${message}

\n \n `,\n 403,\n );\n }\n\n c.set(\"viewer\", { username: viewer.username });\n return next();\n});\n\napp.get(\"/\", (c) => c.html(Root()));\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n/** Everything the dashboard needs, in one round trip. */\napp.get(\"/api/state\", async (c) => {\n await ensureSchema();\n const views = await listViews(true);\n const live = views.filter((s) => isLive(s.status));\n const [sum, fc, hist, sav, review, cats, base] = await Promise.all([\n summary(views),\n forecast(12, live),\n history(12),\n savings(),\n listReviewItems(\"open\"),\n byCategory(live),\n baseCurrency(),\n ]);\n const viewer = c.get(\"viewer\");\n return c.json({\n baseCurrency: base,\n period: currentPeriod(),\n llmConfigured: isConfigured(),\n viewer: viewer ? { username: viewer.username } : null,\n summary: sum,\n subscriptions: views,\n forecast: fc,\n history: hist,\n savings: sav,\n review,\n categories: cats,\n });\n});\n\napp.get(\"/api/subscriptions/:id\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const sub = await getSubscription(id);\n if (!sub) return c.json({ error: \"not found\" }, 404);\n const [charges, ratings] = await Promise.all([chargesFor(id), ratingsFor(id)]);\n return c.json({ subscription: sub, charges, ratings });\n});\n\napp.post(\"/api/subscriptions\", async (c) => {\n const body = await c.req.json();\n const parsed = parseSubscriptionBody(body);\n if (\"error\" in parsed) return c.json(parsed, 400);\n const id = await createSubscription(parsed.value);\n return c.json({ id }, 201);\n});\n\napp.patch(\"/api/subscriptions/:id\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json() as Record;\n const patch: Record = {};\n\n if (body.amount != null) patch.amountMinor = toMinor(Number(body.amount));\n if (body.amountMinor != null) patch.amountMinor = Math.round(Number(body.amountMinor));\n for (const key of [\"planName\", \"startedOn\", \"nextChargeOn\", \"paymentMethod\", \"notes\", \"status\"]) {\n if (key in body) patch[key] = body[key];\n }\n if (body.currency && CURRENCIES.includes(String(body.currency) as Currency)) patch.currency = body.currency;\n if (body.billingCycle === \"monthly\" || body.billingCycle === \"yearly\") patch.billingCycle = body.billingCycle;\n if (\"autoRenew\" in body) patch.autoRenew = Boolean(body.autoRenew);\n\n await updateSubscription(id, patch);\n\n // Category is a property of the service behind this subscription, so it is set\n // separately rather than through the subscription patch.\n if (\"category\" in body) {\n const category = String(body.category ?? \"\").trim();\n await setCategory(id, category === \"\" ? null : category);\n }\n return c.json({ ok: true });\n});\n\napp.post(\"/api/subscriptions/:id/cancel\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({})) as { reason?: string; on?: string };\n await cancelSubscription(id, { reason: body.reason, on: body.on });\n await closeItemsFor(id);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/subscriptions/:id/reactivate\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({})) as { nextChargeOn?: string };\n await reactivateSubscription(id, body.nextChargeOn);\n return c.json({ ok: true });\n});\n\napp.delete(\"/api/subscriptions/:id\", async (c) => {\n await deleteSubscription(Number(c.req.param(\"id\")));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/subscriptions/:id/ratings\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json() as { quality?: number; usage?: number; period?: string; note?: string };\n const quality = Number(body.quality);\n const usage = Number(body.usage);\n if (!Number.isFinite(quality) || !Number.isFinite(usage)) {\n return c.json({ error: \"quality and usage are required, 1 to 5\" }, 400);\n }\n await saveRating(id, body.period ?? currentPeriod(), quality, usage, body.note ?? null);\n await closeItemsFor(id, [\"rating_due\"]);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/review/:id/:action\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const action = c.req.param(\"action\");\n if (action !== \"done\" && action !== \"dismissed\") return c.json({ error: \"unknown action\" }, 400);\n await resolveReviewItem(id, action);\n return c.json({ ok: true });\n});\n\n/** Rebuild the decision inbox on demand — the same routine the daily cron runs. */\napp.post(\"/api/review/refresh\", async (c) => {\n const created = await generateReviewItems();\n return c.json({ created: created.length, items: created });\n});\n\n/**\n * Paste an email here to see exactly what the inbound handler would do with it,\n * without having to send real mail. Writes for real, so it is the fastest way to\n * check extraction against a receipt you actually received.\n */\napp.post(\"/api/email/simulate\", async (c) => {\n const body = await c.req.json() as {\n from?: string;\n subject?: string;\n text?: string;\n html?: string;\n messageId?: string;\n };\n if (!body.text && !body.html) return c.json({ error: \"text or html is required\" }, 400);\n const result = await handleInbound({\n from: body.from ?? \"test@example.com\",\n subject: body.subject ?? null,\n text: body.text ?? null,\n html: body.html ?? null,\n messageId: body.messageId ?? null,\n });\n return c.json(result);\n});\n\n// Full stack traces in the val logs rather than a swallowed 500.\napp.onError((err) => Promise.reject(err));\n\nfunction parseSubscriptionBody(body: Record):\n | { value: Parameters[0] }\n | { error: string }\n{\n const serviceName = String(body.serviceName ?? \"\").trim();\n if (!serviceName) return { error: \"serviceName is required\" };\n\n const amountMinor = body.amountMinor != null\n ? Math.round(Number(body.amountMinor))\n : toMinor(Number(body.amount));\n if (!Number.isFinite(amountMinor) || amountMinor <= 0) return { error: \"amount must be a positive number\" };\n\n const currency = String(body.currency ?? \"PLN\").toUpperCase() as Currency;\n if (!CURRENCIES.includes(currency)) return { error: `currency must be one of ${CURRENCIES.join(\", \")}` };\n\n const billingCycle = body.billingCycle === \"yearly\" ? \"yearly\" : \"monthly\" as BillingCycle;\n\n return {\n value: {\n serviceName,\n planName: body.planName ? String(body.planName) : null,\n amountMinor,\n currency,\n billingCycle,\n startedOn: body.startedOn ? String(body.startedOn) : null,\n nextChargeOn: body.nextChargeOn ? String(body.nextChargeOn) : null,\n category: body.category ? String(body.category) : null,\n paymentMethod: body.paymentMethod ? String(body.paymentMethod) : null,\n notes: body.notes ? String(body.notes) : null,\n source: \"manual\",\n },\n };\n}\n\nexport default oauthMiddleware(app.fetch);\n","xdv-subscriptions","children",[],[221],"1332d763-1c21-43e3-a76c-3fb9ab76c29b","email.ts","c42f2144-a63a-11f1-bee9-1607ee4eb77e",90,["D",1788303271098],2,"email","/**\n * Email entry point — forward receipts here, or ask questions.\n *\n * Val Town assigns this file its own address; read it from `links.email` on the\n * file listing rather than guessing the format. Forwarding a confirmation with no\n * comment of your own tracks it; adding a line asks a question or runs a command.\n */\nimport { email } from \"https://esm.town/v/std/email\";\nimport { handleInbound } from \"./backend/email/handle.ts\";\nimport { isAllowedSender } from \"./backend/email/senders.ts\";\nimport { replyToFor } from \"./backend/links.ts\";\n\n/** Shape Val Town delivers. Declared locally so the file type-checks anywhere. */\ninterface InboundEmail {\n from: string;\n to: string[];\n subject?: string;\n text?: string;\n html?: string;\n attachments: File[];\n headers: Record;\n}\n\nexport default async function (e: InboundEmail) {\n // The address is public and guessable, and this assistant will answer questions\n // about the owner's spending — so check the sender before doing anything at all.\n // Rejected mail is dropped silently: replying would confirm the address is live\n // and let anyone use the val to bounce mail at a forged sender.\n const sender = isAllowedSender(e.from);\n if (!sender.allowed) {\n console.warn(`Ignored inbound email from ${e.from}: ${sender.reason}`, {\n subject: e.subject ?? null,\n });\n return;\n }\n\n const messageId = headerOf(e.headers, \"message-id\");\n\n let result;\n try {\n result = await handleInbound({\n from: e.from,\n subject: e.subject ?? null,\n text: e.text ?? null,\n html: e.html ?? null,\n messageId,\n });\n } catch (err) {\n // A failure still gets a reply — silence would look like the address is dead.\n console.error(\"inbound email failed:\", err);\n await email({\n to: e.from,\n replyTo: replyToFor(e.to),\n subject: `Re: ${e.subject ?? \"your subscriptions\"}`,\n text: `Something went wrong handling that email:\\n\\n${err instanceof Error ? err.message : String(err)}`,\n });\n throw err;\n }\n\n if (!result.replied || !result.body) {\n console.log(\"no reply sent (duplicate or empty)\", { from: e.from, subject: e.subject });\n return;\n }\n\n // Reply-To points back at this val, so replying to the answer is itself a command.\n await email({ to: e.from, replyTo: replyToFor(e.to), subject: result.subject, text: result.body });\n}\n\nfunction headerOf(headers: Record, name: string): string | null {\n const wanted = name.toLowerCase();\n for (const [key, value] of Object.entries(headers ?? {})) {\n if (key.toLowerCase() === wanted) return value;\n }\n return null;\n}\n","xd-subscriptions",[],[232],"5af71b4b-24cf-4f73-bbbc-975676e31156","cron.ts","c6d3ea2e-a63a-11f1-94c2-1607ee4eb77e",91,["D",1788303278151],3,"interval","/**\n * Daily maintenance and the digest email.\n *\n * Runs at 06:00 UTC — 07:00 or 08:00 in Warsaw depending on the season. Cron on\n * Val Town is UTC only and does not follow daylight saving, so a fixed early-morning\n * UTC time is the right compromise for a once-a-day digest.\n *\n * The digest stays quiet on purpose. A mail every morning saying \"nothing changed\"\n * gets filtered within a week, and then the one that matters gets filtered with it.\n */\nimport { email } from \"https://esm.town/v/std/email\";\nimport { refreshRates } from \"./backend/fx.ts\";\nimport { baseCurrency } from \"./backend/fx.ts\";\nimport { listViews } from \"./backend/subscriptions.ts\";\nimport { summary, upcoming } from \"./backend/analytics.ts\";\nimport { generateReviewItems, listReviewItems } from \"./backend/review.ts\";\nimport { formatReview, formatSummary, formatUpcoming } from \"./backend/email/reply.ts\";\nimport { today } from \"./shared/money.ts\";\nimport { primeLinks, replyToFor } from \"./backend/links.ts\";\nimport { isLive } from \"./shared/types.ts\";\n\ninterface Interval {\n lastRunAt?: Date;\n}\n\n/** Charges inside this window go in the digest. */\nconst LOOKAHEAD_DAYS = 7;\n\n/**\n * Where the digest goes.\n *\n * A val owned by an organisation has no single \"owner\" for std/email to fall back\n * to, so the recipient has to be named explicitly — an org-owned val that omits\n * `to` fails at send time rather than at deploy time.\n */\nfunction digestRecipient(): string | null {\n return Deno.env.get(\"DIGEST_EMAIL\")?.trim() || null;\n}\n\nexport default async function (_interval: Interval) {\n await primeLinks();\n\n try {\n await refreshRates();\n } catch (err) {\n console.error(\"fx refresh failed, continuing with cached rates:\", err);\n }\n\n const created = await generateReviewItems();\n const [views, base] = await Promise.all([listViews(true), baseCurrency()]);\n const live = views.filter((s) => isLive(s.status));\n const soon = await upcoming(LOOKAHEAD_DAYS, live);\n const open = await listReviewItems(\"open\");\n\n const isFirstOfMonth = today().endsWith(\"-01\");\n const worthSending = created.length > 0 || soon.length > 0 || isFirstOfMonth;\n\n console.log(\"daily run\", {\n newItems: created.length,\n dueSoon: soon.length,\n openItems: open.length,\n sending: worthSending,\n });\n\n if (!worthSending) return;\n\n const to = digestRecipient();\n if (!to) {\n console.error(\"DIGEST_EMAIL is not set — nothing to send the digest to. Skipping.\");\n return;\n }\n\n const sections: string[] = [];\n\n if (created.length > 0) {\n sections.push(`New since yesterday\\n${\"-\".repeat(52)}\\n${created.map((i) => `• ${i.title}`).join(\"\\n\")}`);\n }\n if (soon.length > 0) {\n sections.push(formatUpcoming(soon, base, LOOKAHEAD_DAYS));\n }\n if (open.length > 0) {\n sections.push(formatReview(open));\n }\n if (isFirstOfMonth) {\n sections.push(formatSummary(await summary(views)));\n }\n\n await email({\n to,\n // So a reply to the digest — \"cancel Netflix\" — reaches the inbound handler.\n replyTo: replyToFor(),\n subject: subjectFor(created.length, soon.length, isFirstOfMonth),\n text: sections.join(`\\n\\n${\"=\".repeat(52)}\\n\\n`),\n });\n}\n\nfunction subjectFor(newItems: number, dueSoon: number, monthStart: boolean): string {\n if (monthStart) return \"Subscriptions — new month, time to rate\";\n if (dueSoon > 0) return `Subscriptions — ${dueSoon} charge${dueSoon === 1 ? \"\" : \"s\"} coming up`;\n return `Subscriptions — ${newItems} thing${newItems === 1 ? \"\" : \"s\"} to decide`;\n}\n",[],[243],"9f1de654-f342-40bd-83b3-3a6d11538077","README.md","c9b25cbc-a63a-11f1-9a33-1607ee4eb77e",["D",1788303327624],5,"# Subscription tracker\n\nA Val Town app for deciding, month by month, whether each subscription is still\nworth paying for. Three parts: a schema that keeps enough history to answer\n\"what did cancelling save me\", an email assistant you forward receipts to, and a\ndashboard.\n\n## What it answers\n\n| Question | Where |\n|---|---|\n| What do my subscriptions cost me a month? | Run rate — every yearly plan divided by twelve |\n| What leaves my account in March? | 12-month calendar forecast, yearly renewals marked separately |\n| Which ones should I drop? | Two grades a month (quality, usage) → a keep/watch/cancel verdict |\n| What has cancelling saved me? | Monthly equivalent of each cancelled plan, counted from the day it stopped |\n| What do I need to decide right now? | The decision inbox — renewals you can still stop, ratings due, cancel candidates |\n\nRun rate and the calendar forecast are deliberately separate numbers. Averaging a\nyearly plan into a monthly figure makes it comparable; it also hides the month the\nmoney actually leaves, which is the surprise worth avoiding.\n\n## Files\n\n```\nindex.ts HTTP: the dashboard and its JSON API (fileType: http)\nemail.ts inbound mail: forward receipts here (fileType: email)\ncron.ts daily: FX, decision inbox, digest (fileType: interval, 0 6 * * *)\n\nshared/ types, money and date maths, verdicts, forecasting — pure, runs on both sides\nbackend/ db schema, FX, queries, analytics, review inbox, LLM, email handling\nfrontend/ the React dashboard (no build step; Val Town transpiles per request)\ntests/ the pure logic, run with `deno test --allow-import tests/`\n```\n\n## The schema\n\n`services` — the vendor. `subscriptions` — one billing arrangement for a service;\na service can own several over time as plans and prices change, but only one is\nlive. `charges` — payments that really happened. Nothing in the future is stored:\nit is projected from `next_charge_on`, so a price change never leaves stale rows\nbehind.\n\n```\nservices id, name, name_key(unique), vendor_domain, category, notes\nsubscriptions id, service_id, plan_name, amount_minor, currency, billing_cycle,\n started_on, next_charge_on, status, cancelled_on, cancel_reason,\n payment_method, auto_renew, source, notes\ncharges id, subscription_id, charged_on, amount_minor, currency,\n base_minor, fx_rate, source, inbound_email_id\nratings id, subscription_id, period(YYYY-MM), quality 1-5, usage 1-5, note\n unique(subscription_id, period)\nreview_items id, subscription_id, kind, status, title, detail, due_on, dedupe_key\ninbound_emails id, message_id(unique), from_addr, subject, body, intent, handled, result\nfx_rates quote, base, rate, as_of\nsettings key, value\n```\n\nMoney is stored as **integer minor units** (grosze, cents) in the currency it is\nactually billed in — never a float, never pre-converted. Conversion to your base\ncurrency happens at read time, except on `charges`, which pin the rate that applied\non the day so history is not re-priced when the zloty moves.\n\n`status` is `active | trial | paused | cancelled`. Cancelling keeps the row: the\nprice and the stop date are exactly what the savings figure is computed from.\n\n## The verdict\n\nEach month, two grades out of five: **quality** (how good is it) and **usage** (how\noften do you reach for it). They are combined with a harmonic mean, which collapses\ntoward whichever is worse — 5 and 1 give 1.7, not 3. A brilliant tool you opened\ntwice is still money leaving.\n\nRatings are recency-weighted over six months (each month back counts 0.75 of the\none after it), so one quiet month nudges the score without flipping it. Bands:\n`>= 3.5` keep, `>= 2.5` watch, below that a cancel candidate. A *watch* that costs\nmore than your median subscription is promoted to a cancel candidate — an\nabove-median price only has to be middling to deserve a decision.\n\n## The email assistant\n\nForward mail to the address Val Town assigns `email.ts` (read it from `links.email`\non the file listing — never construct it).\n\n### Who may email it\n\n`ALLOWED_SENDERS` is checked before anything else happens: no database write, no\nmodel call, no reply. Mail from anyone else is logged and dropped.\n\nThis matters more than it does for a typical webhook. The assistant *answers\nquestions about your spending*, so a stranger emailing \"how much am I spending a\nmonth?\" would otherwise get an answer. Rejected mail is dropped rather than replied\nto, because a reply would confirm the address is live and let anyone bounce mail off\nthis val at a forged sender.\n\n**Unset means nobody is allowed.** A mail handler that can leak data should fail\nclosed; a misconfigured val quietly answering strangers is the worse failure. Both\nfull addresses and whole domains are accepted, and `me+tag@` matches `me@` since\nthey are the same mailbox.\n\nOne honest limitation: this reads the `From` header, which is not authenticated. It\nreliably stops accidental, curious and opportunistic senders. It is not proof against\nsomeone deliberately forging a sender address. The dashboard's own\n`/api/email/simulate` route bypasses it, but sits behind the dashboard login gate.\n\n- **Forward a receipt with nothing on top** → it is extracted and tracked, and a\n *confirm* item appears in the decision inbox. Nothing is ever written silently.\n- **Forward it with a question on top** → both: the charge is recorded *and* the\n question is answered from your data.\n- **Send a command** as the first line:\n\n```\nlist active subscriptions and run rate\nforecast [months] calendar forecast, yearly renewals marked\nupcoming [days] what is due soon\nsavings what cancelling has saved you\nreview the decisions waiting on you\nrate 4 2 quality 4, usage 2, for this month\ncancel [because …]\nkeep clear its open decisions\nadd 49.99 PLN monthly\nhelp\n```\n\nAnything else is treated as a question and answered by the model from your\nsubscription data.\n\nExtraction uses a strict tool rather than a forced one: a receipt the model cannot\nread comes back as \"no result\" instead of a confidently wrong row. Without an API\nkey the app still works — receipts fall back to a text scan that takes the largest\nmoney amount, and commands are unaffected.\n\n## Environment variables\n\n| Variable | Required | What it does |\n|---|---|---|\n| `ANTHROPIC_API_KEY` | for the assistant | Receipt extraction and email Q&A. Without it, commands and the heuristic scan still work. |\n| `APP_URL` | no | Overrides the dashboard link in emails. Leave unset — the val asks the platform for its own endpoint, so a remixed copy links to itself with no setup. Set it only for a custom domain or a proxy. |\n| `BASE_CURRENCY` | no | `PLN` (default), `USD` or `EUR`. Everything rolls up into this. |\n| `INBOUND_EMAIL` | recommended | This val's own inbound address, set as `Reply-To` on outgoing mail. Without it, replying to the app's emails goes to `notifications@val.town` and is lost. Read it from `links.email` on the file listing — never construct it. |\n| `ALLOWED_SENDERS` | **required** | Who may email this val: full addresses (`me@example.com`) or whole domains (`@example.com`), comma-separated. **Unset means nobody** — see below. |\n| `ALLOWED_USERS` | recommended | The complete guest list: Val Town handles or account emails, comma-separated. **While set, org membership admits nobody on its own.** Leave unset and members of the owning org get in. |\n\nFX rates come from Frankfurter (ECB reference rates, no key), cached daily, falling\nback to the last cached value.\n\n## Who can see it\n\nThe dashboard is spending data, so the endpoint is not open. Val Town's\nplatform-level restricted access needs a paid business org, so the gate lives in\nthe val instead: `std/oauth` wraps the whole app, and a visitor gets through only\nif they are signed in to Val Town **and** appear on this val's guest list. Anyone\nelse gets a 401 (API) or a 403 page (browser) — never the data.\n\n`ALLOWED_USERS` is that guest list — handles or account emails, comma-separated —\nand while it is set, **org membership grants nothing by itself**. That matters\nbecause this app has no multi-tenancy: each person runs their own copy, and adding\nsomeone to the org so they can reach theirs would otherwise hand them everyone\nelse's too. Naming the list explicitly keeps each instance to its own person.\nLeaving it unset falls back to org membership, so a fresh deploy can't lock its\nowner out of itself.\n\nNote what this gate does *not* cover: anyone with edit access to the val — which\norg membership does grant — can read its SQLite database directly through Val Town,\nregardless of this code. Keep the org membership list to people you would trust with\nthe data itself.\n\nIf this val ever moves to a business-tier org, `set_http_privacy: restricted` is\nthe better mechanism — it gates at the platform edge, before any code runs — and\nthe `oauthMiddleware` wrapper should come off at the same time so nobody has to\nauthenticate twice.\n\n## Deploying\n\nThe val needs three file types: `index.ts` as `http`, `email.ts` as `email`,\n`cron.ts` as `interval` with `0 6 * * *` (UTC — that is 07:00 or 08:00 Warsaw\ndepending on the season; cron does not follow daylight saving).\n\nNo post-deploy URL configuration is needed: `backend/links.ts` resolves this val's\nown endpoint at runtime via `httpEndpoint()` from `std/utils`, so a fresh remix\nlinks to itself. `APP_URL` remains available as an override.\n\n## Not built yet\n\nGoogle Calendar entries for upcoming renewals, and bank feeds via bkpr to\nreconcile charges against what actually left the account.\n",[],[253],"b8e1b64f-9fc1-475f-a44b-c4d506550580","senders_test.ts","cc46197e-a64d-11f1-bdec-1607ee4eb77e","daa22ada-a639-11f1-a090-1607ee4eb77e",75,["D",1788298849491],"import { assertEquals } from \"jsr:@std/assert@1\";\nimport { isAllowedSender, senderAddress } from \"../backend/email/senders.ts\";\n\nfunction withEnv(value: string | null, run: () => void) {\n const previous = Deno.env.get(\"ALLOWED_SENDERS\");\n if (value === null) Deno.env.delete(\"ALLOWED_SENDERS\");\n else Deno.env.set(\"ALLOWED_SENDERS\", value);\n try {\n run();\n } finally {\n if (previous === undefined) Deno.env.delete(\"ALLOWED_SENDERS\");\n else Deno.env.set(\"ALLOWED_SENDERS\", previous);\n }\n}\n\nDeno.test(\"the address is pulled out of any From format\", () => {\n assertEquals(senderAddress(\"Maciek \"), \"maciek@amplification.pl\");\n assertEquals(senderAddress(\"maciek@amplification.pl\"), \"maciek@amplification.pl\");\n assertEquals(senderAddress(\" MACIEK@Amplification.PL \"), \"maciek@amplification.pl\");\n assertEquals(senderAddress(\"not an address\"), null);\n assertEquals(senderAddress(\"\"), null);\n});\n\nDeno.test(\"an unset allowlist accepts nobody — it fails closed\", () => {\n withEnv(null, () => {\n const verdict = isAllowedSender(\"maciek@amplification.pl\");\n assertEquals(verdict.allowed, false);\n assertEquals(verdict.reason.includes(\"ALLOWED_SENDERS is not set\"), true);\n });\n withEnv(\"\", () => {\n assertEquals(isAllowedSender(\"maciek@amplification.pl\").allowed, false);\n });\n});\n\nDeno.test(\"a listed address is accepted and everything else is not\", () => {\n withEnv(\"maciek@amplification.pl\", () => {\n assertEquals(isAllowedSender(\"Maciek \").allowed, true);\n assertEquals(isAllowedSender(\"MACIEK@AMPLIFICATION.PL\").allowed, true);\n assertEquals(isAllowedSender(\"stranger@example.com\").allowed, false);\n // A lookalike domain must not pass.\n assertEquals(isAllowedSender(\"maciek@amplification.pl.evil.com\").allowed, false);\n });\n});\n\nDeno.test(\"plus-tags reach the same mailbox, so they are the same sender\", () => {\n withEnv(\"zocimek@gmail.com\", () => {\n assertEquals(isAllowedSender(\"zocimek+receipts@gmail.com\").allowed, true);\n assertEquals(isAllowedSender(\"zocimek@gmail.com\").allowed, true);\n assertEquals(isAllowedSender(\"zocimekk@gmail.com\").allowed, false);\n });\n});\n\nDeno.test(\"a whole domain can be allowed, written either way\", () => {\n withEnv(\"@amplification.pl\", () => {\n assertEquals(isAllowedSender(\"anyone@amplification.pl\").allowed, true);\n assertEquals(isAllowedSender(\"anyone@gmail.com\").allowed, false);\n });\n withEnv(\"amplification.pl\", () => {\n assertEquals(isAllowedSender(\"anyone@amplification.pl\").allowed, true);\n });\n});\n\nDeno.test(\"several entries can be listed together\", () => {\n withEnv(\"maciek@amplification.pl, zocimek@gmail.com , @xd.ventures\", () => {\n assertEquals(isAllowedSender(\"maciek@amplification.pl\").allowed, true);\n assertEquals(isAllowedSender(\"zocimek@gmail.com\").allowed, true);\n assertEquals(isAllowedSender(\"someone@xd.ventures\").allowed, true);\n assertEquals(isAllowedSender(\"nope@elsewhere.com\").allowed, false);\n });\n});\n\nDeno.test(\"a malformed From is rejected before anything else happens\", () => {\n withEnv(\"maciek@amplification.pl\", () => {\n const verdict = isAllowedSender(\"<>\");\n assertEquals(verdict.allowed, false);\n assertEquals(verdict.address, null);\n });\n});\n",[],[269,261],"tests","a1d52b29-ad39-4497-baf4-e3cf73edb906","money_test.ts","8834364c-a63b-11f1-9bae-1607ee4eb77e",47,["D",1788291004337],"import { assertEquals } from \"jsr:@std/assert@1\";\nimport {\n addMonths,\n advanceByCycle,\n daysBetween,\n formatMoney,\n monthlyEquivalentMinor,\n normaliseNextCharge,\n shiftPeriod,\n toMinor,\n yearlyEquivalentMinor,\n} from \"../shared/money.ts\";\n\nDeno.test(\"a yearly price becomes an average monthly cost\", () => {\n assertEquals(monthlyEquivalentMinor(60000, \"yearly\"), 5000);\n assertEquals(monthlyEquivalentMinor(5000, \"monthly\"), 5000);\n assertEquals(yearlyEquivalentMinor(5000, \"monthly\"), 60000);\n assertEquals(yearlyEquivalentMinor(60000, \"yearly\"), 60000);\n});\n\nDeno.test(\"amounts are integers, so no floating point cents\", () => {\n assertEquals(toMinor(49.99), 4999);\n assertEquals(toMinor(0.1 + 0.2), 30);\n});\n\nDeno.test(\"month arithmetic clamps to the end of a short month\", () => {\n // A card charged on the 31st is charged on the 28th in February, not the 3rd of March.\n assertEquals(addMonths(\"2026-01-31\", 1), \"2026-02-28\");\n assertEquals(addMonths(\"2028-01-31\", 1), \"2028-02-29\"); // leap year\n assertEquals(addMonths(\"2026-03-31\", 1), \"2026-04-30\");\n assertEquals(addMonths(\"2026-12-15\", 1), \"2027-01-15\");\n});\n\nDeno.test(\"advancing by cycle moves a month or a year\", () => {\n assertEquals(advanceByCycle(\"2026-09-15\", \"monthly\"), \"2026-10-15\");\n assertEquals(advanceByCycle(\"2026-09-15\", \"yearly\"), \"2027-09-15\");\n});\n\nDeno.test(\"a stale next-charge date rolls forward to the first future one\", () => {\n // Untouched since January, monthly: the next charge is in September, not January.\n assertEquals(normaliseNextCharge(\"2026-01-10\", \"monthly\", \"2026-09-01\"), \"2026-09-10\");\n // Already in the future: left alone.\n assertEquals(normaliseNextCharge(\"2026-12-10\", \"monthly\", \"2026-09-01\"), \"2026-12-10\");\n // Yearly rolls a whole year at a time.\n assertEquals(normaliseNextCharge(\"2024-03-05\", \"yearly\", \"2026-09-01\"), \"2027-03-05\");\n});\n\nDeno.test(\"periods shift across year boundaries\", () => {\n assertEquals(shiftPeriod(\"2026-01\", -1), \"2025-12\");\n assertEquals(shiftPeriod(\"2026-12\", 1), \"2027-01\");\n assertEquals(shiftPeriod(\"2026-09\", 0), \"2026-09\");\n});\n\nDeno.test(\"day counts span months and leap days\", () => {\n assertEquals(daysBetween(\"2026-09-01\", \"2026-09-30\"), 29);\n assertEquals(daysBetween(\"2028-02-28\", \"2028-03-01\"), 2);\n});\n\nDeno.test(\"each currency is formatted the way it is written\", () => {\n assertEquals(formatMoney(4999, \"USD\"), \"$49.99\");\n assertEquals(formatMoney(4999, \"EUR\"), \"€49.99\");\n assertEquals(formatMoney(4999, \"PLN\").endsWith(\"zł\"), true);\n});\n",[],[269,271],"ed4a5287-a979-47d6-b472-cc39f8404355","grade_test.ts","8c3c8276-a63b-11f1-a9b7-1607ee4eb77e",48,["D",1788291011048],"import { assertEquals, assertLess } from \"jsr:@std/assert@1\";\nimport { computeVerdict, harmonicMean, medianMinor } from \"../shared/grade.ts\";\nimport { rating } from \"./fixtures.ts\";\n\nDeno.test(\"an unrated subscription gets no verdict, not a default one\", () => {\n const v = computeVerdict({ ratings: [], currentPeriod: \"2026-09\" });\n assertEquals(v.band, \"unrated\");\n assertEquals(v.score, null);\n});\n\nDeno.test(\"a great service you never open scores badly\", () => {\n const v = computeVerdict({ ratings: [rating(\"2026-09\", 5, 1)], currentPeriod: \"2026-09\" });\n // The mean of 5 and 1 would be 3 — a passing grade for something you never use.\n assertLess(v.score!, 2);\n assertEquals(v.band, \"cancel_candidate\");\n});\n\nDeno.test(\"solid on both axes reads as keep\", () => {\n const v = computeVerdict({ ratings: [rating(\"2026-09\", 4, 4)], currentPeriod: \"2026-09\" });\n assertEquals(v.band, \"keep\");\n assertEquals(v.score, 4);\n});\n\nDeno.test(\"the newest month counts for more than any single older month\", () => {\n const improving = computeVerdict({\n ratings: [rating(\"2026-09\", 5, 5), rating(\"2026-08\", 1, 1)],\n currentPeriod: \"2026-09\",\n });\n const declining = computeVerdict({\n ratings: [rating(\"2026-09\", 1, 1), rating(\"2026-08\", 5, 5)],\n currentPeriod: \"2026-09\",\n });\n assertLess(declining.score!, improving.score!);\n});\n\nDeno.test(\"one good month lifts a long bad run, without erasing it\", () => {\n const flat = computeVerdict({\n ratings: [\"2026-09\", \"2026-08\", \"2026-07\", \"2026-06\"].map((p) => rating(p, 2, 2)),\n currentPeriod: \"2026-09\",\n });\n const recovering = computeVerdict({\n ratings: [rating(\"2026-09\", 5, 5), ...[\"2026-08\", \"2026-07\", \"2026-06\"].map((p) => rating(p, 2, 2))],\n currentPeriod: \"2026-09\",\n });\n // Moves up, but a single month does not outvote a season of history.\n assertLess(flat.score!, recovering.score!);\n assertLess(recovering.score!, 4);\n});\n\nDeno.test(\"ratings older than the window are ignored\", () => {\n const v = computeVerdict({ ratings: [rating(\"2025-01\", 5, 5)], currentPeriod: \"2026-09\" });\n assertEquals(v.band, \"unrated\");\n assertEquals(v.ratedMonths, 0);\n});\n\nDeno.test(\"a middling service above the median cost becomes a decision\", () => {\n const ratings = [rating(\"2026-09\", 3, 3)];\n const cheap = computeVerdict({\n ratings,\n currentPeriod: \"2026-09\",\n monthlyBaseMinor: 1000,\n expensiveThresholdMinor: 5000,\n });\n const pricey = computeVerdict({\n ratings,\n currentPeriod: \"2026-09\",\n monthlyBaseMinor: 9000,\n expensiveThresholdMinor: 5000,\n });\n assertEquals(cheap.band, \"watch\");\n assertEquals(pricey.band, \"cancel_candidate\");\n});\n\nDeno.test(\"harmonic mean collapses toward the worse score\", () => {\n assertEquals(harmonicMean(5, 5), 5);\n assertLess(harmonicMean(5, 2), 3.5);\n});\n\nDeno.test(\"median handles both even and odd counts\", () => {\n assertEquals(medianMinor([100, 300, 200]), 200);\n assertEquals(medianMinor([100, 200, 300, 400]), 250);\n assertEquals(medianMinor([]), undefined);\n});\n",[],[269,279],"ce679d08-734c-4a60-9b0a-ae8492976e7f","forecast_test.ts","8f0a8700-a63b-11f1-9edc-1607ee4eb77e",49,["D",1788291015821],"import { assertEquals } from \"jsr:@std/assert@1\";\nimport { bucketByMonth, projectCharges } from \"../shared/forecast.ts\";\nimport { sub } from \"./fixtures.ts\";\n\nconst FROM = \"2026-09-01\";\nconst UNTIL = \"2027-08-31\";\n\nDeno.test(\"a monthly plan projects one charge per month\", () => {\n const charges = projectCharges([sub({ nextChargeOn: \"2026-09-15\", billingCycle: \"monthly\" })], {\n from: FROM,\n until: UNTIL,\n });\n assertEquals(charges.length, 12);\n assertEquals(charges[0].date, \"2026-09-15\");\n assertEquals(charges[11].date, \"2027-08-15\");\n});\n\nDeno.test(\"a yearly plan projects one charge, in the month it actually falls\", () => {\n const charges = projectCharges(\n [sub({ nextChargeOn: \"2027-03-20\", billingCycle: \"yearly\", amountMinor: 120000 })],\n { from: FROM, until: UNTIL },\n );\n assertEquals(charges.length, 1);\n assertEquals(charges[0].date, \"2027-03-20\");\n assertEquals(charges[0].billingCycle, \"yearly\");\n});\n\nDeno.test(\"cancelled and paused subscriptions cost nothing going forward\", () => {\n const charges = projectCharges(\n [sub({ status: \"cancelled\" }), sub({ status: \"paused\" }), sub({ status: \"trial\" })],\n { from: FROM, until: UNTIL },\n );\n // Only the trial is still live.\n assertEquals(new Set(charges.map((c) => c.subscriptionId)).size, 1);\n});\n\nDeno.test(\"auto-renew off means the booked charge happens and nothing after it\", () => {\n const charges = projectCharges([sub({ autoRenew: false, nextChargeOn: \"2026-09-15\" })], {\n from: FROM,\n until: UNTIL,\n });\n assertEquals(charges.length, 1);\n});\n\nDeno.test(\"a next-charge date left behind still forecasts from today\", () => {\n const charges = projectCharges([sub({ nextChargeOn: \"2025-02-10\", billingCycle: \"monthly\" })], {\n from: FROM,\n until: \"2026-12-31\",\n });\n assertEquals(charges[0].date, \"2026-09-10\");\n assertEquals(charges.length, 4); // Sep, Oct, Nov, Dec\n});\n\nDeno.test(\"foreign currency is converted at the subscription's rate\", () => {\n const charges = projectCharges(\n [sub({ currency: \"USD\", amountMinor: 1000, fxRate: 4, nextChargeOn: \"2026-09-15\" })],\n { from: FROM, until: \"2026-09-30\" },\n );\n assertEquals(charges[0].amountMinor, 1000);\n assertEquals(charges[0].baseMinor, 4000);\n});\n\nDeno.test(\"months with nothing due still appear on the axis\", () => {\n const charges = projectCharges(\n [sub({ nextChargeOn: \"2026-11-05\", billingCycle: \"yearly\" })],\n { from: FROM, until: UNTIL },\n );\n const buckets = bucketByMonth(charges, \"2026-09\", 12);\n assertEquals(buckets.length, 12);\n assertEquals(buckets[0].period, \"2026-09\");\n assertEquals(buckets[0].baseMinor, 0);\n assertEquals(buckets[2].period, \"2026-11\");\n assertEquals(buckets[2].charges.length, 1);\n});\n\nDeno.test(\"a yearly renewal lands in one month rather than being smeared across twelve\", () => {\n const yearly = sub({ nextChargeOn: \"2027-01-10\", billingCycle: \"yearly\", amountMinor: 120000 });\n const buckets = bucketByMonth(projectCharges([yearly], { from: FROM, until: UNTIL }), \"2026-09\", 12);\n const withMoney = buckets.filter((b) => b.baseMinor > 0);\n assertEquals(withMoney.length, 1);\n assertEquals(withMoney[0].period, \"2027-01\");\n assertEquals(withMoney[0].baseMinor, 120000);\n});\n",[],[269,287],"404f14d0-7389-47c5-a42c-3dc942ba3c62","fixtures.ts","8556ccfa-a63b-11f1-9edc-1607ee4eb77e",46,["D",1788290999526],"/** Builders for test data — only the fields a given test cares about need naming. */\nimport type { Rating, SubscriptionView } from \"../shared/types.ts\";\n\nlet nextId = 1;\n\nexport function sub(overrides: Partial = {}): SubscriptionView {\n const id = overrides.id ?? nextId++;\n return {\n id,\n serviceId: id,\n serviceName: `Service ${id}`,\n category: null,\n planName: null,\n amountMinor: 5000,\n currency: \"PLN\",\n billingCycle: \"monthly\",\n startedOn: \"2026-01-01\",\n nextChargeOn: \"2026-09-15\",\n status: \"active\",\n cancelledOn: null,\n cancelReason: null,\n paymentMethod: null,\n autoRenew: true,\n source: \"manual\",\n notes: null,\n createdAt: \"2026-01-01\",\n updatedAt: \"2026-01-01\",\n monthlyMinor: 5000,\n yearlyMinor: 60000,\n monthlyBaseMinor: 5000,\n yearlyBaseMinor: 60000,\n fxRate: 1,\n verdict: { quality: null, usage: null, score: null, ratedMonths: 0, band: \"unrated\", reason: \"\" },\n latestRating: null,\n ratingDue: true,\n ...overrides,\n };\n}\n\nexport function rating(period: string, quality: number, usage: number): Rating {\n return { id: nextId++, subscriptionId: 1, period, quality, usage, note: null, createdAt: period };\n}\n",[],[269,295],"8694499f-04fd-485d-a6ff-9d685a1277c7","email_parse_test.ts","92fd0252-a63b-11f1-83e3-1607ee4eb77e",50,["D",1788291022418],"import { assertEquals } from \"jsr:@std/assert@1\";\nimport {\n cleanSubject,\n heuristicAmount,\n parseAmount,\n parseCommand,\n senderDomain,\n splitEmail,\n} from \"../backend/email/parse.ts\";\n\nconst GMAIL_FORWARD = `Please handle this one.\n\n---------- Forwarded message ---------\nFrom: Netflix \nDate: Mon, 1 Sep 2026 at 09:12\nSubject: Your Netflix bill\n\nYour payment of 56,00 zł was received.\n`;\n\nDeno.test(\"a note above a forward is separated from the receipt below it\", () => {\n const split = splitEmail(GMAIL_FORWARD);\n assertEquals(split.hasComment, true);\n assertEquals(split.comment, \"Please handle this one.\");\n assertEquals(split.quoted.includes(\"Your payment of 56,00 zł\"), true);\n});\n\nDeno.test(\"a bare forward has no comment, so it is an ingest\", () => {\n assertEquals(splitEmail(BARE_FORWARD).hasComment, false);\n});\n\nconst BARE_FORWARD = GMAIL_FORWARD.replace(\"Please handle this one.\\n\\n\", \"\");\n\nDeno.test(\"'fyi' on its own is not a comment\", () => {\n for (const noise of [\"fyi\", \"FYI\", \"fwd\", \"thanks\", \" ok \"]) {\n assertEquals(splitEmail(`${noise}\\n\\n${BARE_FORWARD}`).hasComment, false, noise);\n }\n});\n\nDeno.test(\"Apple and Outlook forward styles are recognised too\", () => {\n const apple = \"is this worth keeping?\\n\\nBegin forwarded message:\\n\\nFrom: iCloud\\nTotal: $2.99\";\n assertEquals(splitEmail(apple).comment, \"is this worth keeping?\");\n\n const outlook = \"check this\\n\\n-----Original Message-----\\nFrom: Spotify\\nAmount: 23,99 zł\";\n assertEquals(splitEmail(outlook).comment, \"check this\");\n});\n\nDeno.test(\"a phone signature is not mistaken for a comment\", () => {\n assertEquals(splitEmail(`Sent from my iPhone\\n\\n${BARE_FORWARD}`).hasComment, false);\n});\n\nDeno.test(\"quoted reply lines are not the sender's own words\", () => {\n const split = splitEmail(\"> Your payment of 56,00 zł was received.\\n> Thanks\");\n assertEquals(split.hasComment, false);\n});\n\nDeno.test(\"both decimal conventions parse to the same number\", () => {\n assertEquals(parseAmount(\"1 234,56\"), 1234.56);\n assertEquals(parseAmount(\"1,234.56\"), 1234.56);\n assertEquals(parseAmount(\"56,00\"), 56);\n assertEquals(parseAmount(\"2.99\"), 2.99);\n assertEquals(parseAmount(\"nope\"), null);\n});\n\nDeno.test(\"the largest amount in a receipt is taken as the total\", () => {\n const hit = heuristicAmount(\"Subtotal 45,53 zł\\nVAT 10,47 zł\\nTotal 56,00 zł\");\n assertEquals(hit?.amount, 56);\n assertEquals(hit?.currency, \"PLN\");\n\n // The same vendor writes \"zł\" in one template and ASCII \"zl\" in another.\n assertEquals(heuristicAmount(\"Your payment of 56,00 zl was received\")?.amount, 56);\n assertEquals(heuristicAmount(\"Your payment of 56,00 zl was received\")?.currency, \"PLN\");\n assertEquals(heuristicAmount(\"Total: PLN 129.00\")?.amount, 129);\n assertEquals(heuristicAmount(\"You paid $9.99 for your monthly plan\")?.currency, \"USD\");\n assertEquals(heuristicAmount(\"Charged €120.00 annually\")?.currency, \"EUR\");\n assertEquals(heuristicAmount(\"Charged €120.00 annually\")?.cycle, \"yearly\");\n});\n\nDeno.test(\"commands parse off the first line\", () => {\n assertEquals(parseCommand(\"list\"), { kind: \"list\" });\n assertEquals(parseCommand(\"forecast 6\"), { kind: \"forecast\", months: 6 });\n assertEquals(parseCommand(\"upcoming\"), { kind: \"upcoming\", days: 30 });\n assertEquals(parseCommand(\"cancel Netflix\"), { kind: \"cancel\", service: \"Netflix\", reason: null });\n assertEquals(parseCommand(\"cancel Netflix because I never watch it\"), {\n kind: \"cancel\",\n service: \"Netflix\",\n reason: \"I never watch it\",\n });\n assertEquals(parseCommand(\"rate Figma 4 2\"), {\n kind: \"rate\",\n service: \"Figma\",\n quality: 4,\n usage: 2,\n note: null,\n });\n assertEquals(parseCommand(\"add Spotify 23.99 PLN monthly\"), {\n kind: \"add\",\n service: \"Spotify\",\n amount: 23.99,\n currency: \"PLN\",\n cycle: \"monthly\",\n });\n});\n\nDeno.test(\"a question is not a command\", () => {\n assertEquals(parseCommand(\"how much am I spending on software?\"), null);\n assertEquals(parseCommand(\"is Netflix worth keeping\"), null);\n});\n\nDeno.test(\"sender domains are normalised, and forward prefixes stripped\", () => {\n assertEquals(senderDomain(\"Netflix \"), \"netflix.com\");\n assertEquals(senderDomain(\"billing@figma.com\"), \"figma.com\");\n assertEquals(senderDomain(\"no-reply@email.apple.com\"), \"apple.com\");\n assertEquals(senderDomain(\"receipts@billing.example.co.uk\"), \"example.co.uk\");\n assertEquals(cleanSubject(\"Fwd: Re: Your receipt\"), \"Your receipt\");\n assertEquals(cleanSubject(null), \"\");\n});\n",[],[269,303],"44ac6418-79af-44cf-ad45-03919cf85518",7,["D",1788290283645],"directory",[210,211,212,213,214,215],[269],"dea5d51b-5f6d-49d2-b649-2156764aaa87","types.ts","fad95512-a639-11f1-8af0-1607ee4eb77e",76,["D",1788301936921],"/** Shared types used by both the backend and the browser bundle. */\n\nexport type Currency = \"PLN\" | \"USD\" | \"EUR\";\nexport const CURRENCIES: Currency[] = [\"PLN\", \"USD\", \"EUR\"];\n\nexport type BillingCycle = \"monthly\" | \"yearly\";\nexport const BILLING_CYCLES: BillingCycle[] = [\"monthly\", \"yearly\"];\n\nexport type SubscriptionStatus = \"active\" | \"trial\" | \"paused\" | \"cancelled\";\n\n/** Statuses that still cost money and still get forecast, rated and reminded about. */\nexport const LIVE_STATUSES: SubscriptionStatus[] = [\"active\", \"trial\"];\n\nexport function isLive(status: SubscriptionStatus): boolean {\n return status === \"active\" || status === \"trial\";\n}\n\nexport interface Service {\n id: number;\n name: string;\n /** Sender domain of confirmation mail, used to match forwarded email to a service. */\n vendorDomain: string | null;\n category: string | null;\n notes: string | null;\n createdAt: string;\n}\n\nexport interface Subscription {\n id: number;\n serviceId: number;\n serviceName: string;\n category: string | null;\n planName: string | null;\n /** Native amount in minor units (grosze / cents). Never a float. */\n amountMinor: number;\n currency: Currency;\n billingCycle: BillingCycle;\n startedOn: string | null;\n /** ISO date of the next expected charge. Drives forecasts and reminders. */\n nextChargeOn: string | null;\n status: SubscriptionStatus;\n cancelledOn: string | null;\n cancelReason: string | null;\n paymentMethod: string | null;\n autoRenew: boolean;\n /** Where the row came from: typed in by hand, or extracted from a forwarded email. */\n source: \"manual\" | \"email\";\n notes: string | null;\n createdAt: string;\n updatedAt: string;\n}\n\n/** A real payment that happened, as opposed to a projected one. */\nexport interface Charge {\n id: number;\n subscriptionId: number;\n chargedOn: string;\n amountMinor: number;\n currency: Currency;\n /** Value in base currency at the time of the charge, so history is not re-rated by later FX moves. */\n baseMinor: number;\n fxRate: number;\n source: \"manual\" | \"email\" | \"projected\";\n /** Order / invoice / transaction number from the receipt, when it had one. */\n orderRef: string | null;\n inboundEmailId: number | null;\n createdAt: string;\n}\n\n/** One month's worth of \"how good is this, really\". */\nexport interface Rating {\n id: number;\n subscriptionId: number;\n /** YYYY-MM */\n period: string;\n /** 1..5 — how happy am I with the quality of the service. */\n quality: number;\n /** 1..5 — how often do I actually use it. */\n usage: number;\n note: string | null;\n createdAt: string;\n}\n\nexport type ReviewKind =\n | \"confirm_new\"\n | \"renewal_soon\"\n | \"yearly_upcoming\"\n | \"rating_due\"\n | \"cancel_candidate\";\n\nexport type ReviewStatus = \"open\" | \"done\" | \"dismissed\";\n\n/** The actionable inbox: the thing that stops a \"I meant to cancel that\" from evaporating. */\nexport interface ReviewItem {\n id: number;\n subscriptionId: number | null;\n kind: ReviewKind;\n status: ReviewStatus;\n title: string;\n detail: string | null;\n dueOn: string | null;\n createdAt: string;\n resolvedAt: string | null;\n}\n\nexport type EmailIntent = \"ingest\" | \"question\" | \"command\" | \"unknown\";\n\nexport interface InboundEmail {\n id: number;\n messageId: string | null;\n fromAddr: string;\n subject: string | null;\n intent: EmailIntent;\n handled: boolean;\n result: string | null;\n createdAt: string;\n}\n\n/** Verdict for a single subscription, computed from its recent ratings and its cost. */\nexport interface Verdict {\n /** Recency-weighted quality, 1..5, or null when never rated. */\n quality: number | null;\n usage: number | null;\n /** Harmonic mean of quality and usage — punishes \"great but unused\" and \"used but bad\". */\n score: number | null;\n ratedMonths: number;\n band: \"keep\" | \"watch\" | \"cancel_candidate\" | \"unrated\";\n reason: string;\n}\n\n/** A subscription plus everything the dashboard needs to render a row. */\nexport interface SubscriptionView extends Subscription {\n /** Native cost normalised to a month, in minor units of the native currency. */\n monthlyMinor: number;\n yearlyMinor: number;\n /** Same, converted to the base currency. */\n monthlyBaseMinor: number;\n yearlyBaseMinor: number;\n /** Units of base currency per unit of this subscription's currency, at render time. */\n fxRate: number;\n verdict: Verdict;\n latestRating: Rating | null;\n /** True when this month has no rating yet and the subscription is live. */\n ratingDue: boolean;\n}\n\n/**\n * What a receipt yielded. `billingCycle` is nullable on purpose: a receipt that\n * never says whether it is monthly or yearly must not be allowed to assert one,\n * because that guess would otherwise overwrite a known-good cycle on an existing\n * subscription.\n */\nexport interface ExtractedSubscription {\n serviceName: string;\n planName: string | null;\n amount: number;\n currency: Currency;\n billingCycle: BillingCycle | null;\n chargedOn: string | null;\n nextChargeOn: string | null;\n category: string | null;\n /** Order / invoice / transaction number as printed on the receipt. */\n orderReference: string | null;\n /** 0..1 — how sure the model is that this really is a subscription receipt. */\n confidence: number;\n notes: string | null;\n}\n\n/** One projected (not yet charged) payment. */\nexport interface ProjectedCharge {\n subscriptionId: number;\n serviceName: string;\n date: string;\n amountMinor: number;\n currency: Currency;\n baseMinor: number;\n billingCycle: BillingCycle;\n}\n\nexport interface MonthBucket {\n /** YYYY-MM */\n period: string;\n baseMinor: number;\n charges: ProjectedCharge[];\n}\n\nexport interface Summary {\n baseCurrency: Currency;\n /** Sum of monthly-equivalents of everything live — the steady-state burn. */\n monthlyRunRateBaseMinor: number;\n yearlyRunRateBaseMinor: number;\n /** What the next 30 days will actually cost, on the calendar. */\n next30DaysBaseMinor: number;\n /** Calendar-accurate 12-month projection, so yearly renewals land in their real month. */\n next12MonthsBaseMinor: number;\n activeCount: number;\n monthlyCount: number;\n yearlyCount: number;\n /** Cumulative monthly-equivalent not spent since each cancellation. */\n savedToDateBaseMinor: number;\n /** Monthly-equivalent of everything cancelled — the ongoing saving. */\n savedPerMonthBaseMinor: number;\n openReviewCount: number;\n ratingDueCount: number;\n}\n",[],[159,317],"cb48b4ca-fd39-49ae-8659-93797fa60ddb","reconcile.ts","0012f2ca-a655-11f1-a23e-1607ee4eb77e",77,["D",1788301942871],"/**\n * Working out what a receipt changes about a subscription we already track.\n *\n * This exists because the first version only ever applied the new *price*. When a\n * plan moved from monthly to yearly, the yearly amount landed on a monthly cadence\n * — the run rate overstated it twelvefold and the next charge was predicted a month\n * out instead of a year. Deciding the whole patch in one pure function makes that\n * class of omission visible, and testable.\n */\nimport type { BillingCycle, Currency, ExtractedSubscription, Subscription } from \"./types.ts\";\nimport { advanceByCycle, normaliseNextCharge, toMinor } from \"./money.ts\";\n\nexport interface Reconciliation {\n /** Patch for updateSubscription. Empty when the receipt tells us nothing new. */\n patch: Record;\n priceChanged: boolean;\n cycleChanged: boolean;\n planChanged: boolean;\n previous: { amountMinor: number; currency: Currency; billingCycle: BillingCycle };\n next: { amountMinor: number; currency: Currency; billingCycle: BillingCycle; nextChargeOn: string };\n}\n\nexport function reconcile(\n existing: Subscription,\n extracted: ExtractedSubscription,\n chargedOn: string,\n today: string,\n): Reconciliation {\n const amountMinor = toMinor(extracted.amount);\n\n // A receipt that does not state a cycle leaves the existing one alone. The\n // extractor is allowed to return null precisely so it cannot guess here.\n const billingCycle = extracted.billingCycle ?? existing.billingCycle;\n\n const priceChanged = existing.amountMinor !== amountMinor || existing.currency !== extracted.currency;\n const cycleChanged = billingCycle !== existing.billingCycle;\n const planChanged = Boolean(extracted.planName) && extracted.planName !== existing.planName;\n\n // The next charge follows the *new* cycle. Using the old one is what put a\n // yearly plan back on the calendar a month later.\n const nextChargeOn = normaliseNextCharge(\n extracted.nextChargeOn ?? advanceByCycle(chargedOn, billingCycle),\n billingCycle,\n today,\n );\n\n const patch: Record = { nextChargeOn };\n if (priceChanged) {\n patch.amountMinor = amountMinor;\n patch.currency = extracted.currency;\n }\n if (cycleChanged) patch.billingCycle = billingCycle;\n if (planChanged) patch.planName = extracted.planName;\n\n return {\n patch,\n priceChanged,\n cycleChanged,\n planChanged,\n previous: {\n amountMinor: existing.amountMinor,\n currency: existing.currency,\n billingCycle: existing.billingCycle,\n },\n next: { amountMinor, currency: extracted.currency, billingCycle, nextChargeOn },\n };\n}\n",[],[159,325],"7e542ab3-108c-44d6-8108-02d6e5e4f01f","money.ts","09979014-a63a-11f1-83e6-1607ee4eb77e",9,["D",1788290362431],"/**\n * Money and billing-cycle maths. Pure — no imports, runs on both sides.\n *\n * Amounts are integer minor units (grosze / cents) everywhere. PLN, USD and EUR\n * all have two decimal places, so one constant covers every supported currency.\n */\nimport type { BillingCycle, Currency } from \"./types.ts\";\n\nexport const MINOR = 100;\n\nexport function toMinor(amount: number): number {\n return Math.round(amount * MINOR);\n}\n\nexport function fromMinor(minor: number): number {\n return minor / MINOR;\n}\n\nconst SYMBOLS: Record = { PLN: \"zł\", USD: \"$\", EUR: \"€\" };\n\n/** \"1 234,56 zł\" for PLN, \"$1,234.56\" for USD/EUR — matches where each symbol normally sits. */\nexport function formatMoney(minor: number, currency: Currency, opts?: { compact?: boolean }): string {\n const value = fromMinor(minor);\n const locale = currency === \"PLN\" ? \"pl-PL\" : \"en-US\";\n const body = value.toLocaleString(locale, {\n minimumFractionDigits: opts?.compact ? 0 : 2,\n maximumFractionDigits: opts?.compact ? 0 : 2,\n });\n return currency === \"PLN\" ? `${body} ${SYMBOLS.PLN}` : `${SYMBOLS[currency]}${body}`;\n}\n\n/**\n * Cost of one cycle expressed as a month.\n *\n * A yearly subscription is divided by twelve — this is the \"average monthly cost\"\n * that makes a 600 zł/year plan comparable to a 49 zł/month one. It is a run-rate,\n * not a cash-flow figure; the calendar projection below is what tells you when the\n * money actually leaves.\n */\nexport function monthlyEquivalentMinor(amountMinor: number, cycle: BillingCycle): number {\n return cycle === \"yearly\" ? Math.round(amountMinor / 12) : amountMinor;\n}\n\nexport function yearlyEquivalentMinor(amountMinor: number, cycle: BillingCycle): number {\n return cycle === \"yearly\" ? amountMinor : amountMinor * 12;\n}\n\n// ---------------------------------------------------------------------------\n// Dates. Stored as YYYY-MM-DD strings and manipulated in UTC so that a server in\n// one timezone and a browser in another agree on which day a charge lands.\n// ---------------------------------------------------------------------------\n\nexport function today(now: Date = new Date()): string {\n return toISODate(now);\n}\n\nexport function toISODate(d: Date): string {\n return d.toISOString().slice(0, 10);\n}\n\nexport function parseISODate(s: string): Date {\n const [y, m, d] = s.split(\"-\").map(Number);\n return new Date(Date.UTC(y, m - 1, d));\n}\n\n/** YYYY-MM for a date string. */\nexport function periodOf(isoDate: string): string {\n return isoDate.slice(0, 7);\n}\n\nexport function currentPeriod(now: Date = new Date()): string {\n return toISODate(now).slice(0, 7);\n}\n\n/** Previous period, e.g. \"2026-01\" -> \"2025-12\". */\nexport function shiftPeriod(period: string, months: number): string {\n const [y, m] = period.split(\"-\").map(Number);\n const d = new Date(Date.UTC(y, m - 1 + months, 1));\n return toISODate(d).slice(0, 7);\n}\n\n/**\n * Add months, clamping the day to the end of the target month.\n * 31 Jan + 1 month is 28/29 Feb, which is how card renewals actually behave.\n */\nexport function addMonths(isoDate: string, months: number): string {\n const d = parseISODate(isoDate);\n const day = d.getUTCDate();\n const target = new Date(Date.UTC(d.getUTCFullYear(), d.getUTCMonth() + months, 1));\n const lastDay = new Date(Date.UTC(target.getUTCFullYear(), target.getUTCMonth() + 1, 0)).getUTCDate();\n target.setUTCDate(Math.min(day, lastDay));\n return toISODate(target);\n}\n\nexport function addDays(isoDate: string, days: number): string {\n const d = parseISODate(isoDate);\n d.setUTCDate(d.getUTCDate() + days);\n return toISODate(d);\n}\n\nexport function advanceByCycle(isoDate: string, cycle: BillingCycle): string {\n return addMonths(isoDate, cycle === \"yearly\" ? 12 : 1);\n}\n\nexport function daysBetween(from: string, to: string): number {\n return Math.round((parseISODate(to).getTime() - parseISODate(from).getTime()) / 86_400_000);\n}\n\n/**\n * Roll a stale next-charge date forward until it is in the future.\n * Cheaper than a backfill job: a subscription whose date was never updated still\n * forecasts correctly, and the loop is bounded so bad data cannot hang a request.\n */\nexport function normaliseNextCharge(nextChargeOn: string, cycle: BillingCycle, from: string): string {\n let next = nextChargeOn;\n for (let i = 0; i < 240 && next < from; i++) {\n next = advanceByCycle(next, cycle);\n }\n return next;\n}\n",[],[159,333],["D",1788290408143],[],[159,65],"1b189923-25e4-4258-a3c4-af249248f555","forecast.ts","27a1da2e-a63a-11f1-9ce3-1607ee4eb77e",11,["D",1788290412822],"/**\n * Projecting charges forward. Pure — the calendar maths that turns a set of\n * subscriptions into \"what leaves the account, and when\".\n *\n * Kept out of the backend so it can be tested without a database, and so the\n * browser could run the same projection if it ever needed to.\n */\nimport type { MonthBucket, ProjectedCharge, SubscriptionView } from \"./types.ts\";\nimport { isLive } from \"./types.ts\";\nimport { advanceByCycle, normaliseNextCharge, periodOf, shiftPeriod, today } from \"./money.ts\";\n\n/** Bound on how many charges one subscription can contribute — 20 years of monthly. */\nconst MAX_ITERATIONS = 240;\n\nexport function projectCharges(\n subs: SubscriptionView[],\n opts: { from?: string; until: string },\n): ProjectedCharge[] {\n const from = opts.from ?? today();\n const out: ProjectedCharge[] = [];\n\n for (const s of subs) {\n if (!isLive(s.status) || !s.nextChargeOn) continue;\n // A stale next-charge date rolls forward to the first one still ahead of us,\n // so a row nobody has touched in months still forecasts correctly.\n let date = normaliseNextCharge(s.nextChargeOn, s.billingCycle, from);\n for (let i = 0; i < MAX_ITERATIONS && date <= opts.until; i++) {\n out.push({\n subscriptionId: s.id,\n serviceName: s.serviceName,\n date,\n amountMinor: s.amountMinor,\n currency: s.currency,\n baseMinor: Math.round(s.amountMinor * s.fxRate),\n billingCycle: s.billingCycle,\n });\n // Auto-renew off means the charge already scheduled happens and nothing after it.\n if (!s.autoRenew) break;\n date = advanceByCycle(date, s.billingCycle);\n }\n }\n return out.sort((a, b) => a.date.localeCompare(b.date) || a.serviceName.localeCompare(b.serviceName));\n}\n\n/** Group into calendar months, keeping empty months so the chart has a continuous axis. */\nexport function bucketByMonth(charges: ProjectedCharge[], startPeriod: string, months: number): MonthBucket[] {\n const buckets: MonthBucket[] = [];\n const index = new Map();\n for (let i = 0; i < months; i++) {\n const period = shiftPeriod(startPeriod, i);\n const bucket: MonthBucket = { period, baseMinor: 0, charges: [] };\n buckets.push(bucket);\n index.set(period, bucket);\n }\n for (const c of charges) {\n const bucket = index.get(periodOf(c.date));\n if (!bucket) continue;\n bucket.baseMinor += c.baseMinor;\n bucket.charges.push(c);\n }\n return buckets;\n}\n",[],[159,344],"30c1d699-e154-46a8-bd92-ab0082f8fbfa","dedupe.ts","f6823714-a656-11f1-adf5-1607ee4eb77e",82,["D",1788302785812],"/**\n * Deciding whether a charge has already been recorded.\n *\n * The original rule was a UNIQUE index on (subscription, date, amount), which only\n * catches a byte-identical repeat. It missed the real case: the same annual payment\n * arriving twice — once from an instruction typed by hand, once from the receipt a\n * day later — which double-counted the year's spend.\n *\n * Two rules, cheapest and most reliable first:\n *\n * 1. The vendor's own order number. If two records carry the same one they are the\n * same payment, whatever the dates say. This is an idempotency key we are handed\n * for free, and it is exact.\n * 2. Otherwise, the same amount on the same subscription within a few days. Real\n * subscriptions bill monthly at the closest; two identical amounts three days\n * apart are a duplicate, not a second payment.\n */\nimport type { Charge, Currency } from \"./types.ts\";\nimport { daysBetween } from \"./money.ts\";\n\n/** How close two identical amounts must be to count as the same payment. */\nexport const DEDUPE_WINDOW_DAYS = 3;\n\nexport interface CandidateCharge {\n chargedOn: string;\n amountMinor: number;\n currency: Currency;\n orderRef?: string | null;\n}\n\nexport type DuplicateOf = { charge: Charge; reason: string } | null;\n\nexport function findDuplicate(existing: Charge[], candidate: CandidateCharge): DuplicateOf {\n const ref = candidate.orderRef?.trim();\n\n if (ref) {\n const sameOrder = existing.find((c) => c.orderRef?.trim() === ref);\n if (sameOrder) {\n return { charge: sameOrder, reason: `same order number ${ref}` };\n }\n }\n\n const near = existing.find((c) =>\n c.amountMinor === candidate.amountMinor &&\n c.currency === candidate.currency &&\n Math.abs(daysBetween(c.chargedOn, candidate.chargedOn)) <= DEDUPE_WINDOW_DAYS\n );\n if (near) {\n return {\n charge: near,\n reason: `an identical amount was already recorded on ${near.chargedOn}`,\n };\n }\n\n return null;\n}\n",[],[159,352],"3b062db2-506c-4dab-8eea-bbf72b699f28",["D",1788290261270],[203,204,205,206,207,208],[159],"44a00701-c190-4dcd-a54a-aec1046ddf8d","root.tsx","6f64bc1e-a63a-11f1-859f-1607ee4eb77e","d62582e0-a639-11f1-8486-1607ee4eb77e",22,["D",1788290533191],"/** @jsxImportSource npm:hono@^4.13.5/jsx */\n/**\n * The HTML shell. Never cached, so it can stamp the current version onto the\n * client entry — `immutableFileUrl` turns /frontend/index.tsx into\n * /__immutable//frontend/index.tsx, which browsers may cache forever and\n * which a publish invalidates by bumping the version.\n *\n * The

History · grade.ts