[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_104":105,"_106":107},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","AyanAfzal","name","TheAgents","path","main.ts","project",{"_22":46,"_11":12,"_33":47,"_48":-5,"_49":42,"_50":51,"_52":51,"_53":54,"_55":-5,"_56":57,"_58":25,"_59":32,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_13":45},"permalink","https://www.val.town/x/AyanAfzal/TheAgents/code/main.ts","extension","id","117161a4-c9c4-4247-9102-f6c8f7e1d52d","fileId","bbc8531e-ae7c-11f1-af98-1607ee4eb77e","parentId","branchId","ffa65750-a2bb-44f4-bf59-b45deb4c8118","branchVersion",73,"latest",true,"createdAt",["D",1789293374613],"version",19,"fileType","http","content","/**\n * THE AGENTS — creator-services marketplace. Single Val Town HTTP val.\n *\n * SETUP\n * 1. Paste into a new HTTP val, save. Tables self-create on first request.\n * 2. Env vars: ADMIN_EMAIL, ADMIN_PASSWORD. Unset = the fallbacks below.\n *\n * SECURITY: the fallback password sits in source — anyone who can read this\n * val owns the admin account. Set ADMIN_PASSWORD as an env var and change the\n * fallback to junk. Passwords are stored PBKDF2-SHA256 / 150k / per-user salt;\n * changing the env var re-hashes the admin row on the next request.\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { CONFIG, PAGE } from \"./page.ts\";\n\n/* ================================================================== */\n/* config */\n/* ================================================================== */\n\nconst ADMIN_EMAIL = (Deno.env.get(\"ADMIN_EMAIL\") || \"rayandnp@gmail.com\")\n .toLowerCase();\nconst ADMIN_PASSWORD = Deno.env.get(\"ADMIN_PASSWORD\") || \"Ayan9823\";\nconst ADMIN_NAME = \"Ayan\";\n\nconst T = {\n users: \"users\",\n orders: \"orders\",\n listings: \"listings\",\n requests: \"seller_requests\",\n sessions: \"ta_sessions\",\n};\n\n/** House packages. Prices live server-side so the client can't set its own. */\nconst PACKAGES: Record = {\n starter: { title: \"Starter — 1,000 watch hours\", price: 11500 },\n creator: { title: \"Creator — 4,000 hours + 1,000 subscribers\", price: 42000 },\n pro: { title: \"Pro — monetization + 90 days of growth\", price: 78000 },\n monetization: { title: \"YouTube monetization pack\", price: 42000 },\n watchhours: { title: \"Watch hours package\", price: 11500 },\n subscribers: { title: \"Subscribers package\", price: 9000 },\n views: { title: \"Views package\", price: 6500 },\n shorts: { title: \"Shorts growth package\", price: 14000 },\n channel: { title: \"Channel growth package\", price: 25000 },\n};\n\n/* ================================================================== */\n/* sqlite helpers */\n/* ================================================================== */\n\ntype Row = Record;\n\nasync function q(sql: string, args: any[] = []): Promise {\n const res: any = await sqlite.execute({ sql, args });\n const cols: string[] = res?.columns ?? [];\n const rows: any[] = res?.rows ?? [];\n return rows.map((r: any) =>\n Array.isArray(r)\n ? Object.fromEntries(cols.map((c, i) => [c, r[i]]))\n : (r as Row)\n );\n}\nasync function run(sql: string, args: any[] = []): Promise {\n return await sqlite.execute({ sql, args });\n}\nasync function one(sql: string, args: any[] = []): Promise {\n const rows = await q(sql, args);\n return rows.length ? rows[0] : null;\n}\n\n/* ================================================================== */\n/* bootstrap */\n/* ================================================================== */\n\nlet ready: Promise | null = null;\nconst init = () => (ready ??= bootstrap());\n\nasync function bootstrap(): Promise {\n await run(`CREATE TABLE IF NOT EXISTS ${T.users} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT NOT NULL,\n email TEXT NOT NULL UNIQUE,\n role TEXT NOT NULL DEFAULT 'buyer',\n pass_hash TEXT NOT NULL,\n pass_salt TEXT NOT NULL,\n created_at TEXT NOT NULL\n )`);\n\n await run(`CREATE TABLE IF NOT EXISTS ${T.sessions} (\n token TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL,\n created_at TEXT NOT NULL\n )`);\n\n await run(`CREATE TABLE IF NOT EXISTS ${T.listings} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n seller_id INTEGER NOT NULL,\n seller_name TEXT NOT NULL,\n title TEXT NOT NULL,\n description TEXT NOT NULL DEFAULT '',\n price REAL NOT NULL DEFAULT 0,\n category TEXT NOT NULL DEFAULT 'Growth',\n wa_link TEXT NOT NULL,\n active INTEGER NOT NULL DEFAULT 1,\n created_at TEXT NOT NULL\n )`);\n\n await run(`CREATE TABLE IF NOT EXISTS ${T.orders} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n sku TEXT NOT NULL UNIQUE,\n listing_id INTEGER,\n package_id TEXT,\n product_title TEXT NOT NULL,\n price REAL NOT NULL DEFAULT 0,\n seller_name TEXT NOT NULL,\n seller_id INTEGER,\n buyer_name TEXT,\n buyer_email TEXT,\n status TEXT NOT NULL DEFAULT 'Pending',\n created_at TEXT NOT NULL\n )`);\n\n await run(`CREATE TABLE IF NOT EXISTS ${T.requests} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n user_id INTEGER NOT NULL,\n name TEXT NOT NULL,\n email TEXT NOT NULL,\n note TEXT DEFAULT '',\n status TEXT NOT NULL DEFAULT 'pending',\n created_at TEXT NOT NULL,\n decided_at TEXT\n )`);\n\n await run(\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_orders_sku ON ${T.orders}(sku)`,\n );\n await run(\n `CREATE INDEX IF NOT EXISTS idx_listings_seller ON ${T.listings}(seller_id)`,\n );\n await run(\n `CREATE INDEX IF NOT EXISTS idx_requests_status ON ${T.requests}(status)`,\n );\n\n await migrate();\n await seedAdmin();\n}\n\n/** Adds columns to tables that already exist in a live database.\n * CREATE TABLE IF NOT EXISTS never alters an existing table, so anything\n * added after your first deploy has to come through here. */\nasync function ensureColumn(\n table: string,\n column: string,\n ddl: string,\n backfill?: string,\n) {\n const cols = await q(`PRAGMA table_info(${table})`);\n if (cols.some((c) => String(c.name) === column)) return;\n await run(`ALTER TABLE ${table} ADD COLUMN ${column} ${ddl}`);\n if (backfill) await run(backfill);\n}\n\nasync function migrate(): Promise {\n // Accounts that existed before verification shipped are grandfathered in —\n // backfilling to 0 would lock out every current user.\n await ensureColumn(\n T.users,\n \"verified\",\n \"INTEGER NOT NULL DEFAULT 1\",\n `UPDATE ${T.users} SET verified = 1`,\n );\n // Verification was removed: clear anyone still stuck behind it.\n await run(\n `UPDATE ${T.users} SET verified = 1, verify_code = NULL WHERE verified = 0`,\n );\n await ensureColumn(T.users, \"banned\", \"INTEGER NOT NULL DEFAULT 0\");\n await ensureColumn(T.users, \"verify_code\", \"TEXT\");\n await ensureColumn(T.users, \"verify_expires\", \"TEXT\");\n await ensureColumn(T.users, \"verify_sent_at\", \"TEXT\");\n await ensureColumn(T.orders, \"updated_at\", \"TEXT\");\n await ensureColumn(T.listings, \"image_key\", \"TEXT\");\n await ensureColumn(T.listings, \"video_key\", \"TEXT\");\n await ensureColumn(T.listings, \"tags\", \"TEXT\");\n}\n\nasync function seedAdmin(): Promise {\n const salt = randomHex(16);\n const hash = await hashPassword(ADMIN_PASSWORD, salt);\n const existing = await one(\n `SELECT id, role, pass_hash, pass_salt FROM ${T.users} WHERE email = ?`,\n [\n ADMIN_EMAIL,\n ],\n );\n\n if (!existing) {\n await run(\n `INSERT INTO ${T.users} (name, email, role, pass_hash, pass_salt, created_at)\n VALUES (?, ?, 'admin', ?, ?, ?)`,\n [ADMIN_NAME, ADMIN_EMAIL, hash, salt, new Date().toISOString()],\n );\n return;\n }\n\n // Keep the admin row in sync with the current ADMIN_PASSWORD env value.\n const current = await hashPassword(\n ADMIN_PASSWORD,\n String(existing.pass_salt),\n );\n if (current !== String(existing.pass_hash) || existing.role !== \"admin\") {\n await run(\n `UPDATE ${T.users} SET role = 'admin', pass_hash = ?, pass_salt = ? WHERE id = ?`,\n [\n hash,\n salt,\n existing.id,\n ],\n );\n }\n // The master account can never be left banned or unverified.\n await run(`UPDATE ${T.users} SET banned = 0, verified = 1 WHERE email = ?`, [\n ADMIN_EMAIL,\n ]);\n}\n\n/* ================================================================== */\n/* crypto + sessions */\n/* ================================================================== */\n\nconst enc = new TextEncoder();\n\nfunction toHex(buf: ArrayBuffer | Uint8Array): string {\n const b = buf instanceof Uint8Array ? buf : new Uint8Array(buf);\n return Array.from(b).map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\nfunction randomHex(bytes: number): string {\n return toHex(crypto.getRandomValues(new Uint8Array(bytes)));\n}\nasync function hashPassword(password: string, salt: string): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n enc.encode(password),\n \"PBKDF2\",\n false,\n [\n \"deriveBits\",\n ],\n );\n const bits = await crypto.subtle.deriveBits(\n {\n name: \"PBKDF2\",\n salt: enc.encode(salt),\n iterations: 150000,\n hash: \"SHA-256\",\n },\n key,\n 256,\n );\n return toHex(bits);\n}\nfunction safeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\nfunction bearer(req: Request): string | null {\n const m = (req.headers.get(\"authorization\") || \"\").match(/^Bearer\\s+(.+)$/i);\n return m ? m[1].trim() : null;\n}\nasync function currentUser(req: Request): Promise {\n const token = bearer(req);\n if (!token) return null;\n return await one(\n `SELECT u.id, u.name, u.email, u.role, u.verified, u.banned FROM ${T.sessions} s\n JOIN ${T.users} u ON u.id = s.user_id WHERE s.token = ? AND u.banned = 0`,\n [token],\n );\n}\nasync function newSession(userId: number): Promise {\n const token = randomHex(32);\n await run(\n `INSERT INTO ${T.sessions} (token, user_id, created_at) VALUES (?, ?, ?)`,\n [\n token,\n userId,\n new Date().toISOString(),\n ],\n );\n return token;\n}\n/** Admin gate: role must be admin AND the email must be the master account. */\nfunction isAdmin(user: Row | null): boolean {\n return !!user && user.role === \"admin\" &&\n String(user.email).toLowerCase() === ADMIN_EMAIL;\n}\nconst canSell = (u: Row | null) =>\n !!u && (u.role === \"approved_seller\" || isAdmin(u));\n\n/* ================================================================== */\n/* WhatsApp link handling */\n/* ================================================================== */\n\n/** wa.me/message/

 links resolve at WhatsApp and drop the query string,\n * so ?text= never arrives. Only wa.me/ and api.whatsapp.com/send?phone=\n * carry a prefilled body. `prefill` tells the client to fall back to clipboard. */\nfunction buildWaUrl(\n  raw: string,\n  message: string,\n): { url: string; prefill: boolean } {\n  const link = (raw || \"\").trim();\n  if (/^\\+?\\d[\\d\\s\\-()]{6,}$/.test(link)) {\n    return {\n      url: `https://wa.me/${link.replace(/\\D/g, \"\")}?text=${\n        encodeURIComponent(message)\n      }`,\n      prefill: true,\n    };\n  }\n  let url: URL;\n  try {\n    url = new URL(link.startsWith(\"http\") ? link : `https://${link}`);\n  } catch {\n    return { url: CONFIG.brandWa, prefill: false };\n  }\n  const host = url.hostname.replace(/^www\\./, \"\");\n  if (host === \"wa.me\" && /^\\/message\\//i.test(url.pathname)) {\n    return { url: url.toString(), prefill: false };\n  }\n  if (host === \"chat.whatsapp.com\") {\n    return { url: url.toString(), prefill: false };\n  }\n  if (host === \"wa.me\" && /^\\/\\+?\\d{6,}$/.test(url.pathname)) {\n    url.searchParams.set(\"text\", message);\n    return { url: url.toString(), prefill: true };\n  }\n  if (\n    (host === \"api.whatsapp.com\" || host === \"web.whatsapp.com\") &&\n    url.searchParams.get(\"phone\")\n  ) {\n    url.searchParams.set(\"text\", message);\n    return { url: url.toString(), prefill: true };\n  }\n  return { url: url.toString(), prefill: false };\n}\n\nfunction validWaLink(raw: string): boolean {\n  const link = (raw || \"\").trim();\n  if (!link) return false;\n  if (/^\\+?\\d[\\d\\s\\-()]{6,}$/.test(link)) return true;\n  try {\n    const host = new URL(link.startsWith(\"http\") ? link : `https://${link}`)\n      .hostname.replace(/^www\\./, \"\");\n    return [\n      \"wa.me\",\n      \"api.whatsapp.com\",\n      \"web.whatsapp.com\",\n      \"chat.whatsapp.com\",\n    ].includes(host);\n  } catch {\n    return false;\n  }\n}\n\n/* ================================================================== */\n/* SKU                                                                */\n/* ================================================================== */\n\nfunction skuCandidate(width = 6): string {\n  const max = Math.pow(10, width);\n  const min = Math.pow(10, width - 1);\n  return `SKU-${\n    (crypto.getRandomValues(new Uint32Array(1))[0] % (max - min)) + min\n  }`;\n}\n\n/** Uniqueness comes from the UNIQUE index, not a prior SELECT — check-then-insert\n * races the moment two buyers tap in the same second. */\nasync function insertOrder(o: {\n  listingId: number | null;\n  packageId: string | null;\n  title: string;\n  price: number;\n  sellerName: string;\n  sellerId: number | null;\n  buyerName: string | null;\n  buyerEmail: string | null;\n}): Promise {\n  const now = new Date().toISOString();\n  for (let i = 0; i < 14; i++) {\n    const sku = skuCandidate(i < 10 ? 6 : 8);\n    try {\n      await run(\n        `INSERT INTO ${T.orders}\n         (sku, listing_id, package_id, product_title, price, seller_name, seller_id,\n          buyer_name, buyer_email, status, created_at)\n         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'Pending', ?)`,\n        [\n          sku,\n          o.listingId,\n          o.packageId,\n          o.title,\n          o.price,\n          o.sellerName,\n          o.sellerId,\n          o.buyerName,\n          o.buyerEmail,\n          now,\n        ],\n      );\n      return sku;\n    } catch (err: any) {\n      if (/UNIQUE|constraint/i.test(String(err?.message || err))) continue;\n      throw err;\n    }\n  }\n  throw new Error(\"Could not allocate a unique SKU\");\n}\n\n/* ================================================================== */\n/* helpers                                                            */\n/* ================================================================== */\n\nconst json = (data: unknown, status = 200) =>\n  new Response(JSON.stringify(data), {\n    status,\n    headers: { \"content-type\": \"application/json; charset=utf-8\" },\n  });\n\nconst htmlRes = (b: string, status = 200) =>\n  new Response(b, {\n    status,\n    headers: { \"content-type\": \"text/html; charset=utf-8\" },\n  });\n\nasync function readBody(req: Request): Promise {\n  try {\n    return (await req.json()) as Row;\n  } catch {\n    return {};\n  }\n}\n\nconst money = (n: number) =>\n  new Intl.NumberFormat(CONFIG.locale, { maximumFractionDigits: 0 }).format(\n    Number(n) || 0,\n  );\n\nconst priceLabel = (n: number) => `${CONFIG.currency} ${money(n)}`;\n\n/** Exact checkout message format. */\nconst orderMessage = (sku: string, title: string, price: number) =>\n  `Order ${sku} - Product: ${title} - Price: ${\n    priceLabel(price)\n  }. Sent from ${CONFIG.brand}. Please confirm this order.`;\n\n/* ================================================================== */\n/* router                                                             */\n/* ================================================================== */\n\nexport default async function (req: Request): Promise {\n  await init();\n  const url = new URL(req.url);\n  const path = url.pathname.replace(/\\/+$/, \"\") || \"/\";\n  const method = req.method.toUpperCase();\n\n  try {\n    if (method === \"GET\" && path === \"/\") return htmlRes(PAGE);\n    if (method === \"GET\" && path === \"/health\") return json({ ok: true });\n    if (method === \"GET\" && path === \"/media/hero.mp4\") {\n      return await heroVideo();\n    }\n    if (method === \"GET\" && path === \"/media/debug\") return await blobDebug();\n    if (method === \"POST\" && path === \"/api/hero-video\") {\n      return await uploadHeroVideo(req);\n    }\n    if (method === \"GET\" && path.startsWith(\"/media/img/\")) {\n      return await listingImage(path);\n    }\n    if (method === \"POST\" && path === \"/api/upload-image\") {\n      return await uploadImage(req);\n    }\n    if (method === \"POST\" && path === \"/api/upload-video\") {\n      return await uploadListingVideo(req);\n    }\n    if (method === \"GET\" && path.startsWith(\"/media/vid/\")) {\n      return await listingVideo(path);\n    }\n\n    if (method === \"POST\" && path === \"/api/register\") {\n      return await register(req);\n    }\n    if (method === \"POST\" && path === \"/api/login\") return await login(req);\n    if (method === \"POST\" && path === \"/api/logout\") return await logout(req);\n    if (method === \"GET\" && path === \"/api/me\") return await me(req);\n\n    if (method === \"GET\" && path === \"/api/listings\") {\n      return await getListings();\n    }\n    if (method === \"GET\" && path === \"/api/stats\") return await publicStats();\n    if (method === \"POST\" && path === \"/api/listings\") {\n      return await createListing(req);\n    }\n    if (method === \"POST\" && path === \"/api/listings/delete\") {\n      return await deleteListing(req);\n    }\n\n    if (\n      method === \"POST\" &&\n      (path === \"/create-order\" || path === \"/api/create-order\")\n    ) {\n      return await createOrder(req);\n    }\n\n    if (method === \"POST\" && path === \"/api/request-seller\") {\n      return await requestSeller(req);\n    }\n    if (method === \"GET\" && path === \"/api/my-orders\") {\n      return await myOrders(req);\n    }\n    if (method === \"GET\" && path === \"/api/seller-orders\") {\n      return await sellerOrders(req);\n    }\n    if (method === \"POST\" && path === \"/api/order-status\") {\n      return await setOrderStatus(req);\n    }\n\n    if (method === \"GET\" && path === \"/api/admin/pending-sellers\") {\n      return await pendingSellers(req);\n    }\n    if (method === \"POST\" && path === \"/api/admin/approve-seller\") {\n      return await approveSeller(req);\n    }\n    if (method === \"GET\" && path === \"/api/admin/orders\") {\n      return await adminOrders(req);\n    }\n    if (method === \"GET\" && path === \"/api/admin/users\") {\n      return await adminUsers(req);\n    }\n    if (method === \"POST\" && path === \"/api/admin/user-action\") {\n      return await adminUserAction(req);\n    }\n\n    return json({ error: \"Not found\" }, 404);\n  } catch (err: any) {\n    console.error(err);\n    return json(\n      { error: \"Server error\", detail: String(err?.message || err) },\n      500,\n    );\n  }\n}\n\n/* ================================================================== */\n/* auth                                                               */\n/* ================================================================== */\n\nasync function register(req: Request): Promise {\n  const b = await readBody(req);\n  const name = String(b.name || \"\").trim();\n  const email = String(b.email || \"\").trim().toLowerCase();\n  const password = String(b.password || \"\");\n\n  if (name.length < 2) return json({ error: \"Enter your full name.\" }, 400);\n  if (!/^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(email)) {\n    return json({ error: \"That email isn't valid.\" }, 400);\n  }\n  if (password.length < 6) {\n    return json({ error: \"Use at least 6 characters.\" }, 400);\n  }\n  if (email === ADMIN_EMAIL) {\n    return json({ error: \"That account already exists. Log in instead.\" }, 409);\n  }\n\n  if (await one(`SELECT id FROM ${T.users} WHERE email = ?`, [email])) {\n    return json({\n      error: \"An account already uses that email. Log in instead.\",\n    }, 409);\n  }\n\n  const salt = randomHex(16);\n  const hash = await hashPassword(password, salt);\n  await run(\n    `INSERT INTO ${T.users} (name, email, role, pass_hash, pass_salt, created_at, verified)\n     VALUES (?, ?, 'buyer', ?, ?, ?, 1)`,\n    [name, email, hash, salt, new Date().toISOString()],\n  );\n  const user = await one(\n    `SELECT id, name, email, role FROM ${T.users} WHERE email = ?`,\n    [email],\n  );\n  return json({\n    success: true,\n    token: await newSession(Number(user!.id)),\n    user,\n  });\n}\n\nasync function login(req: Request): Promise {\n  const b = await readBody(req);\n  const email = String(b.email || \"\").trim().toLowerCase();\n  const password = String(b.password || \"\");\n  const row = await one(\n    `SELECT id, name, email, role, verified, banned, pass_hash, pass_salt FROM ${T.users} WHERE email = ?`,\n    [email],\n  );\n  const generic = json({ error: \"Email or password is wrong.\" }, 401);\n  if (!row) return generic;\n  if (Number(row.banned) === 1) {\n    return json({ error: \"This account is suspended. Contact support.\" }, 403);\n  }\n  const hash = await hashPassword(password, String(row.pass_salt));\n  if (!safeEqual(hash, String(row.pass_hash))) return generic;\n  return json({\n    success: true,\n    token: await newSession(Number(row.id)),\n    user: { id: row.id, name: row.name, email: row.email, role: row.role },\n  });\n}\n\nasync function logout(req: Request): Promise {\n  const token = bearer(req);\n  if (token) await run(`DELETE FROM ${T.sessions} WHERE token = ?`, [token]);\n  return json({ success: true });\n}\n\nasync function me(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ user: null });\n  const pending = await one(\n    `SELECT id FROM ${T.requests} WHERE user_id = ? AND status = 'pending'`,\n    [user.id],\n  );\n  return json({\n    user: { id: user.id, name: user.name, email: user.email, role: user.role },\n    admin: isAdmin(user),\n    canSell: canSell(user),\n    sellerRequestPending: !!pending,\n  });\n}\n\n/* ================================================================== */\n/* listings                                                           */\n/* ================================================================== */\n\nasync function getListings(): Promise {\n  const listings = await q(\n    `SELECT l.id, l.title, l.description, l.price, l.category, l.seller_name, l.seller_id, l.image_key, l.video_key, l.tags, l.created_at\n       FROM ${T.listings} l JOIN ${T.users} u ON u.id = l.seller_id\n      WHERE l.active = 1 AND u.banned = 0 AND u.role IN ('approved_seller','admin')\n      ORDER BY l.id DESC LIMIT 200`,\n  );\n  return json({ listings });\n}\n\nasync function createListing(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  if (!canSell(user)) {\n    return json({ error: \"Your seller account is not approved yet.\" }, 403);\n  }\n\n  const b = await readBody(req);\n  const title = String(b.title || \"\").trim();\n  const description = String(b.description || \"\").trim();\n  const price = Number(b.price);\n  const category = String(b.category || \"Growth\").trim() || \"Growth\";\n  const waLink = String(b.waLink || \"\").trim();\n  const imageKey = String(b.imageKey || \"\").trim();\n  if (imageKey && !validImageKey(imageKey)) {\n    return json({ error: \"Bad image reference.\" }, 400);\n  }\n  const videoKey = String(b.videoKey || \"\").trim();\n  if (videoKey && !validVideoKey(videoKey)) {\n    return json({ error: \"Bad video reference.\" }, 400);\n  }\n  // Tags are free text from sellers: cap the count and length, drop the rest.\n  const tags = String(b.tags || \"\")\n    .split(\",\")\n    .map((t) => t.trim().toLowerCase().replace(/[^a-z0-9 +-]/g, \"\"))\n    .filter(Boolean)\n    .slice(0, 8)\n    .map((t) => t.slice(0, 28))\n    .join(\",\");\n\n  if (title.length < 3) {\n    return json({ error: \"Give the listing a title.\" }, 400);\n  }\n  if (!Number.isFinite(price) || price <= 0) {\n    return json({ error: \"Enter a price above zero.\" }, 400);\n  }\n  if (!validWaLink(waLink)) {\n    return json({\n      error:\n        \"Use a wa.me short link, an api.whatsapp.com link, or a full phone number.\",\n    }, 400);\n  }\n\n  await run(\n    `INSERT INTO ${T.listings}\n     (seller_id, seller_name, title, description, price, category, wa_link, image_key,\n      video_key, tags, active, created_at)\n     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?)`,\n    [\n      user.id,\n      user.name,\n      title,\n      description,\n      price,\n      category,\n      waLink,\n      imageKey || null,\n      videoKey || null,\n      tags || null,\n      new Date().toISOString(),\n    ],\n  );\n  return json({ success: true, prefill: buildWaUrl(waLink, \"test\").prefill });\n}\n\nasync function deleteListing(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  const id = Number((await readBody(req)).id);\n  const owned = await one(\n    `SELECT id FROM ${T.listings} WHERE id = ? AND (seller_id = ? OR ? = 1)`,\n    [id, user.id, isAdmin(user) ? 1 : 0],\n  );\n  if (!owned) return json({ error: \"That listing isn't yours.\" }, 403);\n  const img = await one(`SELECT image_key FROM ${T.listings} WHERE id = ?`, [\n    id,\n  ]);\n  await run(`UPDATE ${T.listings} SET active = 0 WHERE id = ?`, [id]);\n  if (img && img.image_key && validImageKey(String(img.image_key))) {\n    try {\n      const mod: any = await import(\"https://esm.town/v/std/blob\");\n      await mod.blob.delete(String(img.image_key));\n    } catch { /* orphaned blob is not worth failing the request over */ }\n  }\n  return json({ success: true });\n}\n\n/* ================================================================== */\n/* orders                                                             */\n/* ================================================================== */\n\nasync function createOrder(req: Request): Promise {\n  const b = await readBody(req);\n  const user = await currentUser(req);\n  // Enforced here, not just in the UI — the endpoint is reachable directly.\n  if (!user) return json({ error: \"Log in to place an order.\" }, 401);\n\n  let title: string, price: number, sellerName: string, waLink: string;\n  let listingId: number | null = null;\n  let sellerId: number | null = null;\n  let packageId: string | null = null;\n\n  if (b.listingId != null) {\n    const l = await one(\n      `SELECT id, title, price, seller_name, seller_id, wa_link FROM ${T.listings}\n        WHERE id = ? AND active = 1`,\n      [Number(b.listingId)],\n    );\n    if (!l) return json({ error: \"That listing is no longer available.\" }, 404);\n    listingId = Number(l.id);\n    sellerId = l.seller_id == null ? null : Number(l.seller_id);\n    title = String(l.title);\n    price = Number(l.price);\n    sellerName = String(l.seller_name);\n    waLink = String(l.wa_link);\n  } else {\n    const pkg = PACKAGES[String(b.packageId || \"\")];\n    if (!pkg) return json({ error: \"Unknown package.\" }, 400);\n    packageId = String(b.packageId);\n    title = pkg.title;\n    price = pkg.price;\n    sellerName = CONFIG.brand;\n    waLink = CONFIG.brandWa;\n  }\n\n  const sku = await insertOrder({\n    listingId,\n    packageId,\n    title,\n    price,\n    sellerName,\n    sellerId,\n    buyerName: String(user.name),\n    buyerEmail: String(user.email),\n  });\n\n  const message = orderMessage(sku, title, price);\n  const { url: waUrl, prefill } = buildWaUrl(waLink, message);\n\n  return json({\n    success: true,\n    sku,\n    waUrl,\n    message,\n    prefill,\n    product: { title, price, seller_name: sellerName },\n  });\n}\n\nasync function myOrders(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  return json({\n    orders: await q(\n      `SELECT sku, product_title, price, seller_name, status, created_at FROM ${T.orders}\n        WHERE buyer_email = ? ORDER BY id DESC LIMIT 100`,\n      [user.email],\n    ),\n  });\n}\n\nasync function sellerOrders(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  return json({\n    orders: await q(\n      `SELECT sku, product_title, price, buyer_name, status, created_at FROM ${T.orders}\n        WHERE seller_id = ? ORDER BY id DESC LIMIT 100`,\n      [user.id],\n    ),\n  });\n}\n\n/* ================================================================== */\n/* seller requests                                                    */\n/* ================================================================== */\n\nasync function requestSeller(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) {\n    return json({ error: \"Create an account first, then apply.\" }, 401);\n  }\n  if (canSell(user)) {\n    return json({ error: \"You can already publish listings.\" }, 400);\n  }\n\n  const note = String((await readBody(req)).note || \"\").trim().slice(0, 400);\n  const existing = await one(\n    `SELECT id FROM ${T.requests} WHERE user_id = ? AND status = 'pending'`,\n    [user.id],\n  );\n  if (!existing) {\n    await run(\n      `INSERT INTO ${T.requests} (user_id, name, email, note, status, created_at)\n       VALUES (?, ?, ?, ?, 'pending', ?)`,\n      [user.id, user.name, user.email, note, new Date().toISOString()],\n    );\n  }\n\n  const message = `Seller application - ${CONFIG.brand}\\n` +\n    `Name: ${user.name}\\n` +\n    `Email: ${user.email}\\n` +\n    `Account ID: ${user.id}` +\n    (note ? `\\nAbout: ${note}` : \"\") +\n    `\\n\\nPlease approve my seller access.`;\n\n  const { url: waUrl, prefill } = buildWaUrl(CONFIG.brandWa, message);\n  return json({\n    success: true,\n    waUrl,\n    message,\n    prefill,\n    alreadyPending: !!existing,\n  });\n}\n\nasync function pendingSellers(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n  return json({\n    requests: await q(\n      `SELECT r.id, r.user_id, r.name, r.email, r.note, r.status, r.created_at, u.role\n         FROM ${T.requests} r JOIN ${T.users} u ON u.id = r.user_id\n        ORDER BY (r.status = 'pending') DESC, r.id DESC LIMIT 200`,\n    ),\n  });\n}\n\nasync function approveSeller(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n\n  const b = await readBody(req);\n  const userId = Number(b.userId);\n  const target = await one(`SELECT id, email FROM ${T.users} WHERE id = ?`, [\n    userId,\n  ]);\n  if (!target) return json({ error: \"No such user.\" }, 404);\n  if (String(target.email).toLowerCase() === ADMIN_EMAIL) {\n    return json({ error: \"The admin account already has full access.\" }, 400);\n  }\n\n  await run(`UPDATE ${T.users} SET role = 'approved_seller' WHERE id = ?`, [\n    userId,\n  ]);\n  await run(\n    `UPDATE ${T.requests} SET status = 'approved', decided_at = ? WHERE user_id = ? AND status = 'pending'`,\n    [new Date().toISOString(), userId],\n  );\n  return json({ success: true });\n}\n\nasync function adminOrders(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n  const totals = await one(\n    `SELECT COUNT(*) AS n, COALESCE(SUM(price),0) AS value FROM ${T.orders}`,\n  );\n  return json({\n    totals,\n    orders: await q(\n      `SELECT sku, product_title, price, seller_name, buyer_name, buyer_email, status, created_at\n         FROM ${T.orders} ORDER BY id DESC LIMIT 200`,\n    ),\n  });\n}\n\n/* ================================================================== */\n/* frontend                                                           */\n/* ================================================================== */\n\nconst ORDER_STATUSES = [\"Pending\", \"Delivered\", \"Cancelled\"];\n\n/**\n * Who may move an order:\n *   admin  — any order, any status\n *   seller — orders on their own listings\n *   buyer  — may cancel their own order while it is still Pending\n */\nasync function setOrderStatus(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n\n  const b = await readBody(req);\n  const sku = String(b.sku || \"\").trim();\n  const status = String(b.status || \"\").trim();\n  if (!ORDER_STATUSES.includes(status)) {\n    return json({ error: \"Unknown status.\" }, 400);\n  }\n\n  const order = await one(\n    `SELECT sku, seller_id, buyer_email, status FROM ${T.orders} WHERE sku = ?`,\n    [sku],\n  );\n  if (!order) return json({ error: \"No order with that SKU.\" }, 404);\n\n  const admin = isAdmin(user);\n  const isSeller = order.seller_id != null &&\n    Number(order.seller_id) === Number(user.id);\n  const isBuyer = String(order.buyer_email || \"\") === String(user.email);\n\n  let allowed = false;\n  if (admin || isSeller) allowed = true;\n  else if (isBuyer && status === \"Cancelled\" && order.status === \"Pending\") {\n    allowed = true;\n  }\n  if (!allowed) return json({ error: \"You can't change this order.\" }, 403);\n\n  await run(`UPDATE ${T.orders} SET status = ?, updated_at = ? WHERE sku = ?`, [\n    status,\n    new Date().toISOString(),\n    sku,\n  ]);\n  return json({ success: true, sku, status });\n}\n\nasync function adminUsers(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n  return json({\n    users: await q(\n      `SELECT u.id, u.name, u.email, u.role, u.verified, u.banned, u.created_at,\n              (SELECT COUNT(*) FROM ${T.listings} l WHERE l.seller_id = u.id AND l.active = 1) AS listings,\n              (SELECT COUNT(*) FROM ${T.orders} o WHERE o.seller_id = u.id) AS sales\n         FROM ${T.users} u ORDER BY u.id DESC LIMIT 300`,\n    ),\n  });\n}\n\n/**\n * approve | revoke | ban | unban | verify\n * Banning also drops the user's sessions, so an open tab stops working on its\n * next request instead of staying live until the token is discarded.\n */\nasync function adminUserAction(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n\n  const b = await readBody(req);\n  const userId = Number(b.userId);\n  const action = String(b.action || \"\");\n  const target = await one(`SELECT id, email FROM ${T.users} WHERE id = ?`, [\n    userId,\n  ]);\n  if (!target) return json({ error: \"No such user.\" }, 404);\n  if (String(target.email).toLowerCase() === ADMIN_EMAIL) {\n    return json(\n      { error: \"The master account can't be changed from here.\" },\n      400,\n    );\n  }\n\n  const now = new Date().toISOString();\n  switch (action) {\n    case \"approve\":\n      await run(`UPDATE ${T.users} SET role = 'approved_seller' WHERE id = ?`, [\n        userId,\n      ]);\n      await run(\n        `UPDATE ${T.requests} SET status = 'approved', decided_at = ? WHERE user_id = ? AND status = 'pending'`,\n        [now, userId],\n      );\n      break;\n    case \"revoke\":\n      await run(`UPDATE ${T.users} SET role = 'buyer' WHERE id = ?`, [userId]);\n      await run(`UPDATE ${T.listings} SET active = 0 WHERE seller_id = ?`, [\n        userId,\n      ]);\n      await run(\n        `UPDATE ${T.requests} SET status = 'revoked', decided_at = ? WHERE user_id = ? AND status = 'approved'`,\n        [now, userId],\n      );\n      break;\n    case \"ban\":\n      await run(`UPDATE ${T.users} SET banned = 1 WHERE id = ?`, [userId]);\n      await run(`DELETE FROM ${T.sessions} WHERE user_id = ?`, [userId]);\n      break;\n    case \"unban\":\n      await run(`UPDATE ${T.users} SET banned = 0 WHERE id = ?`, [userId]);\n      break;\n    default:\n      return json({ error: \"Unknown action.\" }, 400);\n  }\n  return json({ success: true });\n}\n\n/**\n * Serves the hero clip from Val Town blob storage.\n * The listing API shape varies between SDK versions, so normalise whatever\n * comes back — array, iterable, or a wrapper object — before searching it.\n */\nlet heroKeyCache: string | null = null;\n\nasync function asArray(x: any): Promise {\n  if (!x) return [];\n  if (Array.isArray(x)) return x;\n  if (typeof x[Symbol.asyncIterator] === \"function\") {\n    const out: any[] = [];\n    for await (const i of x) out.push(i);\n    return out;\n  }\n  if (typeof x[Symbol.iterator] === \"function\") return Array.from(x);\n  for (const prop of [\"blobs\", \"items\", \"data\", \"keys\", \"results\"]) {\n    if (Array.isArray(x[prop])) return x[prop];\n  }\n  return [];\n}\n\nconst keyOf = (item: any): string =>\n  String(item?.key ?? item?.name ?? item?.path ?? item ?? \"\");\n\nasync function listBlobKeys(mod: any): Promise {\n  for (\n    const call of [\n      () => mod.blob.list(),\n      () => mod.blob.list(\"\"),\n      () => mod.blob.list(\"/\"),\n    ]\n  ) {\n    try {\n      const arr = await asArray(await call());\n      const keys = arr.map(keyOf).filter(Boolean);\n      if (keys.length) return keys;\n    } catch { /* try the next shape */ }\n  }\n  return [];\n}\n\nasync function resolveHeroKey(mod: any): Promise {\n  if (heroKeyCache) return heroKeyCache;\n\n  const preferred = Deno.env.get(\"HERO_VIDEO_KEY\") || \"hero.mp4\";\n  try {\n    const probe = await mod.blob.get(preferred);\n    if (probe && probe.ok) return (heroKeyCache = preferred);\n  } catch { /* fall through */ }\n\n  const keys = await listBlobKeys(mod);\n  // Exact match first (in case the env value differs only by case), then any video.\n  const exact = keys.find((k) => k.toLowerCase() === preferred.toLowerCase());\n  if (exact) return (heroKeyCache = exact);\n  const vid = keys.find((k) => /\\.(mp4|webm|mov|m4v)$/i.test(k));\n  if (vid) return (heroKeyCache = vid);\n  return null;\n}\n\nasync function heroVideo(): Promise {\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/blob\");\n    const key = await resolveHeroKey(mod);\n    if (!key) {\n      const keys = await listBlobKeys(mod);\n      return json({\n        error: \"No video found in blob storage.\",\n        keysSeen: keys.slice(0, 20),\n      }, 404);\n    }\n    const res = await mod.blob.get(key);\n    if (!res || !res.ok || !res.body) {\n      heroKeyCache = null;\n      return json({ error: \"Blob could not be read.\", key }, 404);\n    }\n    return new Response(res.body, {\n      headers: {\n        \"content-type\": /\\.webm$/i.test(key) ? \"video/webm\" : \"video/mp4\",\n        \"cache-control\": \"public, max-age=86400\",\n      },\n    });\n  } catch (err: any) {\n    return json({\n      error: \"Blob storage unavailable\",\n      detail: String(err?.message || err),\n    }, 500);\n  }\n}\n\n/* ================================================================== */\n/* listing images (Val Town blob storage)                             */\n/* ================================================================== */\n\nconst MAX_IMAGE_BYTES = 1_500_000;\n\n/** Keys are generated here, never by the client — this is what stops\n *  /media/img/hero.mp4 or any other blob from being read through this route. */\nfunction newImageKey(): string {\n  return `listing-img-${randomHex(10)}.jpg`;\n}\nfunction validImageKey(key: string): boolean {\n  return /^listing-img-[a-f0-9]{20}\\.jpg$/.test(key);\n}\n\nasync function uploadImage(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  if (!canSell(user)) {\n    return json({ error: \"Only approved sellers can upload images.\" }, 403);\n  }\n\n  const dataUrl = String((await readBody(req)).dataUrl || \"\");\n  const match = dataUrl.match(\n    /^data:image\\/(jpeg|png|webp);base64,([A-Za-z0-9+/=]+)$/,\n  );\n  if (!match) return json({ error: \"Send a JPEG, PNG or WebP image.\" }, 400);\n\n  let bytes: Uint8Array;\n  try {\n    const bin = atob(match[2]);\n    bytes = new Uint8Array(bin.length);\n    for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);\n  } catch {\n    return json({ error: \"That image could not be decoded.\" }, 400);\n  }\n  if (bytes.length > MAX_IMAGE_BYTES) {\n    return json({ error: \"Image is too large. Keep it under 1.5 MB.\" }, 413);\n  }\n\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/blob\");\n    const key = newImageKey();\n    await mod.blob.set(key, bytes);\n    return json({ success: true, key, bytes: bytes.length });\n  } catch (err: any) {\n    return json(\n      { error: \"Upload failed\", detail: String(err?.message || err) },\n      500,\n    );\n  }\n}\n\nasync function listingImage(path: string): Promise {\n  const key = decodeURIComponent(path.slice(\"/media/img/\".length));\n  if (!validImageKey(key)) return json({ error: \"Not found\" }, 404);\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/blob\");\n    const res = await mod.blob.get(key);\n    if (!res || !res.ok || !res.body) return json({ error: \"Not found\" }, 404);\n    return new Response(res.body, {\n      headers: {\n        \"content-type\": \"image/jpeg\",\n        // Keys are unique per upload, so this can cache forever.\n        \"cache-control\": \"public, max-age=31536000, immutable\",\n      },\n    });\n  } catch {\n    return json({ error: \"Not found\" }, 404);\n  }\n}\n\n/** Public counters, read straight from the tables. Nothing estimated. */\nasync function publicStats(): Promise {\n  const delivered = await one(\n    `SELECT COUNT(*) AS n FROM ${T.orders} WHERE status = 'Delivered'`,\n  );\n  const sellers = await one(\n    `SELECT COUNT(*) AS n FROM ${T.users} WHERE role = 'approved_seller' AND banned = 0`,\n  );\n  const listings = await one(\n    `SELECT COUNT(*) AS n FROM ${T.listings} WHERE active = 1`,\n  );\n  return json({\n    stats: {\n      delivered: Number(delivered?.n || 0),\n      sellers: Number(sellers?.n || 0),\n      listings: Number(listings?.n || 0),\n      refillDays: 90,\n    },\n  });\n}\n\n/** Temporary diagnostic: shows exactly what blob storage returns. Remove once\n *  the hero video is confirmed working. */\nasync function blobDebug(): Promise {\n  const report: Record = {};\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/blob\");\n    report.moduleKeys = Object.keys(mod || {});\n    report.blobMethods = mod?.blob ? Object.keys(mod.blob) : \"no blob export\";\n    try {\n      const items = await mod.blob.list();\n      report.listType = Array.isArray(items) ? \"array\" : typeof items;\n      report.listRaw = JSON.stringify(items).slice(0, 600);\n    } catch (e: any) {\n      report.listError = String(e?.message || e).slice(0, 300);\n    }\n    try {\n      const r = await mod.blob.get(\"hero.mp4\");\n      report.getHero = r ? { ok: r.ok, status: r.status } : \"null\";\n    } catch (e: any) {\n      report.getHeroError = String(e?.message || e).slice(0, 200);\n    }\n  } catch (e: any) {\n    report.importError = String(e?.message || e).slice(0, 300);\n  }\n  return json(report);\n}\n\n/**\n * Admin-only hero video upload. Takes the raw file body (no base64, which\n * would inflate it by a third) and writes it through std/blob — the same\n * store the serving route reads, which the val-scoped Blob UI is not.\n */\nasync function uploadHeroVideo(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n\n  const buf = await req.arrayBuffer();\n  if (!buf.byteLength) return json({ error: \"Empty upload.\" }, 400);\n  if (buf.byteLength > 12_000_000) {\n    return json({ error: \"Too large. Compress the clip to under 12 MB.\" }, 413);\n  }\n\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/blob\");\n    await mod.blob.set(\"hero.mp4\", new Uint8Array(buf));\n    heroKeyCache = \"hero.mp4\";\n    return json({ success: true, bytes: buf.byteLength });\n  } catch (err: any) {\n    return json(\n      { error: \"Upload failed\", detail: String(err?.message || err) },\n      500,\n    );\n  }\n}\n\n/* ================================================================== */\n/* listing videos                                                     */\n/* ================================================================== */\n\nconst MAX_LISTING_VIDEO_BYTES = 12_000_000;\n\nfunction newVideoKey(): string {\n  return `listing-vid-${randomHex(10)}.mp4`;\n}\nfunction validVideoKey(key: string): boolean {\n  return /^listing-vid-[a-f0-9]{20}\\.mp4$/.test(key);\n}\n\n/** Raw body upload — base64 would add a third to an already large file. */\nasync function uploadListingVideo(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  if (!canSell(user)) {\n    return json({ error: \"Only approved sellers can upload video.\" }, 403);\n  }\n\n  const buf = await req.arrayBuffer();\n  if (!buf.byteLength) return json({ error: \"Empty upload.\" }, 400);\n  if (buf.byteLength > MAX_LISTING_VIDEO_BYTES) {\n    return json({ error: \"Video too large. Keep it under 12 MB.\" }, 413);\n  }\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/blob\");\n    const key = newVideoKey();\n    await mod.blob.set(key, new Uint8Array(buf));\n    return json({ success: true, key, bytes: buf.byteLength });\n  } catch (err: any) {\n    return json(\n      { error: \"Upload failed\", detail: String(err?.message || err) },\n      500,\n    );\n  }\n}\n\nasync function listingVideo(path: string): Promise {\n  const key = decodeURIComponent(path.slice(\"/media/vid/\".length));\n  if (!validVideoKey(key)) return json({ error: \"Not found\" }, 404);\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/blob\");\n    const res = await mod.blob.get(key);\n    if (!res || !res.ok || !res.body) return json({ error: \"Not found\" }, 404);\n    return new Response(res.body, {\n      headers: {\n        \"content-type\": \"video/mp4\",\n        \"cache-control\": \"public, max-age=31536000, immutable\",\n      },\n    });\n  } catch {\n    return json({ error: \"Not found\" }, 404);\n  }\n}","deleted",false,"label","theagentsyt",[14],"49c17bf8-dd10-4afa-aff7-a6e807ffe5a4",["D",1789198617445],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","userId","47eaf13b-b72f-4418-ae2f-ebe9fff309ae","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0783d-81e8-754f-ad5a-c8c2fb0c005f","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_103":99},"org",{"_9":10,"_96":97,"_98":99,"_56":57,"_100":101,"_102":42},"branch",{"_35":86,"_11":87,"_22":28,"_88":46,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":12,"_95":10},"isOwned",76,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Rayan Bhatti","avatar","https://lh3.googleusercontent.com/a/ACg8ocLHYtPrlNBVkdnNY7c7Sp49jHoTN9_El-TKpOlHxwIPQn6Saw=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_79":-5,"_137":138,"_139":140,"_141":142,"_143":42,"_144":42,"_145":42,"_146":32,"_147":-5,"_148":-7,"_149":-7,"_150":63,"_151":42,"_152":42,"_153":-5,"_154":42,"_155":42,"_156":42,"_157":-5},"ENV",{"_108":109,"_110":111,"_112":87,"_113":114,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]