[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_167":168,"_169":170},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_61":136,"_16":-7,"_137":-5,"_17":138,"_139":140,"_28":141,"_21":142,"_23":143,"_144":-5,"_145":-5,"_146":-5,"_147":35,"_148":149,"_150":38,"_151":-5,"_152":-5,"_153":154},"routes/_app.x.$handle.$name._index",{"_11":12,"_13":14,"_15":-7,"_16":-7,"_17":18,"_19":20,"_21":22,"_23":24,"_25":-7,"_26":-5,"_27":-5,"_28":29,"_30":31,"_32":-5,"_33":-5,"_34":35,"_36":35,"_37":38},"handle","victorzc","name","kiosk-analytics","branchName","version","project",{"_39":78,"_13":14,"_50":79,"_80":-5,"_81":35,"_82":83,"_84":83,"_85":86,"_87":-5,"_88":89,"_90":43,"_91":38,"_92":-5,"_93":-5,"_94":67,"_95":96,"_97":98,"_99":100,"_101":102,"_103":-5,"_104":105,"_106":105,"_107":108,"_109":108,"_110":108,"_111":105,"_112":105,"_113":114,"_115":116,"_117":118,"_119":35},"tags",[],"counts",{"_66":67,"_68":69,"_70":67,"_71":72,"_73":74},"contents",[63],"readme","upstream","pull","files",[31],"preview",{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":38,"_50":51,"_16":52,"_53":54,"_55":56,"_57":35,"_58":-5,"_59":60,"_61":62},"ahead","behind","showHomeCustomizationHint",false,"showHTTPPreviewSettingsHint","hasHTTPFiles",true,"id","379e37cd-1c2b-4f82-bcb6-6bfd49006444","hci-kiosk-analytics-val.ts","fileId","c3198a04-8cfb-11f1-bdb8-1607ee4eb77e","parentId","branchId","bc661123-1594-4b2f-a8f0-40058722561d","branchVersion",22,"latest","createdAt",["D",1785519011304],17,"fileType","http","content","// Val Town HTTP Val — paste this entire file into a new HTTP Val at val.town\n//\n// Auth flow:\n// 1. POST /user/login with email+password → get authenticated piq_session cookie\n// 2. GET /kiosk/get_token with session cookie → JWT access token\n// 3. All /api/* calls use Authorization: Bearer + client_id header\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\n\nconst BASE = \"https://hillcountryindoor.myperformanceiq.com\";\n\n// Only requests from these public IPs are allowed through\nconst ALLOWED_IPS = [\"97.105.202.126\"];\n\nfunction clientIP(req: Request): string {\n return (req.headers.get(\"x-forwarded-for\") ?? \"\").split(\",\")[0].trim();\n}\n\n// ─── SET THESE ────────────────────────────────────────────────────────────────\nconst PIQ_USERNAME = \"beecave@admin.com\"; // kiosk admin email\nconst PIQ_PASSWORD = \"7a&Ixist=sWe\"; // kiosk admin password\nconst ANALYTICS_WEBHOOK_URL =\n \"https://script.google.com/macros/s/AKfycbxBNKeJwkTf9RzT_1Up__frh3rmdJBifHcJeeKje_jaHXB05xmJ_Y40wiuhO5xusP6qjw/exec?secret=hci-kiosk-2026-private\"; // optional: Google Apps Script, Airtable webhook, Make/Zapier, etc.\nconst SESSION_GAP = 120; // seconds of silence that ends an inferred interaction\nconst KEEP_DAYS = 365;\n// Optional Val Town environment variable. When set, append &key=... to a CSV\n// URL to export off-site. Raw exports always work from an allowed kiosk IP.\nconst ANALYTICS_EXPORT_KEY = Deno.env.get(\"KIOSK_ANALYTICS_EXPORT_KEY\") ?? \"\";\n// ─────────────────────────────────────────────────────────────────────────────\n\nlet sessionCache: { piq_session: string; expires_at: number } | null = null;\nlet tokenCache:\n | { access_token: string; expires_at: number; client_id: string }\n | null = null;\n\nasync function login(): Promise {\n const now = Date.now();\n if (sessionCache && sessionCache.expires_at - now > 300_000) {\n return sessionCache.piq_session;\n }\n\n if (!PIQ_USERNAME || !PIQ_PASSWORD) {\n throw new Error(\"PIQ_USERNAME and PIQ_PASSWORD must be set in the proxy.\");\n }\n\n const body = new URLSearchParams({\n email: PIQ_USERNAME,\n password: PIQ_PASSWORD,\n });\n const loginRes = await fetch(`${BASE}/user/login`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: body.toString(),\n redirect: \"manual\",\n });\n\n const setCookie = loginRes.headers.get(\"set-cookie\") ?? \"\";\n const match = setCookie.match(/piq_session=([^;]+)/);\n if (!match) {\n const preview = await loginRes.text();\n throw new Error(\n `Login failed (${loginRes.status}): no piq_session in Set-Cookie. Preview: ${\n preview.slice(0, 300)\n }`,\n );\n }\n\n // Cache session for 50 minutes (sessions are long-lived but we refresh proactively)\n sessionCache = { piq_session: match[1], expires_at: now + 50 * 60_000 };\n return sessionCache.piq_session;\n}\n\nasync function getToken(): Promise<{ token: string; client_id: string }> {\n const now = Date.now();\n if (tokenCache && tokenCache.expires_at - now > 300_000) {\n return { token: tokenCache.access_token, client_id: tokenCache.client_id };\n }\n\n let session: string;\n try {\n session = await login();\n } catch (e: any) {\n throw new Error(`login failed: ${e.message}`);\n }\n\n const tokenRes = await fetch(`${BASE}/kiosk/get_token`, {\n headers: { Cookie: `piq_session=${session}` },\n });\n\n const text = await tokenRes.text();\n let body: any;\n try {\n body = JSON.parse(text);\n } catch {\n body = text;\n }\n\n if (!tokenRes.ok || !body?.access_token) {\n // Session may be stale — clear so next call re-authenticates\n sessionCache = null;\n throw new Error(\n `get_token failed (${tokenRes.status}): ${\n typeof body === \"string\" ? body.slice(0, 300) : JSON.stringify(body)\n }`,\n );\n }\n\n tokenCache = {\n access_token: body.access_token,\n expires_at: new Date(body.access_token_expires_at).getTime(),\n client_id: body.client_id,\n };\n return { token: tokenCache.access_token, client_id: tokenCache.client_id };\n}\n\nconst CORS_HEADERS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n \"Content-Type\": \"application/json\",\n};\n\nasync function handleDebug(req: Request): Promise {\n const steps: Record = {};\n\n steps.network = {\n clientIP: clientIP(req),\n allowed: ALLOWED_IPS.includes(clientIP(req)),\n };\n steps.configured = { username: !!PIQ_USERNAME, password: !!PIQ_PASSWORD };\n if (!PIQ_USERNAME || !PIQ_PASSWORD) {\n steps.instructions =\n \"Set PIQ_USERNAME and PIQ_PASSWORD at the top of the Val.\";\n return new Response(JSON.stringify(steps, null, 2), {\n headers: CORS_HEADERS,\n });\n }\n\n // Step 1: login\n let session: string;\n try {\n const loginBody = new URLSearchParams({\n email: PIQ_USERNAME,\n password: PIQ_PASSWORD,\n });\n const loginRes = await fetch(`${BASE}/user/login`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: loginBody.toString(),\n redirect: \"manual\",\n });\n const setCookie = loginRes.headers.get(\"set-cookie\") ?? \"\";\n const match = setCookie.match(/piq_session=([^;]+)/);\n steps.login = {\n status: loginRes.status,\n gotSession: !!match,\n cookiePreview: match ? `piq_session=${match[1].slice(0, 8)}…` : null,\n };\n if (!match) {\n const preview = await loginRes.text();\n steps.login.responsePreview = preview.slice(0, 400);\n return new Response(JSON.stringify(steps, null, 2), {\n headers: CORS_HEADERS,\n });\n }\n session = match[1];\n } catch (e: any) {\n steps.login = { error: e.message };\n return new Response(JSON.stringify(steps, null, 2), {\n headers: CORS_HEADERS,\n });\n }\n\n // Step 2: get_token\n try {\n const tokenRes = await fetch(`${BASE}/kiosk/get_token`, {\n headers: { Cookie: `piq_session=${session}` },\n });\n const text = await tokenRes.text();\n let body: any;\n try {\n body = JSON.parse(text);\n } catch {\n body = text;\n }\n\n steps.get_token = {\n status: tokenRes.status,\n ok: tokenRes.ok,\n hasAccessToken: !!(body?.access_token),\n hasClientId: !!(body?.client_id),\n expiresAt: body?.access_token_expires_at ?? null,\n error: (!tokenRes.ok || !body?.access_token) ? body : undefined,\n };\n\n // Step 3: test GetClasses\n if (tokenRes.ok && body?.access_token) {\n const today = new Date().toISOString().split(\"T\")[0];\n const apiRes = await fetch(\n `${BASE}/api/GetClasses?end_date=${today}&private=true&location_id=10379`,\n {\n headers: {\n Authorization: `Bearer ${body.access_token}`,\n client_id: body.client_id,\n Accept: \"application/json\",\n },\n },\n );\n const apiText = await apiRes.text();\n let apiBody: any;\n try {\n apiBody = JSON.parse(apiText);\n } catch {\n apiBody = apiText;\n }\n const list = apiBody?.classes ?? apiBody?.data ??\n (Array.isArray(apiBody) ? apiBody : null);\n const firstClass = Array.isArray(list) && list.length > 0\n ? list[0]\n : null;\n steps.GetClasses = {\n status: apiRes.status,\n ok: apiRes.ok,\n classCount: Array.isArray(list)\n ? list.length\n : \"unknown — check topLevelKeys\",\n topLevelKeys: typeof apiBody === \"object\" && apiBody !== null\n ? Object.keys(apiBody)\n : apiBody,\n sampleClass: firstClass,\n };\n\n // Step 4: test getClassInfo with the first class\n if (firstClass?.class_id && body?.access_token) {\n const infoRes = await fetch(\n `${BASE}/api/getClassInfo?class_id=${firstClass.class_id}&user_info=true`,\n {\n headers: {\n Authorization: `Bearer ${body.access_token}`,\n client_id: body.client_id,\n Accept: \"application/json\",\n },\n },\n );\n const infoText = await infoRes.text();\n let infoBody: any;\n try {\n infoBody = JSON.parse(infoText);\n } catch {\n infoBody = infoText;\n }\n const classObj = infoBody?.class ?? infoBody;\n const bookings = classObj?.class_bookings ?? [];\n steps.getClassInfo = {\n status: infoRes.status,\n ok: infoRes.ok,\n classKeys: typeof classObj === \"object\" ? Object.keys(classObj) : [],\n bookingCount: Array.isArray(bookings)\n ? bookings.length\n : \"not an array\",\n sampleBooking: Array.isArray(bookings) && bookings.length > 0\n ? bookings[0]\n : null,\n };\n }\n }\n } catch (e: any) {\n steps.get_token = { error: e.message };\n }\n\n return new Response(JSON.stringify(steps, null, 2), {\n headers: CORS_HEADERS,\n });\n}\n\n// ─── analytics ───────────────────────────────────────────────────────────────\n\nconst ANALYTICS_COLUMNS: [string, string][] = [\n [\"ts\", \"TEXT\"],\n [\"received_at\", \"TEXT\"],\n [\"kiosk\", \"TEXT\"],\n [\"event\", \"TEXT\"],\n [\"session_id\", \"TEXT\"],\n [\"mode\", \"TEXT\"],\n [\"step\", \"TEXT\"],\n [\"active_filter\", \"TEXT\"],\n [\"location_id\", \"TEXT\"],\n [\"data\", \"TEXT\"],\n [\"extra\", \"TEXT\"],\n [\"client_ip\", \"TEXT\"],\n [\"user_agent\", \"TEXT\"],\n];\n\nlet schemaReady = false;\nlet schemaPromise: Promise | null = null;\n\nasync function ensureSchema(): Promise {\n if (schemaReady) return;\n if (!schemaPromise) {\n schemaPromise = (async () => {\n // Existing databases may predate the id column. We intentionally use\n // SQLite's built-in rowid for recency instead of trying to retrofit an\n // AUTOINCREMENT primary key, which SQLite cannot add with ALTER TABLE.\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS kiosk_events (id INTEGER PRIMARY KEY AUTOINCREMENT)`,\n );\n const info = await sqlite.execute({\n sql: `PRAGMA table_info(kiosk_events)`,\n args: [],\n });\n const have = new Set((info.rows as any[]).map((row) => String(row[1])));\n for (const [name, type] of ANALYTICS_COLUMNS) {\n if (!have.has(name)) {\n await sqlite.execute(\n `ALTER TABLE kiosk_events ADD COLUMN ${name} ${type}`,\n );\n }\n }\n await sqlite.execute(\n `CREATE INDEX IF NOT EXISTS idx_kiosk_ts ON kiosk_events(kiosk, ts)`,\n );\n await sqlite.execute(\n `CREATE INDEX IF NOT EXISTS idx_event ON kiosk_events(event)`,\n );\n schemaReady = true;\n })();\n }\n try {\n await schemaPromise;\n } catch (error) {\n schemaPromise = null;\n throw error;\n }\n}\n\nasync function handleAnalytics(req: Request): Promise {\n if (req.method !== \"POST\") {\n return new Response(JSON.stringify({ error: \"analytics_requires_post\" }), {\n headers: CORS_HEADERS,\n status: 405,\n });\n }\n\n const text = await req.text();\n if (text.length > 20_000) {\n return new Response(\n JSON.stringify({ error: \"analytics_payload_too_large\" }),\n {\n headers: CORS_HEADERS,\n status: 413,\n },\n );\n }\n\n let body: any;\n try {\n body = JSON.parse(text);\n } catch {\n return new Response(JSON.stringify({ error: \"invalid_json\" }), {\n headers: CORS_HEADERS,\n status: 400,\n });\n }\n\n let stored = false;\n try {\n await ensureSchema();\n const {\n event,\n timestamp,\n kioskId,\n sessionId,\n mode,\n step,\n activeFilter,\n locationId,\n data,\n ...extra\n } = body;\n await sqlite.execute({\n sql: `INSERT INTO kiosk_events\n (ts, received_at, kiosk, event, session_id, mode, step,\n active_filter, location_id, data, extra, client_ip, user_agent)\n VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)`,\n args: [\n timestamp ?? new Date().toISOString(),\n new Date().toISOString(),\n kioskId || \"unset\",\n event ?? \"unknown\",\n sessionId ?? null,\n mode ?? null,\n step ?? null,\n activeFilter ?? null,\n locationId ?? null,\n data ? JSON.stringify(data) : null,\n Object.keys(extra).length ? JSON.stringify(extra) : null,\n clientIP(req),\n req.headers.get(\"user-agent\") ?? \"\",\n ],\n });\n stored = true;\n\n if (Math.random() < 0.001) {\n await sqlite.execute({\n sql: `DELETE FROM kiosk_events WHERE ts < datetime('now', ?)`,\n args: [`-${KEEP_DAYS} days`],\n });\n }\n } catch (e: any) {\n console.error(\"[HCI Kiosk Analytics] sqlite write failed\", e?.message ?? e);\n }\n\n if (ANALYTICS_WEBHOOK_URL) {\n try {\n // Keep the old Google Sheet mirror reliable during the SQLite transition.\n // Analytics never blocks kiosk UI because the Framer caller uses beacon/\n // keepalive and ignores this response, but awaiting here keeps Val Town\n // from ending the serverless request before the webhook is delivered.\n const webhookResponse = await fetch(ANALYTICS_WEBHOOK_URL, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n ...body,\n receivedAt: new Date().toISOString(),\n clientIP: clientIP(req),\n userAgent: req.headers.get(\"user-agent\") ?? \"\",\n }),\n });\n console.log(\n \"[HCI Kiosk Analytics] sheet mirror\",\n JSON.stringify({\n status: webhookResponse.status,\n ok: webhookResponse.ok,\n }),\n );\n } catch (e: any) {\n console.error(\n \"[HCI Kiosk Analytics] sheet mirror failed\",\n e?.message ?? e,\n );\n }\n }\n\n return new Response(\n JSON.stringify(\n stored ? { ok: true } : { ok: false, error: \"analytics_storage_error\" },\n ),\n { headers: CORS_HEADERS, status: stored ? 200 : 500 },\n );\n}\n\nconst FUNNEL_SQL = `\n WITH ordered AS (\n SELECT rowid, kiosk, event, ts, data,\n LAG(ts) OVER (PARTITION BY kiosk ORDER BY ts, rowid) AS prev\n FROM kiosk_events WHERE ts >= datetime('now', ?)\n ),\n marked AS (\n SELECT *, CASE WHEN prev IS NULL\n OR (julianday(ts) - julianday(prev)) * 86400.0 > ?\n THEN 1 ELSE 0 END AS is_new\n FROM ordered\n ),\n sessionized AS (\n SELECT *, SUM(is_new) OVER (\n PARTITION BY kiosk ORDER BY ts, rowid ROWS UNBOUNDED PRECEDING\n ) AS inferred_session\n FROM marked\n ),\n per_session AS (\n SELECT kiosk, inferred_session,\n MAX(ts) last_ts,\n MAX(event IN ('filter_tap','day_tap','day_nav_tap','schedule_card_tap',\n 'check_in_flow_start','member_row_tap','check_in_confirm_tap',\n 'signup_flow_start','signup_search','signup_profile_selected',\n 'signup_confirm_tap')) engaged,\n MAX(event='check_in_flow_start') checkin_started,\n MAX(event='member_list_loaded') roster_loaded,\n MAX(event='member_row_tap' AND\n COALESCE(CASE WHEN json_valid(data)\n THEN json_extract(data, '$.alreadyCheckedIn') END, 0)=0) checkin_name_selected,\n MAX(event='check_in_confirm_tap') checkin_confirmed,\n MAX(event='check_in_success') checkin_success,\n MAX(event='check_in_abandoned') checkin_abandoned,\n MAX(event='signup_flow_start') signup_started,\n MAX(event='signup_search_results') signup_results,\n MAX(event='signup_profile_selected') signup_profile_selected,\n MAX(event='signup_confirm_tap') signup_confirmed,\n MAX(event='signup_success') signup_success,\n MAX(event='signup_already_booked') signup_already_booked,\n MAX(event='signup_timeout') signup_timed_out,\n MAX(event='signup_abandoned') signup_abandoned,\n MAX(event='signup_class_filled') signup_class_filled,\n MAX(event IN ('member_list_error','check_in_failed','check_in_error',\n 'signup_error','signup_search_error',\n 'signup_roster_refresh_error')) errored\n FROM sessionized GROUP BY kiosk, inferred_session\n )\n SELECT kiosk, SUM(engaged) interactions,\n SUM(checkin_started) checkin_started,\n SUM(roster_loaded) roster_loaded,\n SUM(checkin_name_selected) checkin_name_selected,\n SUM(checkin_confirmed) checkin_confirmed,\n SUM(checkin_success) checkin_success,\n SUM(checkin_abandoned) checkin_abandoned,\n SUM(checkin_name_selected=1 AND checkin_success=0 AND errored=0 AND\n (checkin_abandoned=1 OR last_ts < datetime('now', '-${SESSION_GAP} seconds')))\n checkin_unfinished,\n SUM(signup_started) signup_started,\n SUM(signup_results) signup_results,\n SUM(signup_profile_selected) signup_profile_selected,\n SUM(signup_confirmed) signup_confirmed,\n SUM(signup_success) signup_success,\n SUM(signup_already_booked) signup_already_booked,\n SUM(signup_timed_out) signup_timed_out,\n SUM(signup_abandoned) signup_abandoned,\n SUM(signup_class_filled) signup_class_filled,\n SUM(signup_started=1 AND signup_success=0 AND\n signup_already_booked=0 AND signup_class_filled=0 AND errored=0 AND\n (signup_timed_out=1 OR signup_abandoned=1 OR\n last_ts < datetime('now', '-${SESSION_GAP} seconds')))\n signup_unfinished,\n SUM(errored) errored\n FROM per_session GROUP BY kiosk ORDER BY kiosk`;\n\nconst CHECKIN_FUNNEL_STEPS: [string, string][] = [\n [\"interactions\", \"Active interactions\"],\n [\"checkin_started\", \"Opened check-in\"],\n [\"roster_loaded\", \"Roster loaded\"],\n [\"checkin_name_selected\", \"Selected a name\"],\n [\"checkin_confirmed\", \"Confirmed\"],\n [\"checkin_success\", \"Checked in\"],\n];\n\nconst SIGNUP_FUNNEL_STEPS: [string, string][] = [\n [\"interactions\", \"Active interactions\"],\n [\"signup_started\", \"Started signup\"],\n [\"signup_results\", \"Search completed\"],\n [\"signup_profile_selected\", \"Selected a profile\"],\n [\"signup_confirmed\", \"Confirmed signup\"],\n [\"signup_success\", \"Booked\"],\n];\n\nfunction rowsToObjects(result: any): any[] {\n return (result.rows as any[]).map((row) =>\n Object.fromEntries(\n result.columns.map((column: string, i: number) => [column, row[i]]),\n )\n );\n}\n\nfunction escapeHtml(value: any): string {\n return String(value ?? \"\").replace(\n /[<>&]/g,\n (match) => ({ \"<\": \"<\", \">\": \">\", \"&\": \"&\" }[match] as string),\n );\n}\n\nfunction canExport(req: Request, url: URL): boolean {\n const suppliedKey = url.searchParams.get(\"key\") ?? \"\";\n return ALLOWED_IPS.includes(clientIP(req)) ||\n (!!ANALYTICS_EXPORT_KEY && suppliedKey === ANALYTICS_EXPORT_KEY);\n}\n\nfunction buildInsights(\n funnel: any[],\n health: any,\n topClasses: any[],\n): string[] {\n const insights: string[] = [];\n const totalInteractions = funnel.reduce(\n (sum, kiosk) => sum + (Number(kiosk.interactions) || 0),\n 0,\n );\n const checkinStarts = funnel.reduce(\n (sum, kiosk) => sum + (Number(kiosk.checkin_started) || 0),\n 0,\n );\n const signupStarts = funnel.reduce(\n (sum, kiosk) => sum + (Number(kiosk.signup_started) || 0),\n 0,\n );\n const checkinUnfinished = funnel.reduce(\n (sum, kiosk) => sum + (Number(kiosk.checkin_unfinished) || 0),\n 0,\n );\n const signupUnfinished = funnel.reduce(\n (sum, kiosk) => sum + (Number(kiosk.signup_unfinished) || 0),\n 0,\n );\n const checkinSuccesses = Number(health?.checkin_successes) || 0;\n const checkinAttempts = Number(health?.checkin_attempts) || 0;\n const signupSuccesses = Number(health?.signup_successes) || 0;\n const signupAttempts = Number(health?.signup_attempts) || 0;\n const errors = Number(health?.errors) || 0;\n\n if (!totalInteractions) {\n insights.push(\"No active kiosk interactions were recorded in this window.\");\n return insights;\n }\n if (checkinStarts) {\n insights.push(\n `${checkinStarts} check-in flows started from ${totalInteractions} active interactions (${\n Math.round((checkinStarts / totalInteractions) * 100)\n }%).`,\n );\n }\n if (checkinAttempts) {\n insights.push(\n `${checkinSuccesses} of ${checkinAttempts} confirmed check-ins succeeded (${\n Math.round((checkinSuccesses / checkinAttempts) * 100)\n }%).`,\n );\n }\n if (signupStarts) {\n insights.push(\n `${signupStarts} future-class signup flows started; ${signupSuccesses} completed a new booking.`,\n );\n }\n if (signupAttempts) {\n insights.push(\n `${signupSuccesses} of ${signupAttempts} confirmed signup attempts booked successfully (${\n Math.round((signupSuccesses / signupAttempts) * 100)\n }%).`,\n );\n }\n if (checkinUnfinished) {\n insights.push(\n `${checkinUnfinished} check-in ${\n checkinUnfinished === 1 ? \"flow was\" : \"flows were\"\n } left unfinished after a member selected their name.`,\n );\n }\n if (signupUnfinished) {\n insights.push(\n `${signupUnfinished} signup ${\n signupUnfinished === 1 ? \"flow was\" : \"flows were\"\n } left unfinished before booking.`,\n );\n }\n if (Number(health?.signup_timeouts)) {\n insights.push(\n `${health.signup_timeouts} signup flows timed out before completion.`,\n );\n }\n if (Number(health?.signup_class_filled)) {\n insights.push(\n `${health.signup_class_filled} signup attempts reached a class that had filled.`,\n );\n }\n if (errors) {\n insights.push(\n `${errors} check-in or roster errors need review; use the event counts and class table below to isolate them.`,\n );\n }\n if (Number(health?.feed_outages)) {\n insights.push(\n `${health.feed_outages} feed snapshots reported every schedule source unavailable.`,\n );\n }\n if (Number(health?.partial_feed_errors)) {\n insights.push(\n `${health.partial_feed_errors} feed snapshots reported a partial schedule-source error.`,\n );\n }\n if (Number(health?.empty_rosters)) {\n insights.push(\n `${health.empty_rosters} opened classes returned an empty member roster.`,\n );\n }\n if (topClasses[0]?.class_name) {\n const topStarts = (Number(topClasses[0].checkin_starts) || 0) +\n (Number(topClasses[0].signup_starts) || 0);\n insights.push(\n `${topClasses[0].class_name}${\n topClasses[0].instructor_name\n ? ` with ${topClasses[0].instructor_name}`\n : \"\"\n } generated the most check-in/signup starts (${topStarts}).`,\n );\n }\n return insights;\n}\n\nasync function handleDashboard(req: Request): Promise {\n const url = new URL(req.url);\n const requestedDays = Number(url.searchParams.get(\"days\") ?? 30);\n const days = Number.isFinite(requestedDays)\n ? Math.min(365, Math.max(1, Math.round(requestedDays)))\n : 30;\n const since = `-${days} days`;\n await ensureSchema();\n\n if (url.searchParams.get(\"csv\") === \"1\") {\n if (!canExport(req, url)) {\n return new Response(\n JSON.stringify({\n error: \"export_unauthorized\",\n detail:\n \"Use an allowed kiosk network or set KIOSK_ANALYTICS_EXPORT_KEY in Val Town and pass ?key=...\",\n }),\n { headers: CORS_HEADERS, status: 401 },\n );\n }\n const all = await sqlite.execute({\n sql:\n `SELECT * FROM kiosk_events WHERE ts >= datetime('now', ?) ORDER BY ts, rowid`,\n args: [since],\n });\n const csvCell = (value: any) =>\n `\"${String(value ?? \"\").replace(/\"/g, '\"\"').replace(/\\r?\\n/g, \" \")}\"`;\n const csv = [\n all.columns.join(\",\"),\n ...(all.rows as any[]).map((row) => row.map(csvCell).join(\",\")),\n ].join(\"\\n\");\n return new Response(csv, {\n headers: {\n \"Content-Type\": \"text/csv; charset=utf-8\",\n \"Content-Disposition\":\n `attachment; filename=\"kiosk-events-${days}d.csv\"`,\n },\n });\n }\n\n const [\n funnelResult,\n eventResult,\n recentResult,\n totalsResult,\n healthResult,\n classResult,\n dailyResult,\n ] = await Promise.all([\n sqlite.execute({ sql: FUNNEL_SQL, args: [since, SESSION_GAP] }),\n sqlite.execute({\n sql: `SELECT event, kiosk, COUNT(*) n FROM kiosk_events\n WHERE ts >= datetime('now', ?)\n GROUP BY event, kiosk ORDER BY n DESC`,\n args: [since],\n }),\n sqlite.execute({\n // rowid exists on old and new kiosk_events tables; some old tables lack id.\n sql: `SELECT ts, kiosk, event, step,\n CASE WHEN json_valid(data) THEN\n COALESCE(json_extract(data, '$.class.title'),\n json_extract(data, '$.item.title')) END class_name,\n CASE WHEN json_valid(data) THEN\n COALESCE(json_extract(data, '$.class.instructor'),\n json_extract(data, '$.item.instructor')) END instructor_name\n FROM kiosk_events ORDER BY rowid DESC LIMIT 60`,\n args: [],\n }),\n sqlite.execute({\n sql: `SELECT COUNT(*) total,\n (SELECT COUNT(*) FROM kiosk_events) all_time\n FROM kiosk_events WHERE ts >= datetime('now', ?)`,\n args: [since],\n }),\n sqlite.execute({\n sql: `SELECT\n SUM(event='feed_state') feed_snapshots,\n SUM(event='feed_state' AND json_valid(data) AND\n json_extract(data, '$.allErrored')=1) feed_outages,\n SUM(event='feed_state' AND json_valid(data) AND\n json_extract(data, '$.partialError')=1) partial_feed_errors,\n SUM(event='feed_state' AND json_valid(data) AND\n json_extract(data, '$.empty')=1) empty_feed_states,\n SUM(event='member_list_loaded' AND json_valid(data) AND\n json_extract(data, '$.memberCount')=0) empty_rosters,\n SUM(event='check_in_confirm_tap') checkin_attempts,\n SUM(event='check_in_success') checkin_successes,\n SUM(event='check_in_abandoned') checkin_abandoned,\n SUM(event='signup_confirm_tap') signup_attempts,\n SUM(event='signup_success') signup_successes,\n SUM(event='signup_timeout') signup_timeouts,\n SUM(event='signup_abandoned') signup_abandoned,\n SUM(event='signup_already_booked') signup_already_booked,\n SUM(event='signup_class_filled') signup_class_filled,\n SUM(event IN ('member_list_error','check_in_failed','check_in_error',\n 'signup_error','signup_search_error',\n 'signup_roster_refresh_error')) errors\n FROM kiosk_events WHERE ts >= datetime('now', ?)`,\n args: [since],\n }),\n sqlite.execute({\n sql: `WITH named AS (\n SELECT event,\n CASE WHEN json_valid(data) THEN\n COALESCE(json_extract(data, '$.class.title'),\n json_extract(data, '$.item.title')) END class_name,\n CASE WHEN json_valid(data) THEN\n COALESCE(json_extract(data, '$.class.instructor'),\n json_extract(data, '$.item.instructor')) END instructor_name\n FROM kiosk_events WHERE ts >= datetime('now', ?)\n )\n SELECT class_name, instructor_name,\n SUM(event='check_in_flow_start') checkin_starts,\n SUM(event='member_row_tap') name_taps,\n SUM(event='check_in_success') checkins,\n SUM(event='check_in_abandoned') checkin_unfinished,\n SUM(event='signup_flow_start') signup_starts,\n SUM(event='signup_success') signups,\n SUM(event IN ('signup_abandoned','signup_timeout')) signup_unfinished,\n SUM(event IN ('member_list_error','check_in_failed','check_in_error',\n 'signup_error','signup_search_error',\n 'signup_roster_refresh_error')) errors\n FROM named WHERE class_name IS NOT NULL AND class_name <> ''\n GROUP BY class_name, instructor_name\n ORDER BY (checkin_starts + signup_starts) DESC,\n (checkins + signups) DESC, name_taps DESC LIMIT 20`,\n args: [since],\n }),\n sqlite.execute({\n sql: `SELECT substr(ts, 1, 10) day,\n SUM(event='check_in_flow_start') checkin_starts,\n SUM(event='check_in_success') checkins,\n SUM(event='signup_flow_start') signup_starts,\n SUM(event='signup_success') signups,\n SUM(event IN ('member_list_error','check_in_failed','check_in_error',\n 'signup_error','signup_search_error',\n 'signup_roster_refresh_error')) errors\n FROM kiosk_events WHERE ts >= datetime('now', ?)\n GROUP BY substr(ts, 1, 10) ORDER BY day`,\n args: [since],\n }),\n ]);\n\n const funnel = rowsToObjects(funnelResult);\n const byEvent = rowsToObjects(eventResult);\n const recent = rowsToObjects(recentResult);\n const totals = rowsToObjects(totalsResult)[0] ?? {};\n const health = rowsToObjects(healthResult)[0] ?? {};\n const topClasses = rowsToObjects(classResult);\n const byDay = rowsToObjects(dailyResult);\n const insights = buildInsights(funnel, health, topClasses);\n\n if (url.searchParams.get(\"json\") === \"1\") {\n return new Response(\n JSON.stringify(\n {\n window_days: days,\n session_gap_seconds: SESSION_GAP,\n note:\n \"Interactions are inferred from event gaps; the kiosk cannot detect a person who never touches it.\",\n totals,\n insights,\n funnel,\n health,\n top_classes: topClasses,\n by_day: byDay,\n by_event: byEvent,\n },\n null,\n 2,\n ),\n { headers: CORS_HEADERS },\n );\n }\n\n const insightItems = insights.map((insight) =>\n `

${escapeHtml(insight)}

`\n ).join(\"\");\n const renderFunnel = (\n kiosk: any,\n title: string,\n steps: [string, string][],\n ) => {\n const top = Number(kiosk.interactions) || 0;\n const rows = steps.map(([key, label], index) => {\n const count = Number(kiosk[key]) || 0;\n const pct = top ? Math.round((count / top) * 100) : 0;\n const previous = index ? Number(kiosk[steps[index - 1][0]]) || 0 : 0;\n const lost = index ? previous - count : 0;\n return `${label}${count}\n \n ${pct}%\n ${lost > 0 ? `−${lost}` : \"\"}`;\n }).join(\"\");\n return `

${escapeHtml(title)} · ${escapeHtml(kiosk.kiosk)}

\n ${rows}

unfinished ${\n Number(\n title.startsWith(\"Check-in\")\n ? kiosk.checkin_unfinished\n : kiosk.signup_unfinished,\n ) || 0\n } · errors ${Number(kiosk.errored) || 0}

`;\n };\n const funnelPanels = funnel.map((kiosk: any) => {\n return renderFunnel(kiosk, \"Check-in funnel\", CHECKIN_FUNNEL_STEPS) +\n renderFunnel(kiosk, \"Signup funnel\", SIGNUP_FUNNEL_STEPS);\n }).join(\"\");\n\n const classRows = topClasses.map((row: any) =>\n `${escapeHtml(row.class_name)}\n ${escapeHtml(row.instructor_name || \"—\")}\n ${row.checkin_starts}${row.checkins}\n ${row.checkin_unfinished}\n ${row.signup_starts}${row.signups}\n ${row.signup_unfinished}\n ${row.errors}`\n ).join(\"\");\n const eventRows = byEvent.map((row: any) =>\n `${escapeHtml(row.event)}\n ${\n escapeHtml(row.kiosk)\n }${row.n}`\n ).join(\"\");\n const recentRows = recent.map((row: any) =>\n `${\n escapeHtml(String(row.ts).replace(\"T\", \" \").slice(0, 19))\n }\n ${escapeHtml(row.kiosk)}\n ${escapeHtml(row.event)}\n ${escapeHtml(row.step)}\n ${escapeHtml(row.class_name || \"\")}\n ${escapeHtml(row.instructor_name || \"\")}`\n ).join(\"\");\n const exportLink = canExport(req, url)\n ? ` · download protected CSV`\n : \"\";\n\n return new Response(\n `\n\nKiosk analytics

Kiosk analytics

Last ${days} days · ${totals.total ?? 0} events (${\n totals.all_time ?? 0\n } all time)
\nInteractions are inferred after ${SESSION_GAP}s idle; untouched visitors cannot be measured.
\n7d · 30d ·\n1y · AI-readable JSON${exportLink}

What needs attention

${insightItems}

\n${\n funnelPanels ||\n '

No interactions yet.

'\n }\n

Classes driving action

${\n classRows || ''\n }

class	instructor	check-in starts	check-ins	unfinished check-ins	signup starts	signups	unfinished signups	errors
Nothing yet.

Every event captured

${\n eventRows || ''\n }

event	kiosk	count
Nothing yet.

Latest 60

${\n recentRows || ''\n }

time	kiosk	event	step	class	instructor
Nothing yet.

`,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n}\n\nexport default async function handler(req: Request): Promise {\n if (req.method === \"OPTIONS\") {\n return new Response(null, { headers: CORS_HEADERS });\n }\n\n const url = new URL(req.url);\n\n // The dashboard and AI-readable JSON contain aggregates only. Raw CSV export\n // is separately protected inside handleDashboard().\n if (url.searchParams.get(\"dashboard\") === \"1\") return handleDashboard(req);\n\n if (!ALLOWED_IPS.includes(clientIP(req))) {\n return new Response(JSON.stringify({ error: \"unauthorized\" }), {\n headers: CORS_HEADERS,\n status: 401,\n });\n }\n\n // Debug includes a sample booking and therefore stays behind the IP check.\n if (url.searchParams.get(\"debug\") === \"1\") return handleDebug(req);\n\n if (url.searchParams.get(\"analytics\") === \"1\") return handleAnalytics(req);\n\n const path = url.searchParams.get(\"path\");\n const params = url.searchParams.get(\"params\");\n\n if (!path) {\n return new Response(\n JSON.stringify({ error: \"missing ?path= query param\" }),\n { headers: CORS_HEADERS, status: 400 },\n );\n }\n\n let token: string, client_id: string;\n try {\n ({ token, client_id } = await getToken());\n } catch (e: any) {\n return new Response(\n JSON.stringify({ error: \"token_error\", detail: e.message }),\n { headers: CORS_HEADERS, status: 502 },\n );\n }\n\n // Default base is /api/ so every existing call keeps working unchanged.\n // SearchMember lives under /Site_query/, so the kiosk passes ?base=Site_query for it.\n const base = url.searchParams.get(\"base\") || \"api\";\n const apiUrl = `${BASE}/${base}/${path}${params ? \"?\" + params : \"\"}`;\n const isPost = req.method === \"POST\";\n\n try {\n const apiRes = await fetch(apiUrl, {\n method: isPost ? \"POST\" : \"GET\",\n headers: {\n Authorization: `Bearer ${token}`,\n client_id,\n Accept: \"application/json\",\n ...(isPost\n ? {\n \"Content-Type\": req.headers.get(\"Content-Type\") ??\n \"application/json\",\n }\n : {}),\n },\n ...(isPost ? { body: await req.text() } : {}),\n });\n const text = await apiRes.text();\n let data: any;\n try {\n data = JSON.parse(text);\n } catch {\n data = { error: \"non_json_response\", preview: text.slice(0, 300) };\n }\n return new Response(JSON.stringify(data), { headers: CORS_HEADERS });\n } catch (e: any) {\n return new Response(\n JSON.stringify({ error: \"upstream_error\", detail: e.message }),\n { headers: CORS_HEADERS, status: 502 },\n );\n }\n}","deleted","label","children",[],"path",[41],{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":38,"_50":64,"_16":52,"_53":54,"_55":56,"_57":35,"_58":-5,"_61":65},["D",1785519011304],[41],"pulls",0,"branches",1,"forks","envVars",{"_75":67,"_77":67},"connections",{"_75":67,"_76":67},"count","unfilledCount","emptyCount","b9a9545d-f739-43ce-af6a-afef55d1241a",["D",1785514808790],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Newest July 2026 val for the kiosk","imageUrl","userId","019d2a5b-8669-70bf-b5fc-3182a89d6a19","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","019d2a5b-8669-70bf-b5fc-36efdfc4464d","tursoName","b9a9545df73943ceaf6aafef55d1241a","tursoHostname","b9a9545df73943ceaf6aafef55d1241a-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789516253896],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_135":131},"org",{"_11":12,"_129":-5,"_130":131,"_88":89,"_132":133,"_134":35},"branch",{"_16":48,"_13":120,"_39":46,"_121":78,"_122":-5,"_123":-5,"_124":-5,"_125":-5,"_126":-5,"_127":14,"_128":12},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoiZGVmYXVsdCIsImlpZCI6Imluc18yTm10cGhQUklwU0tqZHNiOHNnNGd2ZjJURFUiLCJyaWQiOiJ1c2VyXzNCVTd5eUtsTWM1eGNSRlJrMTM2RFRFQ3FzNyJ9","tier","free","canRestrictVals","profileImageUrl","","adoptOrgId",{"_39":78,"_13":14,"_50":162,"_80":-5,"_81":35,"_82":83,"_84":83,"_85":86,"_87":-5,"_88":89,"_90":43,"_91":38,"_92":-5,"_93":-5,"_94":67,"_95":96,"_97":98,"_99":100,"_101":163,"_103":-5,"_104":105,"_106":105,"_107":108,"_109":108,"_110":108,"_111":105,"_112":105,"_113":164,"_115":165,"_117":166,"_119":35},"tree",[159],[159],{"_66":67,"_68":69,"_70":67,"_71":157,"_73":158},[155],"file","upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":38,"_50":64,"_16":52,"_53":54,"_55":56,"_57":35,"_58":-5,"_61":156},[41],{"_75":67,"_77":67},{"_75":67,"_76":67},{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":38,"_50":51,"_16":52,"_53":54,"_55":56,"_57":35,"_58":-5,"_59":160,"_61":161},[],[41],["D",1785514808790],["D",1789516253896],{"_11":12,"_135":131},{"_11":12,"_129":-5,"_130":131,"_88":89,"_132":133,"_134":35},{"_16":48,"_13":120,"_39":46,"_121":78,"_122":-5,"_123":-5,"_124":-5,"_125":-5,"_126":-5,"_127":14,"_128":12},"ctx",{"_113":-5,"_152":200,"_201":202,"_203":204,"_205":35,"_206":35,"_207":35,"_208":38,"_209":-5,"_210":-7,"_211":-7,"_212":67,"_213":35,"_214":35,"_215":-5,"_216":35,"_217":35,"_218":35,"_219":-5},"ENV",{"_171":172,"_173":174,"_175":120,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189,"_190":191,"_192":193,"_194":195,"_196":197,"_198":199},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]