[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_181":182,"_183":184},"routes/_app.x.$handle.$name",{"_96":95,"_32":44,"_105":86,"_27":52,"_13":14,"_106":-5,"_11":107,"_108":109,"_110":111,"_112":113,"_114":115,"_20":-5,"_116":-5,"_117":-5,"_118":25,"_119":120,"_121":58,"_122":-5,"_123":-5,"_124":125},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_32":44,"_37":45,"_46":-5,"_47":25,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":25},"version",50,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","app.ts","latestPath","fileId","ff1c9f76-aedb-11f1-bdb0-1607ee4eb77e","name","fileType","script","content","// THE AGENTS — client script. Embedded by page.ts into the served HTML.\n// Lives in the same val; keep it beside main.ts and page.ts.\n\nexport const APP = `\nvar SERVICES = [\n{ id:'monetization', icon:'▶', name:'YouTube monetization pack', desc:'Watch hours and subscribers delivered together so the channel clears the YPP bar without a suspicious spike.' },\n{ id:'watchhours', icon:'⏱', name:'Watch hours', desc:'Long-form watch time from recommended-feed traffic, paced daily and held above 45% retention.' },\n{ id:'subscribers', icon:'👤', name:'Subscribers', desc:'Real accounts with history and activity, drip-fed over 10–14 days with 90-day refill cover.' },\n{ id:'views', icon:'📈', name:'Views', desc:'High-retention views for launches, with the option to target a single upload or the whole channel.' },\n{ id:'shorts', icon:'⚡', name:'Shorts growth', desc:'Shorts feed push for vertical uploads, tuned for swipe-through rate rather than raw view count.' },\n{ id:'channel', icon:'🚀', name:'Channel growth package', desc:'Thirty days of managed growth: hours, subs, thumbnail and title review, priority support.' }\n];\nvar MOTION = {\nreduce: !!(window.matchMedia && window.matchMedia('(prefers-reduced-motion: reduce)').matches),\nhover: !!(window.matchMedia && window.matchMedia('(hover:hover) and (pointer:fine)').matches),\nio: null, on: false\n};\nvar state = { token:null, user:null, admin:false, canSell:false, verified:true, pending:null, chip:'all', lastOrder:null, awaitingReturn:false, listings:[], authMode:'login', lastMsg:'' };\nvar LS_TOKEN='ta_token', LS_USER='ta_user';\nfunction $(id){ return document.getElementById(id); }\nfunction esc(s){ return String(s==null?'':s).replace(/[&<>\"']/g, function(c){\nreturn {'&':'&','<':'<','>':'>','\"':'"',\"'\":'''}[c]; }); }\nfunction money(n){ return new Intl.NumberFormat(CFG.locale,{maximumFractionDigits:0}).format(Number(n)||0); }\nfunction price(n){ return CFG.currency + ' ' + money(n); }\nvar toastTimer=null;\nfunction toast(msg){\nvar t=$('toast'); t.textContent=msg; t.classList.remove('hide');\nclearTimeout(toastTimer); toastTimer=setTimeout(function(){ t.classList.add('hide'); },3000);\n}\nasync function api(path, opts){\nopts=opts||{};\nvar headers={'content-type':'application/json'};\nif (state.token) headers.authorization='Bearer '+state.token;\nvar res=await fetch(path,{ method:opts.method||'GET', headers:headers,\nbody: opts.body ? JSON.stringify(opts.body) : undefined });\nvar data={}; try{ data=await res.json(); }catch(e){}\nif(!res.ok) throw new Error(data.error || ('Request failed ('+res.status+')'));\nreturn data;\n}\n// session\nfunction saveSession(token,user,admin,canSell,verified){\nstate.token=token; state.user=user;\nstate.admin=!!admin; state.canSell=!!canSell; state.verified=verified!==false;\nlocalStorage.setItem(LS_TOKEN,token);\nlocalStorage.setItem(LS_USER,JSON.stringify(user));\nrenderAuthArea();\n}\nfunction clearSession(){\nstate.token=null; state.user=null; state.admin=false; state.canSell=false; state.verified=true;\nlocalStorage.removeItem(LS_TOKEN); localStorage.removeItem(LS_USER);\nrenderAuthArea();\n}\nasync function restoreSession(){\nvar token=localStorage.getItem(LS_TOKEN);\nif(!token){ renderAuthArea(); return; }\nstate.token=token;\nvar cached=localStorage.getItem(LS_USER);\nif(cached){ try{ state.user=JSON.parse(cached); }catch(e){} }\nrenderAuthArea();\ntry{\nvar out=await api('/api/me');\nif(out.user) saveSession(token,out.user,out.admin,out.canSell,out.verified);\nelse clearSession();\n}catch(e){ clearSession(); }\n}\n// nav\nfunction renderAuthArea(){\nvar u=state.user;\n$('verifyBanner').classList.toggle('hide', !u || state.verified);\n// Admin and seller entry points are rendered only for accounts the server\n// confirmed — /api/me decides, never the client.\n$('navAdmin').classList.toggle('hide', !state.admin);\n$('mNavAdmin').classList.toggle('hide', !state.admin);\n$('navSell').classList.toggle('hide', !state.canSell);\n$('mNavSell').classList.toggle('hide', !state.canSell);\n$('mNavOrders').classList.toggle('hide', !u);\nvar html;\nif(!u){\nhtml=''+\n'';\n} else {\nvar role = state.admin ? 'Admin' : (state.canSell ? 'Seller' : 'Buyer');\nvar badgeCls = state.admin ? 'border-emerald/40 text-emerald' : (state.canSell ? 'border-purple/50 text-purple' : 'border-line text-mute');\nvar become = (!state.canSell && !state.admin)\n? '' : '';\nhtml=''+\n''+esc(u.name.split(' ')[0])+\n''+role+''+\nbecome+\n'';\n}\n$('authArea').innerHTML=html;\n\nvar mob;\nif(!u){\nmob=''+\n'';\n} else {\nvar roleM = state.admin ? 'Admin' : (state.canSell ? 'Seller' : 'Buyer');\nvar badgeM = state.admin ? 'border-emerald/40 text-emerald' : (state.canSell ? 'border-purple/50 text-purple' : 'border-line text-mute');\nmob='

'+\n''+esc(u.name.split(' ')[0])+''+\n''+roleM+'

'+\n((!state.canSell && !state.admin)\n? '' : '')+\n'';\n}\n$('authAreaMobile').innerHTML=mob;\n}\nfunction toggleMenu(force){\nvar d=$('menuD'); if(!d) return;\nd.open = (force===undefined) ? !d.open : !!force;\n}\nvar VIEWS = { home:'#/', orders:'#/orders', sell:'#/sell', admin:'#/admin' };\n\nfunction viewFromHash(){\nvar h = (location.hash || '#/').toLowerCase();\nif(h.indexOf('orders') > -1) return 'orders';\nif(h.indexOf('sell') > -1) return 'sell';\nif(h.indexOf('admin') > -1) return 'admin';\nreturn 'home';\n}\n\n// Back must move between views, not leave the site.\nfunction applyHash(){\nvar v = viewFromHash();\nif(v === 'admin' && !state.admin) v = 'home';\nif(v === 'sell' && !state.canSell) v = 'home';\nrender(v);\n}\n\nfunction go(view, silent){\nif(!silent && VIEWS[view] && location.hash !== VIEWS[view]) location.hash = VIEWS[view];\nrender(view);\n}\n\nfunction render(view){\n['home','orders','sell','admin'].forEach(function(v){\n$('view-'+v).classList.toggle('hide', v!==view);\n});\nwindow.scrollTo({top:0});\nif(view==='orders') loadMyOrders();\nif(view==='sell'){ renderMyListings(); loadSellerOrders(); }\nif(view==='admin') loadAdmin();\n}\n// Section anchors live inside #view-home. From the seller or admin panel that\n// view is display:none, so a bare #hash jumps nowhere — switch view first.\nfunction goSection(id){\ntoggleMenu(false);\napplyHash();\nvar el = document.getElementById(id);\nif(el) setTimeout(function(){ el.scrollIntoView({ behavior:'smooth', block:'start' }); }, 70);\n}\n\nfunction goHome(){\ntoggleMenu(false);\ngo('home');\nwindow.scrollTo({ top:0, behavior:'smooth' });\n}\n\nfunction getStarted(){\nif(!state.user) return openAuth('register');\ndocument.getElementById('pricing').scrollIntoView({behavior:'smooth'});\n}\n// modals\nfunction openModal(id){\ntoggleMenu(false);\n$(id).classList.remove('hide');\ndocument.body.classList.add('noscroll');\n}\nfunction closeModal(id){ $(id).classList.add('hide'); document.body.classList.remove('noscroll'); }\nfunction openAuth(mode){ setAuthMode(mode); openModal('authModal'); setTimeout(function(){ $('aEmail').focus(); },40); }\nfunction setAuthMode(mode){\nstate.authMode=mode;\nvar reg = mode==='register';\n$('authTitle').textContent = reg ? 'Create your account' : 'Log in';\n$('authSubmit').textContent = reg ? 'Create account' : 'Log in';\n$('nameRow').classList.toggle('hide', !reg);\n$('aName').required = reg;\n$('aPass').setAttribute('autocomplete', reg ? 'new-password' : 'current-password');\n$('tabLogin').className = 'py-2.5 rounded-xl ' + (reg ? 'text-mute' : 'bg-card font-semibold');\n$('tabRegister').className = 'py-2.5 rounded-xl ' + (reg ? 'bg-card font-semibold' : 'text-mute');\n$('authError').classList.add('hide');\n}\nasync function submitAuth(e){\ne.preventDefault();\nvar btn=$('authSubmit'), err=$('authError');\nerr.classList.add('hide'); btn.disabled=true;\ntry{\nvar out=await api(state.authMode==='register' ? '/api/register' : '/api/login', { method:'POST', body:{\nname: $('aName').value.trim(), email: $('aEmail').value.trim(), password: $('aPass').value\n}});\nsaveSession(out.token,out.user,false,false,out.verified);\nvar who=await api('/api/me');\nsaveSession(out.token,who.user,who.admin,who.canSell,who.verified);\ncloseModal('authModal');\n$('aPass').value='';\nif(state.pending){ var p=state.pending; state.pending=null; setTimeout(function(){ checkout(p); }, 300); }\ntoast('Welcome, '+out.user.name.split(' ')[0]+'.');\nif(!who.verified){\n$('verifySub').textContent = (out.mailSent===false)\n? 'We could not send the code by email. Your code is in the val logs, or ask the admin to verify you.'\n: 'We sent a 6-digit code to '+out.user.email+'. It expires in 30 minutes.';\nopenVerify();\n} else if(who.admin) go('admin');\n}catch(ex){ err.textContent=ex.message; err.classList.remove('hide'); }\nfinally{ btn.disabled=false; }\n}\nasync function logout(){\ntry{ await api('/api/logout',{method:'POST'}); }catch(e){}\nclearSession(); go('home'); toast('Logged out.');\n}\n// seller application\nfunction openSeller(){\nif(!state.user) return openAuth('register');\n$('sellerMsg').classList.add('hide');\n$('sellerOpen').classList.add('hide');\n$('sellerNoteMsg').classList.add('hide');\nopenModal('sellerModal');\n}\nasync function sendSellerRequest(btn){\nvar tab=window.open('','_blank');\nbtn.disabled=true;\ntry{\nvar out=await api('/api/request-seller',{ method:'POST', body:{ note: $('sellerNote').value.trim() }});\nvar copied=await copyText(out.message);\nif(tab && !tab.closed) tab.location.href=out.waUrl;\n$('sellerMsg').textContent=out.message;\n$('sellerMsg').classList.remove('hide');\n$('sellerOpen').href=out.waUrl;\n$('sellerOpen').classList.remove('hide');\n$('sellerNoteMsg').textContent = (out.prefill\n? 'Your application is typed into WhatsApp — just send it.'\n: 'Our support number uses a WhatsApp short link, which cannot carry a prefilled message. '\n+ (copied ? 'Your details are on the clipboard — paste them into the chat.' : 'Copy the text above and paste it into the chat.'))\n+ ' Your request is logged either way.';\n$('sellerNoteMsg').classList.remove('hide');\ntoast(out.alreadyPending ? 'Application already on file.' : 'Application submitted.');\n}catch(ex){\nif(tab && !tab.closed) tab.close();\ntoast(ex.message);\n} finally{ btn.disabled=false; }\n}\n// services + listings\nfunction renderServices(){\n$('serviceGrid').innerHTML = SERVICES.map(function(s){\nreturn '

'+\n''+s.icon+''+\n'

'+esc(s.name)+'

'+\n'

'+esc(s.desc)+'

'+\n''+\n'

';\n}).join('');\nanimateIn('#serviceGrid > *');\n}\nasync function loadListings(){\ntry{ var out=await api('/api/listings'); state.listings=out.listings||[]; }\ncatch(e){ state.listings=[]; }\nrenderListings();\n}\nfunction setChip(cat, btn){\nstate.chip = cat;\nvar all = document.querySelectorAll('#chips .chip');\nfor(var i=0;i0);\n$('listingGrid').innerHTML=list.map(function(p){\nvar cover = p.image_key\n? ' $\"\"$ '\n: '

'+esc((p.title||'?').charAt(0).toUpperCase())+'

';\nreturn '

'+\n'

'+cover+'

'+\n'

'+\n''+esc(p.category)+''+\n'#'+esc(p.id)+''+\n'

'+\n'

'+esc(p.title)+'

'+\n'

'+esc(p.description||'No description provided.')+'

'+\n'

'+\n''+esc((p.seller_name||'?').charAt(0).toUpperCase())+''+\n''+esc(p.seller_name)+''+\n'

'+\n'

'+\n''+esc(price(p.price))+''+\n''+\n'

'+\n'

';\n}).join('');\nanimateIn('#listingGrid > *');\n}\n/* checkout: window.open() fires synchronously inside the click handler —\nafter the await it loses the gesture context and iOS blocks it. */\nfunction orderListing(id, btn){ return checkout({ listingId:id }, btn); }\nfunction buyPackage(pid, btn){ return checkout({ packageId:pid }, btn); }\nasync function checkout(payload, btn){\nif(!state.user){\nstate.pending=payload;\nopenAuth('register');\n$('authTitle').textContent='Create an account to generate your SKU';\n$('authWhy').textContent='Your order number is issued to your account so you and the seller can both track it. Takes a few seconds.';\nreturn;\n}\nbtn = btn || {};\nvar tab=window.open('','_blank');\nvar label=btn.textContent;\nbtn.disabled=true; btn.textContent='Creating SKU...';\ntry{\nvar out=await api('/create-order',{ method:'POST', body:payload });\nstate.lastMsg=out.message;\nvar copied=await copyText(out.message);\nif(tab && !tab.closed) tab.location.href=out.waUrl;\nshowSku(out, copied, !tab || tab.closed);\n}catch(ex){\nif(tab && !tab.closed) tab.close();\ntoast(ex.message);\n} finally{ btn.disabled=false; btn.textContent=label; }\n}\nasync function copyText(text){\ntry{\nif(navigator.clipboard && window.isSecureContext){ await navigator.clipboard.writeText(text); return true; }\n}catch(e){}\ntry{\nvar ta=document.createElement('textarea');\nta.value=text; ta.style.position='fixed'; ta.style.opacity='0';\ndocument.body.appendChild(ta); ta.select();\nvar ok=document.execCommand('copy');\ndocument.body.removeChild(ta);\nreturn ok;\n}catch(e){ return false; }\n}\nfunction showSku(out, copied, blocked){\nstate.lastOrder = out;\n$('skuCode').textContent=out.sku;\n$('skuProduct').textContent=out.product.title;\n$('skuPrice').textContent=price(out.product.price);\n$('skuSeller').textContent=out.product.seller_name;\n$('skuMsg').textContent=out.message;\nvar note = out.prefill\n? 'The message is already typed in WhatsApp. Send it as it is and the seller will see your SKU.'\n: 'This seller uses a WhatsApp short link, which cannot carry a prefilled message. '\n+ (copied ? 'The message is on your clipboard — paste it into the chat.' : 'Copy the message above and paste it into the chat.');\nif(blocked) note+=' Your browser blocked the new tab, so use the Open WhatsApp button.';\n$('skuNote').textContent=note;\n$('skuGo').textContent = copied ? 'Copied — open WhatsApp again' : 'Copy details & open WhatsApp';\nstate.awaitingReturn = true;\nopenModal('skuModal');\nif(state.user) loadMyOrders();\n}\n// Runs inside the click, so the popup blocker allows the tab.\nasync function copyAndOpen(){\nif(!state.lastOrder) return;\nvar ok = await copyText(state.lastOrder.message);\nwindow.open(state.lastOrder.waUrl, '_blank');\nstate.awaitingReturn = true;\n$('skuGo').textContent = ok ? 'Copied — open WhatsApp again' : 'Open WhatsApp again';\n}\n\n// Coming back from WhatsApp should land on the order, not a stale modal.\ndocument.addEventListener('visibilitychange', function(){\nif(document.visibilityState !== 'visible' || !state.awaitingReturn) return;\nstate.awaitingReturn = false;\ncloseModal('skuModal');\nif(state.user) go('orders');\n});\n// orders\nfunction statusPill(st){\nvar cls = st==='Delivered' ? 'border-emerald/40 text-emerald'\n: (st==='Cancelled' ? 'border-line text-mute' : 'border-cyan/50 text-cyan');\nreturn ''+esc(st)+'';\n}\n\n// mode: 'buyer' (cancel own pending order), 'seller' / 'admin' (full control), null (read only)\nfunction statusActions(o, mode){\nif(mode==='buyer'){\nreturn o.status==='Pending'\n? ''\n: '—';\n}\nif(mode==='seller' || mode==='admin'){\nvar out='';\nif(o.status!=='Delivered') out+=' ';\nif(o.status!=='Cancelled') out+=' ';\nif(o.status!=='Pending') out+='';\nreturn out || '—';\n}\nreturn '';\n}\n\nfunction ordersTable(rows, party, partyLabel, mode){\nvar acts = !!mode;\nvar cards = '

'+rows.map(function(o){\nreturn '

'+\n'

'+\n''+esc(o.sku)+''+statusPill(o.status)+'

'+\n'

'+esc(o.product_title)+'

'+\n'

'+\n''+esc(price(o.price))+''+\n''+partyLabel+': '+esc(o[party]||'guest')+''+\n''+esc(String(o.created_at).slice(0,10))+'

'+\n(acts ? '

'+statusActions(o,mode)+'

' : '')+\n'

';\n}).join('')+'

';\nreturn cards+'

'+\n''+\n''+\n''+\n(acts?'':'')+\n''+\nrows.map(function(o){\nreturn ''+\n''+\n''+\n''+\n''+\n''+\n''+\n(acts?'':'')+\n'';\n}).join('')+'

SKU	Package	Price	'+partyLabel+'	Status	Created	Actions
'+esc(o.sku)+'	'+esc(o.product_title)+'	'+esc(price(o.price))+'	'+esc(o[party]\|\|'guest')+'	'+statusPill(o.status)+'	'+esc(String(o.created_at).slice(0,16).replace('T',' '))+'	'+statusActions(o,mode)+'

';\n}\nasync function loadMyOrders(){\nvar wrap=$('ordersWrap');\nif(!state.user){ wrap.innerHTML='

'; return; }\ntry{\nvar out=await api('/api/my-orders');\nvar rows=out.orders||[];\nwrap.innerHTML = rows.length ? ordersTable(rows,'seller_name','Seller','buyer')\n: '

'+\n'

No orders yet

'+\n'

Pick a package and your SKU appears here.

'+\n'

';\n}catch(ex){ wrap.innerHTML='

'+esc(ex.message)+'

'; }\n}\nasync function loadSellerOrders(){\nvar wrap=$('sellerOrdersWrap');\ntry{\nvar out=await api('/api/seller-orders');\nvar rows=out.orders||[];\nwrap.innerHTML = rows.length ? ordersTable(rows,'buyer_name','Buyer','seller')\n: '

Nothing ordered yet. Orders land here the moment a buyer taps your package.

';\n}catch(ex){ wrap.innerHTML='

'+esc(ex.message)+'

'; }\n}\n// seller panel\nfunction compressImage(file, maxW, quality){\nreturn new Promise(function(resolve, reject){\nif(file.size > 25000000){ reject(new Error('That file is too large to process.')); return; }\nvar reader = new FileReader();\nreader.onerror = function(){ reject(new Error('Could not read that file.')); };\nreader.onload = function(){\nvar img = new Image();\nimg.onerror = function(){ reject(new Error('That file is not a readable image.')); };\nimg.onload = function(){\nvar scale = Math.min(1, maxW / img.width);\nvar w = Math.max(1, Math.round(img.width * scale));\nvar h = Math.max(1, Math.round(img.height * scale));\nvar c = document.createElement('canvas');\nc.width = w; c.height = h;\nvar ctx = c.getContext('2d');\nctx.fillStyle = '#0B1020';\nctx.fillRect(0, 0, w, h);\nctx.drawImage(img, 0, 0, w, h);\nresolve(c.toDataURL('image/jpeg', quality));\n};\nimg.src = reader.result;\n};\nreader.readAsDataURL(file);\n});\n}\n\nfunction previewImage(){\nvar f = $('pImage').files && $('pImage').files[0];\nvar box = $('pImagePreview');\nif(!f){ box.innerHTML = 'No image'; return; }\ncompressImage(f, 1200, .82).then(function(dataUrl){\nbox.innerHTML = ' $\"\"$ ';\n$('pImageNote').textContent = 'Ready to upload, about ' + Math.round((dataUrl.length*0.75)/1024) + ' KB.';\nbox.style.animation='riseIn .4s cubic-bezier(.22,1,.36,1) both';\n}).catch(function(ex){\nbox.innerHTML = 'No image';\n$('pImageNote').textContent = ex.message;\n});\n}\n\nasync function uploadCover(){\nvar f = $('pImage').files && $('pImage').files[0];\nif(!f) return '';\nvar dataUrl = await compressImage(f, 1200, .82);\nvar out = await api('/api/upload-image', { method:'POST', body:{ dataUrl: dataUrl } });\nreturn out.key;\n}\n\nasync function publishListing(e){\ne.preventDefault();\nvar btn=e.target.querySelector('button');\nvar label=btn.textContent;\nbtn.disabled=true;\ntry{\nvar imageKey='';\nif($('pImage').files && $('pImage').files[0]){\nbtn.textContent='Uploading image...';\nimageKey=await uploadCover();\n}\nbtn.textContent='Publishing...';\nvar out=await api('/api/listings',{ method:'POST', body:{\ntitle:$('pTitle').value.trim(), price:Number($('pPrice').value), imageKey:imageKey,\ndescription:$('pDesc').value.trim(), category:$('pCat').value, waLink:$('pLink').value.trim()\n}});\n$('pTitle').value=''; $('pPrice').value=''; $('pDesc').value='';\n$('pImage').value=''; $('pImagePreview').innerHTML='No image';\n$('pImageNote').textContent='Optional. Compressed on your phone before upload.';\nawait loadListings(); renderMyListings();\ntoast(out.prefill ? 'Published. Buyers get the SKU typed in automatically.' : 'Published. Short link saved — buyers will paste the SKU.');\n}catch(ex){ toast(ex.message); }\nfinally{ btn.disabled=false; btn.textContent=label; }\n}\nfunction renderMyListings(){\nvar wrap=$('myListings');\nif(!state.user){ wrap.innerHTML=''; return; }\nvar mine=state.listings.filter(function(p){ return Number(p.seller_id)===Number(state.user.id); });\nwrap.innerHTML = mine.length ? mine.map(function(p){\nvar thumb = p.image_key\n? ' $\"\"$ '\n: '';\nreturn '

'+\nthumb+\n'

'+esc(p.title)+'

'+\n'

'+esc(price(p.price))+' · '+esc(p.category)+'

'+\n'

';\n}).join('') : '

Nothing published yet. The form puts your first package in the marketplace.

';\n}\nasync function removeListing(id){\ntry{\nawait api('/api/listings/delete',{ method:'POST', body:{ id:id }});\nawait loadListings(); renderMyListings();\ntoast('Listing removed.');\n}catch(ex){ toast(ex.message); }\n}\n\n// motion system — CSS drives every animation; this only flips a class when an\n// element scrolls into view. No library, so nothing can fail to load.\nfunction animateIn(sel){\nvar list = document.querySelectorAll(sel);\nfor(var i=0;i div > div';\nif(MOTION.reduce || !window.IntersectionObserver){\ndocument.querySelectorAll(sel).forEach(function(el){ el.classList.add('in'); });\nreturn;\n}\nMOTION.io = new IntersectionObserver(function(entries){\nentries.forEach(function(e){\nif(e.isIntersecting){ e.target.classList.add('in'); MOTION.io.unobserve(e.target); }\n});\n}, { rootMargin:'0px 0px -8% 0px', threshold:.08 });\nMOTION.on = true;\nanimateIn(sel);\n\nvar dash = document.querySelector('#heroMedia .dash');\nif(!dash) return;\nvar done = false;\nvar cio = new IntersectionObserver(function(en){\nif(done || !en[0].isIntersecting) return;\ndone = true;\ndash.querySelectorAll('.num').forEach(function(el){\nvar to = Number(el.getAttribute('data-to')) || 0;\nvar sfx = el.getAttribute('data-suffix') || '';\nvar t0 = 0;\nvar step = function(ts){\nif(!t0) t0 = ts;\nvar p = Math.min(1, (ts - t0) / 1400);\nel.textContent = Math.round(to * (1 - Math.pow(1 - p, 3))).toLocaleString(CFG.locale) + sfx;\nif(p < 1) requestAnimationFrame(step);\n};\nrequestAnimationFrame(step);\n});\nvar spark = dash.querySelector('.spark');\nif(spark && spark.getTotalLength){\nvar len = spark.getTotalLength();\nspark.style.strokeDasharray = len;\nspark.style.strokeDashoffset = len;\nspark.style.transition = 'stroke-dashoffset 1.6s cubic-bezier(.22,1,.36,1)';\nrequestAnimationFrame(function(){ spark.style.strokeDashoffset = 0; });\n}\ndash.querySelectorAll('.bar').forEach(function(b, i){\nb.style.transform = 'scaleY(0)';\nb.style.transition = 'transform .6s cubic-bezier(.34,1.56,.64,1) ' + (i*70 + 250) + 'ms';\nrequestAnimationFrame(function(){ b.style.transform = 'scaleY(1)'; });\n});\n}, { threshold:.25 });\ncio.observe(dash);\n}\n// email verification\nfunction openVerify(){ $('verifyError').classList.add('hide'); openModal('verifyModal'); setTimeout(function(){ $('vCode').focus(); },40); }\n\nasync function submitVerify(e){\ne.preventDefault();\nvar btn=$('verifySubmit'), err=$('verifyError');\nerr.classList.add('hide'); btn.disabled=true;\ntry{\nawait api('/api/verify-email',{ method:'POST', body:{ code:$('vCode').value.trim() }});\nstate.verified=true;\nvar who=await api('/api/me');\nsaveSession(state.token,who.user,who.admin,who.canSell,who.verified);\ncloseModal('verifyModal');\n$('vCode').value='';\ntoast('Email verified.');\n}catch(ex){ err.textContent=ex.message; err.classList.remove('hide'); }\nfinally{ btn.disabled=false; }\n}\n\nasync function resendVerify(btn){\nbtn.disabled=true;\ntry{\nvar out=await api('/api/resend-code',{ method:'POST' });\ntoast(out.mailSent===false ? 'Email failed — the code is in the val logs.' : 'New code sent.');\n}catch(ex){ toast(ex.message); }\nfinally{ btn.disabled=false; }\n}\n\n// order status\nasync function setStatus(sku, status, btn){\nbtn.disabled=true;\ntry{\nawait api('/api/order-status',{ method:'POST', body:{ sku:sku, status:status }});\ntoast('Order '+sku+' marked '+status.toLowerCase()+'.');\nif(!$('view-orders').classList.contains('hide')) loadMyOrders();\nif(!$('view-sell').classList.contains('hide')) loadSellerOrders();\nif(!$('view-admin').classList.contains('hide')) loadAdmin();\n}catch(ex){ toast(ex.message); btn.disabled=false; }\n}\n\n// admin\nasync function loadAdmin(){\nif(!state.admin){ go('home'); return; }\ntry{\nvar reqs=await api('/api/admin/pending-sellers');\nvar rows=reqs.requests||[];\nvar pending=rows.filter(function(r){ return r.status==='pending'; });\n$('pendingWrap').innerHTML = rows.length ? rows.map(function(r){\nvar approved = r.status==='approved' || r.role==='approved_seller';\nreturn '

'+\n'

'+esc(r.name)+'

'+\n'

'+esc(r.email)+'

'+\n(r.note ? '

'+esc(r.note)+'

' : '')+\n'

Applied '+esc(String(r.created_at).slice(0,10))+'

'+\n'

'+\n(approved\n? 'Approved seller'\n: '')+\n'

';\n}).join('') : '

No applications yet.

';\nvar us=await api('/api/admin/users');\nrenderUsers(us.users||[]);\n\nvar ord=await api('/api/admin/orders');\nvar o=ord.orders||[];\nvar t=ord.totals||{};\n$('adminTotals').innerHTML=[\n['Orders', money(t.n||0)],\n['Requested value', price(t.value||0)],\n['Applications', money(rows.length)],\n['Awaiting review', money(pending.length)]\n].map(function(pair){\nreturn '

'+pair[0]+'

'+\n'

'+esc(pair[1])+'

';\n}).join('');\n$('adminOrdersWrap').innerHTML = o.length ? ordersTable(o,'buyer_name','Buyer','admin')\n: '

No orders yet.

';\n}catch(ex){ toast(ex.message); go('home'); }\n}\nasync function approve(userId, btn){ return userAction(userId,'approve',btn); }\n\nasync function userAction(userId, action, btn){\nvar label=btn.textContent;\nbtn.disabled=true; btn.textContent='Working...';\ntry{\nawait api('/api/admin/user-action',{ method:'POST', body:{ userId:userId, action:action }});\ntoast('Done: '+action+'.');\nloadAdmin();\n}catch(ex){ toast(ex.message); btn.disabled=false; btn.textContent=label; }\n}\n\nfunction renderUsers(users){\nvar wrap=$('usersWrap');\nif(!users.length){ wrap.innerHTML='

No users yet.

'; return; }\nwrap.innerHTML=users.map(function(u){\nvar isMaster = u.role==='admin';\nvar tags='';\ntags += ''+esc(u.role)+'';\ntags += Number(u.verified)===1\n? 'verified'\n: 'unverified';\nif(Number(u.banned)===1) tags += 'banned';\n\nvar btns='';\nif(!isMaster){\nif(Number(u.verified)!==1) btns+='';\nbtns += u.role==='approved_seller'\n? ''\n: '';\nbtns += Number(u.banned)===1\n? ''\n: '';\n}\n\nreturn '

'+\n'

'+esc(u.name)+'

'+\n'

'+esc(u.email)+'

'+\n'

'+tags+'

'+\n'

'+esc(u.listings)+' listings · '+esc(u.sales)+' orders

'+\n'

'+btns+'

'+\n'

';\n}).join('');\n}\n// boot\ndocument.addEventListener('keydown', function(e){\nif(e.key==='Escape'){ ['authModal','sellerModal','skuModal'].forEach(closeModal); }\n});\n['authModal','sellerModal','skuModal'].forEach(function(id){\n$(id).addEventListener('click', function(e){ if(e.target===this) closeModal(id); });\n});\ndocument.querySelectorAll('#mobileMenu a').forEach(function(a){\na.addEventListener('click', function(){ toggleMenu(false); });\n});\nif(window.__jsErr){ var _d=$('jsErr'); _d.style.display='block'; _d.textContent=window.__jsErr; }\nwindow.addEventListener('hashchange', applyHash);\nwindow.addEventListener('popstate', applyHash);\n$('year').textContent=new Date().getFullYear();\nrenderServices();\ngo('home');\nrestoreSession();\nloadListings();\ninitMotion();\nvar sw=document.documentElement.scrollWidth, iw=window.innerWidth;\nif(sw > iw + 2){\nvar d2=$('jsErr'); d2.style.display='block';\nd2.textContent='Layout overflow: page is '+sw+'px wide vs '+iw+'px viewport.';\n}\n$('buildTag').textContent = 'Build 13 · W'+iw+'/'+sw+' · MOTION ' + (MOTION.on ? 'ON' : 'reduced');\n`;","createdAt",["D",1789239589580],"branchVersion","branchId","ffa65750-a2bb-44f4-bf59-b45deb4c8118","id","49c17bf8-dd10-4afa-aff7-a6e807ffe5a4","TheAgents",["D",1789198617445],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","47eaf13b-b72f-4418-ae2f-ebe9fff309ae","pinnedFileId","bbc8531e-ae7c-11f1-af98-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0783d-81e8-754f-ad5a-c8c2fb0c005f","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_96":95,"_104":100},"org",{"_96":95,"_97":98,"_99":100,"_18":54,"_101":102,"_103":25},"branch",{"_13":85,"_32":86,"_42":41,"_87":43,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":44,"_94":95},"isOwned",76,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","AyanAfzal","handle","displayName","Rayan Bhatti","avatar","https://lh3.googleusercontent.com/a/ACg8ocLHYtPrlNBVkdnNY7c7Sp49jHoTN9_El-TKpOlHxwIPQn6Saw=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_42":43,"_32":44,"_37":177,"_46":-5,"_47":25,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":178,"_80":179,"_82":180,"_84":25},"tree",[164,165,166],"files",[164,165,166],"counts",{"_153":62,"_154":155,"_156":62,"_157":158,"_159":160},"contents",[126,127,128],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_42":149,"_32":28,"_30":31,"_132":-5,"_40":41,"_39":14,"_134":25,"_37":150,"_13":151,"_33":34,"_35":36,"_24":25,"_138":-5,"_27":152},{"_42":140,"_32":141,"_30":56,"_132":-5,"_40":41,"_39":142,"_134":25,"_37":143,"_13":144,"_33":145,"_35":146,"_24":25,"_138":147,"_27":148},{"_42":129,"_32":130,"_30":131,"_132":-5,"_40":41,"_39":133,"_134":25,"_37":135,"_13":136,"_33":34,"_35":137,"_24":25,"_138":-5,"_27":139},"56c7308b-9eb7-447a-970a-6ee89c9a7a7c","page.ts","6a9f9a30-ae84-11f1-9032-1607ee4eb77e","parentId",46,"latest",["D",1789219643445],26,"// THE AGENTS — frontend. Lives in the same val as main.ts.\n// main.ts imports { CONFIG, PAGE } from \"./page.ts\".\n\nexport const CONFIG = {\n brand: \"The Agents\",\n currency: \"PKR\",\n locale: \"en-PK\",\n youtubeId: \"b45wwm9gi5Y\",\n // \"youtube\" = embed | \"blob\" = self-hosted MP4 served from /media/hero.mp4.\n // Upload the file to Val Town blob storage under the key hero.mp4, then\n // switch this to \"blob\" — autoplays muted on loop with no YouTube chrome.\n heroMode: \"youtube\",\n // Brand WhatsApp — used for seller requests and for packages sold by the house.\n brandWa: \"https://wa.me/message/EQTSKXH474MID1\",\n supportEmail: \"rayandnp@gmail.com\",\n};\n\nexport const PAGE = `\n\n\n\n\n\n${CONFIG.brand} — grow your YouTube channel faster\n\n\n\n\n\n\n\n\n\n\n\n\n

\n\n\n

\n\n\n\n\n

\n\n

\n\n\n

\nCheck your inbox for a 6-digit code and verify your email to publish or apply as a seller.\n\n

\n\n\n

\n\n Trusted by creators in 20+ countries\n\n

\nGrow Your YouTube
Channel Faster.\n

\nPremium YouTube services designed to help creators reach their growth and monetization goals.\n

\nOpen Marketplace\nView Services\n\n

Orders delivered: 12,400+
Avg. delivery: 28 days
Refill cover: 90 days

\n${CONFIG.heroMode === \"blob\"\n? `

`\n: ``}\n

\n\n

\nYT\n

Channel analytics

Last 28 days

\n\n Monetized\n\n

Subscribers

1,042

Watch hours

4,118

Views

318K

\n\n

\n\n\n\n\n\n\n\n

\n\n

✓Secure checkout

⚡Fast delivery

💬Customer support

#Order tracking

★Verified service

\n\n

Services built for channels

Pick what your channel is short of. Every order is tracked with its own SKU and confirmed on WhatsApp.

\n\n

Pricing that scales with the channel

One-off packages. No subscription, no channel password, no access to your account.

Starter

For channels early in the watch-hour climb.

${CONFIG.currency} 11,500

Delivery in 10–14 days

✓1,000 watch hours
✓Retention held above 45%
✓Drip-fed daily
✓SKU order tracking

\n\n

Creator

\nMOST POPULAR\n

The full monetization requirement, handled.

${CONFIG.currency} 42,000

Delivery in 28–35 days

✓4,000 watch hours
✓1,000 subscribers
✓Natural ratio pacing
✓90-day refill cover
✓Pre-order channel review

\n\n

Pro

Monetization plus three months of managed growth.

${CONFIG.currency} 78,000

Delivery in 30 days, then managed

✓Everything in Creator
✓Shorts feed push
✓Thumbnail and title review
✓Priority support line

\n\n

Marketplace

Packages published by approved sellers. You order in their own WhatsApp inbox.

\n\n

No seller listings yet. The packages above are sold directly by ${CONFIG.brand}.

\n\n

What creators say

★★★★★

Hit the 4,000 hours in five weeks and the review passed first time. The SKU made it easy to keep track of where my order was.

\nH\nHamza R.Tech reviews · 18K subs\n

\n\n

★★★★★

Subscribers arrived gradually instead of in one suspicious spike. My retention graph didn't wobble at all.

\nS\nSana K.Cooking · 42K subs\n

\n\n

★★★★☆

Delivery ran a few days past the estimate, but support answered every message and the refill covered the drop.

\nD\nDaniyal A.Gaming · 7K subs\n

\n\n

Questions before you order

How long does delivery take?▾

Watch hours run 10–35 days depending on the size of the package. Subscribers land across 10–14 days. Anything faster looks artificial to YouTube's systems, so we pace it deliberately.

What do you need from me?▾

Your channel link and the videos you want the hours on. Never your password, and never channel access — if anyone asks for either, stop.

How do I track my order?▾

Every order creates a unique SKU the moment you tap the button. Quote it in WhatsApp and check \"My orders\" in your account for its status.

What is the refund policy?▾

If delivery hasn't started within 7 days you get a full refund. Once delivery is under way, drops are covered by the 90-day refill rather than cash back.

Is my channel eligible?▾

Channels with original long-form uploads and no active strikes are. We review before starting and decline reused or auto-generated content — those channels fail the YPP review regardless of hours.

\n\n

My orders

Quote the SKU in WhatsApp — it's how both sides track the job.

\n\n

Seller panel

Publish a package, then take the order in your own WhatsApp inbox.

\n\n

Your listings

Orders on your packages

\n\n

Admin dashboard

\nMaster account\n

Seller applications

Users

Approve, revoke, ban or verify any account. Banning drops their sessions and hides their listings.

\n\n

All orders

\n\n\n\n

Log in

\n\n

\n\n\n

\n\n

New accounts start as buyers. Apply for seller access from your profile once you're in.

\n\n

Apply to sell

We approve sellers by hand. Send your application on WhatsApp and you'll hear back the same day.

\n\n

\nWhat do you sell? (optional)\n\n

\n\nOpen WhatsApp\n

\n\n

Verify your email

We sent a 6-digit code to your inbox. It expires in 30 minutes.

\n\n

\n\n\n

Didn't get it? Check spam, or ask the admin to verify you manually.

\n\n\n

Order created

\n\n

Your tracking SKU

\n\nOpen WhatsApp\n

\n\n\n`;","label",[130],"2dd98d33-5aff-41a7-a091-0eaae121b822","main.ts",45,["D",1789219558695],11,"http","/**\n * THE AGENTS — creator-services marketplace. Single Val Town HTTP val.\n *\n * SETUP\n * 1. Paste into a new HTTP val, save. Tables self-create on first request.\n * 2. Env vars: ADMIN_EMAIL, ADMIN_PASSWORD. Unset = the fallbacks below.\n *\n * SECURITY: the fallback password sits in source — anyone who can read this\n * val owns the admin account. Set ADMIN_PASSWORD as an env var and change the\n * fallback to junk. Passwords are stored PBKDF2-SHA256 / 150k / per-user salt;\n * changing the env var re-hashes the admin row on the next request.\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { CONFIG, PAGE } from \"./page.ts\";\n\n/* ================================================================== */\n/* config */\n/* ================================================================== */\n\n\n\nconst ADMIN_EMAIL = (Deno.env.get(\"ADMIN_EMAIL\") || \"rayandnp@gmail.com\").toLowerCase();\nconst ADMIN_PASSWORD = Deno.env.get(\"ADMIN_PASSWORD\") || \"Ayan9823\";\nconst ADMIN_NAME = \"Ayan\";\n\nconst T = {\n users: \"users\",\n orders: \"orders\",\n listings: \"listings\",\n requests: \"seller_requests\",\n sessions: \"ta_sessions\",\n};\n\n/** House packages. Prices live server-side so the client can't set its own. */\nconst PACKAGES: Record = {\n starter: { title: \"Starter — 1,000 watch hours\", price: 11500 },\n creator: { title: \"Creator — 4,000 hours + 1,000 subscribers\", price: 42000 },\n pro: { title: \"Pro — monetization + 90 days of growth\", price: 78000 },\n monetization: { title: \"YouTube monetization pack\", price: 42000 },\n watchhours: { title: \"Watch hours package\", price: 11500 },\n subscribers: { title: \"Subscribers package\", price: 9000 },\n views: { title: \"Views package\", price: 6500 },\n shorts: { title: \"Shorts growth package\", price: 14000 },\n channel: { title: \"Channel growth package\", price: 25000 },\n};\n\n/* ================================================================== */\n/* sqlite helpers */\n/* ================================================================== */\n\ntype Row = Record;\n\nasync function q(sql: string, args: any[] = []): Promise {\n const res: any = await sqlite.execute({ sql, args });\n const cols: string[] = res?.columns ?? [];\n const rows: any[] = res?.rows ?? [];\n return rows.map((r: any) =>\n Array.isArray(r) ? Object.fromEntries(cols.map((c, i) => [c, r[i]])) : (r as Row)\n );\n}\nasync function run(sql: string, args: any[] = []): Promise {\n return await sqlite.execute({ sql, args });\n}\nasync function one(sql: string, args: any[] = []): Promise {\n const rows = await q(sql, args);\n return rows.length ? rows[0] : null;\n}\n\n/* ================================================================== */\n/* bootstrap */\n/* ================================================================== */\n\nlet ready: Promise | null = null;\nconst init = () => (ready ??= bootstrap());\n\nasync function bootstrap(): Promise {\n await run(`CREATE TABLE IF NOT EXISTS ${T.users} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT NOT NULL,\n email TEXT NOT NULL UNIQUE,\n role TEXT NOT NULL DEFAULT 'buyer',\n pass_hash TEXT NOT NULL,\n pass_salt TEXT NOT NULL,\n created_at TEXT NOT NULL\n )`);\n\n await run(`CREATE TABLE IF NOT EXISTS ${T.sessions} (\n token TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL,\n created_at TEXT NOT NULL\n )`);\n\n await run(`CREATE TABLE IF NOT EXISTS ${T.listings} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n seller_id INTEGER NOT NULL,\n seller_name TEXT NOT NULL,\n title TEXT NOT NULL,\n description TEXT NOT NULL DEFAULT '',\n price REAL NOT NULL DEFAULT 0,\n category TEXT NOT NULL DEFAULT 'Growth',\n wa_link TEXT NOT NULL,\n active INTEGER NOT NULL DEFAULT 1,\n created_at TEXT NOT NULL\n )`);\n\n await run(`CREATE TABLE IF NOT EXISTS ${T.orders} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n sku TEXT NOT NULL UNIQUE,\n listing_id INTEGER,\n package_id TEXT,\n product_title TEXT NOT NULL,\n price REAL NOT NULL DEFAULT 0,\n seller_name TEXT NOT NULL,\n seller_id INTEGER,\n buyer_name TEXT,\n buyer_email TEXT,\n status TEXT NOT NULL DEFAULT 'Pending',\n created_at TEXT NOT NULL\n )`);\n\n await run(`CREATE TABLE IF NOT EXISTS ${T.requests} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n user_id INTEGER NOT NULL,\n name TEXT NOT NULL,\n email TEXT NOT NULL,\n note TEXT DEFAULT '',\n status TEXT NOT NULL DEFAULT 'pending',\n created_at TEXT NOT NULL,\n decided_at TEXT\n )`);\n\n await run(`CREATE UNIQUE INDEX IF NOT EXISTS idx_orders_sku ON ${T.orders}(sku)`);\n await run(`CREATE INDEX IF NOT EXISTS idx_listings_seller ON ${T.listings}(seller_id)`);\n await run(`CREATE INDEX IF NOT EXISTS idx_requests_status ON ${T.requests}(status)`);\n\n await migrate();\n await seedAdmin();\n}\n\n/** Adds columns to tables that already exist in a live database.\n * CREATE TABLE IF NOT EXISTS never alters an existing table, so anything\n * added after your first deploy has to come through here. */\nasync function ensureColumn(table: string, column: string, ddl: string, backfill?: string) {\n const cols = await q(`PRAGMA table_info(${table})`);\n if (cols.some((c) => String(c.name) === column)) return;\n await run(`ALTER TABLE ${table} ADD COLUMN ${column} ${ddl}`);\n if (backfill) await run(backfill);\n}\n\nasync function migrate(): Promise {\n // Accounts that existed before verification shipped are grandfathered in —\n // backfilling to 0 would lock out every current user.\n await ensureColumn(T.users, \"verified\", \"INTEGER NOT NULL DEFAULT 0\", `UPDATE ${T.users} SET verified = 1`);\n await ensureColumn(T.users, \"banned\", \"INTEGER NOT NULL DEFAULT 0\");\n await ensureColumn(T.users, \"verify_code\", \"TEXT\");\n await ensureColumn(T.users, \"verify_expires\", \"TEXT\");\n await ensureColumn(T.users, \"verify_sent_at\", \"TEXT\");\n await ensureColumn(T.orders, \"updated_at\", \"TEXT\");\n await ensureColumn(T.listings, \"image_key\", \"TEXT\");\n}\n\nasync function seedAdmin(): Promise {\n const salt = randomHex(16);\n const hash = await hashPassword(ADMIN_PASSWORD, salt);\n const existing = await one(`SELECT id, role, pass_hash, pass_salt FROM ${T.users} WHERE email = ?`, [\n ADMIN_EMAIL,\n ]);\n\n if (!existing) {\n await run(\n `INSERT INTO ${T.users} (name, email, role, pass_hash, pass_salt, created_at)\n VALUES (?, ?, 'admin', ?, ?, ?)`,\n [ADMIN_NAME, ADMIN_EMAIL, hash, salt, new Date().toISOString()]\n );\n return;\n }\n\n // Keep the admin row in sync with the current ADMIN_PASSWORD env value.\n const current = await hashPassword(ADMIN_PASSWORD, String(existing.pass_salt));\n if (current !== String(existing.pass_hash) || existing.role !== \"admin\") {\n await run(`UPDATE ${T.users} SET role = 'admin', pass_hash = ?, pass_salt = ? WHERE id = ?`, [\n hash,\n salt,\n existing.id,\n ]);\n }\n // The master account can never be left banned or unverified.\n await run(`UPDATE ${T.users} SET banned = 0, verified = 1 WHERE email = ?`, [ADMIN_EMAIL]);\n}\n\n/* ================================================================== */\n/* crypto + sessions */\n/* ================================================================== */\n\nconst enc = new TextEncoder();\n\nfunction toHex(buf: ArrayBuffer | Uint8Array): string {\n const b = buf instanceof Uint8Array ? buf : new Uint8Array(buf);\n return Array.from(b).map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\nfunction randomHex(bytes: number): string {\n return toHex(crypto.getRandomValues(new Uint8Array(bytes)));\n}\nasync function hashPassword(password: string, salt: string): Promise {\n const key = await crypto.subtle.importKey(\"raw\", enc.encode(password), \"PBKDF2\", false, [\n \"deriveBits\",\n ]);\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt: enc.encode(salt), iterations: 150000, hash: \"SHA-256\" },\n key,\n 256\n );\n return toHex(bits);\n}\nfunction safeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\nfunction bearer(req: Request): string | null {\n const m = (req.headers.get(\"authorization\") || \"\").match(/^Bearer\\s+(.+)$/i);\n return m ? m[1].trim() : null;\n}\nasync function currentUser(req: Request): Promise {\n const token = bearer(req);\n if (!token) return null;\n return await one(\n `SELECT u.id, u.name, u.email, u.role, u.verified, u.banned FROM ${T.sessions} s\n JOIN ${T.users} u ON u.id = s.user_id WHERE s.token = ? AND u.banned = 0`,\n [token]\n );\n}\nasync function newSession(userId: number): Promise {\n const token = randomHex(32);\n await run(`INSERT INTO ${T.sessions} (token, user_id, created_at) VALUES (?, ?, ?)`, [\n token,\n userId,\n new Date().toISOString(),\n ]);\n return token;\n}\n/** Admin gate: role must be admin AND the email must be the master account. */\nfunction isAdmin(user: Row | null): boolean {\n return !!user && user.role === \"admin\" && String(user.email).toLowerCase() === ADMIN_EMAIL;\n}\nconst canSell = (u: Row | null) =>\n !!u && Number(u.verified) === 1 && (u.role === \"approved_seller\" || isAdmin(u));\nconst isVerified = (u: Row | null) => !!u && Number(u.verified) === 1;\n\n/* ================================================================== */\n/* WhatsApp link handling */\n/* ================================================================== */\n\n/** wa.me/message/

 links resolve at WhatsApp and drop the query string,\n * so ?text= never arrives. Only wa.me/ and api.whatsapp.com/send?phone=\n * carry a prefilled body. `prefill` tells the client to fall back to clipboard. */\nfunction buildWaUrl(raw: string, message: string): { url: string; prefill: boolean } {\n  const link = (raw || \"\").trim();\n  if (/^\\+?\\d[\\d\\s\\-()]{6,}$/.test(link)) {\n    return {\n      url: `https://wa.me/${link.replace(/\\D/g, \"\")}?text=${encodeURIComponent(message)}`,\n      prefill: true,\n    };\n  }\n  let url: URL;\n  try {\n    url = new URL(link.startsWith(\"http\") ? link : `https://${link}`);\n  } catch {\n    return { url: CONFIG.brandWa, prefill: false };\n  }\n  const host = url.hostname.replace(/^www\\./, \"\");\n  if (host === \"wa.me\" && /^\\/message\\//i.test(url.pathname)) return { url: url.toString(), prefill: false };\n  if (host === \"chat.whatsapp.com\") return { url: url.toString(), prefill: false };\n  if (host === \"wa.me\" && /^\\/\\+?\\d{6,}$/.test(url.pathname)) {\n    url.searchParams.set(\"text\", message);\n    return { url: url.toString(), prefill: true };\n  }\n  if ((host === \"api.whatsapp.com\" || host === \"web.whatsapp.com\") && url.searchParams.get(\"phone\")) {\n    url.searchParams.set(\"text\", message);\n    return { url: url.toString(), prefill: true };\n  }\n  return { url: url.toString(), prefill: false };\n}\n\nfunction validWaLink(raw: string): boolean {\n  const link = (raw || \"\").trim();\n  if (!link) return false;\n  if (/^\\+?\\d[\\d\\s\\-()]{6,}$/.test(link)) return true;\n  try {\n    const host = new URL(link.startsWith(\"http\") ? link : `https://${link}`).hostname.replace(/^www\\./, \"\");\n    return [\"wa.me\", \"api.whatsapp.com\", \"web.whatsapp.com\", \"chat.whatsapp.com\"].includes(host);\n  } catch {\n    return false;\n  }\n}\n\n/* ================================================================== */\n/* SKU                                                                */\n/* ================================================================== */\n\nfunction skuCandidate(width = 6): string {\n  const max = Math.pow(10, width);\n  const min = Math.pow(10, width - 1);\n  return `SKU-${(crypto.getRandomValues(new Uint32Array(1))[0] % (max - min)) + min}`;\n}\n\n/** Uniqueness comes from the UNIQUE index, not a prior SELECT — check-then-insert\n * races the moment two buyers tap in the same second. */\nasync function insertOrder(o: {\n  listingId: number | null;\n  packageId: string | null;\n  title: string;\n  price: number;\n  sellerName: string;\n  sellerId: number | null;\n  buyerName: string | null;\n  buyerEmail: string | null;\n}): Promise {\n  const now = new Date().toISOString();\n  for (let i = 0; i < 14; i++) {\n    const sku = skuCandidate(i < 10 ? 6 : 8);\n    try {\n      await run(\n        `INSERT INTO ${T.orders}\n         (sku, listing_id, package_id, product_title, price, seller_name, seller_id,\n          buyer_name, buyer_email, status, created_at)\n         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'Pending', ?)`,\n        [sku, o.listingId, o.packageId, o.title, o.price, o.sellerName, o.sellerId, o.buyerName, o.buyerEmail, now]\n      );\n      return sku;\n    } catch (err: any) {\n      if (/UNIQUE|constraint/i.test(String(err?.message || err))) continue;\n      throw err;\n    }\n  }\n  throw new Error(\"Could not allocate a unique SKU\");\n}\n\n/* ================================================================== */\n/* helpers                                                            */\n/* ================================================================== */\n\nconst json = (data: unknown, status = 200) =>\n  new Response(JSON.stringify(data), {\n    status,\n    headers: { \"content-type\": \"application/json; charset=utf-8\" },\n  });\n\nconst htmlRes = (b: string, status = 200) =>\n  new Response(b, { status, headers: { \"content-type\": \"text/html; charset=utf-8\" } });\n\nasync function readBody(req: Request): Promise {\n  try {\n    return (await req.json()) as Row;\n  } catch {\n    return {};\n  }\n}\n\nconst money = (n: number) =>\n  new Intl.NumberFormat(CONFIG.locale, { maximumFractionDigits: 0 }).format(Number(n) || 0);\n\nconst priceLabel = (n: number) => `${CONFIG.currency} ${money(n)}`;\n\n/** Exact checkout message format. */\nconst orderMessage = (sku: string, title: string, price: number) =>\n  `Order ${sku} - Product: ${title} - Price: ${priceLabel(price)}. Sent from ${CONFIG.brand}. Please confirm this order.`;\n\n/* ================================================================== */\n/* router                                                             */\n/* ================================================================== */\n\nexport default async function (req: Request): Promise {\n  await init();\n  const url = new URL(req.url);\n  const path = url.pathname.replace(/\\/+$/, \"\") || \"/\";\n  const method = req.method.toUpperCase();\n\n  try {\n    if (method === \"GET\" && path === \"/\") return htmlRes(PAGE);\n    if (method === \"GET\" && path === \"/health\") return json({ ok: true });\n    if (method === \"GET\" && path === \"/media/hero.mp4\") return await heroVideo();\n    if (method === \"GET\" && path.startsWith(\"/media/img/\")) return await listingImage(path);\n    if (method === \"POST\" && path === \"/api/upload-image\") return await uploadImage(req);\n\n    if (method === \"POST\" && path === \"/api/register\") return await register(req);\n    if (method === \"POST\" && path === \"/api/login\") return await login(req);\n    if (method === \"POST\" && path === \"/api/logout\") return await logout(req);\n    if (method === \"GET\" && path === \"/api/me\") return await me(req);\n    if (method === \"POST\" && path === \"/api/verify-email\") return await verifyEmail(req);\n    if (method === \"POST\" && path === \"/api/resend-code\") return await resendCode(req);\n\n    if (method === \"GET\" && path === \"/api/listings\") return await getListings();\n    if (method === \"POST\" && path === \"/api/listings\") return await createListing(req);\n    if (method === \"POST\" && path === \"/api/listings/delete\") return await deleteListing(req);\n\n    if (method === \"POST\" && (path === \"/create-order\" || path === \"/api/create-order\"))\n      return await createOrder(req);\n\n    if (method === \"POST\" && path === \"/api/request-seller\") return await requestSeller(req);\n    if (method === \"GET\" && path === \"/api/my-orders\") return await myOrders(req);\n    if (method === \"GET\" && path === \"/api/seller-orders\") return await sellerOrders(req);\n    if (method === \"POST\" && path === \"/api/order-status\") return await setOrderStatus(req);\n\n    if (method === \"GET\" && path === \"/api/admin/pending-sellers\") return await pendingSellers(req);\n    if (method === \"POST\" && path === \"/api/admin/approve-seller\") return await approveSeller(req);\n    if (method === \"GET\" && path === \"/api/admin/orders\") return await adminOrders(req);\n    if (method === \"GET\" && path === \"/api/admin/users\") return await adminUsers(req);\n    if (method === \"POST\" && path === \"/api/admin/user-action\") return await adminUserAction(req);\n\n    return json({ error: \"Not found\" }, 404);\n  } catch (err: any) {\n    console.error(err);\n    return json({ error: \"Server error\", detail: String(err?.message || err) }, 500);\n  }\n}\n\n/* ================================================================== */\n/* auth                                                               */\n/* ================================================================== */\n\nasync function register(req: Request): Promise {\n  const b = await readBody(req);\n  const name = String(b.name || \"\").trim();\n  const email = String(b.email || \"\").trim().toLowerCase();\n  const password = String(b.password || \"\");\n\n  if (name.length < 2) return json({ error: \"Enter your full name.\" }, 400);\n  if (!/^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(email)) return json({ error: \"That email isn't valid.\" }, 400);\n  if (password.length < 6) return json({ error: \"Use at least 6 characters.\" }, 400);\n  if (email === ADMIN_EMAIL) return json({ error: \"That account already exists. Log in instead.\" }, 409);\n\n  if (await one(`SELECT id FROM ${T.users} WHERE email = ?`, [email]))\n    return json({ error: \"An account already uses that email. Log in instead.\" }, 409);\n\n  const salt = randomHex(16);\n  const hash = await hashPassword(password, salt);\n  await run(\n    `INSERT INTO ${T.users} (name, email, role, pass_hash, pass_salt, created_at, verified)\n     VALUES (?, ?, 'buyer', ?, ?, ?, 0)`,\n    [name, email, hash, salt, new Date().toISOString()]\n  );\n  const user = await one(`SELECT id, name, email, role FROM ${T.users} WHERE email = ?`, [email]);\n  const mail = await issueVerification(Number(user!.id), email, name);\n  return json({\n    success: true,\n    token: await newSession(Number(user!.id)),\n    user,\n    verified: false,\n    mailSent: mail.ok,\n  });\n}\n\nasync function login(req: Request): Promise {\n  const b = await readBody(req);\n  const email = String(b.email || \"\").trim().toLowerCase();\n  const password = String(b.password || \"\");\n  const row = await one(\n    `SELECT id, name, email, role, verified, banned, pass_hash, pass_salt FROM ${T.users} WHERE email = ?`,\n    [email]\n  );\n  const generic = json({ error: \"Email or password is wrong.\" }, 401);\n  if (!row) return generic;\n  if (Number(row.banned) === 1)\n    return json({ error: \"This account is suspended. Contact support.\" }, 403);\n  const hash = await hashPassword(password, String(row.pass_salt));\n  if (!safeEqual(hash, String(row.pass_hash))) return generic;\n  return json({\n    success: true,\n    token: await newSession(Number(row.id)),\n    user: { id: row.id, name: row.name, email: row.email, role: row.role },\n    verified: Number(row.verified) === 1,\n  });\n}\n\nasync function logout(req: Request): Promise {\n  const token = bearer(req);\n  if (token) await run(`DELETE FROM ${T.sessions} WHERE token = ?`, [token]);\n  return json({ success: true });\n}\n\nasync function me(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ user: null });\n  const pending = await one(\n    `SELECT id FROM ${T.requests} WHERE user_id = ? AND status = 'pending'`,\n    [user.id]\n  );\n  return json({\n    user: { id: user.id, name: user.name, email: user.email, role: user.role },\n    admin: isAdmin(user),\n    canSell: canSell(user),\n    verified: isVerified(user),\n    sellerRequestPending: !!pending,\n  });\n}\n\n/* ================================================================== */\n/* email + verification                                               */\n/* ================================================================== */\n\n/**\n * Two backends. Resend if RESEND_API_KEY is set (needs a verified sending\n * domain), otherwise Val Town's std/email — which on the free plan only\n * reaches your own address, so anything else fails and lands in the logs.\n */\nasync function sendMail(to: string, subject: string, text: string): Promise<{ ok: boolean; error?: string }> {\n  const key = Deno.env.get(\"RESEND_API_KEY\");\n  if (key) {\n    try {\n      const from = Deno.env.get(\"MAIL_FROM\") || `${CONFIG.brand} `;\n      const res = await fetch(\"https://api.resend.com/emails\", {\n        method: \"POST\",\n        headers: { authorization: `Bearer ${key}`, \"content-type\": \"application/json\" },\n        body: JSON.stringify({ from, to, subject, text }),\n      });\n      if (res.ok) return { ok: true };\n      return { ok: false, error: (await res.text()).slice(0, 300) };\n    } catch (e: any) {\n      return { ok: false, error: String(e?.message || e).slice(0, 300) };\n    }\n  }\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/email\");\n    await mod.email({ to, subject, text });\n    return { ok: true };\n  } catch (e: any) {\n    return { ok: false, error: String(e?.message || e).slice(0, 300) };\n  }\n}\n\nasync function issueVerification(userId: number, email: string, name: string) {\n  const code = String((crypto.getRandomValues(new Uint32Array(1))[0] % 900000) + 100000);\n  const expires = new Date(Date.now() + 30 * 60 * 1000).toISOString();\n  await run(\n    `UPDATE ${T.users} SET verify_code = ?, verify_expires = ?, verify_sent_at = ? WHERE id = ?`,\n    [code, expires, new Date().toISOString(), userId]\n  );\n  const text =\n    `Hi ${name},\\n\\nYour ${CONFIG.brand} verification code is ${code}\\n` +\n    `It expires in 30 minutes.\\n\\nIf you did not create this account, ignore this email.`;\n  const mail = await sendMail(email, `${code} is your ${CONFIG.brand} code`, text);\n  // Always log it: with no mail provider configured this is the only copy.\n  console.log(`[verify] ${email} code=${code} sent=${mail.ok}${mail.error ? \" err=\" + mail.error : \"\"}`);\n  return mail;\n}\n\nasync function verifyEmail(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  if (isVerified(user)) return json({ success: true, already: true });\n\n  const code = String((await readBody(req)).code || \"\").trim();\n  const row = await one(`SELECT verify_code, verify_expires FROM ${T.users} WHERE id = ?`, [user.id]);\n  if (!row || !row.verify_code) return json({ error: \"No code on file. Send a new one.\" }, 400);\n  if (new Date(String(row.verify_expires)).getTime() < Date.now())\n    return json({ error: \"That code expired. Send a new one.\" }, 400);\n  if (!safeEqual(code, String(row.verify_code))) return json({ error: \"That code is wrong.\" }, 400);\n\n  await run(\n    `UPDATE ${T.users} SET verified = 1, verify_code = NULL, verify_expires = NULL WHERE id = ?`,\n    [user.id]\n  );\n  return json({ success: true });\n}\n\nasync function resendCode(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  if (isVerified(user)) return json({ success: true, already: true });\n\n  const row = await one(`SELECT verify_sent_at FROM ${T.users} WHERE id = ?`, [user.id]);\n  const last = row && row.verify_sent_at ? new Date(String(row.verify_sent_at)).getTime() : 0;\n  const wait = 60000 - (Date.now() - last);\n  if (wait > 0) return json({ error: `Wait ${Math.ceil(wait / 1000)}s before asking for another code.` }, 429);\n\n  const mail = await issueVerification(Number(user.id), String(user.email), String(user.name));\n  return json({ success: true, mailSent: mail.ok });\n}\n\n/* ================================================================== */\n/* listings                                                           */\n/* ================================================================== */\n\nasync function getListings(): Promise {\n  const listings = await q(\n    `SELECT l.id, l.title, l.description, l.price, l.category, l.seller_name, l.seller_id, l.image_key, l.created_at\n       FROM ${T.listings} l JOIN ${T.users} u ON u.id = l.seller_id\n      WHERE l.active = 1 AND u.banned = 0 AND u.role IN ('approved_seller','admin')\n      ORDER BY l.id DESC LIMIT 200`\n  );\n  return json({ listings });\n}\n\nasync function createListing(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  if (!isVerified(user)) return json({ error: \"Verify your email before publishing.\" }, 403);\n  if (!canSell(user)) return json({ error: \"Your seller account is not approved yet.\" }, 403);\n\n  const b = await readBody(req);\n  const title = String(b.title || \"\").trim();\n  const description = String(b.description || \"\").trim();\n  const price = Number(b.price);\n  const category = String(b.category || \"Growth\").trim() || \"Growth\";\n  const waLink = String(b.waLink || \"\").trim();\n  const imageKey = String(b.imageKey || \"\").trim();\n  if (imageKey && !validImageKey(imageKey)) return json({ error: \"Bad image reference.\" }, 400);\n\n  if (title.length < 3) return json({ error: \"Give the listing a title.\" }, 400);\n  if (!Number.isFinite(price) || price <= 0) return json({ error: \"Enter a price above zero.\" }, 400);\n  if (!validWaLink(waLink))\n    return json({ error: \"Use a wa.me short link, an api.whatsapp.com link, or a full phone number.\" }, 400);\n\n  await run(\n    `INSERT INTO ${T.listings}\n     (seller_id, seller_name, title, description, price, category, wa_link, image_key, active, created_at)\n     VALUES (?, ?, ?, ?, ?, ?, ?, ?, 1, ?)`,\n    [user.id, user.name, title, description, price, category, waLink, imageKey || null,\n     new Date().toISOString()]\n  );\n  return json({ success: true, prefill: buildWaUrl(waLink, \"test\").prefill });\n}\n\nasync function deleteListing(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  const id = Number((await readBody(req)).id);\n  const owned = await one(\n    `SELECT id FROM ${T.listings} WHERE id = ? AND (seller_id = ? OR ? = 1)`,\n    [id, user.id, isAdmin(user) ? 1 : 0]\n  );\n  if (!owned) return json({ error: \"That listing isn't yours.\" }, 403);\n  const img = await one(`SELECT image_key FROM ${T.listings} WHERE id = ?`, [id]);\n  await run(`UPDATE ${T.listings} SET active = 0 WHERE id = ?`, [id]);\n  if (img && img.image_key && validImageKey(String(img.image_key))) {\n    try {\n      const mod: any = await import(\"https://esm.town/v/std/blob\");\n      await mod.blob.delete(String(img.image_key));\n    } catch { /* orphaned blob is not worth failing the request over */ }\n  }\n  return json({ success: true });\n}\n\n/* ================================================================== */\n/* orders                                                             */\n/* ================================================================== */\n\nasync function createOrder(req: Request): Promise {\n  const b = await readBody(req);\n  const user = await currentUser(req);\n  // Enforced here, not just in the UI — the endpoint is reachable directly.\n  if (!user) return json({ error: \"Log in to place an order.\" }, 401);\n\n  let title: string, price: number, sellerName: string, waLink: string;\n  let listingId: number | null = null;\n  let sellerId: number | null = null;\n  let packageId: string | null = null;\n\n  if (b.listingId != null) {\n    const l = await one(\n      `SELECT id, title, price, seller_name, seller_id, wa_link FROM ${T.listings}\n        WHERE id = ? AND active = 1`,\n      [Number(b.listingId)]\n    );\n    if (!l) return json({ error: \"That listing is no longer available.\" }, 404);\n    listingId = Number(l.id);\n    sellerId = l.seller_id == null ? null : Number(l.seller_id);\n    title = String(l.title);\n    price = Number(l.price);\n    sellerName = String(l.seller_name);\n    waLink = String(l.wa_link);\n  } else {\n    const pkg = PACKAGES[String(b.packageId || \"\")];\n    if (!pkg) return json({ error: \"Unknown package.\" }, 400);\n    packageId = String(b.packageId);\n    title = pkg.title;\n    price = pkg.price;\n    sellerName = CONFIG.brand;\n    waLink = CONFIG.brandWa;\n  }\n\n  const sku = await insertOrder({\n    listingId,\n    packageId,\n    title,\n    price,\n    sellerName,\n    sellerId,\n    buyerName: String(user.name),\n    buyerEmail: String(user.email),\n  });\n\n  const message = orderMessage(sku, title, price);\n  const { url: waUrl, prefill } = buildWaUrl(waLink, message);\n\n  return json({\n    success: true,\n    sku,\n    waUrl,\n    message,\n    prefill,\n    product: { title, price, seller_name: sellerName },\n  });\n}\n\nasync function myOrders(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  return json({\n    orders: await q(\n      `SELECT sku, product_title, price, seller_name, status, created_at FROM ${T.orders}\n        WHERE buyer_email = ? ORDER BY id DESC LIMIT 100`,\n      [user.email]\n    ),\n  });\n}\n\nasync function sellerOrders(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  return json({\n    orders: await q(\n      `SELECT sku, product_title, price, buyer_name, status, created_at FROM ${T.orders}\n        WHERE seller_id = ? ORDER BY id DESC LIMIT 100`,\n      [user.id]\n    ),\n  });\n}\n\n/* ================================================================== */\n/* seller requests                                                    */\n/* ================================================================== */\n\nasync function requestSeller(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Create an account first, then apply.\" }, 401);\n  if (!isVerified(user)) return json({ error: \"Verify your email before applying.\" }, 403);\n  if (canSell(user)) return json({ error: \"You can already publish listings.\" }, 400);\n\n  const note = String((await readBody(req)).note || \"\").trim().slice(0, 400);\n  const existing = await one(\n    `SELECT id FROM ${T.requests} WHERE user_id = ? AND status = 'pending'`,\n    [user.id]\n  );\n  if (!existing) {\n    await run(\n      `INSERT INTO ${T.requests} (user_id, name, email, note, status, created_at)\n       VALUES (?, ?, ?, ?, 'pending', ?)`,\n      [user.id, user.name, user.email, note, new Date().toISOString()]\n    );\n  }\n\n  const message =\n    `Seller application - ${CONFIG.brand}\\n` +\n    `Name: ${user.name}\\n` +\n    `Email: ${user.email}\\n` +\n    `Account ID: ${user.id}` +\n    (note ? `\\nAbout: ${note}` : \"\") +\n    `\\n\\nPlease approve my seller access.`;\n\n  const { url: waUrl, prefill } = buildWaUrl(CONFIG.brandWa, message);\n  return json({ success: true, waUrl, message, prefill, alreadyPending: !!existing });\n}\n\nasync function pendingSellers(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n  return json({\n    requests: await q(\n      `SELECT r.id, r.user_id, r.name, r.email, r.note, r.status, r.created_at, u.role\n         FROM ${T.requests} r JOIN ${T.users} u ON u.id = r.user_id\n        ORDER BY (r.status = 'pending') DESC, r.id DESC LIMIT 200`\n    ),\n  });\n}\n\nasync function approveSeller(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n\n  const b = await readBody(req);\n  const userId = Number(b.userId);\n  const target = await one(`SELECT id, email FROM ${T.users} WHERE id = ?`, [userId]);\n  if (!target) return json({ error: \"No such user.\" }, 404);\n  if (String(target.email).toLowerCase() === ADMIN_EMAIL)\n    return json({ error: \"The admin account already has full access.\" }, 400);\n\n  await run(`UPDATE ${T.users} SET role = 'approved_seller' WHERE id = ?`, [userId]);\n  await run(\n    `UPDATE ${T.requests} SET status = 'approved', decided_at = ? WHERE user_id = ? AND status = 'pending'`,\n    [new Date().toISOString(), userId]\n  );\n  return json({ success: true });\n}\n\nasync function adminOrders(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n  const totals = await one(`SELECT COUNT(*) AS n, COALESCE(SUM(price),0) AS value FROM ${T.orders}`);\n  return json({\n    totals,\n    orders: await q(\n      `SELECT sku, product_title, price, seller_name, buyer_name, buyer_email, status, created_at\n         FROM ${T.orders} ORDER BY id DESC LIMIT 200`\n    ),\n  });\n}\n\n/* ================================================================== */\n/* frontend                                                           */\n/* ================================================================== */\n\nconst ORDER_STATUSES = [\"Pending\", \"Delivered\", \"Cancelled\"];\n\n/**\n * Who may move an order:\n *   admin  — any order, any status\n *   seller — orders on their own listings\n *   buyer  — may cancel their own order while it is still Pending\n */\nasync function setOrderStatus(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n\n  const b = await readBody(req);\n  const sku = String(b.sku || \"\").trim();\n  const status = String(b.status || \"\").trim();\n  if (!ORDER_STATUSES.includes(status)) return json({ error: \"Unknown status.\" }, 400);\n\n  const order = await one(`SELECT sku, seller_id, buyer_email, status FROM ${T.orders} WHERE sku = ?`, [sku]);\n  if (!order) return json({ error: \"No order with that SKU.\" }, 404);\n\n  const admin = isAdmin(user);\n  const isSeller = order.seller_id != null && Number(order.seller_id) === Number(user.id);\n  const isBuyer = String(order.buyer_email || \"\") === String(user.email);\n\n  let allowed = false;\n  if (admin || isSeller) allowed = true;\n  else if (isBuyer && status === \"Cancelled\" && order.status === \"Pending\") allowed = true;\n  if (!allowed) return json({ error: \"You can't change this order.\" }, 403);\n\n  await run(`UPDATE ${T.orders} SET status = ?, updated_at = ? WHERE sku = ?`, [\n    status,\n    new Date().toISOString(),\n    sku,\n  ]);\n  return json({ success: true, sku, status });\n}\n\nasync function adminUsers(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n  return json({\n    users: await q(\n      `SELECT u.id, u.name, u.email, u.role, u.verified, u.banned, u.created_at,\n              (SELECT COUNT(*) FROM ${T.listings} l WHERE l.seller_id = u.id AND l.active = 1) AS listings,\n              (SELECT COUNT(*) FROM ${T.orders} o WHERE o.seller_id = u.id) AS sales\n         FROM ${T.users} u ORDER BY u.id DESC LIMIT 300`\n    ),\n  });\n}\n\n/**\n * approve | revoke | ban | unban | verify\n * Banning also drops the user's sessions, so an open tab stops working on its\n * next request instead of staying live until the token is discarded.\n */\nasync function adminUserAction(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n\n  const b = await readBody(req);\n  const userId = Number(b.userId);\n  const action = String(b.action || \"\");\n  const target = await one(`SELECT id, email FROM ${T.users} WHERE id = ?`, [userId]);\n  if (!target) return json({ error: \"No such user.\" }, 404);\n  if (String(target.email).toLowerCase() === ADMIN_EMAIL)\n    return json({ error: \"The master account can't be changed from here.\" }, 400);\n\n  const now = new Date().toISOString();\n  switch (action) {\n    case \"approve\":\n      await run(`UPDATE ${T.users} SET role = 'approved_seller' WHERE id = ?`, [userId]);\n      await run(\n        `UPDATE ${T.requests} SET status = 'approved', decided_at = ? WHERE user_id = ? AND status = 'pending'`,\n        [now, userId]\n      );\n      break;\n    case \"revoke\":\n      await run(`UPDATE ${T.users} SET role = 'buyer' WHERE id = ?`, [userId]);\n      await run(`UPDATE ${T.listings} SET active = 0 WHERE seller_id = ?`, [userId]);\n      await run(\n        `UPDATE ${T.requests} SET status = 'revoked', decided_at = ? WHERE user_id = ? AND status = 'approved'`,\n        [now, userId]\n      );\n      break;\n    case \"ban\":\n      await run(`UPDATE ${T.users} SET banned = 1 WHERE id = ?`, [userId]);\n      await run(`DELETE FROM ${T.sessions} WHERE user_id = ?`, [userId]);\n      break;\n    case \"unban\":\n      await run(`UPDATE ${T.users} SET banned = 0 WHERE id = ?`, [userId]);\n      break;\n    case \"verify\":\n      await run(\n        `UPDATE ${T.users} SET verified = 1, verify_code = NULL, verify_expires = NULL WHERE id = ?`,\n        [userId]\n      );\n      break;\n    default:\n      return json({ error: \"Unknown action.\" }, 400);\n  }\n  return json({ success: true });\n}\n\n/**\n * Serves the hero clip from Val Town blob storage (key: hero.mp4).\n * Upload once, then set CONFIG.heroMode = \"blob\" in page.ts.\n */\nasync function heroVideo(): Promise {\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/blob\");\n    const res = await mod.blob.get(\"hero.mp4\");\n    if (!res || !res.ok || !res.body) {\n      return json({ error: \"No blob found under the key hero.mp4.\" }, 404);\n    }\n    return new Response(res.body, {\n      headers: {\n        \"content-type\": \"video/mp4\",\n        \"cache-control\": \"public, max-age=86400\",\n        \"accept-ranges\": \"none\",\n      },\n    });\n  } catch (err: any) {\n    return json({ error: \"Blob storage unavailable\", detail: String(err?.message || err) }, 500);\n  }\n}\n\n/* ================================================================== */\n/* listing images (Val Town blob storage)                             */\n/* ================================================================== */\n\nconst MAX_IMAGE_BYTES = 1_500_000;\n\n/** Keys are generated here, never by the client — this is what stops\n *  /media/img/hero.mp4 or any other blob from being read through this route. */\nfunction newImageKey(): string {\n  return `listing-img-${randomHex(10)}.jpg`;\n}\nfunction validImageKey(key: string): boolean {\n  return /^listing-img-[a-f0-9]{20}\\.jpg$/.test(key);\n}\n\nasync function uploadImage(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  if (!canSell(user)) return json({ error: \"Only approved sellers can upload images.\" }, 403);\n\n  const dataUrl = String((await readBody(req)).dataUrl || \"\");\n  const match = dataUrl.match(/^data:image\\/(jpeg|png|webp);base64,([A-Za-z0-9+/=]+)$/);\n  if (!match) return json({ error: \"Send a JPEG, PNG or WebP image.\" }, 400);\n\n  let bytes: Uint8Array;\n  try {\n    const bin = atob(match[2]);\n    bytes = new Uint8Array(bin.length);\n    for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);\n  } catch {\n    return json({ error: \"That image could not be decoded.\" }, 400);\n  }\n  if (bytes.length > MAX_IMAGE_BYTES) {\n    return json({ error: \"Image is too large. Keep it under 1.5 MB.\" }, 413);\n  }\n\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/blob\");\n    const key = newImageKey();\n    await mod.blob.set(key, bytes);\n    return json({ success: true, key, bytes: bytes.length });\n  } catch (err: any) {\n    return json({ error: \"Upload failed\", detail: String(err?.message || err) }, 500);\n  }\n}\n\nasync function listingImage(path: string): Promise {\n  const key = decodeURIComponent(path.slice(\"/media/img/\".length));\n  if (!validImageKey(key)) return json({ error: \"Not found\" }, 404);\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/blob\");\n    const res = await mod.blob.get(key);\n    if (!res || !res.ok || !res.body) return json({ error: \"Not found\" }, 404);\n    return new Response(res.body, {\n      headers: {\n        \"content-type\": \"image/jpeg\",\n        // Keys are unique per upload, so this can cache forever.\n        \"cache-control\": \"public, max-age=31536000, immutable\",\n      },\n    });\n  } catch {\n    return json({ error: \"Not found\" }, 404);\n  }\n}","theagentsyt",[141],"7fe419b7-3134-4c12-be51-21b0158f4a92",["D",1789239589580],3,[28],"pulls","branches",1,"forks","envVars",{"_161":151,"_163":62},"connections",{"_161":62,"_162":62},"count","unfilledCount","emptyCount",{"_42":149,"_32":28,"_30":31,"_132":-5,"_40":41,"_39":14,"_134":25,"_37":174,"_13":151,"_33":34,"_35":36,"_24":25,"_138":-5,"_168":175,"_27":176},{"_42":140,"_32":141,"_30":56,"_132":-5,"_40":41,"_39":142,"_134":25,"_37":171,"_13":144,"_33":145,"_35":146,"_24":25,"_138":147,"_168":172,"_27":173},{"_42":129,"_32":130,"_30":131,"_132":-5,"_40":41,"_39":133,"_134":25,"_37":167,"_13":136,"_33":34,"_35":137,"_24":25,"_138":-5,"_168":169,"_27":170},["D",1789219643445],"children",[],[130],["D",1789219558695],[],[141],["D",1789239589580],[],[28],["D",1789198617445],{"_96":95,"_104":100},{"_96":95,"_97":98,"_99":100,"_18":54,"_101":102,"_103":25},{"_13":85,"_32":86,"_42":41,"_87":43,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":44,"_94":95},"ctx",{"_78":-5,"_123":214,"_215":216,"_217":218,"_219":25,"_220":25,"_221":25,"_222":58,"_223":-5,"_224":-7,"_225":-7,"_226":62,"_227":25,"_228":25,"_229":-5,"_230":25,"_231":25,"_232":25,"_233":-5},"ENV",{"_185":186,"_187":188,"_189":86,"_190":191,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

'+esc(s.name)+'

'+esc(p.title)+'

\nGrow Your YouTube Channel Faster.\n

Services built for channels

Pricing that scales with the channel

Marketplace

What creators say

Questions before you order

My orders

Seller panel

New listing

Your listings

Orders on your packages

Admin dashboard

Seller applications

Users

All orders

Log in

Apply to sell

Verify your email

Order created

\nGrow Your YouTube
Channel Faster.\n

Diff · v50