[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_162":163,"_164":165},"routes/_app.x.$handle.$name",{"_99":98,"_32":45,"_108":89,"_27":109,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_20":-5,"_120":-5,"_121":-5,"_122":25,"_123":124,"_125":58,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",38,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.tsx","latestPath","fileId","29bdcbfe-9d86-11f1-9801-1607ee4eb77e","name","fileType","http","content","/**\n * TerraClear dashboards — access gate + index.\n *\n * TO ADD A DASHBOARD: publish its gzipped HTML to a blob named `gz:`, then add\n * one line to DASHBOARDS below. Routing, login, per-dashboard access, the index page\n * and the audit log are all derived from that table — nothing else to touch.\n *\n * Humans log in with Val Town. Machines (the refresh pipeline) pass ?k=\n * and skip OAuth entirely, so a broken login flow can never block publishing.\n *\n * Dashboard HTML lives in blobs; this file only decides who may see what.\n */\nimport { Hono } from \"npm:hono\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport {\n getOAuthUserData,\n oauthMiddleware,\n} from \"https://esm.town/v/std/oauth/middleware.ts\";\n\ntype Access = \"owner\" | \"team\" | \"list\";\ninterface Dash {\n blob: string;\n label: string;\n note?: string;\n access: Access;\n /** Only for access:\"list\" — specific people, who must still be on an allowed domain. */\n emails?: string[];\n}\n\n/** route key -> dashboard. The owner always sees every entry. */\nconst DASHBOARDS: Record = {\n amanda: {\n blob: \"gz:amanda\",\n label: \"Digital Performance — Amanda\",\n note: \"All modules, including Auto-MQL quality and budget pacing.\",\n access: \"owner\",\n },\n share: {\n blob: \"gz:share\",\n label: \"Digital Performance — Team\",\n note: \"Funnel, channels, spend, acres. Same numbers as the full view.\",\n access: \"team\",\n },\n // Example of a dashboard for named people only:\n // acres: {\n // blob: \"gz:acres\",\n // label: \"Acres & Delivery\",\n // note: \"Committed vs delivered by cohort.\",\n // access: \"list\",\n // emails: [\"derek.sahr@terraclear.com\", \"laura@spinutech.com\"],\n // },\n};\n\nconst TOKEN = Deno.env.get(\"DASH_TOKEN\") || \"\";\nconst OWNER = (Deno.env.get(\"OWNER_EMAIL\") || \"\").trim().toLowerCase();\nconst ALLOWED_DOMAINS = [\"terraclear.com\", \"spinutech.com\"];\n\nconst blocked = () =>\n new Set(\n (Deno.env.get(\"BLOCKED_EMAILS\") || \"\")\n .toLowerCase()\n .split(\",\")\n .map((s) => s.trim())\n .filter(Boolean),\n );\n\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS access_log (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n ts TEXT NOT NULL,\n email TEXT,\n username TEXT,\n route TEXT,\n verdict TEXT,\n allowed INTEGER\n)`);\n\n/** owner | team | blocked | off-domain | no-email */\nfunction decide(email: string): string {\n const e = (email || \"\").trim().toLowerCase();\n if (!e) return \"no-email\";\n if (blocked().has(e)) return \"blocked\";\n if (e === OWNER) return \"owner\";\n const domain = e.split(\"@\")[1] || \"\";\n return ALLOWED_DOMAINS.includes(domain) ? \"team\" : \"off-domain\";\n}\n\ninterface Viewer {\n machine: boolean;\n email: string;\n username: string | null;\n verdict: string;\n}\n\n/** Resolve the viewer once: machine token, or an OAuth session. */\nasync function viewer(c: any): Promise {\n if (TOKEN && c.req.query(\"k\") === TOKEN) {\n return { machine: true, email: \"\", username: null, verdict: \"token\" };\n }\n const session = await getOAuthUserData(c.req.raw);\n if (!session?.user) return null;\n const email = session.user.email || \"\";\n return {\n machine: false,\n email,\n username: session.user.username,\n verdict: decide(email),\n };\n}\n\nfunction canSee(key: string, v: Viewer): boolean {\n const d = DASHBOARDS[key];\n if (!d) return false;\n if (v.machine) return true;\n if (v.verdict === \"owner\") return true; // owner sees everything\n if (v.verdict !== \"team\") return false; // must be on an allowed domain\n if (d.access === \"owner\") return false;\n if (d.access === \"team\") return true;\n return (d.emails || []).some((e) => e.toLowerCase() === v.email.toLowerCase());\n}\n\nasync function log(v: Viewer, route: string, allowed: boolean) {\n try {\n await sqlite.execute({\n sql:\n \"INSERT INTO access_log (ts, email, username, route, verdict, allowed) VALUES (?, ?, ?, ?, ?, ?)\",\n args: [\n new Date().toISOString(),\n v.email || null,\n v.username || null,\n route,\n v.verdict,\n allowed ? 1 : 0,\n ],\n });\n } catch (_e) {\n // Never let logging break a page view.\n }\n}\n\nasync function serveGz(key: string): Promise {\n const res = await blob.get(DASHBOARDS[key].blob);\n const html = await new Response(\n res.body!.pipeThrough(new DecompressionStream(\"gzip\")),\n ).text();\n return new Response(html, {\n status: 200,\n headers: {\n \"content-type\": \"text/html; charset=utf-8\",\n \"cache-control\": \"no-store\",\n },\n });\n}\n\nconst esc = (s: string) =>\n String(s ?? \"\").replace(\n /[&<>\"]/g,\n (ch) => ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\" }[ch]!),\n );\n\nconst page = (title: string, body: string) =>\n `\n${esc(title)}\n\n${body}`;\n\nconst signedInFoot = (v: Viewer, extra = \"\") =>\n `

Signed in as ${esc(v.email)}${extra}\n

`;\n\nconst app = new Hono();\napp.onError((err) => Promise.reject(err));\n\n// Open health check — no data behind it.\napp.get(\"/health\", (c) => c.text(\"ok\"));\n\nconst denied = (c: any, v: Viewer) =>\n c.html(\n page(\n \"No access\",\n `

No access

You're signed in as ${\n esc(v.email || \"an account with no email address\")\n }${v.verdict === \"blocked\" ? \", which has been blocked\" : \"\"}.

These dashboards are limited to TerraClear and Spinutech accounts. If you have a\nwork email, sign out and sign back in with it.

\n`,\n ),\n 403,\n );\n\n// Index — the one link worth distributing. Also where OAuth lands after login.\napp.get(\"/\", async (c) => {\n const v = await viewer(c);\n if (!v) return c.redirect(\"/auth/login\");\n if (v.machine) return c.text(\"ok\");\n const keys = Object.keys(DASHBOARDS).filter((k) => canSee(k, v));\n await log(v, \"/\", keys.length > 0);\n if (!keys.length) return denied(c, v);\n const cards = keys\n .map(\n (k) =>\n `

${\n esc(DASHBOARDS[k].label)\n }

${\n DASHBOARDS[k].note ? `

${esc(DASHBOARDS[k].note!)}

` : \"\"\n }`,\n )\n .join(\"\");\n const extra = v.verdict === \"owner\"\n ? `Access log`\n : \"\";\n return c.html(\n page(\n \"TerraClear dashboards\",\n `

TerraClear dashboards

${keys.length} view${keys.length === 1 ? \"\" : \"s\"} available to you.

\n${cards}${signedInFoot(v, extra)}`,\n ),\n );\n});\n\n// One route per dashboard, generated from the table.\nfor (const key of Object.keys(DASHBOARDS)) {\n app.get(\"/\" + key, async (c) => {\n const v = await viewer(c);\n if (!v) return c.redirect(\"/auth/login\");\n if (v.machine) return serveGz(key);\n const ok = canSee(key, v);\n await log(v, \"/\" + key, ok);\n if (ok) return serveGz(key);\n // Don't confirm what exists — send them to their own index instead.\n return v.verdict === \"team\" ? c.redirect(\"/\") : denied(c, v);\n });\n}\n\n// Access log — owner only.\napp.get(\"/who\", async (c) => {\n const v = await viewer(c);\n if (!v) return c.redirect(\"/auth/login\");\n // Owner only — deliberately not reachable with the machine token either.\n if (v.verdict !== \"owner\") return c.notFound();\n const { rows } = await sqlite.execute(\n \"SELECT ts, email, username, route, verdict, allowed FROM access_log ORDER BY id DESC LIMIT 200\",\n );\n const body = rows.length\n ? `` +\n rows\n .map(\n (r: any) =>\n `${r.allowed ? \"allowed\" : \"denied · \" + esc(r.verdict)}`,\n )\n .join(\"\") + \"

When (UTC)	Email	Val Town	Route	Result
${esc(String(r.ts).replace(\"T\", \" \").slice(0, 19))}	${\n esc(r.email ?? \"—\")\n }	${esc(r.username ?? \"—\")}	${esc(r.route)}

\"\n : \"

No sign-ins recorded yet.

\";\n return c.html(\n page(\n \"Access log\",\n `

Access log

Most recent 200 human views. Pipeline requests aren't logged.

\n${body}

← Dashboards

`,\n ),\n );\n});\n\napp.notFound((c) => c.html(page(\"Not found\", `

Not found

`), 404));\n\nexport default oauthMiddleware(app.fetch);\n","/**\n * TerraClear dashboards — access gate + index.\n *\n * TO ADD A DASHBOARD: publish its gzipped HTML to a blob named `gz:`, then add\n * one line to DASHBOARDS below. Routing, login, per-dashboard access, the index page\n * and the audit log are all derived from that table — nothing else to touch.\n *\n * PREVIEW / STAGING (permanent — do not remove): `preview-amanda` and `preview-share`\n * are owner-only staging copies of the two live dashboards, served from\n * `gz:preview:amanda` / `gz:preview:share`. Any session that wants to show Amanda a\n * dashboard change before it goes live publishes to those blobs instead of the live\n * ones — no code change, no new route, no new val. Preview blobs are deliberately\n * NOT refreshed by the twice-daily job and are NOT watched by the staleness watchdog.\n * Full recipe: project doc `claude/sy27-build/PREVIEW_STAGING.md`.\n *\n * Humans log in with Val Town. Machines (the refresh pipeline) pass ?k=\n * and skip OAuth entirely, so a broken login flow can never block publishing.\n *\n * Dashboard HTML lives in blobs; this file only decides who may see what.\n */\nimport { Hono } from \"npm:hono\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport {\n getOAuthUserData,\n oauthMiddleware,\n} from \"https://esm.town/v/std/oauth/middleware.ts\";\n\ntype Access = \"owner\" | \"team\" | \"list\";\ninterface Dash {\n blob: string;\n label: string;\n note?: string;\n access: Access;\n /** Only for access:\"list\" — specific people, who must still be on an allowed domain. */\n emails?: string[];\n}\n\n/** route key -> dashboard. The owner always sees every entry. */\nconst DASHBOARDS: Record = {\n amanda: {\n blob: \"gz:amanda\",\n label: \"Digital Performance — Amanda\",\n note: \"All modules, including Auto-MQL quality and budget pacing.\",\n access: \"owner\",\n },\n share: {\n blob: \"gz:share\",\n label: \"Digital Performance — Team\",\n note: \"Funnel, channels, spend, acres. Same numbers as the full view.\",\n access: \"team\",\n },\n // Example of a dashboard for named people only:\n // acres: {\n // blob: \"gz:acres\",\n // label: \"Acres & Delivery\",\n // note: \"Committed vs delivered by cohort.\",\n // access: \"list\",\n // emails: [\"derek.sahr@terraclear.com\", \"laura@spinutech.com\"],\n // },\n};\n\nconst TOKEN = Deno.env.get(\"DASH_TOKEN\") || \"\";\nconst OWNER = (Deno.env.get(\"OWNER_EMAIL\") || \"\").trim().toLowerCase();\nconst ALLOWED_DOMAINS = [\"terraclear.com\", \"spinutech.com\"];\n\nconst blocked = () =>\n new Set(\n (Deno.env.get(\"BLOCKED_EMAILS\") || \"\")\n .toLowerCase()\n .split(\",\")\n .map((s) => s.trim())\n .filter(Boolean),\n );\n\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS access_log (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n ts TEXT NOT NULL,\n email TEXT,\n username TEXT,\n route TEXT,\n verdict TEXT,\n allowed INTEGER\n)`);\n\n/** owner | team | blocked | off-domain | no-email */\nfunction decide(email: string): string {\n const e = (email || \"\").trim().toLowerCase();\n if (!e) return \"no-email\";\n if (blocked().has(e)) return \"blocked\";\n if (e === OWNER) return \"owner\";\n const domain = e.split(\"@\")[1] || \"\";\n return ALLOWED_DOMAINS.includes(domain) ? \"team\" : \"off-domain\";\n}\n\ninterface Viewer {\n machine: boolean;\n email: string;\n username: string | null;\n verdict: string;\n}\n\n/** Resolve the viewer once: machine token, or an OAuth session. */\nasync function viewer(c: any): Promise {\n if (TOKEN && c.req.query(\"k\") === TOKEN) {\n return { machine: true, email: \"\", username: null, verdict: \"token\" };\n }\n const session = await getOAuthUserData(c.req.raw);\n if (!session?.user) return null;\n const email = session.user.email || \"\";\n return {\n machine: false,\n email,\n username: session.user.username,\n verdict: decide(email),\n };\n}\n\nfunction canSee(key: string, v: Viewer): boolean {\n const d = DASHBOARDS[key];\n if (!d) return false;\n if (v.machine) return true;\n if (v.verdict === \"owner\") return true; // owner sees everything\n if (v.verdict !== \"team\") return false; // must be on an allowed domain\n if (d.access === \"owner\") return false;\n if (d.access === \"team\") return true;\n return (d.emails || []).some((e) => e.toLowerCase() === v.email.toLowerCase());\n}\n\nasync function log(v: Viewer, route: string, allowed: boolean) {\n try {\n await sqlite.execute({\n sql:\n \"INSERT INTO access_log (ts, email, username, route, verdict, allowed) VALUES (?, ?, ?, ?, ?, ?)\",\n args: [\n new Date().toISOString(),\n v.email || null,\n v.username || null,\n route,\n v.verdict,\n allowed ? 1 : 0,\n ],\n });\n } catch (_e) {\n // Never let logging break a page view.\n }\n}\n\nasync function serveGz(key: string): Promise {\n const res = await blob.get(DASHBOARDS[key].blob);\n const html = await new Response(\n res.body!.pipeThrough(new DecompressionStream(\"gzip\")),\n ).text();\n return new Response(html, {\n status: 200,\n headers: {\n \"content-type\": \"text/html; charset=utf-8\",\n \"cache-control\": \"no-store\",\n },\n });\n}\n\nconst esc = (s: string) =>\n String(s ?? \"\").replace(\n /[&<>\"]/g,\n (ch) => ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\" }[ch]!),\n );\n\nconst page = (title: string, body: string) =>\n `\n${esc(title)}\n\n${body}`;\n\nconst signedInFoot = (v: Viewer, extra = \"\") =>\n `

Signed in as ${esc(v.email)}${extra}\n

No access

You're signed in as ${\n esc(v.email || \"an account with no email address\")\n }${v.verdict === \"blocked\" ? \", which has been blocked\" : \"\"}.

These dashboards are limited to TerraClear and Spinutech accounts. If you have a\nwork email, sign out and sign back in with it.

${\n esc(DASHBOARDS[k].label)\n }

${\n DASHBOARDS[k].note ? `

${esc(DASHBOARDS[k].note!)}

` : \"\"\n }`,\n )\n .join(\"\");\n const extra = v.verdict === \"owner\"\n ? `Access log`\n : \"\";\n return c.html(\n page(\n \"TerraClear dashboards\",\n `

TerraClear dashboards

${keys.length} view${keys.length === 1 ? \"\" : \"s\"} available to you.

When (UTC)	Email	Val Town	Route	Result
${esc(String(r.ts).replace(\"T\", \" \").slice(0, 19))}	${\n esc(r.email ?? \"—\")\n }	${esc(r.username ?? \"—\")}	${esc(r.route)}

\"\n : \"

No sign-ins recorded yet.

\";\n return c.html(\n page(\n \"Access log\",\n `

Access log

Most recent 200 human views. Pipeline requests aren't logged.

\n${body}

← Dashboards

`,\n ),\n );\n});\n\napp.notFound((c) => c.html(page(\"Not found\", `

Not found

`), 404));\n\nexport default oauthMiddleware(app.fetch);\n","createdAt",["D",1787854321934],"branchVersion","branchId","682dc73b-ce03-4bd6-bc9d-1ea55e51846d","id","c9f048c5-e98a-4ba5-b3b5-6f64ac009b82","sy27-dashboards",["D",1787333497510],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","TerraClear SY27 digital dashboards (private, token-gated)","imageUrl","b02b181d-acdd-41c7-966b-7ee33571e414","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0211b-3ceb-71a5-a4e8-34becf953d3e","tursoName","c9f048c5e98a4ba5b3b56f64ac009b82","tursoHostname","c9f048c5e98a4ba5b3b56f64ac009b82-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789510270483],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_107":103},"org",{"_99":98,"_100":101,"_102":103,"_18":-5,"_104":105,"_106":25},"branch",{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"isOwned",122,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","terraclear","handle","displayName","Terraclear","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/3fbd6d7f-43ca-409d-22e4-7e3b2a373e00/square512?exp=1789577999&sig=b59db8ff2c1057b3cbe23421ddb3ba3068c1a7c140842e419f49a90b066b3b20","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":157,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":158,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":159,"_83":160,"_85":161,"_87":25},"tree",[152],"files",[152],"counts",{"_139":62,"_140":141,"_142":143,"_144":145,"_146":147},"contents",[130],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":131,"_32":28,"_30":31,"_132":-5,"_41":42,"_40":14,"_133":25,"_38":134,"_13":135,"_33":34,"_35":37,"_24":25,"_136":137,"_27":138},"1abbfe6a-d6f0-4af6-88d1-465b909d1c8b","parentId","latest",["D",1787854321934],6,"label","terraclear-sy27",[28],"pulls","branches",2,"forks",1,"envVars",{"_148":150,"_151":143},"connections",{"_148":62,"_149":62},"count","unfilledCount",3,"emptyCount",{"_43":131,"_32":28,"_30":31,"_132":-5,"_41":42,"_40":14,"_133":25,"_38":153,"_13":135,"_33":34,"_35":37,"_24":25,"_136":137,"_154":155,"_27":156},["D",1787854321934],"children",[],[28],["D",1787333497510],["D",1789510270483],{"_99":98,"_107":103},{"_99":98,"_100":101,"_102":103,"_18":-5,"_104":105,"_106":25},{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"ctx",{"_81":-5,"_127":195,"_196":197,"_198":199,"_200":25,"_201":25,"_202":25,"_203":58,"_204":-5,"_205":-7,"_206":-7,"_207":62,"_208":25,"_209":25,"_210":-5,"_211":25,"_212":25,"_213":25,"_214":-5},"ENV",{"_166":167,"_168":169,"_170":89,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v38