\n * <post url>\n * - $10 (santa rosa)\n *\n * The price line is optional (free items have none) and the parenthesised neighbourhood\n * is optional too; a free item may carry only the parenthesised location.\n *\n * Two URL shapes exist. Craigslist switched on 2026-07-02:\n * new: https://www.craigslist.org/view/d/<slug>/<uuid>\n * legacy: https://sfbay.craigslist.org/eby/hsh/d/<slug>/<pid>.html\n * Legacy rows carry a numeric post id and no uuid; the judge resolves the uuid later by\n * following the 301 on the old URL.\n */\n\nexport interface ParsedResult {\n uuid: string | null;\n pid: number | null;\n slug: string;\n title: string;\n price: number | null;\n hood: string | null;\n /** The 11-char image identity from the alert's _300x300 thumbnail, when there is one. */\n thumbImgId: string | null;\n url: string;\n}\n\nexport interface ParsedAlert {\n /** Saved-search name, lowercased — this is the key criteria are stored under. */\n search: string;\n /** N from \"(N new results)\", or null if the subject did not parse. */\n count: number | null;\n results: ParsedResult[];\n}\n\nconst NEW_URL =\n /https?:\\/\\/(?:www\\.)?craigslist\\.org\\/view\\/d\\/([^/\\s\"'<>]+)\\/([A-Za-z0-9]{15,30})/;\nconst LEGACY_URL =\n /https?:\\/\\/[a-z0-9.-]*craigslist\\.org\\/(?:[a-z0-9]+\\/)*d\\/([^/\\s\"'<>]+)\\/(\\d{6,})\\.html/;\nconst THUMB = /images\\.craigslist\\.org\\/[0-9A-Za-z]+_([0-9A-Za-z]{8,14})_[0-9A-Za-z]+_\\d+x\\d+\\.jpg/;\n\n/** \"(2 new results) sewing machine\" -> {count: 2, search: \"sewing machine\"} */\nexport function parseSubject(\n subject: string | undefined,\n): { count: number; search: string } | null {\n if (!subject) return null;\n const m = subject.match(/\$(\\d+)\\s+new\\s+results?\$\\s*(.+)$/i);\n if (!m) return null;\n const search = m[2].trim().toLowerCase();\n if (!search) return null;\n return { count: Number(m[1]), search };\n}\n\n/** Identity key for a result: the uuid when we have one, otherwise \"pid:<n>\". */\nexport function resultKey(r: { uuid: string | null; pid: number | null }): string {\n return r.uuid ?? `pid:${r.pid}`;\n}\n\nexport function parseAlert(\n subject: string | undefined,\n text: string | undefined,\n html: string | undefined,\n): ParsedAlert {\n const sub = parseSubject(subject);\n const results = text ? parseTextPart(text) : [];\n const thumbs = html ? thumbnailsByKey(html) : new Map<string, string>();\n for (const r of results) {\n r.thumbImgId = thumbs.get(resultKey(r)) ?? null;\n }\n return { search: sub?.search ?? \"\", count: sub?.count ?? null, results };\n}\n\nfunction parseTextPart(text: string): ParsedResult[] {\n const out: ParsedResult[] = [];\n const seen = new Set<string>();\n let title: string | null = null;\n let block: string[] = [];\n\n const flush = () => {\n if (title) {\n const r = blockToResult(title, block);\n if (r && !seen.has(resultKey(r))) {\n seen.add(resultKey(r));\n out.push(r);\n }\n }\n title = null;\n block = [];\n };\n\n for (const raw of text.split(/\\r?\\n/)) {\n const sep = raw.match(/^={5,}\\s*(.*)$/);\n if (sep) {\n flush();\n title = sep[1].trim() || null;\n } else if (title) {\n block.push(raw.trim());\n }\n }\n flush();\n return out;\n}\n\nfunction blockToResult(title: string, lines: string[]): ParsedResult | null {\n let uuid: string | null = null;\n let pid: number | null = null;\n let slug = \"\";\n let url = \"\";\n\n for (const line of lines) {\n const nu = line.match(NEW_URL);\n if (nu) {\n slug = nu[1];\n uuid = nu[2];\n url = nu[0];\n break;\n }\n const lu = line.match(LEGACY_URL);\n if (lu) {\n slug = lu[1];\n pid = Number(lu[2]);\n url = lu[0];\n break;\n }\n }\n if (!url) return null;\n\n let price: number | null = null;\n let hood: string | null = null;\n for (const line of lines) {\n const p = line.match(/^-\\s*\\$([\\d,]+)(?:\\s*\$(.+)\$)?\\s*$/);\n if (p) {\n price = Number(p[1].replace(/,/g, \"\"));\n hood = p[2]?.trim() || null;\n break;\n }\n const h = line.match(/^\$(.+)\$\\s*$/);\n if (h) {\n hood = h[1].trim();\n break;\n }\n }\n\n return { uuid, pid, slug, title, price, hood, thumbImgId: null, url };\n}\n\n/**\n * Thumbnail image ids from the HTML part, matched to results by document order: each\n * <img> belongs to the most recent post link above it, which is how the alert is laid out\n * (the thumbnail is wrapped in a second anchor to the same post).\n */\nfunction thumbnailsByKey(html: string): Map<string, string> {\n const combined = new RegExp(\n `(?:${NEW_URL.source})|(?:${LEGACY_URL.source})|(?:${THUMB.source})`,\n \"g\",\n );\n const map = new Map<string, string>();\n let current: string | null = null;\n for (const m of html.matchAll(combined)) {\n // groups: 1,2 = new slug/uuid 3,4 = legacy slug/pid 5 = thumbnail image id\n if (m[2]) current = m[2];\n else if (m[4]) current = `pid:${Number(m[4])}`;\n else if (m[5] && current && !map.has(current)) map.set(current, m[5]);\n }\n return map;\n}\n","/**\n * Parsing of Craigslist saved-search alert emails. Pure: no I/O, no Val Town imports,\n * so it is unit-testable against the fixtures in test/fixtures/.\n *\n * Shape of the plain-text part (the authoritative one — it survives Gmail's forward\n * wrapping better than the HTML):\n *\n * =========================================================== <title>\n * <post url>\n * - $10 (santa rosa)\n *\n * The price line is optional (free items have none) and the parenthesised neighbourhood\n * is optional too; a free item may carry only the parenthesised location.\n *\n * Two URL shapes exist. Craigslist switched on 2026-07-02:\n * new: https://www.craigslist.org/view/d/<slug>/<uuid>\n * legacy: https://sfbay.craigslist.org/eby/hsh/d/<slug>/<pid>.html\n * Legacy rows carry a numeric post id and no uuid; the judge resolves the uuid later by\n * following the 301 on the old URL.\n */\n\nexport interface ParsedResult {\n uuid: string | null;\n pid: number | null;\n slug: string;\n title: string;\n price: number | null;\n hood: string | null;\n /** The 11-char image identity from the alert's _300x300 thumbnail, when there is one. */\n thumbImgId: string | null;\n url: string;\n}\n\nexport interface ParsedAlert {\n /** Saved-search name, lowercased — this is the key criteria are stored under. */\n search: string;\n /** N from \"(N new results)\", or null if the subject did not parse. */\n count: number | null;\n results: ParsedResult[];\n}\n\nconst NEW_URL =\n /https?:\\/\\/(?:www\\.)?craigslist\\.org\\/view\\/d\\/([^/\\s\"'<>]+)\\/([A-Za-z0-9]{15,30})/;\nconst LEGACY_URL =\n /https?:\\/\\/[a-z0-9.-]*craigslist\\.org\\/(?:[a-z0-9]+\\/)*d\\/([^/\\s\"'<>]+)\\/(\\d{6,})\\.html/;\nconst THUMB = /images\\.craigslist\\.org\\/[0-9A-Za-z]+_([0-9A-Za-z]{8,14})_[0-9A-Za-z]+_\\d+x\\d+\\.jpg/;\n\n/** \"(2 new results) some saved search\" -> {count: 2, search: \"some saved search\"} */\nexport function parseSubject(\n subject: string | undefined,\n): { count: number; search: string } | null {\n if (!subject) return null;\n const m = subject.match(/\$(\\d+)\\s+new\\s+results?\$\\s*(.+)$/i);\n if (!m) return null;\n const search = m[2].trim().toLowerCase();\n if (!search) return null;\n return { count: Number(m[1]), search };\n}\n\n/** Identity key for a result: the uuid when we have one, otherwise \"pid:<n>\". */\nexport function resultKey(r: { uuid: string | null; pid: number | null }): string {\n return r.uuid ?? `pid:${r.pid}`;\n}\n\nexport function parseAlert(\n subject: string | undefined,\n text: string | undefined,\n html: string | undefined,\n): ParsedAlert {\n const sub = parseSubject(subject);\n const results = text ? parseTextPart(text) : [];\n const thumbs = html ? thumbnailsByKey(html) : new Map<string, string>();\n for (const r of results) {\n r.thumbImgId = thumbs.get(resultKey(r)) ?? null;\n }\n return { search: sub?.search ?? \"\", count: sub?.count ?? null, results };\n}\n\nfunction parseTextPart(text: string): ParsedResult[] {\n const out: ParsedResult[] = [];\n const seen = new Set<string>();\n let title: string | null = null;\n let block: string[] = [];\n\n const flush = () => {\n if (title) {\n const r = blockToResult(title, block);\n if (r && !seen.has(resultKey(r))) {\n seen.add(resultKey(r));\n out.push(r);\n }\n }\n title = null;\n block = [];\n };\n\n for (const raw of text.split(/\\r?\\n/)) {\n const sep = raw.match(/^={5,}\\s*(.*)$/);\n if (sep) {\n flush();\n title = sep[1].trim() || null;\n } else if (title) {\n block.push(raw.trim());\n }\n }\n flush();\n return out;\n}\n\nfunction blockToResult(title: string, lines: string[]): ParsedResult | null {\n let uuid: string | null = null;\n let pid: number | null = null;\n let slug = \"\";\n let url = \"\";\n\n for (const line of lines) {\n const nu = line.match(NEW_URL);\n if (nu) {\n slug = nu[1];\n uuid = nu[2];\n url = nu[0];\n break;\n }\n const lu = line.match(LEGACY_URL);\n if (lu) {\n slug = lu[1];\n pid = Number(lu[2]);\n url = lu[0];\n break;\n }\n }\n if (!url) return null;\n\n let price: number | null = null;\n let hood: string | null = null;\n for (const line of lines) {\n const p = line.match(/^-\\s*\\$([\\d,]+)(?:\\s*\$(.+)\$)?\\s*$/);\n if (p) {\n price = Number(p[1].replace(/,/g, \"\"));\n hood = p[2]?.trim() || null;\n break;\n }\n const h = line.match(/^\$(.+)\$\\s*$/);\n if (h) {\n hood = h[1].trim();\n break;\n }\n }\n\n return { uuid, pid, slug, title, price, hood, thumbImgId: null, url };\n}\n\n/**\n * Thumbnail image ids from the HTML part, matched to results by document order: each\n * <img> belongs to the most recent post link above it, which is how the alert is laid out\n * (the thumbnail is wrapped in a second anchor to the same post).\n */\nfunction thumbnailsByKey(html: string): Map<string, string> {\n const combined = new RegExp(\n `(?:${NEW_URL.source})|(?:${LEGACY_URL.source})|(?:${THUMB.source})`,\n \"g\",\n );\n const map = new Map<string, string>();\n let current: string | null = null;\n for (const m of html.matchAll(combined)) {\n // groups: 1,2 = new slug/uuid 3,4 = legacy slug/pid 5 = thumbnail image id\n if (m[2]) current = m[2];\n else if (m[4]) current = `pid:${Number(m[4])}`;\n else if (m[5] && current && !map.has(current)) map.set(current, m[5]);\n }\n return map;\n}\n","createdAt",["D",1789025748365],"branchVersion","branchId","19036aae-467e-44f0-962d-88964ddc5361","id","c358f270-b3fc-477f-a942-c58f7915cb3d","cl-triage",["D",1789025029995],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","019bcf70-5321-758b-8dfa-2be50f1fc9fb","pinnedFileId","e7e3fae2-ace8-11f1-8828-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019bcf70-5321-758b-8dfa-2ea07f250c13","tursoName","c358f270b3fc477fa942c58f7915cb3d","tursoHostname","c358f270b3fc477fa942c58f7915cb3d-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789546246980],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_101":100,"_108":104},"org",{"_101":100,"_102":-5,"_103":104,"_18":56,"_105":106,"_107":25},"branch",{"_13":90,"_32":91,"_44":43,"_92":45,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":46,"_99":100},"isOwned",62,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","herschelrs","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18zOFBxeE4yTklpRW16aUxzZzlSaTZRa3BWN0wifQ","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_44":45,"_32":46,"_39":301,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":302,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":303,"_85":304,"_87":305,"_89":25},"tree",[209,217,218,219,220,221,222,223],"files",[209,210,211,212,213,214,215,216,217,218,219,220,221,222,223],"counts",{"_199":64,"_200":155,"_201":64,"_202":203,"_204":205},"contents",[130,131,132,133,134,135,136,137],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_44":193,"_32":194,"_30":195,"_141":-5,"_42":43,"_41":155,"_143":60,"_39":196,"_13":64,"_34":197,"_36":-5,"_24":25,"_148":-5,"_27":198},{"_44":186,"_32":187,"_30":188,"_141":-5,"_42":43,"_41":189,"_143":60,"_39":190,"_13":64,"_34":20,"_36":191,"_24":25,"_148":-5,"_27":192},{"_44":180,"_32":181,"_30":182,"_141":-5,"_42":43,"_41":145,"_143":25,"_39":183,"_13":64,"_34":20,"_36":184,"_24":25,"_148":-5,"_27":185},{"_44":173,"_32":174,"_30":175,"_141":-5,"_42":43,"_41":176,"_143":25,"_39":177,"_13":64,"_34":20,"_36":178,"_24":25,"_148":-5,"_27":179},{"_44":166,"_32":167,"_30":168,"_141":-5,"_42":43,"_41":169,"_143":25,"_39":170,"_13":64,"_34":20,"_36":171,"_24":25,"_148":-5,"_27":172},{"_44":159,"_32":160,"_30":58,"_141":-5,"_42":43,"_41":161,"_143":25,"_39":162,"_13":64,"_34":163,"_36":164,"_24":25,"_148":-5,"_27":165},{"_44":150,"_32":151,"_30":152,"_141":-5,"_42":43,"_41":153,"_143":25,"_39":154,"_13":155,"_34":156,"_36":157,"_24":25,"_148":-5,"_27":158},{"_44":138,"_32":139,"_30":140,"_141":-5,"_42":43,"_41":142,"_143":25,"_39":144,"_13":145,"_34":146,"_36":147,"_24":25,"_148":-5,"_27":149},"401f4262-d948-486e-bab9-083a93afe60f","judge.cron.tsx","e81164fa-ace8-11f1-b8ae-1607ee4eb77e","parentId",23,"latest",["D",1789025514185],3,"interval","/**\n * [2] The judge. Drains the queue the email handler filled.\n *\n * Budget: Val Town's free tier kills a run at 60 s, and *repeated* overruns temporarily pause\n * the val — so this keeps a 40 s deadline of its own, stops picking up posts once it is past,\n * and never takes more than MAX_POSTS in one run. Every outbound fetch carries its own\n * AbortSignal.timeout.\n *\n * Per post: one sapi detail call, the dedup ladder, then (only if it is genuinely new) up to\n * five images and exactly one LLM call. Good verdicts from one run go out as a single email.\n */\nimport {\n BlockedError,\n bodyText,\n fetchDetail,\n fetchImageBase64,\n imageUrl,\n resolveUuid,\n} from \"./lib/cl.ts\";\nimport * as db from \"./lib/db.ts\";\nimport { type DedupRow, findDuplicate, imageIdentity } from \"./lib/dedup.ts\";\nimport {\n buildSystem,\n buildUserText,\n criteriaFor,\n DEFAULT_MODEL,\n judge,\n loadCriteria,\n type Verdict,\n} from \"./lib/llm.ts\";\nimport { type DigestItem, feedbackLink, sendDigest } from \"./lib/mail.ts\";\nimport { sign } from \"./lib/sign.ts\";\n\nconst MAX_POSTS = 4;\nconst RUN_DEADLINE_MS = 40_000;\nconst MAX_IMAGES = 5;\nconst NOPE_EXAMPLES = 10;\nconst YES_EXAMPLES = 5;\n\nexport default async function (): Promise<void> {\n const started = Date.now();\n const left = () => RUN_DEADLINE_MS - (Date.now() - started);\n\n await db.init();\n const queue = await db.listQueued(MAX_POSTS);\n console.log(\"RUN\", JSON.stringify({ queued: queue.length, max: MAX_POSTS }));\n if (!queue.length) return;\n\n const apiKey = Deno.env.get(\"ANTHROPIC_API_KEY\") ?? \"\";\n const dryRun = !apiKey;\n const sendInDryRun = Deno.env.get(\"SEND_IN_DRY_RUN\") === \"1\";\n const model = Deno.env.get(\"JUDGE_MODEL\") || DEFAULT_MODEL;\n const criteria = loadCriteria(Deno.env.get(\"CRITERIA_JSON\"));\n if (!Deno.env.get(\"CRITERIA_JSON\")) console.log(\"CRITERIA_JSON unset — built-in default only\");\n if (dryRun) console.log(\"DRY_RUN: ANTHROPIC_API_KEY unset, no LLM call will be made\");\n\n const digest: DigestItem[] = [];\n\n for (const row of queue) {\n if (left() <= 8000) {\n console.log(\"DEADLINE\", JSON.stringify({ msLeft: left(), stoppedBefore: row.uuid }));\n break;\n }\n try {\n const item = await handleOne(row, { apiKey, dryRun, sendInDryRun, model, criteria });\n if (item) digest.push(item);\n } catch (err) {\n if (err instanceof BlockedError) {\n // Craigslist blocked us. Stop the run. Do not retry and do not change egress:\n // evading a block is the fact that turns scraping into a legal problem.\n console.error(\"BLOCKED_BY_CL\", JSON.stringify({ blockID: err.blockID, url: err.url }));\n await db.updatePost(String(row.uuid), {\n status: \"blocked_by_cl\",\n reason: `blockID=${err.blockID}`,\n });\n break;\n }\n console.error(\"POST_ERROR\", String(row.uuid), String(err));\n await db.updatePost(String(row.uuid), {\n status: \"error\",\n reason: String(err).slice(0, 200),\n });\n }\n }\n\n if (digest.length) {\n await sendDigest(digest);\n for (const it of digest) await db.updatePost(it.uuid, { emailed_at: db.now() });\n console.log(\n \"EMAILED\",\n JSON.stringify({ count: digest.length, uuids: digest.map((d) => d.uuid) }),\n );\n }\n console.log(\"DONE\", JSON.stringify({ ms: Date.now() - started, emailed: digest.length }));\n}\n\ninterface Cfg {\n apiKey: string;\n dryRun: boolean;\n sendInDryRun: boolean;\n model: string;\n criteria: ReturnType<typeof loadCriteria>;\n}\n\nasync function handleOne(row: db.Row, cfg: Cfg): Promise<DigestItem | null> {\n let uuid = String(row.uuid);\n const search = String(row.search ?? \"\");\n\n // Legacy pid-only rows: the old numeric URL 301s to the /view/d/<slug>/<uuid> form, which\n // is the only pid -> uuid oracle there is (the uuid is a random 128-bit token).\n if (uuid.startsWith(\"pid:\")) {\n const res = await resolveUuid(String(row.url), 10_000);\n if (res.status === 404) {\n await db.updatePost(uuid, { status: \"gone\", judged_at: db.now() });\n console.log(\"GONE\", JSON.stringify({ key: uuid, via: \"legacy-404\" }));\n return null;\n }\n if (!res.uuid) throw new Error(`no uuid from redirect (status ${res.status})`);\n const existing = await db.getPost(res.uuid);\n if (existing) {\n await db.updatePost(uuid, {\n status: \"dup\",\n dup_of: res.uuid,\n verdict: existing.verdict,\n score: existing.score,\n reason: existing.reason,\n judged_at: db.now(),\n });\n console.log(\"DUP\", JSON.stringify({ key: uuid, dupOf: res.uuid, rule: \"resolved-uuid\" }));\n return null;\n }\n await db.renameUuid(uuid, res.uuid);\n console.log(\"RESOLVED\", JSON.stringify({ from: uuid, to: res.uuid }));\n uuid = res.uuid;\n }\n\n const { status, item } = await fetchDetail(uuid, 10_000);\n if (status === 404 || !item) {\n if (status === 404) {\n await db.updatePost(uuid, { status: \"gone\", judged_at: db.now() });\n console.log(\"GONE\", JSON.stringify({ uuid }));\n return null;\n }\n throw new Error(`sapi status ${status}`);\n }\n if (item.notices?.length) {\n console.log(\"NOTICES\", JSON.stringify({ uuid, notices: item.notices }));\n }\n\n const images = item.images ?? [];\n const lat = item.location?.lat ?? null;\n const lon = item.location?.lon ?? null;\n const hood = item.location?.neighborhood || (row.hood === null ? null : String(row.hood));\n\n await db.updatePost(uuid, {\n pid: item.postingId ?? null,\n repost_of: item.repostOf ?? null,\n title: item.title ?? String(row.title ?? \"\"),\n price: item.price ?? (row.price === null ? null : Number(row.price)),\n hood,\n lat,\n lon,\n image_ids: images.join(\",\"),\n record_created: item.recordCreated ?? null,\n url: item.url ?? String(row.url ?? \"\"),\n status: \"fetched\",\n });\n\n // Anything he has already said no to, in any of its forms.\n const blockKeys = [\n `pid:${item.postingId}`,\n ...(item.repostOf ? [`pid:${item.repostOf}`] : []),\n ...images.map((i) => `img:${imageIdentity(i)}`),\n ];\n const blockedBy = await db.isBlocked(blockKeys);\n if (blockedBy) {\n await db.updatePost(uuid, {\n status: \"rejected\",\n verdict: \"bad\",\n score: 0,\n reason: `blocked by earlier nope (${blockedBy})`,\n judged_at: db.now(),\n });\n console.log(\"BLOCKED\", JSON.stringify({ uuid, key: blockedBy }));\n return null;\n }\n\n const cand: DedupRow = {\n uuid,\n pid: item.postingId ?? null,\n repostOf: item.repostOf ?? null,\n imageIds: images,\n title: item.title ?? \"\",\n price: item.price ?? null,\n lat,\n lon,\n };\n const known = (await db.dedupRows()).map(toDedupRow);\n const dup = findDuplicate(cand, known);\n if (dup) {\n // Follow any dup_of chain to the row that actually carries the verdict. Without this a\n // post can be marked a duplicate of a row that is itself a duplicate of this post.\n const canonical = await canonicalUuid(dup.uuid, uuid);\n if (canonical === uuid) {\n console.log(\"DUP_SELF\", JSON.stringify({ uuid, matched: dup.uuid, rule: dup.rule }));\n } else {\n return await markDup(uuid, canonical, dup.rule);\n }\n }\n\n // Only now, for a post we have never judged, do we spend images and a model call.\n const picked = images.slice(0, MAX_IMAGES);\n const fetched: { mediaType: string; data: string }[] = [];\n for (const raw of picked) {\n const img = await fetchImageBase64(raw, \"600x450\", 10_000);\n if (img) fetched.push(img);\n }\n\n const { prompt, fellBack } = criteriaFor(cfg.criteria, search);\n if (fellBack) console.log(\"CRITERIA_FALLBACK\", JSON.stringify({ search, uuid }));\n const nopes = await db.feedbackExamples(search, \"nope\", NOPE_EXAMPLES);\n const yeses = await db.feedbackExamples(search, \"yes\", YES_EXAMPLES);\n const system = buildSystem(prompt, nopes, yeses);\n const userText = buildUserText({\n title: item.title ?? \"\",\n priceString: item.priceString ?? null,\n hood,\n body: bodyText(item.body),\n attributes: (item.attributes ?? []).map((a) => `${a.label ?? \"\"}: ${a.value ?? \"\"}`),\n category: item.category ?? null,\n postedIso: iso(item.postedDate),\n createdIso: iso(item.recordCreated),\n search,\n });\n\n let verdict: Verdict;\n if (cfg.dryRun) {\n const promptLen = system.length + userText.length;\n verdict = {\n verdict: \"meh\",\n score: 0,\n reason: `DRY_RUN: no ANTHROPIC_API_KEY (prompt ${promptLen} chars, ${fetched.length} images)`,\n flags: [\"dry\"],\n };\n await db.updatePost(uuid, {\n status: \"judged\",\n verdict: \"dry\",\n score: 0,\n reason: verdict.reason,\n flags: \"dry\",\n prompt_len: promptLen,\n judged_at: db.now(),\n });\n console.log(\n \"DRY\",\n JSON.stringify({ uuid, promptLen, images: fetched.length, title: item.title }),\n );\n if (!cfg.sendInDryRun) return null;\n } else {\n verdict = await judge({\n apiKey: cfg.apiKey,\n model: cfg.model,\n system,\n userText,\n images: fetched,\n timeoutMs: 30_000,\n });\n await db.updatePost(uuid, {\n status: \"judged\",\n verdict: verdict.verdict,\n score: verdict.score,\n reason: verdict.reason,\n flags: verdict.flags.join(\",\"),\n prompt_len: system.length + userText.length,\n judged_at: db.now(),\n });\n console.log(\n \"JUDGED\",\n JSON.stringify({\n uuid,\n verdict: verdict.verdict,\n score: verdict.score,\n images: fetched.length,\n title: item.title,\n }),\n );\n if (verdict.verdict !== \"good\") return null;\n }\n\n return await digestItem(uuid, item, hood, verdict, picked[0] ?? null);\n}\n\n/**\n * Walk dup_of to the row that actually holds the verdict. `self` is the post being judged:\n * if the chain leads back to it, the match is circular and there is no duplicate.\n */\nasync function canonicalUuid(start: string, self: string): Promise<string> {\n let cur = start;\n for (let i = 0; i < 4; i++) {\n const row = await db.getPost(cur);\n const next = row?.dup_of ? String(row.dup_of) : null;\n if (!next || next === cur) return cur;\n if (next === self) return self;\n cur = next;\n }\n return cur;\n}\n\nasync function markDup(uuid: string, dupOf: string, rule: string): Promise<null> {\n const orig = await db.getPost(dupOf);\n await db.updatePost(uuid, {\n status: \"dup\",\n dup_of: dupOf,\n verdict: orig?.verdict ?? null,\n score: orig?.score ?? null,\n reason: `duplicate of ${dupOf} (${rule})`,\n judged_at: db.now(),\n });\n console.log(\"DUP\", JSON.stringify({ uuid, dupOf, rule }));\n return null;\n}\n\nasync function digestItem(\n uuid: string,\n item: { title?: string; priceString?: string; url?: string },\n hood: string | null,\n verdict: Verdict,\n firstImage: string | null,\n): Promise<DigestItem> {\n const secret = Deno.env.get(\"FEEDBACK_SECRET\") ?? \"\";\n const base = await feedbackBase();\n let nopeUrl: string | null = null;\n let yesUrl: string | null = null;\n if (secret && base) {\n nopeUrl = feedbackLink(base, uuid, \"nope\", await sign(secret, uuid, \"nope\"));\n yesUrl = feedbackLink(base, uuid, \"yes\", await sign(secret, uuid, \"yes\"));\n } else {\n console.log(\"NO_FEEDBACK_LINKS\", JSON.stringify({ hasSecret: !!secret, base }));\n }\n return {\n uuid,\n title: item.title ?? \"\",\n priceString: item.priceString ?? null,\n hood,\n score: verdict.score,\n reason: verdict.reason,\n flags: verdict.flags,\n url: item.url ?? `https://www.craigslist.org/view/d/x/${uuid}`,\n imageUrl: firstImage ? imageUrl(firstImage, \"600x450\") : null,\n nopeUrl,\n yesUrl,\n };\n}\n\n/**\n * The feedback endpoint's own URL, for the buttons in the digest.\n *\n * Zero-config by default: Val Town injects VALTOWN_ENTRYPOINT (which names the user and the\n * val) and an API token, so the endpoint can be looked up at runtime and cached for the life\n * of the isolate. Set FEEDBACK_URL to skip the lookup. There is no VAL_URL variable in the\n * runtime — checked, the injected names are VALTOWN_ENTRYPOINT / VALTOWN_API_URL / valtown.\n */\nlet cachedBase: string | null | undefined;\n\nasync function feedbackBase(): Promise<string | null> {\n const explicit = Deno.env.get(\"FEEDBACK_URL\");\n if (explicit) return explicit.replace(/\\/$/, \"\");\n if (cachedBase !== undefined) return cachedBase;\n cachedBase = await discoverFeedbackUrl();\n return cachedBase;\n}\n\nasync function discoverFeedbackUrl(): Promise<string | null> {\n const token = Deno.env.get(\"valtown\") ?? Deno.env.get(\"VAL_TOWN_API_KEY\");\n const entry = Deno.env.get(\"VALTOWN_ENTRYPOINT\") ?? \"\";\n const m = entry.match(/esm\\.town\\/v\\/([^/]+)\\/([^/@]+)/);\n if (!token || !m) return null;\n const auth = { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) };\n try {\n const valRes = await fetch(`https://api.val.town/v2/alias/vals/${m[1]}/${m[2]}`, auth);\n if (!valRes.ok) return null;\n const valId = (await valRes.json())?.id;\n if (!valId) return null;\n const fileRes = await fetch(\n `https://api.val.town/v2/vals/${valId}/files?path=feedback.http.tsx`,\n auth,\n );\n if (!fileRes.ok) return null;\n const endpoint = (await fileRes.json())?.data?.[0]?.links?.endpoint;\n return typeof endpoint === \"string\" ? endpoint : null;\n } catch (e) {\n console.error(\"FEEDBACK_URL_DISCOVERY_FAILED\", String(e));\n return null;\n }\n}\n\n/** Exported so the deploy-time harness can prove the discovery path works. */\nexport { feedbackBase };\n\nfunction iso(epoch: number | undefined): string | null {\n return epoch ? new Date(epoch * 1000).toISOString().slice(0, 16).replace(\"T\", \" \") : null;\n}\n\nfunction toDedupRow(r: db.Row): DedupRow {\n return {\n uuid: String(r.uuid),\n pid: r.pid === null ? null : Number(r.pid),\n repostOf: r.repost_of === null ? null : Number(r.repost_of),\n imageIds: String(r.image_ids ?? \"\").split(\",\").filter(Boolean),\n title: String(r.title ?? \"\"),\n price: r.price === null ? null : Number(r.price),\n lat: r.lat === null ? null : Number(r.lat),\n lon: r.lon === null ? null : Number(r.lon),\n };\n}\n","label",[139],"fb27cca5-efdf-4c7e-b513-8423cc05e394","inbox.email.tsx","e7fd2184-ace8-11f1-8bd6-1607ee4eb77e",15,["D",1789025245787],1,"email","/**\n * [1] Email trigger. Parses a Craigslist saved-search alert, does the cheap dedup that needs\n * no network, enqueues the survivors and returns. It must stay fast: judging inline would\n * put a 60-second hard cap between us and a val that gets temporarily paused for overrunning.\n *\n * Anyone can send mail to this address and the val is public, so the sender is checked here.\n */\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { parseAlert, parseSubject, resultKey } from \"./lib/parse.ts\";\nimport * as db from \"./lib/db.ts\";\n\nconst ALERTS_FROM = \"alerts@alerts.craigslist.org\";\n\nexport interface Email {\n from: string;\n to: string[];\n cc?: string | string[];\n bcc?: string | string[];\n subject?: string;\n text?: string;\n html?: string;\n attachments?: File[];\n headers?: Record<string, string>;\n}\n\n/** \"craigslist <alerts@alerts.craigslist.org>\" -> \"alerts@alerts.craigslist.org\" */\nfunction addrOf(s: string | undefined): string {\n if (!s) return \"\";\n const m = s.match(/<([^>]+)>/);\n return (m ? m[1] : s).trim().toLowerCase();\n}\n\nexport default function (e: Email): Promise<void> {\n return handleEmail(e);\n}\n\n/** Exported so the same path can be exercised without actually sending mail. */\nexport async function handleEmail(e: Email): Promise<void> {\n const from = addrOf(e.from);\n const senderMatches = from === ALERTS_FROM;\n\n // Gmail filter-forwarding normally preserves the original From. If it ever wraps instead,\n // the original address survives in the forwarded headers or in the body text.\n const inHeaders = Object.values(e.headers ?? {}).some((v) =>\n String(v).toLowerCase().includes(ALERTS_FROM)\n );\n const inBody = `${e.text ?? \"\"}${e.html ?? \"\"}`.toLowerCase().includes(ALERTS_FROM);\n\n const sub = parseSubject(e.subject);\n const alert = parseAlert(e.subject, e.text, e.html);\n const looksLikeAlert = sub !== null && alert.results.length > 0;\n\n // A body mention alone is not enough: anyone can type that address into an email. It has to\n // parse as a real alert as well.\n const accept = senderMatches ? true : ((inHeaders || inBody) && looksLikeAlert);\n\n if (!accept) {\n const record = {\n at: new Date().toISOString(),\n from: e.from ?? \"\",\n subject: e.subject ?? \"\",\n text: (e.text ?? \"\").slice(0, 2000),\n };\n // Gmail's forwarding-verification code lands here; read it with blob.getJSON.\n await blob.setJSON(\"last-other-email\", record);\n console.log(\"OTHER_EMAIL\", JSON.stringify({ from: record.from, subject: record.subject }));\n return;\n }\n\n if (!looksLikeAlert) {\n await blob.setJSON(\"last-unparsed-alert\", {\n at: new Date().toISOString(),\n subject: e.subject ?? \"\",\n text: (e.text ?? \"\").slice(0, 2000),\n });\n console.log(\"ALERT_PARSE_EMPTY\", JSON.stringify({ subject: e.subject ?? \"\" }));\n return;\n }\n\n await db.init();\n let queued = 0;\n const skipped: string[] = [];\n\n for (const r of alert.results) {\n const key = resultKey(r);\n const reason = await skipReason(key, r.pid, r.thumbImgId);\n if (reason) {\n skipped.push(`${key}:${reason}`);\n continue;\n }\n await db.insertQueued({\n uuid: key,\n pid: r.pid,\n search: alert.search,\n title: r.title,\n price: r.price,\n hood: r.hood,\n thumbImgId: r.thumbImgId,\n url: r.url,\n });\n queued++;\n }\n\n console.log(\n \"ALERT\",\n JSON.stringify({\n search: alert.search,\n claimed: alert.count,\n parsed: alert.results.length,\n queued,\n skipped,\n }),\n );\n}\n\n/** Everything here is local to SQLite — no craigslist request is made before the cron runs. */\nasync function skipReason(\n key: string,\n pid: number | null,\n thumbImgId: string | null,\n): Promise<string | null> {\n if (await db.getPost(key)) return \"known\";\n if (pid !== null) {\n if (await db.existsPid(pid)) return \"pid-known\";\n if (await db.isBlocked([`pid:${pid}`])) return \"pid-blocked\";\n }\n if (thumbImgId) {\n if (await db.isBlocked([`img:${thumbImgId}`])) return \"img-blocked\";\n if (await db.existsImage(thumbImgId)) return \"img-known\";\n }\n return null;\n}\n",[151],"52088f85-8b11-4768-96af-395c64402f80","feedback.http.tsx",2,["D",1789025174785],"http","/**\n * [3] The nope / more-like-this buttons in the digest.\n *\n * GET ?u=<uuid>&v=nope|yes&t=<hex hmac-sha256(secret, uuid + \"|\" + v)>\n * POST same query string plus a form field `reason`\n *\n * The token is the only authentication: the val is public and these links travel by email.\n * Everything is idempotent — mail clients prefetch links, and he may click twice.\n */\nimport * as db from \"./lib/db.ts\";\nimport { imageIdentity } from \"./lib/dedup.ts\";\nimport { verify } from \"./lib/sign.ts\";\n\nexport default async function (req: Request): Promise<Response> {\n const secret = Deno.env.get(\"FEEDBACK_SECRET\");\n if (!secret) {\n return new Response(\"feedback is not configured: FEEDBACK_SECRET is unset\\n\", {\n status: 503,\n headers: { \"content-type\": \"text/plain; charset=utf-8\" },\n });\n }\n\n const url = new URL(req.url);\n const uuid = url.searchParams.get(\"u\") ?? \"\";\n const kind = url.searchParams.get(\"v\") ?? \"\";\n const token = url.searchParams.get(\"t\");\n\n if (!uuid || (kind !== \"nope\" && kind !== \"yes\") || !(await verify(secret, uuid, kind, token))) {\n return new Response(\"403 — bad or missing token\\n\", {\n status: 403,\n headers: { \"content-type\": \"text/plain; charset=utf-8\" },\n });\n }\n\n await db.init();\n const post = await db.getPost(uuid);\n if (!post) return page(\"Unknown post.\", null, 404);\n\n if (req.method === \"POST\") {\n const form = await req.formData();\n const reason = String(form.get(\"reason\") ?? \"\").slice(0, 300).trim();\n if (reason) {\n await db.setFeedbackReason(uuid, kind, reason);\n console.log(\"FEEDBACK_REASON\", JSON.stringify({ uuid, kind, reason }));\n }\n return page(\"Noted. Thanks.\", null, 200);\n }\n\n const title = String(post.title ?? uuid);\n\n if (kind === \"nope\") {\n const keys = [\n ...(post.pid ? [`pid:${Number(post.pid)}`] : []),\n ...(post.repost_of ? [`pid:${Number(post.repost_of)}`] : []),\n ...String(post.image_ids ?? \"\").split(\",\").filter(Boolean).map((i) =>\n `img:${imageIdentity(i)}`\n ),\n ...(post.thumb_img_id ? [`img:${String(post.thumb_img_id)}`] : []),\n ];\n await db.addBlocked(keys, uuid, null);\n await db.updatePost(uuid, { status: \"rejected\", verdict: \"bad\" });\n if (!(await db.hasFeedback(uuid, \"nope\"))) await db.addFeedback(uuid, \"nope\", null);\n console.log(\"NOPE\", JSON.stringify({ uuid, keys }));\n return page(\n `Blocked: ${title}`,\n `${keys.length} key(s) suppressed. Why, in one line? (optional)`,\n 200,\n { uuid, kind, token: token ?? \"\" },\n );\n }\n\n await db.updatePost(uuid, { status: \"liked\" });\n if (!(await db.hasFeedback(uuid, \"yes\"))) await db.addFeedback(uuid, \"yes\", null);\n console.log(\"YES\", JSON.stringify({ uuid }));\n return page(\n `More like this: ${title}`,\n \"What made it good? (optional)\",\n 200,\n { uuid, kind, token: token ?? \"\" },\n );\n}\n\nconst esc = (s: string) =>\n s.replace(/&/g, \"&\").replace(/</g, \"<\").replace(/>/g, \">\").replace(/\"/g, \""\");\n\nfunction page(\n heading: string,\n prompt: string | null,\n status: number,\n form?: { uuid: string; kind: string; token: string },\n): Response {\n const body = form && prompt\n ? `<form method=\"post\" action=\"?u=${encodeURIComponent(form.uuid)}&v=${\n encodeURIComponent(form.kind)\n }&t=${encodeURIComponent(form.token)}\">\n <p style=\"color:#555\">${esc(prompt)}</p>\n <input name=\"reason\" maxlength=\"300\" style=\"width:100%;padding:8px;font-size:15px\" autofocus>\n <button style=\"margin-top:8px;padding:8px 14px;font-size:15px\">save</button>\n</form>`\n : \"\";\n return new Response(\n `<!doctype html><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n<title>cl-triage

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_306":307,"_308":309},"routes/_app.x.$handle.$name",{"_101":100,"_32":46,"_109":91,"_27":54,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_20":-5,"_120":-5,"_121":-5,"_122":25,"_123":124,"_125":60,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_44":45,"_32":46,"_39":47,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":84,"_85":86,"_87":88,"_89":25},"version",30,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":33,"_34":35,"_36":38,"_39":40,"_41":14,"_42":43,"_24":25},"previous",{"_30":31,"_32":33,"_34":35,"_36":37},"deleted",false,"deletedHere","path","lib/parse.ts","latestPath","fileId","e824aae2-ace8-11f1-a6b9-1607ee4eb77e","name","parse.ts","fileType","script","content","/**\n * Parsing of Craigslist saved-search alert emails. Pure: no I/O, no Val Town imports,\n * so it is unit-testable against the fixtures in test/fixtures/.\n *\n * Shape of the plain-text part (the authoritative one — it survives Gmail's forward\n * wrapping better than the HTML):\n *\n * =========================================================== \n * <post url>\n * - $10 (santa rosa)\n *\n * The price line is optional (free items have none) and the parenthesised neighbourhood\n * is optional too; a free item may carry only the parenthesised location.\n *\n * Two URL shapes exist. Craigslist switched on 2026-07-02:\n * new: https://www.craigslist.org/view/d/<slug>/<uuid>\n * legacy: https://sfbay.craigslist.org/eby/hsh/d/<slug>/<pid>.html\n * Legacy rows carry a numeric post id and no uuid; the judge resolves the uuid later by\n * following the 301 on the old URL.\n */\n\nexport interface ParsedResult {\n uuid: string | null;\n pid: number | null;\n slug: string;\n title: string;\n price: number | null;\n hood: string | null;\n /** The 11-char image identity from the alert's _300x300 thumbnail, when there is one. */\n thumbImgId: string | null;\n url: string;\n}\n\nexport interface ParsedAlert {\n /** Saved-search name, lowercased — this is the key criteria are stored under. */\n search: string;\n /** N from \"(N new results)\", or null if the subject did not parse. */\n count: number | null;\n results: ParsedResult[];\n}\n\nconst NEW_URL =\n /https?:\\/\\/(?:www\\.)?craigslist\\.org\\/view\\/d\\/([^/\\s\"'<>]+)\\/([A-Za-z0-9]{15,30})/;\nconst LEGACY_URL =\n /https?:\\/\\/[a-z0-9.-]*craigslist\\.org\\/(?:[a-z0-9]+\\/)*d\\/([^/\\s\"'<>]+)\\/(\\d{6,})\\.html/;\nconst THUMB = /images\\.craigslist\\.org\\/[0-9A-Za-z]+_([0-9A-Za-z]{8,14})_[0-9A-Za-z]+_\\d+x\\d+\\.jpg/;\n\n/** \"(2 new results) sewing machine\" -> {count: 2, search: \"sewing machine\"} */\nexport function parseSubject(\n subject: string | undefined,\n): { count: number; search: string } | null {\n if (!subject) return null;\n const m = subject.match(/\$(\\d+)\\s+new\\s+results?\$\\s*(.+)$/i);\n if (!m) return null;\n const search = m[2].trim().toLowerCase();\n if (!search) return null;\n return { count: Number(m[1]), search };\n}\n\n/** Identity key for a result: the uuid when we have one, otherwise \"pid:<n>\". */\nexport function resultKey(r: { uuid: string | null; pid: number | null }): string {\n return r.uuid ?? `pid:${r.pid}`;\n}\n\nexport function parseAlert(\n subject: string | undefined,\n text: string | undefined,\n html: string | undefined,\n): ParsedAlert {\n const sub = parseSubject(subject);\n const results = text ? parseTextPart(text) : [];\n const thumbs = html ? thumbnailsByKey(html) : new Map<string, string>();\n for (const r of results) {\n r.thumbImgId = thumbs.get(resultKey(r)) ?? null;\n }\n return { search: sub?.search ?? \"\", count: sub?.count ?? null, results };\n}\n\nfunction parseTextPart(text: string): ParsedResult[] {\n const out: ParsedResult[] = [];\n const seen = new Set<string>();\n let title: string | null = null;\n let block: string[] = [];\n\n const flush = () => {\n if (title) {\n const r = blockToResult(title, block);\n if (r && !seen.has(resultKey(r))) {\n seen.add(resultKey(r));\n out.push(r);\n }\n }\n title = null;\n block = [];\n };\n\n for (const raw of text.split(/\\r?\\n/)) {\n const sep = raw.match(/^={5,}\\s*(.*)$/);\n if (sep) {\n flush();\n title = sep[1].trim() || null;\n } else if (title) {\n block.push(raw.trim());\n }\n }\n flush();\n return out;\n}\n\nfunction blockToResult(title: string, lines: string[]): ParsedResult | null {\n let uuid: string | null = null;\n let pid: number | null = null;\n let slug = \"\";\n let url = \"\";\n\n for (const line of lines) {\n const nu = line.match(NEW_URL);\n if (nu) {\n slug = nu[1];\n uuid = nu[2];\n url = nu[0];\n break;\n }\n const lu = line.match(LEGACY_URL);\n if (lu) {\n slug = lu[1];\n pid = Number(lu[2]);\n url = lu[0];\n break;\n }\n }\n if (!url) return null;\n\n let price: number | null = null;\n let hood: string | null = null;\n for (const line of lines) {\n const p = line.match(/^-\\s*\\$([\\d,]+)(?:\\s*\$(.+)\$)?\\s*$/);\n if (p) {\n price = Number(p[1].replace(/,/g, \"\"));\n hood = p[2]?.trim() || null;\n break;\n }\n const h = line.match(/^\$(.+)\$\\s*$/);\n if (h) {\n hood = h[1].trim();\n break;\n }\n }\n\n return { uuid, pid, slug, title, price, hood, thumbImgId: null, url };\n}\n\n/**\n * Thumbnail image ids from the HTML part, matched to results by document order: each\n * <img> belongs to the most recent post link above it, which is how the alert is laid out\n * (the thumbnail is wrapped in a second anchor to the same post).\n */\nfunction thumbnailsByKey(html: string): Map<string, string> {\n const combined = new RegExp(\n `(?:${NEW_URL.source})|(?:${LEGACY_URL.source})|(?:${THUMB.source})`,\n \"g\",\n );\n const map = new Map<string, string>();\n let current: string | null = null;\n for (const m of html.matchAll(combined)) {\n // groups: 1,2 = new slug/uuid 3,4 = legacy slug/pid 5 = thumbnail image id\n if (m[2]) current = m[2];\n else if (m[4]) current = `pid:${Number(m[4])}`;\n else if (m[5] && current && !map.has(current)) map.set(current, m[5]);\n }\n return map;\n}\n","/**\n * Parsing of Craigslist saved-search alert emails. Pure: no I/O, no Val Town imports,\n * so it is unit-testable against the fixtures in test/fixtures/.\n *\n * Shape of the plain-text part (the authoritative one — it survives Gmail's forward\n * wrapping better than the HTML):\n *\n * =========================================================== <title>\n * <post url>\n * - $10 (santa rosa)\n *\n * The price line is optional (free items have none) and the parenthesised neighbourhood\n * is optional too; a free item may carry only the parenthesised location.\n *\n * Two URL shapes exist. Craigslist switched on 2026-07-02:\n * new: https://www.craigslist.org/view/d/<slug>/<uuid>\n * legacy: https://sfbay.craigslist.org/eby/hsh/d/<slug>/<pid>.html\n * Legacy rows carry a numeric post id and no uuid; the judge resolves the uuid later by\n * following the 301 on the old URL.\n */\n\nexport interface ParsedResult {\n uuid: string | null;\n pid: number | null;\n slug: string;\n title: string;\n price: number | null;\n hood: string | null;\n /** The 11-char image identity from the alert's _300x300 thumbnail, when there is one. */\n thumbImgId: string | null;\n url: string;\n}\n\nexport interface ParsedAlert {\n /** Saved-search name, lowercased — this is the key criteria are stored under. */\n search: string;\n /** N from \"(N new results)\", or null if the subject did not parse. */\n count: number | null;\n results: ParsedResult[];\n}\n\nconst NEW_URL =\n /https?:\\/\\/(?:www\\.)?craigslist\\.org\\/view\\/d\\/([^/\\s\"'<>]+)\\/([A-Za-z0-9]{15,30})/;\nconst LEGACY_URL =\n /https?:\\/\\/[a-z0-9.-]*craigslist\\.org\\/(?:[a-z0-9]+\\/)*d\\/([^/\\s\"'<>]+)\\/(\\d{6,})\\.html/;\nconst THUMB = /images\\.craigslist\\.org\\/[0-9A-Za-z]+_([0-9A-Za-z]{8,14})_[0-9A-Za-z]+_\\d+x\\d+\\.jpg/;\n\n/** \"(2 new results) some saved search\" -> {count: 2, search: \"some saved search\"} */\nexport function parseSubject(\n subject: string | undefined,\n): { count: number; search: string } | null {\n if (!subject) return null;\n const m = subject.match(/\$(\\d+)\\s+new\\s+results?\$\\s*(.+)$/i);\n if (!m) return null;\n const search = m[2].trim().toLowerCase();\n if (!search) return null;\n return { count: Number(m[1]), search };\n}\n\n/** Identity key for a result: the uuid when we have one, otherwise \"pid:<n>\". */\nexport function resultKey(r: { uuid: string | null; pid: number | null }): string {\n return r.uuid ?? `pid:${r.pid}`;\n}\n\nexport function parseAlert(\n subject: string | undefined,\n text: string | undefined,\n html: string | undefined,\n): ParsedAlert {\n const sub = parseSubject(subject);\n const results = text ? parseTextPart(text) : [];\n const thumbs = html ? thumbnailsByKey(html) : new Map<string, string>();\n for (const r of results) {\n r.thumbImgId = thumbs.get(resultKey(r)) ?? null;\n }\n return { search: sub?.search ?? \"\", count: sub?.count ?? null, results };\n}\n\nfunction parseTextPart(text: string): ParsedResult[] {\n const out: ParsedResult[] = [];\n const seen = new Set<string>();\n let title: string | null = null;\n let block: string[] = [];\n\n const flush = () => {\n if (title) {\n const r = blockToResult(title, block);\n if (r && !seen.has(resultKey(r))) {\n seen.add(resultKey(r));\n out.push(r);\n }\n }\n title = null;\n block = [];\n };\n\n for (const raw of text.split(/\\r?\\n/)) {\n const sep = raw.match(/^={5,}\\s*(.*)$/);\n if (sep) {\n flush();\n title = sep[1].trim() || null;\n } else if (title) {\n block.push(raw.trim());\n }\n }\n flush();\n return out;\n}\n\nfunction blockToResult(title: string, lines: string[]): ParsedResult | null {\n let uuid: string | null = null;\n let pid: number | null = null;\n let slug = \"\";\n let url = \"\";\n\n for (const line of lines) {\n const nu = line.match(NEW_URL);\n if (nu) {\n slug = nu[1];\n uuid = nu[2];\n url = nu[0];\n break;\n }\n const lu = line.match(LEGACY_URL);\n if (lu) {\n slug = lu[1];\n pid = Number(lu[2]);\n url = lu[0];\n break;\n }\n }\n if (!url) return null;\n\n let price: number | null = null;\n let hood: string | null = null;\n for (const line of lines) {\n const p = line.match(/^-\\s*\\$([\\d,]+)(?:\\s*\$(.+)\$)?\\s*$/);\n if (p) {\n price = Number(p[1].replace(/,/g, \"\"));\n hood = p[2]?.trim() || null;\n break;\n }\n const h = line.match(/^\$(.+)\$\\s*$/);\n if (h) {\n hood = h[1].trim();\n break;\n }\n }\n\n return { uuid, pid, slug, title, price, hood, thumbImgId: null, url };\n}\n\n/**\n * Thumbnail image ids from the HTML part, matched to results by document order: each\n * <img> belongs to the most recent post link above it, which is how the alert is laid out\n * (the thumbnail is wrapped in a second anchor to the same post).\n */\nfunction thumbnailsByKey(html: string): Map<string, string> {\n const combined = new RegExp(\n `(?:${NEW_URL.source})|(?:${LEGACY_URL.source})|(?:${THUMB.source})`,\n \"g\",\n );\n const map = new Map<string, string>();\n let current: string | null = null;\n for (const m of html.matchAll(combined)) {\n // groups: 1,2 = new slug/uuid 3,4 = legacy slug/pid 5 = thumbnail image id\n if (m[2]) current = m[2];\n else if (m[4]) current = `pid:${Number(m[4])}`;\n else if (m[5] && current && !map.has(current)) map.set(current, m[5]);\n }\n return map;\n}\n","createdAt",["D",1789025748365],"branchVersion","branchId","19036aae-467e-44f0-962d-88964ddc5361","id","c358f270-b3fc-477f-a942-c58f7915cb3d","cl-triage",["D",1789025029995],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","019bcf70-5321-758b-8dfa-2be50f1fc9fb","pinnedFileId","e7e3fae2-ace8-11f1-8828-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019bcf70-5321-758b-8dfa-2ea07f250c13","tursoName","c358f270b3fc477fa942c58f7915cb3d","tursoHostname","c358f270b3fc477fa942c58f7915cb3d-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789546246980],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_101":100,"_108":104},"org",{"_101":100,"_102":-5,"_103":104,"_18":56,"_105":106,"_107":25},"branch",{"_13":90,"_32":91,"_44":43,"_92":45,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":46,"_99":100},"isOwned",62,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","herschelrs","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18zOFBxeE4yTklpRW16aUxzZzlSaTZRa3BWN0wifQ","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_44":45,"_32":46,"_39":301,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":302,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":303,"_85":304,"_87":305,"_89":25},"tree",[209,217,218,219,220,221,222,223],"files",[209,210,211,212,213,214,215,216,217,218,219,220,221,222,223],"counts",{"_199":64,"_200":155,"_201":64,"_202":203,"_204":205},"contents",[130,131,132,133,134,135,136,137],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_44":193,"_32":194,"_30":195,"_141":-5,"_42":43,"_41":155,"_143":60,"_39":196,"_13":64,"_34":197,"_36":-5,"_24":25,"_148":-5,"_27":198},{"_44":186,"_32":187,"_30":188,"_141":-5,"_42":43,"_41":189,"_143":60,"_39":190,"_13":64,"_34":20,"_36":191,"_24":25,"_148":-5,"_27":192},{"_44":180,"_32":181,"_30":182,"_141":-5,"_42":43,"_41":145,"_143":25,"_39":183,"_13":64,"_34":20,"_36":184,"_24":25,"_148":-5,"_27":185},{"_44":173,"_32":174,"_30":175,"_141":-5,"_42":43,"_41":176,"_143":25,"_39":177,"_13":64,"_34":20,"_36":178,"_24":25,"_148":-5,"_27":179},{"_44":166,"_32":167,"_30":168,"_141":-5,"_42":43,"_41":169,"_143":25,"_39":170,"_13":64,"_34":20,"_36":171,"_24":25,"_148":-5,"_27":172},{"_44":159,"_32":160,"_30":58,"_141":-5,"_42":43,"_41":161,"_143":25,"_39":162,"_13":64,"_34":163,"_36":164,"_24":25,"_148":-5,"_27":165},{"_44":150,"_32":151,"_30":152,"_141":-5,"_42":43,"_41":153,"_143":25,"_39":154,"_13":155,"_34":156,"_36":157,"_24":25,"_148":-5,"_27":158},{"_44":138,"_32":139,"_30":140,"_141":-5,"_42":43,"_41":142,"_143":25,"_39":144,"_13":145,"_34":146,"_36":147,"_24":25,"_148":-5,"_27":149},"401f4262-d948-486e-bab9-083a93afe60f","judge.cron.tsx","e81164fa-ace8-11f1-b8ae-1607ee4eb77e","parentId",23,"latest",["D",1789025514185],3,"interval","/**\n * [2] The judge. Drains the queue the email handler filled.\n *\n * Budget: Val Town's free tier kills a run at 60 s, and *repeated* overruns temporarily pause\n * the val — so this keeps a 40 s deadline of its own, stops picking up posts once it is past,\n * and never takes more than MAX_POSTS in one run. Every outbound fetch carries its own\n * AbortSignal.timeout.\n *\n * Per post: one sapi detail call, the dedup ladder, then (only if it is genuinely new) up to\n * five images and exactly one LLM call. Good verdicts from one run go out as a single email.\n */\nimport {\n BlockedError,\n bodyText,\n fetchDetail,\n fetchImageBase64,\n imageUrl,\n resolveUuid,\n} from \"./lib/cl.ts\";\nimport * as db from \"./lib/db.ts\";\nimport { type DedupRow, findDuplicate, imageIdentity } from \"./lib/dedup.ts\";\nimport {\n buildSystem,\n buildUserText,\n criteriaFor,\n DEFAULT_MODEL,\n judge,\n loadCriteria,\n type Verdict,\n} from \"./lib/llm.ts\";\nimport { type DigestItem, feedbackLink, sendDigest } from \"./lib/mail.ts\";\nimport { sign } from \"./lib/sign.ts\";\n\nconst MAX_POSTS = 4;\nconst RUN_DEADLINE_MS = 40_000;\nconst MAX_IMAGES = 5;\nconst NOPE_EXAMPLES = 10;\nconst YES_EXAMPLES = 5;\n\nexport default async function (): Promise<void> {\n const started = Date.now();\n const left = () => RUN_DEADLINE_MS - (Date.now() - started);\n\n await db.init();\n const queue = await db.listQueued(MAX_POSTS);\n console.log(\"RUN\", JSON.stringify({ queued: queue.length, max: MAX_POSTS }));\n if (!queue.length) return;\n\n const apiKey = Deno.env.get(\"ANTHROPIC_API_KEY\") ?? \"\";\n const dryRun = !apiKey;\n const sendInDryRun = Deno.env.get(\"SEND_IN_DRY_RUN\") === \"1\";\n const model = Deno.env.get(\"JUDGE_MODEL\") || DEFAULT_MODEL;\n const criteria = loadCriteria(Deno.env.get(\"CRITERIA_JSON\"));\n if (!Deno.env.get(\"CRITERIA_JSON\")) console.log(\"CRITERIA_JSON unset — built-in default only\");\n if (dryRun) console.log(\"DRY_RUN: ANTHROPIC_API_KEY unset, no LLM call will be made\");\n\n const digest: DigestItem[] = [];\n\n for (const row of queue) {\n if (left() <= 8000) {\n console.log(\"DEADLINE\", JSON.stringify({ msLeft: left(), stoppedBefore: row.uuid }));\n break;\n }\n try {\n const item = await handleOne(row, { apiKey, dryRun, sendInDryRun, model, criteria });\n if (item) digest.push(item);\n } catch (err) {\n if (err instanceof BlockedError) {\n // Craigslist blocked us. Stop the run. Do not retry and do not change egress:\n // evading a block is the fact that turns scraping into a legal problem.\n console.error(\"BLOCKED_BY_CL\", JSON.stringify({ blockID: err.blockID, url: err.url }));\n await db.updatePost(String(row.uuid), {\n status: \"blocked_by_cl\",\n reason: `blockID=${err.blockID}`,\n });\n break;\n }\n console.error(\"POST_ERROR\", String(row.uuid), String(err));\n await db.updatePost(String(row.uuid), {\n status: \"error\",\n reason: String(err).slice(0, 200),\n });\n }\n }\n\n if (digest.length) {\n await sendDigest(digest);\n for (const it of digest) await db.updatePost(it.uuid, { emailed_at: db.now() });\n console.log(\n \"EMAILED\",\n JSON.stringify({ count: digest.length, uuids: digest.map((d) => d.uuid) }),\n );\n }\n console.log(\"DONE\", JSON.stringify({ ms: Date.now() - started, emailed: digest.length }));\n}\n\ninterface Cfg {\n apiKey: string;\n dryRun: boolean;\n sendInDryRun: boolean;\n model: string;\n criteria: ReturnType<typeof loadCriteria>;\n}\n\nasync function handleOne(row: db.Row, cfg: Cfg): Promise<DigestItem | null> {\n let uuid = String(row.uuid);\n const search = String(row.search ?? \"\");\n\n // Legacy pid-only rows: the old numeric URL 301s to the /view/d/<slug>/<uuid> form, which\n // is the only pid -> uuid oracle there is (the uuid is a random 128-bit token).\n if (uuid.startsWith(\"pid:\")) {\n const res = await resolveUuid(String(row.url), 10_000);\n if (res.status === 404) {\n await db.updatePost(uuid, { status: \"gone\", judged_at: db.now() });\n console.log(\"GONE\", JSON.stringify({ key: uuid, via: \"legacy-404\" }));\n return null;\n }\n if (!res.uuid) throw new Error(`no uuid from redirect (status ${res.status})`);\n const existing = await db.getPost(res.uuid);\n if (existing) {\n await db.updatePost(uuid, {\n status: \"dup\",\n dup_of: res.uuid,\n verdict: existing.verdict,\n score: existing.score,\n reason: existing.reason,\n judged_at: db.now(),\n });\n console.log(\"DUP\", JSON.stringify({ key: uuid, dupOf: res.uuid, rule: \"resolved-uuid\" }));\n return null;\n }\n await db.renameUuid(uuid, res.uuid);\n console.log(\"RESOLVED\", JSON.stringify({ from: uuid, to: res.uuid }));\n uuid = res.uuid;\n }\n\n const { status, item } = await fetchDetail(uuid, 10_000);\n if (status === 404 || !item) {\n if (status === 404) {\n await db.updatePost(uuid, { status: \"gone\", judged_at: db.now() });\n console.log(\"GONE\", JSON.stringify({ uuid }));\n return null;\n }\n throw new Error(`sapi status ${status}`);\n }\n if (item.notices?.length) {\n console.log(\"NOTICES\", JSON.stringify({ uuid, notices: item.notices }));\n }\n\n const images = item.images ?? [];\n const lat = item.location?.lat ?? null;\n const lon = item.location?.lon ?? null;\n const hood = item.location?.neighborhood || (row.hood === null ? null : String(row.hood));\n\n await db.updatePost(uuid, {\n pid: item.postingId ?? null,\n repost_of: item.repostOf ?? null,\n title: item.title ?? String(row.title ?? \"\"),\n price: item.price ?? (row.price === null ? null : Number(row.price)),\n hood,\n lat,\n lon,\n image_ids: images.join(\",\"),\n record_created: item.recordCreated ?? null,\n url: item.url ?? String(row.url ?? \"\"),\n status: \"fetched\",\n });\n\n // Anything he has already said no to, in any of its forms.\n const blockKeys = [\n `pid:${item.postingId}`,\n ...(item.repostOf ? [`pid:${item.repostOf}`] : []),\n ...images.map((i) => `img:${imageIdentity(i)}`),\n ];\n const blockedBy = await db.isBlocked(blockKeys);\n if (blockedBy) {\n await db.updatePost(uuid, {\n status: \"rejected\",\n verdict: \"bad\",\n score: 0,\n reason: `blocked by earlier nope (${blockedBy})`,\n judged_at: db.now(),\n });\n console.log(\"BLOCKED\", JSON.stringify({ uuid, key: blockedBy }));\n return null;\n }\n\n const cand: DedupRow = {\n uuid,\n pid: item.postingId ?? null,\n repostOf: item.repostOf ?? null,\n imageIds: images,\n title: item.title ?? \"\",\n price: item.price ?? null,\n lat,\n lon,\n };\n const known = (await db.dedupRows()).map(toDedupRow);\n const dup = findDuplicate(cand, known);\n if (dup) {\n // Follow any dup_of chain to the row that actually carries the verdict. Without this a\n // post can be marked a duplicate of a row that is itself a duplicate of this post.\n const canonical = await canonicalUuid(dup.uuid, uuid);\n if (canonical === uuid) {\n console.log(\"DUP_SELF\", JSON.stringify({ uuid, matched: dup.uuid, rule: dup.rule }));\n } else {\n return await markDup(uuid, canonical, dup.rule);\n }\n }\n\n // Only now, for a post we have never judged, do we spend images and a model call.\n const picked = images.slice(0, MAX_IMAGES);\n const fetched: { mediaType: string; data: string }[] = [];\n for (const raw of picked) {\n const img = await fetchImageBase64(raw, \"600x450\", 10_000);\n if (img) fetched.push(img);\n }\n\n const { prompt, fellBack } = criteriaFor(cfg.criteria, search);\n if (fellBack) console.log(\"CRITERIA_FALLBACK\", JSON.stringify({ search, uuid }));\n const nopes = await db.feedbackExamples(search, \"nope\", NOPE_EXAMPLES);\n const yeses = await db.feedbackExamples(search, \"yes\", YES_EXAMPLES);\n const system = buildSystem(prompt, nopes, yeses);\n const userText = buildUserText({\n title: item.title ?? \"\",\n priceString: item.priceString ?? null,\n hood,\n body: bodyText(item.body),\n attributes: (item.attributes ?? []).map((a) => `${a.label ?? \"\"}: ${a.value ?? \"\"}`),\n category: item.category ?? null,\n postedIso: iso(item.postedDate),\n createdIso: iso(item.recordCreated),\n search,\n });\n\n let verdict: Verdict;\n if (cfg.dryRun) {\n const promptLen = system.length + userText.length;\n verdict = {\n verdict: \"meh\",\n score: 0,\n reason: `DRY_RUN: no ANTHROPIC_API_KEY (prompt ${promptLen} chars, ${fetched.length} images)`,\n flags: [\"dry\"],\n };\n await db.updatePost(uuid, {\n status: \"judged\",\n verdict: \"dry\",\n score: 0,\n reason: verdict.reason,\n flags: \"dry\",\n prompt_len: promptLen,\n judged_at: db.now(),\n });\n console.log(\n \"DRY\",\n JSON.stringify({ uuid, promptLen, images: fetched.length, title: item.title }),\n );\n if (!cfg.sendInDryRun) return null;\n } else {\n verdict = await judge({\n apiKey: cfg.apiKey,\n model: cfg.model,\n system,\n userText,\n images: fetched,\n timeoutMs: 30_000,\n });\n await db.updatePost(uuid, {\n status: \"judged\",\n verdict: verdict.verdict,\n score: verdict.score,\n reason: verdict.reason,\n flags: verdict.flags.join(\",\"),\n prompt_len: system.length + userText.length,\n judged_at: db.now(),\n });\n console.log(\n \"JUDGED\",\n JSON.stringify({\n uuid,\n verdict: verdict.verdict,\n score: verdict.score,\n images: fetched.length,\n title: item.title,\n }),\n );\n if (verdict.verdict !== \"good\") return null;\n }\n\n return await digestItem(uuid, item, hood, verdict, picked[0] ?? null);\n}\n\n/**\n * Walk dup_of to the row that actually holds the verdict. `self` is the post being judged:\n * if the chain leads back to it, the match is circular and there is no duplicate.\n */\nasync function canonicalUuid(start: string, self: string): Promise<string> {\n let cur = start;\n for (let i = 0; i < 4; i++) {\n const row = await db.getPost(cur);\n const next = row?.dup_of ? String(row.dup_of) : null;\n if (!next || next === cur) return cur;\n if (next === self) return self;\n cur = next;\n }\n return cur;\n}\n\nasync function markDup(uuid: string, dupOf: string, rule: string): Promise<null> {\n const orig = await db.getPost(dupOf);\n await db.updatePost(uuid, {\n status: \"dup\",\n dup_of: dupOf,\n verdict: orig?.verdict ?? null,\n score: orig?.score ?? null,\n reason: `duplicate of ${dupOf} (${rule})`,\n judged_at: db.now(),\n });\n console.log(\"DUP\", JSON.stringify({ uuid, dupOf, rule }));\n return null;\n}\n\nasync function digestItem(\n uuid: string,\n item: { title?: string; priceString?: string; url?: string },\n hood: string | null,\n verdict: Verdict,\n firstImage: string | null,\n): Promise<DigestItem> {\n const secret = Deno.env.get(\"FEEDBACK_SECRET\") ?? \"\";\n const base = await feedbackBase();\n let nopeUrl: string | null = null;\n let yesUrl: string | null = null;\n if (secret && base) {\n nopeUrl = feedbackLink(base, uuid, \"nope\", await sign(secret, uuid, \"nope\"));\n yesUrl = feedbackLink(base, uuid, \"yes\", await sign(secret, uuid, \"yes\"));\n } else {\n console.log(\"NO_FEEDBACK_LINKS\", JSON.stringify({ hasSecret: !!secret, base }));\n }\n return {\n uuid,\n title: item.title ?? \"\",\n priceString: item.priceString ?? null,\n hood,\n score: verdict.score,\n reason: verdict.reason,\n flags: verdict.flags,\n url: item.url ?? `https://www.craigslist.org/view/d/x/${uuid}`,\n imageUrl: firstImage ? imageUrl(firstImage, \"600x450\") : null,\n nopeUrl,\n yesUrl,\n };\n}\n\n/**\n * The feedback endpoint's own URL, for the buttons in the digest.\n *\n * Zero-config by default: Val Town injects VALTOWN_ENTRYPOINT (which names the user and the\n * val) and an API token, so the endpoint can be looked up at runtime and cached for the life\n * of the isolate. Set FEEDBACK_URL to skip the lookup. There is no VAL_URL variable in the\n * runtime — checked, the injected names are VALTOWN_ENTRYPOINT / VALTOWN_API_URL / valtown.\n */\nlet cachedBase: string | null | undefined;\n\nasync function feedbackBase(): Promise<string | null> {\n const explicit = Deno.env.get(\"FEEDBACK_URL\");\n if (explicit) return explicit.replace(/\\/$/, \"\");\n if (cachedBase !== undefined) return cachedBase;\n cachedBase = await discoverFeedbackUrl();\n return cachedBase;\n}\n\nasync function discoverFeedbackUrl(): Promise<string | null> {\n const token = Deno.env.get(\"valtown\") ?? Deno.env.get(\"VAL_TOWN_API_KEY\");\n const entry = Deno.env.get(\"VALTOWN_ENTRYPOINT\") ?? \"\";\n const m = entry.match(/esm\\.town\\/v\\/([^/]+)\\/([^/@]+)/);\n if (!token || !m) return null;\n const auth = { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) };\n try {\n const valRes = await fetch(`https://api.val.town/v2/alias/vals/${m[1]}/${m[2]}`, auth);\n if (!valRes.ok) return null;\n const valId = (await valRes.json())?.id;\n if (!valId) return null;\n const fileRes = await fetch(\n `https://api.val.town/v2/vals/${valId}/files?path=feedback.http.tsx`,\n auth,\n );\n if (!fileRes.ok) return null;\n const endpoint = (await fileRes.json())?.data?.[0]?.links?.endpoint;\n return typeof endpoint === \"string\" ? endpoint : null;\n } catch (e) {\n console.error(\"FEEDBACK_URL_DISCOVERY_FAILED\", String(e));\n return null;\n }\n}\n\n/** Exported so the deploy-time harness can prove the discovery path works. */\nexport { feedbackBase };\n\nfunction iso(epoch: number | undefined): string | null {\n return epoch ? new Date(epoch * 1000).toISOString().slice(0, 16).replace(\"T\", \" \") : null;\n}\n\nfunction toDedupRow(r: db.Row): DedupRow {\n return {\n uuid: String(r.uuid),\n pid: r.pid === null ? null : Number(r.pid),\n repostOf: r.repost_of === null ? null : Number(r.repost_of),\n imageIds: String(r.image_ids ?? \"\").split(\",\").filter(Boolean),\n title: String(r.title ?? \"\"),\n price: r.price === null ? null : Number(r.price),\n lat: r.lat === null ? null : Number(r.lat),\n lon: r.lon === null ? null : Number(r.lon),\n };\n}\n","label",[139],"fb27cca5-efdf-4c7e-b513-8423cc05e394","inbox.email.tsx","e7fd2184-ace8-11f1-8bd6-1607ee4eb77e",15,["D",1789025245787],1,"email","/**\n * [1] Email trigger. Parses a Craigslist saved-search alert, does the cheap dedup that needs\n * no network, enqueues the survivors and returns. It must stay fast: judging inline would\n * put a 60-second hard cap between us and a val that gets temporarily paused for overrunning.\n *\n * Anyone can send mail to this address and the val is public, so the sender is checked here.\n */\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { parseAlert, parseSubject, resultKey } from \"./lib/parse.ts\";\nimport * as db from \"./lib/db.ts\";\n\nconst ALERTS_FROM = \"alerts@alerts.craigslist.org\";\n\nexport interface Email {\n from: string;\n to: string[];\n cc?: string | string[];\n bcc?: string | string[];\n subject?: string;\n text?: string;\n html?: string;\n attachments?: File[];\n headers?: Record<string, string>;\n}\n\n/** \"craigslist <alerts@alerts.craigslist.org>\" -> \"alerts@alerts.craigslist.org\" */\nfunction addrOf(s: string | undefined): string {\n if (!s) return \"\";\n const m = s.match(/<([^>]+)>/);\n return (m ? m[1] : s).trim().toLowerCase();\n}\n\nexport default function (e: Email): Promise<void> {\n return handleEmail(e);\n}\n\n/** Exported so the same path can be exercised without actually sending mail. */\nexport async function handleEmail(e: Email): Promise<void> {\n const from = addrOf(e.from);\n const senderMatches = from === ALERTS_FROM;\n\n // Gmail filter-forwarding normally preserves the original From. If it ever wraps instead,\n // the original address survives in the forwarded headers or in the body text.\n const inHeaders = Object.values(e.headers ?? {}).some((v) =>\n String(v).toLowerCase().includes(ALERTS_FROM)\n );\n const inBody = `${e.text ?? \"\"}${e.html ?? \"\"}`.toLowerCase().includes(ALERTS_FROM);\n\n const sub = parseSubject(e.subject);\n const alert = parseAlert(e.subject, e.text, e.html);\n const looksLikeAlert = sub !== null && alert.results.length > 0;\n\n // A body mention alone is not enough: anyone can type that address into an email. It has to\n // parse as a real alert as well.\n const accept = senderMatches ? true : ((inHeaders || inBody) && looksLikeAlert);\n\n if (!accept) {\n const record = {\n at: new Date().toISOString(),\n from: e.from ?? \"\",\n subject: e.subject ?? \"\",\n text: (e.text ?? \"\").slice(0, 2000),\n };\n // Gmail's forwarding-verification code lands here; read it with blob.getJSON.\n await blob.setJSON(\"last-other-email\", record);\n console.log(\"OTHER_EMAIL\", JSON.stringify({ from: record.from, subject: record.subject }));\n return;\n }\n\n if (!looksLikeAlert) {\n await blob.setJSON(\"last-unparsed-alert\", {\n at: new Date().toISOString(),\n subject: e.subject ?? \"\",\n text: (e.text ?? \"\").slice(0, 2000),\n });\n console.log(\"ALERT_PARSE_EMPTY\", JSON.stringify({ subject: e.subject ?? \"\" }));\n return;\n }\n\n await db.init();\n let queued = 0;\n const skipped: string[] = [];\n\n for (const r of alert.results) {\n const key = resultKey(r);\n const reason = await skipReason(key, r.pid, r.thumbImgId);\n if (reason) {\n skipped.push(`${key}:${reason}`);\n continue;\n }\n await db.insertQueued({\n uuid: key,\n pid: r.pid,\n search: alert.search,\n title: r.title,\n price: r.price,\n hood: r.hood,\n thumbImgId: r.thumbImgId,\n url: r.url,\n });\n queued++;\n }\n\n console.log(\n \"ALERT\",\n JSON.stringify({\n search: alert.search,\n claimed: alert.count,\n parsed: alert.results.length,\n queued,\n skipped,\n }),\n );\n}\n\n/** Everything here is local to SQLite — no craigslist request is made before the cron runs. */\nasync function skipReason(\n key: string,\n pid: number | null,\n thumbImgId: string | null,\n): Promise<string | null> {\n if (await db.getPost(key)) return \"known\";\n if (pid !== null) {\n if (await db.existsPid(pid)) return \"pid-known\";\n if (await db.isBlocked([`pid:${pid}`])) return \"pid-blocked\";\n }\n if (thumbImgId) {\n if (await db.isBlocked([`img:${thumbImgId}`])) return \"img-blocked\";\n if (await db.existsImage(thumbImgId)) return \"img-known\";\n }\n return null;\n}\n",[151],"52088f85-8b11-4768-96af-395c64402f80","feedback.http.tsx",2,["D",1789025174785],"http","/**\n * [3] The nope / more-like-this buttons in the digest.\n *\n * GET ?u=<uuid>&v=nope|yes&t=<hex hmac-sha256(secret, uuid + \"|\" + v)>\n * POST same query string plus a form field `reason`\n *\n * The token is the only authentication: the val is public and these links travel by email.\n * Everything is idempotent — mail clients prefetch links, and he may click twice.\n */\nimport * as db from \"./lib/db.ts\";\nimport { imageIdentity } from \"./lib/dedup.ts\";\nimport { verify } from \"./lib/sign.ts\";\n\nexport default async function (req: Request): Promise<Response> {\n const secret = Deno.env.get(\"FEEDBACK_SECRET\");\n if (!secret) {\n return new Response(\"feedback is not configured: FEEDBACK_SECRET is unset\\n\", {\n status: 503,\n headers: { \"content-type\": \"text/plain; charset=utf-8\" },\n });\n }\n\n const url = new URL(req.url);\n const uuid = url.searchParams.get(\"u\") ?? \"\";\n const kind = url.searchParams.get(\"v\") ?? \"\";\n const token = url.searchParams.get(\"t\");\n\n if (!uuid || (kind !== \"nope\" && kind !== \"yes\") || !(await verify(secret, uuid, kind, token))) {\n return new Response(\"403 — bad or missing token\\n\", {\n status: 403,\n headers: { \"content-type\": \"text/plain; charset=utf-8\" },\n });\n }\n\n await db.init();\n const post = await db.getPost(uuid);\n if (!post) return page(\"Unknown post.\", null, 404);\n\n if (req.method === \"POST\") {\n const form = await req.formData();\n const reason = String(form.get(\"reason\") ?? \"\").slice(0, 300).trim();\n if (reason) {\n await db.setFeedbackReason(uuid, kind, reason);\n console.log(\"FEEDBACK_REASON\", JSON.stringify({ uuid, kind, reason }));\n }\n return page(\"Noted. Thanks.\", null, 200);\n }\n\n const title = String(post.title ?? uuid);\n\n if (kind === \"nope\") {\n const keys = [\n ...(post.pid ? [`pid:${Number(post.pid)}`] : []),\n ...(post.repost_of ? [`pid:${Number(post.repost_of)}`] : []),\n ...String(post.image_ids ?? \"\").split(\",\").filter(Boolean).map((i) =>\n `img:${imageIdentity(i)}`\n ),\n ...(post.thumb_img_id ? [`img:${String(post.thumb_img_id)}`] : []),\n ];\n await db.addBlocked(keys, uuid, null);\n await db.updatePost(uuid, { status: \"rejected\", verdict: \"bad\" });\n if (!(await db.hasFeedback(uuid, \"nope\"))) await db.addFeedback(uuid, \"nope\", null);\n console.log(\"NOPE\", JSON.stringify({ uuid, keys }));\n return page(\n `Blocked: ${title}`,\n `${keys.length} key(s) suppressed. Why, in one line? (optional)`,\n 200,\n { uuid, kind, token: token ?? \"\" },\n );\n }\n\n await db.updatePost(uuid, { status: \"liked\" });\n if (!(await db.hasFeedback(uuid, \"yes\"))) await db.addFeedback(uuid, \"yes\", null);\n console.log(\"YES\", JSON.stringify({ uuid }));\n return page(\n `More like this: ${title}`,\n \"What made it good? (optional)\",\n 200,\n { uuid, kind, token: token ?? \"\" },\n );\n}\n\nconst esc = (s: string) =>\n s.replace(/&/g, \"&\").replace(/</g, \"<\").replace(/>/g, \">\").replace(/\"/g, \""\");\n\nfunction page(\n heading: string,\n prompt: string | null,\n status: number,\n form?: { uuid: string; kind: string; token: string },\n): Response {\n const body = form && prompt\n ? `<form method=\"post\" action=\"?u=${encodeURIComponent(form.uuid)}&v=${\n encodeURIComponent(form.kind)\n }&t=${encodeURIComponent(form.token)}\">\n <p style=\"color:#555\">${esc(prompt)}</p>\n <input name=\"reason\" maxlength=\"300\" style=\"width:100%;padding:8px;font-size:15px\" autofocus>\n <button style=\"margin-top:8px;padding:8px 14px;font-size:15px\">save</button>\n</form>`\n : \"\";\n return new Response(\n `<!doctype html><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n<title>cl-triage\n\n

${esc(heading)}

\n${body}\n`,\n { status, headers: { \"content-type\": \"text/html; charset=utf-8\" } },\n );\n}\n",[160],"54dceed7-8457-4821-aedf-3d0bd4ba47e8","deno.json","e8bf8620-ace8-11f1-b2b3-1607ee4eb77e",14,["D",1789025174916],"{\n \"tasks\": {\n \"test\": \"deno test --allow-read=test/fixtures test/\",\n \"check\": \"deno check --allow-import=esm.town:443 lib/ inbox.email.tsx judge.cron.tsx feedback.http.tsx\",\n \"fmt\": \"deno fmt\",\n \"lint\": \"deno lint\"\n },\n \"fmt\": {\n \"lineWidth\": 100,\n \"exclude\": [\n \"*.md\",\n \"research/\",\n \"test/fixtures/\"\n ]\n },\n \"compilerOptions\": {\n \"strict\": true\n }\n}\n",[167],"585f522f-1ef4-4d92-b9b1-22dd6f51293f","README.md","2e4ab7f4-acea-11f1-a894-1607ee4eb77e",26,["D",1789025722387],"# cl-triage\n\nCraigslist saved-search alerts → an LLM judge → one email with only the listings worth looking\nat. Runs on Val Town's free tier.\n\nCraigslist emails a saved-search alert whenever matching posts appear. Those alerts re-fire on\nevery renew, repost and edit, so the same item arrives over and over, and most of what arrives\nis not what you meant. This val parses each alert, fetches the real posting and its photos,\nasks Claude whether it matches criteria you wrote in plain English, and emails you only the\ngood ones — with a **nope** button that suppresses that listing (and its reposts and\ncrossposts) forever and teaches the judge what you don't want.\n\n## How it works\n\n```\ncraigslist alert -> inbox.email.tsx parse, cheap dedup, enqueue. Returns in milliseconds.\n | SQLite: posts(uuid, pid, search, title, ..., status)\n v\n judge.cron.tsx detail API -> dedup ladder -> images -> one LLM call\n | -> verdict -> one email per run\n v\n feedback.http.tsx the nope / more-like-this links, HMAC signed\n```\n\nThe email handler never calls the model: Val Town's free tier kills a run at 60 seconds and\n*repeated* overruns temporarily pause the val, so all slow work happens in the cron, which\nkeeps a 40-second deadline of its own and takes at most four posts per run.\n\nDuplicates are caught by a ladder of keys, strongest first: the numeric post id (stable across\nrenew), `repostOf` (craigslist records repost lineage itself), the sorted set of image ids\n(catches crossposts under different ids and different coordinates), and finally\ntitle + price + lat/lon rounded to three decimals. A duplicate inherits the original's verdict\nand costs no model call.\n\n## Environment variables\n\nAll configuration is in env vars, because a free-tier val is public and its source is\nworld-readable.\n\n| variable | required | what it is |\n|---|---|---|\n| `CRITERIA_JSON` | no (but the point) | `{\"default\": \"\", \"searches\": {\"\": \"\"}}` — what you actually want, per saved search |\n| `ANTHROPIC_API_KEY` | no | Without it the val runs in DRY_RUN: everything except the model call, verdict stored as `dry` |\n| `JUDGE_MODEL` | no | Defaults to `claude-sonnet-5` |\n| `FEEDBACK_SECRET` | yes for the buttons | HMAC key for the nope / more-like-this links. Without it the feedback endpoint answers 503 and the digest ships without buttons |\n| `FEEDBACK_URL` | no | The public URL of `feedback.http.tsx`. Discovered automatically at runtime if unset |\n| `SEND_IN_DRY_RUN` | no | `1` makes DRY_RUN still send the digest, for testing the email path |\n\n## Setup\n\n1. Set `CRITERIA_JSON`, `ANTHROPIC_API_KEY` and `FEEDBACK_SECRET` in the val's environment\n variables (sidebar in the Val Town editor), and set the cron interval on `judge.cron.tsx`\n (15 minutes is the free-tier minimum).\n2. Turn on the alert checkbox for each saved search in your craigslist account.\n3. In Gmail: Settings → Forwarding → add this val's inbound address (shown on\n `inbox.email.tsx` in the Val Town editor). Gmail sends a verification code to it; the\n handler stores that mail in blob `last-other-email`, so read the code with\n `blob.getJSON(\"last-other-email\")`.\n4. Add a Gmail filter `from:alerts@alerts.craigslist.org` → *Forward it to* that address, and\n probably *Skip the inbox* so only judged results land in front of you.\n5. Forward one alert by hand first and check the log line `ALERT {...}`.\n\n## Adding a search\n\nTick the alert box on the new saved search in craigslist. Nothing here needs to change: the\nalert subject is `(N new results) ` and that name is the key. Add an entry\nunder `searches` in `CRITERIA_JSON` when you want it judged on its own terms — until you do, it\nfalls back to `default` and logs `CRITERIA_FALLBACK`, so a new search is never silently dropped.\n\n## Being a good citizen\n\nRoughly one 2 KB JSON call and at most five cached images per alerted post — three orders of\nmagnitude under the 1,000 pages per 24 hours craigslist's own terms name. Browser-like\nUser-Agent, GET only, never `?format=rss`, never `/reply` or anything else robots.txt\ndisallows. If craigslist ever answers with its block page, the run logs the blockID, marks the\npost `blocked_by_cl` and stops. Do not retry it and do not move it to another IP.\n\n## Development\n\n```\ndeno task test # unit tests for the email parser, the dedup ladder and the link signing\ndeno task check # typecheck, including the esm.town imports\nvt push # deploy\n```\n",[174],"89487f85-bffb-445f-bc4d-263c04dae2d2",".vtignore","e7eae14a-ace8-11f1-8c88-1607ee4eb77e",["D",1789025174833],"# Never sync to Val Town. The val is PUBLIC (free tier = zero private vals), so\n# anything here is world-readable. Keep research notes, fixtures and secrets out.\n.env\n.env.*\n*.local\n\nPLAN.md\nCLAUDE.md\nresearch/\ntest/\nscratch/\n\n.git/\n\n# Lockfile is a local build artifact; Val Town resolves imports itself.\ndeno.lock\n",[181],"4afb64de-e43d-4e3a-85c7-c5448521df3a",".gitignore","e7f8b5a4-ace8-11f1-81ba-1607ee4eb77e",4,["D",1789025174910],".env\n.env.*\n*.local\n.vt/\nscratch/\n",[187],"c19b5d71-7c9f-4b31-8ff4-cbc4e764009a","lib","e7cae0ca-ace8-11f1-b8ae-1607ee4eb77e",["D",1789025174616],"directory",[194],"pulls","branches","forks","envVars",{"_206":145,"_208":64},"connections",{"_206":64,"_207":64},"count","unfilledCount","emptyCount",{"_44":193,"_32":194,"_30":195,"_141":-5,"_42":43,"_41":155,"_143":60,"_39":298,"_13":64,"_34":197,"_36":-5,"_24":25,"_148":-5,"_225":299,"_27":300},{"_44":290,"_32":291,"_30":292,"_141":195,"_42":43,"_41":293,"_143":60,"_39":294,"_13":64,"_34":35,"_36":295,"_24":25,"_148":-5,"_225":296,"_27":297},{"_44":282,"_32":283,"_30":284,"_141":195,"_42":43,"_41":285,"_143":25,"_39":286,"_13":145,"_34":35,"_36":287,"_24":25,"_148":-5,"_225":288,"_27":289},{"_44":274,"_32":275,"_30":276,"_141":195,"_42":43,"_41":277,"_143":60,"_39":278,"_13":155,"_34":35,"_36":279,"_24":25,"_148":-5,"_225":280,"_27":281},{"_44":266,"_32":267,"_30":268,"_141":195,"_42":43,"_41":269,"_143":25,"_39":270,"_13":64,"_34":35,"_36":271,"_24":25,"_148":-5,"_225":272,"_27":273},{"_44":258,"_32":259,"_30":260,"_141":195,"_42":43,"_41":261,"_143":60,"_39":262,"_13":64,"_34":35,"_36":263,"_24":25,"_148":-5,"_225":264,"_27":265},{"_44":254,"_32":33,"_30":31,"_141":195,"_42":43,"_41":14,"_143":25,"_39":255,"_13":155,"_34":35,"_36":38,"_24":25,"_148":-5,"_225":256,"_27":257},{"_44":246,"_32":247,"_30":248,"_141":195,"_42":43,"_41":249,"_143":60,"_39":250,"_13":64,"_34":35,"_36":251,"_24":25,"_148":-5,"_225":252,"_27":253},{"_44":186,"_32":187,"_30":188,"_141":-5,"_42":43,"_41":189,"_143":60,"_39":243,"_13":64,"_34":20,"_36":191,"_24":25,"_148":-5,"_225":244,"_27":245},{"_44":180,"_32":181,"_30":182,"_141":-5,"_42":43,"_41":145,"_143":25,"_39":240,"_13":64,"_34":20,"_36":184,"_24":25,"_148":-5,"_225":241,"_27":242},{"_44":173,"_32":174,"_30":175,"_141":-5,"_42":43,"_41":176,"_143":25,"_39":237,"_13":64,"_34":20,"_36":178,"_24":25,"_148":-5,"_225":238,"_27":239},{"_44":166,"_32":167,"_30":168,"_141":-5,"_42":43,"_41":169,"_143":25,"_39":234,"_13":64,"_34":20,"_36":171,"_24":25,"_148":-5,"_225":235,"_27":236},{"_44":159,"_32":160,"_30":58,"_141":-5,"_42":43,"_41":161,"_143":25,"_39":231,"_13":64,"_34":163,"_36":164,"_24":25,"_148":-5,"_225":232,"_27":233},{"_44":150,"_32":151,"_30":152,"_141":-5,"_42":43,"_41":153,"_143":25,"_39":228,"_13":155,"_34":156,"_36":157,"_24":25,"_148":-5,"_225":229,"_27":230},{"_44":138,"_32":139,"_30":140,"_141":-5,"_42":43,"_41":142,"_143":25,"_39":224,"_13":145,"_34":146,"_36":147,"_24":25,"_148":-5,"_225":226,"_27":227},["D",1789025514185],"children",[],[139],["D",1789025245787],[],[151],["D",1789025174785],[],[160],["D",1789025174916],[],[167],["D",1789025722387],[],[174],["D",1789025174833],[],[181],["D",1789025174910],[],[187],"77b700c6-5186-4dfd-a699-429343c6dbcf","sign.ts","e83bfcf6-ace8-11f1-8265-1607ee4eb77e",11,["D",1789025175351],"/**\n * HMAC-SHA256 over `|`, hex encoded, via Web Crypto (available in Deno and\n * on Val Town). The token is the only authentication the feedback endpoint has: the val is\n * public and the links go out in email, so the secret must never appear in source.\n */\n\nexport type FeedbackKind = \"nope\" | \"yes\";\n\nasync function hmacHex(secret: string, msg: string): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const sig = await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(msg));\n return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport function sign(secret: string, uuid: string, kind: FeedbackKind | string): Promise {\n return hmacHex(secret, `${uuid}|${kind}`);\n}\n\nexport async function verify(\n secret: string,\n uuid: string,\n kind: string,\n token: string | null | undefined,\n): Promise {\n if (!token) return false;\n const expected = await sign(secret, uuid, kind);\n if (token.length !== expected.length) return false;\n // Constant time over the hex string.\n let diff = 0;\n for (let i = 0; i < expected.length; i++) diff |= expected.charCodeAt(i) ^ token.charCodeAt(i);\n return diff === 0;\n}\n",[],[194,247],"21fffcb2-555d-4f33-a4d3-129bce783b3f",["D",1789025748365],[],[194,33],"826c2430-3a31-4d09-af53-d9cc981dbcb4","mail.ts","e8045df0-ace8-11f1-8828-1607ee4eb77e",6,["D",1789025174997],"/**\n * The outgoing digest. One email per cron run, carrying every 'good' verdict from that run.\n *\n * Gmail rules (learned the hard way in the sibling calendar-val project):\n * -

Diff · v30