NDX Command Center — Production Control

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_292":293,"_294":295},"routes/_app.x.$handle.$name",{"_107":106,"_39":53,"_115":97,"_34":109,"_13":14,"_116":-5,"_11":117,"_118":119,"_120":121,"_122":123,"_124":125,"_26":-5,"_126":-5,"_127":-5,"_128":33,"_129":130,"_131":31,"_132":-5,"_133":-5,"_134":135},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_51":52,"_39":53,"_46":54,"_55":-5,"_56":33,"_57":58,"_59":58,"_60":61,"_62":-5,"_19":63,"_64":65,"_66":31,"_67":-5,"_68":-5,"_69":70,"_71":72,"_73":74,"_75":76,"_77":78,"_79":-5,"_80":81,"_82":81,"_83":84,"_85":84,"_86":84,"_87":81,"_88":81,"_89":90,"_91":92,"_93":94,"_95":33},"version",30,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","7434118c-8405-4042-95d1-c8e074fd2ed3","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":29,"_30":31,"_32":33,"_34":35,"_36":35},"file",{"_37":38,"_39":40,"_41":42,"_43":45,"_46":47,"_48":14,"_49":50,"_30":33},"previous",{"_37":38,"_39":40,"_41":42,"_43":44},"deleted",true,"deletedHere",false,"path","scripts/test-recovery.ts","latestPath","fileId","6c58be60-a808-11f1-bcd7-1607ee4eb77e","name","test-recovery.ts","fileType","script","content","// TEMPORARY test helper (deleted after verification).\n// Exercises the /api/recover flow against a throwaway admin so the real\n// administrator's password is never changed. Cleans up after itself.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { hashPassword, verifyPassword, createSession } from \"../auth.ts\";\n\nconst BASE = \"https://ndx-command-center.val.run\";\nconst TEST_EMAIL = \"recovery-test@example.test\";\nconst OLD_PASS = \"OldPassTest123\";\nconst NEW_PASS = \"NewPassTest456\";\n\nasync function post(body: unknown) {\n const res = await fetch(`${BASE}/api/recover`, {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify(body),\n });\n return { status: res.status, json: await res.json() };\n}\n\n// Read the recovery code from the environment (never print it).\nconst CODE = Deno.env.get(\"ADMIN_RECOVERY_CODE\");\n\nfunction ok(cond: boolean, label: string) {\n console.log(`${cond ? \"PASS\" : \"FAIL\"}: ${label}`);\n if (!cond) process.exitCode = 1;\n}\n\n// ---- Setup: throwaway admin + existing session ----\nconst { salt, hash } = await hashPassword(OLD_PASS);\nconst ins = await sqlite.execute(\n `INSERT INTO users (email, role, password_salt, password_hash) VALUES (?, 'admin', ?, ?)`,\n [TEST_EMAIL, salt, hash],\n);\nconst testId = Number(ins.lastInsertRowid);\nawait createSession(testId);\nconsole.log(`Setup: created temp admin id=${testId} and one session (count should be 1)`);\n\nlet count = (await sqlite.execute(`SELECT COUNT(*) AS n FROM sessions WHERE user_id = ?`, [testId])).rows[0] as { n: number };\nok(Number(count.n) === 1, \"temp admin has exactly one session before recovery\");\n\n// Old password is valid, new password is not (yet).\nok(await verifyPassword(OLD_PASS, salt, hash), \"old password is valid before reset\");\nok(!(await verifyPassword(NEW_PASS, salt, hash)), \"new password is not valid before reset\");\n\n// ---- Negative cases ----\nlet r = await post({ email: TEST_EMAIL, code: \"wrong-code\", password: NEW_PASS, confirm: NEW_PASS });\nok(r.status === 401, `wrong recovery code rejected (status ${r.status})`);\n\nr = await post({ email: \"nobody@example.test\", code: CODE, password: NEW_PASS, confirm: NEW_PASS });\nok(r.status === 401, `unknown admin email rejected (status ${r.status})`);\n\nr = await post({ email: TEST_EMAIL, code: CODE, password: \"short\", confirm: \"short\" });\nok(r.status === 400, `short/mismatched password rejected (status ${r.status})`);\n\nr = await post({ email: TEST_EMAIL, code: CODE, password: NEW_PASS, confirm: \"different\" });\nok(r.status === 400, `password confirm mismatch rejected (status ${r.status})`);\n\n// Confirm nothing changed after failed attempts.\nlet row = (await sqlite.execute(`SELECT password_salt AS s, password_hash AS h FROM users WHERE id = ?`, [testId])).rows[0] as { s: string; h: string };\nok(row.s === salt && row.h === hash, \"password unchanged after failed attempts\");\nlet sessCount = (await sqlite.execute(`SELECT COUNT(*) AS n FROM sessions WHERE user_id = ?`, [testId])).rows[0] as { n: number };\nok(Number(sessCount.n) === 1, \"session survives failed attempts\");\n\n// ---- Success ----\nr = await post({ email: TEST_EMAIL.toUpperCase(), code: CODE, password: NEW_PASS, confirm: NEW_PASS });\nok(r.status === 200 && r.json.ok === true, `successful reset (status ${r.status})`);\n\n// New password valid; old invalid.\nrow = (await sqlite.execute(`SELECT password_salt AS s, password_hash AS h FROM users WHERE id = ?`, [testId])).rows[0] as { s: string; h: string };\nok(await verifyPassword(NEW_PASS, row.s, row.h), \"new password is valid after reset\");\nok(!(await verifyPassword(OLD_PASS, row.s, row.h)), \"old password is invalid after reset\");\n\n// All sessions for that admin were invalidated.\nsessCount = (await sqlite.execute(`SELECT COUNT(*) AS n FROM sessions WHERE user_id = ?`, [testId])).rows[0] as { n: number };\nok(Number(sessCount.n) === 0, `all sessions for the reset admin invalidated (now 0)`);\n\n// ---- Cleanup: remove the throwaway admin and any leftover session ----\nawait sqlite.execute(`DELETE FROM sessions WHERE user_id = ?`, [testId]);\nawait sqlite.execute(`DELETE FROM users WHERE id = ?`, [testId]);\nconsole.log(\"Cleanup: deleted temp admin and its sessions. Real admin untouched.\");\n","// TEMPORARY test helper (deleted after verification).\n// Exercises the /api/recover flow against a throwaway admin so the real\n// administrator's password is never changed. Cleans up after itself.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { hashPassword, verifyPassword, createSession } from \"../auth.ts\";\n\nconst BASE = \"https://ndx-command-center.val.run\";\nconst TEST_EMAIL = \"recovery-test@example.test\";\nconst OLD_PASS = \"OldPassTest123\";\nconst NEW_PASS = \"NewPassTest456\";\n\nasync function post(body: unknown) {\n const res = await fetch(`${BASE}/api/recover`, {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify(body),\n });\n return { status: res.status, json: await res.json() };\n}\n\n// Read the recovery code from the environment (never print it).\nconst CODE = Deno.env.get(\"ADMIN_RECOVERY_CODE\");\n\nfunction ok(cond: boolean, label: string) {\n console.log(`${cond ? \"PASS\" : \"FAIL\"}: ${label}`);\n if (!cond) process.exitCode = 1;\n}\n\n// ---- Setup: throwaway admin + existing session ----\nconst enc = new TextEncoder();\nconst sha256 = async (s: string) =>\n [...new Uint8Array(await crypto.subtle.digest(\"SHA-256\", enc.encode(s)))].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n\nconst { salt, hash } = await hashPassword(OLD_PASS);\nconst ins = await sqlite.execute(\n `INSERT INTO users (email, role, password_salt, password_hash) VALUES (?, 'admin', ?, ?)`,\n [TEST_EMAIL, salt, hash],\n);\nconst testId = Number(ins.lastInsertRowid);\n// Insert a session directly with a deterministic token (avoids createSession).\nconst token = \"recovery-test-token\";\nawait sqlite.execute(\n `INSERT INTO sessions (id, user_id, token_hash, expires_at) VALUES (?, ?, ?, ?)`,\n [`recovery-session`, testId, await sha256(token), new Date(Date.now() + 3600e3).toISOString()],\n);\nconsole.log(`Setup: created temp admin id=${testId} and one session (count should be 1)`);\n\nlet count = (await sqlite.execute(`SELECT COUNT(*) AS n FROM sessions WHERE user_id = ?`, [testId])).rows[0] as { n: number };\nok(Number(count.n) === 1, \"temp admin has exactly one session before recovery\");\n\n// Old password is valid, new password is not (yet).\nok(await verifyPassword(OLD_PASS, salt, hash), \"old password is valid before reset\");\nok(!(await verifyPassword(NEW_PASS, salt, hash)), \"new password is not valid before reset\");\n\n// ---- Negative cases ----\nlet r = await post({ email: TEST_EMAIL, code: \"wrong-code\", password: NEW_PASS, confirm: NEW_PASS });\nok(r.status === 401, `wrong recovery code rejected (status ${r.status})`);\n\nr = await post({ email: \"nobody@example.test\", code: CODE, password: NEW_PASS, confirm: NEW_PASS });\nok(r.status === 401, `unknown admin email rejected (status ${r.status})`);\n\nr = await post({ email: TEST_EMAIL, code: CODE, password: \"short\", confirm: \"short\" });\nok(r.status === 400, `short/mismatched password rejected (status ${r.status})`);\n\nr = await post({ email: TEST_EMAIL, code: CODE, password: NEW_PASS, confirm: \"different\" });\nok(r.status === 400, `password confirm mismatch rejected (status ${r.status})`);\n\n// Confirm nothing changed after failed attempts.\nlet row = (await sqlite.execute(`SELECT password_salt AS s, password_hash AS h FROM users WHERE id = ?`, [testId])).rows[0] as { s: string; h: string };\nok(row.s === salt && row.h === hash, \"password unchanged after failed attempts\");\nlet sessCount = (await sqlite.execute(`SELECT COUNT(*) AS n FROM sessions WHERE user_id = ?`, [testId])).rows[0] as { n: number };\nok(Number(sessCount.n) === 1, \"session survives failed attempts\");\n\n// ---- Success ----\nr = await post({ email: TEST_EMAIL.toUpperCase(), code: CODE, password: NEW_PASS, confirm: NEW_PASS });\nok(r.status === 200 && r.json.ok === true, `successful reset (status ${r.status})`);\n\n// New password valid; old invalid.\nrow = (await sqlite.execute(`SELECT password_salt AS s, password_hash AS h FROM users WHERE id = ?`, [testId])).rows[0] as { s: string; h: string };\nok(await verifyPassword(NEW_PASS, row.s, row.h), \"new password is valid after reset\");\nok(!(await verifyPassword(OLD_PASS, row.s, row.h)), \"old password is invalid after reset\");\n\n// All sessions for that admin were invalidated.\nsessCount = (await sqlite.execute(`SELECT COUNT(*) AS n FROM sessions WHERE user_id = ?`, [testId])).rows[0] as { n: number };\nok(Number(sessCount.n) === 0, `all sessions for the reset admin invalidated (now 0)`);\n\n// ---- Cleanup: remove the throwaway admin and any leftover session ----\nawait sqlite.execute(`DELETE FROM sessions WHERE user_id = ?`, [testId]);\nawait sqlite.execute(`DELETE FROM users WHERE id = ?`, [testId]);\nconsole.log(\"Cleanup: deleted temp admin and its sessions. Real admin untouched.\");\n","createdAt",["D",1788488996417],"branchVersion","branchId","be1fb918-ad42-444d-9d39-35276cd47cc6","id","9c7d0c21-6fce-451a-b6a0-ca5de197aeab","production-command-center",["D",1788450878892],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","NDX internal job production, labor, equipment, and cost dash","imageUrl","fe3e8c07-bae6-44d7-85dc-b222854b68d6","pinnedFileId","179f165a-a7d4-11f1-92c0-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a06443-646e-71a4-ad2c-20559176a0b0","tursoName","9c7d0c216fce451ab6a0ca5de197aeab","tursoHostname","9c7d0c216fce451ab6a0ca5de197aeab-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789514495229],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_107":106,"_114":109},"org",{"_107":106,"_108":109,"_110":109,"_19":63,"_111":112,"_113":33},"branch",{"_13":96,"_39":97,"_51":50,"_98":52,"_99":-5,"_100":-5,"_101":-5,"_102":-5,"_103":-5,"_104":53,"_105":106},"isOwned",63,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","wnewton","handle","displayName","","avatar","tier","pro","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_51":52,"_39":53,"_46":287,"_55":-5,"_56":33,"_57":58,"_59":58,"_60":61,"_62":-5,"_19":63,"_64":65,"_66":31,"_67":-5,"_68":-5,"_69":70,"_71":72,"_73":74,"_75":76,"_77":288,"_79":-5,"_80":81,"_82":81,"_83":84,"_85":84,"_86":84,"_87":81,"_88":81,"_89":289,"_91":290,"_93":291,"_95":33},"tree",[213,218,220,221,222,223,224,225],"files",[213,214,215,216,217,218,219,220,221,222,223,224,225],"counts",{"_203":70,"_204":148,"_205":70,"_206":207,"_208":209},"contents",[136,137,138,139,140,141,142,143],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_51":197,"_39":198,"_37":199,"_147":-5,"_49":50,"_48":200,"_149":31,"_46":201,"_13":70,"_41":195,"_43":-5,"_30":33,"_151":-5,"_34":202},{"_51":190,"_39":191,"_37":192,"_147":-5,"_49":50,"_48":193,"_149":31,"_46":194,"_13":70,"_41":195,"_43":-5,"_30":33,"_151":-5,"_34":196},{"_51":183,"_39":184,"_37":185,"_147":-5,"_49":50,"_48":186,"_149":33,"_46":187,"_13":148,"_41":26,"_43":188,"_30":33,"_151":-5,"_34":189},{"_51":176,"_39":177,"_37":178,"_147":-5,"_49":50,"_48":179,"_149":31,"_46":180,"_13":70,"_41":42,"_43":181,"_30":33,"_151":-5,"_34":182},{"_51":169,"_39":170,"_37":171,"_147":-5,"_49":50,"_48":172,"_149":33,"_46":173,"_13":157,"_41":42,"_43":174,"_30":33,"_151":-5,"_34":175},{"_51":162,"_39":163,"_37":164,"_147":-5,"_49":50,"_48":165,"_149":31,"_46":166,"_13":70,"_41":42,"_43":167,"_30":33,"_151":-5,"_34":168},{"_51":153,"_39":154,"_37":65,"_147":-5,"_49":50,"_48":155,"_149":33,"_46":156,"_13":157,"_41":158,"_43":159,"_30":33,"_151":160,"_34":161},{"_51":144,"_39":145,"_37":146,"_147":-5,"_49":50,"_48":148,"_149":31,"_46":150,"_13":70,"_41":42,"_43":109,"_30":33,"_151":-5,"_34":152},"0ba39e2b-78ae-4125-8280-9482a4fdad83","main.ts","c4e2e564-a7af-11f1-b820-1607ee4eb77e","parentId",1,"latest",["D",1788450878935],"label",[145],"b0929364-9fce-4d00-a9ff-3677320ef228","index.ts",24,["D",1788488919300],2,"http","import { parseVal, serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { Hono } from \"npm:hono\";\nimport type { Context, Next } from \"npm:hono\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { ready } from \"./db.ts\";\nimport {\n hashPassword,\n verifyPassword,\n createSession,\n sessionCookieHeader,\n clearCookieHeader,\n getSessionUser,\n requireAuth,\n requireAdmin,\n} from \"./auth.ts\";\nimport type { User } from \"./auth.ts\";\nimport { equipmentRates } from \"./equipmentRates.ts\";\nimport { Root } from \"./frontend/root.tsx\";\n\nawait ready;\n\nconst app = new Hono();\n\nfunction getU(c: Context): User {\n return c.get(\"user\");\n}\n\nconst authed = (c: Context, next: Next) => requireAuth(c, next);\nconst admin = (c: Context, next: Next) => requireAdmin(c, next);\n\nconst DEFAULT_RATES = { labor: 45, operator: 55, foreman: 65 };\nconst MAX_FILE_BYTES = 25 * 1024 * 1024; // 25 MB\n\nconst ALLOWED_EXT: Record = {\n \".txt\": \"vista-target\",\n \".text\": \"vista-target\",\n \".xlsx\": \"timesheet\",\n \".xls\": \"timesheet\",\n};\n\nfunction jobSelect(fields: string[]): string {\n return fields.map((f) => `j.${f}`).join(\", \");\n}\n\n// ---- Frontend ----\napp.get(\"/\", (c) => c.html(Root()));\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// ---- Auth + bootstrap (Phase 1, unchanged) ----\napp.get(\"/api/bootstrap\", async (c) => {\n const rows = await sqlite.execute(`SELECT COUNT(*) AS n FROM users`);\n const userCount = Number((rows.rows[0] as { n: number }).n);\n if (userCount === 0) return c.json({ state: \"setup\" });\n const user = await getSessionUser(c.req.raw);\n if (user) return c.json({ state: \"authed\", user });\n return c.json({ state: \"login\" });\n});\n\napp.post(\"/api/setup\", async (c) => {\n const rows = await sqlite.execute(`SELECT COUNT(*) AS n FROM users`);\n if (Number((rows.rows[0] as { n: number }).n) > 0) {\n return c.json({ error: \"Setup already complete. Sign in instead.\" }, 400);\n }\n const body = await c.req.json().catch(() => ({}));\n const email = String(body.email ?? \"\").trim().toLowerCase();\n const password = String(body.password ?? \"\");\n if (!/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {\n return c.json({ error: \"A valid email is required.\" }, 400);\n }\n if (password.length < 8) {\n return c.json({ error: \"Password must be at least 8 characters.\" }, 400);\n }\n const { salt, hash } = await hashPassword(password);\n await sqlite.batch([\n { sql: `INSERT INTO approved_emails (email, role) VALUES (?, 'admin')`, args: [email] },\n { sql: `INSERT INTO users (email, role, password_salt, password_hash) VALUES (?, 'admin', ?, ?)`, args: [email, salt, hash] },\n ]);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/login\", async (c) => {\n const body = await c.req.json().catch(() => ({}));\n const email = String(body.email ?? \"\").trim().toLowerCase();\n const password = String(body.password ?? \"\");\n const rows = await sqlite.execute(\n `SELECT id, email, role, password_salt, password_hash FROM users WHERE lower(email) = ?`,\n [email],\n );\n if (rows.rows.length === 0) return c.json({ error: \"Invalid email or password.\" }, 401);\n const row = rows.rows[0] as {\n id: number; email: string; role: string; password_salt: string | null; password_hash: string | null;\n };\n if (!row.password_salt || !row.password_hash) return c.json({ error: \"This user has no password set.\" }, 401);\n const ok = await verifyPassword(password, row.password_salt, row.password_hash);\n if (!ok) return c.json({ error: \"Invalid email or password.\" }, 401);\n const { token, expiresAt } = await createSession(Number(row.id));\n c.header(\"Set-Cookie\", sessionCookieHeader(token, expiresAt));\n return c.json({ user: { id: Number(row.id), email: row.email, role: row.role } });\n});\n\napp.post(\"/api/logout\", async (c) => {\n c.header(\"Set-Cookie\", clearCookieHeader);\n return c.json({ ok: true });\n});\n\n/**\n * Administrator password recovery.\n *\n * Security rules:\n * - The recovery code is read ONLY from the ADMIN_RECOVERY_CODE env var;\n * it is never hardcoded, displayed, or logged.\n * - Requires the existing administrator email + the recovery code + the new\n * password entered twice.\n * - The new password is hashed with the same PBKDF2 system as normal sign-in.\n * - On success, all existing sessions for that administrator are invalidated\n * so any open session must sign in again.\n */\napp.post(\"/api/recover\", async (c) => {\n const expectedCode = Deno.env.get(\"ADMIN_RECOVERY_CODE\");\n const body = await c.req.json().catch(() => ({}));\n const email = String(body.email ?? \"\").trim().toLowerCase();\n const code = String(body.code ?? \"\");\n const password = String(body.password ?? \"\");\n const confirm = String(body.confirm ?? \"\");\n\n if (!expectedCode) {\n return c.json({ error: \"Password recovery is not configured. Contact the administrator.\" }, 500);\n }\n\n // Generic failures — never reveal whether the email or the code was wrong.\n const fail = () => c.json({ error: \"Unable to reset the password. Check your email and recovery code, then try again.\" }, 401);\n\n if (!email || password.length < 8 || password !== confirm) {\n return c.json({ error: \"Enter your administrator email, a new password of at least 8 characters, and confirm it.\" }, 400);\n }\n\n // Timing-safe comparison of the recovery code.\n const a = new Uint8Array(new TextEncoder().encode(code));\n const b = new Uint8Array(new TextEncoder().encode(expectedCode));\n let diff = a.length === b.length ? 0 : 1;\n const len = Math.max(a.length, b.length);\n for (let i = 0; i < len; i++) {\n const av = i < a.length ? a[i] : 0;\n const bv = i < b.length ? b[i] : 0;\n diff |= av ^ bv;\n }\n if (diff !== 0) return fail();\n\n const rows = await sqlite.execute(\n `SELECT id FROM users WHERE lower(email) = ? AND role = 'admin'`,\n [email],\n );\n if (rows.rows.length === 0) return fail();\n const userId = Number((rows.rows[0] as { id: number }).id);\n\n const { salt, hash } = await hashPassword(password);\n await sqlite.batch([\n {\n sql: `UPDATE users SET password_salt = ?, password_hash = ? WHERE id = ?`,\n args: [salt, hash, userId],\n },\n // Invalidate every session for this administrator.\n { sql: `DELETE FROM sessions WHERE user_id = ?`, args: [userId] },\n ]);\n\n return c.json({ ok: true });\n});\n\n// ---- Jobs CRUD ----\n\nasync function getJobRow(id: number) {\n const rows = await sqlite.execute(\n `SELECT id, name, source, job_number, status, superintendent, project_manager,\n estimator, location, jurisdiction, general_contractor, foreman,\n prevailing_wage, permit_number, schedule_group, monday_url\n FROM jobs WHERE id = ?`,\n [id],\n );\n return rows.rows[0] ?? null;\n}\n\napp.get(\"/api/jobs\", authed, async (c) => {\n const rows = await sqlite.execute(\n `SELECT id, name, source, job_number, status, superintendent, project_manager,\n estimator, location, jurisdiction, general_contractor, foreman,\n prevailing_wage, permit_number, schedule_group, monday_url, created_at\n FROM jobs ORDER BY name`,\n );\n return c.json({ jobs: rows.rows });\n});\n\napp.post(\"/api/jobs\", authed, admin, async (c) => {\n const body = await c.req.json().catch(() => ({}));\n const name = String(body.name ?? \"\").trim();\n if (!name) return c.json({ error: \"Job name is required.\" }, 400);\n const me = getU(c);\n const result = await sqlite.execute(\n `INSERT INTO jobs (name, source, created_by) VALUES (?, 'manual', ?)`,\n [name, me.id],\n );\n const id = Number(result.lastInsertRowid);\n await sqlite.execute(\n `INSERT OR IGNORE INTO job_labor_rates (job_id, labor, operator, foreman, updated_at)\n VALUES (?, ?, ?, ?, datetime('now'))`,\n [id, DEFAULT_RATES.labor, DEFAULT_RATES.operator, DEFAULT_RATES.foreman],\n );\n const row = await getJobRow(id);\n return c.json({ job: row }, 201);\n});\n\napp.put(\"/api/jobs/:id\", authed, admin, async (c) => {\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({}));\n const allowed = [\"name\", \"job_number\", \"status\", \"superintendent\", \"project_manager\", \"estimator\",\n \"location\", \"jurisdiction\", \"general_contractor\", \"foreman\", \"prevailing_wage\", \"permit_number\",\n \"schedule_group\", \"monday_url\"];\n for (const key of allowed) {\n if (body[key] !== undefined) {\n await sqlite.execute(`UPDATE jobs SET ${key} = ? WHERE id = ?`, [String(body[key]), id]);\n }\n }\n const row = await getJobRow(id);\n if (!row) return c.json({ error: \"Job not found.\" }, 404);\n return c.json({ job: row });\n});\n\napp.delete(\"/api/jobs/:id\", authed, admin, async (c) => {\n const id = Number(c.req.param(\"id\"));\n // Delete blobs first, then the cascading rows.\n const files = await sqlite.execute(`SELECT blob_key FROM job_files WHERE job_id = ?`, [id]);\n for (const f of files.rows) {\n try { await blob.delete(f.blob_key as string); } catch { /* ignore */ }\n }\n await sqlite.execute(`DELETE FROM job_files WHERE job_id = ?`, [id]);\n await sqlite.execute(`DELETE FROM jobs WHERE id = ?`, [id]);\n return c.json({ ok: true });\n});\n\n// ---- Per-job labor rates ----\n\napp.get(\"/api/jobs/:id/rates\", authed, async (c) => {\n const id = Number(c.req.param(\"id\"));\n const rows = await sqlite.execute(\n `SELECT labor, operator, foreman FROM job_labor_rates WHERE job_id = ?`,\n [id],\n );\n if (rows.rows.length === 0) return c.json({ rates: { ...DEFAULT_RATES }, isDefault: true });\n return c.json({ rates: rows.rows[0], isDefault: false });\n});\n\napp.put(\"/api/jobs/:id/rates\", authed, async (c) => {\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({}));\n const labor = Number(body.labor ?? DEFAULT_RATES.labor);\n const operator = Number(body.operator ?? DEFAULT_RATES.operator);\n const foreman = Number(body.foreman ?? DEFAULT_RATES.foreman);\n await sqlite.execute(\n `INSERT INTO job_labor_rates (job_id, labor, operator, foreman, updated_at)\n VALUES (?, ?, ?, ?, datetime('now'))\n ON CONFLICT(job_id) DO UPDATE SET labor = excluded.labor, operator = excluded.operator,\n foreman = excluded.foreman, updated_at = datetime('now')`,\n [id, labor, operator, foreman],\n );\n return c.json({ rates: { labor, operator, foreman }, isDefault: false });\n});\n\n// ---- Job data (autosave) ----\n\nconst emptyJobData = {\n entries: [],\n production: {},\n actualRows: [],\n equipmentUsage: [],\n crewDays: [],\n phaseUsage: [],\n equipmentMoves: [],\n forecast: { budget: \"\", completion: \"\" },\n};\n\napp.get(\"/api/jobs/:id/data\", authed, async (c) => {\n const id = Number(c.req.param(\"id\"));\n const rows = await sqlite.execute(`SELECT data FROM job_data WHERE job_id = ?`, [id]);\n if (rows.rows.length === 0) return c.json({ data: emptyJobData });\n try {\n return c.json({ data: JSON.parse(rows.rows[0].data as string) });\n } catch {\n return c.json({ data: emptyJobData });\n }\n});\n\napp.put(\"/api/jobs/:id/data\", authed, async (c) => {\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({}));\n const data = body.data ?? {};\n await sqlite.execute(\n `INSERT INTO job_data (job_id, data, updated_at) VALUES (?, ?, datetime('now'))\n ON CONFLICT(job_id) DO UPDATE SET data = excluded.data, updated_at = datetime('now')`,\n [id, JSON.stringify(data)],\n );\n return c.json({ ok: true });\n});\n\n// ---- File uploads (Vista target TXT / BusyBusy Excel) ----\n\nasync function storeFileParts(formData: FormData, jobId: number, user: User) {\n const saved: { filename: string; kind: string; size: number }[] = [];\n const errors: string[] = [];\n\n for (const [key, value] of formData.entries()) {\n if (!(value instanceof File)) continue;\n const file = value as File;\n const name = file.name ?? key;\n const ext = name.slice(name.lastIndexOf(\".\")).toLowerCase();\n const kind = ALLOWED_EXT[ext];\n if (!kind) {\n errors.push(`\"${name}\" is not an accepted file type. Use .txt for Vista targets or .xlsx/.xls for BusyBusy time sheets.`);\n continue;\n }\n if (file.size > MAX_FILE_BYTES) {\n errors.push(`\"${name}\" exceeds the 25 MB upload limit.`);\n continue;\n }\n const nonce = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;\n const blobKey = `jobs/${jobId}/${kind}/${nonce}-${name}`;\n const bytes = new Uint8Array(await file.arrayBuffer());\n await blob.set(blobKey, bytes);\n await sqlite.execute(\n `INSERT INTO job_files (job_id, kind, filename, content_type, size, blob_key, uploaded_by, uploaded_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, datetime('now'))`,\n [jobId, kind, name, file.type || \"application/octet-stream\", file.size, blobKey, user.id],\n );\n saved.push({ filename: name, kind, size: file.size });\n }\n return { saved, errors };\n}\n\napp.post(\"/api/jobs/:id/files\", authed, async (c) => {\n const jobId = Number(c.req.param(\"id\"));\n const me = getU(c);\n const formData = await c.req.formData().catch(() => null);\n if (!formData) return c.json({ error: \"Invalid upload.\" }, 400);\n const { saved, errors } = await storeFileParts(formData, jobId, me);\n if (saved.length === 0) {\n return c.json({ error: errors.join(\" \") || \"No files uploaded.\" }, 400);\n }\n return c.json({ ok: true, saved, warnings: errors });\n});\n\napp.get(\"/api/jobs/:id/files\", authed, async (c) => {\n const id = Number(c.req.param(\"id\"));\n const rows = await sqlite.execute(\n `SELECT id, kind, filename, content_type, size, uploaded_at FROM job_files WHERE job_id = ? ORDER BY uploaded_at DESC`,\n [id],\n );\n return c.json({ files: rows.rows });\n});\n\n// ---- Equipment rates ----\napp.get(\"/api/equipment-rates\", authed, async (c) => {\n return c.json({ rates: equipmentRates, count: equipmentRates.length });\n});\n\n// ---- Monday.com (disconnected in Phase 2) ----\napp.get(\"/api/monday-connection\", authed, async (c) => {\n return c.json({ connected: false, message: \"Monday.com not connected\" });\n});\n\napp.post(\"/api/monday-refresh\", authed, async (c) => {\n return c.json({ error: \"Monday.com is not connected yet. The Utility Schedule import will be enabled in a later phase.\" }, 400);\n});\n\n// ---- Migration status ----\napp.get(\"/api/migration-status\", authed, async (c) => {\n const users = (await sqlite.execute(`SELECT COUNT(*) AS n FROM users`)).rows[0] as { n: number };\n const jobs = (await sqlite.execute(`SELECT COUNT(*) AS n FROM jobs`)).rows[0] as { n: number };\n const mondayToken = Deno.env.get(\"MONDAY_TOKEN\");\n return c.json({\n users: Number(users.n),\n jobs: Number(jobs.n),\n mondayTokenConfigured: Boolean(mondayToken),\n mondayConnected: false,\n });\n});\n\n// Admin: manage approved users.\napp.get(\"/api/admin/users\", authed, admin, async (c) => {\n const approved = await sqlite.execute(\n `SELECT id, email, role, created_at FROM approved_emails ORDER BY email`,\n );\n return c.json({ approved: approved.rows });\n});\n\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;\n","ndx-command-center",[154],"e0a3d028-1a1e-42fb-930b-28f93ae6d0ca","equipmentRates.ts","b7729c34-a7d3-11f1-8201-1607ee4eb77e",4,["D",1788466317861],"export type EquipmentRate = { label: string; rate: number };\n\n/**\n * Hourly operating rates imported from Rates by Equipment.pdf (08/14/26).\n *\n * NOTE: The migration source captured most of this list but was truncated at\n * entry \"5103\". The remaining plate-compactor / small-tool entries should be\n * reconciled from the original PDF before production use. This staging copy\n * carries the entries present in the source.\n */\nexport const equipmentRates: EquipmentRate[] = [\n { label: \"001 2013 Ram Truck 3500 ST\", rate: 100.00 },\n { label: \"002 2014 A Double Cab SR/SRS\", rate: 100.00 },\n { label: \"003 2003 F250 Super Duty\", rate: 100.00 },\n { label: \"004 2016 Ram 2500 Laramie\", rate: 100.00 },\n { label: \"005 2017 Ram 3500 Laramie\", rate: 100.00 },\n { label: \"006 2008 F250 Super Duty\", rate: 100.00 },\n { label: \"007 2021 Ram 3500 Laramie\", rate: 100.00 },\n { label: \"008 2015 F350 Super Duty\", rate: 100.00 },\n { label: \"009 2022 F150 Supercrew\", rate: 100.00 },\n { label: \"010 2022 F150 Supercrew\", rate: 100.00 },\n { label: \"011 2022 F350 Super Duty\", rate: 100.00 },\n { label: \"012 2019 Silverado C2500 Heavy Duty\", rate: 100.00 },\n { label: \"013 2013 Silverado C3500\", rate: 100.00 },\n { label: \"014 2015 F450 Super Duty\", rate: 100.00 },\n { label: \"015 2016 F350 Super Duty\", rate: 100.00 },\n { label: \"016 2015 F450 Super Duty\", rate: 100.00 },\n { label: \"018 2021 F350 Super Duty\", rate: 100.00 },\n { label: \"019 2021 F350 Super Duty\", rate: 100.00 },\n { label: \"020 2011 Ram 2500\", rate: 100.00 },\n { label: \"021 2022 F450 Super Duty\", rate: 100.00 },\n { label: \"022 2023 F150 Supercrew\", rate: 100.00 },\n { label: \"023 2023 F150 Supercrew\", rate: 100.00 },\n { label: \"024 2023 F150 Supercrew\", rate: 100.00 },\n { label: \"025 2022 F350 Super Duty\", rate: 100.00 },\n { label: \"026 2023 F150 Supercrew\", rate: 100.00 },\n { label: \"027 2025 F-150 STX\", rate: 100.00 },\n { label: \"028 2026 F-150 Crew Cab\", rate: 100.00 },\n { label: \"029 2026 Ford F150\", rate: 100.00 },\n { label: \"203 Case 580N Backhoe\", rate: 70.03 },\n { label: \"204 Case 580SN T4 Backhoe\", rate: 70.03 },\n { label: \"205 Case 580 SN T4 Backhoe\", rate: 70.03 },\n { label: \"206 Case 580SN T4B Backhoe\", rate: 70.03 },\n { label: \"207 JD 320 P-Tier Backhoe\", rate: 70.03 },\n { label: \"208 Case 570N-EP Backhoe\", rate: 70.03 },\n { label: \"301 CAT 322 BL Trackhoe W/ Hammer\", rate: 103.49 },\n { label: \"303 Case CX36B Excavator\", rate: 44.57 },\n { label: \"305 KOM PC 78US-8 Mini Excavator\", rate: 57.89 },\n { label: \"306 KOM PC210LC-11 Excavator\", rate: 103.49 },\n { label: \"307 CAT 303.5 E2 Mini Ex\", rate: 44.57 },\n { label: \"308 CAT 308-07 T Midi Excavator\", rate: 57.89 },\n { label: \"309 CAT 320-07 Excavator\", rate: 103.49 },\n { label: \"310 CAT 308-07 Mini Excavator\", rate: 57.89 },\n { label: \"311 CAT 303.5-07 Mini Excavator\", rate: 44.57 },\n { label: \"312 CAT 308-07 Midi Ex\", rate: 57.89 },\n { label: \"313 CAT 303.5-07 Mini Ex\", rate: 44.57 },\n { label: \"314 CAT 349FL Excavator\", rate: 210.00 },\n { label: \"315 CAT320GC Excavator\", rate: 103.49 },\n { label: \"316 KOM PC78US-11 Excavator\", rate: 57.89 },\n { label: \"317 CAT 303.5-07OR Mini Ex\", rate: 44.57 },\n { label: \"318 CAT 308-07CR Midi Excavator\", rate: 57.89 },\n { label: \"4001 2022 Peterbilt 579 Water Truck\", rate: 48.67 },\n { label: \"4002 2022 Peterbilt 579 Water Truck\", rate: 48.67 },\n { label: \"4003 2021 Peterbilt 579 Water Truck\", rate: 48.67 },\n { label: \"4005 2021 Peterbilt 579 4x2 Water Truck\", rate: 48.67 },\n { label: \"4006 2012 Kenworth T370 Water Truck\", rate: 61.48 },\n { label: \"4007 2012 Kenworth T370 Water Truck\", rate: 61.48 },\n { label: \"4008 1999 Sterling Water Truck\", rate: 48.67 },\n { label: \"4009 2006 Peterbilt 378 Convention Water Truck\", rate: 61.48 },\n { label: \"4010 1997 Water Truck (2000G)\", rate: 48.67 },\n { label: \"4011 2004 Water Pull 615 (6000G)\", rate: 157.80 },\n { label: \"4012 2019 Freightliner Water Truck (2000G)\", rate: 61.48 },\n { label: \"4013 2023 Freightliner Water Truck (2000G)\", rate: 48.67 },\n { label: \"4014 2023 Water Wagon 613CII\", rate: 157.80 },\n { label: \"4015 1993 International Water Truck\", rate: 61.48 },\n { label: \"4016 1992 Peterbilt Water Truck\", rate: 61.48 },\n { label: \"4017 1996 Peterbilt Water Truck\", rate: 61.48 },\n { label: \"4018 1998 Water Truck\", rate: 48.67 },\n { label: \"402 CAT 966F Loader\", rate: 172.14 },\n { label: \"404 CAT 938K Loader\", rate: 85.05 },\n { label: \"405 KOM WA320 Loader\", rate: 85.05 },\n { label: \"406 KOM WA380 Loader\", rate: 123.98 },\n { label: \"407 CAT 950M Loader\", rate: 123.98 },\n { label: \"408 CAT 950M Loader (New)\", rate: 123.98 },\n { label: \"409 CAT 950M Loader\", rate: 123.98 },\n { label: \"410 CAT 950M Loader\", rate: 123.98 },\n { label: \"4100 2021 Peterbilt 337 Fuel Truck\", rate: 0.00 },\n { label: \"4101 2026 Peterbilt 537 Fuel Truck\", rate: 0.00 },\n { label: \"4102 2021 Peterbilt 348 8x4 Dump Truck\", rate: 157.99 },\n { label: \"4103 1995 International Dump Truck\", rate: 157.99 },\n { label: \"4104 2022 Peterbilt 579 Dump Truck\", rate: 157.99 },\n { label: \"4105 2021 Peterbilt 579 4x2 Dump Truck\", rate: 157.99 },\n { label: \"4106 Peterbilt 389\", rate: 157.99 },\n { label: \"4107 International ProStar 6x4 Day Cab Truck\", rate: 157.99 },\n { label: \"4108 Peterbilt 378 Convention\", rate: 157.99 },\n { label: \"411 KOM WA320-8 Loader\", rate: 85.05 },\n { label: \"412 CAT 950-14 Loader\", rate: 123.98 },\n { label: \"413 JD 644 P-Tier Loader\", rate: 123.98 },\n { label: \"414 CAT 950M Loader\", rate: 123.98 },\n { label: \"504 Case SR175 Skidsteer\", rate: 44.57 },\n { label: \"507 Case SR210 Skidsteer (New)\", rate: 44.57 },\n { label: \"508 Case SR210B T4 Skidsteer\", rate: 44.57 },\n { label: \"509 Case SR210B T4 Skidsteer\", rate: 44.57 },\n { label: \"510 Case SR210B T4 Skidsteer\", rate: 44.57 },\n { label: \"5100 Plate Compactors\", rate: 0.00 },\n { label: \"5101 Multiquip Plate Wacker\", rate: 0.00 },\n { label: \"5102 Sakai Wacker Rammer\", rate: 0.00 },\n // The source file truncated here. The remaining entries (from ~5103 onward,\n // small tools / saws / trailers / generators) should be re-imported from\n // \"Rates by Equipment.pdf\" before production use.\n];\n",[163],"e8626441-c730-4955-b23b-b61caa4a44b8","db.ts","9d68b710-a7d3-11f1-bea0-1607ee4eb77e",18,["D",1788472738104],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n/**\n * Database migrations for the Production Command Center.\n *\n * The migration has its own DB tables for users, sessions, approved emails,\n * jobs, job labor rates, job data, Monday snapshots, and uploaded-file metadata.\n * All statements use CREATE TABLE IF NOT EXISTS / ALTER guard so the setup is\n * idempotent across restarts.\n */\n\nconst migrations: { name: string; sql: string[] }[] = [\n {\n name: \"0001_initial_auth_and_jobs\",\n sql: [\n `CREATE TABLE IF NOT EXISTS users (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n email TEXT NOT NULL UNIQUE,\n role TEXT NOT NULL DEFAULT 'user' CHECK (role IN ('admin','user')),\n password_salt TEXT,\n password_hash TEXT,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n `CREATE TABLE IF NOT EXISTS sessions (\n id TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n token_hash TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n expires_at TEXT NOT NULL\n )`,\n `CREATE INDEX IF NOT EXISTS idx_sessions_user ON sessions(user_id)`,\n `CREATE TABLE IF NOT EXISTS approved_emails (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n email TEXT NOT NULL UNIQUE,\n role TEXT NOT NULL DEFAULT 'user' CHECK (role IN ('admin','user')),\n created_by INTEGER REFERENCES users(id),\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n `CREATE TABLE IF NOT EXISTS jobs (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT NOT NULL,\n source TEXT,\n job_number TEXT,\n status TEXT,\n superintendent TEXT,\n project_manager TEXT,\n estimator TEXT,\n location TEXT,\n jurisdiction TEXT,\n general_contractor TEXT,\n foreman TEXT,\n prevailing_wage TEXT,\n permit_number TEXT,\n schedule_group TEXT,\n monday_url TEXT,\n created_by INTEGER REFERENCES users(id),\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n `CREATE TABLE IF NOT EXISTS job_labor_rates (\n job_id INTEGER PRIMARY KEY REFERENCES jobs(id) ON DELETE CASCADE,\n labor REAL,\n operator REAL,\n foreman REAL,\n updated_at TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS job_data (\n job_id INTEGER PRIMARY KEY REFERENCES jobs(id) ON DELETE CASCADE,\n data TEXT,\n updated_at TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS monday_snapshots (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n fetched_at TEXT NOT NULL DEFAULT (datetime('now')),\n jobs_json TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS job_files (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n job_id INTEGER REFERENCES jobs(id) ON DELETE CASCADE,\n kind TEXT NOT NULL,\n filename TEXT NOT NULL,\n content_type TEXT,\n size INTEGER,\n blob_key TEXT NOT NULL,\n uploaded_by INTEGER REFERENCES users(id),\n uploaded_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n `CREATE TABLE IF NOT EXISTS settings (\n key TEXT PRIMARY KEY,\n value TEXT\n )`,\n ],\n },\n {\n name: \"0002_jobs_created_by\",\n sql: [\n // 0001 ran before created_by was added to the jobs CREATE TABLE, so add it\n // via ALTER TABLE now. Idempotent across restarts via try/catch.\n `ALTER TABLE jobs ADD COLUMN created_by INTEGER REFERENCES users(id)`,\n ],\n },\n];\n\nconst applied = new Set();\n\nexport async function migrate(): Promise {\n // Track applied migrations.\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS _migrations (\n name TEXT PRIMARY KEY,\n applied_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n );\n\n for (const migration of migrations) {\n const row = await sqlite.execute(\n `SELECT name FROM _migrations WHERE name = ?`,\n [migration.name],\n );\n if (row.rows.length > 0) {\n applied.add(migration.name);\n continue;\n }\n await sqlite.batch(\n migration.sql.map((sql) => ({ sql })),\n );\n await sqlite.execute(\n `INSERT INTO _migrations (name) VALUES (?)`,\n [migration.name],\n );\n applied.add(migration.name);\n }\n}\n\n/** Runs migrations once at import time (idempotent). */\nexport const ready = migrate();\n",[170],"345b0511-440e-4372-8675-5a014e9ef1c1","auth.ts","ace8cfc2-a7d3-11f1-8230-1607ee4eb77e",3,["D",1788466300593],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport type { Context, Next } from \"npm:hono\";\n\nexport interface User {\n id: number;\n email: string;\n role: \"admin\" | \"user\";\n}\n\nexport const SESSION_COOKIE = \"pcc_session\";\nconst SESSION_DAYS = 30;\n\nconst encoder = new TextEncoder();\n\nfunction bufToHex(buf: ArrayBuffer): string {\n return [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction hexToBuf(hex: string): Uint8Array {\n const out = new Uint8Array(hex.length / 2);\n for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n return out;\n}\n\nasync function randomHex(bytes: number): Promise {\n const buf = crypto.getRandomValues(new Uint8Array(bytes));\n return bufToHex(buf.buffer);\n}\n\n/** PBKDF2-SHA256 password hashing with a per-user random salt. */\nexport async function hashPassword(password: string): Promise<{ salt: string; hash: string }> {\n const salt = await randomHex(16);\n const keyMaterial = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt: hexToBuf(salt), iterations: 120_000, hash: \"SHA-256\" },\n keyMaterial,\n 256,\n );\n return { salt, hash: bufToHex(bits) };\n}\n\nexport async function verifyPassword(password: string, salt: string, hash: string): Promise {\n try {\n const keyMaterial = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt: hexToBuf(salt), iterations: 120_000, hash: \"SHA-256\" },\n keyMaterial,\n 256,\n );\n return bufToHex(bits) === hash;\n } catch {\n return false;\n }\n}\n\n/** Create a session for a user; returns the raw token to set as the cookie. */\nexport async function createSession(userId: number): Promise<{ token: string; expiresAt: string }> {\n const id = await randomHex(16);\n const token = await randomHex(32);\n const tokenHash = bufToHex((await crypto.subtle.digest(\"SHA-256\", encoder.encode(token))).buffer);\n const expiresAt = new Date(Date.now() + SESSION_DAYS * 24 * 60 * 60 * 1000).toISOString();\n await sqlite.execute(\n `INSERT INTO sessions (id, user_id, token_hash, expires_at) VALUES (?, ?, ?, ?)`,\n [id, userId, tokenHash, expiresAt],\n );\n return { token, expiresAt };\n}\n\nexport function sessionCookieHeader(token: string, expiresAt: string): string {\n return `${SESSION_COOKIE}=${token}; HttpOnly; Secure; SameSite=Lax; Path=/; Expires=${new Date(expiresAt).toUTCString()}`;\n}\n\nexport const clearCookieHeader = `${SESSION_COOKIE}=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0`;\n\n/** Resolve the current user from the request's cookie, or null. */\nexport async function getSessionUser(req: Request): Promise {\n const cookie = req.headers.get(\"cookie\") ?? \"\";\n const match = cookie.split(\";\").map((s) => s.trim()).find((c) => c.startsWith(`${SESSION_COOKIE}=`));\n if (!match) return null;\n const token = match.slice(SESSION_COOKIE.length + 1);\n if (!token) return null;\n const tokenHash = bufToHex((await crypto.subtle.digest(\"SHA-256\", encoder.encode(token))).buffer);\n const rows = await sqlite.execute(\n `SELECT s.expires_at AS exp, u.id AS id, u.email AS email, u.role AS role\n FROM sessions s JOIN users u ON u.id = s.user_id\n WHERE s.token_hash = ?`,\n [tokenHash],\n );\n if (rows.rows.length === 0) return null;\n const row = rows.rows[0] as { exp: string; id: number; email: string; role: string };\n if (new Date(row.exp).getTime() < Date.now()) return null;\n return { id: Number(row.id), email: row.email, role: row.role as \"admin\" | \"user\" };\n}\n\n/** Hono middleware: require a logged-in user, else 401 JSON (for /api/*). */\nexport async function requireAuth(c: Context, next: Next) {\n const user = await getSessionUser(c.req.raw);\n if (!user) {\n return c.json({ error: \"Not authenticated\" }, 401);\n }\n c.set(\"user\", user);\n await next();\n}\n\n/** Hono middleware: require admin role. */\nexport async function requireAdmin(c: Context, next: Next) {\n const user = c.get(\"user\");\n if (!user || user.role !== \"admin\") {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n await next();\n}\n",[177],"dad98472-62c6-47f9-842e-3a9e324a0c56","README.md","27d70b36-a7d4-11f1-942c-1607ee4eb77e",23,["D",1788473046694],"# Production Command Center — Val Town migration\n\nA Val Town-native rebuild of the NDX Production Command Center. Cloudflare\nNext.js/Vinext has been replaced with **Hono** (routes) + a client-side **React**\nfrontend. **Cloudflare D1** → this val's scoped SQLite. **Cloudflare R2** → this\nval's scoped Blob Storage.\n\n> **Phase status: Phase 2 — non-Monday dashboard features complete.**\n> Auth, roles, the full dashboard (jobs, rates, Vista/BusyBusy imports, cost\n> consolidation, equipment/crew/phase views, equipment moves, reports), and\n> permanent job storage are implemented and tested. Monday.com remains\n> disconnected. No production job data is loaded.\n\n## Try it\n\n- [Launch the app](url:index.ts)\n- [View source](url:/source)\n- [Add `MONDAY_TOKEN`](https://www.val.town/x/wnewton/production-command-center/environment-variables?key=MONDAY_TOKEN)\n\nSign in with the existing administrator account. Every dashboard page and data\nAPI requires authentication.\n\n## Architecture\n\n```mermaid\ngraph LR\n Browser -->|GET /| Hono[\"index.ts (Hono server)\"]\n Hono -->|serves| Root[\"frontend/root.tsx (HTML shell)\"]\n Root -->|loads| Entry[\"frontend/index.tsx\"]\n Entry -->|renders| App[\"frontend/App.tsx (auth + dashboard)\"]\n App -->|\"fetch /api/*\"| Hono\n Hono -->|SQLite| DB[\"project-scoped SQLite (std/sqlite/main.ts)\"]\n Hono -->|Blob| Blob[\"scoped Blob Storage (original uploads)\"]\n Hono -->|secrets| Env[\"Deno.env MONDAY_TOKEN (server-only)\"]\n```\n\n## Files\n\n```\nindex.ts ← Hono HTTP entrypoint (auth + jobs + data + files + rates)\ndb.ts ← SQLite migrations (users, sessions, jobs, rates, data, Monday, files)\nauth.ts ← PBKDF2 hashing, HTTP-only session cookies, role middleware\nequipmentRates.ts ← Equipment rate book (source of hourly operating rates)\nfrontend/\n root.tsx ← HTML shell (stamps immutable asset URLs)\n index.tsx ← React entrypoint\n App.tsx ← Auth + jobs, rates, imports, cost/equipment/report views\n styles.css ← NDX black/white/red interface\n```\n\n## Auth model\n\n- **Email + password** login (PBKDF2-SHA256 hashed, per-user salt).\n- **HTTP-only, Secure, SameSite=Lax** session cookie (`pcc_session`), token hashed in DB, 30-day expiry.\n- **Approved-email allowlist** (`approved_emails`) with `admin` / `user` roles. Admins manage jobs; both may view/enter data.\n- Every data API requires auth (`requireAuth`); job create/edit/delete also requires `requireAdmin`.\n\n## Phase 2 — implemented & tested\n\n- **Jobs** — create, select (top bar), edit, delete (cascades data, rates, files, blobs).\n- **Per-job labor / operator / foreman rates** — saved per job with standard defaults.\n- **Vista TXT target import** — browser-side CSV parsing, targets stored in the job's production map, original saved to Blob.\n- **BusyBusy Excel import** — SheetJS in the browser; actual costs per cost code, equipment usage, crew size, phase-code breakdown, equipment moves. Original saved to Blob.\n- **Cost-code consolidation** — first-4-digit grouping (1201.2 + 1201.3 → 1201), toggle in the cost-code table.\n- **Equipment usage / crew size / phase-code views** — most-used equipment, crew-by-workday, expandable per-phase detail.\n- **Equipment moves (phase 1101)** — equipment moved, move hours, driver labor cost, hauling truck cost, total; no charge for the transported machine.\n- **Manual production + cost per unit** — enter quantities per cost code; actual vs. Vista target unit cost.\n- **Reports + print/PDF** — executive report cover, top cost codes, print stylesheet.\n- **Permanent storage** — job data in SQLite, original uploads in Blob Storage keyed by job.\n\n**Monday.com: disconnected.** The Utility Schedule import is deferred to Phase 3.\n\n## Remaining (Phase 3)\n\n- Set `MONDAY_TOKEN` environment variable.\n- Wire the Monday.com Utility Schedule board import (map jobs, exclude the `Completed.` group, add the refresh button, use the `monday_snapshots` table).\n- Optionally re-import the tail of the equipment-rate PDF (the migration source was truncated at entry `5103`, so `equipmentRates.ts` carries 96 records; some small-tool entries may be missing).\n\n## Secrets\n\nNo added env vars are required for Phase 2 — the val injects its own API token. The single secret needed for Phase 3 is `MONDAY_TOKEN`.\n\n👉 Add `MONDAY_TOKEN` here: https://www.val.town/x/wnewton/production-command-center/environment-variables?key=MONDAY_TOKEN\n\n## Safety\n\n- Monday.com token (when added) stays server-side only.\n- All reads/writes/uploads are authenticated; uploaded file type + size validated.\n- Parameterized SQL throughout.\n- The live hosted Command Center is untouched.\n",[184],"b4ddd245-b24d-43c0-84da-9e5509f17f07","scripts","3602a262-390e-4ee8-b50a-14fa58db107b",17,["D",1788472667790],"directory",[191],"d282a7b4-665c-4fa4-96fc-c126b9fb15e5","frontend","ba293578-a7d3-11f1-8201-1607ee4eb77e",5,["D",1788466322820],[198],"pulls","branches","forks","envVars",{"_210":179,"_212":70},"connections",{"_210":70,"_211":70},"count","unfilledCount","emptyCount",{"_51":197,"_39":198,"_37":199,"_147":-5,"_49":50,"_48":200,"_149":31,"_46":284,"_13":70,"_41":195,"_43":-5,"_30":33,"_151":-5,"_227":285,"_34":286},{"_51":276,"_39":277,"_37":278,"_147":199,"_49":50,"_48":279,"_149":33,"_46":280,"_13":179,"_41":42,"_43":281,"_30":33,"_151":-5,"_227":282,"_34":283},{"_51":268,"_39":269,"_37":270,"_147":199,"_49":50,"_48":271,"_149":31,"_46":272,"_13":70,"_41":42,"_43":273,"_30":33,"_151":-5,"_227":274,"_34":275},{"_51":260,"_39":261,"_37":262,"_147":199,"_49":50,"_48":263,"_149":31,"_46":264,"_13":70,"_41":42,"_43":265,"_30":33,"_151":-5,"_227":266,"_34":267},{"_51":252,"_39":253,"_37":254,"_147":199,"_49":50,"_48":255,"_149":33,"_46":256,"_13":157,"_41":26,"_43":257,"_30":33,"_151":-5,"_227":258,"_34":259},{"_51":190,"_39":191,"_37":192,"_147":-5,"_49":50,"_48":193,"_149":31,"_46":249,"_13":70,"_41":195,"_43":-5,"_30":33,"_151":-5,"_227":250,"_34":251},{"_51":245,"_39":40,"_37":38,"_147":192,"_49":50,"_48":14,"_149":33,"_46":246,"_13":179,"_41":42,"_43":45,"_30":33,"_151":-5,"_227":247,"_34":248},{"_51":183,"_39":184,"_37":185,"_147":-5,"_49":50,"_48":186,"_149":33,"_46":242,"_13":148,"_41":26,"_43":188,"_30":33,"_151":-5,"_227":243,"_34":244},{"_51":176,"_39":177,"_37":178,"_147":-5,"_49":50,"_48":179,"_149":31,"_46":239,"_13":70,"_41":42,"_43":181,"_30":33,"_151":-5,"_227":240,"_34":241},{"_51":169,"_39":170,"_37":171,"_147":-5,"_49":50,"_48":172,"_149":33,"_46":236,"_13":157,"_41":42,"_43":174,"_30":33,"_151":-5,"_227":237,"_34":238},{"_51":162,"_39":163,"_37":164,"_147":-5,"_49":50,"_48":165,"_149":31,"_46":233,"_13":70,"_41":42,"_43":167,"_30":33,"_151":-5,"_227":234,"_34":235},{"_51":153,"_39":154,"_37":65,"_147":-5,"_49":50,"_48":155,"_149":33,"_46":230,"_13":157,"_41":158,"_43":159,"_30":33,"_151":160,"_227":231,"_34":232},{"_51":144,"_39":145,"_37":146,"_147":-5,"_49":50,"_48":148,"_149":31,"_46":226,"_13":70,"_41":42,"_43":109,"_30":33,"_151":-5,"_227":228,"_34":229},["D",1788450878935],"children",[],[145],["D",1788488919300],[],[154],["D",1788466317861],[],[163],["D",1788472738104],[],[170],["D",1788466300593],[],[177],["D",1788473046694],[],[184],"6e79c58a-0a19-4802-a82a-03e3da456e78",["D",1788488996417],[],[191,40],["D",1788472667790],[219],[191],"9884c966-f5a2-46a0-bd34-5e126de9543a","styles.css","ff077a2e-a7d3-11f1-92c0-1607ee4eb77e",26,["D",1788488936901],"/* Production Command Center — NDX black/white/red interface */\n:root{--navy:#090909;--red:#d71920;--ink:#111;--muted:#707070;--line:#dedede;--paper:#f3f3f3;--shadow:0 10px 30px rgba(0,0,0,.075)}\n*{box-sizing:border-box}\nhtml{background:var(--paper)}\nbody{margin:0;background:radial-gradient(circle at 92% 4%,rgba(196,18,48,.07),transparent 25%),radial-gradient(circle at 42% 96%,rgba(0,0,0,.035),transparent 32%),var(--paper);color:var(--ink);font-family:\"Manrope\",Arial,sans-serif;-webkit-font-smoothing:antialiased}\nbutton{border:1px solid #d7dfe2;background:#fff;border-radius:6px;padding:10px 14px;margin-left:7px;font-size:10px;font-weight:800;color:#455660;cursor:pointer}\n.gold{background:var(--red);border-color:var(--red);color:#fff}\n.shell{min-height:100vh;display:block}\n.shell aside{position:fixed;inset:0 auto 0 0;z-index:30;width:258px;padding:24px 16px 20px;background:linear-gradient(165deg,#141414 0%,#090909 58%,#000 100%);box-shadow:12px 0 40px rgba(0,0,0,.14)}\n.shell aside:after{content:\"\";position:absolute;inset:0;pointer-events:none;background:radial-gradient(circle at 12% 0,rgba(196,18,48,.3),transparent 28%),radial-gradient(circle at 100% 92%,rgba(196,18,48,.12),transparent 34%)}\n.brand,nav,.job,.user{position:relative;z-index:1}\n.brand{display:flex;gap:13px;align-items:center;padding:2px 7px 24px;border-bottom:1px solid rgba(255,255,255,.11)}\n.brand>i{width:50px;height:50px;border:1px solid rgba(255,255,255,.2);border-radius:15px;background:linear-gradient(145deg,#d81d3d,#aa0e28);box-shadow:0 10px 24px rgba(196,18,48,.3);display:grid;place-items:center;font:800 17px \"Manrope\";letter-spacing:-.08em;color:#fff;font-style:normal}\n.brand>i span{font-size:13px}\n.brand b{font-size:14px;letter-spacing:-.02em;color:#fff}\n.brand small{margin-top:5px;color:#a9a9a9;font:500 8px \"DM Mono\";letter-spacing:.11em}\n.brand span,.user span{display:flex;flex-direction:column}\n.shell nav{display:flex;flex-direction:column;gap:5px;margin-top:22px}\n.shell nav button{position:relative;display:flex;align-items:center;gap:12px;min-height:47px;padding:0 12px;border:0;border-radius:12px;color:#b7b7b7;background:transparent;font-size:11px;font-weight:600;transition:170ms ease;margin-left:0;width:100%;text-align:left}\n.shell nav button:hover{color:#fff;background:rgba(255,255,255,.06);transform:translateX(2px)}\n.shell nav button>span{display:grid;place-items:center;width:28px;height:28px;border-radius:9px;color:#9c9c9c;background:rgba(255,255,255,.055);font-size:13px}\n.shell nav button.active{color:#fff;background:rgba(255,255,255,.1);box-shadow:0 8px 22px rgba(0,0,0,.1)}\n.shell nav button.active:before{content:\"\";position:absolute;left:0;width:3px;height:22px;border-radius:0 4px 4px 0;background:#e31b3d}\n.shell nav button.active>span{color:#fff;background:rgba(196,18,48,.72)}\n.job{margin-top:auto;border:0;border-top:1px solid rgba(255,255,255,.11);border-radius:0;padding:19px 10px 0!important;background:transparent!important;display:flex;flex-direction:column;gap:7px}\n.job small{color:#b8b8b8;font:500 8px \"DM Mono\";letter-spacing:.07em}\n.job b{font-size:11px;color:#fff}\n.job em{color:#ddd;font:500 9px \"DM Mono\";font-style:normal}\n.user{border-top:0;margin-top:18px;padding:0 10px;display:flex;gap:9px;align-items:center}\n.user>i{width:34px;height:34px;border-radius:11px;background:linear-gradient(145deg,#d91b3b,#b40e2a);display:grid;place-items:center;color:#fff;font-style:normal;font-size:10px;font-weight:bold}\n.user b{font-size:10px;color:#fff}\n.user small{font-size:8px;color:#a9a9a9}\n.shell main{width:calc(100% - 258px);max-width:none;min-height:100vh;margin-left:258px;padding:0 34px 66px}\n.shell main>header{position:sticky;top:0;z-index:20;min-height:92px;margin:0 -34px 30px;padding:17px 34px;align-items:center;display:flex;justify-content:space-between;background:rgba(255,255,255,.9);border-bottom:1px solid rgba(220,220,220,.92);box-shadow:0 8px 30px rgba(0,0,0,.04);backdrop-filter:blur(22px) saturate(1.2)}\nheader p{font-size:8px;letter-spacing:1.7px;font-weight:800;color:#8a979e;margin:0 0 7px}\nheader h1{font:700 clamp(25px,2.3vw,35px) \"Manrope\";line-height:1;letter-spacing:-.05em;margin:0 0 6px}\nheader span{font-size:11px;color:var(--muted)}\n.header-actions{display:flex;align-items:center;gap:10px}\nheader button{min-height:42px;margin:0;border-radius:11px;padding:0 17px;font-size:10px;transition:170ms ease}\nheader button:hover{transform:translateY(-2px);box-shadow:0 9px 20px rgba(0,0,0,.14)}\nheader .gold{background:linear-gradient(145deg,#d91b3b,#b40e2a)!important;box-shadow:0 5px 14px rgba(196,18,48,.22)}\nheader .logout{background:#fff;color:#111;border-color:#dedede}\n.top-job-picker{display:grid;gap:3px;min-width:235px;padding:7px 12px;border:1px solid #dbe3de;border-radius:11px;background:rgba(255,255,255,.82)}\n.top-job-picker small{color:#707070;font:500 8px \"DM Mono\";letter-spacing:.1em}\n.top-job-picker select{border:0;outline:0;background:transparent;color:#111;font-size:11px;font-weight:600}\n.status-line{background:#fff;border:1px solid var(--line);border-left:4px solid var(--red);border-radius:10px;padding:11px 15px;margin-bottom:15px;font-size:10px;font-weight:700;color:#b51218}\n.panel,.kpis article{background:rgba(255,255,255,.92);border:1px solid rgba(220,220,220,.95);border-radius:17px;box-shadow:var(--shadow);backdrop-filter:blur(10px)}\n.panel{padding:21px;margin-bottom:18px;overflow:hidden}\n.kpis{display:grid;grid-template-columns:repeat(4,1fr);gap:15px;margin:15px 0}\n.kpis article{min-height:145px;padding:21px 22px;border-top:3px solid #111;transition:180ms ease}\n.kpis article>i{display:grid;place-items:center;width:27px;height:27px;background:#f7e7e7;color:var(--red);border-radius:6px;font-style:normal;font-weight:bold}\n.kpis article p{margin-top:15px;font-size:8px;letter-spacing:1.5px;font-weight:800;color:#8a979e}\n.kpis h2{font:500 28px \"DM Mono\";margin:0 0 6px}\n.kpis span{font-size:8px;color:#84929a}\n.kpis .accent{border-top:3px solid var(--red)}\n.import-strip{display:flex;align-items:center;gap:9px;background:linear-gradient(145deg,#1a1a1a,#050505);color:#fff;border-left:5px solid var(--red);border-radius:22px;padding:13px 15px;margin-top:15px;box-shadow:0 18px 44px rgba(0,0,0,.18)}\n.import-strip>div{margin-right:auto}\n.import-strip p{color:#e1484d;margin-bottom:4px;font-size:8px;font-weight:800;letter-spacing:1.7px}\n.import-strip b{font-size:11px}\n.import-strip button{min-height:42px;border-radius:11px;border-color:#444;background:#222;color:#fff}\n.empty-state{padding:50px 20px;display:flex;flex-direction:column;align-items:center;gap:8px;color:#7b868c;text-align:center}\n.empty-state b{font:700 18px Georgia;color:#111}\n.empty-state span{font-size:10px;max-width:520px;line-height:1.5}\n.view-head{display:flex;justify-content:space-between;align-items:center;border-bottom:1px solid #e4e7e8;padding-bottom:16px}\n.view-head p{margin-bottom:4px;color:var(--red);font-size:8px;font-weight:800;letter-spacing:1.5px}\n.view-head h3{font:700 20px \"Manrope\";margin:0}\n.source-pill{padding:6px 9px;border-radius:20px;background:#f6e7ea;color:#b5122c;font:600 7px \"DM Mono\";letter-spacing:.08em}\n/* Migration checklist */\n.migration-panel{padding:22px!important}\n.migration-list{display:flex;flex-direction:column;margin-top:8px}\n.migration-row{display:flex;align-items:center;gap:14px;min-height:58px;padding:12px 6px;border-top:1px solid #ececec}\n.migration-row>i{flex:0 0 26px;width:26px;height:26px;display:grid;place-items:center;border-radius:9px;font-style:normal;background:#eee;color:#999;font:600 12px \"DM Mono\"}\n.migration-row.done>i{background:#111;color:#fff}\n.migration-row>span{display:flex;flex-direction:column;gap:3px}\n.migration-row b{font-size:11px}\n.migration-row small{font-size:9px;color:#7a7a7a;line-height:1.4}\n.migration-note{margin-top:16px;padding:13px 15px;border-left:4px solid var(--red);background:#f8eeee;border-radius:10px;font-size:10px;line-height:1.5;color:#7a5a5c}\n.migration-note code{background:#fff;border:1px solid #e2ccce;padding:2px 6px;border-radius:5px;color:#b51218}\n/* Auth screens */\n.auth-shell{min-height:100vh;display:grid;place-items:center;padding:20px}\n.auth-card{width:min(440px,100%);background:rgba(255,255,255,.95);border:1px solid rgba(220,220,220,.95);border-radius:20px;box-shadow:var(--shadow);padding:34px;display:flex;flex-direction:column}\n.brand-mark{width:58px;height:58px;border-radius:16px;background:linear-gradient(145deg,#d81d3d,#aa0e28);box-shadow:0 10px 24px rgba(196,18,48,.3);display:grid;place-items:center;font:800 20px \"Manrope\";letter-spacing:-.08em;color:#fff}\n.brand-mark span{font-size:15px}\n.auth-kicker{margin-top:24px;color:var(--red);font-size:9px;font-weight:800;letter-spacing:2px}\n.auth-card h1{font:700 26px \"Manrope\";letter-spacing:-.02em;margin:6px 0 8px}\n.auth-sub{font-size:11px;line-height:1.55;color:#707070;margin:0 0 18px}\n.auth-card label{display:flex;flex-direction:column;gap:6px;margin-bottom:14px;font-size:8px;font-weight:800;letter-spacing:1px;color:#777}\n.auth-card input{border:1px solid #d8dfe2;border-radius:10px;padding:12px 13px;font-size:12px}\n.auth-card .gold{min-height:46px;border-radius:11px;margin:6px 0 0;font-size:12px}\n.auth-status{font-size:11px;color:#b51218;background:#f8eeee;border-radius:8px;padding:9px 11px;margin:0 0 10px}\n.auth-loading{color:#777;font-size:11px;margin-top:20px}\n.backdrop{position:fixed;inset:0;background:rgba(8,8,8,.74);display:grid;place-items:center;padding:20px;z-index:100;backdrop-filter:blur(5px)}\n.backdrop form{width:min(550px,100%);background:#fff;padding:23px;border-radius:17px;box-shadow:0 30px 90px rgba(0,0,0,.32)}\n.form-head{display:flex;justify-content:space-between;margin:-23px -23px 20px;padding:19px 24px;color:#fff;background:#111;border-radius:17px 17px 0 0}\n.form-head p{color:#e15469}\n.form-head h2{font:700 23px \"Manrope\";margin:0}\n.form-head button{border:0;font-size:22px;color:#fff;background:transparent}\n.create-job-form>label{display:flex;flex-direction:column;gap:7px;margin-top:20px;font-size:8px;font-weight:bold;letter-spacing:1px;color:#777}\n.create-job-form>label input{border:1px solid #d8e0e3;border-radius:6px;padding:12px;font-size:12px}\n.job-help{font-size:9px;line-height:1.5;margin-top:12px;color:#888}\n.actions{display:flex;justify-content:flex-end;margin-top:17px}\n@media(max-width:1100px){.shell aside{width:82px}.shell main{width:calc(100% - 82px);margin-left:82px}.brand span,.job,.user span{display:none}.brand>i{width:48px}.shell nav button{font-size:0;padding:0 10px}.top-job-picker{min-width:180px}}\n@media(max-width:760px){.shell aside{position:static;width:100%;height:68px;min-height:0;padding:9px 14px}.shell aside nav,.job,.user{display:none}.brand{border:0;padding:0}.shell main{width:100%;margin:0;padding:0 15px 45px}.shell main>header{position:static;margin:0 -15px 20px;padding:16px}.kpis{grid-template-columns:1fr 1fr}}\n/* Print */\n@media print{aside,.header-actions,.import-strip,.logout{display:none!important}.shell main{margin:0;width:100%;padding:0}.panel{box-shadow:none;border:1px solid #ddd}}\n\n/* ===== Phase 2 components ===== */\n/* Monday status strip */\n.monday-strip{display:flex;align-items:center;gap:12px;background:#fff;border:1px solid var(--line);border-left:5px solid #999;border-radius:14px;padding:12px 16px;margin-bottom:16px;box-shadow:var(--shadow)}\n.monday-strip>div{display:flex;flex-direction:column;gap:3px;margin-right:auto}\n.monday-strip p{color:#8a979e;margin:0;font-size:8px;font-weight:800;letter-spacing:1.5px}\n.monday-strip b{font-size:12px}\n.monday-strip span{font-size:10px;color:#7a848a}\n.monday-strip.not-connected{border-left-color:#b0b0b0}\n.monday-strip.not-connected b{color:#8a8a8a}\n.monday-strip button{min-height:36px;border-radius:10px;background:#f0f0f0;color:#999;cursor:not-allowed}\n/* Filters */\n.filters{height:56px;background:#fff;border:1px solid var(--line);border-radius:12px;padding:11px 16px;display:flex;align-items:center;gap:28px;margin-top:14px;box-shadow:var(--shadow)}\n.filters label{font-size:7px;font-weight:bold;color:#87959d;display:flex;flex-direction:column;gap:5px}\n.filters select{border:0;background:#fff;font-size:10px;font-weight:bold}\n.filters>span{margin-left:auto;font-size:9px;color:#b51218}\n/* Jobs manager */\n.jobs-panel{padding:22px!important}\n.create-job-inline{display:flex;gap:10px;margin:16px 0}\n.create-job-inline input{flex:1;border:1px solid #d8e0e3;border-radius:10px;padding:12px;font-size:12px}\n.create-job-inline button{margin:0}\n.job-list{display:flex;flex-direction:column}\n.job-list-row{display:flex;align-items:center;justify-content:space-between;gap:12px;min-height:58px;padding:12px 14px;border-top:1px solid #ececec}\n.job-list-row.active{background:#f8f2f2;border-left:3px solid var(--red)}\n.job-list-row>span:first-child{display:flex;flex-direction:column;gap:4px}\n.job-list-row b{font-size:12px}\n.job-list-row small{font-size:9px;color:#7a848a}\n.job-list-actions{display:flex;gap:6px}\n.job-list-actions button{margin:0;min-height:32px;border-radius:8px}\n.danger-ghost{color:#b51218;border-color:#e2ccce;background:#fff}\n.danger{background:#b51218;border-color:#b51218;color:#fff}\n.wide-form{width:min(640px,100%)!important}\n/* Labor rates */\n.labor-settings{display:grid;grid-template-columns:1.5fr .7fr;gap:14px}\n.rate-settings-card{padding:24px!important}\n.settings-head{display:flex;align-items:flex-start;justify-content:space-between;border-bottom:1px solid #e4e7e8;padding-bottom:17px}\n.settings-head h3,.prevailing-card h3{font:700 21px \"Manrope\";margin:0}\n.save-status{font-size:9px;color:#d71920;background:#f8e8e8;padding:6px 9px;border-radius:14px}\n.settings-job{display:flex;flex-direction:column;gap:6px;margin:19px 0;font-size:8px;letter-spacing:1px;font-weight:bold;color:#777}\n.settings-job input{width:100%;border:1px solid #d8dfe2;border-radius:7px;padding:12px;background:#f5f5f5;font-size:11px;font-weight:bold}\n.rate-input-grid{display:grid;grid-template-columns:repeat(3,1fr);gap:12px}\n.rate-input-grid>label{border:1px solid #dedede;border-radius:8px;padding:15px}\n.rate-input-grid>label>span{display:flex;justify-content:space-between;font-size:11px;font-weight:bold}\n.rate-input-grid small{font-size:7px;color:#888}\n.rate-input-grid label>div{display:flex;align-items:center;margin-top:12px}\n.rate-input-grid i{font:700 20px Georgia;color:#d71920;font-style:normal}\n.rate-input-grid input{width:100%;border:0;border-bottom:2px solid #111;padding:5px;font:700 25px Georgia;outline:none}\n.rate-input-grid em{font-size:9px;color:#777;font-style:normal;white-space:nowrap}\n.rate-actions{display:flex;align-items:center;justify-content:flex-end;margin-top:20px;padding-top:16px;border-top:1px solid #e4e7e8}\n.rate-actions>span{margin-right:auto;max-width:45%;font-size:9px;line-height:1.5;color:#76848b}\n.prevailing-card{background:#111!important;color:#fff!important;display:flex;gap:16px;align-items:flex-start}\n.prevailing-card>i{width:42px;height:42px;border:1px solid #d71920;color:#fff;background:#d71920;display:grid;place-items:center;border-radius:7px;font-style:normal;font-weight:bold}\n.prevailing-card p{color:#e33b40}\n.prevailing-card span{font-size:10px;line-height:1.6;color:#bfc3c5;display:block;margin-top:12px}\n/* Daily */\n.daily-view{padding:22px!important}\n.daily-row{display:grid;grid-template-columns:2fr .8fr .7fr .9fr .9fr .9fr;align-items:center;min-height:58px;border-bottom:1px solid #eceff0;font-size:9px}\n.daily-head{min-height:34px;font-size:7px;font-weight:bold;letter-spacing:.7px;color:#7b868c}\n.form-grid{display:grid;grid-template-columns:1fr 1fr;gap:13px;margin:18px 0}\n.form-grid label{display:flex;flex-direction:column;gap:6px;font-size:7px;font-weight:bold;color:#7d8b93}\n.form-grid .wide{grid-column:1/-1}\n.form-grid input,.form-grid select{border:1px solid #d8e0e3;border-radius:6px;padding:10px}\n.equipment-calc{border:1px solid #dedede;border-radius:7px;padding:11px 13px;margin-bottom:10px;display:flex;align-items:center;justify-content:space-between;background:#fafafa}\n.equipment-calc span{display:flex;flex-direction:column}\n.equipment-calc small{font-size:7px;letter-spacing:1px;color:#777}\n.equipment-calc b{font:700 19px Georgia;margin-top:3px}\n.equipment-calc em{font-style:normal;font-size:9px;color:#777}\n.calculated{background:#f8eeee;border-left:4px solid var(--red);padding:12px;display:flex;justify-content:space-between;border-radius:11px}\n.calculated span{font-size:7px}\n.calculated b{font:700 16px Georgia;color:#b51218}\n/* Operations usage */\n.operations-grid{display:grid;grid-template-columns:1.15fr .85fr;gap:15px;margin-bottom:15px}\n.operations-grid>.panel{margin:0}\n.usage-list{margin-top:14px}\n.usage-row{display:grid;grid-template-columns:28px 1fr auto;gap:11px;align-items:center;padding:11px 0;border-top:1px solid #ececec}\n.usage-row>i{width:26px;height:26px;display:grid;place-items:center;border-radius:8px;background:#111;color:#fff;font:600 9px \"DM Mono\";font-style:normal}\n.usage-row>span{min-width:0;display:flex;flex-direction:column;gap:4px}\n.usage-row b{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:10px}\n.usage-row small{color:#7a7a7a;font-size:8px}\n.usage-row em{display:block;width:100%;height:4px;border-radius:4px;background:#ececec}\n.usage-row em u{display:block;height:100%;border-radius:4px;background:#c41230;text-decoration:none}\n.usage-row>strong{min-width:62px;text-align:right;font:600 16px \"DM Mono\"}\n.usage-row>strong small{font-size:8px}\n.crew-summary{display:grid;grid-template-columns:repeat(3,1fr);gap:8px;margin:15px 0}\n.crew-summary>span{display:flex;flex-direction:column;gap:5px;padding:12px;border-radius:11px;background:#111;color:#fff}\n.crew-summary small{font:500 7px \"DM Mono\";color:#aaa;letter-spacing:.08em}\n.crew-summary b{font:600 23px \"DM Mono\"}\n.crew-days>div{display:flex;align-items:center;justify-content:space-between;padding:10px 2px;border-top:1px solid #ececec}\n.crew-days span{display:flex;flex-direction:column;gap:3px}\n.crew-days b{font-size:10px}\n.crew-days small{font-size:8px;color:#7a7a7a}\n.crew-days strong{font:600 15px \"DM Mono\"}\n.crew-days strong small{font:500 8px \"Manrope\"}\n.empty-state.compact{min-height:150px}\n/* Phase controls + phase usage */\n.phase-controls{display:flex;align-items:center;justify-content:space-between;min-height:64px;margin:0 0 12px;padding:11px 14px;border:1px solid #dedede;border-radius:15px;background:#fff;box-shadow:0 8px 24px rgba(0,0,0,.05)}\n.phase-controls p{margin-bottom:4px}\n.phase-controls b{font-size:11px}\n.phase-controls button{min-height:38px;border-color:#111;background:#111;color:#fff}\n.phase-controls button:disabled{opacity:.35;cursor:not-allowed}\n.phase-usage{padding:0!important;margin-bottom:15px!important}\n.phase-usage>.view-head{padding:20px 20px 14px}\n.phase-table{overflow:auto}\n.phase-row{display:grid;grid-template-columns:minmax(180px,1.4fr) minmax(220px,1.5fr) 120px 90px 90px 85px;align-items:center;min-width:900px;min-height:62px;padding:0 20px;border-top:1px solid #ececec}\n.phase-row>span{display:flex;flex-direction:column;gap:4px;padding-right:12px;font-size:10px;text-align:left}\n.phase-row small{color:#7a7a7a;font-size:8px}\n.phase-row em{color:#888;font-size:9px;font-style:normal}\n.phase-row>span:nth-child(n+3) b{font:600 14px \"DM Mono\"}\n.phase-head{min-height:34px;background:#111;color:#fff;border:0}\n.phase-head>span{font:600 7px \"DM Mono\";letter-spacing:.08em}\n.phase-group:nth-child(odd)>.phase-click{background:#fafafa}\n.phase-click{width:100%;margin:0;border:0;border-top:1px solid #ececec;border-radius:0;background:#fff;color:#111}\n.phase-click:hover{background:#f5f5f5}\n.phase-group.open>.phase-click{background:#f8eaed;box-shadow:inset 4px 0 #c41230}\n.phase-name{flex-direction:row!important;align-items:center;gap:10px!important}\n.phase-name i{display:grid;place-items:center;flex:0 0 25px;width:25px;height:25px;border-radius:7px;background:#111;color:#fff;font:500 15px \"DM Mono\";font-style:normal}\n.phase-detail{display:grid;grid-template-columns:1.15fr .85fr;gap:22px;min-width:900px;padding:20px 28px 25px 54px;border-top:1px solid #e2c9ce;border-bottom:1px solid #dedede;background:linear-gradient(135deg,#fff 0%,#faf7f8 100%);box-shadow:inset 4px 0 #c41230}\n.detail-title{padding-bottom:10px;border-bottom:1px solid #e5e5e5}\n.detail-title p{margin-bottom:4px;color:#c41230}\n.detail-title>b{font-size:11px}\n.phase-detail .usage-list{margin-top:3px}\n.phase-detail .crew-summary{margin-top:12px}\n.detail-days{max-height:250px;overflow:auto;padding-right:6px}\n.detail-empty{padding:28px 0;color:#777;font-size:10px}\n/* Equipment moves */\n.equipment-moves{padding:0!important}\n.equipment-moves>.view-head{padding:20px 21px 14px}\n.move-summary{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:9px;padding:0 21px 18px}\n.move-summary>span{display:flex;flex-direction:column;gap:5px;padding:12px 14px;border-radius:11px;background:#111;color:#fff}\n.move-summary small{color:#aaa;font:500 7px \"DM Mono\";letter-spacing:.08em}\n.move-summary b{font:600 18px \"DM Mono\"}\n.move-summary .review{background:#fff0d3;color:#946000}\n.move-summary .review small{color:#946000}\n.move-table{overflow:auto}\n.move-row{display:grid;grid-template-columns:115px minmax(210px,1.2fr) minmax(230px,1.4fr) 85px minmax(180px,1fr);align-items:center;min-width:900px;min-height:67px;padding:0 21px;border-top:1px solid #ececec}\n.move-row>span{display:flex;flex-direction:column;gap:4px;padding-right:12px;font-size:10px}\n.move-row b{font-size:10px}\n.move-row small{color:#777;font-size:8px}\n.move-row>span:nth-child(4)>b,.move-row>span:nth-child(5)>b{font:600 14px \"DM Mono\"}\n.move-row em{align-self:flex-start;margin-top:2px;padding:3px 6px;border-radius:10px;background:#fff0d3;color:#946000;font:600 7px \"DM Mono\";font-style:normal}\n.move-head{min-height:34px;background:#111;color:#fff}\n.move-head>span{font:600 7px \"DM Mono\";letter-spacing:.08em}\n.move-row:nth-child(odd):not(.move-head){background:#fafafa}\n/* Rate book */\n.rate-book{padding:0!important;overflow:hidden}\n.rate-tools{display:flex;align-items:center;justify-content:space-between;padding:19px}\n.rate-tools h3{font:700 20px \"Manrope\";margin:0}\n.rate-tools input{width:min(320px,45%);border:1px solid #d8dfe2;border-radius:7px;padding:11px 13px;font-size:11px}\n.rate-header,.rate-row{display:grid;grid-template-columns:1fr 150px;align-items:center}\n.rate-header{padding:10px 19px;background:#111;color:#fff;font-size:7px;letter-spacing:1.2px;font-weight:bold}\n.rate-list{max-height:640px;overflow:auto}\n.rate-row{min-height:48px;padding:0 19px;border-bottom:1px solid #eceff0}\n.rate-row>span{display:flex;align-items:center;gap:10px;font-size:10px}\n.rate-row>span i{width:25px;height:25px;border-radius:5px;background:#f8e7e7;color:#d71920;display:grid;place-items:center;font-style:normal}\n.rate-row strong{font:700 14px Georgia;color:#111}\n.rate-row strong small{font:normal 8px Arial;color:#7b858b;margin-left:3px}\n/* Cost code table */\n.cost-code-panel{padding:0!important;overflow:hidden}\n.cost-code-title{display:flex;justify-content:space-between;align-items:center;padding:18px}\n.cost-code-title h3{font:700 18px \"Manrope\";margin:0}\n.cost-code-title>div:last-child{display:flex;gap:20px}\n.cost-code-title>div:last-child span{display:flex;flex-direction:column}\n.cost-code-title small{font-size:7px;color:#838d92;letter-spacing:.7px}\n.cost-code-title b{font:700 15px Georgia;margin-top:3px}\n.cost-code-title .total{border-left:2px solid #d71920;padding-left:18px}\n.cost-code-scroll{max-height:630px;overflow:auto}\n.cost-code-row{display:grid;grid-template-columns:2.2fr .8fr .9fr .9fr 1.25fr 1fr;align-items:center;gap:10px;min-height:60px;padding:8px 18px;border-top:1px solid #eceff0;font-size:9px}\n.cost-code-head{min-height:32px;background:#111;color:#fff;font-size:7px;letter-spacing:.8px;font-weight:bold}\n.cost-code-row>span:first-child{display:flex;flex-direction:column;gap:4px}\n.cost-code-row>span:first-child small{color:#7e8a91}\n.production-input{display:flex!important;flex-direction:row!important;gap:5px;flex-wrap:wrap}\n.production-input input{width:75px;border:1px solid #d7dfe2;border-radius:5px;padding:7px;font-size:9px}\n.production-input select{border:1px solid #d7dfe2;border-radius:5px;background:#fff;padding:7px;font-size:9px}\n.production-input .scope-note{width:100%;font-size:7px;color:#8b969c;margin-top:1px}\n.unit-cost{display:flex;flex-direction:column;color:#b51218}\n.unit-cost b{font:700 14px Georgia}\n.pending-unit em{font-style:normal;color:#929ca1}\n.cost-code-row:nth-child(even):not(.cost-code-head){background:#fafafa}\n.consolidate-button{min-height:34px;margin:12px 0 0;padding:0 12px;border-color:#111;border-radius:9px;background:#fff;color:#111}\n.consolidate-button.active{border-color:#c41230;background:#c41230;color:#fff}\n/* Unit cost summary */\n.unit-summary{display:grid;grid-template-columns:repeat(3,1fr);gap:13px;margin-bottom:13px}\n.unit-summary article{background:#111;color:#fff;border-top:3px solid #d71920;border-radius:8px;padding:18px}\n.unit-summary h2{font:700 28px Georgia;margin:0 0 5px}\n.unit-summary span{font-size:9px;color:#aaa}\n/* Split + chart + forecast */\n.split{display:grid;grid-template-columns:1.2fr 1fr;gap:13px;margin-bottom:13px}\n.title{display:flex;justify-content:space-between}\n.title h3{font:700 17px \"Manrope\";margin:0}\n.title button{border:0;padding:0;color:#d71920;background:transparent}\n.chart{height:190px;border-bottom:1px solid #dfe5e7;margin-top:14px;display:flex;justify-content:space-around;align-items:flex-end;background:repeating-linear-gradient(to bottom,#fff 0,#fff 45px,#edf1f2 46px)}\n.bar{width:16%;height:100%;display:flex;flex-direction:column;justify-content:flex-end;align-items:center}\n.bar>b{font-size:7px}\n.bar>span{height:135px;display:flex;align-items:flex-end;gap:3px}\n.bar>span i,.bar>span em{display:block;width:12px;border-radius:2px 2px 0 0}\n.bar>span i{background:#d71920}\n.bar>span em{background:#78a0ad}\n.bar>small{font-size:7px;color:#8d999f;margin:7px 0 -20px}\n.forecast-card{padding:21px 22px!important}\n.forecast-card.on-track{border-top:4px solid #18824b}\n.forecast-card.watch{border-top:4px solid #d68a00}\n.forecast-card.over{border-top:4px solid #c41230}\n.forecast-head{display:flex;align-items:flex-start;justify-content:space-between;gap:12px}\n.forecast-head h3{margin:0;font-size:17px}\n.forecast-head>span{padding:6px 9px;border-radius:20px;background:#ededed;color:#555;font:600 7px \"DM Mono\";letter-spacing:.06em;white-space:nowrap}\n.forecast-card.on-track .forecast-head>span{background:#e4f3eb;color:#126c3e}\n.forecast-card.watch .forecast-head>span{background:#fff0d3;color:#946000}\n.forecast-card.over .forecast-head>span{background:#f8e2e6;color:#a40f29}\n.forecast-inputs{display:grid;grid-template-columns:1fr 1fr;gap:9px;margin-top:14px}\n.forecast-inputs label{padding:10px 11px;border:1px solid #dedede;border-radius:11px;background:#fafafa}\n.forecast-inputs small,.forecast-result small,.forecast-bars small{display:block;color:#777;font:500 7px \"DM Mono\";letter-spacing:.06em}\n.forecast-inputs label>div{display:flex;align-items:center;margin-top:5px}\n.forecast-inputs i{color:#777;font:500 12px \"DM Mono\";font-style:normal}\n.forecast-inputs input{width:100%;border:0;outline:0;background:transparent;font:600 15px \"DM Mono\"}\n.forecast-bars{display:grid;grid-template-columns:1fr 1fr;gap:10px;margin-top:13px}\n.forecast-bars>div>span{display:flex;align-items:center;justify-content:space-between}\n.forecast-bars b{font:600 11px \"DM Mono\"}\n.forecast-bars>div>i{display:block;height:6px;margin-top:6px;border-radius:8px;background:#e8e8e8}\n.forecast-bars em{display:block;height:100%;border-radius:8px;background:#111}\n.forecast-bars em.over{background:#c41230}\n.forecast-result{display:grid;grid-template-columns:1fr 1fr 1.2fr;gap:8px;margin-top:14px;padding-top:12px;border-top:1px solid #e5e5e5}\n.forecast-result>span{display:flex;flex-direction:column;gap:4px}\n.forecast-result b{font:600 12px \"DM Mono\"}\n.forecast-result em{font-size:7px;color:#777;font-style:normal}\n.forecast-result .positive b{color:#126c3e}\n.forecast-result .negative b{color:#b10f2a}\n.forecast-empty{display:flex;flex-direction:column;gap:4px;margin-top:14px;padding:12px;border-radius:11px;background:#f3f3f3}\n.forecast-empty b{font-size:9px}\n.forecast-empty span{font-size:8px;line-height:1.45;color:#777}\n/* Reports */\n.report-view{display:grid;grid-template-columns:1.15fr .85fr;gap:14px}\n.report-cover{background:#111!important;color:#fff!important;border-left:5px solid #d71920!important;padding:28px!important}\n.report-cover h2{font:700 31px Georgia;margin:0 0 8px}\n.report-cover>span{font-size:10px;color:#aaa}\n.report-kpis{display:grid;grid-template-columns:1fr 1fr;gap:10px;margin-top:32px}\n.report-kpis>div{border:1px solid #373737;border-radius:7px;padding:16px;display:flex;flex-direction:column;gap:6px}\n.report-kpis small{font-size:7px;color:#aaa;letter-spacing:1px}\n.report-kpis b{font:700 20px Georgia}\n.report-rank{padding:22px!important}\n.rank-row{display:grid;grid-template-columns:30px 1fr auto;align-items:center;gap:10px;padding:13px 0;border-bottom:1px solid #eceff0}\n.rank-row i{width:24px;height:24px;background:#d71920;color:#fff;border-radius:50%;display:grid;place-items:center;font-style:normal;font-size:8px;font-weight:bold}\n.rank-row span{display:flex;flex-direction:column;gap:4px}\n.rank-row b{font-size:9px}\n.rank-row small{font-size:8px;color:#88949a}\n.rank-row strong{font:700 13px Georgia}\n.report-print{margin-top:18px;display:flex;justify-content:flex-end}\n.report-print button{margin:0}\n@media(max-width:900px){.report-view{grid-template-columns:1fr}.unit-summary{grid-template-columns:1fr}.labor-settings{grid-template-columns:1fr}.rate-input-grid{grid-template-columns:1fr}.operations-grid{grid-template-columns:1fr}.split{grid-template-columns:1fr}.cost-code-panel{overflow:auto}.cost-code-scroll{min-width:900px}.cost-code-title{min-width:900px}}\n@media(max-width:700px){.phase-detail{grid-template-columns:1fr}.rate-tools input{width:60%}.rate-header,.rate-row{grid-template-columns:1fr 95px}}\n@media print{aside,.header-actions,.import-strip,.logout,.monday-strip,.phase-controls,.report-print{display:none!important}.shell main{margin:0;width:100%;padding:0}.report-view{grid-template-columns:1fr 1fr}.panel{box-shadow:none;border:1px solid #ddd}}\n/* Forgot password link on the login / recovery cards */\n.auth-forgot{margin:14px 0 0;text-align:center}\n.auth-forgot .linklike{background:none;border:0;margin:0;padding:0;color:#b51218;font-size:11px;font-weight:700;cursor:pointer;text-decoration:underline}\n.auth-forgot .linklike:hover{color:#8f0e15}\n.auth-forgot .linklike:disabled{color:#aaa;cursor:not-allowed;text-decoration:none}\n",[],[198,253],"de051783-ca3e-431f-9e6c-dbdc3e98605a","root.tsx","bcd5b7d8-a7d3-11f1-893b-1607ee4eb77e",6,["D",1788466327307],"/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\nexport function Root() {\n return (\n <>\n {raw(\"\")}\n \n \n \n \n NDX Command Center — Production Control\n \n \n \n \n \n \n \n

Diff · v30