cl-triage

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_262":263,"_264":265},"routes/_app.x.$handle.$name",{"_99":98,"_31":44,"_107":89,"_26":52,"_13":14,"_108":-5,"_11":109,"_110":111,"_112":113,"_114":115,"_116":117,"_20":-5,"_118":-5,"_119":-5,"_120":24,"_121":122,"_123":58,"_124":-5,"_125":-5,"_126":127},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_31":44,"_37":45,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":24},"version",11,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_23":24},"previous","deleted",false,"deletedHere","path","lib/sign.ts","latestPath","fileId","e83bfcf6-ace8-11f1-8265-1607ee4eb77e","name","sign.ts","fileType","script","content","/**\n * HMAC-SHA256 over `|`, hex encoded, via Web Crypto (available in Deno and\n * on Val Town). The token is the only authentication the feedback endpoint has: the val is\n * public and the links go out in email, so the secret must never appear in source.\n */\n\nexport type FeedbackKind = \"nope\" | \"yes\";\n\nasync function hmacHex(secret: string, msg: string): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const sig = await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(msg));\n return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport function sign(secret: string, uuid: string, kind: FeedbackKind | string): Promise {\n return hmacHex(secret, `${uuid}|${kind}`);\n}\n\nexport async function verify(\n secret: string,\n uuid: string,\n kind: string,\n token: string | null | undefined,\n): Promise {\n if (!token) return false;\n const expected = await sign(secret, uuid, kind);\n if (token.length !== expected.length) return false;\n // Constant time over the hex string.\n let diff = 0;\n for (let i = 0; i < expected.length; i++) diff |= expected.charCodeAt(i) ^ token.charCodeAt(i);\n return diff === 0;\n}\n","createdAt",["D",1789025175351],"branchVersion","branchId","19036aae-467e-44f0-962d-88964ddc5361","id","c358f270-b3fc-477f-a942-c58f7915cb3d","cl-triage",["D",1789025029995],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","019bcf70-5321-758b-8dfa-2be50f1fc9fb","pinnedFileId","e7e3fae2-ace8-11f1-8828-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019bcf70-5321-758b-8dfa-2ea07f250c13","tursoName","c358f270b3fc477fa942c58f7915cb3d","tursoHostname","c358f270b3fc477fa942c58f7915cb3d-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789459281818],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_106":102},"org",{"_99":98,"_100":-5,"_101":102,"_18":54,"_103":104,"_105":24},"branch",{"_13":88,"_31":89,"_42":41,"_90":43,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":44,"_97":98},"isOwned",62,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","herschelrs","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18zOFBxeE4yTklpRW16aUxzZzlSaTZRa3BWN0wifQ","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_42":43,"_31":44,"_37":257,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":258,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":259,"_83":260,"_85":261,"_87":24},"tree",[191,197,198,199,200,201],"files",[191,192,193,194,195,196,197,198,199,200,201],"counts",{"_181":62,"_182":177,"_183":62,"_184":185,"_186":187},"contents",[128,129,130,131,132,133],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_42":174,"_31":175,"_29":176,"_137":-5,"_40":41,"_39":177,"_139":58,"_37":178,"_13":62,"_33":179,"_35":-5,"_23":24,"_143":-5,"_26":180},{"_42":167,"_31":168,"_29":169,"_137":-5,"_40":41,"_39":170,"_139":58,"_37":171,"_13":62,"_33":20,"_35":172,"_23":24,"_143":-5,"_26":173},{"_42":160,"_31":161,"_29":162,"_137":-5,"_40":41,"_39":163,"_139":24,"_37":164,"_13":62,"_33":20,"_35":165,"_23":24,"_143":-5,"_26":166},{"_42":153,"_31":154,"_29":56,"_137":-5,"_40":41,"_39":155,"_139":24,"_37":156,"_13":62,"_33":157,"_35":158,"_23":24,"_143":-5,"_26":159},{"_42":145,"_31":146,"_29":147,"_137":-5,"_40":41,"_39":148,"_139":24,"_37":149,"_13":62,"_33":150,"_35":151,"_23":24,"_143":-5,"_26":152},{"_42":134,"_31":135,"_29":136,"_137":-5,"_40":41,"_39":138,"_139":24,"_37":140,"_13":62,"_33":141,"_35":142,"_23":24,"_143":-5,"_26":144},"288768d8-c3ec-4fe2-a76c-e17329f1b652","judge.cron.tsx","e81164fa-ace8-11f1-b8ae-1607ee4eb77e","parentId",7,"latest",["D",1789025174988],"interval","/**\n * [2] The judge. Drains the queue the email handler filled.\n *\n * Budget: Val Town's free tier kills a run at 60 s, and *repeated* overruns temporarily pause\n * the val — so this keeps a 40 s deadline of its own, stops picking up posts once it is past,\n * and never takes more than MAX_POSTS in one run. Every outbound fetch carries its own\n * AbortSignal.timeout.\n *\n * Per post: one sapi detail call, the dedup ladder, then (only if it is genuinely new) up to\n * five images and exactly one LLM call. Good verdicts from one run go out as a single email.\n */\nimport {\n BlockedError,\n bodyText,\n fetchDetail,\n fetchImageBase64,\n imageUrl,\n resolveUuid,\n} from \"./lib/cl.ts\";\nimport * as db from \"./lib/db.ts\";\nimport { type DedupRow, findDuplicate, imageIdentity } from \"./lib/dedup.ts\";\nimport {\n buildSystem,\n buildUserText,\n criteriaFor,\n DEFAULT_MODEL,\n judge,\n loadCriteria,\n type Verdict,\n} from \"./lib/llm.ts\";\nimport { type DigestItem, feedbackLink, sendDigest } from \"./lib/mail.ts\";\nimport { sign } from \"./lib/sign.ts\";\n\nconst MAX_POSTS = 4;\nconst RUN_DEADLINE_MS = 40_000;\nconst MAX_IMAGES = 5;\nconst NOPE_EXAMPLES = 10;\nconst YES_EXAMPLES = 5;\n\nexport default async function (): Promise {\n const started = Date.now();\n const left = () => RUN_DEADLINE_MS - (Date.now() - started);\n\n await db.init();\n const queue = await db.listQueued(MAX_POSTS);\n console.log(\"RUN\", JSON.stringify({ queued: queue.length, max: MAX_POSTS }));\n if (!queue.length) return;\n\n const apiKey = Deno.env.get(\"ANTHROPIC_API_KEY\") ?? \"\";\n const dryRun = !apiKey;\n const sendInDryRun = Deno.env.get(\"SEND_IN_DRY_RUN\") === \"1\";\n const model = Deno.env.get(\"JUDGE_MODEL\") || DEFAULT_MODEL;\n const criteria = loadCriteria(Deno.env.get(\"CRITERIA_JSON\"));\n if (!Deno.env.get(\"CRITERIA_JSON\")) console.log(\"CRITERIA_JSON unset — built-in default only\");\n if (dryRun) console.log(\"DRY_RUN: ANTHROPIC_API_KEY unset, no LLM call will be made\");\n\n const digest: DigestItem[] = [];\n\n for (const row of queue) {\n if (left() <= 8000) {\n console.log(\"DEADLINE\", JSON.stringify({ msLeft: left(), stoppedBefore: row.uuid }));\n break;\n }\n try {\n const item = await handleOne(row, { apiKey, dryRun, sendInDryRun, model, criteria });\n if (item) digest.push(item);\n } catch (err) {\n if (err instanceof BlockedError) {\n // Craigslist blocked us. Stop the run. Do not retry and do not change egress:\n // evading a block is the fact that turns scraping into a legal problem.\n console.error(\"BLOCKED_BY_CL\", JSON.stringify({ blockID: err.blockID, url: err.url }));\n await db.updatePost(String(row.uuid), {\n status: \"blocked_by_cl\",\n reason: `blockID=${err.blockID}`,\n });\n break;\n }\n console.error(\"POST_ERROR\", String(row.uuid), String(err));\n await db.updatePost(String(row.uuid), {\n status: \"error\",\n reason: String(err).slice(0, 200),\n });\n }\n }\n\n if (digest.length) {\n await sendDigest(digest);\n for (const it of digest) await db.updatePost(it.uuid, { emailed_at: db.now() });\n console.log(\n \"EMAILED\",\n JSON.stringify({ count: digest.length, uuids: digest.map((d) => d.uuid) }),\n );\n }\n console.log(\"DONE\", JSON.stringify({ ms: Date.now() - started, emailed: digest.length }));\n}\n\ninterface Cfg {\n apiKey: string;\n dryRun: boolean;\n sendInDryRun: boolean;\n model: string;\n criteria: ReturnType;\n}\n\nasync function handleOne(row: db.Row, cfg: Cfg): Promise {\n let uuid = String(row.uuid);\n const search = String(row.search ?? \"\");\n\n // Legacy pid-only rows: the old numeric URL 301s to the /view/d// form, which\n // is the only pid -> uuid oracle there is (the uuid is a random 128-bit token).\n if (uuid.startsWith(\"pid:\")) {\n const res = await resolveUuid(String(row.url), 10_000);\n if (res.status === 404) {\n await db.updatePost(uuid, { status: \"gone\", judged_at: db.now() });\n console.log(\"GONE\", JSON.stringify({ key: uuid, via: \"legacy-404\" }));\n return null;\n }\n if (!res.uuid) throw new Error(`no uuid from redirect (status ${res.status})`);\n const existing = await db.getPost(res.uuid);\n if (existing) {\n await db.updatePost(uuid, {\n status: \"dup\",\n dup_of: res.uuid,\n verdict: existing.verdict,\n score: existing.score,\n reason: existing.reason,\n judged_at: db.now(),\n });\n console.log(\"DUP\", JSON.stringify({ key: uuid, dupOf: res.uuid, rule: \"resolved-uuid\" }));\n return null;\n }\n await db.renameUuid(uuid, res.uuid);\n console.log(\"RESOLVED\", JSON.stringify({ from: uuid, to: res.uuid }));\n uuid = res.uuid;\n }\n\n const { status, item } = await fetchDetail(uuid, 10_000);\n if (status === 404 || !item) {\n if (status === 404) {\n await db.updatePost(uuid, { status: \"gone\", judged_at: db.now() });\n console.log(\"GONE\", JSON.stringify({ uuid }));\n return null;\n }\n throw new Error(`sapi status ${status}`);\n }\n if (item.notices?.length) {\n console.log(\"NOTICES\", JSON.stringify({ uuid, notices: item.notices }));\n }\n\n const images = item.images ?? [];\n const lat = item.location?.lat ?? null;\n const lon = item.location?.lon ?? null;\n const hood = item.location?.neighborhood || (row.hood === null ? null : String(row.hood));\n\n await db.updatePost(uuid, {\n pid: item.postingId ?? null,\n repost_of: item.repostOf ?? null,\n title: item.title ?? String(row.title ?? \"\"),\n price: item.price ?? (row.price === null ? null : Number(row.price)),\n hood,\n lat,\n lon,\n image_ids: images.join(\",\"),\n record_created: item.recordCreated ?? null,\n url: item.url ?? String(row.url ?? \"\"),\n status: \"fetched\",\n });\n\n // Anything he has already said no to, in any of its forms.\n const blockKeys = [\n `pid:${item.postingId}`,\n ...(item.repostOf ? [`pid:${item.repostOf}`] : []),\n ...images.map((i) => `img:${imageIdentity(i)}`),\n ];\n const blockedBy = await db.isBlocked(blockKeys);\n if (blockedBy) {\n await db.updatePost(uuid, {\n status: \"rejected\",\n verdict: \"bad\",\n score: 0,\n reason: `blocked by earlier nope (${blockedBy})`,\n judged_at: db.now(),\n });\n console.log(\"BLOCKED\", JSON.stringify({ uuid, key: blockedBy }));\n return null;\n }\n\n const cand: DedupRow = {\n uuid,\n pid: item.postingId ?? null,\n repostOf: item.repostOf ?? null,\n imageIds: images,\n title: item.title ?? \"\",\n price: item.price ?? null,\n lat,\n lon,\n };\n const known = (await db.dedupRows()).map(toDedupRow);\n const dup = findDuplicate(cand, known);\n if (dup) {\n const orig = await db.getPost(dup.uuid);\n await db.updatePost(uuid, {\n status: \"dup\",\n dup_of: dup.uuid,\n verdict: orig?.verdict ?? null,\n score: orig?.score ?? null,\n reason: `duplicate of ${dup.uuid} (${dup.rule})`,\n judged_at: db.now(),\n });\n console.log(\"DUP\", JSON.stringify({ uuid, dupOf: dup.uuid, rule: dup.rule }));\n return null;\n }\n\n // Only now, for a post we have never judged, do we spend images and a model call.\n const picked = images.slice(0, MAX_IMAGES);\n const fetched: { mediaType: string; data: string }[] = [];\n for (const raw of picked) {\n const img = await fetchImageBase64(raw, \"600x450\", 10_000);\n if (img) fetched.push(img);\n }\n\n const { prompt, fellBack } = criteriaFor(cfg.criteria, search);\n if (fellBack) console.log(\"CRITERIA_FALLBACK\", JSON.stringify({ search, uuid }));\n const nopes = await db.feedbackExamples(search, \"nope\", NOPE_EXAMPLES);\n const yeses = await db.feedbackExamples(search, \"yes\", YES_EXAMPLES);\n const system = buildSystem(prompt, nopes, yeses);\n const userText = buildUserText({\n title: item.title ?? \"\",\n priceString: item.priceString ?? null,\n hood,\n body: bodyText(item.body),\n attributes: (item.attributes ?? []).map((a) => `${a.label ?? \"\"}: ${a.value ?? \"\"}`),\n category: item.category ?? null,\n postedIso: iso(item.postedDate),\n createdIso: iso(item.recordCreated),\n search,\n });\n\n let verdict: Verdict;\n if (cfg.dryRun) {\n const promptLen = system.length + userText.length;\n verdict = {\n verdict: \"meh\",\n score: 0,\n reason: `DRY_RUN: no ANTHROPIC_API_KEY (prompt ${promptLen} chars, ${fetched.length} images)`,\n flags: [\"dry\"],\n };\n await db.updatePost(uuid, {\n status: \"judged\",\n verdict: \"dry\",\n score: 0,\n reason: verdict.reason,\n flags: \"dry\",\n prompt_len: promptLen,\n judged_at: db.now(),\n });\n console.log(\n \"DRY\",\n JSON.stringify({ uuid, promptLen, images: fetched.length, title: item.title }),\n );\n if (!cfg.sendInDryRun) return null;\n } else {\n verdict = await judge({\n apiKey: cfg.apiKey,\n model: cfg.model,\n system,\n userText,\n images: fetched,\n timeoutMs: 30_000,\n });\n await db.updatePost(uuid, {\n status: \"judged\",\n verdict: verdict.verdict,\n score: verdict.score,\n reason: verdict.reason,\n flags: verdict.flags.join(\",\"),\n prompt_len: system.length + userText.length,\n judged_at: db.now(),\n });\n console.log(\n \"JUDGED\",\n JSON.stringify({\n uuid,\n verdict: verdict.verdict,\n score: verdict.score,\n images: fetched.length,\n title: item.title,\n }),\n );\n if (verdict.verdict !== \"good\") return null;\n }\n\n return await digestItem(uuid, item, hood, verdict, picked[0] ?? null);\n}\n\nasync function digestItem(\n uuid: string,\n item: { title?: string; priceString?: string; url?: string },\n hood: string | null,\n verdict: Verdict,\n firstImage: string | null,\n): Promise {\n const secret = Deno.env.get(\"FEEDBACK_SECRET\") ?? \"\";\n const base = feedbackBase();\n let nopeUrl: string | null = null;\n let yesUrl: string | null = null;\n if (secret && base) {\n nopeUrl = feedbackLink(base, uuid, \"nope\", await sign(secret, uuid, \"nope\"));\n yesUrl = feedbackLink(base, uuid, \"yes\", await sign(secret, uuid, \"yes\"));\n } else {\n console.log(\"NO_FEEDBACK_LINKS\", JSON.stringify({ hasSecret: !!secret, base }));\n }\n return {\n uuid,\n title: item.title ?? \"\",\n priceString: item.priceString ?? null,\n hood,\n score: verdict.score,\n reason: verdict.reason,\n flags: verdict.flags,\n url: item.url ?? `https://www.craigslist.org/view/d/x/${uuid}`,\n imageUrl: firstImage ? imageUrl(firstImage, \"600x450\") : null,\n nopeUrl,\n yesUrl,\n };\n}\n\n/**\n * The feedback endpoint's own URL. Val Town exposes the val's public HTTP origin to the\n * runtime; FEEDBACK_URL overrides it. If neither resolves, the digest still goes out, just\n * without buttons — see the NO_FEEDBACK_LINKS log line.\n */\nfunction feedbackBase(): string | null {\n const explicit = Deno.env.get(\"FEEDBACK_URL\");\n if (explicit) return explicit;\n const origin = Deno.env.get(\"VAL_URL\");\n return origin ? origin.replace(/\\/$/, \"\") : null;\n}\n\nfunction iso(epoch: number | undefined): string | null {\n return epoch ? new Date(epoch * 1000).toISOString().slice(0, 16).replace(\"T\", \" \") : null;\n}\n\nfunction toDedupRow(r: db.Row): DedupRow {\n return {\n uuid: String(r.uuid),\n pid: r.pid === null ? null : Number(r.pid),\n repostOf: r.repost_of === null ? null : Number(r.repost_of),\n imageIds: String(r.image_ids ?? \"\").split(\",\").filter(Boolean),\n title: String(r.title ?? \"\"),\n price: r.price === null ? null : Number(r.price),\n lat: r.lat === null ? null : Number(r.lat),\n lon: r.lon === null ? null : Number(r.lon),\n };\n}\n","label",[135],"d0e8b395-610f-42c0-8f2a-172464de03d1","inbox.email.tsx","e7fd2184-ace8-11f1-8bd6-1607ee4eb77e",5,["D",1789025174920],"email","/**\n * [1] Email trigger. Parses a Craigslist saved-search alert, does the cheap dedup that needs\n * no network, enqueues the survivors and returns. It must stay fast: judging inline would\n * put a 60-second hard cap between us and a val that gets temporarily paused for overrunning.\n *\n * Anyone can send mail to this address and the val is public, so the sender is checked here.\n */\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { parseAlert, parseSubject, resultKey } from \"./lib/parse.ts\";\nimport * as db from \"./lib/db.ts\";\n\nconst ALERTS_FROM = \"alerts@alerts.craigslist.org\";\n\ninterface Email {\n from: string;\n to: string[];\n cc?: string | string[];\n bcc?: string | string[];\n subject?: string;\n text?: string;\n html?: string;\n attachments?: File[];\n headers?: Record;\n}\n\n/** \"craigslist \" -> \"alerts@alerts.craigslist.org\" */\nfunction addrOf(s: string | undefined): string {\n if (!s) return \"\";\n const m = s.match(/<([^>]+)>/);\n return (m ? m[1] : s).trim().toLowerCase();\n}\n\nexport default async function (e: Email): Promise {\n const from = addrOf(e.from);\n const senderMatches = from === ALERTS_FROM;\n\n // Gmail filter-forwarding normally preserves the original From. If it ever wraps instead,\n // the original address survives in the forwarded headers or in the body text.\n const inHeaders = Object.values(e.headers ?? {}).some((v) =>\n String(v).toLowerCase().includes(ALERTS_FROM)\n );\n const inBody = `${e.text ?? \"\"}${e.html ?? \"\"}`.toLowerCase().includes(ALERTS_FROM);\n\n const sub = parseSubject(e.subject);\n const alert = parseAlert(e.subject, e.text, e.html);\n const looksLikeAlert = sub !== null && alert.results.length > 0;\n\n // A body mention alone is not enough: anyone can type that address into an email. It has to\n // parse as a real alert as well.\n const accept = senderMatches ? true : ((inHeaders || inBody) && looksLikeAlert);\n\n if (!accept) {\n const record = {\n at: new Date().toISOString(),\n from: e.from ?? \"\",\n subject: e.subject ?? \"\",\n text: (e.text ?? \"\").slice(0, 2000),\n };\n // Gmail's forwarding-verification code lands here; read it with blob.getJSON.\n await blob.setJSON(\"last-other-email\", record);\n console.log(\"OTHER_EMAIL\", JSON.stringify({ from: record.from, subject: record.subject }));\n return;\n }\n\n if (!looksLikeAlert) {\n await blob.setJSON(\"last-unparsed-alert\", {\n at: new Date().toISOString(),\n subject: e.subject ?? \"\",\n text: (e.text ?? \"\").slice(0, 2000),\n });\n console.log(\"ALERT_PARSE_EMPTY\", JSON.stringify({ subject: e.subject ?? \"\" }));\n return;\n }\n\n await db.init();\n let queued = 0;\n const skipped: string[] = [];\n\n for (const r of alert.results) {\n const key = resultKey(r);\n const reason = await skipReason(key, r.pid, r.thumbImgId);\n if (reason) {\n skipped.push(`${key}:${reason}`);\n continue;\n }\n await db.insertQueued({\n uuid: key,\n pid: r.pid,\n search: alert.search,\n title: r.title,\n price: r.price,\n hood: r.hood,\n thumbImgId: r.thumbImgId,\n url: r.url,\n });\n queued++;\n }\n\n console.log(\n \"ALERT\",\n JSON.stringify({\n search: alert.search,\n claimed: alert.count,\n parsed: alert.results.length,\n queued,\n skipped,\n }),\n );\n}\n\n/** Everything here is local to SQLite — no craigslist request is made before the cron runs. */\nasync function skipReason(\n key: string,\n pid: number | null,\n thumbImgId: string | null,\n): Promise {\n if (await db.getPost(key)) return \"known\";\n if (pid !== null) {\n if (await db.existsPid(pid)) return \"pid-known\";\n if (await db.isBlocked([`pid:${pid}`])) return \"pid-blocked\";\n }\n if (thumbImgId) {\n if (await db.isBlocked([`img:${thumbImgId}`])) return \"img-blocked\";\n if (await db.existsImage(thumbImgId)) return \"img-known\";\n }\n return null;\n}\n",[146],"52088f85-8b11-4768-96af-395c64402f80","feedback.http.tsx",2,["D",1789025174785],"http","/**\n * [3] The nope / more-like-this buttons in the digest.\n *\n * GET ?u=&v=nope|yes&t=\n * POST same query string plus a form field `reason`\n *\n * The token is the only authentication: the val is public and these links travel by email.\n * Everything is idempotent — mail clients prefetch links, and he may click twice.\n */\nimport * as db from \"./lib/db.ts\";\nimport { imageIdentity } from \"./lib/dedup.ts\";\nimport { verify } from \"./lib/sign.ts\";\n\nexport default async function (req: Request): Promise {\n const secret = Deno.env.get(\"FEEDBACK_SECRET\");\n if (!secret) {\n return new Response(\"feedback is not configured: FEEDBACK_SECRET is unset\\n\", {\n status: 503,\n headers: { \"content-type\": \"text/plain; charset=utf-8\" },\n });\n }\n\n const url = new URL(req.url);\n const uuid = url.searchParams.get(\"u\") ?? \"\";\n const kind = url.searchParams.get(\"v\") ?? \"\";\n const token = url.searchParams.get(\"t\");\n\n if (!uuid || (kind !== \"nope\" && kind !== \"yes\") || !(await verify(secret, uuid, kind, token))) {\n return new Response(\"403 — bad or missing token\\n\", {\n status: 403,\n headers: { \"content-type\": \"text/plain; charset=utf-8\" },\n });\n }\n\n await db.init();\n const post = await db.getPost(uuid);\n if (!post) return page(\"Unknown post.\", null, 404);\n\n if (req.method === \"POST\") {\n const form = await req.formData();\n const reason = String(form.get(\"reason\") ?? \"\").slice(0, 300).trim();\n if (reason) {\n await db.setFeedbackReason(uuid, kind, reason);\n console.log(\"FEEDBACK_REASON\", JSON.stringify({ uuid, kind, reason }));\n }\n return page(\"Noted. Thanks.\", null, 200);\n }\n\n const title = String(post.title ?? uuid);\n\n if (kind === \"nope\") {\n const keys = [\n ...(post.pid ? [`pid:${Number(post.pid)}`] : []),\n ...(post.repost_of ? [`pid:${Number(post.repost_of)}`] : []),\n ...String(post.image_ids ?? \"\").split(\",\").filter(Boolean).map((i) =>\n `img:${imageIdentity(i)}`\n ),\n ...(post.thumb_img_id ? [`img:${String(post.thumb_img_id)}`] : []),\n ];\n await db.addBlocked(keys, uuid, null);\n await db.updatePost(uuid, { status: \"rejected\", verdict: \"bad\" });\n if (!(await db.hasFeedback(uuid, \"nope\"))) await db.addFeedback(uuid, \"nope\", null);\n console.log(\"NOPE\", JSON.stringify({ uuid, keys }));\n return page(\n `Blocked: ${title}`,\n `${keys.length} key(s) suppressed. Why, in one line? (optional)`,\n 200,\n { uuid, kind, token: token ?? \"\" },\n );\n }\n\n await db.updatePost(uuid, { status: \"liked\" });\n if (!(await db.hasFeedback(uuid, \"yes\"))) await db.addFeedback(uuid, \"yes\", null);\n console.log(\"YES\", JSON.stringify({ uuid }));\n return page(\n `More like this: ${title}`,\n \"What made it good? (optional)\",\n 200,\n { uuid, kind, token: token ?? \"\" },\n );\n}\n\nconst esc = (s: string) =>\n s.replace(/&/g, \"&\").replace(//g, \">\").replace(/\"/g, \""\");\n\nfunction page(\n heading: string,\n prompt: string | null,\n status: number,\n form?: { uuid: string; kind: string; token: string },\n): Response {\n const body = form && prompt\n ? ``\n : \"\";\n return new Response(\n `\ncl-triage\n\n

${esc(heading)}

\n${body}\n`,\n { status, headers: { \"content-type\": \"text/html; charset=utf-8\" } },\n );\n}\n",[154],"89487f85-bffb-445f-bc4d-263c04dae2d2",".vtignore","e7eae14a-ace8-11f1-8c88-1607ee4eb77e",3,["D",1789025174833],"# Never sync to Val Town. The val is PUBLIC (free tier = zero private vals), so\n# anything here is world-readable. Keep research notes, fixtures and secrets out.\n.env\n.env.*\n*.local\n\nPLAN.md\nCLAUDE.md\nresearch/\ntest/\nscratch/\n\n.git/\n\n# Lockfile is a local build artifact; Val Town resolves imports itself.\ndeno.lock\n",[161],"4afb64de-e43d-4e3a-85c7-c5448521df3a",".gitignore","e7f8b5a4-ace8-11f1-81ba-1607ee4eb77e",4,["D",1789025174910],".env\n.env.*\n*.local\n.vt/\nscratch/\n",[168],"c19b5d71-7c9f-4b31-8ff4-cbc4e764009a","lib","e7cae0ca-ace8-11f1-b8ae-1607ee4eb77e",1,["D",1789025174616],"directory",[175],"pulls","branches","forks","envVars",{"_188":163,"_190":62},"connections",{"_188":62,"_189":62},"count","unfilledCount","emptyCount",{"_42":174,"_31":175,"_29":176,"_137":-5,"_40":41,"_39":177,"_139":58,"_37":254,"_13":62,"_33":179,"_35":-5,"_23":24,"_143":-5,"_203":255,"_26":256},{"_42":246,"_31":247,"_29":248,"_137":176,"_40":41,"_39":249,"_139":58,"_37":250,"_13":62,"_33":34,"_35":251,"_23":24,"_143":-5,"_203":252,"_26":253},{"_42":238,"_31":239,"_29":240,"_137":176,"_40":41,"_39":241,"_139":24,"_37":242,"_13":62,"_33":34,"_35":243,"_23":24,"_143":-5,"_203":244,"_26":245},{"_42":230,"_31":231,"_29":232,"_137":176,"_40":41,"_39":233,"_139":58,"_37":234,"_13":62,"_33":34,"_35":235,"_23":24,"_143":-5,"_203":236,"_26":237},{"_42":222,"_31":223,"_29":224,"_137":176,"_40":41,"_39":225,"_139":24,"_37":226,"_13":62,"_33":34,"_35":227,"_23":24,"_143":-5,"_203":228,"_26":229},{"_42":218,"_31":32,"_29":30,"_137":176,"_40":41,"_39":14,"_139":58,"_37":219,"_13":62,"_33":34,"_35":36,"_23":24,"_143":-5,"_203":220,"_26":221},{"_42":167,"_31":168,"_29":169,"_137":-5,"_40":41,"_39":170,"_139":58,"_37":215,"_13":62,"_33":20,"_35":172,"_23":24,"_143":-5,"_203":216,"_26":217},{"_42":160,"_31":161,"_29":162,"_137":-5,"_40":41,"_39":163,"_139":24,"_37":212,"_13":62,"_33":20,"_35":165,"_23":24,"_143":-5,"_203":213,"_26":214},{"_42":153,"_31":154,"_29":56,"_137":-5,"_40":41,"_39":155,"_139":24,"_37":209,"_13":62,"_33":157,"_35":158,"_23":24,"_143":-5,"_203":210,"_26":211},{"_42":145,"_31":146,"_29":147,"_137":-5,"_40":41,"_39":148,"_139":24,"_37":206,"_13":62,"_33":150,"_35":151,"_23":24,"_143":-5,"_203":207,"_26":208},{"_42":134,"_31":135,"_29":136,"_137":-5,"_40":41,"_39":138,"_139":24,"_37":202,"_13":62,"_33":141,"_35":142,"_23":24,"_143":-5,"_203":204,"_26":205},["D",1789025174988],"children",[],[135],["D",1789025174920],[],[146],["D",1789025174785],[],[154],["D",1789025174833],[],[161],["D",1789025174910],[],[168],"77b700c6-5186-4dfd-a699-429343c6dbcf",["D",1789025175351],[],[175,32],"463c9921-1ba8-4ef7-b2af-fa36b78680ae","parse.ts","e824aae2-ace8-11f1-a6b9-1607ee4eb77e",9,["D",1789025175218],"/**\n * Parsing of Craigslist saved-search alert emails. Pure: no I/O, no Val Town imports,\n * so it is unit-testable against the fixtures in test/fixtures/.\n *\n * Shape of the plain-text part (the authoritative one — it survives Gmail's forward\n * wrapping better than the HTML):\n *\n * =========================================================== \n * <post url>\n * - $10 (santa rosa)\n *\n * The price line is optional (free items have none) and the parenthesised neighbourhood\n * is optional too; a free item may carry only the parenthesised location.\n *\n * Two URL shapes exist. Craigslist switched on 2026-07-02:\n * new: https://www.craigslist.org/view/d/<slug>/<uuid>\n * legacy: https://sfbay.craigslist.org/eby/hsh/d/<slug>/<pid>.html\n * Legacy rows carry a numeric post id and no uuid; the judge resolves the uuid later by\n * following the 301 on the old URL.\n */\n\nexport interface ParsedResult {\n uuid: string | null;\n pid: number | null;\n slug: string;\n title: string;\n price: number | null;\n hood: string | null;\n /** The 11-char image identity from the alert's _300x300 thumbnail, when there is one. */\n thumbImgId: string | null;\n url: string;\n}\n\nexport interface ParsedAlert {\n /** Saved-search name, lowercased — this is the key criteria are stored under. */\n search: string;\n /** N from \"(N new results)\", or null if the subject did not parse. */\n count: number | null;\n results: ParsedResult[];\n}\n\nconst NEW_URL =\n /https?:\\/\\/(?:www\\.)?craigslist\\.org\\/view\\/d\\/([^/\\s\"'<>]+)\\/([A-Za-z0-9]{15,30})/;\nconst LEGACY_URL =\n /https?:\\/\\/[a-z0-9.-]*craigslist\\.org\\/(?:[a-z0-9]+\\/)*d\\/([^/\\s\"'<>]+)\\/(\\d{6,})\\.html/;\nconst THUMB = /images\\.craigslist\\.org\\/[0-9A-Za-z]+_([0-9A-Za-z]{8,14})_[0-9A-Za-z]+_\\d+x\\d+\\.jpg/;\n\n/** \"(2 new results) sewing machine\" -> {count: 2, search: \"sewing machine\"} */\nexport function parseSubject(\n subject: string | undefined,\n): { count: number; search: string } | null {\n if (!subject) return null;\n const m = subject.match(/\$(\\d+)\\s+new\\s+results?\$\\s*(.+)$/i);\n if (!m) return null;\n const search = m[2].trim().toLowerCase();\n if (!search) return null;\n return { count: Number(m[1]), search };\n}\n\n/** Identity key for a result: the uuid when we have one, otherwise \"pid:<n>\". */\nexport function resultKey(r: { uuid: string | null; pid: number | null }): string {\n return r.uuid ?? `pid:${r.pid}`;\n}\n\nexport function parseAlert(\n subject: string | undefined,\n text: string | undefined,\n html: string | undefined,\n): ParsedAlert {\n const sub = parseSubject(subject);\n const results = text ? parseTextPart(text) : [];\n const thumbs = html ? thumbnailsByKey(html) : new Map<string, string>();\n for (const r of results) {\n r.thumbImgId = thumbs.get(resultKey(r)) ?? null;\n }\n return { search: sub?.search ?? \"\", count: sub?.count ?? null, results };\n}\n\nfunction parseTextPart(text: string): ParsedResult[] {\n const out: ParsedResult[] = [];\n const seen = new Set<string>();\n let title: string | null = null;\n let block: string[] = [];\n\n const flush = () => {\n if (title) {\n const r = blockToResult(title, block);\n if (r && !seen.has(resultKey(r))) {\n seen.add(resultKey(r));\n out.push(r);\n }\n }\n title = null;\n block = [];\n };\n\n for (const raw of text.split(/\\r?\\n/)) {\n const sep = raw.match(/^={5,}\\s*(.*)$/);\n if (sep) {\n flush();\n title = sep[1].trim() || null;\n } else if (title) {\n block.push(raw.trim());\n }\n }\n flush();\n return out;\n}\n\nfunction blockToResult(title: string, lines: string[]): ParsedResult | null {\n let uuid: string | null = null;\n let pid: number | null = null;\n let slug = \"\";\n let url = \"\";\n\n for (const line of lines) {\n const nu = line.match(NEW_URL);\n if (nu) {\n slug = nu[1];\n uuid = nu[2];\n url = nu[0];\n break;\n }\n const lu = line.match(LEGACY_URL);\n if (lu) {\n slug = lu[1];\n pid = Number(lu[2]);\n url = lu[0];\n break;\n }\n }\n if (!url) return null;\n\n let price: number | null = null;\n let hood: string | null = null;\n for (const line of lines) {\n const p = line.match(/^-\\s*\\$([\\d,]+)(?:\\s*\$(.+)\$)?\\s*$/);\n if (p) {\n price = Number(p[1].replace(/,/g, \"\"));\n hood = p[2]?.trim() || null;\n break;\n }\n const h = line.match(/^\$(.+)\$\\s*$/);\n if (h) {\n hood = h[1].trim();\n break;\n }\n }\n\n return { uuid, pid, slug, title, price, hood, thumbImgId: null, url };\n}\n\n/**\n * Thumbnail image ids from the HTML part, matched to results by document order: each\n * <img> belongs to the most recent post link above it, which is how the alert is laid out\n * (the thumbnail is wrapped in a second anchor to the same post).\n */\nfunction thumbnailsByKey(html: string): Map<string, string> {\n const combined = new RegExp(\n `(?:${NEW_URL.source})|(?:${LEGACY_URL.source})|(?:${THUMB.source})`,\n \"g\",\n );\n const map = new Map<string, string>();\n let current: string | null = null;\n for (const m of html.matchAll(combined)) {\n // groups: 1,2 = new slug/uuid 3,4 = legacy slug/pid 5 = thumbnail image id\n if (m[2]) current = m[2];\n else if (m[4]) current = `pid:${Number(m[4])}`;\n else if (m[5] && current && !map.has(current)) map.set(current, m[5]);\n }\n return map;\n}\n",[],[175,223],"826c2430-3a31-4d09-af53-d9cc981dbcb4","mail.ts","e8045df0-ace8-11f1-8828-1607ee4eb77e",6,["D",1789025174997],"/**\n * The outgoing digest. One email per cron run, carrying every 'good' verdict from that run.\n *\n * Gmail rules (learned the hard way in the sibling calendar-val project):\n * - <style> is honoured only inside <head>; a <style> in the body is silently dropped.\n * This email therefore uses inline styles only and has no <style> block at all.\n * - ::before / ::after are stripped, so nothing decorative may live in CSS.\n * - messages over ~102 KB get clipped. At <=4 posts per run this is a couple of KB.\n * Free tier can only send to the account owner, so `to` is omitted entirely — passing an\n * explicit address is refused by std/email.\n */\nimport { email } from \"https://esm.town/v/std/email\";\n\nexport interface DigestItem {\n uuid: string;\n title: string;\n priceString: string | null;\n hood: string | null;\n score: number;\n reason: string;\n flags: string[];\n url: string;\n imageUrl: string | null;\n nopeUrl: string | null;\n yesUrl: string | null;\n}\n\nconst esc = (s: string) =>\n s.replace(/&/g, \"&\").replace(/</g, \"<\").replace(/>/g, \">\").replace(/\"/g, \""\");\n\nexport function feedbackLink(base: string, uuid: string, kind: string, token: string): string {\n const u = new URL(base);\n u.searchParams.set(\"u\", uuid);\n u.searchParams.set(\"v\", kind);\n u.searchParams.set(\"t\", token);\n return u.toString();\n}\n\nexport function buildDigest(items: DigestItem[]): { subject: string; html: string; text: string } {\n const subject = items.length === 1\n ? `craigslist: ${items[0].title}`\n : `craigslist: ${items.length} worth a look`;\n\n const blocks = items.map((it) => {\n const meta = [it.priceString, it.hood, `score ${it.score}/10`].filter(Boolean).join(\" · \");\n const img = it.imageUrl\n ? `<a href=\"${esc(it.url)}\"><img src=\"${esc(it.imageUrl)}\" alt=\"\" width=\"300\" ` +\n `style=\"max-width:300px;border:0;border-radius:4px;display:block;margin:8px 0\"></a>`\n : \"\";\n const flags = it.flags.length\n ? `<div style=\"color:#888;font-size:12px\">${esc(it.flags.join(\" · \"))}</div>`\n : \"\";\n const buttons = (it.nopeUrl && it.yesUrl)\n ? `<div style=\"margin-top:10px;font-size:13px\">` +\n `<a href=\"${esc(it.nopeUrl)}\" style=\"padding:5px 10px;border:1px solid #c33;` +\n `border-radius:4px;color:#c33;text-decoration:none\">nope</a>` +\n `<a href=\"${\n esc(it.yesUrl)\n }\" style=\"margin-left:8px;padding:5px 10px;border:1px solid #383;` +\n `border-radius:4px;color:#383;text-decoration:none\">more like this</a></div>`\n : `<div style=\"margin-top:10px;font-size:12px;color:#888\">` +\n `(feedback links unavailable — FEEDBACK_SECRET or FEEDBACK_URL not set)</div>`;\n return `<div style=\"margin:0 0 26px 0;padding:0 0 20px 0;border-bottom:1px solid #eee\">\n <div style=\"font-size:16px;font-weight:600\"><a href=\"${\n esc(it.url)\n }\" style=\"color:#0a58ca;text-decoration:none\">${esc(it.title)}</a></div>\n <div style=\"color:#555;font-size:13px;margin-top:2px\">${esc(meta)}</div>\n <div style=\"margin-top:6px\">${esc(it.reason)}</div>\n ${flags}\n ${img}\n ${buttons}\n</div>`;\n });\n\n const html = `<html><head><meta charset=\"utf-8\"></head>\n<body style=\"margin:0;padding:16px;font-family:-apple-system,Segoe UI,Helvetica,Arial,sans-serif;color:#222\">\n${blocks.join(\"\\n\")}\n<div style=\"color:#999;font-size:11px\">cl-triage</div>\n</body></html>`;\n\n const text = items.map((it) =>\n [\n it.title,\n [it.priceString, it.hood, `score ${it.score}/10`].filter(Boolean).join(\" · \"),\n it.reason,\n it.url,\n it.nopeUrl ? `nope: ${it.nopeUrl}` : \"\",\n it.yesUrl ? `more like this: ${it.yesUrl}` : \"\",\n ].filter(Boolean).join(\"\\n\")\n ).join(\"\\n\\n---\\n\\n\");\n\n return { subject, html, text };\n}\n\n/** Sends to the account owner. `to` must stay omitted: free tier refuses any other recipient. */\nexport async function sendDigest(items: DigestItem[]): Promise<void> {\n const { subject, html, text } = buildDigest(items);\n await email({ subject, html, text });\n}\n",[],[175,231],"33d0b506-3f87-42df-869a-c4b899f7a523","dedup.ts","e8318de8-ace8-11f1-9b2d-1607ee4eb77e",10,["D",1789025175283],"/**\n * The dedup key ladder, strongest first. Pure — no I/O.\n *\n * Verified against real duplicates (research/craigslist-mechanics.md):\n * pid renew keeps postingId; the buttonholer alerted 5x under 7930466022\n * repostOf the two live \"Portable Sewing Machine\" posts both carry repostOf 7226229288\n * images the two Greist buttonholer crossposts have byte-identical image id lists\n * under different pids AND different coordinates\n * titlePriceLoc last resort; over-merges, so it runs last\n *\n * Do NOT key on postedDate (moves on every renew), on the URL form (it changed 2026-07-02),\n * or on the 5-char image shard prefix (varies per image within one post).\n */\n\nexport interface DedupRow {\n uuid: string;\n pid: number | null;\n repostOf: number | null;\n /** Raw craigslist image ids, e.g. \"3:00U0U_ixFsruu1I5I_0ak07K\". */\n imageIds: string[];\n title: string;\n price: number | null;\n lat: number | null;\n lon: number | null;\n}\n\nexport type DedupRule = \"pid\" | \"repostOf\" | \"images\" | \"titlePriceLoc\";\n\n/**\n * \"3:00U0U_ixFsruu1I5I_0ak07K\" -> \"ixFsruu1I5I\". The leading \"3:\" is an image type, the\n * 5-char first segment is a storage shard hint and the 6-char last segment is a replica\n * pair that appears in either order; only the middle 11 chars identify the image.\n */\nexport function imageIdentity(raw: string): string {\n const noType = raw.replace(/^\\d+:/, \"\");\n const parts = noType.split(\"_\");\n return parts.length >= 2 ? parts[1] : parts[0];\n}\n\nexport function imageSetKey(ids: string[]): string {\n return ids.map(imageIdentity).filter(Boolean).sort().join(\",\");\n}\n\nfunction normTitle(t: string): string {\n return t.trim().toLowerCase().replace(/\\s+/g, \" \");\n}\n\nfunction coordKey(lat: number | null, lon: number | null): string | null {\n if (lat === null || lon === null) return null;\n return `${lat.toFixed(3)},${lon.toFixed(3)}`;\n}\n\nexport function findDuplicate(\n cand: DedupRow,\n existing: DedupRow[],\n): { uuid: string; rule: DedupRule } | null {\n const others = existing.filter((e) => e.uuid !== cand.uuid);\n\n for (const e of others) {\n if (cand.pid !== null && e.pid === cand.pid) return { uuid: e.uuid, rule: \"pid\" };\n }\n for (const e of others) {\n const linked = (cand.repostOf !== null &&\n (e.repostOf === cand.repostOf || e.pid === cand.repostOf)) ||\n (e.repostOf !== null && e.repostOf === cand.pid);\n if (linked) return { uuid: e.uuid, rule: \"repostOf\" };\n }\n const ck = imageSetKey(cand.imageIds);\n if (ck) {\n for (const e of others) {\n if (imageSetKey(e.imageIds) === ck) return { uuid: e.uuid, rule: \"images\" };\n }\n }\n const loc = coordKey(cand.lat, cand.lon);\n if (loc) {\n const t = normTitle(cand.title);\n for (const e of others) {\n if (\n t && normTitle(e.title) === t && e.price === cand.price &&\n coordKey(e.lat, e.lon) === loc\n ) {\n return { uuid: e.uuid, rule: \"titlePriceLoc\" };\n }\n }\n }\n return null;\n}\n",[],[175,239],"6e14e58e-00b1-41ec-864c-999505d71ef6","cl.ts","e81f36d4-ace8-11f1-81ba-1607ee4eb77e",8,["D",1789025175111],"/**\n * Craigslist access. Etiquette rules baked in, all from research/craigslist-mechanics.md:\n * - browser-like User-Agent, GET only (images.craigslist.org answers 405 to HEAD)\n * - never ?format=rss (403 + block page; the parameter itself is a bot signal)\n * - never touch /reply or /flag (robots.txt Disallow)\n * - if a body ever contains <title>blocked, log the blockID and STOP. Do not retry,\n * do not change egress. Evading a block is the fact that turns scraping into CFAA exposure.\n * Volume here is ~1 detail call + <=5 images per alerted post, three orders of magnitude\n * under craigslist's own written 1,000-pages/24h budget.\n */\n\nconst UA =\n \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\";\n\nexport class BlockedError extends Error {\n constructor(public blockID: string, public url: string) {\n super(`craigslist block page (blockID=${blockID}) for ${url}`);\n this.name = \"BlockedError\";\n }\n}\n\nfunction assertNotBlocked(body: string, url: string) {\n if (/\\s*blocked\\s*<\\/title>/i.test(body)) {\n const m = body.match(/blockID[=:]\\s*(\\d+)/i);\n throw new BlockedError(m ? m[1] : \"unknown\", url);\n }\n}\n\nasync function get(url: string, timeoutMs: number, accept: string): Promise<Response> {\n return await fetch(url, {\n method: \"GET\",\n redirect: \"follow\",\n headers: { \"User-Agent\": UA, \"Accept\": accept, \"Accept-Language\": \"en-US,en;q=0.9\" },\n signal: AbortSignal.timeout(timeoutMs),\n });\n}\n\nexport interface DetailItem {\n postingId: number;\n postingUuid: string;\n repostOf?: number;\n recordCreated?: number;\n postedDate?: number;\n updatedDate?: number;\n images?: string[];\n title?: string;\n price?: number;\n priceString?: string;\n body?: string;\n category?: string;\n categoryId?: number;\n attributes?: { label?: string; value?: string }[];\n notices?: unknown[];\n location?: { lat?: number; lon?: number; neighborhood?: string; area?: string };\n url?: string;\n}\n\n/** GET sapi detail. Returns status 404 with item null for a post that is gone. */\nexport async function fetchDetail(\n uuid: string,\n timeoutMs = 10_000,\n): Promise<{ status: number; item: DetailItem | null }> {\n const url = `https://sapi.craigslist.org/web/v8/postings/${\n encodeURIComponent(uuid)\n }?cc=US&lang=en`;\n const res = await get(url, timeoutMs, \"application/json\");\n const text = await res.text();\n assertNotBlocked(text, url);\n if (res.status === 404) return { status: 404, item: null };\n if (!res.ok) return { status: res.status, item: null };\n const json = JSON.parse(text);\n const item = json?.data?.items?.[0] ?? null;\n return { status: res.status, item };\n}\n\n/**\n * Legacy alert rows carry only a numeric post id. The old numeric URL 301s to the\n * /view/d/<slug>/<uuid> form, so the redirect is the pid -> uuid oracle. A deleted or\n * expired post 404s here with no redirect.\n */\nexport async function resolveUuid(\n legacyUrl: string,\n timeoutMs = 10_000,\n): Promise<{ status: number; uuid: string | null }> {\n const res = await get(legacyUrl, timeoutMs, \"text/html\");\n const text = await res.text();\n assertNotBlocked(text, legacyUrl);\n if (!res.ok) return { status: res.status, uuid: null };\n const m = res.url.match(/\\/view\\/d\\/[^/]+\\/([A-Za-z0-9]{15,30})/) ??\n text.match(/rel=\"canonical\"[^>]*\\/view\\/d\\/[^/]+\\/([A-Za-z0-9]{15,30})/);\n return { status: res.status, uuid: m ? m[1] : null };\n}\n\n/** \"3:00U0U_ixFsruu1I5I_0ak07K\" -> the fetchable URL at the given size box. */\nexport function imageUrl(rawId: string, size = \"600x450\"): string {\n return `https://images.craigslist.org/${rawId.replace(/^\\d+:/, \"\")}_${size}.jpg`;\n}\n\nfunction toBase64(bytes: Uint8Array): string {\n let s = \"\";\n const chunk = 0x8000;\n for (let i = 0; i < bytes.length; i += chunk) {\n s += String.fromCharCode(...bytes.subarray(i, i + chunk));\n }\n return btoa(s);\n}\n\n/** Fetches one image and base64s it in memory. Never persisted — the storage quota is 10 MB. */\nexport async function fetchImageBase64(\n rawId: string,\n size = \"600x450\",\n timeoutMs = 10_000,\n): Promise<{ mediaType: string; data: string } | null> {\n const url = imageUrl(rawId, size);\n const res = await get(url, timeoutMs, \"image/*\");\n if (!res.ok) return null;\n const ct = res.headers.get(\"content-type\") ?? \"\";\n if (!ct.startsWith(\"image/\")) return null;\n const buf = new Uint8Array(await res.arrayBuffer());\n if (buf.length === 0) return null;\n return { mediaType: ct.split(\";\")[0].trim(), data: toBase64(buf) };\n}\n\n/** Strip the HTML craigslist puts in `body`, so the judge reads plain text. */\nexport function bodyText(html: string | undefined, max = 4000): string {\n if (!html) return \"\";\n return html\n .replace(/<showcontactinfo[^>]*>.*?<\\/showcontactinfo>/gis, \"[contact info]\")\n .replace(/<br\\s*\\/?>/gi, \"\\n\")\n .replace(/<[^>]+>/g, \"\")\n .replace(/ /g, \" \")\n .replace(/&/g, \"&\")\n .replace(/</g, \"<\")\n .replace(/>/g, \">\")\n .replace(/"/g, '\"')\n .replace(/'/g, \"'\")\n .replace(/\\n{3,}/g, \"\\n\\n\")\n .trim()\n .slice(0, max);\n}\n",[],[175,247],["D",1789025174616],[192,193,194,195,196],[175],["D",1789025029995],["D",1789459281818],{"_99":98,"_106":102},{"_99":98,"_100":-5,"_101":102,"_18":54,"_103":104,"_105":24},{"_13":88,"_31":89,"_42":41,"_90":43,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":44,"_97":98},"ctx",{"_81":-5,"_125":295,"_296":297,"_298":299,"_300":24,"_301":24,"_302":24,"_303":58,"_304":-5,"_305":-7,"_306":-7,"_307":62,"_308":24,"_309":24,"_310":-5,"_311":24,"_312":24,"_313":24,"_314":-5},"ENV",{"_266":267,"_268":269,"_270":89,"_271":272,"_273":274,"_275":276,"_277":278,"_279":280,"_281":282,"_283":284,"_285":286,"_287":288,"_289":290,"_291":292,"_293":294},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"] </article></body></html>

Diff · v11