\n \"05/07/2026;PAK N SAVE;-42,90\",\n \"03/07/2026;WAGES;2620,00\",\n].join(\"\\n\"), { count: 2, firstDate: \"2026-07-05\", firstAmount: -42.9, descHas: \"pak\", total: 2577.1, debits: 1 });\n\n// The nastiest realistic case: balance column that looks exactly like an amount column\nconsole.log(\"\\n=== the trap: don't mistake the BALANCE column for the amount ===\");\n{\n const text = [\n \"Date,Description,Amount,Balance\",\n \"05/07/2026,COUNTDOWN,-42.90,1957.10\",\n \"03/07/2026,WAGES,2620.00,2000.00\",\n ].join(\"\\n\");\n const det = CSV.read(text);\n const items = CSV.build(det, det.map, det.order, \"X\").items;\n ok(\"picked Amount, not Balance\", det.header[det.map.amount] === \"Amount\", \"picked \" + det.header[det.map.amount]);\n ok(\"amounts are right\", items[0].amount === -42.9 && items[1].amount === 2620);\n}\n\n// ---------------------------------------------------------------- dedupe\nconsole.log(\"\\n=== dedupe: re-importing an overlapping statement ===\");\n{\n const jan = \"Date,Description,Amount\\n05/07/2026,COUNTDOWN,-42.90\\n03/07/2026,WAGES,2620.00\";\n const feb = \"Date,Description,Amount\\n05/07/2026,COUNTDOWN,-42.90\\n03/07/2026,WAGES,2620.00\\n08/07/2026,MOJO,-5.50\";\n const a = CSV.build(CSV.read(jan), CSV.read(jan).map, \"DMY\", \"X\").items;\n const b = CSV.build(CSV.read(feb), CSV.read(feb).map, \"DMY\", \"X\").items;\n const seen: Record = {};\n a.forEach((i: any) => seen[CSV.fingerprint(i)] = 1);\n const fresh = b.filter((i: any) => !seen[CSV.fingerprint(i)]);\n ok(\"second import only brings in the ONE new row\", fresh.length === 1, \"got \" + fresh.length);\n ok(\"and it's the right one\", fresh[0].description.includes(\"MOJO\"));\n ok(\"identical rows produce identical ids\", CSV.fingerprint(a[0]) === CSV.fingerprint(b[0]));\n ok(\"different amounts produce different ids\",\n CSV.fingerprint({ date: \"2026-07-05\", amount: -42.9, description: \"X\" }) !==\n CSV.fingerprint({ date: \"2026-07-05\", amount: -42.91, description: \"X\" }));\n // a genuine second coffee on the same day for the same amount SHOULD be treated as a duplicate --\n // that's the safe direction to err. Better to miss one than to double-count someone's money.\n console.log(\" (note: two identical purchases on one day collapse to one. Safe direction.)\");\n}\n\n// ---------------------------------------------------------------- junk\nconsole.log(\"\\n=== junk in, nothing broken out ===\");\n{\n const junk = \"this is not a csv at all\\njust some words\";\n let threw = false;\n try { const det = CSV.read(junk); CSV.build(det, det.map, det.order, \"X\"); } catch (_) { threw = true; }\n ok(\"garbage doesn't throw\", !threw);\n\n const partial = [\"Date,Description,Amount\", \"05/07/2026,GOOD,-10.00\", \"NOT A DATE,BAD,-20.00\", \",,\", \"07/07/2026,ALSO GOOD,-30.00\"].join(\"\\n\");\n const det = CSV.read(partial);\n const built = CSV.build(det, det.map, det.order, \"X\");\n ok(\"keeps the good rows, drops the bad\", built.items.length === 2, \"kept \" + built.items.length);\n ok(\"and counts what it skipped\", built.skipped === 1, \"skipped \" + built.skipped);\n ok(\"no money invented\", built.items.reduce((t: number, i: any) => t + i.amount, 0) === -40);\n}\n\nconsole.log(\"\\n\" + pass + \" passed, \" + fail + \" failed\");\n",[461],"10ff57e0-5a5c-4251-b59f-c7236d4055f7","csv.js","fd1bdaba-7f0c-11f1-a17f-1607ee4eb77e",["D",1784009912922],"/* Statement import. Everything here runs in the browser -- a bank statement never touches the\n server, which is the whole point of the encryption work.\n\n Deliberately NOT hard-coded per bank. Every bank has a different CSV layout and they change\n them without telling anyone, so instead we read the file and work out what's in it, then let\n the user correct us. Guessing wrong about which column is \"amount\" would silently corrupt\n someone's money, so the user always sees a preview before anything is imported. */\n(function(){\n\n /* ---------- RFC-4180-ish parser: handles quoted fields, embedded commas and newlines ---------- */\n function parseDelimited(text, delim){\n var rows = [], row = [], cur = '', inQ = false, i = 0;\n text = String(text).replace(/^/, ''); // strip BOM\n while(i < text.length){\n var ch = text[i];\n if(inQ){\n if(ch === '\"'){\n if(text[i+1] === '\"'){ cur += '\"'; i += 2; continue; } // escaped quote\n inQ = false; i++; continue;\n }\n cur += ch; i++; continue;\n }\n if(ch === '\"'){ inQ = true; i++; continue; }\n if(ch === delim){ row.push(cur); cur = ''; i++; continue; }\n if(ch === '\\r'){ i++; continue; }\n if(ch === '\\n'){ row.push(cur); rows.push(row); row = []; cur = ''; i++; continue; }\n cur += ch; i++;\n }\n if(cur.length || row.length){ row.push(cur); rows.push(row); }\n return rows.filter(function(r){ return r.some(function(c){ return String(c).trim() !== ''; }); });\n }\n\n /* Which separator is it? Whichever gives the most consistent column count. */\n function sniffDelim(text){\n var head = text.split(/\\r?\\n/).slice(0, 20).join('\\n');\n var best = ',', bestScore = -1;\n [',', ';', '\\t', '|'].forEach(function(d){\n var rows = parseDelimited(head, d);\n if(rows.length < 2) return;\n var counts = {};\n rows.forEach(function(r){ counts[r.length] = (counts[r.length] || 0) + 1; });\n var mode = 0, modeN = 0;\n Object.keys(counts).forEach(function(k){ if(counts[k] > modeN){ modeN = counts[k]; mode = +k; } });\n var score = mode > 1 ? modeN * mode : 0; // consistent AND more than one column\n if(score > bestScore){ bestScore = score; best = d; }\n });\n return best;\n }\n\n /* ---------- value readers ---------- */\n\n /* NZ banks write dates as DD/MM/YYYY. American software writes MM/DD/YYYY. Getting this backwards\n silently moves transactions into the wrong month, so we look at the WHOLE column: if any value\n has a first part above 12, it must be day-first. Only if it's genuinely ambiguous do we assume\n day-first, because this is New Zealand. */\n function dateOrder(values){\n var sawBigFirst = false, sawBigSecond = false;\n values.forEach(function(v){\n var m = String(v).match(/^(\\d{1,2})[\\/\\-.](\\d{1,2})[\\/\\-.](\\d{2,4})/);\n if(!m) return;\n if(+m[1] > 12) sawBigFirst = true;\n if(+m[2] > 12) sawBigSecond = true;\n });\n if(sawBigFirst) return 'DMY';\n if(sawBigSecond) return 'MDY';\n return 'DMY';\n }\n\n function parseDate(v, order){\n var s = String(v || '').trim();\n if(!s) return null;\n var m = s.match(/^(\\d{4})-(\\d{1,2})-(\\d{1,2})/); // ISO\n if(m) return new Date(+m[1], +m[2]-1, +m[3], 12).getTime();\n m = s.match(/^(\\d{1,2})[\\/\\-.](\\d{1,2})[\\/\\-.](\\d{2,4})/);\n if(m){\n var a = +m[1], b = +m[2], y = +m[3];\n if(y < 100) y += y < 70 ? 2000 : 1900;\n var d = (order === 'MDY') ? b : a;\n var mo = (order === 'MDY') ? a : b;\n if(mo < 1 || mo > 12 || d < 1 || d > 31) return null;\n return new Date(y, mo-1, d, 12).getTime();\n }\n m = s.match(/^(\\d{1,2})\\s+([A-Za-z]{3,})\\s+(\\d{2,4})/); // 14 Jul 2026\n if(m){\n var MON = ['jan','feb','mar','apr','may','jun','jul','aug','sep','oct','nov','dec'];\n var mi = MON.indexOf(m[2].slice(0,3).toLowerCase());\n if(mi < 0) return null;\n var yy = +m[3]; if(yy < 100) yy += 2000;\n return new Date(yy, mi, +m[1], 12).getTime();\n }\n var t = Date.parse(s);\n return isNaN(t) ? null : t;\n }\n\n /* Money. Handles $1,234.56 (1,234.56) -1234.56 1 234,56 */\n function parseAmount(v){\n var s = String(v == null ? '' : v).trim();\n if(!s) return null;\n var neg = false;\n if(/^\$.*\$$/.test(s)){ neg = true; s = s.slice(1, -1); }\n if(/^-/.test(s)){ neg = true; s = s.slice(1); }\n if(/-$/.test(s)){ neg = true; s = s.slice(0, -1); } // trailing minus\n s = s.replace(/[^0-9.,]/g, '');\n if(!s) return null;\n var lastDot = s.lastIndexOf('.'), lastCom = s.lastIndexOf(',');\n if(lastCom > lastDot){ s = s.replace(/\\./g, '').replace(',', '.'); } // european\n else { s = s.replace(/,/g, ''); }\n var n = parseFloat(s);\n if(isNaN(n)) return null;\n return neg ? -Math.abs(n) : n;\n }\n\n var looksLikeDate = function(v){ return parseDate(v, 'DMY') !== null; };\n var looksLikeMoney = function(v){\n var s = String(v == null ? '' : v).trim();\n if(!s) return false;\n if(!/[0-9]/.test(s)) return false;\n if(!/^[\\s$()\\-+0-9.,]+$/.test(s)) return false;\n return parseAmount(s) !== null;\n };\n\n /* ---------- work out which column is which ---------- */\n var DATE_WORDS = ['date', 'transaction date', 'processed', 'posted'];\n var DESC_WORDS = ['description', 'details', 'payee', 'particulars', 'memo', 'narrative', 'reference', 'other party', 'op name', 'merchant', 'transaction'];\n var AMT_WORDS = ['amount', 'value', 'transaction amount'];\n var DR_WORDS = ['debit', 'withdrawal', 'money out', 'paid out', 'amount (debit)'];\n var CR_WORDS = ['credit', 'deposit', 'money in', 'paid in', 'amount (credit)'];\n var BAL_WORDS = ['balance', 'running balance'];\n\n var norm = function(s){ return String(s || '').toLowerCase().replace(/[^a-z() ]/g, ' ').replace(/\\s+/g, ' ').trim(); };\n function hits(header, words){\n var h = norm(header);\n if(!h) return 0;\n var best = 0;\n words.forEach(function(w){\n if(h === w) best = Math.max(best, 3);\n else if(h.indexOf(w) >= 0) best = Math.max(best, 2);\n });\n return best;\n }\n\n /* Banks love a few lines of preamble (\"Account: 01-0495...\", blank line, THEN the headers).\n Find the row that actually looks like a header: mostly non-numeric, and followed by rows\n that parse as dates/money. */\n function findHeader(rows){\n var limit = Math.min(rows.length, 15);\n for(var i = 0; i < limit; i++){\n var r = rows[i];\n if(r.length < 3) continue;\n var wordy = r.filter(function(c){ return /[a-z]/i.test(c) && !looksLikeMoney(c) && !looksLikeDate(c); }).length;\n if(wordy < 2) continue;\n var below = rows.slice(i+1, i+6).filter(function(x){ return x.length === r.length; });\n if(!below.length) continue;\n var anyDate = below.some(function(x){ return x.some(looksLikeDate); });\n var anyMoney = below.some(function(x){ return x.some(looksLikeMoney); });\n if(anyDate && anyMoney) return i;\n }\n return -1; // no header at all -- some exports are headerless\n }\n\n function detect(rows, headerIdx){\n var header = headerIdx >= 0 ? rows[headerIdx] : [];\n var body = rows.slice(headerIdx + 1).filter(function(r){ return r.length === (header.length || r.length); });\n var cols = Math.max.apply(null, rows.map(function(r){ return r.length; }));\n var sample = body.slice(0, 40);\n\n var stats = [];\n for(var c = 0; c < cols; c++){\n var vals = sample.map(function(r){ return r[c]; }).filter(function(v){ return v != null && String(v).trim() !== ''; });\n stats.push({\n i: c,\n head: header[c] || '',\n vals: vals,\n /* How often the column is filled in at all. ANZ splits the merchant name across Details /\n Particulars / Code / Reference and leaves most of them blank -- without this, a column\n that's empty on 9 rows out of 10 can still win on the one row it does have. */\n coverage: sample.length ? vals.length / sample.length : 0,\n dateRate: vals.length ? vals.filter(looksLikeDate).length / vals.length : 0,\n moneyRate: vals.length ? vals.filter(looksLikeMoney).length / vals.length : 0,\n textRate: vals.length ? vals.filter(function(v){ return /[a-z]{3}/i.test(v) && !looksLikeDate(v); }).length / vals.length : 0,\n avgLen: vals.length ? vals.reduce(function(t, v){ return t + String(v).length; }, 0) / vals.length : 0,\n });\n }\n\n var used = {};\n function best(scorer){\n var pick = null, top = 0;\n stats.forEach(function(s){\n if(used[s.i]) return;\n var v = scorer(s);\n if(v > top){ top = v; pick = s; }\n });\n if(pick) used[pick.i] = 1;\n return pick ? pick.i : -1;\n }\n\n var date = best(function(s){ return s.dateRate * s.coverage * 10 + hits(s.head, DATE_WORDS) * 5; });\n\n // separate debit / credit columns (Kiwibank, some ASB exports)\n var drIdx = -1, crIdx = -1;\n stats.forEach(function(s){\n if(used[s.i] || s.moneyRate < 0.3) return;\n if(hits(s.head, DR_WORDS) >= 2 && drIdx < 0) drIdx = s.i;\n if(hits(s.head, CR_WORDS) >= 2 && crIdx < 0) crIdx = s.i;\n });\n var amount = -1;\n if(drIdx >= 0 || crIdx >= 0){\n used[drIdx] = 1; used[crIdx] = 1;\n } else {\n amount = best(function(s){\n if(hits(s.head, BAL_WORDS) >= 2) return 0; // never mistake balance for amount\n return s.moneyRate * s.coverage * 10 + hits(s.head, AMT_WORDS) * 6;\n });\n }\n\n /* Coverage matters most here: the column that names the merchant is the one that's filled in\n on nearly every row. A header that says \"Particulars\" but is blank 2 rows out of 3 is not\n the description, whatever it calls itself. */\n var desc = best(function(s){\n return s.textRate * s.coverage * 8\n + hits(s.head, DESC_WORDS) * 5 * (0.3 + 0.7 * s.coverage)\n + Math.min(s.avgLen, 30) / 10 * s.coverage;\n });\n\n return {\n header: header, headerIdx: headerIdx, body: body, cols: cols, stats: stats,\n map: { date: date, amount: amount, debit: drIdx, credit: crIdx, desc: desc },\n order: dateOrder((date >= 0 ? sample.map(function(r){ return r[date]; }) : [])),\n };\n }\n\n /* ---------- turn rows into inbox items ---------- */\n function build(det, map, order, accountName){\n var out = [], skipped = 0;\n det.body.forEach(function(r){\n var ts = parseDate(r[map.date], order);\n if(ts === null){ skipped++; return; }\n\n var amt = null;\n if(map.amount >= 0){\n amt = parseAmount(r[map.amount]);\n } else {\n var dr = map.debit >= 0 ? parseAmount(r[map.debit]) : null;\n var cr = map.credit >= 0 ? parseAmount(r[map.credit]) : null;\n if(dr) amt = -Math.abs(dr);\n else if(cr) amt = Math.abs(cr);\n }\n if(amt === null || amt === 0){ skipped++; return; }\n\n // stitch together anything descriptive we didn't otherwise use\n var bits = [];\n if(map.desc >= 0 && r[map.desc]) bits.push(String(r[map.desc]).trim());\n var desc = bits.join(' ').replace(/\\s+/g, ' ').trim() || 'Imported transaction';\n\n out.push({\n date: new Date(ts).toISOString(),\n amount: Math.round(amt * 100) / 100,\n description: desc,\n merchant: '',\n category: '',\n account: accountName || 'Imported',\n imported: true,\n });\n });\n return { items: out, skipped: skipped };\n }\n\n /* Stable id from the contents, so importing an overlapping statement twice can't double-count.\n Same shape as the Akahu pending ids: contents in, short string out. */\n function fingerprint(it){\n var raw = [\n String(it.date).slice(0, 10),\n Math.round(Math.abs(it.amount) * 100),\n String(it.description || '').toLowerCase().replace(/\\s+/g, ' ').trim(),\n it.amount < 0 ? 'd' : 'c',\n ].join('|');\n var a = 0x811c9dc5, b = 0x811c9dc5 ^ raw.length;\n for(var i = 0; i < raw.length; i++){ a ^= raw.charCodeAt(i); a = Math.imul(a, 0x01000193) >>> 0; }\n for(var j = raw.length - 1; j >= 0; j--){ b ^= raw.charCodeAt(j); b = Math.imul(b, 0x01000193) >>> 0; }\n return 'csv_' + a.toString(36) + b.toString(36);\n }\n\n window.CSV = {\n parseDelimited: parseDelimited,\n sniffDelim: sniffDelim,\n parseDate: parseDate,\n parseAmount: parseAmount,\n dateOrder: dateOrder,\n findHeader: findHeader,\n detect: detect,\n build: build,\n fingerprint: fingerprint,\n read: function(text){\n var d = sniffDelim(text);\n var rows = parseDelimited(text, d);\n var hi = findHeader(rows);\n var det = detect(rows, hi);\n det.delim = d;\n return det;\n },\n };\n})();\n",[467],"c5c1d90f-0118-48b7-aad6-b2a32fa20454","SECURITY_NOTES.md","28436a98-7e9d-11f1-91ed-1607ee4eb77e",["D",1784009912922],"# Stash — security & \"can we release this?\" notes\n\nWritten 13 Jul 2026. Parked, not actioned. Read before opening signups to anyone\noutside the circle of people who already trust Riley personally.\n\n---\n\n## 1. The thing Riley noticed\n\nThe operator (Riley) can read every user's financial data without their password.\n\n| What | Where | Who can read it |\n|---|---|---|\n| Budget data (pockets, txns, assets, worth) | blob `bud_`, **plaintext JSON** | anyone with the Val Town login |\n| Akahu tokens | sqlite `mb_bank`, AES-GCM **encrypted with `APP_KEY`** | anyone with the Val Town login (they own `APP_KEY`) |\n| Passwords | sqlite `mb_users`, PBKDF2-SHA256 120k iters + per-user salt | **nobody** — this bit is fine |\n\nEncrypting with a key you own is not protection *from you*. It only protects\nagainst a leaked database.\n\n## 2. The fix, if we ever want it: E2E encrypt the budget blob\n\nDesign (do NOT half-build this — losing the key means losing user data):\n\n1. On signup, generate a random 256-bit **data key** (DK).\n2. Derive `Kpw` from the user's password (PBKDF2/Argon2, **different salt+params\n from the auth hash** — never reuse the auth derivation).\n3. Derive `Krc` from their recovery code the same way.\n4. Store DK **twice**: `wrap(DK, Kpw)` and `wrap(DK, Krc)`. Server holds only\n ciphertext, never DK.\n5. Client encrypts state with DK before `POST /api/state`; decrypts after `GET`.\n6. Password change = re-wrap DK with the new `Kpw`. Recovery reset = unwrap with\n `Krc`, re-wrap with new `Kpw`. **Data survives both.**\n\n### Two honest costs\n\n- **Crons go blind.** `notify.ts` reads budget data to detect shortfall / bills\n due / inbox count. Encrypted, it can't. Those checks must move client-side\n (compute on app open, schedule a local notification) or we keep a tiny\n plaintext \"hints\" blob — which leaks a little, so decide deliberately.\n- **Bank tokens can NOT be E2E encrypted** while a server-side cron refreshes\n them. Something on the server must decrypt them to call Akahu. Either accept\n that narrower exposure, or drop background refresh and sync only when the app\n is open.\n\n## 3. Cheap fixes worth doing regardless\n\n- **No rate limiting** on `/api/login` or `/api/recover/*` → brute-forceable.\n- **Sessions never expire** (`mb_sessions` has `created` but nothing reads it).\n- **Password minimum is 6 chars**, no complexity rule.\n- Delete one-off admin/debug scripts after use (they're the read-anything hole).\n- Consider an audit log of any operator data access.\n\n---\n\n## 4. Akahu: the real wall to a public release\n\nSource: developers.akahu.nz — Personal Apps, App Accreditation, OAuth2 guides.\n\n### What we're on now\n\n**Personal App.** Akahu's stated limit: **1 user, restricted to your own Akahu\naccount.** Free. Daily scheduled refresh, 1-hour manual refresh rest period.\nRiley and Ella each have their own personal app and paste their own tokens.\n**This model cannot serve other people. There is no \"add users\" option.**\n\n### What public release requires: a Full App + Accreditation\n\nFour gates:\n\n1. **Privacy notice** covering data exchanged via Akahu.\n2. **Consumer information page** — what data, why, one-off vs ongoing, plus an\n accurate description of Akahu and their logo.\n3. **Security + penetration test** — grey-box pentest of the user-facing app and\n its APIs, by a competent firm. Real money (thousands). Only waivable if we\n hold SOC 2 / ISO 27001, which we don't.\n4. **Akahu application review** — free for the first review and the first re-check\n of fixes; **$1,000 per subsequent review**. Full apps are usage-priced, not free.\n\n### Where Stash currently FAILS their requirements\n\n- ❌ *\"Akahu credentials (App Secret and User Access Tokens) are not exposed to\n the client\"* — our entire connect flow is the user pasting a **user access\n token** into the client. This is exactly backwards. Needs the **OAuth2\n authorization-code flow**: redirect to Akahu → user picks accounts → we get a\n `code` → **server** exchanges it (within 60s) for the user token via `/token`\n with our App Secret. Must use the `state` param.\n- ❌ **Password strength** — 6 chars, no complexity. They require \"high quality\n strength requirements (minimum length & character variation)\".\n- ⚠️ **MFA** — required in general, BUT they explicitly say read-only apps may get\n relaxed requirements at their discretion (username + strong password is\n allowable). **Stash is read-only, no payments — ask them for this exemption.**\n- ⚠️ **Persistent sessions** — web sessions >2h must expire MFA status after 2h.\n Ours never expire at all.\n- ❌ **Consumer controls**, none of which we have:\n - show a summary of accounts connected via Akahu\n - let the user revoke access (`DELETE /authorisations/{id}` or `DELETE /token`)\n - revoke ALL access + delete their Akahu-derived data when they delete their\n Stash account (Privacy Act 2020: only retain data as long as reasonably needed)\n - handle the token being revoked externally — either the `TOKEN DELETE` webhook\n or by handling 401s from Akahu\n - alert the user when a connected account's `status` goes `INACTIVE`\n\n### NZ Privacy Act 2020\n\nOnce we hold strangers' financial data we're an \"agency\": need a privacy policy,\na breach-notification plan, and data deletion on revoke/account-deletion.\n\n---\n\n## 5. The three realistic paths\n\n1. **Friends-only, stay as-is.** Free, legitimate, works. Each person makes their\n own Akahu personal app and pastes tokens. Never leaves the circle of people who\n already trust Riley. Do the §3 cheap fixes anyway.\n2. **Build it properly, decide later.** Get a Full App in sandbox, build OAuth +\n consumer controls + strong auth, ask Akahu about the read-only MFA exemption.\n Only pay for the pentest if we actually commit to launching.\n3. **Public without banks.** Strangers get Stash in manual mode (no Akahu at all);\n the bank connection stays personal-app, for Riley and Ella only. Sidesteps\n accreditation entirely.\n\n**Note:** the reason Akahu demands all of the above is precisely the concern Riley\nraised unprompted. His instinct matched the regulatory bar.\n",[473],["D",1784010336484],[289],"pulls","branches","forks","envVars",{"_487":89,"_489":103},"connections",{"_487":103,"_488":103},"count","unfilledCount","emptyCount",{"_32":291,"_13":289,"_81":292,"_83":-5,"_84":59,"_85":293,"_87":26,"_34":294,"_41":103,"_90":153,"_92":295,"_66":51,"_94":-5,"_95":575,"_74":576},{"_32":472,"_13":473,"_81":474,"_83":-5,"_84":59,"_85":405,"_87":26,"_34":572,"_41":192,"_90":153,"_92":476,"_66":51,"_94":-5,"_95":573,"_74":574},{"_32":466,"_13":467,"_81":468,"_83":-5,"_84":59,"_85":405,"_87":26,"_34":569,"_41":89,"_90":91,"_92":470,"_66":51,"_94":-5,"_95":570,"_74":571},{"_32":460,"_13":461,"_81":462,"_83":-5,"_84":59,"_85":405,"_87":26,"_34":566,"_41":192,"_90":91,"_92":464,"_66":51,"_94":-5,"_95":567,"_74":568},{"_32":454,"_13":455,"_81":456,"_83":-5,"_84":59,"_85":405,"_87":26,"_34":563,"_41":192,"_90":91,"_92":458,"_66":51,"_94":-5,"_95":564,"_74":565},{"_32":282,"_13":280,"_81":283,"_83":-5,"_84":59,"_85":284,"_87":26,"_34":285,"_41":103,"_90":91,"_92":286,"_66":51,"_94":-5,"_95":561,"_74":562},{"_32":273,"_13":271,"_81":274,"_83":-5,"_84":59,"_85":275,"_87":26,"_34":276,"_41":103,"_90":91,"_92":277,"_66":51,"_94":-5,"_95":559,"_74":560},{"_32":264,"_13":262,"_81":265,"_83":-5,"_84":59,"_85":266,"_87":26,"_34":267,"_41":202,"_90":91,"_92":268,"_66":51,"_94":-5,"_95":557,"_74":558},{"_32":255,"_13":253,"_81":256,"_83":-5,"_84":59,"_85":257,"_87":26,"_34":258,"_41":192,"_90":91,"_92":259,"_66":51,"_94":-5,"_95":555,"_74":556},{"_32":440,"_13":441,"_81":442,"_83":-5,"_84":59,"_85":192,"_87":26,"_34":552,"_41":103,"_90":153,"_92":444,"_66":51,"_94":-5,"_95":553,"_74":554},{"_32":434,"_13":435,"_81":436,"_83":-5,"_84":59,"_85":192,"_87":26,"_34":549,"_41":103,"_90":153,"_92":438,"_66":51,"_94":-5,"_95":550,"_74":551},{"_32":246,"_13":244,"_81":247,"_83":-5,"_84":59,"_85":248,"_87":26,"_34":249,"_41":231,"_90":91,"_92":250,"_66":51,"_94":-5,"_95":547,"_74":548},{"_32":148,"_13":145,"_81":149,"_83":-5,"_84":59,"_85":150,"_87":26,"_34":151,"_41":152,"_90":153,"_92":154,"_66":51,"_94":-5,"_95":545,"_74":546},{"_32":237,"_13":235,"_81":238,"_83":-5,"_84":59,"_85":239,"_87":26,"_34":240,"_41":114,"_90":91,"_92":241,"_66":51,"_94":-5,"_95":543,"_74":544},{"_32":128,"_13":125,"_81":129,"_83":-5,"_84":59,"_85":130,"_87":26,"_34":131,"_41":132,"_90":133,"_92":134,"_66":51,"_94":-5,"_95":541,"_74":542},{"_32":110,"_13":107,"_81":111,"_83":-5,"_84":59,"_85":112,"_87":26,"_34":113,"_41":114,"_90":91,"_92":115,"_66":51,"_94":-5,"_95":539,"_74":540},{"_32":80,"_13":75,"_81":82,"_83":-5,"_84":59,"_85":86,"_87":26,"_34":88,"_41":89,"_90":91,"_92":93,"_66":51,"_94":-5,"_95":537,"_74":538},{"_32":415,"_13":416,"_81":417,"_83":-5,"_84":59,"_85":405,"_87":26,"_34":534,"_41":419,"_90":91,"_92":420,"_66":51,"_94":-5,"_95":535,"_74":536},{"_32":409,"_13":410,"_81":411,"_83":-5,"_84":59,"_85":405,"_87":26,"_34":531,"_41":202,"_90":91,"_92":413,"_66":51,"_94":-5,"_95":532,"_74":533},{"_32":402,"_13":403,"_81":404,"_83":-5,"_84":59,"_85":405,"_87":26,"_34":528,"_41":192,"_90":91,"_92":407,"_66":51,"_94":-5,"_95":529,"_74":530},{"_32":227,"_13":225,"_81":228,"_83":-5,"_84":59,"_85":229,"_87":26,"_34":230,"_41":231,"_90":91,"_92":232,"_66":51,"_94":-5,"_95":526,"_74":527},{"_32":217,"_13":215,"_81":218,"_83":-5,"_84":59,"_85":219,"_87":26,"_34":220,"_41":221,"_90":91,"_92":222,"_66":51,"_94":-5,"_95":524,"_74":525},{"_32":208,"_13":206,"_81":209,"_83":-5,"_84":59,"_85":210,"_87":26,"_34":211,"_41":202,"_90":91,"_92":212,"_66":51,"_94":-5,"_95":522,"_74":523},{"_32":198,"_13":196,"_81":199,"_83":-5,"_84":59,"_85":200,"_87":26,"_34":201,"_41":202,"_90":91,"_92":203,"_66":51,"_94":-5,"_95":520,"_74":521},{"_32":188,"_13":186,"_81":189,"_83":-5,"_84":59,"_85":190,"_87":26,"_34":191,"_41":192,"_90":91,"_92":193,"_66":51,"_94":-5,"_95":518,"_74":519},{"_32":179,"_13":177,"_81":180,"_83":-5,"_84":59,"_85":181,"_87":26,"_34":182,"_41":103,"_90":91,"_92":183,"_66":51,"_94":-5,"_95":516,"_74":517},[],[177],[],[186],[],[196],[],[206],[],[215],[],[225],["D",1784009912922],[],[403],["D",1784009912922],[],[410],["D",1784009912922],[],[416],[],[75],[],[107],[],[125],[],[235],[],[145],[],[244],["D",1783925106582],[],[435],["D",1783925106582],[],[441],[],[253],[],[262],[],[271],[],[280],["D",1784009912922],[],[455],["D",1784009912922],[],[461],["D",1784009912922],[],[467],["D",1784009912922],[],[473],[],[289],["D",1783644524287],["D",1789525245864],{"_11":12,"_339":335},{"_11":12,"_332":333,"_334":335,"_304":305,"_336":337,"_338":51},{"_41":58,"_13":16,"_32":59,"_39":40,"_43":33,"_45":60,"_61":53,"_62":40,"_63":56,"_57":14,"_54":12},"ctx",{"_327":-5,"_359":616,"_617":618,"_619":620,"_621":51,"_622":51,"_623":51,"_624":26,"_625":-5,"_626":-7,"_627":-7,"_628":103,"_629":51,"_630":51,"_631":-5,"_632":51,"_633":51,"_634":51,"_635":-5},"ENV",{"_586":587,"_588":589,"_590":591,"_592":593,"_594":595,"_596":597,"_598":599,"_600":601,"_602":603,"_604":605,"_606":607,"_608":609,"_610":611,"_612":613,"_614":615},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","main","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Compare

Mergedevintomultiuser

index.html+3193-22

Hmain.tsx+652-33

make_demo.ts+46-4

notify.ts+4-4

BREACH_PLAN.md+115-0

demo_reset.ts+30-0

drop_tester.ts+89-0

fixes_check.ts+136-0

freq_check.ts+110-0

import_check.ts+127-0

legal.ts+354-0

rc_check.ts+117-0

rehearsal.ts+190-0

restore_check.ts+128-0

site.ts+321-0

split_check.ts+145-0

syntax_check.ts+46-0