[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_182":183,"_184":185},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_138":-5,"_20":139,"_22":140,"_141":142,"_143":144,"_26":145,"_24":146,"_147":-5,"_148":-5,"_149":52,"_150":151,"_152":43,"_153":-5,"_154":-5,"_155":156},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","AyanAfzal","name","TheAgents","branchName","main","version","path","app.ts","project",{"_33":82,"_13":14,"_44":83,"_84":-5,"_85":52,"_86":87,"_88":87,"_89":90,"_91":-5,"_92":93,"_94":70,"_95":43,"_96":-5,"_97":-5,"_98":99,"_100":101,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":107,"_108":107,"_109":110,"_111":110,"_112":110,"_113":107,"_114":107,"_115":116,"_117":118,"_119":120,"_121":52},"tree",[55,56,57],"file",{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_18":54},"contents",[],"upstream","pull","ahead","behind","envVars","id","daf79b34-d205-4851-8f8f-b3ee53d5e5bf","fileId","ff1c9f76-aedb-11f1-bdb0-1607ee4eb77e","parentId","branchId","ffa65750-a2bb-44f4-bf59-b45deb4c8118","branchVersion",76,"latest",true,"createdAt",["D",1789293468982],8,"fileType","script","content","// THE AGENTS — client script. Embedded by page.ts into the served HTML.\n// Lives in the same val; keep it beside main.ts and page.ts.\n\nexport const APP = `\nvar SERVICES = [\n{ id:'monetization', icon:'▶', name:'YouTube monetization pack', desc:'Watch hours and subscribers delivered together so the channel clears the YPP bar without a suspicious spike.' },\n{ id:'watchhours', icon:'⏱', name:'Watch hours', desc:'Long-form watch time from recommended-feed traffic, paced daily and held above 45% retention.' },\n{ id:'subscribers', icon:'👤', name:'Subscribers', desc:'Real accounts with history and activity, drip-fed over 10–14 days with 90-day refill cover.' },\n{ id:'views', icon:'📈', name:'Views', desc:'High-retention views for launches, with the option to target a single upload or the whole channel.' },\n{ id:'shorts', icon:'⚡', name:'Shorts growth', desc:'Shorts feed push for vertical uploads, tuned for swipe-through rate rather than raw view count.' },\n{ id:'channel', icon:'🚀', name:'Channel growth package', desc:'Thirty days of managed growth: hours, subs, thumbnail and title review, priority support.' }\n];\nvar MOTION = {\nreduce: !!(window.matchMedia && window.matchMedia('(prefers-reduced-motion: reduce)').matches),\nhover: !!(window.matchMedia && window.matchMedia('(hover:hover) and (pointer:fine)').matches),\nio: null, on: false\n};\nvar state = { token:null, user:null, admin:false, canSell:false, verified:true, pending:null, chip:'all', lastOrder:null, awaitingReturn:false, listings:[], authMode:'login', lastMsg:'' };\nvar LS_TOKEN='ta_token', LS_USER='ta_user';\nfunction $(id){ return document.getElementById(id); }\nfunction esc(s){ return String(s==null?'':s).replace(/[&<>\"']/g, function(c){\nreturn {'&':'&','<':'<','>':'>','\"':'"',\"'\":'''}[c]; }); }\nfunction money(n){ return new Intl.NumberFormat(CFG.locale,{maximumFractionDigits:0}).format(Number(n)||0); }\nfunction price(n){ return CFG.currency + ' ' + money(n); }\nvar toastTimer=null;\nfunction toast(msg){\nvar t=$('toast'); t.textContent=msg; t.classList.remove('hide');\nclearTimeout(toastTimer); toastTimer=setTimeout(function(){ t.classList.add('hide'); },3000);\n}\nasync function api(path, opts){\nopts=opts||{};\nvar headers={'content-type':'application/json'};\nif (state.token) headers.authorization='Bearer '+state.token;\nvar res=await fetch(path,{ method:opts.method||'GET', headers:headers,\nbody: opts.body ? JSON.stringify(opts.body) : undefined });\nvar data={}; try{ data=await res.json(); }catch(e){}\nif(!res.ok) throw new Error(data.error || ('Request failed ('+res.status+')'));\nreturn data;\n}\n// session\nfunction saveSession(token,user,admin,canSell,verified){\nstate.token=token; state.user=user;\nstate.admin=!!admin; state.canSell=!!canSell; state.verified=verified!==false;\nlocalStorage.setItem(LS_TOKEN,token);\nlocalStorage.setItem(LS_USER,JSON.stringify(user));\nrenderAuthArea();\n}\nfunction clearSession(){\nstate.token=null; state.user=null; state.admin=false; state.canSell=false; state.verified=true;\nlocalStorage.removeItem(LS_TOKEN); localStorage.removeItem(LS_USER);\nrenderAuthArea();\n}\nasync function restoreSession(){\nvar token=localStorage.getItem(LS_TOKEN);\nif(!token){ renderAuthArea(); return; }\nstate.token=token;\nvar cached=localStorage.getItem(LS_USER);\nif(cached){ try{ state.user=JSON.parse(cached); }catch(e){} }\nrenderAuthArea();\ntry{\nvar out=await api('/api/me');\nif(out.user) saveSession(token,out.user,out.admin,out.canSell,out.verified);\nelse clearSession();\n}catch(e){ clearSession(); }\n}\n// nav\nfunction renderAuthArea(){\nvar u=state.user;\n// Admin and seller entry points are rendered only for accounts the server\n// confirmed — /api/me decides, never the client.\n$('navAdmin').classList.toggle('hide', !state.admin);\n$('mNavAdmin').classList.toggle('hide', !state.admin);\n$('navSell').classList.toggle('hide', !state.canSell);\n$('mNavSell').classList.toggle('hide', !state.canSell);\n$('mNavOrders').classList.toggle('hide', !u);\nvar html;\nif(!u){\nhtml=''+\n'';\n} else {\nvar role = state.admin ? 'Admin' : (state.canSell ? 'Seller' : 'Buyer');\nvar badgeCls = state.admin ? 'border-emerald/40 text-emerald' : (state.canSell ? 'border-violet/60 text-violet' : 'border-line text-mute');\nvar become = (!state.canSell && !state.admin)\n? '' : '';\nhtml=''+\n''+esc(u.name.split(' ')[0])+\n''+role+''+\nbecome+\n'';\n}\n$('authArea').innerHTML=html;\n\nvar mob;\nif(!u){\nmob=''+\n'';\n} else {\nvar roleM = state.admin ? 'Admin' : (state.canSell ? 'Seller' : 'Buyer');\nvar badgeM = state.admin ? 'border-emerald/40 text-emerald' : (state.canSell ? 'border-violet/60 text-violet' : 'border-line text-mute');\nmob='

'+\n''+esc(u.name.split(' ')[0])+''+\n''+roleM+'

'+\n((!state.canSell && !state.admin)\n? '' : '')+\n'';\n}\n$('authAreaMobile').innerHTML=mob;\n}\nfunction toggleMenu(force){\nvar d=$('menuD'); if(!d) return;\nd.open = (force===undefined) ? !d.open : !!force;\n}\nvar VIEWS = { home:'#/', orders:'#/orders', sell:'#/sell', admin:'#/admin' };\n\nfunction viewFromHash(){\nvar h = (location.hash || '#/').toLowerCase();\nif(h.indexOf('orders') > -1) return 'orders';\nif(h.indexOf('sell') > -1) return 'sell';\nif(h.indexOf('admin') > -1) return 'admin';\nreturn 'home';\n}\n\n// Back must move between views, not leave the site.\nfunction applyHash(){\nvar v = viewFromHash();\nif(v === 'admin' && !state.admin) v = 'home';\nif(v === 'sell' && !state.canSell) v = 'home';\nrender(v);\n}\n\nfunction go(view, silent){\nif(!silent && VIEWS[view] && location.hash !== VIEWS[view]) location.hash = VIEWS[view];\nrender(view);\n}\n\nfunction render(view){\n['home','orders','sell','admin'].forEach(function(v){\n$('view-'+v).classList.toggle('hide', v!==view);\n});\nwindow.scrollTo({top:0});\nif(view==='orders') loadMyOrders();\nif(view==='sell'){ renderMyListings(); loadSellerOrders(); }\nif(view==='admin') loadAdmin();\n}\n// Section anchors live inside #view-home. From the seller or admin panel that\n// view is display:none, so a bare #hash jumps nowhere — switch view first.\nfunction goSection(id){\ntoggleMenu(false);\napplyHash();\nvar el = document.getElementById(id);\nif(el) setTimeout(function(){ el.scrollIntoView({ behavior:'smooth', block:'start' }); }, 70);\n}\n\nfunction goHome(){\ntoggleMenu(false);\ngo('home');\nwindow.scrollTo({ top:0, behavior:'smooth' });\n}\n\nfunction getStarted(){\nif(!state.user) return openAuth('register');\ndocument.getElementById('pricing').scrollIntoView({behavior:'smooth'});\n}\n// modals\nfunction openModal(id){\ntoggleMenu(false);\n$(id).classList.remove('hide');\ndocument.body.classList.add('noscroll');\n}\nfunction closeModal(id){ $(id).classList.add('hide'); document.body.classList.remove('noscroll'); }\nfunction openAuth(mode){ setAuthMode(mode); openModal('authModal'); setTimeout(function(){ $('aEmail').focus(); },40); }\nfunction setAuthMode(mode){\nstate.authMode=mode;\nvar reg = mode==='register';\n$('authTitle').textContent = reg ? 'Create your account' : 'Log in';\n$('authSubmit').textContent = reg ? 'Create account' : 'Log in';\n$('nameRow').classList.toggle('hide', !reg);\n$('aName').required = reg;\n$('aPass').setAttribute('autocomplete', reg ? 'new-password' : 'current-password');\n$('tabLogin').className = 'py-2.5 rounded-xl ' + (reg ? 'text-mute' : 'bg-card font-semibold');\n$('tabRegister').className = 'py-2.5 rounded-xl ' + (reg ? 'bg-card font-semibold' : 'text-mute');\n$('authError').classList.add('hide');\n}\nasync function submitAuth(e){\ne.preventDefault();\nvar btn=$('authSubmit'), err=$('authError');\nerr.classList.add('hide'); btn.disabled=true;\ntry{\nvar out=await api(state.authMode==='register' ? '/api/register' : '/api/login', { method:'POST', body:{\nname: $('aName').value.trim(), email: $('aEmail').value.trim(), password: $('aPass').value\n}});\nsaveSession(out.token,out.user,false,false,out.verified);\nvar who=await api('/api/me');\nsaveSession(out.token,who.user,who.admin,who.canSell,who.verified);\ncloseModal('authModal');\n$('aPass').value='';\nif(state.pending){ var p=state.pending; state.pending=null; setTimeout(function(){ checkout(p); }, 300); }\ntoast('Welcome, '+out.user.name.split(' ')[0]+'.');\nif(who.admin) go('admin');\n}catch(ex){ err.textContent=ex.message; err.classList.remove('hide'); }\nfinally{ btn.disabled=false; }\n}\nasync function logout(){\ntry{ await api('/api/logout',{method:'POST'}); }catch(e){}\nclearSession(); go('home'); toast('Logged out.');\n}\n// seller application\nfunction openSeller(){\nif(!state.user) return openAuth('register');\n$('sellerMsg').classList.add('hide');\n$('sellerOpen').classList.add('hide');\n$('sellerNoteMsg').classList.add('hide');\nopenModal('sellerModal');\n}\nasync function sendSellerRequest(btn){\nvar tab=window.open('','_blank');\nbtn.disabled=true;\ntry{\nvar out=await api('/api/request-seller',{ method:'POST', body:{ note: $('sellerNote').value.trim() }});\nvar copied=await copyText(out.message);\nif(tab && !tab.closed) tab.location.href=out.waUrl;\n$('sellerMsg').textContent=out.message;\n$('sellerMsg').classList.remove('hide');\n$('sellerOpen').href=out.waUrl;\n$('sellerOpen').classList.remove('hide');\n$('sellerNoteMsg').textContent = (out.prefill\n? 'Your application is typed into WhatsApp — just send it.'\n: 'Our support number uses a WhatsApp short link, which cannot carry a prefilled message. '\n+ (copied ? 'Your details are on the clipboard — paste them into the chat.' : 'Copy the text above and paste it into the chat.'))\n+ ' Your request is logged either way.';\n$('sellerNoteMsg').classList.remove('hide');\ntoast(out.alreadyPending ? 'Application already on file.' : 'Application submitted.');\n}catch(ex){\nif(tab && !tab.closed) tab.close();\ntoast(ex.message);\n} finally{ btn.disabled=false; }\n}\n// services + listings\nfunction renderServices(){\n$('serviceGrid').innerHTML = SERVICES.map(function(s){\nreturn '

'+\n''+s.icon+''+\n'

'+esc(s.name)+'

'+\n'

'+esc(s.desc)+'

'+\n''+\n'

';\n}).join('');\nanimateIn('#serviceGrid > *');\n}\n// Real counts only. If the platform is new the strip stays hidden rather\n// than displaying zeros or invented figures.\nasync function loadStats(){\ntry{\nvar out=await api('/api/stats');\nvar s=out.stats||{};\nvar cells=[];\nif(s.delivered>0) cells.push(['Orders delivered', money(s.delivered)]);\nif(s.sellers>0) cells.push(['Verified sellers', money(s.sellers)]);\nif(s.listings>0) cells.push(['Live packages', money(s.listings)]);\nif(s.refillDays) cells.push(['Refill cover', s.refillDays+' days']);\nif(cells.length<2) return;\n$('statGrid').innerHTML=cells.map(function(c){\nreturn '

'+esc(c[1])+'

'+esc(c[0])+'

';\n}).join('');\n$('proof').classList.remove('hide');\n}catch(e){}\n}\n\nasync function loadListings(){\ntry{ var out=await api('/api/listings'); state.listings=out.listings||[]; }\ncatch(e){ state.listings=[]; }\nrenderListings();\n}\nfunction setChip(cat, btn){\nstate.chip = cat;\nvar all = document.querySelectorAll('#chips .chip');\nfor(var i=0;i0);\n$('listingGrid').innerHTML=list.map(function(p){\nvar cover;\nif(p.video_key){\ncover='

';\n} else if(p.image_key){\ncover=' $\"\"$ ';\n} else {\ncover='

'+esc((p.title||'?').charAt(0).toUpperCase())+'

';\n}\nvar tagHtml='';\nif(p.tags){\ntagHtml='

'+p.tags.split(',').slice(0,6).map(function(t){\nreturn ''+esc(t.trim())+'';\n}).join('')+'

';\n}\nreturn '

'+\n'

'+cover+'

'+\n'

'+\n''+esc(p.category)+''+\n'#'+esc(p.id)+''+\n'

'+\n'

'+esc(p.title)+'

'+\n(p.description ? '

'+esc(p.description)+'

' : '

Message the seller on WhatsApp for delivery times and terms.

')+\n'

'+\n''+esc((p.seller_name||'?').charAt(0).toUpperCase())+''+\n''+esc(p.seller_name)+''+\n'

'+tagHtml+\n'

'+\n''+esc(price(p.price))+''+\n''+\n'

'+\n'

';\n}).join('');\nanimateIn('#listingGrid > *');\n}\n/* checkout: window.open() fires synchronously inside the click handler —\nafter the await it loses the gesture context and iOS blocks it. */\nfunction orderListing(id, btn){ return checkout({ listingId:id }, btn); }\nfunction buyPackage(pid, btn){ return checkout({ packageId:pid }, btn); }\nasync function checkout(payload, btn){\nif(!state.user){\nstate.pending=payload;\nopenAuth('register');\n$('authTitle').textContent='Create an account to generate your SKU';\n$('authWhy').textContent='Your order number is issued to your account so you and the seller can both track it. Takes a few seconds.';\nreturn;\n}\nbtn = btn || {};\nvar tab=window.open('','_blank');\nvar label=btn.textContent;\nbtn.disabled=true; btn.textContent='Creating SKU...';\ntry{\nvar out=await api('/create-order',{ method:'POST', body:payload });\nstate.lastMsg=out.message;\nvar copied=await copyText(out.message);\nif(tab && !tab.closed) tab.location.href=out.waUrl;\nshowSku(out, copied, !tab || tab.closed);\n}catch(ex){\nif(tab && !tab.closed) tab.close();\ntoast(ex.message);\n} finally{ btn.disabled=false; btn.textContent=label; }\n}\nasync function copyText(text){\ntry{\nif(navigator.clipboard && window.isSecureContext){ await navigator.clipboard.writeText(text); return true; }\n}catch(e){}\ntry{\nvar ta=document.createElement('textarea');\nta.value=text; ta.style.position='fixed'; ta.style.opacity='0';\ndocument.body.appendChild(ta); ta.select();\nvar ok=document.execCommand('copy');\ndocument.body.removeChild(ta);\nreturn ok;\n}catch(e){ return false; }\n}\nfunction showSku(out, copied, blocked){\nstate.lastOrder = out;\n$('skuCode').textContent=out.sku;\n$('skuProduct').textContent=out.product.title;\n$('skuPrice').textContent=price(out.product.price);\n$('skuSeller').textContent=out.product.seller_name;\n$('skuMsg').textContent=out.message;\nvar note = out.prefill\n? 'The message is already typed in WhatsApp. Send it as it is and the seller will see your SKU.'\n: 'This seller uses a WhatsApp short link, which cannot carry a prefilled message. '\n+ (copied ? 'The message is on your clipboard — paste it into the chat.' : 'Copy the message above and paste it into the chat.');\nif(blocked) note+=' Your browser blocked the new tab, so use the Open WhatsApp button.';\n$('skuNote').textContent=note;\n$('skuGo').textContent = copied ? 'Copied — open WhatsApp again' : 'Copy details & open WhatsApp';\nstate.awaitingReturn = true;\nopenModal('skuModal');\nif(state.user) loadMyOrders();\n}\n// Runs inside the click, so the popup blocker allows the tab.\nasync function copyAndOpen(){\nif(!state.lastOrder) return;\nvar ok = await copyText(state.lastOrder.message);\nwindow.open(state.lastOrder.waUrl, '_blank');\nstate.awaitingReturn = true;\n$('skuGo').textContent = ok ? 'Copied — open WhatsApp again' : 'Open WhatsApp again';\n}\n\n// Coming back from WhatsApp should land on the order, not a stale modal.\ndocument.addEventListener('visibilitychange', function(){\nif(document.visibilityState !== 'visible' || !state.awaitingReturn) return;\nstate.awaitingReturn = false;\ncloseModal('skuModal');\nif(state.user) go('orders');\n});\n// orders\nfunction statusPill(st){\nvar cls = st==='Delivered' ? 'border-emerald/40 text-emerald'\n: (st==='Cancelled' ? 'border-line text-mute' : 'border-cyan/50 text-cyan');\nreturn ''+esc(st)+'';\n}\n\n// mode: 'buyer' (cancel own pending order), 'seller' / 'admin' (full control), null (read only)\nfunction statusActions(o, mode){\nif(mode==='buyer'){\nreturn o.status==='Pending'\n? ''\n: '—';\n}\nif(mode==='seller' || mode==='admin'){\nvar out='';\nif(o.status!=='Delivered') out+=' ';\nif(o.status!=='Cancelled') out+=' ';\nif(o.status!=='Pending') out+='';\nreturn out || '—';\n}\nreturn '';\n}\n\nfunction ordersTable(rows, party, partyLabel, mode){\nvar acts = !!mode;\nvar cards = '

'+rows.map(function(o){\nreturn '

'+\n'

'+\n''+esc(o.sku)+''+statusPill(o.status)+'

'+\n'

'+esc(o.product_title)+'

'+\n'

'+\n''+esc(price(o.price))+''+\n''+partyLabel+': '+esc(o[party]||'guest')+''+\n''+esc(String(o.created_at).slice(0,10))+'

'+\n(acts ? '

'+statusActions(o,mode)+'

' : '')+\n'

';\n}).join('')+'

';\nreturn cards+'

'+\n''+\n''+\n''+\n(acts?'':'')+\n''+\nrows.map(function(o){\nreturn ''+\n''+\n''+\n''+\n''+\n''+\n''+\n(acts?'':'')+\n'';\n}).join('')+'

SKU	Package	Price	'+partyLabel+'	Status	Created	Actions
'+esc(o.sku)+'	'+esc(o.product_title)+'	'+esc(price(o.price))+'	'+esc(o[party]\|\|'guest')+'	'+statusPill(o.status)+'	'+esc(String(o.created_at).slice(0,16).replace('T',' '))+'	'+statusActions(o,mode)+'

';\n}\nasync function loadMyOrders(){\nvar wrap=$('ordersWrap');\nif(!state.user){ wrap.innerHTML='

'; return; }\ntry{\nvar out=await api('/api/my-orders');\nvar rows=out.orders||[];\nwrap.innerHTML = rows.length ? ordersTable(rows,'seller_name','Seller','buyer')\n: '

'+\n'

No orders yet

'+\n'

Pick a package and your SKU appears here.

'+\n'

';\n}catch(ex){ wrap.innerHTML='

'+esc(ex.message)+'

'; }\n}\nasync function loadSellerOrders(){\nvar wrap=$('sellerOrdersWrap');\ntry{\nvar out=await api('/api/seller-orders');\nvar rows=out.orders||[];\nwrap.innerHTML = rows.length ? ordersTable(rows,'buyer_name','Buyer','seller')\n: '

Nothing ordered yet. Orders land here the moment a buyer taps your package.

';\n}catch(ex){ wrap.innerHTML='

'+esc(ex.message)+'

'; }\n}\n// seller panel\nfunction compressImage(file, maxW, quality){\nreturn new Promise(function(resolve, reject){\nif(file.size > 25000000){ reject(new Error('That file is too large to process.')); return; }\nvar reader = new FileReader();\nreader.onerror = function(){ reject(new Error('Could not read that file.')); };\nreader.onload = function(){\nvar img = new Image();\nimg.onerror = function(){ reject(new Error('That file is not a readable image.')); };\nimg.onload = function(){\nvar scale = Math.min(1, maxW / img.width);\nvar w = Math.max(1, Math.round(img.width * scale));\nvar h = Math.max(1, Math.round(img.height * scale));\nvar c = document.createElement('canvas');\nc.width = w; c.height = h;\nvar ctx = c.getContext('2d');\nctx.fillStyle = '#0B1020';\nctx.fillRect(0, 0, w, h);\nctx.drawImage(img, 0, 0, w, h);\nresolve(c.toDataURL('image/jpeg', quality));\n};\nimg.src = reader.result;\n};\nreader.readAsDataURL(file);\n});\n}\n\nfunction previewImage(){\nvar f = $('pImage').files && $('pImage').files[0];\nvar box = $('pImagePreview');\nif(!f){ box.innerHTML = 'No image'; return; }\ncompressImage(f, 1200, .82).then(function(dataUrl){\nbox.innerHTML = ' $\"\"$ ';\n$('pImageNote').textContent = 'Ready to upload, about ' + Math.round((dataUrl.length*0.75)/1024) + ' KB.';\nbox.style.animation='riseIn .4s cubic-bezier(.22,1,.36,1) both';\n}).catch(function(ex){\nbox.innerHTML = 'No image';\n$('pImageNote').textContent = ex.message;\n});\n}\n\nasync function uploadCover(){\nvar f = $('pImage').files && $('pImage').files[0];\nif(!f) return '';\nvar dataUrl = await compressImage(f, 1200, .82);\nvar out = await api('/api/upload-image', { method:'POST', body:{ dataUrl: dataUrl } });\nreturn out.key;\n}\n\nasync function publishListing(e){\ne.preventDefault();\nvar btn=e.target.querySelector('button');\nvar label=btn.textContent;\nbtn.disabled=true;\ntry{\nvar imageKey='';\nif($('pImage').files && $('pImage').files[0]){\nbtn.textContent='Uploading image...';\nimageKey=await uploadCover();\n}\nvar videoKey='';\nif($('pVideo').files && $('pVideo').files[0]){\nvar vf=$('pVideo').files[0];\nbtn.textContent='Uploading video...';\nvar vres=await fetch('/api/upload-video',{ method:'POST',\nheaders:{ authorization:'Bearer '+state.token, 'content-type': vf.type||'video/mp4' }, body: vf });\nvar vout=await vres.json();\nif(!vres.ok) throw new Error(vout.error||'Video upload failed');\nvideoKey=vout.key;\n}\nbtn.textContent='Publishing...';\nvar out=await api('/api/listings',{ method:'POST', body:{\ntitle:$('pTitle').value.trim(), price:Number($('pPrice').value), imageKey:imageKey,\nvideoKey:videoKey, tags:$('pTags').value.trim(),\ndescription:$('pDesc').value.trim(), category:$('pCat').value, waLink:$('pLink').value.trim()\n}});\n$('pTitle').value=''; $('pPrice').value=''; $('pDesc').value='';\n$('pImage').value=''; $('pImagePreview').innerHTML='No image';\n$('pVideo').value=''; $('pTags').value='';\n$('pImageNote').textContent='Optional. Compressed on your phone before upload.';\nawait loadListings();\nloadStats();\n\n// If the blob clip is missing or fails to decode, fall back to the YouTube\n// embed rather than leaving a black rectangle in the hero.\n(function(){\nvar v=document.querySelector('#heroMedia video');\nif(!v) return;\nvar swap=function(){\nif(v.dataset.swapped) return;\nv.dataset.swapped='1';\nvar f=document.createElement('iframe');\nf.className='w-full aspect-video';\nf.setAttribute('src','https://www.youtube.com/embed/'+CFG.youtubeId+'?rel=0&playsinline=1');\nf.setAttribute('title',CFG.brand);\nf.setAttribute('loading','lazy');\nf.setAttribute('frameborder','0');\nf.setAttribute('allow','accelerometer; autoplay; encrypted-media; picture-in-picture');\nf.setAttribute('allowfullscreen','');\nv.replaceWith(f);\n};\nv.addEventListener('error', swap);\nv.addEventListener('stalled', swap);\n// A missing blob returns JSON with a 200-ish shape, so also check it actually loaded.\nsetTimeout(function(){ if(!v.videoWidth) swap(); }, 3500);\n})(); renderMyListings();\ntoast(out.prefill ? 'Published. Buyers get the SKU typed in automatically.' : 'Published. Short link saved — buyers will paste the SKU.');\n}catch(ex){ toast(ex.message); }\nfinally{ btn.disabled=false; btn.textContent=label; }\n}\nfunction renderMyListings(){\nvar wrap=$('myListings');\nif(!state.user){ wrap.innerHTML=''; return; }\nvar mine=state.listings.filter(function(p){ return Number(p.seller_id)===Number(state.user.id); });\nwrap.innerHTML = mine.length ? mine.map(function(p){\nvar thumb = p.image_key\n? ' $\"\"$ '\n: '';\nreturn '

'+\nthumb+\n'

'+esc(p.title)+'

'+\n'

'+esc(price(p.price))+' · '+esc(p.category)+'

'+\n'

';\n}).join('') : '

Nothing published yet. The form puts your first package in the marketplace.

';\n}\nasync function removeListing(id){\ntry{\nawait api('/api/listings/delete',{ method:'POST', body:{ id:id }});\nawait loadListings(); renderMyListings();\ntoast('Listing removed.');\n}catch(ex){ toast(ex.message); }\n}\n\n// motion system — CSS drives every animation; this only flips a class when an\n// element scrolls into view. No library, so nothing can fail to load.\nfunction animateIn(sel){\nvar list = document.querySelectorAll(sel);\nfor(var i=0;i div > div';\nif(MOTION.reduce || !window.IntersectionObserver){\ndocument.querySelectorAll(sel).forEach(function(el){ el.classList.add('in'); });\nreturn;\n}\nMOTION.io = new IntersectionObserver(function(entries){\nentries.forEach(function(e){\nif(e.isIntersecting){ e.target.classList.add('in'); MOTION.io.unobserve(e.target); }\n});\n}, { rootMargin:'0px 0px -8% 0px', threshold:.08 });\nMOTION.on = true;\nanimateIn(sel);\n\nvar dash = document.querySelector('#heroMedia .dash');\nif(!dash) return;\nvar done = false;\nvar cio = new IntersectionObserver(function(en){\nif(done || !en[0].isIntersecting) return;\ndone = true;\ndash.querySelectorAll('.num').forEach(function(el){\nvar to = Number(el.getAttribute('data-to')) || 0;\nvar sfx = el.getAttribute('data-suffix') || '';\nvar t0 = 0;\nvar step = function(ts){\nif(!t0) t0 = ts;\nvar p = Math.min(1, (ts - t0) / 1400);\nel.textContent = Math.round(to * (1 - Math.pow(1 - p, 3))).toLocaleString(CFG.locale) + sfx;\nif(p < 1) requestAnimationFrame(step);\n};\nrequestAnimationFrame(step);\n});\nvar spark = dash.querySelector('.spark');\nif(spark && spark.getTotalLength){\nvar len = spark.getTotalLength();\nspark.style.strokeDasharray = len;\nspark.style.strokeDashoffset = len;\nspark.style.transition = 'stroke-dashoffset 1.6s cubic-bezier(.22,1,.36,1)';\nrequestAnimationFrame(function(){ spark.style.strokeDashoffset = 0; });\n}\ndash.querySelectorAll('.bar').forEach(function(b, i){\nb.style.transform = 'scaleY(0)';\nb.style.transition = 'transform .6s cubic-bezier(.34,1.56,.64,1) ' + (i*70 + 250) + 'ms';\nrequestAnimationFrame(function(){ b.style.transform = 'scaleY(1)'; });\n});\n}, { threshold:.25 });\ncio.observe(dash);\n}\n// order status\nasync function setStatus(sku, status, btn){\nbtn.disabled=true;\ntry{\nawait api('/api/order-status',{ method:'POST', body:{ sku:sku, status:status }});\ntoast('Order '+sku+' marked '+status.toLowerCase()+'.');\nif(!$('view-orders').classList.contains('hide')) loadMyOrders();\nif(!$('view-sell').classList.contains('hide')) loadSellerOrders();\nif(!$('view-admin').classList.contains('hide')) loadAdmin();\n}catch(ex){ toast(ex.message); btn.disabled=false; }\n}\n\n// admin\nasync function uploadHero(btn){\nvar f = $('heroFile').files && $('heroFile').files[0];\nvar note = $('heroUpNote');\nif(!f){ note.textContent='Pick a file first.'; return; }\nbtn.disabled = true;\nnote.textContent = 'Uploading ' + Math.round(f.size/1024/1024*10)/10 + ' MB...';\ntry{\nvar res = await fetch('/api/hero-video', {\nmethod:'POST',\nheaders:{ authorization:'Bearer ' + state.token, 'content-type': f.type || 'video/mp4' },\nbody: f\n});\nvar out = await res.json();\nif(!res.ok) throw new Error(out.error || 'Upload failed');\nnote.textContent = 'Uploaded. Reload the home page to see it.';\ntoast('Hero video uploaded.');\n}catch(ex){ note.textContent = ex.message; }\nfinally{ btn.disabled = false; }\n}\n\nasync function loadAdmin(){\nif(!state.admin){ go('home'); return; }\ntry{\nvar reqs=await api('/api/admin/pending-sellers');\nvar rows=reqs.requests||[];\nvar pending=rows.filter(function(r){ return r.status==='pending'; });\n$('pendingWrap').innerHTML = rows.length ? rows.map(function(r){\nvar approved = r.status==='approved' || r.role==='approved_seller';\nreturn '

'+\n'

'+esc(r.name)+'

'+\n'

'+esc(r.email)+'

'+\n(r.note ? '

'+esc(r.note)+'

' : '')+\n'

Applied '+esc(String(r.created_at).slice(0,10))+'

'+\n'

'+\n(approved\n? 'Approved seller'\n: '')+\n'

';\n}).join('') : '

No applications yet.

';\nvar us=await api('/api/admin/users');\nrenderUsers(us.users||[]);\n\nvar ord=await api('/api/admin/orders');\nvar o=ord.orders||[];\nvar t=ord.totals||{};\n$('adminTotals').innerHTML=[\n['Orders', money(t.n||0)],\n['Requested value', price(t.value||0)],\n['Applications', money(rows.length)],\n['Awaiting review', money(pending.length)]\n].map(function(pair){\nreturn '

'+pair[0]+'

'+\n'

'+esc(pair[1])+'

';\n}).join('');\n$('adminOrdersWrap').innerHTML = o.length ? ordersTable(o,'buyer_name','Buyer','admin')\n: '

No orders yet.

';\n}catch(ex){ toast(ex.message); go('home'); }\n}\nasync function approve(userId, btn){ return userAction(userId,'approve',btn); }\n\nasync function userAction(userId, action, btn){\nvar label=btn.textContent;\nbtn.disabled=true; btn.textContent='Working...';\ntry{\nawait api('/api/admin/user-action',{ method:'POST', body:{ userId:userId, action:action }});\ntoast('Done: '+action+'.');\nloadAdmin();\n}catch(ex){ toast(ex.message); btn.disabled=false; btn.textContent=label; }\n}\n\nfunction renderUsers(users){\nvar wrap=$('usersWrap');\nif(!users.length){ wrap.innerHTML='

No users yet.

'; return; }\nwrap.innerHTML=users.map(function(u){\nvar isMaster = u.role==='admin';\nvar tags='';\ntags += ''+esc(u.role)+'';\nif(Number(u.banned)===1) tags += 'banned';\n\nvar btns='';\nif(!isMaster){\nbtns += u.role==='approved_seller'\n? ''\n: '';\nbtns += Number(u.banned)===1\n? ''\n: '';\n}\n\nreturn '

'+\n'

'+esc(u.name)+'

'+\n'

'+esc(u.email)+'

'+\n'

'+tags+'

'+\n'

'+esc(u.listings)+' listings · '+esc(u.sales)+' orders

'+\n'

'+btns+'

'+\n'

';\n}).join('');\n}\n// boot\ndocument.addEventListener('keydown', function(e){\nif(e.key==='Escape'){ ['authModal','sellerModal','skuModal'].forEach(closeModal); }\n});\n['authModal','sellerModal','skuModal'].forEach(function(id){\n$(id).addEventListener('click', function(e){ if(e.target===this) closeModal(id); });\n});\ndocument.querySelectorAll('#mobileMenu a').forEach(function(a){\na.addEventListener('click', function(){ toggleMenu(false); });\n});\nif(window.__jsErr){ var _d=$('jsErr'); _d.style.display='block'; _d.textContent=window.__jsErr; }\nwindow.addEventListener('hashchange', applyHash);\nwindow.addEventListener('popstate', applyHash);\n$('year').textContent=new Date().getFullYear();\nrenderServices();\ngo('home');\nrestoreSession();\nloadListings();\ninitMotion();\nvar sw=document.documentElement.scrollWidth, iw=window.innerWidth;\nif(sw > iw + 2){\nvar d2=$('jsErr'); d2.style.display='block';\nd2.textContent='Layout overflow: page is '+sw+'px wide vs '+iw+'px viewport.';\n}\n$('buildTag').textContent = 'Build 18 · W'+iw+'/'+sw+' · MOTION ' + (MOTION.on ? 'ON' : 'reduced');\n`;","deleted",false,"label",[19],{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":79,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_65":80,"_18":81},{"_33":68,"_13":69,"_35":70,"_37":-5,"_38":39,"_40":71,"_42":43,"_44":72,"_17":73,"_47":74,"_49":75,"_51":52,"_53":76,"_65":77,"_18":78},{"_33":58,"_13":59,"_35":60,"_37":-5,"_38":39,"_40":61,"_42":43,"_44":62,"_17":63,"_47":48,"_49":64,"_51":52,"_53":-5,"_65":66,"_18":67},"a64d1c45-f844-4b28-b83d-a0c15b16f217","page.ts","6a9f9a30-ae84-11f1-9032-1607ee4eb77e",75,["D",1789293433359],39,"// THE AGENTS — markup and styles. Client script lives in app.ts.\n// main.ts imports { CONFIG, PAGE } from \"./page.ts\".\nimport { APP } from \"./app.ts\";\n\nexport const CONFIG = {\n brand: \"The Agents\",\n currency: \"PKR\",\n locale: \"en-PK\",\n youtubeId: \"b45wwm9gi5Y\",\n // \"youtube\" = embed | \"blob\" = self-hosted MP4 served from /media/hero.mp4.\n // Upload the file to Val Town blob storage under the key hero.mp4, then\n // switch this to \"blob\" — autoplays muted on loop with no YouTube chrome.\n heroMode: \"blob\",\n // Brand WhatsApp — used for seller requests and for packages sold by the house.\n brandWa: \"https://wa.me/message/EQTSKXH474MID1\",\n supportEmail: \"rayandnp@gmail.com\",\n};\n\nexport const PAGE = `\n\n\n\n\n\n${CONFIG.brand} — grow your YouTube channel faster\n\n\n\n\n\n\n\n\n\n\n

\n\n\n

\n\n\n\n\n

\n\n

\n\n\n

\n\n Trusted by creators in 20+ countries\n\n

\nGrow Your YouTube
Channel Faster.\n

\nPremium YouTube services designed to help creators reach their growth and monetization goals.\n

\nOpen Marketplace\n

View services

\n${CONFIG.heroMode === \"blob\"\n? `

`\n: ``}\n

\nWhat ${CONFIG.brand} delivers\n

\n\n\n\n

\nYT\n

Channel analytics

Last 28 days

\n\n Monetized\n\n

Subscribers

1,042

Watch hours

4,118

Views

318K

\n\n

\n\n\n\n\n\n\n\n

\n\n

Unique SKU on every order

Issued before you message anyone, so nothing gets lost in a chat.

✓

We never ask for your password

Your channel link is all any seller here needs. No account access, ever.

↻

90-day refill cover

If the count drops inside 90 days, the seller refills it.

⏱

Delivery paced over 28 days

Fast delivery is what gets channels flagged. We pace it deliberately.

\n\n

LIVE ON THE PLATFORM

Counted directly from the order log. No estimates.

\n\n

Services built for channels

Pick what your channel is short of. Every order is tracked with its own SKU and confirmed on WhatsApp.

\n\n

Pricing that scales with the channel

One-off packages. No subscription, no channel password, no access to your account.

Starter

For channels early in the watch-hour climb.

${CONFIG.currency} 11,500

Delivery in 10–14 days

✓1,000 watch hours
✓Retention held above 45%
✓Drip-fed daily
✓SKU order tracking

\n\n

Creator

\nMOST POPULAR\n

The full monetization requirement, handled.

${CONFIG.currency} 42,000

Delivery in 28–35 days

✓4,000 watch hours
✓1,000 subscribers
✓Natural ratio pacing
✓90-day refill cover
✓Pre-order channel review

\n\n

Pro

Monetization plus three months of managed growth.

${CONFIG.currency} 78,000

Delivery in 30 days, then managed

✓Everything in Creator
✓Shorts feed push
✓Thumbnail and title review
✓Priority support line

\n\n

Marketplace

Packages published by approved sellers. You order in their own WhatsApp inbox.

\n\n

\n\n\n\n\n

No seller listings yet. The packages above are sold directly by ${CONFIG.brand}.

\n\n

How an order actually works

No payment gateway, no escrow theatre. You agree terms directly with the seller and we give you the paper trail.

Step 01

Pick a package

Filter by what your channel is short of. Every listing shows the seller and the price they set.

Step 02

Get your SKU

We issue a unique order number and log it before you leave the site.

Step 03

Confirm on WhatsApp

Quote the SKU to the seller. They confirm terms and payment with you directly.

Step 04

Track it here

The order sits in My orders as Pending until the seller marks it delivered.

\n\n

Questions before you order

How long does delivery take?▾

Watch hours run 10–35 days depending on the size of the package. Subscribers land across 10–14 days. Anything faster looks artificial to YouTube's systems, so we pace it deliberately.

What do you need from me?▾

Your channel link and the videos you want the hours on. Never your password, and never channel access — if anyone asks for either, stop.

How do I track my order?▾

Every order creates a unique SKU the moment you tap the button. Quote it in WhatsApp and check \"My orders\" in your account for its status.

What is the refund policy?▾

If delivery hasn't started within 7 days you get a full refund. Once delivery is under way, drops are covered by the 90-day refill rather than cash back.

Is my channel eligible?▾

Channels with original long-form uploads and no active strikes are. We review before starting and decline reused or auto-generated content — those channels fail the YPP review regardless of hours.

\n\n

My orders

Quote the SKU in WhatsApp — it's how both sides track the job.

\n\n

Seller panel

Publish a package, then take the order in your own WhatsApp inbox.

\n\n

Your listings

Orders on your packages

\n\n

Admin dashboard

\nMaster account\n

Seller applications

Hero video

Upload the clip here rather than through the Blob page — this writes to the store the site actually reads from.

\n\n\n

\n\n

Users

Approve, revoke, ban or verify any account. Banning drops their sessions and hides their listings.

\n\n

All orders

\n\n\n\n

Log in

\n\n

\n\n\n

\n\n

New accounts start as buyers. Apply for seller access from your profile once you are in.

\n\n

Apply to sell

We approve sellers by hand. Send your application on WhatsApp and you'll hear back the same day.

\n\n

\nWhat do you sell? (optional)\n\n

\n\nOpen WhatsApp\n

\n\n

ORDER LOGGED

Your order is on record

\n\n

TRACKING SKU

Quote this SKU. It is how both sides track your order.

\n\n

Verified seller

\n\n

Message the seller will receive

\n\n\n\n

\n\n

\n\n\n`;","children",[],[59],"117161a4-c9c4-4247-9102-f6c8f7e1d52d","main.ts","bbc8531e-ae7c-11f1-af98-1607ee4eb77e",73,["D",1789293374613],19,"http","/**\n * THE AGENTS — creator-services marketplace. Single Val Town HTTP val.\n *\n * SETUP\n * 1. Paste into a new HTTP val, save. Tables self-create on first request.\n * 2. Env vars: ADMIN_EMAIL, ADMIN_PASSWORD. Unset = the fallbacks below.\n *\n * SECURITY: the fallback password sits in source — anyone who can read this\n * val owns the admin account. Set ADMIN_PASSWORD as an env var and change the\n * fallback to junk. Passwords are stored PBKDF2-SHA256 / 150k / per-user salt;\n * changing the env var re-hashes the admin row on the next request.\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { CONFIG, PAGE } from \"./page.ts\";\n\n/* ================================================================== */\n/* config */\n/* ================================================================== */\n\nconst ADMIN_EMAIL = (Deno.env.get(\"ADMIN_EMAIL\") || \"rayandnp@gmail.com\")\n .toLowerCase();\nconst ADMIN_PASSWORD = Deno.env.get(\"ADMIN_PASSWORD\") || \"Ayan9823\";\nconst ADMIN_NAME = \"Ayan\";\n\nconst T = {\n users: \"users\",\n orders: \"orders\",\n listings: \"listings\",\n requests: \"seller_requests\",\n sessions: \"ta_sessions\",\n};\n\n/** House packages. Prices live server-side so the client can't set its own. */\nconst PACKAGES: Record = {\n starter: { title: \"Starter — 1,000 watch hours\", price: 11500 },\n creator: { title: \"Creator — 4,000 hours + 1,000 subscribers\", price: 42000 },\n pro: { title: \"Pro — monetization + 90 days of growth\", price: 78000 },\n monetization: { title: \"YouTube monetization pack\", price: 42000 },\n watchhours: { title: \"Watch hours package\", price: 11500 },\n subscribers: { title: \"Subscribers package\", price: 9000 },\n views: { title: \"Views package\", price: 6500 },\n shorts: { title: \"Shorts growth package\", price: 14000 },\n channel: { title: \"Channel growth package\", price: 25000 },\n};\n\n/* ================================================================== */\n/* sqlite helpers */\n/* ================================================================== */\n\ntype Row = Record;\n\nasync function q(sql: string, args: any[] = []): Promise {\n const res: any = await sqlite.execute({ sql, args });\n const cols: string[] = res?.columns ?? [];\n const rows: any[] = res?.rows ?? [];\n return rows.map((r: any) =>\n Array.isArray(r)\n ? Object.fromEntries(cols.map((c, i) => [c, r[i]]))\n : (r as Row)\n );\n}\nasync function run(sql: string, args: any[] = []): Promise {\n return await sqlite.execute({ sql, args });\n}\nasync function one(sql: string, args: any[] = []): Promise {\n const rows = await q(sql, args);\n return rows.length ? rows[0] : null;\n}\n\n/* ================================================================== */\n/* bootstrap */\n/* ================================================================== */\n\nlet ready: Promise | null = null;\nconst init = () => (ready ??= bootstrap());\n\nasync function bootstrap(): Promise {\n await run(`CREATE TABLE IF NOT EXISTS ${T.users} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT NOT NULL,\n email TEXT NOT NULL UNIQUE,\n role TEXT NOT NULL DEFAULT 'buyer',\n pass_hash TEXT NOT NULL,\n pass_salt TEXT NOT NULL,\n created_at TEXT NOT NULL\n )`);\n\n await run(`CREATE TABLE IF NOT EXISTS ${T.sessions} (\n token TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL,\n created_at TEXT NOT NULL\n )`);\n\n await run(`CREATE TABLE IF NOT EXISTS ${T.listings} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n seller_id INTEGER NOT NULL,\n seller_name TEXT NOT NULL,\n title TEXT NOT NULL,\n description TEXT NOT NULL DEFAULT '',\n price REAL NOT NULL DEFAULT 0,\n category TEXT NOT NULL DEFAULT 'Growth',\n wa_link TEXT NOT NULL,\n active INTEGER NOT NULL DEFAULT 1,\n created_at TEXT NOT NULL\n )`);\n\n await run(`CREATE TABLE IF NOT EXISTS ${T.orders} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n sku TEXT NOT NULL UNIQUE,\n listing_id INTEGER,\n package_id TEXT,\n product_title TEXT NOT NULL,\n price REAL NOT NULL DEFAULT 0,\n seller_name TEXT NOT NULL,\n seller_id INTEGER,\n buyer_name TEXT,\n buyer_email TEXT,\n status TEXT NOT NULL DEFAULT 'Pending',\n created_at TEXT NOT NULL\n )`);\n\n await run(`CREATE TABLE IF NOT EXISTS ${T.requests} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n user_id INTEGER NOT NULL,\n name TEXT NOT NULL,\n email TEXT NOT NULL,\n note TEXT DEFAULT '',\n status TEXT NOT NULL DEFAULT 'pending',\n created_at TEXT NOT NULL,\n decided_at TEXT\n )`);\n\n await run(\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_orders_sku ON ${T.orders}(sku)`,\n );\n await run(\n `CREATE INDEX IF NOT EXISTS idx_listings_seller ON ${T.listings}(seller_id)`,\n );\n await run(\n `CREATE INDEX IF NOT EXISTS idx_requests_status ON ${T.requests}(status)`,\n );\n\n await migrate();\n await seedAdmin();\n}\n\n/** Adds columns to tables that already exist in a live database.\n * CREATE TABLE IF NOT EXISTS never alters an existing table, so anything\n * added after your first deploy has to come through here. */\nasync function ensureColumn(\n table: string,\n column: string,\n ddl: string,\n backfill?: string,\n) {\n const cols = await q(`PRAGMA table_info(${table})`);\n if (cols.some((c) => String(c.name) === column)) return;\n await run(`ALTER TABLE ${table} ADD COLUMN ${column} ${ddl}`);\n if (backfill) await run(backfill);\n}\n\nasync function migrate(): Promise {\n // Accounts that existed before verification shipped are grandfathered in —\n // backfilling to 0 would lock out every current user.\n await ensureColumn(\n T.users,\n \"verified\",\n \"INTEGER NOT NULL DEFAULT 1\",\n `UPDATE ${T.users} SET verified = 1`,\n );\n // Verification was removed: clear anyone still stuck behind it.\n await run(\n `UPDATE ${T.users} SET verified = 1, verify_code = NULL WHERE verified = 0`,\n );\n await ensureColumn(T.users, \"banned\", \"INTEGER NOT NULL DEFAULT 0\");\n await ensureColumn(T.users, \"verify_code\", \"TEXT\");\n await ensureColumn(T.users, \"verify_expires\", \"TEXT\");\n await ensureColumn(T.users, \"verify_sent_at\", \"TEXT\");\n await ensureColumn(T.orders, \"updated_at\", \"TEXT\");\n await ensureColumn(T.listings, \"image_key\", \"TEXT\");\n await ensureColumn(T.listings, \"video_key\", \"TEXT\");\n await ensureColumn(T.listings, \"tags\", \"TEXT\");\n}\n\nasync function seedAdmin(): Promise {\n const salt = randomHex(16);\n const hash = await hashPassword(ADMIN_PASSWORD, salt);\n const existing = await one(\n `SELECT id, role, pass_hash, pass_salt FROM ${T.users} WHERE email = ?`,\n [\n ADMIN_EMAIL,\n ],\n );\n\n if (!existing) {\n await run(\n `INSERT INTO ${T.users} (name, email, role, pass_hash, pass_salt, created_at)\n VALUES (?, ?, 'admin', ?, ?, ?)`,\n [ADMIN_NAME, ADMIN_EMAIL, hash, salt, new Date().toISOString()],\n );\n return;\n }\n\n // Keep the admin row in sync with the current ADMIN_PASSWORD env value.\n const current = await hashPassword(\n ADMIN_PASSWORD,\n String(existing.pass_salt),\n );\n if (current !== String(existing.pass_hash) || existing.role !== \"admin\") {\n await run(\n `UPDATE ${T.users} SET role = 'admin', pass_hash = ?, pass_salt = ? WHERE id = ?`,\n [\n hash,\n salt,\n existing.id,\n ],\n );\n }\n // The master account can never be left banned or unverified.\n await run(`UPDATE ${T.users} SET banned = 0, verified = 1 WHERE email = ?`, [\n ADMIN_EMAIL,\n ]);\n}\n\n/* ================================================================== */\n/* crypto + sessions */\n/* ================================================================== */\n\nconst enc = new TextEncoder();\n\nfunction toHex(buf: ArrayBuffer | Uint8Array): string {\n const b = buf instanceof Uint8Array ? buf : new Uint8Array(buf);\n return Array.from(b).map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\nfunction randomHex(bytes: number): string {\n return toHex(crypto.getRandomValues(new Uint8Array(bytes)));\n}\nasync function hashPassword(password: string, salt: string): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n enc.encode(password),\n \"PBKDF2\",\n false,\n [\n \"deriveBits\",\n ],\n );\n const bits = await crypto.subtle.deriveBits(\n {\n name: \"PBKDF2\",\n salt: enc.encode(salt),\n iterations: 150000,\n hash: \"SHA-256\",\n },\n key,\n 256,\n );\n return toHex(bits);\n}\nfunction safeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\nfunction bearer(req: Request): string | null {\n const m = (req.headers.get(\"authorization\") || \"\").match(/^Bearer\\s+(.+)$/i);\n return m ? m[1].trim() : null;\n}\nasync function currentUser(req: Request): Promise {\n const token = bearer(req);\n if (!token) return null;\n return await one(\n `SELECT u.id, u.name, u.email, u.role, u.verified, u.banned FROM ${T.sessions} s\n JOIN ${T.users} u ON u.id = s.user_id WHERE s.token = ? AND u.banned = 0`,\n [token],\n );\n}\nasync function newSession(userId: number): Promise {\n const token = randomHex(32);\n await run(\n `INSERT INTO ${T.sessions} (token, user_id, created_at) VALUES (?, ?, ?)`,\n [\n token,\n userId,\n new Date().toISOString(),\n ],\n );\n return token;\n}\n/** Admin gate: role must be admin AND the email must be the master account. */\nfunction isAdmin(user: Row | null): boolean {\n return !!user && user.role === \"admin\" &&\n String(user.email).toLowerCase() === ADMIN_EMAIL;\n}\nconst canSell = (u: Row | null) =>\n !!u && (u.role === \"approved_seller\" || isAdmin(u));\n\n/* ================================================================== */\n/* WhatsApp link handling */\n/* ================================================================== */\n\n/** wa.me/message/

 links resolve at WhatsApp and drop the query string,\n * so ?text= never arrives. Only wa.me/ and api.whatsapp.com/send?phone=\n * carry a prefilled body. `prefill` tells the client to fall back to clipboard. */\nfunction buildWaUrl(\n  raw: string,\n  message: string,\n): { url: string; prefill: boolean } {\n  const link = (raw || \"\").trim();\n  if (/^\\+?\\d[\\d\\s\\-()]{6,}$/.test(link)) {\n    return {\n      url: `https://wa.me/${link.replace(/\\D/g, \"\")}?text=${\n        encodeURIComponent(message)\n      }`,\n      prefill: true,\n    };\n  }\n  let url: URL;\n  try {\n    url = new URL(link.startsWith(\"http\") ? link : `https://${link}`);\n  } catch {\n    return { url: CONFIG.brandWa, prefill: false };\n  }\n  const host = url.hostname.replace(/^www\\./, \"\");\n  if (host === \"wa.me\" && /^\\/message\\//i.test(url.pathname)) {\n    return { url: url.toString(), prefill: false };\n  }\n  if (host === \"chat.whatsapp.com\") {\n    return { url: url.toString(), prefill: false };\n  }\n  if (host === \"wa.me\" && /^\\/\\+?\\d{6,}$/.test(url.pathname)) {\n    url.searchParams.set(\"text\", message);\n    return { url: url.toString(), prefill: true };\n  }\n  if (\n    (host === \"api.whatsapp.com\" || host === \"web.whatsapp.com\") &&\n    url.searchParams.get(\"phone\")\n  ) {\n    url.searchParams.set(\"text\", message);\n    return { url: url.toString(), prefill: true };\n  }\n  return { url: url.toString(), prefill: false };\n}\n\nfunction validWaLink(raw: string): boolean {\n  const link = (raw || \"\").trim();\n  if (!link) return false;\n  if (/^\\+?\\d[\\d\\s\\-()]{6,}$/.test(link)) return true;\n  try {\n    const host = new URL(link.startsWith(\"http\") ? link : `https://${link}`)\n      .hostname.replace(/^www\\./, \"\");\n    return [\n      \"wa.me\",\n      \"api.whatsapp.com\",\n      \"web.whatsapp.com\",\n      \"chat.whatsapp.com\",\n    ].includes(host);\n  } catch {\n    return false;\n  }\n}\n\n/* ================================================================== */\n/* SKU                                                                */\n/* ================================================================== */\n\nfunction skuCandidate(width = 6): string {\n  const max = Math.pow(10, width);\n  const min = Math.pow(10, width - 1);\n  return `SKU-${\n    (crypto.getRandomValues(new Uint32Array(1))[0] % (max - min)) + min\n  }`;\n}\n\n/** Uniqueness comes from the UNIQUE index, not a prior SELECT — check-then-insert\n * races the moment two buyers tap in the same second. */\nasync function insertOrder(o: {\n  listingId: number | null;\n  packageId: string | null;\n  title: string;\n  price: number;\n  sellerName: string;\n  sellerId: number | null;\n  buyerName: string | null;\n  buyerEmail: string | null;\n}): Promise {\n  const now = new Date().toISOString();\n  for (let i = 0; i < 14; i++) {\n    const sku = skuCandidate(i < 10 ? 6 : 8);\n    try {\n      await run(\n        `INSERT INTO ${T.orders}\n         (sku, listing_id, package_id, product_title, price, seller_name, seller_id,\n          buyer_name, buyer_email, status, created_at)\n         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'Pending', ?)`,\n        [\n          sku,\n          o.listingId,\n          o.packageId,\n          o.title,\n          o.price,\n          o.sellerName,\n          o.sellerId,\n          o.buyerName,\n          o.buyerEmail,\n          now,\n        ],\n      );\n      return sku;\n    } catch (err: any) {\n      if (/UNIQUE|constraint/i.test(String(err?.message || err))) continue;\n      throw err;\n    }\n  }\n  throw new Error(\"Could not allocate a unique SKU\");\n}\n\n/* ================================================================== */\n/* helpers                                                            */\n/* ================================================================== */\n\nconst json = (data: unknown, status = 200) =>\n  new Response(JSON.stringify(data), {\n    status,\n    headers: { \"content-type\": \"application/json; charset=utf-8\" },\n  });\n\nconst htmlRes = (b: string, status = 200) =>\n  new Response(b, {\n    status,\n    headers: { \"content-type\": \"text/html; charset=utf-8\" },\n  });\n\nasync function readBody(req: Request): Promise {\n  try {\n    return (await req.json()) as Row;\n  } catch {\n    return {};\n  }\n}\n\nconst money = (n: number) =>\n  new Intl.NumberFormat(CONFIG.locale, { maximumFractionDigits: 0 }).format(\n    Number(n) || 0,\n  );\n\nconst priceLabel = (n: number) => `${CONFIG.currency} ${money(n)}`;\n\n/** Exact checkout message format. */\nconst orderMessage = (sku: string, title: string, price: number) =>\n  `Order ${sku} - Product: ${title} - Price: ${\n    priceLabel(price)\n  }. Sent from ${CONFIG.brand}. Please confirm this order.`;\n\n/* ================================================================== */\n/* router                                                             */\n/* ================================================================== */\n\nexport default async function (req: Request): Promise {\n  await init();\n  const url = new URL(req.url);\n  const path = url.pathname.replace(/\\/+$/, \"\") || \"/\";\n  const method = req.method.toUpperCase();\n\n  try {\n    if (method === \"GET\" && path === \"/\") return htmlRes(PAGE);\n    if (method === \"GET\" && path === \"/health\") return json({ ok: true });\n    if (method === \"GET\" && path === \"/media/hero.mp4\") {\n      return await heroVideo();\n    }\n    if (method === \"GET\" && path === \"/media/debug\") return await blobDebug();\n    if (method === \"POST\" && path === \"/api/hero-video\") {\n      return await uploadHeroVideo(req);\n    }\n    if (method === \"GET\" && path.startsWith(\"/media/img/\")) {\n      return await listingImage(path);\n    }\n    if (method === \"POST\" && path === \"/api/upload-image\") {\n      return await uploadImage(req);\n    }\n    if (method === \"POST\" && path === \"/api/upload-video\") {\n      return await uploadListingVideo(req);\n    }\n    if (method === \"GET\" && path.startsWith(\"/media/vid/\")) {\n      return await listingVideo(path);\n    }\n\n    if (method === \"POST\" && path === \"/api/register\") {\n      return await register(req);\n    }\n    if (method === \"POST\" && path === \"/api/login\") return await login(req);\n    if (method === \"POST\" && path === \"/api/logout\") return await logout(req);\n    if (method === \"GET\" && path === \"/api/me\") return await me(req);\n\n    if (method === \"GET\" && path === \"/api/listings\") {\n      return await getListings();\n    }\n    if (method === \"GET\" && path === \"/api/stats\") return await publicStats();\n    if (method === \"POST\" && path === \"/api/listings\") {\n      return await createListing(req);\n    }\n    if (method === \"POST\" && path === \"/api/listings/delete\") {\n      return await deleteListing(req);\n    }\n\n    if (\n      method === \"POST\" &&\n      (path === \"/create-order\" || path === \"/api/create-order\")\n    ) {\n      return await createOrder(req);\n    }\n\n    if (method === \"POST\" && path === \"/api/request-seller\") {\n      return await requestSeller(req);\n    }\n    if (method === \"GET\" && path === \"/api/my-orders\") {\n      return await myOrders(req);\n    }\n    if (method === \"GET\" && path === \"/api/seller-orders\") {\n      return await sellerOrders(req);\n    }\n    if (method === \"POST\" && path === \"/api/order-status\") {\n      return await setOrderStatus(req);\n    }\n\n    if (method === \"GET\" && path === \"/api/admin/pending-sellers\") {\n      return await pendingSellers(req);\n    }\n    if (method === \"POST\" && path === \"/api/admin/approve-seller\") {\n      return await approveSeller(req);\n    }\n    if (method === \"GET\" && path === \"/api/admin/orders\") {\n      return await adminOrders(req);\n    }\n    if (method === \"GET\" && path === \"/api/admin/users\") {\n      return await adminUsers(req);\n    }\n    if (method === \"POST\" && path === \"/api/admin/user-action\") {\n      return await adminUserAction(req);\n    }\n\n    return json({ error: \"Not found\" }, 404);\n  } catch (err: any) {\n    console.error(err);\n    return json(\n      { error: \"Server error\", detail: String(err?.message || err) },\n      500,\n    );\n  }\n}\n\n/* ================================================================== */\n/* auth                                                               */\n/* ================================================================== */\n\nasync function register(req: Request): Promise {\n  const b = await readBody(req);\n  const name = String(b.name || \"\").trim();\n  const email = String(b.email || \"\").trim().toLowerCase();\n  const password = String(b.password || \"\");\n\n  if (name.length < 2) return json({ error: \"Enter your full name.\" }, 400);\n  if (!/^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(email)) {\n    return json({ error: \"That email isn't valid.\" }, 400);\n  }\n  if (password.length < 6) {\n    return json({ error: \"Use at least 6 characters.\" }, 400);\n  }\n  if (email === ADMIN_EMAIL) {\n    return json({ error: \"That account already exists. Log in instead.\" }, 409);\n  }\n\n  if (await one(`SELECT id FROM ${T.users} WHERE email = ?`, [email])) {\n    return json({\n      error: \"An account already uses that email. Log in instead.\",\n    }, 409);\n  }\n\n  const salt = randomHex(16);\n  const hash = await hashPassword(password, salt);\n  await run(\n    `INSERT INTO ${T.users} (name, email, role, pass_hash, pass_salt, created_at, verified)\n     VALUES (?, ?, 'buyer', ?, ?, ?, 1)`,\n    [name, email, hash, salt, new Date().toISOString()],\n  );\n  const user = await one(\n    `SELECT id, name, email, role FROM ${T.users} WHERE email = ?`,\n    [email],\n  );\n  return json({\n    success: true,\n    token: await newSession(Number(user!.id)),\n    user,\n  });\n}\n\nasync function login(req: Request): Promise {\n  const b = await readBody(req);\n  const email = String(b.email || \"\").trim().toLowerCase();\n  const password = String(b.password || \"\");\n  const row = await one(\n    `SELECT id, name, email, role, verified, banned, pass_hash, pass_salt FROM ${T.users} WHERE email = ?`,\n    [email],\n  );\n  const generic = json({ error: \"Email or password is wrong.\" }, 401);\n  if (!row) return generic;\n  if (Number(row.banned) === 1) {\n    return json({ error: \"This account is suspended. Contact support.\" }, 403);\n  }\n  const hash = await hashPassword(password, String(row.pass_salt));\n  if (!safeEqual(hash, String(row.pass_hash))) return generic;\n  return json({\n    success: true,\n    token: await newSession(Number(row.id)),\n    user: { id: row.id, name: row.name, email: row.email, role: row.role },\n  });\n}\n\nasync function logout(req: Request): Promise {\n  const token = bearer(req);\n  if (token) await run(`DELETE FROM ${T.sessions} WHERE token = ?`, [token]);\n  return json({ success: true });\n}\n\nasync function me(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ user: null });\n  const pending = await one(\n    `SELECT id FROM ${T.requests} WHERE user_id = ? AND status = 'pending'`,\n    [user.id],\n  );\n  return json({\n    user: { id: user.id, name: user.name, email: user.email, role: user.role },\n    admin: isAdmin(user),\n    canSell: canSell(user),\n    sellerRequestPending: !!pending,\n  });\n}\n\n/* ================================================================== */\n/* listings                                                           */\n/* ================================================================== */\n\nasync function getListings(): Promise {\n  const listings = await q(\n    `SELECT l.id, l.title, l.description, l.price, l.category, l.seller_name, l.seller_id, l.image_key, l.video_key, l.tags, l.created_at\n       FROM ${T.listings} l JOIN ${T.users} u ON u.id = l.seller_id\n      WHERE l.active = 1 AND u.banned = 0 AND u.role IN ('approved_seller','admin')\n      ORDER BY l.id DESC LIMIT 200`,\n  );\n  return json({ listings });\n}\n\nasync function createListing(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  if (!canSell(user)) {\n    return json({ error: \"Your seller account is not approved yet.\" }, 403);\n  }\n\n  const b = await readBody(req);\n  const title = String(b.title || \"\").trim();\n  const description = String(b.description || \"\").trim();\n  const price = Number(b.price);\n  const category = String(b.category || \"Growth\").trim() || \"Growth\";\n  const waLink = String(b.waLink || \"\").trim();\n  const imageKey = String(b.imageKey || \"\").trim();\n  if (imageKey && !validImageKey(imageKey)) {\n    return json({ error: \"Bad image reference.\" }, 400);\n  }\n  const videoKey = String(b.videoKey || \"\").trim();\n  if (videoKey && !validVideoKey(videoKey)) {\n    return json({ error: \"Bad video reference.\" }, 400);\n  }\n  // Tags are free text from sellers: cap the count and length, drop the rest.\n  const tags = String(b.tags || \"\")\n    .split(\",\")\n    .map((t) => t.trim().toLowerCase().replace(/[^a-z0-9 +-]/g, \"\"))\n    .filter(Boolean)\n    .slice(0, 8)\n    .map((t) => t.slice(0, 28))\n    .join(\",\");\n\n  if (title.length < 3) {\n    return json({ error: \"Give the listing a title.\" }, 400);\n  }\n  if (!Number.isFinite(price) || price <= 0) {\n    return json({ error: \"Enter a price above zero.\" }, 400);\n  }\n  if (!validWaLink(waLink)) {\n    return json({\n      error:\n        \"Use a wa.me short link, an api.whatsapp.com link, or a full phone number.\",\n    }, 400);\n  }\n\n  await run(\n    `INSERT INTO ${T.listings}\n     (seller_id, seller_name, title, description, price, category, wa_link, image_key,\n      video_key, tags, active, created_at)\n     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?)`,\n    [\n      user.id,\n      user.name,\n      title,\n      description,\n      price,\n      category,\n      waLink,\n      imageKey || null,\n      videoKey || null,\n      tags || null,\n      new Date().toISOString(),\n    ],\n  );\n  return json({ success: true, prefill: buildWaUrl(waLink, \"test\").prefill });\n}\n\nasync function deleteListing(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  const id = Number((await readBody(req)).id);\n  const owned = await one(\n    `SELECT id FROM ${T.listings} WHERE id = ? AND (seller_id = ? OR ? = 1)`,\n    [id, user.id, isAdmin(user) ? 1 : 0],\n  );\n  if (!owned) return json({ error: \"That listing isn't yours.\" }, 403);\n  const img = await one(`SELECT image_key FROM ${T.listings} WHERE id = ?`, [\n    id,\n  ]);\n  await run(`UPDATE ${T.listings} SET active = 0 WHERE id = ?`, [id]);\n  if (img && img.image_key && validImageKey(String(img.image_key))) {\n    try {\n      const mod: any = await import(\"https://esm.town/v/std/blob\");\n      await mod.blob.delete(String(img.image_key));\n    } catch { /* orphaned blob is not worth failing the request over */ }\n  }\n  return json({ success: true });\n}\n\n/* ================================================================== */\n/* orders                                                             */\n/* ================================================================== */\n\nasync function createOrder(req: Request): Promise {\n  const b = await readBody(req);\n  const user = await currentUser(req);\n  // Enforced here, not just in the UI — the endpoint is reachable directly.\n  if (!user) return json({ error: \"Log in to place an order.\" }, 401);\n\n  let title: string, price: number, sellerName: string, waLink: string;\n  let listingId: number | null = null;\n  let sellerId: number | null = null;\n  let packageId: string | null = null;\n\n  if (b.listingId != null) {\n    const l = await one(\n      `SELECT id, title, price, seller_name, seller_id, wa_link FROM ${T.listings}\n        WHERE id = ? AND active = 1`,\n      [Number(b.listingId)],\n    );\n    if (!l) return json({ error: \"That listing is no longer available.\" }, 404);\n    listingId = Number(l.id);\n    sellerId = l.seller_id == null ? null : Number(l.seller_id);\n    title = String(l.title);\n    price = Number(l.price);\n    sellerName = String(l.seller_name);\n    waLink = String(l.wa_link);\n  } else {\n    const pkg = PACKAGES[String(b.packageId || \"\")];\n    if (!pkg) return json({ error: \"Unknown package.\" }, 400);\n    packageId = String(b.packageId);\n    title = pkg.title;\n    price = pkg.price;\n    sellerName = CONFIG.brand;\n    waLink = CONFIG.brandWa;\n  }\n\n  const sku = await insertOrder({\n    listingId,\n    packageId,\n    title,\n    price,\n    sellerName,\n    sellerId,\n    buyerName: String(user.name),\n    buyerEmail: String(user.email),\n  });\n\n  const message = orderMessage(sku, title, price);\n  const { url: waUrl, prefill } = buildWaUrl(waLink, message);\n\n  return json({\n    success: true,\n    sku,\n    waUrl,\n    message,\n    prefill,\n    product: { title, price, seller_name: sellerName },\n  });\n}\n\nasync function myOrders(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  return json({\n    orders: await q(\n      `SELECT sku, product_title, price, seller_name, status, created_at FROM ${T.orders}\n        WHERE buyer_email = ? ORDER BY id DESC LIMIT 100`,\n      [user.email],\n    ),\n  });\n}\n\nasync function sellerOrders(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  return json({\n    orders: await q(\n      `SELECT sku, product_title, price, buyer_name, status, created_at FROM ${T.orders}\n        WHERE seller_id = ? ORDER BY id DESC LIMIT 100`,\n      [user.id],\n    ),\n  });\n}\n\n/* ================================================================== */\n/* seller requests                                                    */\n/* ================================================================== */\n\nasync function requestSeller(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) {\n    return json({ error: \"Create an account first, then apply.\" }, 401);\n  }\n  if (canSell(user)) {\n    return json({ error: \"You can already publish listings.\" }, 400);\n  }\n\n  const note = String((await readBody(req)).note || \"\").trim().slice(0, 400);\n  const existing = await one(\n    `SELECT id FROM ${T.requests} WHERE user_id = ? AND status = 'pending'`,\n    [user.id],\n  );\n  if (!existing) {\n    await run(\n      `INSERT INTO ${T.requests} (user_id, name, email, note, status, created_at)\n       VALUES (?, ?, ?, ?, 'pending', ?)`,\n      [user.id, user.name, user.email, note, new Date().toISOString()],\n    );\n  }\n\n  const message = `Seller application - ${CONFIG.brand}\\n` +\n    `Name: ${user.name}\\n` +\n    `Email: ${user.email}\\n` +\n    `Account ID: ${user.id}` +\n    (note ? `\\nAbout: ${note}` : \"\") +\n    `\\n\\nPlease approve my seller access.`;\n\n  const { url: waUrl, prefill } = buildWaUrl(CONFIG.brandWa, message);\n  return json({\n    success: true,\n    waUrl,\n    message,\n    prefill,\n    alreadyPending: !!existing,\n  });\n}\n\nasync function pendingSellers(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n  return json({\n    requests: await q(\n      `SELECT r.id, r.user_id, r.name, r.email, r.note, r.status, r.created_at, u.role\n         FROM ${T.requests} r JOIN ${T.users} u ON u.id = r.user_id\n        ORDER BY (r.status = 'pending') DESC, r.id DESC LIMIT 200`,\n    ),\n  });\n}\n\nasync function approveSeller(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n\n  const b = await readBody(req);\n  const userId = Number(b.userId);\n  const target = await one(`SELECT id, email FROM ${T.users} WHERE id = ?`, [\n    userId,\n  ]);\n  if (!target) return json({ error: \"No such user.\" }, 404);\n  if (String(target.email).toLowerCase() === ADMIN_EMAIL) {\n    return json({ error: \"The admin account already has full access.\" }, 400);\n  }\n\n  await run(`UPDATE ${T.users} SET role = 'approved_seller' WHERE id = ?`, [\n    userId,\n  ]);\n  await run(\n    `UPDATE ${T.requests} SET status = 'approved', decided_at = ? WHERE user_id = ? AND status = 'pending'`,\n    [new Date().toISOString(), userId],\n  );\n  return json({ success: true });\n}\n\nasync function adminOrders(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n  const totals = await one(\n    `SELECT COUNT(*) AS n, COALESCE(SUM(price),0) AS value FROM ${T.orders}`,\n  );\n  return json({\n    totals,\n    orders: await q(\n      `SELECT sku, product_title, price, seller_name, buyer_name, buyer_email, status, created_at\n         FROM ${T.orders} ORDER BY id DESC LIMIT 200`,\n    ),\n  });\n}\n\n/* ================================================================== */\n/* frontend                                                           */\n/* ================================================================== */\n\nconst ORDER_STATUSES = [\"Pending\", \"Delivered\", \"Cancelled\"];\n\n/**\n * Who may move an order:\n *   admin  — any order, any status\n *   seller — orders on their own listings\n *   buyer  — may cancel their own order while it is still Pending\n */\nasync function setOrderStatus(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n\n  const b = await readBody(req);\n  const sku = String(b.sku || \"\").trim();\n  const status = String(b.status || \"\").trim();\n  if (!ORDER_STATUSES.includes(status)) {\n    return json({ error: \"Unknown status.\" }, 400);\n  }\n\n  const order = await one(\n    `SELECT sku, seller_id, buyer_email, status FROM ${T.orders} WHERE sku = ?`,\n    [sku],\n  );\n  if (!order) return json({ error: \"No order with that SKU.\" }, 404);\n\n  const admin = isAdmin(user);\n  const isSeller = order.seller_id != null &&\n    Number(order.seller_id) === Number(user.id);\n  const isBuyer = String(order.buyer_email || \"\") === String(user.email);\n\n  let allowed = false;\n  if (admin || isSeller) allowed = true;\n  else if (isBuyer && status === \"Cancelled\" && order.status === \"Pending\") {\n    allowed = true;\n  }\n  if (!allowed) return json({ error: \"You can't change this order.\" }, 403);\n\n  await run(`UPDATE ${T.orders} SET status = ?, updated_at = ? WHERE sku = ?`, [\n    status,\n    new Date().toISOString(),\n    sku,\n  ]);\n  return json({ success: true, sku, status });\n}\n\nasync function adminUsers(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n  return json({\n    users: await q(\n      `SELECT u.id, u.name, u.email, u.role, u.verified, u.banned, u.created_at,\n              (SELECT COUNT(*) FROM ${T.listings} l WHERE l.seller_id = u.id AND l.active = 1) AS listings,\n              (SELECT COUNT(*) FROM ${T.orders} o WHERE o.seller_id = u.id) AS sales\n         FROM ${T.users} u ORDER BY u.id DESC LIMIT 300`,\n    ),\n  });\n}\n\n/**\n * approve | revoke | ban | unban | verify\n * Banning also drops the user's sessions, so an open tab stops working on its\n * next request instead of staying live until the token is discarded.\n */\nasync function adminUserAction(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n\n  const b = await readBody(req);\n  const userId = Number(b.userId);\n  const action = String(b.action || \"\");\n  const target = await one(`SELECT id, email FROM ${T.users} WHERE id = ?`, [\n    userId,\n  ]);\n  if (!target) return json({ error: \"No such user.\" }, 404);\n  if (String(target.email).toLowerCase() === ADMIN_EMAIL) {\n    return json(\n      { error: \"The master account can't be changed from here.\" },\n      400,\n    );\n  }\n\n  const now = new Date().toISOString();\n  switch (action) {\n    case \"approve\":\n      await run(`UPDATE ${T.users} SET role = 'approved_seller' WHERE id = ?`, [\n        userId,\n      ]);\n      await run(\n        `UPDATE ${T.requests} SET status = 'approved', decided_at = ? WHERE user_id = ? AND status = 'pending'`,\n        [now, userId],\n      );\n      break;\n    case \"revoke\":\n      await run(`UPDATE ${T.users} SET role = 'buyer' WHERE id = ?`, [userId]);\n      await run(`UPDATE ${T.listings} SET active = 0 WHERE seller_id = ?`, [\n        userId,\n      ]);\n      await run(\n        `UPDATE ${T.requests} SET status = 'revoked', decided_at = ? WHERE user_id = ? AND status = 'approved'`,\n        [now, userId],\n      );\n      break;\n    case \"ban\":\n      await run(`UPDATE ${T.users} SET banned = 1 WHERE id = ?`, [userId]);\n      await run(`DELETE FROM ${T.sessions} WHERE user_id = ?`, [userId]);\n      break;\n    case \"unban\":\n      await run(`UPDATE ${T.users} SET banned = 0 WHERE id = ?`, [userId]);\n      break;\n    default:\n      return json({ error: \"Unknown action.\" }, 400);\n  }\n  return json({ success: true });\n}\n\n/**\n * Serves the hero clip from Val Town blob storage.\n * The listing API shape varies between SDK versions, so normalise whatever\n * comes back — array, iterable, or a wrapper object — before searching it.\n */\nlet heroKeyCache: string | null = null;\n\nasync function asArray(x: any): Promise {\n  if (!x) return [];\n  if (Array.isArray(x)) return x;\n  if (typeof x[Symbol.asyncIterator] === \"function\") {\n    const out: any[] = [];\n    for await (const i of x) out.push(i);\n    return out;\n  }\n  if (typeof x[Symbol.iterator] === \"function\") return Array.from(x);\n  for (const prop of [\"blobs\", \"items\", \"data\", \"keys\", \"results\"]) {\n    if (Array.isArray(x[prop])) return x[prop];\n  }\n  return [];\n}\n\nconst keyOf = (item: any): string =>\n  String(item?.key ?? item?.name ?? item?.path ?? item ?? \"\");\n\nasync function listBlobKeys(mod: any): Promise {\n  for (\n    const call of [\n      () => mod.blob.list(),\n      () => mod.blob.list(\"\"),\n      () => mod.blob.list(\"/\"),\n    ]\n  ) {\n    try {\n      const arr = await asArray(await call());\n      const keys = arr.map(keyOf).filter(Boolean);\n      if (keys.length) return keys;\n    } catch { /* try the next shape */ }\n  }\n  return [];\n}\n\nasync function resolveHeroKey(mod: any): Promise {\n  if (heroKeyCache) return heroKeyCache;\n\n  const preferred = Deno.env.get(\"HERO_VIDEO_KEY\") || \"hero.mp4\";\n  try {\n    const probe = await mod.blob.get(preferred);\n    if (probe && probe.ok) return (heroKeyCache = preferred);\n  } catch { /* fall through */ }\n\n  const keys = await listBlobKeys(mod);\n  // Exact match first (in case the env value differs only by case), then any video.\n  const exact = keys.find((k) => k.toLowerCase() === preferred.toLowerCase());\n  if (exact) return (heroKeyCache = exact);\n  const vid = keys.find((k) => /\\.(mp4|webm|mov|m4v)$/i.test(k));\n  if (vid) return (heroKeyCache = vid);\n  return null;\n}\n\nasync function heroVideo(): Promise {\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/blob\");\n    const key = await resolveHeroKey(mod);\n    if (!key) {\n      const keys = await listBlobKeys(mod);\n      return json({\n        error: \"No video found in blob storage.\",\n        keysSeen: keys.slice(0, 20),\n      }, 404);\n    }\n    const res = await mod.blob.get(key);\n    if (!res || !res.ok || !res.body) {\n      heroKeyCache = null;\n      return json({ error: \"Blob could not be read.\", key }, 404);\n    }\n    return new Response(res.body, {\n      headers: {\n        \"content-type\": /\\.webm$/i.test(key) ? \"video/webm\" : \"video/mp4\",\n        \"cache-control\": \"public, max-age=86400\",\n      },\n    });\n  } catch (err: any) {\n    return json({\n      error: \"Blob storage unavailable\",\n      detail: String(err?.message || err),\n    }, 500);\n  }\n}\n\n/* ================================================================== */\n/* listing images (Val Town blob storage)                             */\n/* ================================================================== */\n\nconst MAX_IMAGE_BYTES = 1_500_000;\n\n/** Keys are generated here, never by the client — this is what stops\n *  /media/img/hero.mp4 or any other blob from being read through this route. */\nfunction newImageKey(): string {\n  return `listing-img-${randomHex(10)}.jpg`;\n}\nfunction validImageKey(key: string): boolean {\n  return /^listing-img-[a-f0-9]{20}\\.jpg$/.test(key);\n}\n\nasync function uploadImage(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  if (!canSell(user)) {\n    return json({ error: \"Only approved sellers can upload images.\" }, 403);\n  }\n\n  const dataUrl = String((await readBody(req)).dataUrl || \"\");\n  const match = dataUrl.match(\n    /^data:image\\/(jpeg|png|webp);base64,([A-Za-z0-9+/=]+)$/,\n  );\n  if (!match) return json({ error: \"Send a JPEG, PNG or WebP image.\" }, 400);\n\n  let bytes: Uint8Array;\n  try {\n    const bin = atob(match[2]);\n    bytes = new Uint8Array(bin.length);\n    for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);\n  } catch {\n    return json({ error: \"That image could not be decoded.\" }, 400);\n  }\n  if (bytes.length > MAX_IMAGE_BYTES) {\n    return json({ error: \"Image is too large. Keep it under 1.5 MB.\" }, 413);\n  }\n\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/blob\");\n    const key = newImageKey();\n    await mod.blob.set(key, bytes);\n    return json({ success: true, key, bytes: bytes.length });\n  } catch (err: any) {\n    return json(\n      { error: \"Upload failed\", detail: String(err?.message || err) },\n      500,\n    );\n  }\n}\n\nasync function listingImage(path: string): Promise {\n  const key = decodeURIComponent(path.slice(\"/media/img/\".length));\n  if (!validImageKey(key)) return json({ error: \"Not found\" }, 404);\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/blob\");\n    const res = await mod.blob.get(key);\n    if (!res || !res.ok || !res.body) return json({ error: \"Not found\" }, 404);\n    return new Response(res.body, {\n      headers: {\n        \"content-type\": \"image/jpeg\",\n        // Keys are unique per upload, so this can cache forever.\n        \"cache-control\": \"public, max-age=31536000, immutable\",\n      },\n    });\n  } catch {\n    return json({ error: \"Not found\" }, 404);\n  }\n}\n\n/** Public counters, read straight from the tables. Nothing estimated. */\nasync function publicStats(): Promise {\n  const delivered = await one(\n    `SELECT COUNT(*) AS n FROM ${T.orders} WHERE status = 'Delivered'`,\n  );\n  const sellers = await one(\n    `SELECT COUNT(*) AS n FROM ${T.users} WHERE role = 'approved_seller' AND banned = 0`,\n  );\n  const listings = await one(\n    `SELECT COUNT(*) AS n FROM ${T.listings} WHERE active = 1`,\n  );\n  return json({\n    stats: {\n      delivered: Number(delivered?.n || 0),\n      sellers: Number(sellers?.n || 0),\n      listings: Number(listings?.n || 0),\n      refillDays: 90,\n    },\n  });\n}\n\n/** Temporary diagnostic: shows exactly what blob storage returns. Remove once\n *  the hero video is confirmed working. */\nasync function blobDebug(): Promise {\n  const report: Record = {};\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/blob\");\n    report.moduleKeys = Object.keys(mod || {});\n    report.blobMethods = mod?.blob ? Object.keys(mod.blob) : \"no blob export\";\n    try {\n      const items = await mod.blob.list();\n      report.listType = Array.isArray(items) ? \"array\" : typeof items;\n      report.listRaw = JSON.stringify(items).slice(0, 600);\n    } catch (e: any) {\n      report.listError = String(e?.message || e).slice(0, 300);\n    }\n    try {\n      const r = await mod.blob.get(\"hero.mp4\");\n      report.getHero = r ? { ok: r.ok, status: r.status } : \"null\";\n    } catch (e: any) {\n      report.getHeroError = String(e?.message || e).slice(0, 200);\n    }\n  } catch (e: any) {\n    report.importError = String(e?.message || e).slice(0, 300);\n  }\n  return json(report);\n}\n\n/**\n * Admin-only hero video upload. Takes the raw file body (no base64, which\n * would inflate it by a third) and writes it through std/blob — the same\n * store the serving route reads, which the val-scoped Blob UI is not.\n */\nasync function uploadHeroVideo(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n\n  const buf = await req.arrayBuffer();\n  if (!buf.byteLength) return json({ error: \"Empty upload.\" }, 400);\n  if (buf.byteLength > 12_000_000) {\n    return json({ error: \"Too large. Compress the clip to under 12 MB.\" }, 413);\n  }\n\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/blob\");\n    await mod.blob.set(\"hero.mp4\", new Uint8Array(buf));\n    heroKeyCache = \"hero.mp4\";\n    return json({ success: true, bytes: buf.byteLength });\n  } catch (err: any) {\n    return json(\n      { error: \"Upload failed\", detail: String(err?.message || err) },\n      500,\n    );\n  }\n}\n\n/* ================================================================== */\n/* listing videos                                                     */\n/* ================================================================== */\n\nconst MAX_LISTING_VIDEO_BYTES = 12_000_000;\n\nfunction newVideoKey(): string {\n  return `listing-vid-${randomHex(10)}.mp4`;\n}\nfunction validVideoKey(key: string): boolean {\n  return /^listing-vid-[a-f0-9]{20}\\.mp4$/.test(key);\n}\n\n/** Raw body upload — base64 would add a third to an already large file. */\nasync function uploadListingVideo(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  if (!canSell(user)) {\n    return json({ error: \"Only approved sellers can upload video.\" }, 403);\n  }\n\n  const buf = await req.arrayBuffer();\n  if (!buf.byteLength) return json({ error: \"Empty upload.\" }, 400);\n  if (buf.byteLength > MAX_LISTING_VIDEO_BYTES) {\n    return json({ error: \"Video too large. Keep it under 12 MB.\" }, 413);\n  }\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/blob\");\n    const key = newVideoKey();\n    await mod.blob.set(key, new Uint8Array(buf));\n    return json({ success: true, key, bytes: buf.byteLength });\n  } catch (err: any) {\n    return json(\n      { error: \"Upload failed\", detail: String(err?.message || err) },\n      500,\n    );\n  }\n}\n\nasync function listingVideo(path: string): Promise {\n  const key = decodeURIComponent(path.slice(\"/media/vid/\".length));\n  if (!validVideoKey(key)) return json({ error: \"Not found\" }, 404);\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/blob\");\n    const res = await mod.blob.get(key);\n    if (!res || !res.ok || !res.body) return json({ error: \"Not found\" }, 404);\n    return new Response(res.body, {\n      headers: {\n        \"content-type\": \"video/mp4\",\n        \"cache-control\": \"public, max-age=31536000, immutable\",\n      },\n    });\n  } catch {\n    return json({ error: \"Not found\" }, 404);\n  }\n}","theagentsyt",[],[69],["D",1789293468982],[],[19],"49c17bf8-dd10-4afa-aff7-a6e807ffe5a4",["D",1789198617445],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","userId","47eaf13b-b72f-4418-ae2f-ebe9fff309ae","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0783d-81e8-754f-ad5a-c8c2fb0c005f","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_137":133},"org",{"_11":12,"_130":131,"_132":133,"_92":93,"_134":135,"_136":52},"branch",{"_17":41,"_13":16,"_33":39,"_122":82,"_123":-5,"_124":-5,"_125":-5,"_126":-5,"_127":-5,"_128":14,"_129":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Rayan Bhatti","avatar","https://lh3.googleusercontent.com/a/ACg8ocLHYtPrlNBVkdnNY7c7Sp49jHoTN9_El-TKpOlHxwIPQn6Saw=s96-c","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":82,"_13":14,"_44":178,"_84":-5,"_85":52,"_86":87,"_88":87,"_89":90,"_91":-5,"_92":93,"_94":70,"_95":43,"_96":-5,"_97":-5,"_98":99,"_100":101,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":107,"_108":107,"_109":110,"_111":110,"_112":110,"_113":107,"_114":107,"_115":179,"_117":180,"_119":181,"_121":52},[169,170,171],"files",[169,170,171],"counts",{"_158":99,"_159":160,"_161":99,"_32":162,"_163":164},[],{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_18":157},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},[19],"pulls","branches",1,"forks",{"_165":167,"_168":99},"connections",{"_165":99,"_166":99},"count","unfilledCount",3,"emptyCount",{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":79,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_65":176,"_18":177},{"_33":68,"_13":69,"_35":70,"_37":-5,"_38":39,"_40":71,"_42":43,"_44":72,"_17":73,"_47":74,"_49":75,"_51":52,"_53":76,"_65":174,"_18":175},{"_33":58,"_13":59,"_35":60,"_37":-5,"_38":39,"_40":61,"_42":43,"_44":62,"_17":63,"_47":48,"_49":64,"_51":52,"_53":-5,"_65":172,"_18":173},[],[59],[],[69],[],[19],["D",1789198617445],{"_11":12,"_137":133},{"_11":12,"_130":131,"_132":133,"_92":93,"_134":135,"_136":52},{"_17":41,"_13":16,"_33":39,"_122":82,"_123":-5,"_124":-5,"_125":-5,"_126":-5,"_127":-5,"_128":14,"_129":12},"ctx",{"_115":-5,"_154":215,"_216":217,"_218":219,"_220":52,"_221":52,"_222":52,"_223":43,"_224":-5,"_225":-7,"_226":-7,"_227":99,"_228":52,"_229":52,"_230":-5,"_231":52,"_232":52,"_233":52,"_234":-5},"ENV",{"_186":187,"_188":189,"_190":16,"_191":192,"_193":194,"_195":196,"_197":198,"_199":200,"_201":202,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":214},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

'+esc(s.name)+'

'+esc(p.title)+'

\nGrow Your YouTube Channel Faster.\n

Services built for channels

Pricing that scales with the channel

Marketplace

How an order actually works

Pick a package

Get your SKU

Confirm on WhatsApp

Track it here

Questions before you order

My orders

Seller panel

New listing

Your listings

Orders on your packages

Admin dashboard

Seller applications

Hero video

Users

All orders

Log in

Apply to sell

Your order is on record

\nGrow Your YouTube
Channel Faster.\n