cl-triage

${esc(heading)}

\n${body}\n`,\n { status, headers: { \"content-type\": \"text/html; charset=utf-8\" } },\n );\n}\n",[153],"54dceed7-8457-4821-aedf-3d0bd4ba47e8",["D",1789025174916],[27],"89487f85-bffb-445f-bc4d-263c04dae2d2",".vtignore","e7eae14a-ace8-11f1-8c88-1607ee4eb77e",3,["D",1789025174833],"# Never sync to Val Town. The val is PUBLIC (free tier = zero private vals), so\n# anything here is world-readable. Keep research notes, fixtures and secrets out.\n.env\n.env.*\n*.local\n\nPLAN.md\nCLAUDE.md\nresearch/\ntest/\nscratch/\n\n.git/\n\n# Lockfile is a local build artifact; Val Town resolves imports itself.\ndeno.lock\n",[163],"4afb64de-e43d-4e3a-85c7-c5448521df3a",".gitignore","e7f8b5a4-ace8-11f1-81ba-1607ee4eb77e",4,["D",1789025174910],".env\n.env.*\n*.local\n.vt/\nscratch/\n",[170],"c19b5d71-7c9f-4b31-8ff4-cbc4e764009a","lib","e7cae0ca-ace8-11f1-b8ae-1607ee4eb77e",1,["D",1789025174616],"directory",[177],"pulls","branches","forks","envVars",{"_190":165,"_192":60},"connections",{"_190":60,"_191":60},"count","unfilledCount","emptyCount",{"_40":176,"_31":177,"_29":178,"_136":-5,"_38":39,"_37":179,"_138":56,"_35":283,"_13":60,"_32":181,"_33":-5,"_23":24,"_142":-5,"_208":284,"_26":285},{"_40":275,"_31":276,"_29":277,"_136":178,"_38":39,"_37":278,"_138":56,"_35":279,"_13":60,"_32":231,"_33":280,"_23":24,"_142":-5,"_208":281,"_26":282},{"_40":267,"_31":268,"_29":269,"_136":178,"_38":39,"_37":270,"_138":24,"_35":271,"_13":60,"_32":231,"_33":272,"_23":24,"_142":-5,"_208":273,"_26":274},{"_40":259,"_31":260,"_29":261,"_136":178,"_38":39,"_37":262,"_138":24,"_35":263,"_13":60,"_32":231,"_33":264,"_23":24,"_142":-5,"_208":265,"_26":266},{"_40":251,"_31":252,"_29":253,"_136":178,"_38":39,"_37":254,"_138":24,"_35":255,"_13":60,"_32":231,"_33":256,"_23":24,"_142":-5,"_208":257,"_26":258},{"_40":243,"_31":244,"_29":245,"_136":178,"_38":39,"_37":246,"_138":56,"_35":247,"_13":60,"_32":231,"_33":248,"_23":24,"_142":-5,"_208":249,"_26":250},{"_40":235,"_31":236,"_29":237,"_136":178,"_38":39,"_37":238,"_138":24,"_35":239,"_13":60,"_32":231,"_33":240,"_23":24,"_142":-5,"_208":241,"_26":242},{"_40":226,"_31":227,"_29":228,"_136":178,"_38":39,"_37":229,"_138":56,"_35":230,"_13":60,"_32":231,"_33":232,"_23":24,"_142":-5,"_208":233,"_26":234},{"_40":169,"_31":170,"_29":171,"_136":-5,"_38":39,"_37":172,"_138":56,"_35":223,"_13":60,"_32":20,"_33":174,"_23":24,"_142":-5,"_208":224,"_26":225},{"_40":162,"_31":163,"_29":164,"_136":-5,"_38":39,"_37":165,"_138":24,"_35":220,"_13":60,"_32":20,"_33":167,"_23":24,"_142":-5,"_208":221,"_26":222},{"_40":159,"_31":27,"_29":30,"_136":-5,"_38":39,"_37":14,"_138":24,"_35":217,"_13":60,"_32":20,"_33":34,"_23":24,"_142":-5,"_208":218,"_26":219},{"_40":152,"_31":153,"_29":54,"_136":-5,"_38":39,"_37":154,"_138":24,"_35":214,"_13":60,"_32":156,"_33":157,"_23":24,"_142":-5,"_208":215,"_26":216},{"_40":144,"_31":145,"_29":146,"_136":-5,"_38":39,"_37":147,"_138":24,"_35":211,"_13":60,"_32":149,"_33":150,"_23":24,"_142":-5,"_208":212,"_26":213},{"_40":133,"_31":134,"_29":135,"_136":-5,"_38":39,"_37":137,"_138":24,"_35":207,"_13":60,"_32":140,"_33":141,"_23":24,"_142":-5,"_208":209,"_26":210},["D",1789025174988],"children",[],[134],["D",1789025174920],[],[145],["D",1789025174785],[],[153],["D",1789025174916],[],[27],["D",1789025174833],[],[163],["D",1789025174910],[],[170],"77b700c6-5186-4dfd-a699-429343c6dbcf","sign.ts","e83bfcf6-ace8-11f1-8265-1607ee4eb77e",11,["D",1789025175351],"script","/**\n * HMAC-SHA256 over `|`, hex encoded, via Web Crypto (available in Deno and\n * on Val Town). The token is the only authentication the feedback endpoint has: the val is\n * public and the links go out in email, so the secret must never appear in source.\n */\n\nexport type FeedbackKind = \"nope\" | \"yes\";\n\nasync function hmacHex(secret: string, msg: string): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const sig = await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(msg));\n return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport function sign(secret: string, uuid: string, kind: FeedbackKind | string): Promise {\n return hmacHex(secret, `${uuid}|${kind}`);\n}\n\nexport async function verify(\n secret: string,\n uuid: string,\n kind: string,\n token: string | null | undefined,\n): Promise {\n if (!token) return false;\n const expected = await sign(secret, uuid, kind);\n if (token.length !== expected.length) return false;\n // Constant time over the hex string.\n let diff = 0;\n for (let i = 0; i < expected.length; i++) diff |= expected.charCodeAt(i) ^ token.charCodeAt(i);\n return diff === 0;\n}\n",[],[177,227],"463c9921-1ba8-4ef7-b2af-fa36b78680ae","parse.ts","e824aae2-ace8-11f1-a6b9-1607ee4eb77e",9,["D",1789025175218],"/**\n * Parsing of Craigslist saved-search alert emails. Pure: no I/O, no Val Town imports,\n * so it is unit-testable against the fixtures in test/fixtures/.\n *\n * Shape of the plain-text part (the authoritative one — it survives Gmail's forward\n * wrapping better than the HTML):\n *\n * =========================================================== \n * <post url>\n * - $10 (santa rosa)\n *\n * The price line is optional (free items have none) and the parenthesised neighbourhood\n * is optional too; a free item may carry only the parenthesised location.\n *\n * Two URL shapes exist. Craigslist switched on 2026-07-02:\n * new: https://www.craigslist.org/view/d/<slug>/<uuid>\n * legacy: https://sfbay.craigslist.org/eby/hsh/d/<slug>/<pid>.html\n * Legacy rows carry a numeric post id and no uuid; the judge resolves the uuid later by\n * following the 301 on the old URL.\n */\n\nexport interface ParsedResult {\n uuid: string | null;\n pid: number | null;\n slug: string;\n title: string;\n price: number | null;\n hood: string | null;\n /** The 11-char image identity from the alert's _300x300 thumbnail, when there is one. */\n thumbImgId: string | null;\n url: string;\n}\n\nexport interface ParsedAlert {\n /** Saved-search name, lowercased — this is the key criteria are stored under. */\n search: string;\n /** N from \"(N new results)\", or null if the subject did not parse. */\n count: number | null;\n results: ParsedResult[];\n}\n\nconst NEW_URL =\n /https?:\\/\\/(?:www\\.)?craigslist\\.org\\/view\\/d\\/([^/\\s\"'<>]+)\\/([A-Za-z0-9]{15,30})/;\nconst LEGACY_URL =\n /https?:\\/\\/[a-z0-9.-]*craigslist\\.org\\/(?:[a-z0-9]+\\/)*d\\/([^/\\s\"'<>]+)\\/(\\d{6,})\\.html/;\nconst THUMB = /images\\.craigslist\\.org\\/[0-9A-Za-z]+_([0-9A-Za-z]{8,14})_[0-9A-Za-z]+_\\d+x\\d+\\.jpg/;\n\n/** \"(2 new results) sewing machine\" -> {count: 2, search: \"sewing machine\"} */\nexport function parseSubject(\n subject: string | undefined,\n): { count: number; search: string } | null {\n if (!subject) return null;\n const m = subject.match(/\$(\\d+)\\s+new\\s+results?\$\\s*(.+)$/i);\n if (!m) return null;\n const search = m[2].trim().toLowerCase();\n if (!search) return null;\n return { count: Number(m[1]), search };\n}\n\n/** Identity key for a result: the uuid when we have one, otherwise \"pid:<n>\". */\nexport function resultKey(r: { uuid: string | null; pid: number | null }): string {\n return r.uuid ?? `pid:${r.pid}`;\n}\n\nexport function parseAlert(\n subject: string | undefined,\n text: string | undefined,\n html: string | undefined,\n): ParsedAlert {\n const sub = parseSubject(subject);\n const results = text ? parseTextPart(text) : [];\n const thumbs = html ? thumbnailsByKey(html) : new Map<string, string>();\n for (const r of results) {\n r.thumbImgId = thumbs.get(resultKey(r)) ?? null;\n }\n return { search: sub?.search ?? \"\", count: sub?.count ?? null, results };\n}\n\nfunction parseTextPart(text: string): ParsedResult[] {\n const out: ParsedResult[] = [];\n const seen = new Set<string>();\n let title: string | null = null;\n let block: string[] = [];\n\n const flush = () => {\n if (title) {\n const r = blockToResult(title, block);\n if (r && !seen.has(resultKey(r))) {\n seen.add(resultKey(r));\n out.push(r);\n }\n }\n title = null;\n block = [];\n };\n\n for (const raw of text.split(/\\r?\\n/)) {\n const sep = raw.match(/^={5,}\\s*(.*)$/);\n if (sep) {\n flush();\n title = sep[1].trim() || null;\n } else if (title) {\n block.push(raw.trim());\n }\n }\n flush();\n return out;\n}\n\nfunction blockToResult(title: string, lines: string[]): ParsedResult | null {\n let uuid: string | null = null;\n let pid: number | null = null;\n let slug = \"\";\n let url = \"\";\n\n for (const line of lines) {\n const nu = line.match(NEW_URL);\n if (nu) {\n slug = nu[1];\n uuid = nu[2];\n url = nu[0];\n break;\n }\n const lu = line.match(LEGACY_URL);\n if (lu) {\n slug = lu[1];\n pid = Number(lu[2]);\n url = lu[0];\n break;\n }\n }\n if (!url) return null;\n\n let price: number | null = null;\n let hood: string | null = null;\n for (const line of lines) {\n const p = line.match(/^-\\s*\\$([\\d,]+)(?:\\s*\$(.+)\$)?\\s*$/);\n if (p) {\n price = Number(p[1].replace(/,/g, \"\"));\n hood = p[2]?.trim() || null;\n break;\n }\n const h = line.match(/^\$(.+)\$\\s*$/);\n if (h) {\n hood = h[1].trim();\n break;\n }\n }\n\n return { uuid, pid, slug, title, price, hood, thumbImgId: null, url };\n}\n\n/**\n * Thumbnail image ids from the HTML part, matched to results by document order: each\n * <img> belongs to the most recent post link above it, which is how the alert is laid out\n * (the thumbnail is wrapped in a second anchor to the same post).\n */\nfunction thumbnailsByKey(html: string): Map<string, string> {\n const combined = new RegExp(\n `(?:${NEW_URL.source})|(?:${LEGACY_URL.source})|(?:${THUMB.source})`,\n \"g\",\n );\n const map = new Map<string, string>();\n let current: string | null = null;\n for (const m of html.matchAll(combined)) {\n // groups: 1,2 = new slug/uuid 3,4 = legacy slug/pid 5 = thumbnail image id\n if (m[2]) current = m[2];\n else if (m[4]) current = `pid:${Number(m[4])}`;\n else if (m[5] && current && !map.has(current)) map.set(current, m[5]);\n }\n return map;\n}\n",[],[177,236],"826c2430-3a31-4d09-af53-d9cc981dbcb4","mail.ts","e8045df0-ace8-11f1-8828-1607ee4eb77e",6,["D",1789025174997],"/**\n * The outgoing digest. One email per cron run, carrying every 'good' verdict from that run.\n *\n * Gmail rules (learned the hard way in the sibling calendar-val project):\n * - <style> is honoured only inside <head>; a <style> in the body is silently dropped.\n * This email therefore uses inline styles only and has no <style> block at all.\n * - ::before / ::after are stripped, so nothing decorative may live in CSS.\n * - messages over ~102 KB get clipped. At <=4 posts per run this is a couple of KB.\n * Free tier can only send to the account owner, so `to` is omitted entirely — passing an\n * explicit address is refused by std/email.\n */\nimport { email } from \"https://esm.town/v/std/email\";\n\nexport interface DigestItem {\n uuid: string;\n title: string;\n priceString: string | null;\n hood: string | null;\n score: number;\n reason: string;\n flags: string[];\n url: string;\n imageUrl: string | null;\n nopeUrl: string | null;\n yesUrl: string | null;\n}\n\nconst esc = (s: string) =>\n s.replace(/&/g, \"&\").replace(/</g, \"<\").replace(/>/g, \">\").replace(/\"/g, \""\");\n\nexport function feedbackLink(base: string, uuid: string, kind: string, token: string): string {\n const u = new URL(base);\n u.searchParams.set(\"u\", uuid);\n u.searchParams.set(\"v\", kind);\n u.searchParams.set(\"t\", token);\n return u.toString();\n}\n\nexport function buildDigest(items: DigestItem[]): { subject: string; html: string; text: string } {\n const subject = items.length === 1\n ? `craigslist: ${items[0].title}`\n : `craigslist: ${items.length} worth a look`;\n\n const blocks = items.map((it) => {\n const meta = [it.priceString, it.hood, `score ${it.score}/10`].filter(Boolean).join(\" · \");\n const img = it.imageUrl\n ? `<a href=\"${esc(it.url)}\"><img src=\"${esc(it.imageUrl)}\" alt=\"\" width=\"300\" ` +\n `style=\"max-width:300px;border:0;border-radius:4px;display:block;margin:8px 0\"></a>`\n : \"\";\n const flags = it.flags.length\n ? `<div style=\"color:#888;font-size:12px\">${esc(it.flags.join(\" · \"))}</div>`\n : \"\";\n const buttons = (it.nopeUrl && it.yesUrl)\n ? `<div style=\"margin-top:10px;font-size:13px\">` +\n `<a href=\"${esc(it.nopeUrl)}\" style=\"padding:5px 10px;border:1px solid #c33;` +\n `border-radius:4px;color:#c33;text-decoration:none\">nope</a>` +\n `<a href=\"${\n esc(it.yesUrl)\n }\" style=\"margin-left:8px;padding:5px 10px;border:1px solid #383;` +\n `border-radius:4px;color:#383;text-decoration:none\">more like this</a></div>`\n : `<div style=\"margin-top:10px;font-size:12px;color:#888\">` +\n `(feedback links unavailable — FEEDBACK_SECRET or FEEDBACK_URL not set)</div>`;\n return `<div style=\"margin:0 0 26px 0;padding:0 0 20px 0;border-bottom:1px solid #eee\">\n <div style=\"font-size:16px;font-weight:600\"><a href=\"${\n esc(it.url)\n }\" style=\"color:#0a58ca;text-decoration:none\">${esc(it.title)}</a></div>\n <div style=\"color:#555;font-size:13px;margin-top:2px\">${esc(meta)}</div>\n <div style=\"margin-top:6px\">${esc(it.reason)}</div>\n ${flags}\n ${img}\n ${buttons}\n</div>`;\n });\n\n const html = `<html><head><meta charset=\"utf-8\"></head>\n<body style=\"margin:0;padding:16px;font-family:-apple-system,Segoe UI,Helvetica,Arial,sans-serif;color:#222\">\n${blocks.join(\"\\n\")}\n<div style=\"color:#999;font-size:11px\">cl-triage</div>\n</body></html>`;\n\n const text = items.map((it) =>\n [\n it.title,\n [it.priceString, it.hood, `score ${it.score}/10`].filter(Boolean).join(\" · \"),\n it.reason,\n it.url,\n it.nopeUrl ? `nope: ${it.nopeUrl}` : \"\",\n it.yesUrl ? `more like this: ${it.yesUrl}` : \"\",\n ].filter(Boolean).join(\"\\n\")\n ).join(\"\\n\\n---\\n\\n\");\n\n return { subject, html, text };\n}\n\n/** Sends to the account owner. `to` must stay omitted: free tier refuses any other recipient. */\nexport async function sendDigest(items: DigestItem[]): Promise<void> {\n const { subject, html, text } = buildDigest(items);\n await email({ subject, html, text });\n}\n",[],[177,244],"18844a5e-0c7e-425f-9259-d76ff2851bdc","llm.ts","e84fd7c6-ace8-11f1-8c92-1607ee4eb77e",12,["D",1789025175397],"/**\n * The judge call. One request per post: system prompt = the criteria for that saved search\n * plus the feedback he has given on that search; user content = the listing plus up to five\n * images as base64 vision blocks.\n *\n * Structured output uses output_config.format with a raw JSON schema (no zod dependency to\n * ship to Val Town). The schema language has no numeric or string constraints, so score is a\n * plain integer and is clamped here.\n */\nimport Anthropic from \"npm:@anthropic-ai/sdk\";\nimport type { Example } from \"./db.ts\";\n\nexport const DEFAULT_MODEL = \"claude-sonnet-5\";\n\nexport interface Criteria {\n default: string;\n searches: Record<string, string>;\n}\n\n/**\n * A deliberately generic stand-in used when CRITERIA_JSON is unset. Nothing personal may be\n * hardcoded here: this val is public.\n */\nexport const BUILTIN_DEFAULT_CRITERIA = [\n \"You are triaging Craigslist for-sale listings for the person who saved this search.\",\n \"No criteria have been configured for this search, so judge on general signals only:\",\n \"does the listing match its own title, is the item complete and usable, are the photos\",\n \"real and informative, is the asking price plausible, and does anything read like a scam,\",\n \"a bulk dealer relisting, or a parts-only item sold as working?\",\n 'Be skeptical. When you cannot tell, the answer is \"meh\".',\n].join(\" \");\n\nexport function loadCriteria(raw: string | undefined): Criteria {\n if (!raw) return { default: BUILTIN_DEFAULT_CRITERIA, searches: {} };\n try {\n const j = JSON.parse(raw);\n return {\n default: typeof j.default === \"string\" && j.default ? j.default : BUILTIN_DEFAULT_CRITERIA,\n searches: (j.searches && typeof j.searches === \"object\") ? j.searches : {},\n };\n } catch (e) {\n console.error(\"CRITERIA_JSON is not valid JSON, using the built-in default:\", String(e));\n return { default: BUILTIN_DEFAULT_CRITERIA, searches: {} };\n }\n}\n\n/** Criteria are keyed by the lowercased saved-search name; unknown names fall back and log. */\nexport function criteriaFor(c: Criteria, search: string): { prompt: string; fellBack: boolean } {\n const hit = c.searches[search.trim().toLowerCase()];\n if (hit) return { prompt: hit, fellBack: false };\n return { prompt: c.default, fellBack: true };\n}\n\nexport interface Verdict {\n verdict: \"good\" | \"meh\" | \"bad\";\n score: number;\n reason: string;\n flags: string[];\n}\n\nconst SCHEMA = {\n type: \"object\",\n properties: {\n verdict: { type: \"string\", enum: [\"good\", \"meh\", \"bad\"] },\n score: { type: \"integer\", description: \"0-10, where 10 is a listing he should go look at now\" },\n reason: { type: \"string\", description: \"One line, at most 200 characters.\" },\n flags: {\n type: \"array\",\n items: { type: \"string\" },\n description: \"Short tags for anything notable: scam, parts-only, dealer, far, overpriced.\",\n },\n },\n required: [\"verdict\", \"score\", \"reason\", \"flags\"],\n additionalProperties: false,\n} as const;\n\nexport function buildSystem(criteria: string, nopes: Example[], yeses: Example[]): string {\n const parts = [criteria.trim()];\n const fmt = (e: Example) =>\n `- ${e.title}${e.price === null ? \"\" : ` ($${e.price})`}${e.reason ? ` — ${e.reason}` : \"\"}`;\n if (yeses.length) {\n parts.push(\n \"Listings he asked for more like these:\\n\" + yeses.map(fmt).join(\"\\n\"),\n );\n }\n if (nopes.length) {\n parts.push(\n \"Listings he explicitly rejected. Treat close matches as bad:\\n\" + nopes.map(fmt).join(\"\\n\"),\n );\n }\n parts.push(\n \"Reply with the JSON object only. reason is one line, at most 200 characters, written to \" +\n \"him, saying the single thing that decides it.\",\n );\n return parts.join(\"\\n\\n\");\n}\n\nexport interface PostForJudge {\n title: string;\n priceString: string | null;\n hood: string | null;\n body: string;\n attributes: string[];\n category: string | null;\n postedIso: string | null;\n createdIso: string | null;\n search: string;\n}\n\nexport function buildUserText(p: PostForJudge): string {\n const lines = [\n `saved search: ${p.search}`,\n `title: ${p.title}`,\n `price: ${p.priceString ?? \"(none listed)\"}`,\n `location: ${p.hood ?? \"(not given)\"}`,\n `category: ${p.category ?? \"(unknown)\"}`,\n ];\n if (p.attributes.length) lines.push(`attributes: ${p.attributes.join(\"; \")}`);\n if (p.createdIso) lines.push(`first posted: ${p.createdIso}`);\n if (p.postedIso) lines.push(`last renewed: ${p.postedIso}`);\n lines.push(\"\", \"body:\", p.body || \"(empty)\");\n return lines.join(\"\\n\");\n}\n\nexport interface JudgeInput {\n apiKey: string;\n model: string;\n system: string;\n userText: string;\n images: { mediaType: string; data: string }[];\n timeoutMs: number;\n}\n\nfunction clampVerdict(o: Record<string, unknown>): Verdict {\n const v = o.verdict === \"good\" || o.verdict === \"meh\"\n ? o.verdict\n : o.verdict === \"bad\"\n ? \"bad\"\n : \"meh\";\n const n = Number(o.score);\n return {\n verdict: v as Verdict[\"verdict\"],\n score: Number.isFinite(n) ? Math.max(0, Math.min(10, Math.round(n))) : 0,\n reason: String(o.reason ?? \"\").slice(0, 200),\n flags: Array.isArray(o.flags) ? o.flags.map(String).slice(0, 10) : [],\n };\n}\n\nexport async function judge(input: JudgeInput): Promise<Verdict> {\n const client = new Anthropic({ apiKey: input.apiKey, timeout: input.timeoutMs, maxRetries: 1 });\n const content: Anthropic.ContentBlockParam[] = input.images.map((img) => ({\n type: \"image\" as const,\n source: { type: \"base64\" as const, media_type: img.mediaType as \"image/jpeg\", data: img.data },\n }));\n content.push({ type: \"text\", text: input.userText });\n\n const res = await client.messages.create({\n model: input.model,\n max_tokens: 2000,\n system: input.system,\n output_config: { effort: \"low\", format: { type: \"json_schema\", schema: SCHEMA } },\n messages: [{ role: \"user\", content }],\n });\n\n if (res.stop_reason === \"refusal\") throw new Error(\"judge refused this listing\");\n const text = res.content.find((b) => b.type === \"text\");\n if (!text || text.type !== \"text\") throw new Error(`no text block (stop=${res.stop_reason})`);\n return clampVerdict(JSON.parse(text.text));\n}\n",[],[177,252],"33d0b506-3f87-42df-869a-c4b899f7a523","dedup.ts","e8318de8-ace8-11f1-9b2d-1607ee4eb77e",10,["D",1789025175283],"/**\n * The dedup key ladder, strongest first. Pure — no I/O.\n *\n * Verified against real duplicates (research/craigslist-mechanics.md):\n * pid renew keeps postingId; the buttonholer alerted 5x under 7930466022\n * repostOf the two live \"Portable Sewing Machine\" posts both carry repostOf 7226229288\n * images the two Greist buttonholer crossposts have byte-identical image id lists\n * under different pids AND different coordinates\n * titlePriceLoc last resort; over-merges, so it runs last\n *\n * Do NOT key on postedDate (moves on every renew), on the URL form (it changed 2026-07-02),\n * or on the 5-char image shard prefix (varies per image within one post).\n */\n\nexport interface DedupRow {\n uuid: string;\n pid: number | null;\n repostOf: number | null;\n /** Raw craigslist image ids, e.g. \"3:00U0U_ixFsruu1I5I_0ak07K\". */\n imageIds: string[];\n title: string;\n price: number | null;\n lat: number | null;\n lon: number | null;\n}\n\nexport type DedupRule = \"pid\" | \"repostOf\" | \"images\" | \"titlePriceLoc\";\n\n/**\n * \"3:00U0U_ixFsruu1I5I_0ak07K\" -> \"ixFsruu1I5I\". The leading \"3:\" is an image type, the\n * 5-char first segment is a storage shard hint and the 6-char last segment is a replica\n * pair that appears in either order; only the middle 11 chars identify the image.\n */\nexport function imageIdentity(raw: string): string {\n const noType = raw.replace(/^\\d+:/, \"\");\n const parts = noType.split(\"_\");\n return parts.length >= 2 ? parts[1] : parts[0];\n}\n\nexport function imageSetKey(ids: string[]): string {\n return ids.map(imageIdentity).filter(Boolean).sort().join(\",\");\n}\n\nfunction normTitle(t: string): string {\n return t.trim().toLowerCase().replace(/\\s+/g, \" \");\n}\n\nfunction coordKey(lat: number | null, lon: number | null): string | null {\n if (lat === null || lon === null) return null;\n return `${lat.toFixed(3)},${lon.toFixed(3)}`;\n}\n\nexport function findDuplicate(\n cand: DedupRow,\n existing: DedupRow[],\n): { uuid: string; rule: DedupRule } | null {\n const others = existing.filter((e) => e.uuid !== cand.uuid);\n\n for (const e of others) {\n if (cand.pid !== null && e.pid === cand.pid) return { uuid: e.uuid, rule: \"pid\" };\n }\n for (const e of others) {\n const linked = (cand.repostOf !== null &&\n (e.repostOf === cand.repostOf || e.pid === cand.repostOf)) ||\n (e.repostOf !== null && e.repostOf === cand.pid);\n if (linked) return { uuid: e.uuid, rule: \"repostOf\" };\n }\n const ck = imageSetKey(cand.imageIds);\n if (ck) {\n for (const e of others) {\n if (imageSetKey(e.imageIds) === ck) return { uuid: e.uuid, rule: \"images\" };\n }\n }\n const loc = coordKey(cand.lat, cand.lon);\n if (loc) {\n const t = normTitle(cand.title);\n for (const e of others) {\n if (\n t && normTitle(e.title) === t && e.price === cand.price &&\n coordKey(e.lat, e.lon) === loc\n ) {\n return { uuid: e.uuid, rule: \"titlePriceLoc\" };\n }\n }\n }\n return null;\n}\n",[],[177,260],"0da1e96a-6821-4969-9606-0854dc3ecb64","db.ts","e881e32e-ace8-11f1-9915-1607ee4eb77e",13,["D",1789025175089],"/**\n * Val-scoped SQLite. Note the import path ends in /main.ts — the legacy\n * https://esm.town/v/std/sqlite module is account-scoped and returns rows as arrays\n * instead of objects. Do not mix the two.\n *\n * Quota is 10 MB shared between SQLite and blob for the whole account, so this stores ids,\n * verdicts and short reasons only. Never image bytes.\n */\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport type Row = Record<string, string | number | null>;\n/** What the libsql client accepts as a bound parameter. */\nexport type Arg = string | number | bigint | boolean | null | Uint8Array;\n\nasync function run(sql: string, args: Arg[] = []): Promise<Row[]> {\n const res = await sqlite.execute({ sql, args });\n return (res.rows ?? []) as unknown as Row[];\n}\n\n/** Migrations are CREATE ... IF NOT EXISTS only; every entry point calls this first. */\nexport async function init(): Promise<void> {\n await run(`CREATE TABLE IF NOT EXISTS posts (\n uuid TEXT PRIMARY KEY,\n pid INTEGER,\n repost_of INTEGER,\n search TEXT,\n title TEXT,\n price INTEGER,\n hood TEXT,\n lat REAL,\n lon REAL,\n image_ids TEXT,\n thumb_img_id TEXT,\n url TEXT,\n record_created INTEGER,\n status TEXT,\n verdict TEXT,\n score INTEGER,\n reason TEXT,\n flags TEXT,\n dup_of TEXT,\n prompt_len INTEGER,\n queued_at TEXT,\n judged_at TEXT,\n emailed_at TEXT\n )`);\n await run(`CREATE INDEX IF NOT EXISTS posts_pid ON posts (pid)`);\n await run(`CREATE INDEX IF NOT EXISTS posts_repost_of ON posts (repost_of)`);\n await run(`CREATE INDEX IF NOT EXISTS posts_status ON posts (status)`);\n await run(`CREATE TABLE IF NOT EXISTS blocked (\n key TEXT PRIMARY KEY, from_uuid TEXT, reason TEXT, at TEXT)`);\n await run(`CREATE TABLE IF NOT EXISTS feedback (\n uuid TEXT, kind TEXT, reason TEXT, at TEXT)`);\n await run(`CREATE INDEX IF NOT EXISTS feedback_uuid ON feedback (uuid)`);\n}\n\nexport const now = () => new Date().toISOString();\n\nexport interface QueuedInsert {\n uuid: string;\n pid: number | null;\n search: string;\n title: string;\n price: number | null;\n hood: string | null;\n thumbImgId: string | null;\n url: string;\n}\n\nexport async function insertQueued(p: QueuedInsert): Promise<void> {\n await run(\n `INSERT OR IGNORE INTO posts\n (uuid, pid, search, title, price, hood, thumb_img_id, url, status, queued_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'queued', ?)`,\n [p.uuid, p.pid, p.search, p.title, p.price, p.hood, p.thumbImgId, p.url, now()],\n );\n}\n\nexport async function getPost(uuid: string): Promise<Row | null> {\n const rows = await run(`SELECT * FROM posts WHERE uuid = ?`, [uuid]);\n return rows[0] ?? null;\n}\n\nexport async function existsPid(pid: number): Promise<string | null> {\n const rows = await run(`SELECT uuid FROM posts WHERE pid = ? LIMIT 1`, [pid]);\n return rows[0] ? String(rows[0].uuid) : null;\n}\n\n/** Cheap pre-judge check: has this thumbnail already been seen on a post we know about? */\nexport async function existsImage(imgId: string): Promise<string | null> {\n const rows = await run(\n `SELECT uuid FROM posts\n WHERE thumb_img_id = ? OR (image_ids IS NOT NULL AND instr(image_ids, ?) > 0)\n LIMIT 1`,\n [imgId, imgId],\n );\n return rows[0] ? String(rows[0].uuid) : null;\n}\n\nexport async function isBlocked(keys: string[]): Promise<string | null> {\n for (const k of keys) {\n const rows = await run(`SELECT key FROM blocked WHERE key = ?`, [k]);\n if (rows[0]) return k;\n }\n return null;\n}\n\nexport async function addBlocked(keys: string[], fromUuid: string, reason: string | null) {\n for (const k of keys) {\n await run(\n `INSERT INTO blocked (key, from_uuid, reason, at) VALUES (?, ?, ?, ?)\n ON CONFLICT(key) DO UPDATE SET from_uuid = excluded.from_uuid, at = excluded.at`,\n [k, fromUuid, reason, now()],\n );\n }\n}\n\nexport async function listQueued(limit: number): Promise<Row[]> {\n return await run(\n `SELECT * FROM posts WHERE status = 'queued' ORDER BY queued_at ASC LIMIT ?`,\n [limit],\n );\n}\n\n/** The columns the dedup ladder needs, for every post we have already resolved. */\nexport async function dedupRows(limit = 5000): Promise<Row[]> {\n return await run(\n `SELECT uuid, pid, repost_of, image_ids, title, price, lat, lon, verdict, status, dup_of\n FROM posts WHERE status != 'queued' ORDER BY rowid DESC LIMIT ?`,\n [limit],\n );\n}\n\nexport async function updatePost(uuid: string, fields: Record<string, Arg>): Promise<void> {\n const keys = Object.keys(fields);\n if (!keys.length) return;\n await run(\n `UPDATE posts SET ${keys.map((k) => `${k} = ?`).join(\", \")} WHERE uuid = ?`,\n [...keys.map((k) => fields[k]), uuid],\n );\n}\n\n/** A legacy pid-only row becomes a normal row once the 301 gives us its uuid. */\nexport async function renameUuid(oldUuid: string, newUuid: string): Promise<void> {\n await run(`UPDATE posts SET uuid = ? WHERE uuid = ?`, [newUuid, oldUuid]);\n}\n\nexport async function addFeedback(uuid: string, kind: string, reason: string | null) {\n await run(`INSERT INTO feedback (uuid, kind, reason, at) VALUES (?, ?, ?, ?)`, [\n uuid,\n kind,\n reason,\n now(),\n ]);\n}\n\nexport interface Example {\n title: string;\n price: number | null;\n reason: string | null;\n}\n\n/** Few-shot examples for the judge: what he rejected (or liked) on this saved search. */\nexport async function feedbackExamples(\n search: string,\n kind: \"nope\" | \"yes\",\n limit: number,\n): Promise<Example[]> {\n const rows = await run(\n `SELECT p.title AS title, p.price AS price,\n COALESCE(f.reason, p.reason) AS reason\n FROM feedback f JOIN posts p ON p.uuid = f.uuid\n WHERE f.kind = ? AND p.search = ?\n ORDER BY f.at DESC LIMIT ?`,\n [kind, search, limit],\n );\n return rows.map((r) => ({\n title: String(r.title ?? \"\"),\n price: r.price === null ? null : Number(r.price),\n reason: r.reason === null ? null : String(r.reason),\n }));\n}\n\nexport async function dumpTables(limit = 50): Promise<Record<string, Row[]>> {\n return {\n posts: await run(`SELECT * FROM posts ORDER BY rowid DESC LIMIT ?`, [limit]),\n blocked: await run(`SELECT * FROM blocked ORDER BY rowid DESC LIMIT ?`, [limit]),\n feedback: await run(`SELECT * FROM feedback ORDER BY rowid DESC LIMIT ?`, [limit]),\n };\n}\n\nexport async function hasFeedback(uuid: string, kind: string): Promise<boolean> {\n const rows = await run(`SELECT 1 AS x FROM feedback WHERE uuid = ? AND kind = ? LIMIT 1`, [\n uuid,\n kind,\n ]);\n return rows.length > 0;\n}\n\nexport async function setFeedbackReason(uuid: string, kind: string, reason: string) {\n await run(`UPDATE feedback SET reason = ? WHERE uuid = ? AND kind = ?`, [reason, uuid, kind]);\n}\n",[],[177,268],"6e14e58e-00b1-41ec-864c-999505d71ef6","cl.ts","e81f36d4-ace8-11f1-81ba-1607ee4eb77e",8,["D",1789025175111],"/**\n * Craigslist access. Etiquette rules baked in, all from research/craigslist-mechanics.md:\n * - browser-like User-Agent, GET only (images.craigslist.org answers 405 to HEAD)\n * - never ?format=rss (403 + block page; the parameter itself is a bot signal)\n * - never touch /reply or /flag (robots.txt Disallow)\n * - if a body ever contains <title>blocked, log the blockID and STOP. Do not retry,\n * do not change egress. Evading a block is the fact that turns scraping into CFAA exposure.\n * Volume here is ~1 detail call + <=5 images per alerted post, three orders of magnitude\n * under craigslist's own written 1,000-pages/24h budget.\n */\n\nconst UA =\n \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\";\n\nexport class BlockedError extends Error {\n constructor(public blockID: string, public url: string) {\n super(`craigslist block page (blockID=${blockID}) for ${url}`);\n this.name = \"BlockedError\";\n }\n}\n\nfunction assertNotBlocked(body: string, url: string) {\n if (/\\s*blocked\\s*<\\/title>/i.test(body)) {\n const m = body.match(/blockID[=:]\\s*(\\d+)/i);\n throw new BlockedError(m ? m[1] : \"unknown\", url);\n }\n}\n\nasync function get(url: string, timeoutMs: number, accept: string): Promise<Response> {\n return await fetch(url, {\n method: \"GET\",\n redirect: \"follow\",\n headers: { \"User-Agent\": UA, \"Accept\": accept, \"Accept-Language\": \"en-US,en;q=0.9\" },\n signal: AbortSignal.timeout(timeoutMs),\n });\n}\n\nexport interface DetailItem {\n postingId: number;\n postingUuid: string;\n repostOf?: number;\n recordCreated?: number;\n postedDate?: number;\n updatedDate?: number;\n images?: string[];\n title?: string;\n price?: number;\n priceString?: string;\n body?: string;\n category?: string;\n categoryId?: number;\n attributes?: { label?: string; value?: string }[];\n notices?: unknown[];\n location?: { lat?: number; lon?: number; neighborhood?: string; area?: string };\n url?: string;\n}\n\n/** GET sapi detail. Returns status 404 with item null for a post that is gone. */\nexport async function fetchDetail(\n uuid: string,\n timeoutMs = 10_000,\n): Promise<{ status: number; item: DetailItem | null }> {\n const url = `https://sapi.craigslist.org/web/v8/postings/${\n encodeURIComponent(uuid)\n }?cc=US&lang=en`;\n const res = await get(url, timeoutMs, \"application/json\");\n const text = await res.text();\n assertNotBlocked(text, url);\n if (res.status === 404) return { status: 404, item: null };\n if (!res.ok) return { status: res.status, item: null };\n const json = JSON.parse(text);\n const item = json?.data?.items?.[0] ?? null;\n return { status: res.status, item };\n}\n\n/**\n * Legacy alert rows carry only a numeric post id. The old numeric URL 301s to the\n * /view/d/<slug>/<uuid> form, so the redirect is the pid -> uuid oracle. A deleted or\n * expired post 404s here with no redirect.\n */\nexport async function resolveUuid(\n legacyUrl: string,\n timeoutMs = 10_000,\n): Promise<{ status: number; uuid: string | null }> {\n const res = await get(legacyUrl, timeoutMs, \"text/html\");\n const text = await res.text();\n assertNotBlocked(text, legacyUrl);\n if (!res.ok) return { status: res.status, uuid: null };\n const m = res.url.match(/\\/view\\/d\\/[^/]+\\/([A-Za-z0-9]{15,30})/) ??\n text.match(/rel=\"canonical\"[^>]*\\/view\\/d\\/[^/]+\\/([A-Za-z0-9]{15,30})/);\n return { status: res.status, uuid: m ? m[1] : null };\n}\n\n/** \"3:00U0U_ixFsruu1I5I_0ak07K\" -> the fetchable URL at the given size box. */\nexport function imageUrl(rawId: string, size = \"600x450\"): string {\n return `https://images.craigslist.org/${rawId.replace(/^\\d+:/, \"\")}_${size}.jpg`;\n}\n\nfunction toBase64(bytes: Uint8Array): string {\n let s = \"\";\n const chunk = 0x8000;\n for (let i = 0; i < bytes.length; i += chunk) {\n s += String.fromCharCode(...bytes.subarray(i, i + chunk));\n }\n return btoa(s);\n}\n\n/** Fetches one image and base64s it in memory. Never persisted — the storage quota is 10 MB. */\nexport async function fetchImageBase64(\n rawId: string,\n size = \"600x450\",\n timeoutMs = 10_000,\n): Promise<{ mediaType: string; data: string } | null> {\n const url = imageUrl(rawId, size);\n const res = await get(url, timeoutMs, \"image/*\");\n if (!res.ok) return null;\n const ct = res.headers.get(\"content-type\") ?? \"\";\n if (!ct.startsWith(\"image/\")) return null;\n const buf = new Uint8Array(await res.arrayBuffer());\n if (buf.length === 0) return null;\n return { mediaType: ct.split(\";\")[0].trim(), data: toBase64(buf) };\n}\n\n/** Strip the HTML craigslist puts in `body`, so the judge reads plain text. */\nexport function bodyText(html: string | undefined, max = 4000): string {\n if (!html) return \"\";\n return html\n .replace(/<showcontactinfo[^>]*>.*?<\\/showcontactinfo>/gis, \"[contact info]\")\n .replace(/<br\\s*\\/?>/gi, \"\\n\")\n .replace(/<[^>]+>/g, \"\")\n .replace(/ /g, \" \")\n .replace(/&/g, \"&\")\n .replace(/</g, \"<\")\n .replace(/>/g, \">\")\n .replace(/"/g, '\"')\n .replace(/'/g, \"'\")\n .replace(/\\n{3,}/g, \"\\n\\n\")\n .trim()\n .slice(0, max);\n}\n",[],[177,276],["D",1789025174616],[194,195,196,197,198,199,200],[177],["D",1789025029995],["D",1789459281818],{"_97":96,"_104":100},{"_97":96,"_98":-5,"_99":100,"_18":52,"_101":102,"_103":24},{"_13":86,"_31":87,"_40":39,"_88":41,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":42,"_95":96},"ctx",{"_79":-5,"_123":324,"_325":326,"_327":328,"_329":24,"_330":24,"_331":24,"_332":56,"_333":-5,"_334":-7,"_335":-7,"_336":60,"_337":24,"_338":24,"_339":-5,"_340":24,"_341":24,"_342":24,"_343":-5},"ENV",{"_295":296,"_297":298,"_299":87,"_300":301,"_302":303,"_304":305,"_306":307,"_308":309,"_310":311,"_312":313,"_314":315,"_316":317,"_318":319,"_320":321,"_322":323},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"] </article></body></html>

Diff · v14