[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_106":107,"_108":109},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","omriluz","name","telegram-city-network","path","web.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":58,"_59":32,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/omriluz/telegram-city-network/code/web.ts","extension","id","458ddb01-8c18-497b-998e-a3c4d1fd39c8","fileId","9fce736c-b257-11f1-88bf-1607ee4eb77e","parentId","branchId","6de82370-98e9-41cd-add4-480bf35c921b","branchVersion",47,"latest",true,"createdAt",["D",1789637267852],"version",4,"fileType","script","content","import { initNetwork } from './network_store.ts';\nimport { networkAction, networkPage } from \"./network_admin.ts\";\nimport { Hono } from \"npm:hono\";\nimport { botPreview, cities, clean, eligible, escape, localParts, ownerId, safeUrl, weekend, type EventData, type Translation } from \"./core.ts\";\nimport { initialize } from \"./engine.ts\";\nimport { store, type Store } from \"./store.ts\";\nimport { readBounded } from \"./sources.ts\";\nimport { adminAction, adminPage, campaigns } from \"./admin.ts\";\nimport { area, checkbox, date, eventCard, hidden, input, labels, layout, price } from \"./ui.ts\";\nexport interface Session { id: string; secret: string; }\nexport type Authenticate = (request: Request) => Promise;\nexport async function sign(secret: string, value: string): Promise {\n const key = await crypto.subtle.importKey(\"raw\", new TextEncoder().encode(secret), { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]);\n return Array.from(new Uint8Array(await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(value))), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\nexport function equal(a: string, b: string): boolean { let result = a.length ^ b.length; for (let i = 0; i < Math.max(a.length, b.length); i++) result |= (a.charCodeAt(i) || 0) ^ (b.charCodeAt(i) || 0); return result === 0; }\nexport const campaign = (input: string | undefined) => campaigns.includes(input || \"\") ? input! : \"direct\";\nexport async function publicEvents(db: Store): Promise<{ event: EventData; translation: Translation }[]> {\n await initialize(db);\n const rows = (await db.q(\"SELECT e.* FROM ccn_events e LEFT JOIN ccn_sources s ON s.id=e.city||':'||e.source WHERE e.city='shymkent' AND e.review='approved' AND e.approved_hash=e.hash AND e.translation_hash=e.hash AND e.fixture=0 AND e.duplicate_of IS NULL AND e.verified>? AND (s.permission='approved' OR e.source='organizer') ORDER BY json_extract(e.json,'$.date') LIMIT 200\", [Date.now() - 86400000])).rows;\n return rows.filter((r) => r.translation).map((r) => ({ event: JSON.parse(String(r.json)) as EventData, translation: JSON.parse(String(r.translation)) as Translation })).filter((r) => eligible(r.event));\n}\nexport function createApp(options: { db?: Store; authenticate?: Authenticate; formSecret?: () => string } = {}) {\n const db = options.db || store, authenticate = options.authenticate || (async () => null);\n const secret = options.formSecret || (() => { const value = Deno.env.get(\"VAL_TOWN_API_KEY\"); if (!value) throw new Error(\"Form signing unavailable\"); return value; });\n const app = new Hono<{ Variables: { csrf: string } }>();\n app.use(\"*\", async (c, next) => {\n c.header(\"X-Content-Type-Options\", \"nosniff\"); c.header(\"Referrer-Policy\", \"same-origin\"); c.header(\"Cache-Control\", \"no-store\");\n c.header(\"Content-Security-Policy\", \"default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'\");\n c.header(\"Access-Control-Allow-Origin\", new URL(c.req.url).origin);\n if (c.req.path.startsWith(\"/admin\")) {\n let session: Session | null = null; try { session = await authenticate(c.req.raw); } catch { /* Fail closed without returning session details. */ }\n if (!session || session.id !== ownerId) return c.html(layout(\"Owner sign-in\", '

Owner workspace

Continue with Val Town

', true), 401);\n c.set(\"csrf\", await sign(session.secret, new URL(c.req.url).origin + \":admin-action-v1\"));\n }\n await next();\n });\n app.onError(async (_error, c) => { try { await db.log(\"http\", null, \"error\", { path: c.req.path.slice(0, 100), code: \"internal_error\" }); } catch { /* Storage outage must not disclose secrets. */ } return c.html(layout(\"Unavailable\", '

Temporarily unavailable

The operation did not complete. Retry or inspect the owner run log.

', true), 503); });\n app.get(\"/health\", async (c) => { await initNetwork(db); const enabled=Number((await db.q(\"SELECT COUNT(*) AS n FROM ccn_feeds WHERE json_extract(json,'$.enabled')=1 AND json_extract(json,'$.external')=0\")).rows[0].n); return c.json({status:\"ok\",schema:2,build:\"ccn-network-2026-09-17\",collectionEnabled:await db.setting('network:collection','0')==='1',publicPublishing:await db.setting('kill','1')==='0'&&enabled>0,githubCommit:null}); });\n app.get(\"/robots.txt\", (c) => c.text(\"User-agent: *\\nDisallow: /admin\\nDisallow: /go/\\nDisallow: /join/\\nDisallow: /submit\\n\"));\n app.get(\"/\", (c) => c.redirect(\"/shymkent\"));\n app.get(\"/shymkent\", async (c) => {\n const tag = campaign(c.req.query(\"campaign\")), filter = c.req.query(\"filter\") || \"all\", category = c.req.query(\"category\") || \"\";\n const today = localParts(Date.now(), cities.shymkent.timezone).date, [first, last] = weekend(Date.now(), cities.shymkent.timezone);\n let events = await publicEvents(db);\n if (filter === \"today\") events = events.filter(({ event: e }) => e.date && e.date <= today && (e.endDate || e.date) >= today);\n if (filter === \"weekend\") events = events.filter(({ event: e }) => e.date && e.date <= last && (e.endDate || e.date) >= first);\n if (filter === \"free\") events = events.filter(({ event: e }) => e.price === 0);\n if (category) events = events.filter(({ event: e }) => e.category === category);\n const join = await db.setting(\"shymkent:join\");\n return c.html(layout(\"Қаладағы жоспарлар\", `

Шымкент · Іс-шаралар

Қаладағы жоспарлар —
бір жерде.

Концерттер, театр, көрмелер және демалыс. Тек тексерілген іс-шаралар, нақты дереккөздер.

${join ? `Telegram-ға қосылу ↗` : \"Telegram арнасы әзірленуде\"}

${Object.entries(labels).map(([key, label]) => `${label}`).join(\"\")}

${events.length ? `

${events.slice(0, 60).map(({ event, translation }) => eventCard(event, translation, tag)).join(\"\")}

` : '

◌

Әзірге расталған іс-шаралар жоқ

Жаңа ақпаратты тексеріп жатырмыз. Расталмаған мәліметтер бұл күнтізбеге шықпайды.

Өз іс-шараңызды ұсыныңыз →

'}`));\n });\n app.get(\"/event/:id\", async (c) => {\n const item = (await publicEvents(db)).find((x) => x.event.id === c.req.param(\"id\")); if (!item) return c.text(\"Not found\", 404);\n const e = item.event, t = item.translation, tag = campaign(c.req.query(\"campaign\"));\n return c.html(layout(t.title, `

← Барлық іс-шаралар

${escape(t.title)}

${escape(t.description)}

Күні: ${escape(date(e))}

Орны: ${escape([e.venue, e.address].filter(Boolean).join(\", \"))}

Бағасы: ${escape(price(e))}

Іс-шара тілі: ${escape(e.eventLanguage || \"Көрсетілмеген\")}

${e.age ? `

${escape(e.age)}

` : \"\"}

Дереккөз ↗${e.bookingUrl ? `Билеттер / тіркелу ↗` : \"\"}

Дереккөз: ${escape(e.source)}. Өзгерістерді ұйымдастырушыдан тексеріңіз.

`));\n });\n async function recordClick(request: Request, kind: string, target: string, tag: string) {\n const agent = request.headers.get(\"user-agent\") || \"\"; if (request.method !== \"GET\" || !agent || botPreview(agent)) return;\n const day = new Date().toISOString().slice(0, 10); await db.q(\"INSERT INTO ccn_clicks VALUES (?,?,?,?,1) ON CONFLICT(day,campaign,kind,target) DO UPDATE SET count=ccn_clicks.count+1\", [day, tag, kind, target]);\n }\n app.on([\"GET\", \"HEAD\"], \"/go/:id\", async (c) => {\n const item = (await publicEvents(db)).find((x) => x.event.id === c.req.param(\"id\")); if (!item) return c.text(\"Not found\", 404);\n const kind = c.req.query(\"kind\") === \"booking\" ? \"booking\" : \"source\", target = kind === \"booking\" ? item.event.bookingUrl : item.event.url; if (!target) return c.text(\"Unavailable\", 404);\n const url = safeUrl(target); await recordClick(c.req.raw, kind, item.event.id, campaign(c.req.query(\"campaign\"))); return c.redirect(url, 302);\n });\n app.on([\"GET\", \"HEAD\"], \"/join/shymkent\", async (c) => {\n await initialize(db); const url = await db.setting(\"shymkent:join\"); if (!/^https:\\/\\/t\\.me\\/[A-Za-z][A-Za-z0-9_]{4,31}$/.test(url)) return c.text(\"Channel not yet activated\", 404);\n await recordClick(c.req.raw, \"join_click\", \"shymkent\", campaign(c.req.query(\"campaign\"))); return c.redirect(url, 302);\n });\n app.get(\"/submit\", async (c) => {\n const issued = String(Date.now()), nonce = crypto.randomUUID(), signature = await sign(secret(), `${issued}:${nonce}`);\n return c.html(layout(\"Іс-шара ұсыну\", `

Ұйымдастырушыларға

Қалаға жоспарыңызды ұсыныңыз.

Әр ұсынысты жарияламас бұрын тексереміз. Байланыс деректеріңіз ашық жарияланбайды.

${hidden(\"issued\", issued)}${hidden(\"nonce\", nonce)}${hidden(\"signature\", signature)}Ұсыныс түрі${input(\"title\", \"Атауы\", \"\", \"text\", 'maxlength=\"260\" required')}${input(\"contact\", \"Жеке байланыс (email немесе телефон)\", \"\", \"text\", 'maxlength=\"160\" required')}${input(\"url\", \"Ресми сілтеме\", \"\", \"url\", 'maxlength=\"800\" required')}${input(\"venue\", \"Өтетін орын\", \"\", \"text\", 'maxlength=\"400\"')}${input(\"address\", \"Мекенжай\", \"\", \"text\", 'maxlength=\"400\"')}

${input(\"date\", \"Күні\", \"\", \"date\")}${input(\"time\", \"Уақыты (белгілі болса)\", \"\", \"time\")}${input(\"price\", \"Бағасы KZT (белгісіз болса бос қалдырыңыз)\", \"\", \"number\", 'min=\"0\" step=\"0.01\"')}${input(\"language\", \"Іс-шара тілі\", \"\", \"text\", 'maxlength=\"60\"')}

Санат${area(\"note\", \"Қосымша мәлімет\", \"\", 'maxlength=\"1500\"')}${checkbox(\"consent\", \"Байланыс деректерін 90 күнге дейін сақтауға және тексерілген іс-шара мәліметтерін жариялауға келісемін\", true)}

Автоматты түрде жарияланбайды. Төлем алынбайды.

`));\n });\n app.post(\"/submit\", async (c) => {\n if (c.req.header(\"origin\") !== new URL(c.req.url).origin || !c.req.header(\"content-type\")?.startsWith(\"application/x-www-form-urlencoded\")) return c.text(\"Forbidden\", 403);\n const body = await readBounded(new Response(c.req.raw.body), 12000), data = new URLSearchParams(body), value = (key: string) => clean(data.get(key));\n const age = Date.now() - Number(value(\"issued\")); if (value(\"website\") || !Number.isFinite(age) || age < 2000 || age > 7200000 || !equal(value(\"signature\"), await sign(secret(), `${value(\"issued\")}:${value(\"nonce\")}`))) return c.text(\"Invalid submission token; reload the form\", 400);\n await initialize(db);\n const day = new Date().toISOString().slice(0, 10); const fingerprint = await sign(secret(), day + \":\" + (c.req.header(\"x-forwarded-for\") || \"unknown\").slice(0, 100));\n if (!(await db.rate(\"form_nonce:\" + value(\"nonce\"), 1, 7200000)) || !(await db.rate(\"form_global\", 40, 86400000)) || !(await db.rate(\"form_sender:\" + fingerprint, 3, 3600000))) return c.text(\"Too many submissions; try later\", 429);\n if (![\"event\", \"advertising\"].includes(value(\"kind\")) || value(\"consent\") !== \"yes\" || !value(\"title\") || value(\"title\").length > 260 || value(\"contact\").length < 5 || value(\"contact\").length > 160) return c.text(\"Invalid form fields\", 400);\n let url: string; try { url = safeUrl(value(\"url\")); } catch { return c.text(\"A public HTTPS source URL is required\", 400); }\n if (url.length > 800 || value(\"venue\").length > 400 || value(\"address\").length > 400 || value(\"language\").length > 60 || !Object.keys(labels).includes(value(\"category\")) || (value(\"price\") && (!Number.isFinite(Number(value(\"price\"))) || Number(value(\"price\")) < 0))) return c.text(\"Invalid event details\", 400);\n const content = { title: value(\"title\"), url, venue: value(\"venue\"), address: value(\"address\"), date: value(\"date\"), time: value(\"time\"), price: value(\"price\"), language: value(\"language\"), category: value(\"category\"), note: value(\"note\").slice(0, 1500), permission: \"Submitter consented to factual listing and private contact retention\" };\n await db.q(\"INSERT INTO ccn_submissions(id,kind,json,contact,at) VALUES (?,?,?,?,?)\", [crypto.randomUUID(), value(\"kind\"), JSON.stringify(content), value(\"contact\"), Date.now()]);\n return c.html(layout(\"Қабылданды\", '

Рақмет!

Ұсынысыңыз қарауға қабылданды. Бұл автоматты жариялау емес.

Күнтізбеге оралу →

'), 201);\n });\n app.get(\"/admin/network\", async (c) => c.html(await networkPage(db, c.get(\"csrf\"), c.req.query(\"feed\") || \"\")));\n app.post(\"/admin/network/action\", async (c) => {\n if (c.req.header(\"origin\") !== new URL(c.req.url).origin || !c.req.header(\"content-type\")?.startsWith(\"application/x-www-form-urlencoded\")) return c.text(\"Forbidden\", 403);\n const data = new URLSearchParams(await readBounded(new Response(c.req.raw.body), 24000));\n if (!equal(data.get(\"csrf\") || \"\", c.get(\"csrf\"))) return c.text(\"Invalid CSRF token\", 403);\n try { await networkAction(data, db); return c.redirect(\"/admin/network\" + (data.get(\"feed\") ? \"?feed=\" + encodeURIComponent(data.get(\"feed\")!) : \"\"), 303); }\n catch (error) { return c.html(layout(\"Action blocked\", `

Not completed

${escape(error instanceof Error ? error.message.slice(0,250) : \"Action failed\")}

Return to city network

`, true), 400); }\n });\n app.get(\"/admin\", async (c) => c.html(c.req.query(\"tab\") ? await adminPage(db, c.get(\"csrf\"), c.req.query(\"tab\")!, c.req.query(\"city\") || \"shymkent\", new URL(c.req.url).origin) : await networkPage(db,c.get(\"csrf\"))));\n app.post(\"/admin/action\", async (c) => {\n if (c.req.header(\"origin\") !== new URL(c.req.url).origin || !c.req.header(\"content-type\")?.startsWith(\"application/x-www-form-urlencoded\")) return c.text(\"Forbidden: same-origin form required\", 403);\n const body = await readBounded(new Response(c.req.raw.body), 24000), data = new URLSearchParams(body);\n if (!equal(data.get(\"csrf\") || \"\", c.get(\"csrf\"))) return c.text(\"Invalid CSRF token\", 403);\n try { const result = await adminAction(data, db); return c.html(layout(\"Action completed\", `

Saved

${escape(result)}

Return to workspace

`, true)); }\n catch (error) { const text = error instanceof Error ? error.message.slice(0, 250) : \"Operation failed\"; return c.html(layout(\"Action blocked\", `

Action not completed

${escape(text)}

Return to workspace

`, true), 400); }\n });\n app.notFound((c) => c.text(\"Not found\", 404)); return app;\n}\n","deleted",false,"label",[14],"47a79ebc-05ee-454e-983d-7f48a62bccc0",["D",1789621418009],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","City events: Shymkent review pilot, isolated from live Almaty","imageUrl","userId","f5be24e4-c798-4816-91e5-037b60b986f5","pinnedFileId","01a0adbf-b85c-735b-b5fd-9913cdd6d31f","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","7f67379d-2d38-49bd-81ac-2c7f92a739e2","tursoName","47a79ebc05ee454e983d7f48a62bccc0","tursoHostname","47a79ebc05ee454e983d7f48a62bccc0-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789710048837],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_105":101},"org",{"_9":10,"_99":-5,"_100":101,"_55":56,"_102":103,"_104":42},"branch",{"_35":89,"_11":90,"_22":28,"_91":45,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":12,"_98":10},"isOwned",59,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18ycWxkOWxiOE00SkVtZENmRWM4YWxLWTRVUFMifQ","tier","free","canRestrictVals","profileImageUrl","ctx",{"_82":-5,"_139":140,"_141":142,"_143":144,"_145":42,"_146":42,"_147":42,"_148":32,"_149":-5,"_150":-7,"_151":-7,"_152":63,"_153":42,"_154":42,"_155":-5,"_156":42,"_157":42,"_158":42,"_159":-5},"ENV",{"_110":111,"_112":113,"_114":90,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","71c1b20804b3232a7e513be260cfffc1932a9e97","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Owner workspace

Temporarily unavailable

Қаладағы жоспарлар —бір жерде.

Әзірге расталған іс-шаралар жоқ

${escape(t.title)}

Қалаға жоспарыңызды ұсыныңыз.

Рақмет!

Not completed

Saved

Action not completed

Қаладағы жоспарлар —
бір жерде.