[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_563":564,"_565":566},"routes/_app.x.$handle.$name",{"_99":98,"_31":44,"_107":89,"_26":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":24,"_122":123,"_124":58,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_31":44,"_37":45,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":24},"version",70,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_23":24},"previous","deleted",false,"deletedHere","path","backend/email/senders.ts","latestPath","fileId","68a1a9ec-a64d-11f1-8a17-1607ee4eb77e","name","senders.ts","fileType","script","content","/**\n * Who is allowed to email this val.\n *\n * The inbound address is public and, once given a readable name, guessable. That\n * matters more here than for a typical webhook: this assistant *answers questions\n * about your spending*, so an unknown sender asking \"how much am I spending?\" would\n * get a reply containing your data. It can also add subscriptions and spend money on\n * model calls.\n *\n * So the check runs before any work: no database write, no model call, no reply.\n * Rejected mail is logged and dropped rather than answered — replying would confirm\n * the address is live and turn the val into a reflector for anyone who spoofs a\n * sender.\n *\n * `ALLOWED_SENDERS` is comma-separated and takes either a full address\n * (`me@example.com`) or a whole domain (`@example.com`, or bare `example.com`).\n *\n * **Unset means nobody is allowed.** A mail handler that can leak data should fail\n * closed; a misconfigured val that silently answers strangers is the worse failure.\n *\n * One honest limitation: this reads the From header, which is not authenticated.\n * It reliably stops accidental, curious and opportunistic senders. It is not proof\n * against someone deliberately forging a sender address.\n */\n\n/** Pull the bare address out of \"Name \" or a plain \"a@b.com\". */\nexport function senderAddress(from: string): string | null {\n if (!from) return null;\n const angled = /<([^>]+)>/.exec(from);\n const candidate = (angled ? angled[1] : from).trim().toLowerCase();\n return /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(candidate) ? candidate : null;\n}\n\n/** \"me+receipts@gmail.com\" and \"me@gmail.com\" are the same mailbox to the sender. */\nfunction withoutPlusTag(address: string): string {\n const [local, domain] = address.split(\"@\");\n return `${local.split(\"+\")[0]}@${domain}`;\n}\n\nexport interface SenderVerdict {\n allowed: boolean;\n address: string | null;\n reason: string;\n}\n\nexport function isAllowedSender(from: string): SenderVerdict {\n const address = senderAddress(from);\n if (!address) {\n return { allowed: false, address: null, reason: \"no readable address in the From header\" };\n }\n\n const entries = (Deno.env.get(\"ALLOWED_SENDERS\") ?? \"\")\n .split(\",\")\n .map((entry) => entry.trim().toLowerCase())\n .filter(Boolean);\n\n if (entries.length === 0) {\n return {\n allowed: false,\n address,\n reason: \"ALLOWED_SENDERS is not set, so no sender is accepted. Set it to the addresses allowed to use this val.\",\n };\n }\n\n const bare = withoutPlusTag(address);\n const domain = address.slice(address.indexOf(\"@\") + 1);\n\n for (const entry of entries) {\n if (entry.includes(\"@\") && !entry.startsWith(\"@\")) {\n if (entry === address || withoutPlusTag(entry) === bare) {\n return { allowed: true, address, reason: `matched address ${entry}` };\n }\n continue;\n }\n // A whole-domain entry, written either \"@example.com\" or \"example.com\".\n if (entry.replace(/^@/, \"\") === domain) {\n return { allowed: true, address, reason: `matched domain ${entry}` };\n }\n }\n\n return { allowed: false, address, reason: \"sender is not on ALLOWED_SENDERS\" };\n}\n","createdAt",["D",1788298682321],"branchVersion","branchId","723ee93a-6b67-428c-b3cc-6f9491011d78","id","5588f200-1c41-400f-bf66-81f9f6ac0211","subscriptions",["D",1788290256185],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Track subscriptions, forecast spend, decide what to cancel","imageUrl","5f1525c6-51a0-4c57-858d-f94f1e686d46","pinnedFileId","c177e026-a63a-11f1-bee9-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a05e29-777a-77c1-a910-e4a1d8102a40","tursoName","5588f2001c41400fbf6681f9f6ac0211","tursoHostname","5588f2001c41400fbf6681f9f6ac0211-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789509043237],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_106":-5},"org",{"_99":98,"_100":101,"_102":-5,"_18":-5,"_103":104,"_105":24},"branch",{"_13":88,"_31":89,"_42":41,"_90":43,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":44,"_97":98},"isOwned",92,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","xdv","handle","displayName","xd.ventures","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_42":43,"_31":44,"_37":558,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":559,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":560,"_83":561,"_85":562,"_87":24},"tree",[209,222,238,243,249,250,251,252],"files",[209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252],"counts",{"_197":62,"_198":199,"_200":199,"_201":202,"_203":204},"contents",[129,130,131,132,133,134,135,136],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_42":192,"_31":193,"_29":194,"_139":-5,"_40":41,"_39":143,"_141":58,"_37":195,"_13":62,"_33":179,"_35":-5,"_23":24,"_146":-5,"_26":196},{"_42":186,"_31":187,"_29":188,"_139":-5,"_40":41,"_39":189,"_141":58,"_37":190,"_13":62,"_33":179,"_35":-5,"_23":24,"_146":-5,"_26":191},{"_42":181,"_31":182,"_29":183,"_139":-5,"_40":41,"_39":163,"_141":58,"_37":184,"_13":62,"_33":179,"_35":-5,"_23":24,"_146":-5,"_26":185},{"_42":174,"_31":175,"_29":176,"_139":-5,"_40":41,"_39":177,"_141":58,"_37":178,"_13":62,"_33":179,"_35":-5,"_23":24,"_146":-5,"_26":180},{"_42":167,"_31":168,"_29":169,"_139":-5,"_40":41,"_39":170,"_141":24,"_37":171,"_13":143,"_33":20,"_35":172,"_23":24,"_146":-5,"_26":173},{"_42":158,"_31":159,"_29":160,"_139":-5,"_40":41,"_39":161,"_141":24,"_37":162,"_13":163,"_33":164,"_35":165,"_23":24,"_146":-5,"_26":166},{"_42":149,"_31":150,"_29":151,"_139":-5,"_40":41,"_39":152,"_141":24,"_37":153,"_13":62,"_33":154,"_35":155,"_23":24,"_146":156,"_26":157},{"_42":137,"_31":138,"_29":56,"_139":-5,"_40":41,"_39":140,"_141":24,"_37":142,"_13":143,"_33":144,"_35":145,"_23":24,"_146":147,"_26":148},"b84bc181-14b2-4e53-b8f4-af946bbea381","index.ts","parentId",66,"latest",["D",1788295706383],3,"http","/**\n * HTTP entry point: the dashboard and its JSON API.\n *\n * Val Town assigns this file's URL — read it from `links.endpoint` rather than\n * constructing it. Set the same value as the APP_URL environment variable so the\n * outgoing emails can link back here.\n */\nimport { Hono } from \"npm:hono@^4.13.5\";\nimport { parseVal, serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { getOAuthUserData, oauthMiddleware } from \"https://esm.town/v/std/oauth/middleware.ts\";\nimport type { BillingCycle, Currency } from \"./shared/types.ts\";\nimport { CURRENCIES, isLive } from \"./shared/types.ts\";\nimport { currentPeriod, toMinor } from \"./shared/money.ts\";\nimport { ensureSchema } from \"./backend/db.ts\";\nimport { baseCurrency } from \"./backend/fx.ts\";\nimport {\n cancelSubscription,\n chargesFor,\n createSubscription,\n deleteSubscription,\n getSubscription,\n listViews,\n ratingsFor,\n reactivateSubscription,\n saveRating,\n updateSubscription,\n} from \"./backend/subscriptions.ts\";\nimport { byCategory, forecast, history, savings, summary } from \"./backend/analytics.ts\";\nimport { closeItemsFor, generateReviewItems, listReviewItems, resolveReviewItem } from \"./backend/review.ts\";\nimport { handleInbound } from \"./backend/email/handle.ts\";\nimport { isConfigured } from \"./backend/llm.ts\";\nimport { Root } from \"./frontend/root.tsx\";\n\n/** The signed-in Val Town account, once it has passed the gate below. */\ninterface Viewer {\n username: string | null;\n}\n\nconst app = new Hono<{ Variables: { viewer: Viewer } }>();\n\n/**\n * Who may see the dashboard.\n *\n * This is spending data, so the endpoint is not left open. Val Town's platform-level\n * restricted access needs a paid business org, so the gate lives in the val instead:\n * you log in with a Val Town account and this decides whether to let you through.\n *\n * `ALLOWED_USERS` is a comma-separated list of Val Town handles or account emails.\n *\n * set — it is the *entire* guest list. Org membership admits nobody on its own.\n * unset — members of the org that owns this val get in.\n *\n * That distinction is the point. Two people each need their own copy of this app,\n * and sharing an org so one of them can reach their copy would otherwise hand them\n * the other copy too. Naming the guest list explicitly keeps each instance to its\n * own person, whatever the org says. Leaving it unset keeps a fresh deploy from\n * locking its owner out of itself.\n */\nfunction allowedIdentities(): string[] {\n return (Deno.env.get(\"ALLOWED_USERS\") ?? \"\")\n .split(\",\")\n .map((entry) => entry.trim().toLowerCase())\n .filter(Boolean);\n}\n\nasync function viewerOf(req: Request) {\n const session = await getOAuthUserData(req).catch(() => null);\n if (!session?.user) return null;\n\n // Either identifier may be listed: the handle is stable, but the email is what\n // you actually know about a colleague before they have signed up.\n const handle = session.user.username?.toLowerCase() ?? \"\";\n const email = session.user.email?.toLowerCase() ?? \"\";\n const allowed = allowedIdentities();\n\n const permitted = allowed.length > 0\n ? (handle !== \"\" && allowed.includes(handle)) || (email !== \"\" && allowed.includes(email))\n : session.isOrgMember === true;\n\n return permitted ? session.user : { ...session.user, denied: true as const };\n}\n\napp.use(\"*\", async (c, next) => {\n const viewer = await viewerOf(c.req.raw);\n const isApi = c.req.path.startsWith(\"/api/\");\n\n if (!viewer) {\n // Not signed in at all: send people to log in, tell machines plainly.\n if (isApi) return c.json({ error: \"sign in to use this API\" }, 401);\n return c.redirect(\"/auth/login\");\n }\n if (\"denied\" in viewer) {\n // Signed in but not on the list — redirecting here would just bounce them\n // back and forth, so say what happened instead.\n const message =\n `Signed in as ${viewer.username}, but this dashboard is limited to the people on its guest list. ` +\n `Each person using this tracker has their own copy, so you may be looking at someone else's.`;\n if (isApi) return c.json({ error: message }, 403);\n return c.html(\n `\n

${message}

\n \n `,\n 403,\n );\n }\n\n c.set(\"viewer\", { username: viewer.username });\n return next();\n});\n\napp.get(\"/\", (c) => c.html(Root()));\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n/** Everything the dashboard needs, in one round trip. */\napp.get(\"/api/state\", async (c) => {\n await ensureSchema();\n const views = await listViews(true);\n const live = views.filter((s) => isLive(s.status));\n const [sum, fc, hist, sav, review, cats, base] = await Promise.all([\n summary(views),\n forecast(12, live),\n history(12),\n savings(),\n listReviewItems(\"open\"),\n byCategory(live),\n baseCurrency(),\n ]);\n const viewer = c.get(\"viewer\");\n return c.json({\n baseCurrency: base,\n period: currentPeriod(),\n llmConfigured: isConfigured(),\n viewer: viewer ? { username: viewer.username } : null,\n summary: sum,\n subscriptions: views,\n forecast: fc,\n history: hist,\n savings: sav,\n review,\n categories: cats,\n });\n});\n\napp.get(\"/api/subscriptions/:id\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const sub = await getSubscription(id);\n if (!sub) return c.json({ error: \"not found\" }, 404);\n const [charges, ratings] = await Promise.all([chargesFor(id), ratingsFor(id)]);\n return c.json({ subscription: sub, charges, ratings });\n});\n\napp.post(\"/api/subscriptions\", async (c) => {\n const body = await c.req.json();\n const parsed = parseSubscriptionBody(body);\n if (\"error\" in parsed) return c.json(parsed, 400);\n const id = await createSubscription(parsed.value);\n return c.json({ id }, 201);\n});\n\napp.patch(\"/api/subscriptions/:id\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json() as Record;\n const patch: Record = {};\n\n if (body.amount != null) patch.amountMinor = toMinor(Number(body.amount));\n if (body.amountMinor != null) patch.amountMinor = Math.round(Number(body.amountMinor));\n for (const key of [\"planName\", \"startedOn\", \"nextChargeOn\", \"paymentMethod\", \"notes\", \"status\"]) {\n if (key in body) patch[key] = body[key];\n }\n if (body.currency && CURRENCIES.includes(String(body.currency) as Currency)) patch.currency = body.currency;\n if (body.billingCycle === \"monthly\" || body.billingCycle === \"yearly\") patch.billingCycle = body.billingCycle;\n if (\"autoRenew\" in body) patch.autoRenew = Boolean(body.autoRenew);\n\n await updateSubscription(id, patch);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/subscriptions/:id/cancel\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({})) as { reason?: string; on?: string };\n await cancelSubscription(id, { reason: body.reason, on: body.on });\n await closeItemsFor(id);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/subscriptions/:id/reactivate\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({})) as { nextChargeOn?: string };\n await reactivateSubscription(id, body.nextChargeOn);\n return c.json({ ok: true });\n});\n\napp.delete(\"/api/subscriptions/:id\", async (c) => {\n await deleteSubscription(Number(c.req.param(\"id\")));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/subscriptions/:id/ratings\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json() as { quality?: number; usage?: number; period?: string; note?: string };\n const quality = Number(body.quality);\n const usage = Number(body.usage);\n if (!Number.isFinite(quality) || !Number.isFinite(usage)) {\n return c.json({ error: \"quality and usage are required, 1 to 5\" }, 400);\n }\n await saveRating(id, body.period ?? currentPeriod(), quality, usage, body.note ?? null);\n await closeItemsFor(id, [\"rating_due\"]);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/review/:id/:action\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n const action = c.req.param(\"action\");\n if (action !== \"done\" && action !== \"dismissed\") return c.json({ error: \"unknown action\" }, 400);\n await resolveReviewItem(id, action);\n return c.json({ ok: true });\n});\n\n/** Rebuild the decision inbox on demand — the same routine the daily cron runs. */\napp.post(\"/api/review/refresh\", async (c) => {\n const created = await generateReviewItems();\n return c.json({ created: created.length, items: created });\n});\n\n/**\n * Paste an email here to see exactly what the inbound handler would do with it,\n * without having to send real mail. Writes for real, so it is the fastest way to\n * check extraction against a receipt you actually received.\n */\napp.post(\"/api/email/simulate\", async (c) => {\n const body = await c.req.json() as {\n from?: string;\n subject?: string;\n text?: string;\n html?: string;\n messageId?: string;\n };\n if (!body.text && !body.html) return c.json({ error: \"text or html is required\" }, 400);\n const result = await handleInbound({\n from: body.from ?? \"test@example.com\",\n subject: body.subject ?? null,\n text: body.text ?? null,\n html: body.html ?? null,\n messageId: body.messageId ?? null,\n });\n return c.json(result);\n});\n\n// Full stack traces in the val logs rather than a swallowed 500.\napp.onError((err) => Promise.reject(err));\n\nfunction parseSubscriptionBody(body: Record):\n | { value: Parameters[0] }\n | { error: string }\n{\n const serviceName = String(body.serviceName ?? \"\").trim();\n if (!serviceName) return { error: \"serviceName is required\" };\n\n const amountMinor = body.amountMinor != null\n ? Math.round(Number(body.amountMinor))\n : toMinor(Number(body.amount));\n if (!Number.isFinite(amountMinor) || amountMinor <= 0) return { error: \"amount must be a positive number\" };\n\n const currency = String(body.currency ?? \"PLN\").toUpperCase() as Currency;\n if (!CURRENCIES.includes(currency)) return { error: `currency must be one of ${CURRENCIES.join(\", \")}` };\n\n const billingCycle = body.billingCycle === \"yearly\" ? \"yearly\" : \"monthly\" as BillingCycle;\n\n return {\n value: {\n serviceName,\n planName: body.planName ? String(body.planName) : null,\n amountMinor,\n currency,\n billingCycle,\n startedOn: body.startedOn ? String(body.startedOn) : null,\n nextChargeOn: body.nextChargeOn ? String(body.nextChargeOn) : null,\n category: body.category ? String(body.category) : null,\n paymentMethod: body.paymentMethod ? String(body.paymentMethod) : null,\n notes: body.notes ? String(body.notes) : null,\n source: \"manual\",\n },\n };\n}\n\nexport default oauthMiddleware(app.fetch);\n","label","xdv-subscriptions",[138],"d4f853a1-a39b-4607-a195-6b2dc203a14e","email.ts","c42f2144-a63a-11f1-bee9-1607ee4eb77e",37,["D",1788290675475],"email","/**\n * Email entry point — forward receipts here, or ask questions.\n *\n * Val Town assigns this file its own address; read it from `links.email` on the\n * file listing rather than guessing the format. Forwarding a confirmation with no\n * comment of your own tracks it; adding a line asks a question or runs a command.\n */\nimport { email } from \"https://esm.town/v/std/email\";\nimport { handleInbound } from \"./backend/email/handle.ts\";\n\n/** Shape Val Town delivers. Declared locally so the file type-checks anywhere. */\ninterface InboundEmail {\n from: string;\n to: string[];\n subject?: string;\n text?: string;\n html?: string;\n attachments: File[];\n headers: Record;\n}\n\nexport default async function (e: InboundEmail) {\n const messageId = headerOf(e.headers, \"message-id\");\n\n let result;\n try {\n result = await handleInbound({\n from: e.from,\n subject: e.subject ?? null,\n text: e.text ?? null,\n html: e.html ?? null,\n messageId,\n });\n } catch (err) {\n // A failure still gets a reply — silence would look like the address is dead.\n console.error(\"inbound email failed:\", err);\n await email({\n to: e.from,\n subject: `Re: ${e.subject ?? \"your subscriptions\"}`,\n text: `Something went wrong handling that email:\\n\\n${err instanceof Error ? err.message : String(err)}`,\n });\n throw err;\n }\n\n if (!result.replied || !result.body) {\n console.log(\"no reply sent (duplicate or empty)\", { from: e.from, subject: e.subject });\n return;\n }\n\n await email({ to: e.from, subject: result.subject, text: result.body });\n}\n\nfunction headerOf(headers: Record, name: string): string | null {\n const wanted = name.toLowerCase();\n for (const [key, value] of Object.entries(headers ?? {})) {\n if (key.toLowerCase() === wanted) return value;\n }\n return null;\n}\n","xd-subscriptions",[150],"b7dcca15-e85a-478e-b90e-92bce6c0697a","cron.ts","c6d3ea2e-a63a-11f1-94c2-1607ee4eb77e",63,["D",1788294953507],2,"interval","/**\n * Daily maintenance and the digest email.\n *\n * Runs at 06:00 UTC — 07:00 or 08:00 in Warsaw depending on the season. Cron on\n * Val Town is UTC only and does not follow daylight saving, so a fixed early-morning\n * UTC time is the right compromise for a once-a-day digest.\n *\n * The digest stays quiet on purpose. A mail every morning saying \"nothing changed\"\n * gets filtered within a week, and then the one that matters gets filtered with it.\n */\nimport { email } from \"https://esm.town/v/std/email\";\nimport { refreshRates } from \"./backend/fx.ts\";\nimport { baseCurrency } from \"./backend/fx.ts\";\nimport { listViews } from \"./backend/subscriptions.ts\";\nimport { summary, upcoming } from \"./backend/analytics.ts\";\nimport { generateReviewItems, listReviewItems } from \"./backend/review.ts\";\nimport { formatReview, formatSummary, formatUpcoming } from \"./backend/email/reply.ts\";\nimport { today } from \"./shared/money.ts\";\nimport { primeLinks } from \"./backend/links.ts\";\nimport { isLive } from \"./shared/types.ts\";\n\ninterface Interval {\n lastRunAt?: Date;\n}\n\n/** Charges inside this window go in the digest. */\nconst LOOKAHEAD_DAYS = 7;\n\n/**\n * Where the digest goes.\n *\n * A val owned by an organisation has no single \"owner\" for std/email to fall back\n * to, so the recipient has to be named explicitly — an org-owned val that omits\n * `to` fails at send time rather than at deploy time.\n */\nfunction digestRecipient(): string | null {\n return Deno.env.get(\"DIGEST_EMAIL\")?.trim() || null;\n}\n\nexport default async function (_interval: Interval) {\n await primeLinks();\n\n try {\n await refreshRates();\n } catch (err) {\n console.error(\"fx refresh failed, continuing with cached rates:\", err);\n }\n\n const created = await generateReviewItems();\n const [views, base] = await Promise.all([listViews(true), baseCurrency()]);\n const live = views.filter((s) => isLive(s.status));\n const soon = await upcoming(LOOKAHEAD_DAYS, live);\n const open = await listReviewItems(\"open\");\n\n const isFirstOfMonth = today().endsWith(\"-01\");\n const worthSending = created.length > 0 || soon.length > 0 || isFirstOfMonth;\n\n console.log(\"daily run\", {\n newItems: created.length,\n dueSoon: soon.length,\n openItems: open.length,\n sending: worthSending,\n });\n\n if (!worthSending) return;\n\n const to = digestRecipient();\n if (!to) {\n console.error(\"DIGEST_EMAIL is not set — nothing to send the digest to. Skipping.\");\n return;\n }\n\n const sections: string[] = [];\n\n if (created.length > 0) {\n sections.push(`New since yesterday\\n${\"-\".repeat(52)}\\n${created.map((i) => `• ${i.title}`).join(\"\\n\")}`);\n }\n if (soon.length > 0) {\n sections.push(formatUpcoming(soon, base, LOOKAHEAD_DAYS));\n }\n if (open.length > 0) {\n sections.push(formatReview(open));\n }\n if (isFirstOfMonth) {\n sections.push(formatSummary(await summary(views)));\n }\n\n await email({\n to,\n subject: subjectFor(created.length, soon.length, isFirstOfMonth),\n text: sections.join(`\\n\\n${\"=\".repeat(52)}\\n\\n`),\n });\n}\n\nfunction subjectFor(newItems: number, dueSoon: number, monthStart: boolean): string {\n if (monthStart) return \"Subscriptions — new month, time to rate\";\n if (dueSoon > 0) return `Subscriptions — ${dueSoon} charge${dueSoon === 1 ? \"\" : \"s\"} coming up`;\n return `Subscriptions — ${newItems} thing${newItems === 1 ? \"\" : \"s\"} to decide`;\n}\n",[159],"53e748b9-172d-4f01-8084-1b6aa41137ed","README.md","c9b25cbc-a63a-11f1-9a33-1607ee4eb77e",67,["D",1788295756221],"# Subscription tracker\n\nA Val Town app for deciding, month by month, whether each subscription is still\nworth paying for. Three parts: a schema that keeps enough history to answer\n\"what did cancelling save me\", an email assistant you forward receipts to, and a\ndashboard.\n\n## What it answers\n\n| Question | Where |\n|---|---|\n| What do my subscriptions cost me a month? | Run rate — every yearly plan divided by twelve |\n| What leaves my account in March? | 12-month calendar forecast, yearly renewals marked separately |\n| Which ones should I drop? | Two grades a month (quality, usage) → a keep/watch/cancel verdict |\n| What has cancelling saved me? | Monthly equivalent of each cancelled plan, counted from the day it stopped |\n| What do I need to decide right now? | The decision inbox — renewals you can still stop, ratings due, cancel candidates |\n\nRun rate and the calendar forecast are deliberately separate numbers. Averaging a\nyearly plan into a monthly figure makes it comparable; it also hides the month the\nmoney actually leaves, which is the surprise worth avoiding.\n\n## Files\n\n```\nindex.ts HTTP: the dashboard and its JSON API (fileType: http)\nemail.ts inbound mail: forward receipts here (fileType: email)\ncron.ts daily: FX, decision inbox, digest (fileType: interval, 0 6 * * *)\n\nshared/ types, money and date maths, verdicts, forecasting — pure, runs on both sides\nbackend/ db schema, FX, queries, analytics, review inbox, LLM, email handling\nfrontend/ the React dashboard (no build step; Val Town transpiles per request)\ntests/ the pure logic, run with `deno test --allow-import tests/`\n```\n\n## The schema\n\n`services` — the vendor. `subscriptions` — one billing arrangement for a service;\na service can own several over time as plans and prices change, but only one is\nlive. `charges` — payments that really happened. Nothing in the future is stored:\nit is projected from `next_charge_on`, so a price change never leaves stale rows\nbehind.\n\n```\nservices id, name, name_key(unique), vendor_domain, category, notes\nsubscriptions id, service_id, plan_name, amount_minor, currency, billing_cycle,\n started_on, next_charge_on, status, cancelled_on, cancel_reason,\n payment_method, auto_renew, source, notes\ncharges id, subscription_id, charged_on, amount_minor, currency,\n base_minor, fx_rate, source, inbound_email_id\nratings id, subscription_id, period(YYYY-MM), quality 1-5, usage 1-5, note\n unique(subscription_id, period)\nreview_items id, subscription_id, kind, status, title, detail, due_on, dedupe_key\ninbound_emails id, message_id(unique), from_addr, subject, body, intent, handled, result\nfx_rates quote, base, rate, as_of\nsettings key, value\n```\n\nMoney is stored as **integer minor units** (grosze, cents) in the currency it is\nactually billed in — never a float, never pre-converted. Conversion to your base\ncurrency happens at read time, except on `charges`, which pin the rate that applied\non the day so history is not re-priced when the zloty moves.\n\n`status` is `active | trial | paused | cancelled`. Cancelling keeps the row: the\nprice and the stop date are exactly what the savings figure is computed from.\n\n## The verdict\n\nEach month, two grades out of five: **quality** (how good is it) and **usage** (how\noften do you reach for it). They are combined with a harmonic mean, which collapses\ntoward whichever is worse — 5 and 1 give 1.7, not 3. A brilliant tool you opened\ntwice is still money leaving.\n\nRatings are recency-weighted over six months (each month back counts 0.75 of the\none after it), so one quiet month nudges the score without flipping it. Bands:\n`>= 3.5` keep, `>= 2.5` watch, below that a cancel candidate. A *watch* that costs\nmore than your median subscription is promoted to a cancel candidate — an\nabove-median price only has to be middling to deserve a decision.\n\n## The email assistant\n\nForward mail to the address Val Town assigns `email.ts` (read it from `links.email`\non the file listing — never construct it).\n\n- **Forward a receipt with nothing on top** → it is extracted and tracked, and a\n *confirm* item appears in the decision inbox. Nothing is ever written silently.\n- **Forward it with a question on top** → both: the charge is recorded *and* the\n question is answered from your data.\n- **Send a command** as the first line:\n\n```\nlist active subscriptions and run rate\nforecast [months] calendar forecast, yearly renewals marked\nupcoming [days] what is due soon\nsavings what cancelling has saved you\nreview the decisions waiting on you\nrate 4 2 quality 4, usage 2, for this month\ncancel [because …]\nkeep clear its open decisions\nadd 49.99 PLN monthly\nhelp\n```\n\nAnything else is treated as a question and answered by the model from your\nsubscription data.\n\nExtraction uses a strict tool rather than a forced one: a receipt the model cannot\nread comes back as \"no result\" instead of a confidently wrong row. Without an API\nkey the app still works — receipts fall back to a text scan that takes the largest\nmoney amount, and commands are unaffected.\n\n## Environment variables\n\n| Variable | Required | What it does |\n|---|---|---|\n| `ANTHROPIC_API_KEY` | for the assistant | Receipt extraction and email Q&A. Without it, commands and the heuristic scan still work. |\n| `APP_URL` | no | Overrides the dashboard link in emails. Leave unset — the val asks the platform for its own endpoint, so a remixed copy links to itself with no setup. Set it only for a custom domain or a proxy. |\n| `BASE_CURRENCY` | no | `PLN` (default), `USD` or `EUR`. Everything rolls up into this. |\n| `ALLOWED_USERS` | recommended | The complete guest list: Val Town handles or account emails, comma-separated. **While set, org membership admits nobody on its own.** Leave unset and members of the owning org get in. |\n\nFX rates come from Frankfurter (ECB reference rates, no key), cached daily, falling\nback to the last cached value.\n\n## Who can see it\n\nThe dashboard is spending data, so the endpoint is not open. Val Town's\nplatform-level restricted access needs a paid business org, so the gate lives in\nthe val instead: `std/oauth` wraps the whole app, and a visitor gets through only\nif they are signed in to Val Town **and** appear on this val's guest list. Anyone\nelse gets a 401 (API) or a 403 page (browser) — never the data.\n\n`ALLOWED_USERS` is that guest list — handles or account emails, comma-separated —\nand while it is set, **org membership grants nothing by itself**. That matters\nbecause this app has no multi-tenancy: each person runs their own copy, and adding\nsomeone to the org so they can reach theirs would otherwise hand them everyone\nelse's too. Naming the list explicitly keeps each instance to its own person.\nLeaving it unset falls back to org membership, so a fresh deploy can't lock its\nowner out of itself.\n\nNote what this gate does *not* cover: anyone with edit access to the val — which\norg membership does grant — can read its SQLite database directly through Val Town,\nregardless of this code. Keep the org membership list to people you would trust with\nthe data itself.\n\nIf this val ever moves to a business-tier org, `set_http_privacy: restricted` is\nthe better mechanism — it gates at the platform edge, before any code runs — and\nthe `oauthMiddleware` wrapper should come off at the same time so nobody has to\nauthenticate twice.\n\n## Deploying\n\nThe val needs three file types: `index.ts` as `http`, `email.ts` as `email`,\n`cron.ts` as `interval` with `0 6 * * *` (UTC — that is 07:00 or 08:00 Warsaw\ndepending on the season; cron does not follow daylight saving).\n\nNo post-deploy URL configuration is needed: `backend/links.ts` resolves this val's\nown endpoint at runtime via `httpEndpoint()` from `std/utils`, so a fresh remix\nlinks to itself. `APP_URL` remains available as an override.\n\n## Not built yet\n\nGoogle Calendar entries for upcoming renewals, and bank feeds via bkpr to\nreconcile charges against what actually left the account.\n",[168],"44ac6418-79af-44cf-ad45-03919cf85518","tests","daa22ada-a639-11f1-a090-1607ee4eb77e",7,["D",1788290283645],"directory",[175],"3b062db2-506c-4dab-8eea-bbf72b699f28","shared","cd4c23cc-a639-11f1-9263-1607ee4eb77e",["D",1788290261270],[182],"7a1a8cc2-5f5e-41d8-b0dc-6a886fbbfd83","frontend","d62582e0-a639-11f1-8486-1607ee4eb77e",5,["D",1788290276120],[187],"8e3a3793-994f-4922-93a3-91669c779f58","backend","cfb9f800-a639-11f1-ae2f-1607ee4eb77e",["D",1788290265322],[193],"pulls","branches",1,"forks","envVars",{"_205":207,"_208":62},"connections",{"_205":62,"_206":62},"count","unfilledCount",6,"emptyCount",{"_42":192,"_31":193,"_29":194,"_139":-5,"_40":41,"_39":143,"_141":58,"_37":555,"_13":62,"_33":179,"_35":-5,"_23":24,"_146":-5,"_254":556,"_26":557},{"_42":550,"_31":154,"_29":522,"_139":194,"_40":41,"_39":551,"_141":58,"_37":552,"_13":62,"_33":179,"_35":-5,"_23":24,"_146":-5,"_254":553,"_26":554},{"_42":542,"_31":543,"_29":544,"_139":522,"_40":41,"_39":545,"_141":24,"_37":546,"_13":199,"_33":34,"_35":547,"_23":24,"_146":-5,"_254":548,"_26":549},{"_42":534,"_31":535,"_29":536,"_139":522,"_40":41,"_39":537,"_141":58,"_37":538,"_13":199,"_33":34,"_35":539,"_23":24,"_146":-5,"_254":540,"_26":541},{"_42":526,"_31":527,"_29":528,"_139":522,"_40":41,"_39":529,"_141":58,"_37":530,"_13":62,"_33":34,"_35":531,"_23":24,"_146":-5,"_254":532,"_26":533},{"_42":521,"_31":32,"_29":30,"_139":522,"_40":41,"_39":14,"_141":58,"_37":523,"_13":62,"_33":34,"_35":36,"_23":24,"_146":-5,"_254":524,"_26":525},{"_42":513,"_31":514,"_29":515,"_139":194,"_40":41,"_39":516,"_141":58,"_37":517,"_13":62,"_33":34,"_35":518,"_23":24,"_146":-5,"_254":519,"_26":520},{"_42":505,"_31":506,"_29":507,"_139":194,"_40":41,"_39":508,"_141":24,"_37":509,"_13":62,"_33":34,"_35":510,"_23":24,"_146":-5,"_254":511,"_26":512},{"_42":497,"_31":498,"_29":499,"_139":194,"_40":41,"_39":500,"_141":58,"_37":501,"_13":62,"_33":34,"_35":502,"_23":24,"_146":-5,"_254":503,"_26":504},{"_42":489,"_31":490,"_29":491,"_139":194,"_40":41,"_39":492,"_141":24,"_37":493,"_13":199,"_33":34,"_35":494,"_23":24,"_146":-5,"_254":495,"_26":496},{"_42":481,"_31":482,"_29":483,"_139":194,"_40":41,"_39":484,"_141":24,"_37":485,"_13":62,"_33":34,"_35":486,"_23":24,"_146":-5,"_254":487,"_26":488},{"_42":473,"_31":474,"_29":475,"_139":194,"_40":41,"_39":476,"_141":58,"_37":477,"_13":62,"_33":34,"_35":478,"_23":24,"_146":-5,"_254":479,"_26":480},{"_42":465,"_31":466,"_29":467,"_139":194,"_40":41,"_39":468,"_141":24,"_37":469,"_13":199,"_33":34,"_35":470,"_23":24,"_146":-5,"_254":471,"_26":472},{"_42":186,"_31":187,"_29":188,"_139":-5,"_40":41,"_39":189,"_141":58,"_37":462,"_13":62,"_33":179,"_35":-5,"_23":24,"_146":-5,"_254":463,"_26":464},{"_42":458,"_31":377,"_29":371,"_139":188,"_40":41,"_39":207,"_141":58,"_37":459,"_13":62,"_33":179,"_35":-5,"_23":24,"_146":-5,"_254":460,"_26":461},{"_42":450,"_31":451,"_29":452,"_139":371,"_40":41,"_39":453,"_141":58,"_37":454,"_13":62,"_33":34,"_35":455,"_23":24,"_146":-5,"_254":456,"_26":457},{"_42":442,"_31":443,"_29":444,"_139":371,"_40":41,"_39":445,"_141":24,"_37":446,"_13":199,"_33":34,"_35":447,"_23":24,"_146":-5,"_254":448,"_26":449},{"_42":434,"_31":435,"_29":436,"_139":371,"_40":41,"_39":437,"_141":58,"_37":438,"_13":62,"_33":34,"_35":439,"_23":24,"_146":-5,"_254":440,"_26":441},{"_42":426,"_31":427,"_29":428,"_139":371,"_40":41,"_39":429,"_141":58,"_37":430,"_13":62,"_33":34,"_35":431,"_23":24,"_146":-5,"_254":432,"_26":433},{"_42":418,"_31":419,"_29":420,"_139":371,"_40":41,"_39":421,"_141":58,"_37":422,"_13":62,"_33":34,"_35":423,"_23":24,"_146":-5,"_254":424,"_26":425},{"_42":410,"_31":411,"_29":412,"_139":371,"_40":41,"_39":413,"_141":58,"_37":414,"_13":62,"_33":34,"_35":415,"_23":24,"_146":-5,"_254":416,"_26":417},{"_42":402,"_31":403,"_29":404,"_139":371,"_40":41,"_39":405,"_141":58,"_37":406,"_13":62,"_33":34,"_35":407,"_23":24,"_146":-5,"_254":408,"_26":409},{"_42":394,"_31":395,"_29":396,"_139":371,"_40":41,"_39":397,"_141":24,"_37":398,"_13":62,"_33":34,"_35":399,"_23":24,"_146":-5,"_254":400,"_26":401},{"_42":386,"_31":387,"_29":388,"_139":371,"_40":41,"_39":389,"_141":58,"_37":390,"_13":143,"_33":34,"_35":391,"_23":24,"_146":-5,"_254":392,"_26":393},{"_42":378,"_31":379,"_29":380,"_139":371,"_40":41,"_39":381,"_141":58,"_37":382,"_13":62,"_33":34,"_35":383,"_23":24,"_146":-5,"_254":384,"_26":385},{"_42":368,"_31":369,"_29":370,"_139":371,"_40":41,"_39":372,"_141":58,"_37":373,"_13":62,"_33":34,"_35":374,"_23":24,"_146":-5,"_254":375,"_26":376},{"_42":360,"_31":361,"_29":362,"_139":188,"_40":41,"_39":363,"_141":58,"_37":364,"_13":199,"_33":34,"_35":365,"_23":24,"_146":-5,"_254":366,"_26":367},{"_42":352,"_31":353,"_29":354,"_139":188,"_40":41,"_39":355,"_141":58,"_37":356,"_13":62,"_33":34,"_35":357,"_23":24,"_146":-5,"_254":358,"_26":359},{"_42":344,"_31":345,"_29":346,"_139":188,"_40":41,"_39":347,"_141":58,"_37":348,"_13":62,"_33":34,"_35":349,"_23":24,"_146":-5,"_254":350,"_26":351},{"_42":181,"_31":182,"_29":183,"_139":-5,"_40":41,"_39":163,"_141":58,"_37":341,"_13":62,"_33":179,"_35":-5,"_23":24,"_146":-5,"_254":342,"_26":343},{"_42":333,"_31":334,"_29":335,"_139":183,"_40":41,"_39":336,"_141":58,"_37":337,"_13":62,"_33":34,"_35":338,"_23":24,"_146":-5,"_254":339,"_26":340},{"_42":325,"_31":326,"_29":327,"_139":183,"_40":41,"_39":328,"_141":58,"_37":329,"_13":62,"_33":34,"_35":330,"_23":24,"_146":-5,"_254":331,"_26":332},{"_42":317,"_31":318,"_29":319,"_139":183,"_40":41,"_39":320,"_141":58,"_37":321,"_13":62,"_33":34,"_35":322,"_23":24,"_146":-5,"_254":323,"_26":324},{"_42":309,"_31":310,"_29":311,"_139":183,"_40":41,"_39":312,"_141":24,"_37":313,"_13":62,"_33":34,"_35":314,"_23":24,"_146":-5,"_254":315,"_26":316},{"_42":174,"_31":175,"_29":176,"_139":-5,"_40":41,"_39":177,"_141":58,"_37":306,"_13":62,"_33":179,"_35":-5,"_23":24,"_146":-5,"_254":307,"_26":308},{"_42":298,"_31":299,"_29":300,"_139":176,"_40":41,"_39":301,"_141":58,"_37":302,"_13":62,"_33":34,"_35":303,"_23":24,"_146":-5,"_254":304,"_26":305},{"_42":290,"_31":291,"_29":292,"_139":176,"_40":41,"_39":293,"_141":58,"_37":294,"_13":62,"_33":34,"_35":295,"_23":24,"_146":-5,"_254":296,"_26":297},{"_42":282,"_31":283,"_29":284,"_139":176,"_40":41,"_39":285,"_141":58,"_37":286,"_13":62,"_33":34,"_35":287,"_23":24,"_146":-5,"_254":288,"_26":289},{"_42":274,"_31":275,"_29":276,"_139":176,"_40":41,"_39":277,"_141":58,"_37":278,"_13":62,"_33":34,"_35":279,"_23":24,"_146":-5,"_254":280,"_26":281},{"_42":266,"_31":267,"_29":268,"_139":176,"_40":41,"_39":269,"_141":58,"_37":270,"_13":62,"_33":34,"_35":271,"_23":24,"_146":-5,"_254":272,"_26":273},{"_42":167,"_31":168,"_29":169,"_139":-5,"_40":41,"_39":170,"_141":24,"_37":263,"_13":143,"_33":20,"_35":172,"_23":24,"_146":-5,"_254":264,"_26":265},{"_42":158,"_31":159,"_29":160,"_139":-5,"_40":41,"_39":161,"_141":24,"_37":260,"_13":163,"_33":164,"_35":165,"_23":24,"_146":-5,"_254":261,"_26":262},{"_42":149,"_31":150,"_29":151,"_139":-5,"_40":41,"_39":152,"_141":24,"_37":257,"_13":62,"_33":154,"_35":155,"_23":24,"_146":156,"_254":258,"_26":259},{"_42":137,"_31":138,"_29":56,"_139":-5,"_40":41,"_39":140,"_141":24,"_37":253,"_13":143,"_33":144,"_35":145,"_23":24,"_146":147,"_254":255,"_26":256},["D",1788295706383],"children",[],[138],["D",1788290675475],[],[150],["D",1788294953507],[],[159],["D",1788295756221],[],[168],"a1d52b29-ad39-4497-baf4-e3cf73edb906","money_test.ts","8834364c-a63b-11f1-9bae-1607ee4eb77e",47,["D",1788291004337],"import { assertEquals } from \"jsr:@std/assert@1\";\nimport {\n addMonths,\n advanceByCycle,\n daysBetween,\n formatMoney,\n monthlyEquivalentMinor,\n normaliseNextCharge,\n shiftPeriod,\n toMinor,\n yearlyEquivalentMinor,\n} from \"../shared/money.ts\";\n\nDeno.test(\"a yearly price becomes an average monthly cost\", () => {\n assertEquals(monthlyEquivalentMinor(60000, \"yearly\"), 5000);\n assertEquals(monthlyEquivalentMinor(5000, \"monthly\"), 5000);\n assertEquals(yearlyEquivalentMinor(5000, \"monthly\"), 60000);\n assertEquals(yearlyEquivalentMinor(60000, \"yearly\"), 60000);\n});\n\nDeno.test(\"amounts are integers, so no floating point cents\", () => {\n assertEquals(toMinor(49.99), 4999);\n assertEquals(toMinor(0.1 + 0.2), 30);\n});\n\nDeno.test(\"month arithmetic clamps to the end of a short month\", () => {\n // A card charged on the 31st is charged on the 28th in February, not the 3rd of March.\n assertEquals(addMonths(\"2026-01-31\", 1), \"2026-02-28\");\n assertEquals(addMonths(\"2028-01-31\", 1), \"2028-02-29\"); // leap year\n assertEquals(addMonths(\"2026-03-31\", 1), \"2026-04-30\");\n assertEquals(addMonths(\"2026-12-15\", 1), \"2027-01-15\");\n});\n\nDeno.test(\"advancing by cycle moves a month or a year\", () => {\n assertEquals(advanceByCycle(\"2026-09-15\", \"monthly\"), \"2026-10-15\");\n assertEquals(advanceByCycle(\"2026-09-15\", \"yearly\"), \"2027-09-15\");\n});\n\nDeno.test(\"a stale next-charge date rolls forward to the first future one\", () => {\n // Untouched since January, monthly: the next charge is in September, not January.\n assertEquals(normaliseNextCharge(\"2026-01-10\", \"monthly\", \"2026-09-01\"), \"2026-09-10\");\n // Already in the future: left alone.\n assertEquals(normaliseNextCharge(\"2026-12-10\", \"monthly\", \"2026-09-01\"), \"2026-12-10\");\n // Yearly rolls a whole year at a time.\n assertEquals(normaliseNextCharge(\"2024-03-05\", \"yearly\", \"2026-09-01\"), \"2027-03-05\");\n});\n\nDeno.test(\"periods shift across year boundaries\", () => {\n assertEquals(shiftPeriod(\"2026-01\", -1), \"2025-12\");\n assertEquals(shiftPeriod(\"2026-12\", 1), \"2027-01\");\n assertEquals(shiftPeriod(\"2026-09\", 0), \"2026-09\");\n});\n\nDeno.test(\"day counts span months and leap days\", () => {\n assertEquals(daysBetween(\"2026-09-01\", \"2026-09-30\"), 29);\n assertEquals(daysBetween(\"2028-02-28\", \"2028-03-01\"), 2);\n});\n\nDeno.test(\"each currency is formatted the way it is written\", () => {\n assertEquals(formatMoney(4999, \"USD\"), \"$49.99\");\n assertEquals(formatMoney(4999, \"EUR\"), \"€49.99\");\n assertEquals(formatMoney(4999, \"PLN\").endsWith(\"zł\"), true);\n});\n",[],[175,267],"ed4a5287-a979-47d6-b472-cc39f8404355","grade_test.ts","8c3c8276-a63b-11f1-a9b7-1607ee4eb77e",48,["D",1788291011048],"import { assertEquals, assertLess } from \"jsr:@std/assert@1\";\nimport { computeVerdict, harmonicMean, medianMinor } from \"../shared/grade.ts\";\nimport { rating } from \"./fixtures.ts\";\n\nDeno.test(\"an unrated subscription gets no verdict, not a default one\", () => {\n const v = computeVerdict({ ratings: [], currentPeriod: \"2026-09\" });\n assertEquals(v.band, \"unrated\");\n assertEquals(v.score, null);\n});\n\nDeno.test(\"a great service you never open scores badly\", () => {\n const v = computeVerdict({ ratings: [rating(\"2026-09\", 5, 1)], currentPeriod: \"2026-09\" });\n // The mean of 5 and 1 would be 3 — a passing grade for something you never use.\n assertLess(v.score!, 2);\n assertEquals(v.band, \"cancel_candidate\");\n});\n\nDeno.test(\"solid on both axes reads as keep\", () => {\n const v = computeVerdict({ ratings: [rating(\"2026-09\", 4, 4)], currentPeriod: \"2026-09\" });\n assertEquals(v.band, \"keep\");\n assertEquals(v.score, 4);\n});\n\nDeno.test(\"the newest month counts for more than any single older month\", () => {\n const improving = computeVerdict({\n ratings: [rating(\"2026-09\", 5, 5), rating(\"2026-08\", 1, 1)],\n currentPeriod: \"2026-09\",\n });\n const declining = computeVerdict({\n ratings: [rating(\"2026-09\", 1, 1), rating(\"2026-08\", 5, 5)],\n currentPeriod: \"2026-09\",\n });\n assertLess(declining.score!, improving.score!);\n});\n\nDeno.test(\"one good month lifts a long bad run, without erasing it\", () => {\n const flat = computeVerdict({\n ratings: [\"2026-09\", \"2026-08\", \"2026-07\", \"2026-06\"].map((p) => rating(p, 2, 2)),\n currentPeriod: \"2026-09\",\n });\n const recovering = computeVerdict({\n ratings: [rating(\"2026-09\", 5, 5), ...[\"2026-08\", \"2026-07\", \"2026-06\"].map((p) => rating(p, 2, 2))],\n currentPeriod: \"2026-09\",\n });\n // Moves up, but a single month does not outvote a season of history.\n assertLess(flat.score!, recovering.score!);\n assertLess(recovering.score!, 4);\n});\n\nDeno.test(\"ratings older than the window are ignored\", () => {\n const v = computeVerdict({ ratings: [rating(\"2025-01\", 5, 5)], currentPeriod: \"2026-09\" });\n assertEquals(v.band, \"unrated\");\n assertEquals(v.ratedMonths, 0);\n});\n\nDeno.test(\"a middling service above the median cost becomes a decision\", () => {\n const ratings = [rating(\"2026-09\", 3, 3)];\n const cheap = computeVerdict({\n ratings,\n currentPeriod: \"2026-09\",\n monthlyBaseMinor: 1000,\n expensiveThresholdMinor: 5000,\n });\n const pricey = computeVerdict({\n ratings,\n currentPeriod: \"2026-09\",\n monthlyBaseMinor: 9000,\n expensiveThresholdMinor: 5000,\n });\n assertEquals(cheap.band, \"watch\");\n assertEquals(pricey.band, \"cancel_candidate\");\n});\n\nDeno.test(\"harmonic mean collapses toward the worse score\", () => {\n assertEquals(harmonicMean(5, 5), 5);\n assertLess(harmonicMean(5, 2), 3.5);\n});\n\nDeno.test(\"median handles both even and odd counts\", () => {\n assertEquals(medianMinor([100, 300, 200]), 200);\n assertEquals(medianMinor([100, 200, 300, 400]), 250);\n assertEquals(medianMinor([]), undefined);\n});\n",[],[175,275],"ce679d08-734c-4a60-9b0a-ae8492976e7f","forecast_test.ts","8f0a8700-a63b-11f1-9edc-1607ee4eb77e",49,["D",1788291015821],"import { assertEquals } from \"jsr:@std/assert@1\";\nimport { bucketByMonth, projectCharges } from \"../shared/forecast.ts\";\nimport { sub } from \"./fixtures.ts\";\n\nconst FROM = \"2026-09-01\";\nconst UNTIL = \"2027-08-31\";\n\nDeno.test(\"a monthly plan projects one charge per month\", () => {\n const charges = projectCharges([sub({ nextChargeOn: \"2026-09-15\", billingCycle: \"monthly\" })], {\n from: FROM,\n until: UNTIL,\n });\n assertEquals(charges.length, 12);\n assertEquals(charges[0].date, \"2026-09-15\");\n assertEquals(charges[11].date, \"2027-08-15\");\n});\n\nDeno.test(\"a yearly plan projects one charge, in the month it actually falls\", () => {\n const charges = projectCharges(\n [sub({ nextChargeOn: \"2027-03-20\", billingCycle: \"yearly\", amountMinor: 120000 })],\n { from: FROM, until: UNTIL },\n );\n assertEquals(charges.length, 1);\n assertEquals(charges[0].date, \"2027-03-20\");\n assertEquals(charges[0].billingCycle, \"yearly\");\n});\n\nDeno.test(\"cancelled and paused subscriptions cost nothing going forward\", () => {\n const charges = projectCharges(\n [sub({ status: \"cancelled\" }), sub({ status: \"paused\" }), sub({ status: \"trial\" })],\n { from: FROM, until: UNTIL },\n );\n // Only the trial is still live.\n assertEquals(new Set(charges.map((c) => c.subscriptionId)).size, 1);\n});\n\nDeno.test(\"auto-renew off means the booked charge happens and nothing after it\", () => {\n const charges = projectCharges([sub({ autoRenew: false, nextChargeOn: \"2026-09-15\" })], {\n from: FROM,\n until: UNTIL,\n });\n assertEquals(charges.length, 1);\n});\n\nDeno.test(\"a next-charge date left behind still forecasts from today\", () => {\n const charges = projectCharges([sub({ nextChargeOn: \"2025-02-10\", billingCycle: \"monthly\" })], {\n from: FROM,\n until: \"2026-12-31\",\n });\n assertEquals(charges[0].date, \"2026-09-10\");\n assertEquals(charges.length, 4); // Sep, Oct, Nov, Dec\n});\n\nDeno.test(\"foreign currency is converted at the subscription's rate\", () => {\n const charges = projectCharges(\n [sub({ currency: \"USD\", amountMinor: 1000, fxRate: 4, nextChargeOn: \"2026-09-15\" })],\n { from: FROM, until: \"2026-09-30\" },\n );\n assertEquals(charges[0].amountMinor, 1000);\n assertEquals(charges[0].baseMinor, 4000);\n});\n\nDeno.test(\"months with nothing due still appear on the axis\", () => {\n const charges = projectCharges(\n [sub({ nextChargeOn: \"2026-11-05\", billingCycle: \"yearly\" })],\n { from: FROM, until: UNTIL },\n );\n const buckets = bucketByMonth(charges, \"2026-09\", 12);\n assertEquals(buckets.length, 12);\n assertEquals(buckets[0].period, \"2026-09\");\n assertEquals(buckets[0].baseMinor, 0);\n assertEquals(buckets[2].period, \"2026-11\");\n assertEquals(buckets[2].charges.length, 1);\n});\n\nDeno.test(\"a yearly renewal lands in one month rather than being smeared across twelve\", () => {\n const yearly = sub({ nextChargeOn: \"2027-01-10\", billingCycle: \"yearly\", amountMinor: 120000 });\n const buckets = bucketByMonth(projectCharges([yearly], { from: FROM, until: UNTIL }), \"2026-09\", 12);\n const withMoney = buckets.filter((b) => b.baseMinor > 0);\n assertEquals(withMoney.length, 1);\n assertEquals(withMoney[0].period, \"2027-01\");\n assertEquals(withMoney[0].baseMinor, 120000);\n});\n",[],[175,283],"404f14d0-7389-47c5-a42c-3dc942ba3c62","fixtures.ts","8556ccfa-a63b-11f1-9edc-1607ee4eb77e",46,["D",1788290999526],"/** Builders for test data — only the fields a given test cares about need naming. */\nimport type { Rating, SubscriptionView } from \"../shared/types.ts\";\n\nlet nextId = 1;\n\nexport function sub(overrides: Partial = {}): SubscriptionView {\n const id = overrides.id ?? nextId++;\n return {\n id,\n serviceId: id,\n serviceName: `Service ${id}`,\n category: null,\n planName: null,\n amountMinor: 5000,\n currency: \"PLN\",\n billingCycle: \"monthly\",\n startedOn: \"2026-01-01\",\n nextChargeOn: \"2026-09-15\",\n status: \"active\",\n cancelledOn: null,\n cancelReason: null,\n paymentMethod: null,\n autoRenew: true,\n source: \"manual\",\n notes: null,\n createdAt: \"2026-01-01\",\n updatedAt: \"2026-01-01\",\n monthlyMinor: 5000,\n yearlyMinor: 60000,\n monthlyBaseMinor: 5000,\n yearlyBaseMinor: 60000,\n fxRate: 1,\n verdict: { quality: null, usage: null, score: null, ratedMonths: 0, band: \"unrated\", reason: \"\" },\n latestRating: null,\n ratingDue: true,\n ...overrides,\n };\n}\n\nexport function rating(period: string, quality: number, usage: number): Rating {\n return { id: nextId++, subscriptionId: 1, period, quality, usage, note: null, createdAt: period };\n}\n",[],[175,291],"8694499f-04fd-485d-a6ff-9d685a1277c7","email_parse_test.ts","92fd0252-a63b-11f1-83e3-1607ee4eb77e",50,["D",1788291022418],"import { assertEquals } from \"jsr:@std/assert@1\";\nimport {\n cleanSubject,\n heuristicAmount,\n parseAmount,\n parseCommand,\n senderDomain,\n splitEmail,\n} from \"../backend/email/parse.ts\";\n\nconst GMAIL_FORWARD = `Please handle this one.\n\n---------- Forwarded message ---------\nFrom: Netflix \nDate: Mon, 1 Sep 2026 at 09:12\nSubject: Your Netflix bill\n\nYour payment of 56,00 zł was received.\n`;\n\nDeno.test(\"a note above a forward is separated from the receipt below it\", () => {\n const split = splitEmail(GMAIL_FORWARD);\n assertEquals(split.hasComment, true);\n assertEquals(split.comment, \"Please handle this one.\");\n assertEquals(split.quoted.includes(\"Your payment of 56,00 zł\"), true);\n});\n\nDeno.test(\"a bare forward has no comment, so it is an ingest\", () => {\n assertEquals(splitEmail(BARE_FORWARD).hasComment, false);\n});\n\nconst BARE_FORWARD = GMAIL_FORWARD.replace(\"Please handle this one.\\n\\n\", \"\");\n\nDeno.test(\"'fyi' on its own is not a comment\", () => {\n for (const noise of [\"fyi\", \"FYI\", \"fwd\", \"thanks\", \" ok \"]) {\n assertEquals(splitEmail(`${noise}\\n\\n${BARE_FORWARD}`).hasComment, false, noise);\n }\n});\n\nDeno.test(\"Apple and Outlook forward styles are recognised too\", () => {\n const apple = \"is this worth keeping?\\n\\nBegin forwarded message:\\n\\nFrom: iCloud\\nTotal: $2.99\";\n assertEquals(splitEmail(apple).comment, \"is this worth keeping?\");\n\n const outlook = \"check this\\n\\n-----Original Message-----\\nFrom: Spotify\\nAmount: 23,99 zł\";\n assertEquals(splitEmail(outlook).comment, \"check this\");\n});\n\nDeno.test(\"a phone signature is not mistaken for a comment\", () => {\n assertEquals(splitEmail(`Sent from my iPhone\\n\\n${BARE_FORWARD}`).hasComment, false);\n});\n\nDeno.test(\"quoted reply lines are not the sender's own words\", () => {\n const split = splitEmail(\"> Your payment of 56,00 zł was received.\\n> Thanks\");\n assertEquals(split.hasComment, false);\n});\n\nDeno.test(\"both decimal conventions parse to the same number\", () => {\n assertEquals(parseAmount(\"1 234,56\"), 1234.56);\n assertEquals(parseAmount(\"1,234.56\"), 1234.56);\n assertEquals(parseAmount(\"56,00\"), 56);\n assertEquals(parseAmount(\"2.99\"), 2.99);\n assertEquals(parseAmount(\"nope\"), null);\n});\n\nDeno.test(\"the largest amount in a receipt is taken as the total\", () => {\n const hit = heuristicAmount(\"Subtotal 45,53 zł\\nVAT 10,47 zł\\nTotal 56,00 zł\");\n assertEquals(hit?.amount, 56);\n assertEquals(hit?.currency, \"PLN\");\n\n // The same vendor writes \"zł\" in one template and ASCII \"zl\" in another.\n assertEquals(heuristicAmount(\"Your payment of 56,00 zl was received\")?.amount, 56);\n assertEquals(heuristicAmount(\"Your payment of 56,00 zl was received\")?.currency, \"PLN\");\n assertEquals(heuristicAmount(\"Total: PLN 129.00\")?.amount, 129);\n assertEquals(heuristicAmount(\"You paid $9.99 for your monthly plan\")?.currency, \"USD\");\n assertEquals(heuristicAmount(\"Charged €120.00 annually\")?.currency, \"EUR\");\n assertEquals(heuristicAmount(\"Charged €120.00 annually\")?.cycle, \"yearly\");\n});\n\nDeno.test(\"commands parse off the first line\", () => {\n assertEquals(parseCommand(\"list\"), { kind: \"list\" });\n assertEquals(parseCommand(\"forecast 6\"), { kind: \"forecast\", months: 6 });\n assertEquals(parseCommand(\"upcoming\"), { kind: \"upcoming\", days: 30 });\n assertEquals(parseCommand(\"cancel Netflix\"), { kind: \"cancel\", service: \"Netflix\", reason: null });\n assertEquals(parseCommand(\"cancel Netflix because I never watch it\"), {\n kind: \"cancel\",\n service: \"Netflix\",\n reason: \"I never watch it\",\n });\n assertEquals(parseCommand(\"rate Figma 4 2\"), {\n kind: \"rate\",\n service: \"Figma\",\n quality: 4,\n usage: 2,\n note: null,\n });\n assertEquals(parseCommand(\"add Spotify 23.99 PLN monthly\"), {\n kind: \"add\",\n service: \"Spotify\",\n amount: 23.99,\n currency: \"PLN\",\n cycle: \"monthly\",\n });\n});\n\nDeno.test(\"a question is not a command\", () => {\n assertEquals(parseCommand(\"how much am I spending on software?\"), null);\n assertEquals(parseCommand(\"is Netflix worth keeping\"), null);\n});\n\nDeno.test(\"sender domains are normalised, and forward prefixes stripped\", () => {\n assertEquals(senderDomain(\"Netflix \"), \"netflix.com\");\n assertEquals(senderDomain(\"billing@figma.com\"), \"figma.com\");\n assertEquals(senderDomain(\"no-reply@email.apple.com\"), \"apple.com\");\n assertEquals(senderDomain(\"receipts@billing.example.co.uk\"), \"example.co.uk\");\n assertEquals(cleanSubject(\"Fwd: Re: Your receipt\"), \"Your receipt\");\n assertEquals(cleanSubject(null), \"\");\n});\n",[],[175,299],["D",1788290283645],[244,245,246,247,248],[175],"e4d4dca2-b850-4197-9596-43f83839fc12","types.ts","fad95512-a639-11f1-8af0-1607ee4eb77e",8,["D",1788290337678],"/** Shared types used by both the backend and the browser bundle. */\n\nexport type Currency = \"PLN\" | \"USD\" | \"EUR\";\nexport const CURRENCIES: Currency[] = [\"PLN\", \"USD\", \"EUR\"];\n\nexport type BillingCycle = \"monthly\" | \"yearly\";\nexport const BILLING_CYCLES: BillingCycle[] = [\"monthly\", \"yearly\"];\n\nexport type SubscriptionStatus = \"active\" | \"trial\" | \"paused\" | \"cancelled\";\n\n/** Statuses that still cost money and still get forecast, rated and reminded about. */\nexport const LIVE_STATUSES: SubscriptionStatus[] = [\"active\", \"trial\"];\n\nexport function isLive(status: SubscriptionStatus): boolean {\n return status === \"active\" || status === \"trial\";\n}\n\nexport interface Service {\n id: number;\n name: string;\n /** Sender domain of confirmation mail, used to match forwarded email to a service. */\n vendorDomain: string | null;\n category: string | null;\n notes: string | null;\n createdAt: string;\n}\n\nexport interface Subscription {\n id: number;\n serviceId: number;\n serviceName: string;\n category: string | null;\n planName: string | null;\n /** Native amount in minor units (grosze / cents). Never a float. */\n amountMinor: number;\n currency: Currency;\n billingCycle: BillingCycle;\n startedOn: string | null;\n /** ISO date of the next expected charge. Drives forecasts and reminders. */\n nextChargeOn: string | null;\n status: SubscriptionStatus;\n cancelledOn: string | null;\n cancelReason: string | null;\n paymentMethod: string | null;\n autoRenew: boolean;\n /** Where the row came from: typed in by hand, or extracted from a forwarded email. */\n source: \"manual\" | \"email\";\n notes: string | null;\n createdAt: string;\n updatedAt: string;\n}\n\n/** A real payment that happened, as opposed to a projected one. */\nexport interface Charge {\n id: number;\n subscriptionId: number;\n chargedOn: string;\n amountMinor: number;\n currency: Currency;\n /** Value in base currency at the time of the charge, so history is not re-rated by later FX moves. */\n baseMinor: number;\n fxRate: number;\n source: \"manual\" | \"email\" | \"projected\";\n inboundEmailId: number | null;\n createdAt: string;\n}\n\n/** One month's worth of \"how good is this, really\". */\nexport interface Rating {\n id: number;\n subscriptionId: number;\n /** YYYY-MM */\n period: string;\n /** 1..5 — how happy am I with the quality of the service. */\n quality: number;\n /** 1..5 — how often do I actually use it. */\n usage: number;\n note: string | null;\n createdAt: string;\n}\n\nexport type ReviewKind =\n | \"confirm_new\"\n | \"renewal_soon\"\n | \"yearly_upcoming\"\n | \"rating_due\"\n | \"cancel_candidate\";\n\nexport type ReviewStatus = \"open\" | \"done\" | \"dismissed\";\n\n/** The actionable inbox: the thing that stops a \"I meant to cancel that\" from evaporating. */\nexport interface ReviewItem {\n id: number;\n subscriptionId: number | null;\n kind: ReviewKind;\n status: ReviewStatus;\n title: string;\n detail: string | null;\n dueOn: string | null;\n createdAt: string;\n resolvedAt: string | null;\n}\n\nexport type EmailIntent = \"ingest\" | \"question\" | \"command\" | \"unknown\";\n\nexport interface InboundEmail {\n id: number;\n messageId: string | null;\n fromAddr: string;\n subject: string | null;\n intent: EmailIntent;\n handled: boolean;\n result: string | null;\n createdAt: string;\n}\n\n/** Verdict for a single subscription, computed from its recent ratings and its cost. */\nexport interface Verdict {\n /** Recency-weighted quality, 1..5, or null when never rated. */\n quality: number | null;\n usage: number | null;\n /** Harmonic mean of quality and usage — punishes \"great but unused\" and \"used but bad\". */\n score: number | null;\n ratedMonths: number;\n band: \"keep\" | \"watch\" | \"cancel_candidate\" | \"unrated\";\n reason: string;\n}\n\n/** A subscription plus everything the dashboard needs to render a row. */\nexport interface SubscriptionView extends Subscription {\n /** Native cost normalised to a month, in minor units of the native currency. */\n monthlyMinor: number;\n yearlyMinor: number;\n /** Same, converted to the base currency. */\n monthlyBaseMinor: number;\n yearlyBaseMinor: number;\n /** Units of base currency per unit of this subscription's currency, at render time. */\n fxRate: number;\n verdict: Verdict;\n latestRating: Rating | null;\n /** True when this month has no rating yet and the subscription is live. */\n ratingDue: boolean;\n}\n\n/** One projected (not yet charged) payment. */\nexport interface ProjectedCharge {\n subscriptionId: number;\n serviceName: string;\n date: string;\n amountMinor: number;\n currency: Currency;\n baseMinor: number;\n billingCycle: BillingCycle;\n}\n\nexport interface MonthBucket {\n /** YYYY-MM */\n period: string;\n baseMinor: number;\n charges: ProjectedCharge[];\n}\n\nexport interface Summary {\n baseCurrency: Currency;\n /** Sum of monthly-equivalents of everything live — the steady-state burn. */\n monthlyRunRateBaseMinor: number;\n yearlyRunRateBaseMinor: number;\n /** What the next 30 days will actually cost, on the calendar. */\n next30DaysBaseMinor: number;\n /** Calendar-accurate 12-month projection, so yearly renewals land in their real month. */\n next12MonthsBaseMinor: number;\n activeCount: number;\n monthlyCount: number;\n yearlyCount: number;\n /** Cumulative monthly-equivalent not spent since each cancellation. */\n savedToDateBaseMinor: number;\n /** Monthly-equivalent of everything cancelled — the ongoing saving. */\n savedPerMonthBaseMinor: number;\n openReviewCount: number;\n ratingDueCount: number;\n}\n",[],[182,310],"7e542ab3-108c-44d6-8108-02d6e5e4f01f","money.ts","09979014-a63a-11f1-83e6-1607ee4eb77e",9,["D",1788290362431],"/**\n * Money and billing-cycle maths. Pure — no imports, runs on both sides.\n *\n * Amounts are integer minor units (grosze / cents) everywhere. PLN, USD and EUR\n * all have two decimal places, so one constant covers every supported currency.\n */\nimport type { BillingCycle, Currency } from \"./types.ts\";\n\nexport const MINOR = 100;\n\nexport function toMinor(amount: number): number {\n return Math.round(amount * MINOR);\n}\n\nexport function fromMinor(minor: number): number {\n return minor / MINOR;\n}\n\nconst SYMBOLS: Record = { PLN: \"zł\", USD: \"$\", EUR: \"€\" };\n\n/** \"1 234,56 zł\" for PLN, \"$1,234.56\" for USD/EUR — matches where each symbol normally sits. */\nexport function formatMoney(minor: number, currency: Currency, opts?: { compact?: boolean }): string {\n const value = fromMinor(minor);\n const locale = currency === \"PLN\" ? \"pl-PL\" : \"en-US\";\n const body = value.toLocaleString(locale, {\n minimumFractionDigits: opts?.compact ? 0 : 2,\n maximumFractionDigits: opts?.compact ? 0 : 2,\n });\n return currency === \"PLN\" ? `${body} ${SYMBOLS.PLN}` : `${SYMBOLS[currency]}${body}`;\n}\n\n/**\n * Cost of one cycle expressed as a month.\n *\n * A yearly subscription is divided by twelve — this is the \"average monthly cost\"\n * that makes a 600 zł/year plan comparable to a 49 zł/month one. It is a run-rate,\n * not a cash-flow figure; the calendar projection below is what tells you when the\n * money actually leaves.\n */\nexport function monthlyEquivalentMinor(amountMinor: number, cycle: BillingCycle): number {\n return cycle === \"yearly\" ? Math.round(amountMinor / 12) : amountMinor;\n}\n\nexport function yearlyEquivalentMinor(amountMinor: number, cycle: BillingCycle): number {\n return cycle === \"yearly\" ? amountMinor : amountMinor * 12;\n}\n\n// ---------------------------------------------------------------------------\n// Dates. Stored as YYYY-MM-DD strings and manipulated in UTC so that a server in\n// one timezone and a browser in another agree on which day a charge lands.\n// ---------------------------------------------------------------------------\n\nexport function today(now: Date = new Date()): string {\n return toISODate(now);\n}\n\nexport function toISODate(d: Date): string {\n return d.toISOString().slice(0, 10);\n}\n\nexport function parseISODate(s: string): Date {\n const [y, m, d] = s.split(\"-\").map(Number);\n return new Date(Date.UTC(y, m - 1, d));\n}\n\n/** YYYY-MM for a date string. */\nexport function periodOf(isoDate: string): string {\n return isoDate.slice(0, 7);\n}\n\nexport function currentPeriod(now: Date = new Date()): string {\n return toISODate(now).slice(0, 7);\n}\n\n/** Previous period, e.g. \"2026-01\" -> \"2025-12\". */\nexport function shiftPeriod(period: string, months: number): string {\n const [y, m] = period.split(\"-\").map(Number);\n const d = new Date(Date.UTC(y, m - 1 + months, 1));\n return toISODate(d).slice(0, 7);\n}\n\n/**\n * Add months, clamping the day to the end of the target month.\n * 31 Jan + 1 month is 28/29 Feb, which is how card renewals actually behave.\n */\nexport function addMonths(isoDate: string, months: number): string {\n const d = parseISODate(isoDate);\n const day = d.getUTCDate();\n const target = new Date(Date.UTC(d.getUTCFullYear(), d.getUTCMonth() + months, 1));\n const lastDay = new Date(Date.UTC(target.getUTCFullYear(), target.getUTCMonth() + 1, 0)).getUTCDate();\n target.setUTCDate(Math.min(day, lastDay));\n return toISODate(target);\n}\n\nexport function addDays(isoDate: string, days: number): string {\n const d = parseISODate(isoDate);\n d.setUTCDate(d.getUTCDate() + days);\n return toISODate(d);\n}\n\nexport function advanceByCycle(isoDate: string, cycle: BillingCycle): string {\n return addMonths(isoDate, cycle === \"yearly\" ? 12 : 1);\n}\n\nexport function daysBetween(from: string, to: string): number {\n return Math.round((parseISODate(to).getTime() - parseISODate(from).getTime()) / 86_400_000);\n}\n\n/**\n * Roll a stale next-charge date forward until it is in the future.\n * Cheaper than a backfill job: a subscription whose date was never updated still\n * forecasts correctly, and the loop is bounded so bad data cannot hang a request.\n */\nexport function normaliseNextCharge(nextChargeOn: string, cycle: BillingCycle, from: string): string {\n let next = nextChargeOn;\n for (let i = 0; i < 240 && next < from; i++) {\n next = advanceByCycle(next, cycle);\n }\n return next;\n}\n",[],[182,318],"9353e38a-fea3-4c76-a556-ccfc0c7b0461","grade.ts","24db9dfc-a63a-11f1-9b8b-1607ee4eb77e",10,["D",1788290408143],"/**\n * Turning two monthly grades into a keep/cancel verdict.\n *\n * Each month you give a subscription two scores out of five: how good it is\n * (quality) and how much you actually reach for it (usage). Neither alone is a\n * decision — a brilliant tool you opened twice is still money leaving, and a\n * mediocre one you live in is worth keeping. So the two are combined with a\n * harmonic mean, which collapses toward whichever score is *worse*: 5 and 1 give\n * 1.7, not 3. Lopsided pairs are exactly the ones worth surfacing.\n */\nimport type { Rating, Verdict } from \"./types.ts\";\nimport { shiftPeriod } from \"./money.ts\";\n\n/** How many months of history feed a verdict. */\nexport const WINDOW_MONTHS = 6;\n/** Each month back counts for three quarters of the one after it. */\nconst DECAY = 0.75;\n\nexport const KEEP_THRESHOLD = 3.5;\nexport const WATCH_THRESHOLD = 2.5;\n\nexport function harmonicMean(a: number, b: number): number {\n if (a <= 0 || b <= 0) return 0;\n return (2 * a * b) / (a + b);\n}\n\nexport interface VerdictInput {\n ratings: Rating[];\n currentPeriod: string;\n /** Monthly cost in base currency, used to escalate an expensive middling service. */\n monthlyBaseMinor?: number;\n /** Cost above which \"watch\" becomes \"cancel candidate\". Typically the portfolio median. */\n expensiveThresholdMinor?: number;\n}\n\nexport function computeVerdict(input: VerdictInput): Verdict {\n const { ratings, currentPeriod, monthlyBaseMinor, expensiveThresholdMinor } = input;\n\n // Index the window by period so gaps (months you skipped) simply carry no weight.\n const windowPeriods = new Map();\n for (let i = 0; i < WINDOW_MONTHS; i++) {\n windowPeriods.set(shiftPeriod(currentPeriod, -i), Math.pow(DECAY, i));\n }\n\n let qSum = 0, uSum = 0, wSum = 0, months = 0;\n for (const r of ratings) {\n const w = windowPeriods.get(r.period);\n if (w === undefined) continue;\n qSum += r.quality * w;\n uSum += r.usage * w;\n wSum += w;\n months++;\n }\n\n if (wSum === 0) {\n return {\n quality: null,\n usage: null,\n score: null,\n ratedMonths: 0,\n band: \"unrated\",\n reason: \"No ratings yet — rate it once to get a verdict.\",\n };\n }\n\n const quality = round1(qSum / wSum);\n const usage = round1(uSum / wSum);\n const score = round1(harmonicMean(quality, usage));\n\n let band: Verdict[\"band\"] = score >= KEEP_THRESHOLD ? \"keep\" : score >= WATCH_THRESHOLD ? \"watch\" : \"cancel_candidate\";\n\n const expensive = monthlyBaseMinor !== undefined\n && expensiveThresholdMinor !== undefined\n && monthlyBaseMinor > expensiveThresholdMinor;\n\n // An above-median cost only has to be middling, not bad, to deserve a decision.\n if (band === \"watch\" && expensive) band = \"cancel_candidate\";\n\n return { quality, usage, score, ratedMonths: months, band, reason: explain(quality, usage, score, band, expensive) };\n}\n\nfunction explain(quality: number, usage: number, score: number, band: Verdict[\"band\"], expensive: boolean): string {\n const gap = quality - usage;\n if (gap >= 1.5) {\n return `Good service (${quality}) you barely use (${usage}) — the usual cancel candidate.`;\n }\n if (gap <= -1.5) {\n return `You use it (${usage}) despite rating it ${quality} — look for a better alternative.`;\n }\n if (band === \"keep\") return `Solid on both axes (${quality} quality, ${usage} usage).`;\n if (band === \"cancel_candidate\" && expensive) {\n return `Middling (${score}) and above your median cost — decide on it.`;\n }\n if (band === \"cancel_candidate\") return `Low on both axes (${quality} quality, ${usage} usage).`;\n return `Neither good nor bad (${score}) — worth a conscious decision.`;\n}\n\nfunction round1(n: number): number {\n return Math.round(n * 10) / 10;\n}\n\nexport function bandLabel(band: Verdict[\"band\"]): string {\n return { keep: \"Keep\", watch: \"Watch\", cancel_candidate: \"Cancel?\", unrated: \"Unrated\" }[band];\n}\n\n/** Median of the live monthly costs — the reference point for \"expensive\". */\nexport function medianMinor(values: number[]): number | undefined {\n if (values.length === 0) return undefined;\n const sorted = [...values].sort((a, b) => a - b);\n const mid = Math.floor(sorted.length / 2);\n return sorted.length % 2 ? sorted[mid] : Math.round((sorted[mid - 1] + sorted[mid]) / 2);\n}\n",[],[182,326],"1b189923-25e4-4258-a3c4-af249248f555","forecast.ts","27a1da2e-a63a-11f1-9ce3-1607ee4eb77e",11,["D",1788290412822],"/**\n * Projecting charges forward. Pure — the calendar maths that turns a set of\n * subscriptions into \"what leaves the account, and when\".\n *\n * Kept out of the backend so it can be tested without a database, and so the\n * browser could run the same projection if it ever needed to.\n */\nimport type { MonthBucket, ProjectedCharge, SubscriptionView } from \"./types.ts\";\nimport { isLive } from \"./types.ts\";\nimport { advanceByCycle, normaliseNextCharge, periodOf, shiftPeriod, today } from \"./money.ts\";\n\n/** Bound on how many charges one subscription can contribute — 20 years of monthly. */\nconst MAX_ITERATIONS = 240;\n\nexport function projectCharges(\n subs: SubscriptionView[],\n opts: { from?: string; until: string },\n): ProjectedCharge[] {\n const from = opts.from ?? today();\n const out: ProjectedCharge[] = [];\n\n for (const s of subs) {\n if (!isLive(s.status) || !s.nextChargeOn) continue;\n // A stale next-charge date rolls forward to the first one still ahead of us,\n // so a row nobody has touched in months still forecasts correctly.\n let date = normaliseNextCharge(s.nextChargeOn, s.billingCycle, from);\n for (let i = 0; i < MAX_ITERATIONS && date <= opts.until; i++) {\n out.push({\n subscriptionId: s.id,\n serviceName: s.serviceName,\n date,\n amountMinor: s.amountMinor,\n currency: s.currency,\n baseMinor: Math.round(s.amountMinor * s.fxRate),\n billingCycle: s.billingCycle,\n });\n // Auto-renew off means the charge already scheduled happens and nothing after it.\n if (!s.autoRenew) break;\n date = advanceByCycle(date, s.billingCycle);\n }\n }\n return out.sort((a, b) => a.date.localeCompare(b.date) || a.serviceName.localeCompare(b.serviceName));\n}\n\n/** Group into calendar months, keeping empty months so the chart has a continuous axis. */\nexport function bucketByMonth(charges: ProjectedCharge[], startPeriod: string, months: number): MonthBucket[] {\n const buckets: MonthBucket[] = [];\n const index = new Map();\n for (let i = 0; i < months; i++) {\n const period = shiftPeriod(startPeriod, i);\n const bucket: MonthBucket = { period, baseMinor: 0, charges: [] };\n buckets.push(bucket);\n index.set(period, bucket);\n }\n for (const c of charges) {\n const bucket = index.get(periodOf(c.date));\n if (!bucket) continue;\n bucket.baseMinor += c.baseMinor;\n bucket.charges.push(c);\n }\n return buckets;\n}\n",[],[182,334],["D",1788290261270],[239,240,241,242],[182],"44a00701-c190-4dcd-a54a-aec1046ddf8d","root.tsx","6f64bc1e-a63a-11f1-859f-1607ee4eb77e",22,["D",1788290533191],"/** @jsxImportSource npm:hono@^4.13.5/jsx */\n/**\n * The HTML shell. Never cached, so it can stamp the current version onto the\n * client entry — `immutableFileUrl` turns /frontend/index.tsx into\n * /__immutable//frontend/index.tsx, which browsers may cache forever and\n * which a publish invalidates by bumping the version.\n *\n * The

Diff · v70