[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_170":171,"_172":173},"routes/_app.x.$handle.$name",{"_97":96,"_32":45,"_106":87,"_27":53,"_13":14,"_107":-5,"_11":108,"_109":110,"_111":112,"_113":114,"_115":116,"_20":-5,"_117":-5,"_118":-5,"_119":25,"_120":121,"_122":59,"_123":-5,"_124":-5,"_125":126},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":25},"version",40,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","page.ts","latestPath","fileId","6a9f9a30-ae84-11f1-9032-1607ee4eb77e","name","fileType","script","content","// THE AGENTS — frontend. Lives in the same val as main.ts.\n// main.ts imports { CONFIG, PAGE } from \"./page.ts\".\n\nexport const CONFIG = {\n brand: \"The Agents\",\n currency: \"PKR\",\n locale: \"en-PK\",\n youtubeId: \"b45wwm9gi5Y\",\n // \"youtube\" = embed | \"blob\" = self-hosted MP4 served from /media/hero.mp4.\n // Upload the file to Val Town blob storage under the key hero.mp4, then\n // switch this to \"blob\" — autoplays muted on loop with no YouTube chrome.\n heroMode: \"youtube\",\n // Brand WhatsApp — used for seller requests and for packages sold by the house.\n brandWa: \"https://wa.me/message/EQTSKXH474MID1\",\n supportEmail: \"rayandnp@gmail.com\",\n};\n\nexport const PAGE = `\n\n\n\n\n\n${CONFIG.brand} — grow your YouTube channel faster\n\n\n\n\n\n\n\n\n\n\n\n\n

\n\n\n

\n\nA\n${CONFIG.brand}\n\n\n\n\n

\n\n

\n\n\n

\nCheck your inbox for a 6-digit code and verify your email to publish or apply as a seller.\n\n

\n\n\n

\n\n Trusted by creators in 20+ countries\n\n

\nGrow Your YouTube
Channel Faster.\n

\nPremium YouTube services designed to help creators reach their growth and monetization goals.\n

\nOpen Marketplace\nView Services\n\n

Orders delivered: 12,400+
Avg. delivery: 28 days
Refill cover: 90 days

\n${CONFIG.heroMode === \"blob\"\n? `

`\n: ``}\n

\n\n

\nYT\n

Channel analytics

Last 28 days

\n\n Monetized\n\n

Subscribers

1,042

Watch hours

4,118

Views

318K

\n\n

\n\n\n\n\n\n\n\n

\n\n

✓Secure checkout

⚡Fast delivery

💬Customer support

#Order tracking

★Verified service

\n\n

Services built for channels

Pick what your channel is short of. Every order is tracked with its own SKU and confirmed on WhatsApp.

\n\n

Pricing that scales with the channel

One-off packages. No subscription, no channel password, no access to your account.

Starter

For channels early in the watch-hour climb.

${CONFIG.currency} 11,500

Delivery in 10–14 days

✓1,000 watch hours
✓Retention held above 45%
✓Drip-fed daily
✓SKU order tracking

\n\n

Creator

\nMOST POPULAR\n

The full monetization requirement, handled.

${CONFIG.currency} 42,000

Delivery in 28–35 days

✓4,000 watch hours
✓1,000 subscribers
✓Natural ratio pacing
✓90-day refill cover
✓Pre-order channel review

\n\n

Pro

Monetization plus three months of managed growth.

${CONFIG.currency} 78,000

Delivery in 30 days, then managed

✓Everything in Creator
✓Shorts feed push
✓Thumbnail and title review
✓Priority support line

\n\n

Marketplace

Packages published by approved sellers. You order in their own WhatsApp inbox.

\n\n

No seller listings yet. The packages above are sold directly by ${CONFIG.brand}.

\n\n

What creators say

★★★★★

Hit the 4,000 hours in five weeks and the review passed first time. The SKU made it easy to keep track of where my order was.

\nH\nHamza R.Tech reviews · 18K subs\n

\n\n

★★★★★

Subscribers arrived gradually instead of in one suspicious spike. My retention graph didn't wobble at all.

\nS\nSana K.Cooking · 42K subs\n

\n\n

★★★★☆

Delivery ran a few days past the estimate, but support answered every message and the refill covered the drop.

\nD\nDaniyal A.Gaming · 7K subs\n

\n\n

Questions before you order

How long does delivery take?▾

Watch hours run 10–35 days depending on the size of the package. Subscribers land across 10–14 days. Anything faster looks artificial to YouTube's systems, so we pace it deliberately.

What do you need from me?▾

Your channel link and the videos you want the hours on. Never your password, and never channel access — if anyone asks for either, stop.

How do I track my order?▾

Every order creates a unique SKU the moment you tap the button. Quote it in WhatsApp and check \"My orders\" in your account for its status.

What is the refund policy?▾

If delivery hasn't started within 7 days you get a full refund. Once delivery is under way, drops are covered by the 90-day refill rather than cash back.

Is my channel eligible?▾

Channels with original long-form uploads and no active strikes are. We review before starting and decline reused or auto-generated content — those channels fail the YPP review regardless of hours.

\n\n

My orders

Quote the SKU in WhatsApp — it's how both sides track the job.

\n\n

Seller panel

Publish a package, then take the order in your own WhatsApp inbox.

\n\n

Your listings

Orders on your packages

\n\n

Admin dashboard

\nMaster account\n

Seller applications

Users

Approve, revoke, ban or verify any account. Banning drops their sessions and hides their listings.

\n\n

All orders

\n\n\n\n

Log in

\n\n

\n\n\n

\n\n

New accounts start as buyers. Apply for seller access from your profile once you're in.

\n\n

Apply to sell

We approve sellers by hand. Send your application on WhatsApp and you'll hear back the same day.

\n\n

\nWhat do you sell? (optional)\n\n

\n\nOpen WhatsApp\n

\n\n

Verify your email

We sent a 6-digit code to your inbox. It expires in 30 minutes.

\n\n

\n\n\n

Didn't get it? Check spam, or ask the admin to verify you manually.

\n\n\n

Order created

\n\n

Your tracking SKU

\n\nOpen WhatsApp\n

\n\n\n`;","// THE AGENTS — frontend. Lives in the same val as main.ts.\n// main.ts imports { CONFIG, PAGE } from \"./page.ts\".\n\nexport const CONFIG = {\n brand: \"The Agents\",\n currency: \"PKR\",\n locale: \"en-PK\",\n youtubeId: \"b45wwm9gi5Y\",\n // \"youtube\" = embed | \"blob\" = self-hosted MP4 served from /media/hero.mp4.\n // Upload the file to Val Town blob storage under the key hero.mp4, then\n // switch this to \"blob\" — autoplays muted on loop with no YouTube chrome.\n heroMode: \"youtube\",\n // Brand WhatsApp — used for seller requests and for packages sold by the house.\n brandWa: \"https://wa.me/message/EQTSKXH474MID1\",\n supportEmail: \"rayandnp@gmail.com\",\n};\n\nexport const PAGE = `\n\n\n\n\n\n${CONFIG.brand} — grow your YouTube channel faster\n\n\n\n\n\n\n\n\n\n\n\n\n

\n\n\n

\n\nA\n${CONFIG.brand}\n\n\n\n\n

\n\n

\n\n\n

\nCheck your inbox for a 6-digit code and verify your email to publish or apply as a seller.\n\n

\n\n\n

\n\n Trusted by creators in 20+ countries\n\n

\nGrow Your YouTube
Channel Faster.\n

\nPremium YouTube services designed to help creators reach their growth and monetization goals.\n

\nOpen Marketplace\nView Services\n\n

Orders delivered: 12,400+
Avg. delivery: 28 days
Refill cover: 90 days

\n${CONFIG.heroMode === \"blob\"\n? `

`\n: ``}\n

\n\n

\nYT\n

Channel analytics

Last 28 days

\n\n Monetized\n\n

Subscribers

1,042

Watch hours

4,118

Views

318K

\n\n

\n\n\n\n\n\n\n\n

\n\n

✓Secure checkout

⚡Fast delivery

💬Customer support

#Order tracking

★Verified service

\n\n

Services built for channels

Pick what your channel is short of. Every order is tracked with its own SKU and confirmed on WhatsApp.

\n\n

Pricing that scales with the channel

One-off packages. No subscription, no channel password, no access to your account.

Starter

For channels early in the watch-hour climb.

${CONFIG.currency} 11,500

Delivery in 10–14 days

✓1,000 watch hours
✓Retention held above 45%
✓Drip-fed daily
✓SKU order tracking

\n\n

Creator

\nMOST POPULAR\n

The full monetization requirement, handled.

${CONFIG.currency} 42,000

Delivery in 28–35 days

✓4,000 watch hours
✓1,000 subscribers
✓Natural ratio pacing
✓90-day refill cover
✓Pre-order channel review

\n\n

Pro

Monetization plus three months of managed growth.

${CONFIG.currency} 78,000

Delivery in 30 days, then managed

✓Everything in Creator
✓Shorts feed push
✓Thumbnail and title review
✓Priority support line

\n\n

Marketplace

Packages published by approved sellers. You order in their own WhatsApp inbox.

\n\n

No seller listings yet. The packages above are sold directly by ${CONFIG.brand}.

\n\n

What creators say

★★★★★

Hit the 4,000 hours in five weeks and the review passed first time. The SKU made it easy to keep track of where my order was.

\nH\nHamza R.Tech reviews · 18K subs\n

\n\n

★★★★★

Subscribers arrived gradually instead of in one suspicious spike. My retention graph didn't wobble at all.

\nS\nSana K.Cooking · 42K subs\n

\n\n

★★★★☆

Delivery ran a few days past the estimate, but support answered every message and the refill covered the drop.

\nD\nDaniyal A.Gaming · 7K subs\n

\n\n

Questions before you order

How long does delivery take?▾

Watch hours run 10–35 days depending on the size of the package. Subscribers land across 10–14 days. Anything faster looks artificial to YouTube's systems, so we pace it deliberately.

What do you need from me?▾

Your channel link and the videos you want the hours on. Never your password, and never channel access — if anyone asks for either, stop.

How do I track my order?▾

Every order creates a unique SKU the moment you tap the button. Quote it in WhatsApp and check \"My orders\" in your account for its status.

What is the refund policy?▾

If delivery hasn't started within 7 days you get a full refund. Once delivery is under way, drops are covered by the 90-day refill rather than cash back.

Is my channel eligible?▾

Channels with original long-form uploads and no active strikes are. We review before starting and decline reused or auto-generated content — those channels fail the YPP review regardless of hours.

\n\n

My orders

Quote the SKU in WhatsApp — it's how both sides track the job.

\n\n

Seller panel

Publish a package, then take the order in your own WhatsApp inbox.

\n\n

Your listings

Orders on your packages

\n\n

Admin dashboard

\nMaster account\n

Seller applications

Users

Approve, revoke, ban or verify any account. Banning drops their sessions and hides their listings.

\n\n

All orders

\n\n\n\n

Log in

\n\n

\n\n\n

\n\n

New accounts start as buyers. Apply for seller access from your profile once you're in.

\n\n

Apply to sell

We approve sellers by hand. Send your application on WhatsApp and you'll hear back the same day.

\n\n

\nWhat do you sell? (optional)\n\n

\n\nOpen WhatsApp\n

\n\n

Verify your email

We sent a 6-digit code to your inbox. It expires in 30 minutes.

\n\n

\n\n\n

Didn't get it? Check spam, or ask the admin to verify you manually.

\n\n\n

Order created

\n\n

Your tracking SKU

\n\nOpen WhatsApp\n

\n\n\n`;","createdAt",["D",1789215121237],"branchVersion","branchId","ffa65750-a2bb-44f4-bf59-b45deb4c8118","id","49c17bf8-dd10-4afa-aff7-a6e807ffe5a4","TheAgents",["D",1789198617445],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","47eaf13b-b72f-4418-ae2f-ebe9fff309ae","pinnedFileId","bbc8531e-ae7c-11f1-af98-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0783d-81e8-754f-ad5a-c8c2fb0c005f","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_97":96,"_105":101},"org",{"_97":96,"_98":99,"_100":101,"_18":55,"_102":103,"_104":25},"branch",{"_13":86,"_32":87,"_43":42,"_88":44,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":45,"_95":96},"isOwned",76,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","AyanAfzal","handle","displayName","Rayan Bhatti","avatar","https://lh3.googleusercontent.com/a/ACg8ocLHYtPrlNBVkdnNY7c7Sp49jHoTN9_El-TKpOlHxwIPQn6Saw=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":166,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":167,"_81":168,"_83":169,"_85":25},"tree",[157,158],"files",[157,158],"counts",{"_145":63,"_146":147,"_148":63,"_149":150,"_151":152},"contents",[127,128],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":136,"_32":137,"_30":57,"_130":-5,"_41":42,"_40":138,"_131":25,"_38":139,"_13":140,"_33":141,"_35":142,"_24":25,"_134":143,"_27":144},{"_43":129,"_32":28,"_30":31,"_130":-5,"_41":42,"_40":14,"_131":25,"_38":132,"_13":133,"_33":34,"_35":37,"_24":25,"_134":-5,"_27":135},"dc7a8da9-6b3e-4eaf-83b9-0d23aa28279e","parentId","latest",["D",1789215121237],22,"label",[28],"ae753ec2-8e83-409e-86ea-744e069b518d","main.ts",39,["D",1789214762517],9,"http","/**\n * THE AGENTS — creator-services marketplace. Single Val Town HTTP val.\n *\n * SETUP\n * 1. Paste into a new HTTP val, save. Tables self-create on first request.\n * 2. Env vars: ADMIN_EMAIL, ADMIN_PASSWORD. Unset = the fallbacks below.\n *\n * SECURITY: the fallback password sits in source — anyone who can read this\n * val owns the admin account. Set ADMIN_PASSWORD as an env var and change the\n * fallback to junk. Passwords are stored PBKDF2-SHA256 / 150k / per-user salt;\n * changing the env var re-hashes the admin row on the next request.\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { CONFIG, PAGE } from \"./page.ts\";\n\n/* ================================================================== */\n/* config */\n/* ================================================================== */\n\n\n\nconst ADMIN_EMAIL = (Deno.env.get(\"ADMIN_EMAIL\") || \"rayandnp@gmail.com\").toLowerCase();\nconst ADMIN_PASSWORD = Deno.env.get(\"ADMIN_PASSWORD\") || \"Ayan9823\";\nconst ADMIN_NAME = \"Ayan\";\n\nconst T = {\n users: \"users\",\n orders: \"orders\",\n listings: \"listings\",\n requests: \"seller_requests\",\n sessions: \"ta_sessions\",\n};\n\n/** House packages. Prices live server-side so the client can't set its own. */\nconst PACKAGES: Record = {\n starter: { title: \"Starter — 1,000 watch hours\", price: 11500 },\n creator: { title: \"Creator — 4,000 hours + 1,000 subscribers\", price: 42000 },\n pro: { title: \"Pro — monetization + 90 days of growth\", price: 78000 },\n monetization: { title: \"YouTube monetization pack\", price: 42000 },\n watchhours: { title: \"Watch hours package\", price: 11500 },\n subscribers: { title: \"Subscribers package\", price: 9000 },\n views: { title: \"Views package\", price: 6500 },\n shorts: { title: \"Shorts growth package\", price: 14000 },\n channel: { title: \"Channel growth package\", price: 25000 },\n};\n\n/* ================================================================== */\n/* sqlite helpers */\n/* ================================================================== */\n\ntype Row = Record;\n\nasync function q(sql: string, args: any[] = []): Promise {\n const res: any = await sqlite.execute({ sql, args });\n const cols: string[] = res?.columns ?? [];\n const rows: any[] = res?.rows ?? [];\n return rows.map((r: any) =>\n Array.isArray(r) ? Object.fromEntries(cols.map((c, i) => [c, r[i]])) : (r as Row)\n );\n}\nasync function run(sql: string, args: any[] = []): Promise {\n return await sqlite.execute({ sql, args });\n}\nasync function one(sql: string, args: any[] = []): Promise {\n const rows = await q(sql, args);\n return rows.length ? rows[0] : null;\n}\n\n/* ================================================================== */\n/* bootstrap */\n/* ================================================================== */\n\nlet ready: Promise | null = null;\nconst init = () => (ready ??= bootstrap());\n\nasync function bootstrap(): Promise {\n await run(`CREATE TABLE IF NOT EXISTS ${T.users} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT NOT NULL,\n email TEXT NOT NULL UNIQUE,\n role TEXT NOT NULL DEFAULT 'buyer',\n pass_hash TEXT NOT NULL,\n pass_salt TEXT NOT NULL,\n created_at TEXT NOT NULL\n )`);\n\n await run(`CREATE TABLE IF NOT EXISTS ${T.sessions} (\n token TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL,\n created_at TEXT NOT NULL\n )`);\n\n await run(`CREATE TABLE IF NOT EXISTS ${T.listings} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n seller_id INTEGER NOT NULL,\n seller_name TEXT NOT NULL,\n title TEXT NOT NULL,\n description TEXT NOT NULL DEFAULT '',\n price REAL NOT NULL DEFAULT 0,\n category TEXT NOT NULL DEFAULT 'Growth',\n wa_link TEXT NOT NULL,\n active INTEGER NOT NULL DEFAULT 1,\n created_at TEXT NOT NULL\n )`);\n\n await run(`CREATE TABLE IF NOT EXISTS ${T.orders} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n sku TEXT NOT NULL UNIQUE,\n listing_id INTEGER,\n package_id TEXT,\n product_title TEXT NOT NULL,\n price REAL NOT NULL DEFAULT 0,\n seller_name TEXT NOT NULL,\n seller_id INTEGER,\n buyer_name TEXT,\n buyer_email TEXT,\n status TEXT NOT NULL DEFAULT 'Pending',\n created_at TEXT NOT NULL\n )`);\n\n await run(`CREATE TABLE IF NOT EXISTS ${T.requests} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n user_id INTEGER NOT NULL,\n name TEXT NOT NULL,\n email TEXT NOT NULL,\n note TEXT DEFAULT '',\n status TEXT NOT NULL DEFAULT 'pending',\n created_at TEXT NOT NULL,\n decided_at TEXT\n )`);\n\n await run(`CREATE UNIQUE INDEX IF NOT EXISTS idx_orders_sku ON ${T.orders}(sku)`);\n await run(`CREATE INDEX IF NOT EXISTS idx_listings_seller ON ${T.listings}(seller_id)`);\n await run(`CREATE INDEX IF NOT EXISTS idx_requests_status ON ${T.requests}(status)`);\n\n await migrate();\n await seedAdmin();\n}\n\n/** Adds columns to tables that already exist in a live database.\n * CREATE TABLE IF NOT EXISTS never alters an existing table, so anything\n * added after your first deploy has to come through here. */\nasync function ensureColumn(table: string, column: string, ddl: string, backfill?: string) {\n const cols = await q(`PRAGMA table_info(${table})`);\n if (cols.some((c) => String(c.name) === column)) return;\n await run(`ALTER TABLE ${table} ADD COLUMN ${column} ${ddl}`);\n if (backfill) await run(backfill);\n}\n\nasync function migrate(): Promise {\n // Accounts that existed before verification shipped are grandfathered in —\n // backfilling to 0 would lock out every current user.\n await ensureColumn(T.users, \"verified\", \"INTEGER NOT NULL DEFAULT 0\", `UPDATE ${T.users} SET verified = 1`);\n await ensureColumn(T.users, \"banned\", \"INTEGER NOT NULL DEFAULT 0\");\n await ensureColumn(T.users, \"verify_code\", \"TEXT\");\n await ensureColumn(T.users, \"verify_expires\", \"TEXT\");\n await ensureColumn(T.users, \"verify_sent_at\", \"TEXT\");\n await ensureColumn(T.orders, \"updated_at\", \"TEXT\");\n}\n\nasync function seedAdmin(): Promise {\n const salt = randomHex(16);\n const hash = await hashPassword(ADMIN_PASSWORD, salt);\n const existing = await one(`SELECT id, role, pass_hash, pass_salt FROM ${T.users} WHERE email = ?`, [\n ADMIN_EMAIL,\n ]);\n\n if (!existing) {\n await run(\n `INSERT INTO ${T.users} (name, email, role, pass_hash, pass_salt, created_at)\n VALUES (?, ?, 'admin', ?, ?, ?)`,\n [ADMIN_NAME, ADMIN_EMAIL, hash, salt, new Date().toISOString()]\n );\n return;\n }\n\n // Keep the admin row in sync with the current ADMIN_PASSWORD env value.\n const current = await hashPassword(ADMIN_PASSWORD, String(existing.pass_salt));\n if (current !== String(existing.pass_hash) || existing.role !== \"admin\") {\n await run(`UPDATE ${T.users} SET role = 'admin', pass_hash = ?, pass_salt = ? WHERE id = ?`, [\n hash,\n salt,\n existing.id,\n ]);\n }\n // The master account can never be left banned or unverified.\n await run(`UPDATE ${T.users} SET banned = 0, verified = 1 WHERE email = ?`, [ADMIN_EMAIL]);\n}\n\n/* ================================================================== */\n/* crypto + sessions */\n/* ================================================================== */\n\nconst enc = new TextEncoder();\n\nfunction toHex(buf: ArrayBuffer | Uint8Array): string {\n const b = buf instanceof Uint8Array ? buf : new Uint8Array(buf);\n return Array.from(b).map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\nfunction randomHex(bytes: number): string {\n return toHex(crypto.getRandomValues(new Uint8Array(bytes)));\n}\nasync function hashPassword(password: string, salt: string): Promise {\n const key = await crypto.subtle.importKey(\"raw\", enc.encode(password), \"PBKDF2\", false, [\n \"deriveBits\",\n ]);\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt: enc.encode(salt), iterations: 150000, hash: \"SHA-256\" },\n key,\n 256\n );\n return toHex(bits);\n}\nfunction safeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\nfunction bearer(req: Request): string | null {\n const m = (req.headers.get(\"authorization\") || \"\").match(/^Bearer\\s+(.+)$/i);\n return m ? m[1].trim() : null;\n}\nasync function currentUser(req: Request): Promise {\n const token = bearer(req);\n if (!token) return null;\n return await one(\n `SELECT u.id, u.name, u.email, u.role, u.verified, u.banned FROM ${T.sessions} s\n JOIN ${T.users} u ON u.id = s.user_id WHERE s.token = ? AND u.banned = 0`,\n [token]\n );\n}\nasync function newSession(userId: number): Promise {\n const token = randomHex(32);\n await run(`INSERT INTO ${T.sessions} (token, user_id, created_at) VALUES (?, ?, ?)`, [\n token,\n userId,\n new Date().toISOString(),\n ]);\n return token;\n}\n/** Admin gate: role must be admin AND the email must be the master account. */\nfunction isAdmin(user: Row | null): boolean {\n return !!user && user.role === \"admin\" && String(user.email).toLowerCase() === ADMIN_EMAIL;\n}\nconst canSell = (u: Row | null) =>\n !!u && Number(u.verified) === 1 && (u.role === \"approved_seller\" || isAdmin(u));\nconst isVerified = (u: Row | null) => !!u && Number(u.verified) === 1;\n\n/* ================================================================== */\n/* WhatsApp link handling */\n/* ================================================================== */\n\n/** wa.me/message/

 links resolve at WhatsApp and drop the query string,\n * so ?text= never arrives. Only wa.me/ and api.whatsapp.com/send?phone=\n * carry a prefilled body. `prefill` tells the client to fall back to clipboard. */\nfunction buildWaUrl(raw: string, message: string): { url: string; prefill: boolean } {\n  const link = (raw || \"\").trim();\n  if (/^\\+?\\d[\\d\\s\\-()]{6,}$/.test(link)) {\n    return {\n      url: `https://wa.me/${link.replace(/\\D/g, \"\")}?text=${encodeURIComponent(message)}`,\n      prefill: true,\n    };\n  }\n  let url: URL;\n  try {\n    url = new URL(link.startsWith(\"http\") ? link : `https://${link}`);\n  } catch {\n    return { url: CONFIG.brandWa, prefill: false };\n  }\n  const host = url.hostname.replace(/^www\\./, \"\");\n  if (host === \"wa.me\" && /^\\/message\\//i.test(url.pathname)) return { url: url.toString(), prefill: false };\n  if (host === \"chat.whatsapp.com\") return { url: url.toString(), prefill: false };\n  if (host === \"wa.me\" && /^\\/\\+?\\d{6,}$/.test(url.pathname)) {\n    url.searchParams.set(\"text\", message);\n    return { url: url.toString(), prefill: true };\n  }\n  if ((host === \"api.whatsapp.com\" || host === \"web.whatsapp.com\") && url.searchParams.get(\"phone\")) {\n    url.searchParams.set(\"text\", message);\n    return { url: url.toString(), prefill: true };\n  }\n  return { url: url.toString(), prefill: false };\n}\n\nfunction validWaLink(raw: string): boolean {\n  const link = (raw || \"\").trim();\n  if (!link) return false;\n  if (/^\\+?\\d[\\d\\s\\-()]{6,}$/.test(link)) return true;\n  try {\n    const host = new URL(link.startsWith(\"http\") ? link : `https://${link}`).hostname.replace(/^www\\./, \"\");\n    return [\"wa.me\", \"api.whatsapp.com\", \"web.whatsapp.com\", \"chat.whatsapp.com\"].includes(host);\n  } catch {\n    return false;\n  }\n}\n\n/* ================================================================== */\n/* SKU                                                                */\n/* ================================================================== */\n\nfunction skuCandidate(width = 6): string {\n  const max = Math.pow(10, width);\n  const min = Math.pow(10, width - 1);\n  return `SKU-${(crypto.getRandomValues(new Uint32Array(1))[0] % (max - min)) + min}`;\n}\n\n/** Uniqueness comes from the UNIQUE index, not a prior SELECT — check-then-insert\n * races the moment two buyers tap in the same second. */\nasync function insertOrder(o: {\n  listingId: number | null;\n  packageId: string | null;\n  title: string;\n  price: number;\n  sellerName: string;\n  sellerId: number | null;\n  buyerName: string | null;\n  buyerEmail: string | null;\n}): Promise {\n  const now = new Date().toISOString();\n  for (let i = 0; i < 14; i++) {\n    const sku = skuCandidate(i < 10 ? 6 : 8);\n    try {\n      await run(\n        `INSERT INTO ${T.orders}\n         (sku, listing_id, package_id, product_title, price, seller_name, seller_id,\n          buyer_name, buyer_email, status, created_at)\n         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'Pending', ?)`,\n        [sku, o.listingId, o.packageId, o.title, o.price, o.sellerName, o.sellerId, o.buyerName, o.buyerEmail, now]\n      );\n      return sku;\n    } catch (err: any) {\n      if (/UNIQUE|constraint/i.test(String(err?.message || err))) continue;\n      throw err;\n    }\n  }\n  throw new Error(\"Could not allocate a unique SKU\");\n}\n\n/* ================================================================== */\n/* helpers                                                            */\n/* ================================================================== */\n\nconst json = (data: unknown, status = 200) =>\n  new Response(JSON.stringify(data), {\n    status,\n    headers: { \"content-type\": \"application/json; charset=utf-8\" },\n  });\n\nconst htmlRes = (b: string, status = 200) =>\n  new Response(b, { status, headers: { \"content-type\": \"text/html; charset=utf-8\" } });\n\nasync function readBody(req: Request): Promise {\n  try {\n    return (await req.json()) as Row;\n  } catch {\n    return {};\n  }\n}\n\nconst money = (n: number) =>\n  new Intl.NumberFormat(CONFIG.locale, { maximumFractionDigits: 0 }).format(Number(n) || 0);\n\nconst priceLabel = (n: number) => `${CONFIG.currency} ${money(n)}`;\n\n/** Exact checkout message format. */\nconst orderMessage = (sku: string, title: string, price: number) =>\n  `Order ${sku} - Product: ${title} - Price: ${priceLabel(price)}. Sent from ${CONFIG.brand}. Please confirm this order.`;\n\n/* ================================================================== */\n/* router                                                             */\n/* ================================================================== */\n\nexport default async function (req: Request): Promise {\n  await init();\n  const url = new URL(req.url);\n  const path = url.pathname.replace(/\\/+$/, \"\") || \"/\";\n  const method = req.method.toUpperCase();\n\n  try {\n    if (method === \"GET\" && path === \"/\") return htmlRes(PAGE);\n    if (method === \"GET\" && path === \"/health\") return json({ ok: true });\n    if (method === \"GET\" && path === \"/media/hero.mp4\") return await heroVideo();\n\n    if (method === \"POST\" && path === \"/api/register\") return await register(req);\n    if (method === \"POST\" && path === \"/api/login\") return await login(req);\n    if (method === \"POST\" && path === \"/api/logout\") return await logout(req);\n    if (method === \"GET\" && path === \"/api/me\") return await me(req);\n    if (method === \"POST\" && path === \"/api/verify-email\") return await verifyEmail(req);\n    if (method === \"POST\" && path === \"/api/resend-code\") return await resendCode(req);\n\n    if (method === \"GET\" && path === \"/api/listings\") return await getListings();\n    if (method === \"POST\" && path === \"/api/listings\") return await createListing(req);\n    if (method === \"POST\" && path === \"/api/listings/delete\") return await deleteListing(req);\n\n    if (method === \"POST\" && (path === \"/create-order\" || path === \"/api/create-order\"))\n      return await createOrder(req);\n\n    if (method === \"POST\" && path === \"/api/request-seller\") return await requestSeller(req);\n    if (method === \"GET\" && path === \"/api/my-orders\") return await myOrders(req);\n    if (method === \"GET\" && path === \"/api/seller-orders\") return await sellerOrders(req);\n    if (method === \"POST\" && path === \"/api/order-status\") return await setOrderStatus(req);\n\n    if (method === \"GET\" && path === \"/api/admin/pending-sellers\") return await pendingSellers(req);\n    if (method === \"POST\" && path === \"/api/admin/approve-seller\") return await approveSeller(req);\n    if (method === \"GET\" && path === \"/api/admin/orders\") return await adminOrders(req);\n    if (method === \"GET\" && path === \"/api/admin/users\") return await adminUsers(req);\n    if (method === \"POST\" && path === \"/api/admin/user-action\") return await adminUserAction(req);\n\n    return json({ error: \"Not found\" }, 404);\n  } catch (err: any) {\n    console.error(err);\n    return json({ error: \"Server error\", detail: String(err?.message || err) }, 500);\n  }\n}\n\n/* ================================================================== */\n/* auth                                                               */\n/* ================================================================== */\n\nasync function register(req: Request): Promise {\n  const b = await readBody(req);\n  const name = String(b.name || \"\").trim();\n  const email = String(b.email || \"\").trim().toLowerCase();\n  const password = String(b.password || \"\");\n\n  if (name.length < 2) return json({ error: \"Enter your full name.\" }, 400);\n  if (!/^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(email)) return json({ error: \"That email isn't valid.\" }, 400);\n  if (password.length < 6) return json({ error: \"Use at least 6 characters.\" }, 400);\n  if (email === ADMIN_EMAIL) return json({ error: \"That account already exists. Log in instead.\" }, 409);\n\n  if (await one(`SELECT id FROM ${T.users} WHERE email = ?`, [email]))\n    return json({ error: \"An account already uses that email. Log in instead.\" }, 409);\n\n  const salt = randomHex(16);\n  const hash = await hashPassword(password, salt);\n  await run(\n    `INSERT INTO ${T.users} (name, email, role, pass_hash, pass_salt, created_at, verified)\n     VALUES (?, ?, 'buyer', ?, ?, ?, 0)`,\n    [name, email, hash, salt, new Date().toISOString()]\n  );\n  const user = await one(`SELECT id, name, email, role FROM ${T.users} WHERE email = ?`, [email]);\n  const mail = await issueVerification(Number(user!.id), email, name);\n  return json({\n    success: true,\n    token: await newSession(Number(user!.id)),\n    user,\n    verified: false,\n    mailSent: mail.ok,\n  });\n}\n\nasync function login(req: Request): Promise {\n  const b = await readBody(req);\n  const email = String(b.email || \"\").trim().toLowerCase();\n  const password = String(b.password || \"\");\n  const row = await one(\n    `SELECT id, name, email, role, verified, banned, pass_hash, pass_salt FROM ${T.users} WHERE email = ?`,\n    [email]\n  );\n  const generic = json({ error: \"Email or password is wrong.\" }, 401);\n  if (!row) return generic;\n  if (Number(row.banned) === 1)\n    return json({ error: \"This account is suspended. Contact support.\" }, 403);\n  const hash = await hashPassword(password, String(row.pass_salt));\n  if (!safeEqual(hash, String(row.pass_hash))) return generic;\n  return json({\n    success: true,\n    token: await newSession(Number(row.id)),\n    user: { id: row.id, name: row.name, email: row.email, role: row.role },\n    verified: Number(row.verified) === 1,\n  });\n}\n\nasync function logout(req: Request): Promise {\n  const token = bearer(req);\n  if (token) await run(`DELETE FROM ${T.sessions} WHERE token = ?`, [token]);\n  return json({ success: true });\n}\n\nasync function me(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ user: null });\n  const pending = await one(\n    `SELECT id FROM ${T.requests} WHERE user_id = ? AND status = 'pending'`,\n    [user.id]\n  );\n  return json({\n    user: { id: user.id, name: user.name, email: user.email, role: user.role },\n    admin: isAdmin(user),\n    canSell: canSell(user),\n    verified: isVerified(user),\n    sellerRequestPending: !!pending,\n  });\n}\n\n/* ================================================================== */\n/* email + verification                                               */\n/* ================================================================== */\n\n/**\n * Two backends. Resend if RESEND_API_KEY is set (needs a verified sending\n * domain), otherwise Val Town's std/email — which on the free plan only\n * reaches your own address, so anything else fails and lands in the logs.\n */\nasync function sendMail(to: string, subject: string, text: string): Promise<{ ok: boolean; error?: string }> {\n  const key = Deno.env.get(\"RESEND_API_KEY\");\n  if (key) {\n    try {\n      const from = Deno.env.get(\"MAIL_FROM\") || `${CONFIG.brand} `;\n      const res = await fetch(\"https://api.resend.com/emails\", {\n        method: \"POST\",\n        headers: { authorization: `Bearer ${key}`, \"content-type\": \"application/json\" },\n        body: JSON.stringify({ from, to, subject, text }),\n      });\n      if (res.ok) return { ok: true };\n      return { ok: false, error: (await res.text()).slice(0, 300) };\n    } catch (e: any) {\n      return { ok: false, error: String(e?.message || e).slice(0, 300) };\n    }\n  }\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/email\");\n    await mod.email({ to, subject, text });\n    return { ok: true };\n  } catch (e: any) {\n    return { ok: false, error: String(e?.message || e).slice(0, 300) };\n  }\n}\n\nasync function issueVerification(userId: number, email: string, name: string) {\n  const code = String((crypto.getRandomValues(new Uint32Array(1))[0] % 900000) + 100000);\n  const expires = new Date(Date.now() + 30 * 60 * 1000).toISOString();\n  await run(\n    `UPDATE ${T.users} SET verify_code = ?, verify_expires = ?, verify_sent_at = ? WHERE id = ?`,\n    [code, expires, new Date().toISOString(), userId]\n  );\n  const text =\n    `Hi ${name},\\n\\nYour ${CONFIG.brand} verification code is ${code}\\n` +\n    `It expires in 30 minutes.\\n\\nIf you did not create this account, ignore this email.`;\n  const mail = await sendMail(email, `${code} is your ${CONFIG.brand} code`, text);\n  // Always log it: with no mail provider configured this is the only copy.\n  console.log(`[verify] ${email} code=${code} sent=${mail.ok}${mail.error ? \" err=\" + mail.error : \"\"}`);\n  return mail;\n}\n\nasync function verifyEmail(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  if (isVerified(user)) return json({ success: true, already: true });\n\n  const code = String((await readBody(req)).code || \"\").trim();\n  const row = await one(`SELECT verify_code, verify_expires FROM ${T.users} WHERE id = ?`, [user.id]);\n  if (!row || !row.verify_code) return json({ error: \"No code on file. Send a new one.\" }, 400);\n  if (new Date(String(row.verify_expires)).getTime() < Date.now())\n    return json({ error: \"That code expired. Send a new one.\" }, 400);\n  if (!safeEqual(code, String(row.verify_code))) return json({ error: \"That code is wrong.\" }, 400);\n\n  await run(\n    `UPDATE ${T.users} SET verified = 1, verify_code = NULL, verify_expires = NULL WHERE id = ?`,\n    [user.id]\n  );\n  return json({ success: true });\n}\n\nasync function resendCode(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  if (isVerified(user)) return json({ success: true, already: true });\n\n  const row = await one(`SELECT verify_sent_at FROM ${T.users} WHERE id = ?`, [user.id]);\n  const last = row && row.verify_sent_at ? new Date(String(row.verify_sent_at)).getTime() : 0;\n  const wait = 60000 - (Date.now() - last);\n  if (wait > 0) return json({ error: `Wait ${Math.ceil(wait / 1000)}s before asking for another code.` }, 429);\n\n  const mail = await issueVerification(Number(user.id), String(user.email), String(user.name));\n  return json({ success: true, mailSent: mail.ok });\n}\n\n/* ================================================================== */\n/* listings                                                           */\n/* ================================================================== */\n\nasync function getListings(): Promise {\n  const listings = await q(\n    `SELECT l.id, l.title, l.description, l.price, l.category, l.seller_name, l.seller_id, l.created_at\n       FROM ${T.listings} l JOIN ${T.users} u ON u.id = l.seller_id\n      WHERE l.active = 1 AND u.banned = 0 AND u.role IN ('approved_seller','admin')\n      ORDER BY l.id DESC LIMIT 200`\n  );\n  return json({ listings });\n}\n\nasync function createListing(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  if (!isVerified(user)) return json({ error: \"Verify your email before publishing.\" }, 403);\n  if (!canSell(user)) return json({ error: \"Your seller account is not approved yet.\" }, 403);\n\n  const b = await readBody(req);\n  const title = String(b.title || \"\").trim();\n  const description = String(b.description || \"\").trim();\n  const price = Number(b.price);\n  const category = String(b.category || \"Growth\").trim() || \"Growth\";\n  const waLink = String(b.waLink || \"\").trim();\n\n  if (title.length < 3) return json({ error: \"Give the listing a title.\" }, 400);\n  if (!Number.isFinite(price) || price <= 0) return json({ error: \"Enter a price above zero.\" }, 400);\n  if (!validWaLink(waLink))\n    return json({ error: \"Use a wa.me short link, an api.whatsapp.com link, or a full phone number.\" }, 400);\n\n  await run(\n    `INSERT INTO ${T.listings}\n     (seller_id, seller_name, title, description, price, category, wa_link, active, created_at)\n     VALUES (?, ?, ?, ?, ?, ?, ?, 1, ?)`,\n    [user.id, user.name, title, description, price, category, waLink, new Date().toISOString()]\n  );\n  return json({ success: true, prefill: buildWaUrl(waLink, \"test\").prefill });\n}\n\nasync function deleteListing(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  const id = Number((await readBody(req)).id);\n  const owned = await one(\n    `SELECT id FROM ${T.listings} WHERE id = ? AND (seller_id = ? OR ? = 1)`,\n    [id, user.id, isAdmin(user) ? 1 : 0]\n  );\n  if (!owned) return json({ error: \"That listing isn't yours.\" }, 403);\n  await run(`UPDATE ${T.listings} SET active = 0 WHERE id = ?`, [id]);\n  return json({ success: true });\n}\n\n/* ================================================================== */\n/* orders                                                             */\n/* ================================================================== */\n\nasync function createOrder(req: Request): Promise {\n  const b = await readBody(req);\n  const user = await currentUser(req);\n\n  let title: string, price: number, sellerName: string, waLink: string;\n  let listingId: number | null = null;\n  let sellerId: number | null = null;\n  let packageId: string | null = null;\n\n  if (b.listingId != null) {\n    const l = await one(\n      `SELECT id, title, price, seller_name, seller_id, wa_link FROM ${T.listings}\n        WHERE id = ? AND active = 1`,\n      [Number(b.listingId)]\n    );\n    if (!l) return json({ error: \"That listing is no longer available.\" }, 404);\n    listingId = Number(l.id);\n    sellerId = l.seller_id == null ? null : Number(l.seller_id);\n    title = String(l.title);\n    price = Number(l.price);\n    sellerName = String(l.seller_name);\n    waLink = String(l.wa_link);\n  } else {\n    const pkg = PACKAGES[String(b.packageId || \"\")];\n    if (!pkg) return json({ error: \"Unknown package.\" }, 400);\n    packageId = String(b.packageId);\n    title = pkg.title;\n    price = pkg.price;\n    sellerName = CONFIG.brand;\n    waLink = CONFIG.brandWa;\n  }\n\n  const sku = await insertOrder({\n    listingId,\n    packageId,\n    title,\n    price,\n    sellerName,\n    sellerId,\n    buyerName: user ? String(user.name) : null,\n    buyerEmail: user ? String(user.email) : null,\n  });\n\n  const message = orderMessage(sku, title, price);\n  const { url: waUrl, prefill } = buildWaUrl(waLink, message);\n\n  return json({\n    success: true,\n    sku,\n    waUrl,\n    message,\n    prefill,\n    product: { title, price, seller_name: sellerName },\n  });\n}\n\nasync function myOrders(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  return json({\n    orders: await q(\n      `SELECT sku, product_title, price, seller_name, status, created_at FROM ${T.orders}\n        WHERE buyer_email = ? ORDER BY id DESC LIMIT 100`,\n      [user.email]\n    ),\n  });\n}\n\nasync function sellerOrders(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  return json({\n    orders: await q(\n      `SELECT sku, product_title, price, buyer_name, status, created_at FROM ${T.orders}\n        WHERE seller_id = ? ORDER BY id DESC LIMIT 100`,\n      [user.id]\n    ),\n  });\n}\n\n/* ================================================================== */\n/* seller requests                                                    */\n/* ================================================================== */\n\nasync function requestSeller(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Create an account first, then apply.\" }, 401);\n  if (!isVerified(user)) return json({ error: \"Verify your email before applying.\" }, 403);\n  if (canSell(user)) return json({ error: \"You can already publish listings.\" }, 400);\n\n  const note = String((await readBody(req)).note || \"\").trim().slice(0, 400);\n  const existing = await one(\n    `SELECT id FROM ${T.requests} WHERE user_id = ? AND status = 'pending'`,\n    [user.id]\n  );\n  if (!existing) {\n    await run(\n      `INSERT INTO ${T.requests} (user_id, name, email, note, status, created_at)\n       VALUES (?, ?, ?, ?, 'pending', ?)`,\n      [user.id, user.name, user.email, note, new Date().toISOString()]\n    );\n  }\n\n  const message =\n    `Seller application - ${CONFIG.brand}\\n` +\n    `Name: ${user.name}\\n` +\n    `Email: ${user.email}\\n` +\n    `Account ID: ${user.id}` +\n    (note ? `\\nAbout: ${note}` : \"\") +\n    `\\n\\nPlease approve my seller access.`;\n\n  const { url: waUrl, prefill } = buildWaUrl(CONFIG.brandWa, message);\n  return json({ success: true, waUrl, message, prefill, alreadyPending: !!existing });\n}\n\nasync function pendingSellers(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n  return json({\n    requests: await q(\n      `SELECT r.id, r.user_id, r.name, r.email, r.note, r.status, r.created_at, u.role\n         FROM ${T.requests} r JOIN ${T.users} u ON u.id = r.user_id\n        ORDER BY (r.status = 'pending') DESC, r.id DESC LIMIT 200`\n    ),\n  });\n}\n\nasync function approveSeller(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n\n  const b = await readBody(req);\n  const userId = Number(b.userId);\n  const target = await one(`SELECT id, email FROM ${T.users} WHERE id = ?`, [userId]);\n  if (!target) return json({ error: \"No such user.\" }, 404);\n  if (String(target.email).toLowerCase() === ADMIN_EMAIL)\n    return json({ error: \"The admin account already has full access.\" }, 400);\n\n  await run(`UPDATE ${T.users} SET role = 'approved_seller' WHERE id = ?`, [userId]);\n  await run(\n    `UPDATE ${T.requests} SET status = 'approved', decided_at = ? WHERE user_id = ? AND status = 'pending'`,\n    [new Date().toISOString(), userId]\n  );\n  return json({ success: true });\n}\n\nasync function adminOrders(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n  const totals = await one(`SELECT COUNT(*) AS n, COALESCE(SUM(price),0) AS value FROM ${T.orders}`);\n  return json({\n    totals,\n    orders: await q(\n      `SELECT sku, product_title, price, seller_name, buyer_name, buyer_email, status, created_at\n         FROM ${T.orders} ORDER BY id DESC LIMIT 200`\n    ),\n  });\n}\n\n/* ================================================================== */\n/* frontend                                                           */\n/* ================================================================== */\n\nconst ORDER_STATUSES = [\"Pending\", \"Delivered\", \"Cancelled\"];\n\n/**\n * Who may move an order:\n *   admin  — any order, any status\n *   seller — orders on their own listings\n *   buyer  — may cancel their own order while it is still Pending\n */\nasync function setOrderStatus(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n\n  const b = await readBody(req);\n  const sku = String(b.sku || \"\").trim();\n  const status = String(b.status || \"\").trim();\n  if (!ORDER_STATUSES.includes(status)) return json({ error: \"Unknown status.\" }, 400);\n\n  const order = await one(`SELECT sku, seller_id, buyer_email, status FROM ${T.orders} WHERE sku = ?`, [sku]);\n  if (!order) return json({ error: \"No order with that SKU.\" }, 404);\n\n  const admin = isAdmin(user);\n  const isSeller = order.seller_id != null && Number(order.seller_id) === Number(user.id);\n  const isBuyer = String(order.buyer_email || \"\") === String(user.email);\n\n  let allowed = false;\n  if (admin || isSeller) allowed = true;\n  else if (isBuyer && status === \"Cancelled\" && order.status === \"Pending\") allowed = true;\n  if (!allowed) return json({ error: \"You can't change this order.\" }, 403);\n\n  await run(`UPDATE ${T.orders} SET status = ?, updated_at = ? WHERE sku = ?`, [\n    status,\n    new Date().toISOString(),\n    sku,\n  ]);\n  return json({ success: true, sku, status });\n}\n\nasync function adminUsers(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n  return json({\n    users: await q(\n      `SELECT u.id, u.name, u.email, u.role, u.verified, u.banned, u.created_at,\n              (SELECT COUNT(*) FROM ${T.listings} l WHERE l.seller_id = u.id AND l.active = 1) AS listings,\n              (SELECT COUNT(*) FROM ${T.orders} o WHERE o.seller_id = u.id) AS sales\n         FROM ${T.users} u ORDER BY u.id DESC LIMIT 300`\n    ),\n  });\n}\n\n/**\n * approve | revoke | ban | unban | verify\n * Banning also drops the user's sessions, so an open tab stops working on its\n * next request instead of staying live until the token is discarded.\n */\nasync function adminUserAction(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n\n  const b = await readBody(req);\n  const userId = Number(b.userId);\n  const action = String(b.action || \"\");\n  const target = await one(`SELECT id, email FROM ${T.users} WHERE id = ?`, [userId]);\n  if (!target) return json({ error: \"No such user.\" }, 404);\n  if (String(target.email).toLowerCase() === ADMIN_EMAIL)\n    return json({ error: \"The master account can't be changed from here.\" }, 400);\n\n  const now = new Date().toISOString();\n  switch (action) {\n    case \"approve\":\n      await run(`UPDATE ${T.users} SET role = 'approved_seller' WHERE id = ?`, [userId]);\n      await run(\n        `UPDATE ${T.requests} SET status = 'approved', decided_at = ? WHERE user_id = ? AND status = 'pending'`,\n        [now, userId]\n      );\n      break;\n    case \"revoke\":\n      await run(`UPDATE ${T.users} SET role = 'buyer' WHERE id = ?`, [userId]);\n      await run(`UPDATE ${T.listings} SET active = 0 WHERE seller_id = ?`, [userId]);\n      await run(\n        `UPDATE ${T.requests} SET status = 'revoked', decided_at = ? WHERE user_id = ? AND status = 'approved'`,\n        [now, userId]\n      );\n      break;\n    case \"ban\":\n      await run(`UPDATE ${T.users} SET banned = 1 WHERE id = ?`, [userId]);\n      await run(`DELETE FROM ${T.sessions} WHERE user_id = ?`, [userId]);\n      break;\n    case \"unban\":\n      await run(`UPDATE ${T.users} SET banned = 0 WHERE id = ?`, [userId]);\n      break;\n    case \"verify\":\n      await run(\n        `UPDATE ${T.users} SET verified = 1, verify_code = NULL, verify_expires = NULL WHERE id = ?`,\n        [userId]\n      );\n      break;\n    default:\n      return json({ error: \"Unknown action.\" }, 400);\n  }\n  return json({ success: true });\n}\n\n/**\n * Serves the hero clip from Val Town blob storage (key: hero.mp4).\n * Upload once, then set CONFIG.heroMode = \"blob\" in page.ts.\n */\nasync function heroVideo(): Promise {\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/blob\");\n    const res = await mod.blob.get(\"hero.mp4\");\n    if (!res || !res.ok || !res.body) {\n      return json({ error: \"No blob found under the key hero.mp4.\" }, 404);\n    }\n    return new Response(res.body, {\n      headers: {\n        \"content-type\": \"video/mp4\",\n        \"cache-control\": \"public, max-age=86400\",\n        \"accept-ranges\": \"none\",\n      },\n    });\n  } catch (err: any) {\n    return json({ error: \"Blob storage unavailable\", detail: String(err?.message || err) }, 500);\n  }\n}","theagentsyt",[137],"pulls","branches",1,"forks","envVars",{"_153":155,"_156":63},"connections",{"_153":63,"_154":63},"count","unfilledCount",3,"emptyCount",{"_43":136,"_32":137,"_30":57,"_130":-5,"_41":42,"_40":138,"_131":25,"_38":163,"_13":140,"_33":141,"_35":142,"_24":25,"_134":143,"_160":164,"_27":165},{"_43":129,"_32":28,"_30":31,"_130":-5,"_41":42,"_40":14,"_131":25,"_38":159,"_13":133,"_33":34,"_35":37,"_24":25,"_134":-5,"_160":161,"_27":162},["D",1789215121237],"children",[],[28],["D",1789214762517],[],[137],["D",1789198617445],{"_97":96,"_105":101},{"_97":96,"_98":99,"_100":101,"_18":55,"_102":103,"_104":25},{"_13":86,"_32":87,"_43":42,"_88":44,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":45,"_95":96},"ctx",{"_79":-5,"_124":203,"_204":205,"_206":207,"_208":25,"_209":25,"_210":25,"_211":59,"_212":-5,"_213":-7,"_214":-7,"_215":63,"_216":25,"_217":25,"_218":-5,"_219":25,"_220":25,"_221":25,"_222":-5},"ENV",{"_174":175,"_176":177,"_178":87,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194,"_195":196,"_197":198,"_199":200,"_201":202},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

\nGrow Your YouTube
Channel Faster.\n

Services built for channels

Pricing that scales with the channel

Marketplace

What creators say

Questions before you order

My orders

Seller panel

New listing

Your listings

Orders on your packages

Admin dashboard

Seller applications

Users

All orders

Log in

Apply to sell

Verify your email

Order created

\nGrow Your YouTube
Channel Faster.\n

Services built for channels

Pricing that scales with the channel

Marketplace

What creators say

Questions before you order

My orders

Seller panel

New listing

Your listings

Orders on your packages

Admin dashboard

Seller applications

Users

All orders

Log in

Apply to sell

Verify your email

Order created

\nGrow Your YouTube Channel Faster.\n

Services built for channels

Pricing that scales with the channel

Marketplace

What creators say

Questions before you order

My orders

Seller panel

New listing

Your listings

Orders on your packages

Admin dashboard

Seller applications

Users

All orders

Log in

Apply to sell

Verify your email

Order created

\nGrow Your YouTube Channel Faster.\n

Services built for channels

Pricing that scales with the channel

Marketplace

What creators say

Questions before you order

My orders

Seller panel

New listing

Your listings

Orders on your packages

Admin dashboard

Seller applications

Users

All orders

Log in

Apply to sell

Verify your email

Order created

\nGrow Your YouTube
Channel Faster.\n

\nGrow Your YouTube
Channel Faster.\n

Diff · v40