[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_104":105,"_106":107},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","AyanAfzal","name","Insideout","path","main.ts","project",{"_22":46,"_11":12,"_33":47,"_48":-5,"_49":42,"_50":51,"_52":51,"_53":54,"_55":-5,"_56":57,"_58":25,"_59":32,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_13":45},"permalink","https://www.val.town/x/AyanAfzal/Insideout/code/main.ts","extension","id","076201ad-9841-4eb7-8cca-a2686d2d8a69","fileId","742edec4-b0fc-11f1-b0fe-1607ee4eb77e","parentId","branchId","efce13a8-4703-42d3-8163-67565ac1ccd7","branchVersion",24,"latest",true,"createdAt",["D",1789496431617],"version",8,"fileType","http","content","/**\n * INSIDEOUT SPORTS MANAGEMENT — single-file Val Town HTTP val (Deno / TypeScript)\n * ------------------------------------------------------------------------------\n * Public site + Player Portal + Registration + Admin panel in ONE file.\n * Persistence: Val Town std/blob (auto-detected). Falls back to in-memory if the\n * blob module is unavailable, so the val still runs anywhere.\n *\n * Admin sign-in: email + password. Override with env vars ADMIN_EMAIL and\n * ADMIN_PASSWORD in the val's settings (strongly recommended if the val is public).\n */\n\nimport { LOGO_MAIN, LOGO_WEAR } from \"./assets.ts\";\n\nimport { SHELL, TAIL } from \"./page.ts\";\nimport { CLIENT_A } from \"./client.ts\";\nimport { CLIENT_B } from \"./admin.ts\";\n\nconst BLOB_KEY = \"insideout_db_v1\";\n\nfunction envOr(key: string, fallback: string): string {\n try {\n const v = Deno.env.get(key);\n if (v && v.length > 0) return v;\n } catch (_e) { /* env not available */ }\n return fallback;\n}\n\nfunction adminPassword(): string {\n return envOr(\"ADMIN_PASSWORD\", \"Insideoutsports123\");\n}\n\nfunction adminEmail(): string {\n return envOr(\"ADMIN_EMAIL\", \"insideoutsportsuk@gmail.com\").toLowerCase();\n}\n\n/* ----------------------------------------------------------------------------\n * SEED DATA\n * -------------------------------------------------------------------------- */\n\nfunction seed(): any {\n const now = Date.now();\n return {\n stats: [\n { id: \"s1\", label: \"Athletes under management\", value: 184, suffix: \"+\" },\n { id: \"s2\", label: \"Sports properties operated\", value: 26, suffix: \"\" },\n { id: \"s3\", label: \"Brand deals closed\", value: 340, suffix: \"+\" },\n { id: \"s4\", label: \"Contract renewal rate\", value: 96, suffix: \"%\" },\n ],\n partners: [\n { id: \"p1\", name: \"Apex Hydration\", logo: \"\", sector: \"Sports nutrition\" },\n { id: \"p2\", name: \"Vertex Motors\", logo: \"\", sector: \"Automotive\" },\n { id: \"p3\", name: \"Northbank Financial\", logo: \"\", sector: \"Banking\" },\n { id: \"p4\", name: \"Kite Telecom\", logo: \"\", sector: \"Telecom\" },\n { id: \"p5\", name: \"Halcyon Airways\", logo: \"\", sector: \"Aviation\" },\n { id: \"p6\", name: \"Foundry Athletic\", logo: \"\", sector: \"Footwear\" },\n { id: \"p7\", name: \"Meridian Broadcast\", logo: \"\", sector: \"Media rights\" },\n { id: \"p8\", name: \"Sable Energy\", logo: \"\", sector: \"Energy\" },\n ],\n players: [\n {\n id: \"a1\", ref: \"IO-7HF2QK\", status: \"approved\", featured: true,\n fullName: \"Zain Ul Abideen\", email: \"zain@example.com\", phone: \"+92 300 0000001\",\n country: \"Pakistan\", city: \"Lahore\", sport: \"Cricket\", position: \"Right-arm fast bowler\",\n level: \"First-class\", club: \"Lahore Qalandars Academy\", dob: \"2002-04-11\",\n height: \"188\", weight: \"82\", instagram: \"@zain.pace\", youtube: \"\", highlight: \"\",\n bio: \"Express pace bowler with a four-season first-class record and a top speed of 146 kph.\",\n createdAt: now - 86400000 * 42, decidedAt: now - 86400000 * 35,\n },\n {\n id: \"a2\", ref: \"IO-3PLX9M\", status: \"approved\", featured: true,\n fullName: \"Amara Okonkwo\", email: \"amara@example.com\", phone: \"+234 802 0000002\",\n country: \"Nigeria\", city: \"Lagos\", sport: \"Athletics\", position: \"400m hurdles\",\n level: \"International\", club: \"Lagos Track Club\", dob: \"2001-09-02\",\n height: \"175\", weight: \"63\", instagram: \"@amararuns\", youtube: \"\", highlight: \"\",\n bio: \"National record holder at 400m hurdles and a two-time continental medallist.\",\n createdAt: now - 86400000 * 61, decidedAt: now - 86400000 * 54,\n },\n {\n id: \"a3\", ref: \"IO-5KD8TR\", status: \"approved\", featured: true,\n fullName: \"Diego Marchetti\", email: \"diego@example.com\", phone: \"+39 340 0000003\",\n country: \"Italy\", city: \"Turin\", sport: \"Football\", position: \"Attacking midfielder\",\n level: \"Professional\", club: \"Serie B side\", dob: \"2003-01-27\",\n height: \"179\", weight: \"72\", instagram: \"@d.marchetti\", youtube: \"\", highlight: \"\",\n bio: \"Left-footed playmaker, 14 goal contributions last season, out of contract in June.\",\n createdAt: now - 86400000 * 28, decidedAt: now - 86400000 * 20,\n },\n {\n id: \"a4\", ref: \"IO-9WQ4ZC\", status: \"pending\", featured: false,\n fullName: \"Hina Raza\", email: \"hina@example.com\", phone: \"+92 321 0000004\",\n country: \"Pakistan\", city: \"Karachi\", sport: \"Squash\", position: \"Singles\",\n level: \"National\", club: \"Karachi Squash Complex\", dob: \"2005-06-19\",\n height: \"168\", weight: \"58\", instagram: \"@hina.squash\", youtube: \"\", highlight: \"\",\n bio: \"Junior national champion looking for international tour representation.\",\n createdAt: now - 86400000 * 3, decidedAt: 0,\n },\n ],\n team: [\n { id: \"t1\", email: \"founder@insideout.sport\", name: \"Founder\", role: \"Owner\", invitedAt: now - 86400000 * 200 },\n { id: \"t2\", email: \"ops@insideout.sport\", name: \"Operations\", role: \"Manager\", invitedAt: now - 86400000 * 120 },\n ],\n testimonials: [\n { id: \"q1\", quote: \"They renegotiated my contract in eleven days and found me a boot deal I did not know existed. I train, they handle the rest.\", name: \"Diego Marchetti\", role: \"Attacking midfielder\" },\n { id: \"q2\", quote: \"Insideout treated a women's squash career like a serious commercial asset. Nobody else in the region was doing that.\", name: \"Hina Raza\", role: \"National squash champion\" },\n { id: \"q3\", quote: \"We ran a six-city grassroots property with them. Clean operations, on-time reporting, and the sponsor renewed for three years.\", name: \"Apex Hydration\", role: \"Regional marketing lead\" },\n ],\n news: [\n { id: \"n1\", date: \"2026-08-14\", tag: \"Signing\", title: \"Three first-class cricketers join the management roster\", excerpt: \"The pace trio signs multi-year representation covering playing contracts, endorsements and image rights.\" },\n { id: \"n2\", date: \"2026-07-02\", tag: \"Property\", title: \"Insideout to operate the Northbank Youth League for a third season\", excerpt: \"Twelve clubs, 240 fixtures and a broadcast package now handled end to end by the operations wing.\" },\n { id: \"n3\", date: \"2026-05-23\", tag: \"Sportswear\", title: \"Insideout Sportswear opens its performance kit line to club orders\", excerpt: \"Custom match kits, training wear and travel sets, produced in-house with a four-week turnaround.\" },\n ],\n stars: [],\n teams: [],\n reviews: [],\n banners: [],\n brand: { mainRev: 0, wearRev: 0 },\n messages: [],\n };\n}\n\n/* ----------------------------------------------------------------------------\n * STORAGE\n * -------------------------------------------------------------------------- */\n\nlet DB: any = null;\nlet blobApi: any = null;\nlet blobTried = false;\n\nasync function getBlob(): Promise {\n if (blobTried) return blobApi;\n blobTried = true;\n try {\n const mod: any = await import(\"https://esm.town/v/std/blob\");\n blobApi = mod.blob;\n } catch (_e) {\n blobApi = null;\n }\n return blobApi;\n}\n\nasync function load(): Promise {\n if (DB) return DB;\n const b = await getBlob();\n if (b) {\n try {\n const saved = await b.getJSON(BLOB_KEY);\n if (saved && saved.stats) {\n if (!Array.isArray(saved.stars)) saved.stars = [];\n if (!Array.isArray(saved.teams)) saved.teams = [];\n if (!Array.isArray(saved.reviews)) saved.reviews = [];\n if (!Array.isArray(saved.banners)) saved.banners = [];\n if (!saved.brand) saved.brand = { mainRev: 0, wearRev: 0 };\n DB = saved;\n return DB;\n }\n } catch (_e) { /* first run */ }\n }\n DB = seed();\n await save();\n return DB;\n}\n\nasync function save(): Promise {\n const b = await getBlob();\n if (!b) return;\n try { await b.setJSON(BLOB_KEY, DB); } catch (_e) { /* read-only env */ }\n}\n\nconst MEM_PHOTOS: Record = {};\n\nasync function photoPut(id: string, type: string, data: string): Promise {\n MEM_PHOTOS[id] = { type, data };\n const b = await getBlob();\n if (!b) return;\n try { await b.setJSON(\"insideout_photo_\" + id, { type, data }); } catch (_e) { /* read-only */ }\n}\n\nasync function photoGet(id: string): Promise {\n if (MEM_PHOTOS[id]) return MEM_PHOTOS[id];\n const b = await getBlob();\n if (!b) return null;\n try {\n const v = await b.getJSON(\"insideout_photo_\" + id);\n if (v && v.data) { MEM_PHOTOS[id] = v; return v; }\n } catch (_e) { /* missing */ }\n return null;\n}\n\nasync function photoDel(id: string): Promise {\n delete MEM_PHOTOS[id];\n const b = await getBlob();\n if (!b) return;\n try { await b.delete(\"insideout_photo_\" + id); } catch (_e) { /* missing */ }\n}\n\n/* ----------------------------------------------------------------------------\n * HELPERS\n * -------------------------------------------------------------------------- */\n\nfunction json(data: any, status = 200): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", \"cache-control\": \"no-store\" },\n });\n}\n\nfunction uid(prefix: string): string {\n return prefix + Math.random().toString(36).slice(2, 9) + Date.now().toString(36).slice(-4);\n}\n\nfunction refCode(): string {\n const alphabet = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n let out = \"\";\n for (let i = 0; i < 6; i++) out += alphabet[Math.floor(Math.random() * alphabet.length)];\n return \"IO-\" + out;\n}\n\nfunction clean(v: any, max = 500): string {\n return String(v == null ? \"\" : v).trim().slice(0, max);\n}\n\nfunction tokenFor(pw: string): string {\n const bytes = new TextEncoder().encode(pw);\n let bin = \"\";\n for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);\n return \"io.\" + btoa(bin);\n}\n\nfunction authorised(req: Request): boolean {\n const h = req.headers.get(\"authorization\") || \"\";\n const t = h.replace(/^Bearer\\s+/i, \"\").trim();\n return t.length > 0 && t === tokenFor(adminEmail() + \":\" + adminPassword());\n}\n\nfunction publicPayload(db: any): any {\n return {\n stats: db.stats,\n partners: db.partners,\n testimonials: db.testimonials,\n news: db.news,\n stars: (db.stars || []).slice().sort((a: any, b: any) => (a.order || 0) - (b.order || 0)),\n teams: (db.teams || []).slice()\n .sort((a: any, b: any) => (a.order || 0) - (b.order || 0))\n .map((t: any) => ({ id: t.id, name: t.name, sport: t.sport, note: t.note, order: t.order })),\n reviews: (db.reviews || []).filter((r: any) => r.status === \"approved\"),\n banners: (db.banners || []).slice().sort((a: any, b: any) => (a.order || 0) - (b.order || 0)),\n brand: db.brand || { mainRev: 0, wearRev: 0 },\n roster: db.players\n .filter((p: any) => p.status === \"approved\")\n .map((p: any) => ({\n id: p.id, fullName: p.fullName, sport: p.sport, position: p.position,\n country: p.country, level: p.level, club: p.club, bio: p.bio,\n instagram: p.instagram, featured: !!p.featured,\n })),\n };\n}\n\n/* ----------------------------------------------------------------------------\n * API\n * -------------------------------------------------------------------------- */\n\nasync function api(req: Request, path: string): Promise {\n const db = await load();\n\n if (path.startsWith(\"/api/photo/\") && req.method === \"GET\") {\n const key = path.slice(11);\n let ph = await photoGet(key);\n if (!ph && key === \"logo-main\") ph = { type: \"image/jpeg\", data: LOGO_MAIN };\n if (!ph && key === \"logo-wear\") ph = { type: \"image/jpeg\", data: LOGO_WEAR };\n if (!ph) return json({ ok: false, error: \"Not found.\" }, 404);\n const bin = atob(ph.data);\n const bytes = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);\n return new Response(bytes, {\n headers: { \"content-type\": ph.type, \"cache-control\": \"public, max-age=86400\" },\n });\n }\n\n if (path === \"/api/public\" && req.method === \"GET\") {\n return json({ ok: true, data: publicPayload(db) });\n }\n\n if (path === \"/api/register\" && req.method === \"POST\") {\n const b = await req.json().catch(() => ({}));\n const fullName = clean(b.fullName, 120);\n const email = clean(b.email, 160).toLowerCase();\n const sport = clean(b.sport, 80);\n if (!fullName || !email || !sport) {\n return json({ ok: false, error: \"Name, email and sport are required.\" }, 400);\n }\n if (!/^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(email)) {\n return json({ ok: false, error: \"That email address is not valid.\" }, 400);\n }\n const existing = db.players.find((p: any) => p.email === email);\n if (existing) {\n return json({ ok: false, error: \"An application already exists for this email. Reference \" + existing.ref + \".\" }, 409);\n }\n const player = {\n id: uid(\"a_\"), ref: refCode(), status: \"pending\", featured: false,\n fullName, email,\n phone: clean(b.phone, 40), country: clean(b.country, 80), city: clean(b.city, 80),\n sport, position: clean(b.position, 80), level: clean(b.level, 60), club: clean(b.club, 120),\n dob: clean(b.dob, 20), height: clean(b.height, 10), weight: clean(b.weight, 10),\n instagram: clean(b.instagram, 120), youtube: clean(b.youtube, 200),\n highlight: clean(b.highlight, 300), bio: clean(b.bio, 1200),\n createdAt: Date.now(), decidedAt: 0,\n };\n db.players.unshift(player);\n await save();\n return json({ ok: true, ref: player.ref });\n }\n\n if (path === \"/api/track\" && req.method === \"POST\") {\n const b = await req.json().catch(() => ({}));\n const key = clean(b.key, 160).toLowerCase();\n if (!key) return json({ ok: false, error: \"Enter your reference code or email.\" }, 400);\n const p = db.players.find((x: any) =>\n x.ref.toLowerCase() === key || x.email.toLowerCase() === key\n );\n if (!p) return json({ ok: false, error: \"No application found for that reference or email.\" }, 404);\n return json({\n ok: true,\n player: {\n ref: p.ref, status: p.status, fullName: p.fullName, email: p.email, sport: p.sport,\n position: p.position, level: p.level, club: p.club, country: p.country, city: p.city,\n createdAt: p.createdAt, decidedAt: p.decidedAt, bio: p.bio,\n },\n });\n }\n\n if (path === \"/api/contact\" && req.method === \"POST\") {\n const b = await req.json().catch(() => ({}));\n const name = clean(b.name, 120);\n const email = clean(b.email, 160);\n const body = clean(b.message, 2000);\n if (!name || !email || !body) return json({ ok: false, error: \"Fill in every field before sending.\" }, 400);\n db.messages.unshift({ id: uid(\"m_\"), name, email, subject: clean(b.subject, 160), message: body, createdAt: Date.now() });\n db.messages = db.messages.slice(0, 300);\n await save();\n return json({ ok: true });\n }\n\n if (path === \"/api/review\" && req.method === \"POST\") {\n const b = await req.json().catch(() => ({}));\n const name = clean(b.name, 90);\n const text = clean(b.text, 900);\n if (!name || !text) return json({ ok: false, error: \"Add your name and your review.\" }, 400);\n if (!Array.isArray(db.reviews)) db.reviews = [];\n db.reviews.unshift({\n id: uid(\"rv\"), name, role: clean(b.role, 90), team: clean(b.team, 90),\n rating: Math.min(5, Math.max(1, Number(b.rating) || 5)),\n text, status: \"pending\", createdAt: Date.now(),\n });\n await save();\n return json({ ok: true });\n }\n\n if (path === \"/api/leader/login\" && req.method === \"POST\") {\n const b = await req.json().catch(() => ({}));\n const key = clean(b.key, 40).toUpperCase();\n const t = (db.teams || []).find((x: any) => x.key && x.key.toUpperCase() === key);\n if (!t) return json({ ok: false, error: \"That access key is not valid.\" }, 401);\n return json({ ok: true, token: tokenFor(\"leader:\" + t.id + \":\" + t.key), team: { id: t.id, name: t.name, sport: t.sport } });\n }\n\n if (path === \"/api/leader\" && req.method === \"POST\") {\n const b = await req.json().catch(() => ({}));\n const h = req.headers.get(\"authorization\") || \"\";\n const tok = h.replace(/^Bearer\\s+/i, \"\").trim();\n const t = (db.teams || []).find((x: any) => x.key && tokenFor(\"leader:\" + x.id + \":\" + x.key) === tok);\n if (!t) return json({ ok: false, error: \"Session expired. Sign in with your key again.\" }, 401);\n const act = clean(b.action, 40);\n const d = b.payload || {};\n\n if (act === \"data\") {\n return json({\n ok: true,\n team: { id: t.id, name: t.name, sport: t.sport, note: t.note },\n players: (db.stars || []).filter((p: any) => p.teamId === t.id),\n });\n }\n\n if (act === \"star.save\") {\n const st = d.star || {};\n const sid = clean(st.id, 40) || uid(\"st\");\n const nm = clean(st.name, 90);\n if (!nm) return json({ ok: false, error: \"Player name is required.\" }, 400);\n const ex = (db.stars || []).find((x: any) => x.id === sid);\n if (ex && ex.teamId !== t.id) return json({ ok: false, error: \"That player belongs to another team.\" }, 403);\n let hasPhoto = ex ? !!ex.photo : false;\n const img = typeof st.photoData === \"string\" ? st.photoData : \"\";\n if (img) {\n const m = img.match(/^data:(image\\/[a-z+]+);base64,(.+)$/i);\n if (!m) return json({ ok: false, error: \"That file is not a supported image.\" }, 400);\n if (m[2].length > 900000) return json({ ok: false, error: \"That image is too large.\" }, 400);\n await photoPut(sid, m[1], m[2]);\n hasPhoto = true;\n }\n const rec = {\n id: sid, name: nm, country: clean(st.country, 90), teamId: t.id,\n stats: clean(st.stats, 800), photo: hasPhoto, rev: Date.now(),\n order: Number(st.order) || 0,\n };\n if (ex) Object.assign(ex, rec); else db.stars.push(rec);\n await save();\n return json({ ok: true, players: db.stars.filter((p: any) => p.teamId === t.id) });\n }\n\n if (act === \"star.remove\") {\n const sid = clean(d.id, 40);\n const ex = (db.stars || []).find((x: any) => x.id === sid);\n if (!ex || ex.teamId !== t.id) return json({ ok: false, error: \"That player is not on your team.\" }, 403);\n db.stars = db.stars.filter((x: any) => x.id !== sid);\n await photoDel(sid);\n await save();\n return json({ ok: true, players: db.stars.filter((p: any) => p.teamId === t.id) });\n }\n\n return json({ ok: false, error: \"Unknown action.\" }, 400);\n }\n\n if (path === \"/api/admin/login\" && req.method === \"POST\") {\n const b = await req.json().catch(() => ({}));\n const em = clean(b.email, 200).toLowerCase();\n if (em !== adminEmail() || clean(b.password, 200) !== adminPassword()) {\n return json({ ok: false, error: \"Wrong email or password.\" }, 401);\n }\n return json({ ok: true, token: tokenFor(adminEmail() + \":\" + adminPassword()) });\n }\n\n if (path === \"/api/admin\" && req.method === \"POST\") {\n if (!authorised(req)) return json({ ok: false, error: \"Not signed in.\" }, 401);\n const b = await req.json().catch(() => ({}));\n const action = clean(b.action, 60);\n const d = b.payload || {};\n\n if (action === \"data\") {\n return json({ ok: true, data: {\n stats: db.stats, partners: db.partners, players: db.players, team: db.team,\n messages: db.messages, news: db.news, stars: db.stars || [], teams: db.teams || [],\n reviews: db.reviews || [], banners: db.banners || [], brand: db.brand || {},\n } });\n }\n\n if (action === \"stats.save\") {\n const rows = Array.isArray(d.stats) ? d.stats : [];\n db.stats = rows.slice(0, 8).map((s: any, i: number) => ({\n id: clean(s.id, 20) || \"s\" + (i + 1),\n label: clean(s.label, 60) || \"Metric\",\n value: Math.max(0, Math.min(9999999, Number(s.value) || 0)),\n suffix: clean(s.suffix, 4),\n }));\n await save();\n return json({ ok: true, stats: db.stats });\n }\n\n if (action === \"stat.add\") {\n if (db.stats.length >= 8) return json({ ok: false, error: \"Maximum of eight metrics.\" }, 400);\n db.stats.push({ id: uid(\"s_\"), label: \"New metric\", value: 0, suffix: \"\" });\n await save();\n return json({ ok: true, stats: db.stats });\n }\n\n if (action === \"stat.remove\") {\n db.stats = db.stats.filter((s: any) => s.id !== clean(d.id, 40));\n await save();\n return json({ ok: true, stats: db.stats });\n }\n\n if (action === \"partner.save\") {\n const name = clean(d.name, 80);\n if (!name) return json({ ok: false, error: \"Partner name is required.\" }, 400);\n const id = clean(d.id, 40) || uid(\"p_\");\n const found = db.partners.find((p: any) => p.id === id) || null;\n let up = found ? !!found.upload : false;\n const img = typeof d.photoData === \"string\" ? d.photoData : \"\";\n if (img) {\n const m = img.match(/^data:(image\\/[a-z+]+);base64,(.+)$/i);\n if (!m) return json({ ok: false, error: \"That file is not a supported image.\" }, 400);\n if (m[2].length > 900000) return json({ ok: false, error: \"That image is too large.\" }, 400);\n await photoPut(id, m[1], m[2]);\n up = true;\n }\n const rec = {\n id, name, logo: clean(d.logo, 500), sector: clean(d.sector, 80),\n upload: up, rev: Date.now(),\n };\n if (found) Object.assign(found, rec); else db.partners.push(rec);\n await save();\n return json({ ok: true, partners: db.partners });\n }\n\n if (action === \"partner.remove\") {\n const pid = clean(d.id, 40);\n await photoDel(pid);\n db.partners = db.partners.filter((p: any) => p.id !== pid);\n await save();\n return json({ ok: true, partners: db.partners });\n }\n\n if (action === \"star.save\") {\n const st = d.star || {};\n const sid = clean(st.id, 40) || uid(\"st\");\n const name = clean(st.name, 90);\n if (!name) return json({ ok: false, error: \"Player name is required.\" }, 400);\n if (!Array.isArray(db.stars)) db.stars = [];\n const existing = db.stars.find((x: any) => x.id === sid);\n let hasPhoto = existing ? !!existing.photo : false;\n const img = typeof st.photoData === \"string\" ? st.photoData : \"\";\n if (img) {\n const m = img.match(/^data:(image\\/[a-z+]+);base64,(.+)$/i);\n if (!m) return json({ ok: false, error: \"That file is not a supported image.\" }, 400);\n if (m[2].length > 900000) return json({ ok: false, error: \"That image is too large.\" }, 400);\n await photoPut(sid, m[1], m[2]);\n hasPhoto = true;\n }\n const rec = {\n id: sid,\n name,\n country: clean(st.country, 90),\n teamId: clean(st.teamId, 40),\n stats: clean(st.stats, 800),\n photo: hasPhoto,\n rev: Date.now(),\n order: Number(st.order) || 0,\n };\n if (existing) Object.assign(existing, rec);\n else db.stars.push(rec);\n await save();\n return json({ ok: true, stars: db.stars });\n }\n\n if (action === \"star.remove\") {\n const sid = clean(d.id, 40);\n db.stars = (db.stars || []).filter((x: any) => x.id !== sid);\n await photoDel(sid);\n await save();\n return json({ ok: true, stars: db.stars });\n }\n\n if (action === \"squad.save\") {\n const t = d.team || {};\n const tid = clean(t.id, 40) || uid(\"tm\");\n const nm = clean(t.name, 90);\n if (!nm) return json({ ok: false, error: \"Team name is required.\" }, 400);\n if (!Array.isArray(db.teams)) db.teams = [];\n const ex = db.teams.find((x: any) => x.id === tid);\n const rec: any = {\n id: tid, name: nm, sport: clean(t.sport, 60),\n note: clean(t.note, 400), order: Number(t.order) || 0,\n key: ex ? ex.key : \"\", keyIssued: ex ? ex.keyIssued : 0,\n };\n if (ex) Object.assign(ex, rec); else db.teams.push(rec);\n await save();\n return json({ ok: true, teams: db.teams });\n }\n\n if (action === \"squad.remove\") {\n const tid = clean(d.id, 40);\n db.teams = (db.teams || []).filter((x: any) => x.id !== tid);\n (db.stars || []).forEach((p: any) => { if (p.teamId === tid) p.teamId = \"\"; });\n await save();\n return json({ ok: true, teams: db.teams, stars: db.stars });\n }\n\n if (action === \"squad.key\") {\n const t = (db.teams || []).find((x: any) => x.id === clean(d.id, 40));\n if (!t) return json({ ok: false, error: \"Team not found.\" }, 404);\n if (d.revoke) { t.key = \"\"; t.keyIssued = 0; }\n else {\n const alphabet = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n let k = \"\";\n for (let i = 0; i < 10; i++) k += alphabet[Math.floor(Math.random() * alphabet.length)];\n t.key = \"IO-\" + k.slice(0, 5) + \"-\" + k.slice(5);\n t.keyIssued = Date.now();\n }\n await save();\n return json({ ok: true, teams: db.teams });\n }\n\n if (action === \"review.status\") {\n const r = (db.reviews || []).find((x: any) => x.id === clean(d.id, 40));\n if (!r) return json({ ok: false, error: \"Review not found.\" }, 404);\n r.status = d.status === \"approved\" ? \"approved\" : \"denied\";\n await save();\n return json({ ok: true, reviews: db.reviews });\n }\n\n if (action === \"review.remove\") {\n db.reviews = (db.reviews || []).filter((x: any) => x.id !== clean(d.id, 40));\n await save();\n return json({ ok: true, reviews: db.reviews });\n }\n\n if (action === \"banner.save\") {\n const bid = clean(d.id, 40) || uid(\"bn\");\n const img = typeof d.photoData === \"string\" ? d.photoData : \"\";\n const ex = (db.banners || []).find((x: any) => x.id === bid);\n if (img) {\n const m = img.match(/^data:(image\\/[a-z+]+);base64,(.+)$/i);\n if (!m) return json({ ok: false, error: \"That file is not a supported image.\" }, 400);\n if (m[2].length > 2200000) return json({ ok: false, error: \"That image is too large.\" }, 400);\n await photoPut(bid, m[1], m[2]);\n } else if (!ex) {\n return json({ ok: false, error: \"Choose an image to upload.\" }, 400);\n }\n const rec = {\n id: bid, caption: clean(d.caption, 160), link: clean(d.link, 300),\n order: Number(d.order) || 0, rev: Date.now(),\n };\n if (ex) Object.assign(ex, rec); else db.banners.push(rec);\n await save();\n return json({ ok: true, banners: db.banners });\n }\n\n if (action === \"banner.remove\") {\n const bid = clean(d.id, 40);\n db.banners = (db.banners || []).filter((x: any) => x.id !== bid);\n await photoDel(bid);\n await save();\n return json({ ok: true, banners: db.banners });\n }\n\n if (action === \"brand.logo\") {\n const which = d.which === \"wear\" ? \"wear\" : \"main\";\n const img = typeof d.photoData === \"string\" ? d.photoData : \"\";\n if (!img) return json({ ok: false, error: \"Choose an image to upload.\" }, 400);\n const m = img.match(/^data:(image\\/[a-z+]+);base64,(.+)$/i);\n if (!m) return json({ ok: false, error: \"That file is not a supported image.\" }, 400);\n if (m[2].length > 900000) return json({ ok: false, error: \"That image is too large.\" }, 400);\n await photoPut(\"logo-\" + which, m[1], m[2]);\n if (!db.brand) db.brand = { mainRev: 0, wearRev: 0 };\n db.brand[which === \"wear\" ? \"wearRev\" : \"mainRev\"] = Date.now();\n await save();\n return json({ ok: true, brand: db.brand });\n }\n\n if (action === \"brand.reset\") {\n const which = d.which === \"wear\" ? \"wear\" : \"main\";\n await photoDel(\"logo-\" + which);\n if (!db.brand) db.brand = { mainRev: 0, wearRev: 0 };\n db.brand[which === \"wear\" ? \"wearRev\" : \"mainRev\"] = 0;\n await save();\n return json({ ok: true, brand: db.brand });\n }\n\n if (action === \"team.add\") {\n const email = clean(d.email, 160).toLowerCase();\n if (!/^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(email)) return json({ ok: false, error: \"Enter a valid email address.\" }, 400);\n if (db.team.find((t: any) => t.email === email)) return json({ ok: false, error: \"That person is already on the team.\" }, 409);\n db.team.push({ id: uid(\"t_\"), email, name: clean(d.name, 80) || email.split(\"@\")[0], role: clean(d.role, 40) || \"Staff\", invitedAt: Date.now() });\n await save();\n return json({ ok: true, team: db.team });\n }\n\n if (action === \"team.remove\") {\n db.team = db.team.filter((t: any) => t.id !== clean(d.id, 40));\n await save();\n return json({ ok: true, team: db.team });\n }\n\n if (action === \"player.status\") {\n const p = db.players.find((x: any) => x.id === clean(d.id, 40));\n if (!p) return json({ ok: false, error: \"Application not found.\" }, 404);\n const status = clean(d.status, 20);\n if ([\"pending\", \"approved\", \"denied\"].indexOf(status) < 0) return json({ ok: false, error: \"Unknown status.\" }, 400);\n p.status = status;\n p.decidedAt = status === \"pending\" ? 0 : Date.now();\n if (status !== \"approved\") p.featured = false;\n await save();\n return json({ ok: true, players: db.players });\n }\n\n if (action === \"player.feature\") {\n const p = db.players.find((x: any) => x.id === clean(d.id, 40));\n if (!p) return json({ ok: false, error: \"Application not found.\" }, 404);\n if (p.status !== \"approved\") return json({ ok: false, error: \"Approve the athlete before featuring them.\" }, 400);\n p.featured = !p.featured;\n await save();\n return json({ ok: true, players: db.players });\n }\n\n if (action === \"player.remove\") {\n db.players = db.players.filter((x: any) => x.id !== clean(d.id, 40));\n await save();\n return json({ ok: true, players: db.players });\n }\n\n if (action === \"news.add\") {\n const title = clean(d.title, 160);\n if (!title) return json({ ok: false, error: \"Headline is required.\" }, 400);\n db.news.unshift({\n id: uid(\"n_\"),\n date: clean(d.date, 20) || new Date().toISOString().slice(0, 10),\n tag: clean(d.tag, 30) || \"Update\",\n title,\n excerpt: clean(d.excerpt, 400),\n });\n db.news = db.news.slice(0, 24);\n await save();\n return json({ ok: true, news: db.news });\n }\n\n if (action === \"news.remove\") {\n db.news = db.news.filter((n: any) => n.id !== clean(d.id, 40));\n await save();\n return json({ ok: true, news: db.news });\n }\n\n if (action === \"message.remove\") {\n db.messages = db.messages.filter((m: any) => m.id !== clean(d.id, 40));\n await save();\n return json({ ok: true, messages: db.messages });\n }\n\n if (action === \"reset\") {\n DB = seed();\n await save();\n return json({ ok: true });\n }\n\n return json({ ok: false, error: \"Unknown action.\" }, 400);\n }\n\n return json({ ok: false, error: \"Route not found.\" }, 404);\n}\n\n/* ----------------------------------------------------------------------------\n * PAGE\n * -------------------------------------------------------------------------- */\n\nconst PAGE = SHELL + \"