[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_154":155,"_156":157},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_116":-5,"_20":117,"_22":118,"_119":120,"_121":122,"_25":123,"_24":-5,"_124":-5,"_125":-5,"_126":53,"_127":128,"_129":44,"_130":-5,"_131":-5,"_132":133},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","vleytman","name","finplan","branchName","main","version","path","","project",{"_33":61,"_13":14,"_45":62,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":69,"_70":-5,"_71":72,"_73":-5,"_74":53,"_75":-5,"_76":-5,"_77":78,"_79":80,"_81":-5,"_82":-5,"_83":-5,"_84":-5,"_85":86,"_87":86,"_88":89,"_90":89,"_91":89,"_92":86,"_93":86,"_94":95,"_96":97,"_98":99,"_100":53},"tree",[56],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":55},"id","8abafcb1-82ec-4845-8f13-c26978b0e514","main.ts","fileId","138dd32c-6a4d-11f1-b717-1607ee4eb77e","parentId","branchId","11480e20-57de-458d-91d2-6ffd3ce39212","branchVersion",7,"latest",true,"createdAt",["D",1782902178120],6,"fileType","http","content","import { Hono } from \"npm:hono@4.12.25\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst planKey = \"finplan:plan\";\nconst staticKeyPrefix = \"finplan:static:\";\nconst discountFxApiUrl = \"https://www.discountbank.co.il/api/ExchangeRates/GetExchangeRates?bankCode=0011\";\nconst discountFxSourceUrl = \"https://www.discountbank.co.il/en/private/general-information/foreign-currency/exchange-rates/\";\nconst boiMacroSourceUrl = \"https://www.boi.org.il/en/\";\nconst primeMarkupPct = 1.5;\nconst sessionTtlMs = 30 * 24 * 60 * 60 * 1000;\nconst textEncoder = new TextEncoder();\nconst textDecoder = new TextDecoder();\n\nfunction env(name: string) {\n return Deno.env.get(name) || \"\";\n}\n\nasync function sha256(value: unknown) {\n const digest = await crypto.subtle.digest(\"SHA-256\", textEncoder.encode(String(value || \"\")));\n return new Uint8Array(digest);\n}\n\nasync function constantEquals(left: unknown, right: unknown) {\n const a = await sha256(left);\n const b = await sha256(right);\n let diff = a.length ^ b.length;\n for (let i = 0; i < Math.max(a.length, b.length); i += 1) {\n diff |= (a[i] || 0) ^ (b[i] || 0);\n }\n return diff === 0;\n}\n\nfunction makeToken() {\n const bytes = new Uint8Array(32);\n crypto.getRandomValues(bytes);\n return Array.from(bytes, byte => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction base64UrlEncode(bytes: Uint8Array) {\n let binary = \"\";\n for (const byte of bytes) binary += String.fromCharCode(byte);\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/g, \"\");\n}\n\nfunction base64UrlDecode(value: string) {\n const padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\").padEnd(Math.ceil(value.length / 4) * 4, \"=\");\n const binary = atob(padded);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);\n return bytes;\n}\n\nasync function signSessionPayload(payload: string, secret: string) {\n const key = await crypto.subtle.importKey(\n \"raw\",\n textEncoder.encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const signature = await crypto.subtle.sign(\"HMAC\", key, textEncoder.encode(payload));\n return base64UrlEncode(new Uint8Array(signature));\n}\n\nasync function makeSessionToken(username: string, secret: string, now = Date.now()) {\n const payload = base64UrlEncode(textEncoder.encode(JSON.stringify({\n username,\n iat: now,\n exp: now + sessionTtlMs,\n nonce: makeToken(),\n })));\n return `${payload}.${await signSessionPayload(payload, secret)}`;\n}\n\nasync function verifySessionToken(token: string, secret: string, now = Date.now()) {\n const parts = token.split(\".\");\n if (parts.length !== 2 || !parts[0] || !parts[1]) return null;\n const expected = await signSessionPayload(parts[0], secret);\n if (!await constantEquals(parts[1], expected)) return null;\n try {\n const session = JSON.parse(textDecoder.decode(base64UrlDecode(parts[0])));\n if (!session || typeof session.username !== \"string\" || Number(session.exp) <= now) return null;\n return session as { username: string; exp: number; iat: number; nonce: string };\n } catch {\n return null;\n }\n}\n\nfunction sessionSecret() {\n return env(\"FINPLAN_SESSION_SECRET\") || env(\"FINPLAN_PASSWORD\");\n}\n\nfunction stripServerFields(plan: unknown) {\n if (!plan || typeof plan !== \"object\") return plan;\n const copy = structuredClone(plan) as Record;\n delete copy.auth;\n return copy;\n}\n\nasync function readPlanOrNull() {\n return (await blob.getJSON(planKey)) ?? null;\n}\n\nasync function writePlan(plan: unknown) {\n await blob.setJSON(planKey, stripServerFields(plan) || {});\n}\n\nfunction normalizeStaticPath(pathname: string) {\n if (pathname === \"/\") return \"/index.html\";\n if (pathname === \"/index.html\" || pathname === \"/support.js\" || pathname.startsWith(\"/assets/\")) {\n return pathname;\n }\n return \"\";\n}\n\nfunction contentTypeForPath(pathname: string) {\n if (pathname.endsWith(\".html\")) return \"text/html; charset=utf-8\";\n if (pathname.endsWith(\".js\")) return \"text/javascript; charset=utf-8\";\n return \"text/plain; charset=utf-8\";\n}\n\nasync function readStaticFile(pathname: string) {\n const key = normalizeStaticPath(pathname);\n if (!key) return null;\n const stored = await blob.getJSON(`${staticKeyPrefix}${key}`);\n if (!stored || typeof stored !== \"object\") return null;\n const content = (stored as Record).content;\n if (typeof content !== \"string\") return null;\n return {\n content,\n contentType: contentTypeForPath(key),\n };\n}\n\nasync function writeStaticFile(pathname: string, content: string) {\n const key = normalizeStaticPath(pathname);\n if (!key) throw new Error(`Unsupported static path: ${pathname}`);\n await blob.setJSON(`${staticKeyPrefix}${key}`, { content, updatedAt: new Date().toISOString() });\n}\n\nfunction tokenFromHeader(header = \"\") {\n const match = /^Bearer\\s+(.+)$/i.exec(header);\n return match ? match[1] : \"\";\n}\n\nasync function sessionForToken(token: string) {\n const secret = sessionSecret();\n return secret && token ? await verifySessionToken(token, secret) : null;\n}\n\nfunction normalizeDiscountRate(currencies: Array>, code: string) {\n const row = currencies.find(item => item && item.currencyCode === code);\n if (!row) throw new Error(`Discount Bank rate ${code} is missing`);\n const units = Number(row.units || 1);\n const rate = Number(row.exchangeRate);\n if (!Number.isFinite(rate) || rate <= 0 || !Number.isFinite(units) || units <= 0) {\n throw new Error(`Discount Bank rate ${code} is invalid`);\n }\n return rate / units;\n}\n\nasync function fetchDiscountFxRates() {\n const upstream = await fetch(discountFxApiUrl, {\n headers: { accept: \"application/json\" },\n });\n if (!upstream.ok) throw new Error(`Discount Bank returned ${upstream.status}`);\n const body = await upstream.json();\n const exchangeRates = body && body.data && body.data.exchangeRates;\n const currencies = exchangeRates && Array.isArray(exchangeRates.CurrenciesList)\n ? exchangeRates.CurrenciesList\n : [];\n\n return {\n source: \"discountbank\",\n sourceUrl: discountFxSourceUrl,\n apiUrl: discountFxApiUrl,\n rateDate: exchangeRates && exchangeRates.UpdateDate,\n fetchedAt: new Date().toISOString(),\n rates: {\n USD: normalizeDiscountRate(currencies, \"USD\"),\n EUR: normalizeDiscountRate(currencies, \"EUR\"),\n RUB: normalizeDiscountRate(currencies, \"RUB\"),\n },\n };\n}\n\nfunction parsePercent(value: unknown, label: string) {\n const n = Number(String(value || \"\").replace(/[%\\s,]/g, \"\"));\n if (!Number.isFinite(n)) throw new Error(`${label} is missing or invalid`);\n return n;\n}\n\nfunction extractBoiValue(html: string, blockClass: string, label: string) {\n const block = new RegExp(`

([\\\\s\\\\S]*?)<\\\\/div>\\\\s*<\\\\/div>`, \"i\").exec(html);\n const source = block ? block[1] : html;\n const value = /interestAndInflationValue[^>]*>\\s*([^<]+)\\s* {\n console.error(err);\n return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);\n});\n\napp.post(\"/api/login\", async c => {\n const body = await c.req.json().catch(() => ({}));\n const username = env(\"FINPLAN_USERNAME\");\n const password = env(\"FINPLAN_PASSWORD\");\n if (!username || !password) return c.json({ error: \"Authentication is not configured\" }, 500);\n\n const ok = await constantEquals(body.username, username) && await constantEquals(body.password, password);\n if (!ok) return c.json({ error: \"Invalid username or password\" }, 401);\n\n const token = await makeSessionToken(username, sessionSecret());\n return c.json({ ok: true, token, username });\n});\n\napp.post(\"/api/logout\", c => {\n return c.json({ ok: true });\n});\n\napp.use(\"/api/plan\", async (c, next) => {\n if (!await sessionForToken(tokenFromHeader(c.req.header(\"authorization\")))) {\n return c.json({ error: \"Unauthorized\" }, 401);\n }\n await next();\n});\n\napp.use(\"/api/fx/*\", async (c, next) => {\n if (!await sessionForToken(tokenFromHeader(c.req.header(\"authorization\")))) {\n return c.json({ error: \"Unauthorized\" }, 401);\n }\n await next();\n});\n\napp.use(\"/api/macro/*\", async (c, next) => {\n if (!await sessionForToken(tokenFromHeader(c.req.header(\"authorization\")))) {\n return c.json({ error: \"Unauthorized\" }, 401);\n }\n await next();\n});\n\napp.use(\"/api/static\", async (c, next) => {\n if (!await sessionForToken(tokenFromHeader(c.req.header(\"authorization\")))) {\n return c.json({ error: \"Unauthorized\" }, 401);\n }\n await next();\n});\n\napp.get(\"/api/plan\", async c => {\n return c.json(stripServerFields(await readPlanOrNull()));\n});\n\napp.post(\"/api/plan\", async c => {\n await writePlan(await c.req.json());\n return c.json({ ok: true });\n});\n\napp.post(\"/api/static\", async c => {\n const body = await c.req.json().catch(() => null) as { path?: unknown; content?: unknown } | null;\n if (!body || typeof body.path !== \"string\" || typeof body.content !== \"string\") {\n return c.json({ error: \"Invalid static payload\" }, 400);\n }\n await writeStaticFile(body.path, body.content);\n return c.json({ ok: true, path: normalizeStaticPath(body.path) });\n});\n\napp.get(\"/api/fx/discount\", async c => {\n try {\n c.header(\"cache-control\", \"no-store\");\n return c.json(await fetchDiscountFxRates());\n } catch (err) {\n console.error(err);\n return c.json({ error: err instanceof Error ? err.message : String(err) }, 502);\n }\n});\n\napp.get(\"/api/macro/boi\", async c => {\n try {\n c.header(\"cache-control\", \"no-store\");\n return c.json(await fetchBoiMacroData());\n } catch (err) {\n console.warn(\"Could not update Bank of Israel macro data.\", err instanceof Error ? err.message : String(err));\n return c.json({ error: err instanceof Error ? err.message : String(err) }, 502);\n }\n});\n\napp.get(\"*\", async c => {\n const file = await readStaticFile(new URL(c.req.url).pathname);\n if (!file) return c.text(\"FinPlan has not been seeded yet.\", 404);\n return c.body(file.content, 200, { \"content-type\": file.contentType });\n});\n\nexport default app.fetch;\n","deleted",false,"label",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":59,"_18":60},["D",1782902178120],"children",[],[35],"63a8976c-6bfa-4598-bec3-dc4b530d1cd1",["D",1781701469803],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","FinPlan on Val Town","imageUrl","userId","c2ff6847-db11-4af5-8280-787f3ae64187","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","09b37715-66bc-4bc0-ad73-e2010c200a88","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_115":111},"org",{"_11":12,"_109":-5,"_110":111,"_71":72,"_112":113,"_114":53},"branch",{"_17":42,"_13":16,"_33":40,"_101":61,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":-5,"_107":14,"_108":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yZXp0V3ljUTFaa1ZmM2ljNlFTVnl2VjU5UFYifQ","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":61,"_13":14,"_45":150,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":69,"_70":-5,"_71":72,"_73":-5,"_74":53,"_75":-5,"_76":-5,"_77":78,"_79":80,"_81":-5,"_82":-5,"_83":-5,"_84":-5,"_85":86,"_87":86,"_88":89,"_90":89,"_91":89,"_92":86,"_93":86,"_94":151,"_96":152,"_98":153,"_100":53},[147],"files",[147],"counts",{"_136":78,"_137":138,"_139":78,"_31":140,"_141":142},[134],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":135},[35],"pulls","branches",1,"forks",{"_143":145,"_146":78},"connections",{"_143":78,"_144":78},"count","unfilledCount",2,"emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":148,"_18":149},[],[35],["D",1781701469803],{"_11":12,"_115":111},{"_11":12,"_109":-5,"_110":111,"_71":72,"_112":113,"_114":53},{"_17":42,"_13":16,"_33":40,"_101":61,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":-5,"_107":14,"_108":12},"ctx",{"_94":-5,"_131":187,"_188":189,"_190":191,"_192":53,"_193":53,"_194":53,"_195":44,"_196":-5,"_197":-7,"_198":-7,"_199":78,"_200":53,"_201":53,"_202":-5,"_203":53,"_204":53,"_205":53,"_206":-5},"ENV",{"_158":159,"_160":161,"_162":16,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]