blocked

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_235":236,"_237":238},"routes/_app.x.$handle.$name",{"_99":98,"_31":44,"_107":89,"_26":52,"_13":14,"_108":-5,"_11":109,"_110":111,"_112":113,"_114":115,"_116":117,"_20":-5,"_118":-5,"_119":-5,"_120":24,"_121":122,"_123":58,"_124":-5,"_125":-5,"_126":127},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_31":44,"_37":45,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":24},"version",8,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_23":24},"previous","deleted",false,"deletedHere","path","lib/cl.ts","latestPath","fileId","e81f36d4-ace8-11f1-81ba-1607ee4eb77e","name","cl.ts","fileType","script","content","/**\n * Craigslist access. Etiquette rules baked in, all from research/craigslist-mechanics.md:\n * - browser-like User-Agent, GET only (images.craigslist.org answers 405 to HEAD)\n * - never ?format=rss (403 + block page; the parameter itself is a bot signal)\n * - never touch /reply or /flag (robots.txt Disallow)\n * - if a body ever contains blocked, log the blockID and STOP. Do not retry,\n * do not change egress. Evading a block is the fact that turns scraping into CFAA exposure.\n * Volume here is ~1 detail call + <=5 images per alerted post, three orders of magnitude\n * under craigslist's own written 1,000-pages/24h budget.\n */\n\nconst UA =\n \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\";\n\nexport class BlockedError extends Error {\n constructor(public blockID: string, public url: string) {\n super(`craigslist block page (blockID=${blockID}) for ${url}`);\n this.name = \"BlockedError\";\n }\n}\n\nfunction assertNotBlocked(body: string, url: string) {\n if (/\\s*blocked\\s*<\\/title>/i.test(body)) {\n const m = body.match(/blockID[=:]\\s*(\\d+)/i);\n throw new BlockedError(m ? m[1] : \"unknown\", url);\n }\n}\n\nasync function get(url: string, timeoutMs: number, accept: string): Promise<Response> {\n return await fetch(url, {\n method: \"GET\",\n redirect: \"follow\",\n headers: { \"User-Agent\": UA, \"Accept\": accept, \"Accept-Language\": \"en-US,en;q=0.9\" },\n signal: AbortSignal.timeout(timeoutMs),\n });\n}\n\nexport interface DetailItem {\n postingId: number;\n postingUuid: string;\n repostOf?: number;\n recordCreated?: number;\n postedDate?: number;\n updatedDate?: number;\n images?: string[];\n title?: string;\n price?: number;\n priceString?: string;\n body?: string;\n category?: string;\n categoryId?: number;\n attributes?: { label?: string; value?: string }[];\n notices?: unknown[];\n location?: { lat?: number; lon?: number; neighborhood?: string; area?: string };\n url?: string;\n}\n\n/** GET sapi detail. Returns status 404 with item null for a post that is gone. */\nexport async function fetchDetail(\n uuid: string,\n timeoutMs = 10_000,\n): Promise<{ status: number; item: DetailItem | null }> {\n const url = `https://sapi.craigslist.org/web/v8/postings/${\n encodeURIComponent(uuid)\n }?cc=US&lang=en`;\n const res = await get(url, timeoutMs, \"application/json\");\n const text = await res.text();\n assertNotBlocked(text, url);\n if (res.status === 404) return { status: 404, item: null };\n if (!res.ok) return { status: res.status, item: null };\n const json = JSON.parse(text);\n const item = json?.data?.items?.[0] ?? null;\n return { status: res.status, item };\n}\n\n/**\n * Legacy alert rows carry only a numeric post id. The old numeric URL 301s to the\n * /view/d/<slug>/<uuid> form, so the redirect is the pid -> uuid oracle. A deleted or\n * expired post 404s here with no redirect.\n */\nexport async function resolveUuid(\n legacyUrl: string,\n timeoutMs = 10_000,\n): Promise<{ status: number; uuid: string | null }> {\n const res = await get(legacyUrl, timeoutMs, \"text/html\");\n const text = await res.text();\n assertNotBlocked(text, legacyUrl);\n if (!res.ok) return { status: res.status, uuid: null };\n const m = res.url.match(/\\/view\\/d\\/[^/]+\\/([A-Za-z0-9]{15,30})/) ??\n text.match(/rel=\"canonical\"[^>]*\\/view\\/d\\/[^/]+\\/([A-Za-z0-9]{15,30})/);\n return { status: res.status, uuid: m ? m[1] : null };\n}\n\n/** \"3:00U0U_ixFsruu1I5I_0ak07K\" -> the fetchable URL at the given size box. */\nexport function imageUrl(rawId: string, size = \"600x450\"): string {\n return `https://images.craigslist.org/${rawId.replace(/^\\d+:/, \"\")}_${size}.jpg`;\n}\n\nfunction toBase64(bytes: Uint8Array): string {\n let s = \"\";\n const chunk = 0x8000;\n for (let i = 0; i < bytes.length; i += chunk) {\n s += String.fromCharCode(...bytes.subarray(i, i + chunk));\n }\n return btoa(s);\n}\n\n/** Fetches one image and base64s it in memory. Never persisted — the storage quota is 10 MB. */\nexport async function fetchImageBase64(\n rawId: string,\n size = \"600x450\",\n timeoutMs = 10_000,\n): Promise<{ mediaType: string; data: string } | null> {\n const url = imageUrl(rawId, size);\n const res = await get(url, timeoutMs, \"image/*\");\n if (!res.ok) return null;\n const ct = res.headers.get(\"content-type\") ?? \"\";\n if (!ct.startsWith(\"image/\")) return null;\n const buf = new Uint8Array(await res.arrayBuffer());\n if (buf.length === 0) return null;\n return { mediaType: ct.split(\";\")[0].trim(), data: toBase64(buf) };\n}\n\n/** Strip the HTML craigslist puts in `body`, so the judge reads plain text. */\nexport function bodyText(html: string | undefined, max = 4000): string {\n if (!html) return \"\";\n return html\n .replace(/<showcontactinfo[^>]*>.*?<\\/showcontactinfo>/gis, \"[contact info]\")\n .replace(/<br\\s*\\/?>/gi, \"\\n\")\n .replace(/<[^>]+>/g, \"\")\n .replace(/ /g, \" \")\n .replace(/&/g, \"&\")\n .replace(/</g, \"<\")\n .replace(/>/g, \">\")\n .replace(/"/g, '\"')\n .replace(/'/g, \"'\")\n .replace(/\\n{3,}/g, \"\\n\\n\")\n .trim()\n .slice(0, max);\n}\n","createdAt",["D",1789025175111],"branchVersion","branchId","19036aae-467e-44f0-962d-88964ddc5361","id","c358f270-b3fc-477f-a942-c58f7915cb3d","cl-triage",["D",1789025029995],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","019bcf70-5321-758b-8dfa-2be50f1fc9fb","pinnedFileId","e7e3fae2-ace8-11f1-8828-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019bcf70-5321-758b-8dfa-2ea07f250c13","tursoName","c358f270b3fc477fa942c58f7915cb3d","tursoHostname","c358f270b3fc477fa942c58f7915cb3d-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789546246980],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_106":102},"org",{"_99":98,"_100":-5,"_101":102,"_18":54,"_103":104,"_105":24},"branch",{"_13":88,"_31":89,"_42":41,"_90":43,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":44,"_97":98},"isOwned",62,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","herschelrs","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18zOFBxeE4yTklpRW16aUxzZzlSaTZRa3BWN0wifQ","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_42":43,"_31":44,"_37":230,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":231,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":232,"_83":233,"_85":234,"_87":24},"tree",[191,194,195,196,197,198],"files",[191,192,193,194,195,196,197,198],"counts",{"_181":62,"_182":177,"_183":62,"_184":185,"_186":187},"contents",[128,129,130,131,132,133],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_42":174,"_31":175,"_29":176,"_137":-5,"_40":41,"_39":177,"_139":58,"_37":178,"_13":62,"_33":179,"_35":-5,"_23":24,"_143":-5,"_26":180},{"_42":167,"_31":168,"_29":169,"_137":-5,"_40":41,"_39":170,"_139":58,"_37":171,"_13":62,"_33":20,"_35":172,"_23":24,"_143":-5,"_26":173},{"_42":160,"_31":161,"_29":162,"_137":-5,"_40":41,"_39":163,"_139":24,"_37":164,"_13":62,"_33":20,"_35":165,"_23":24,"_143":-5,"_26":166},{"_42":153,"_31":154,"_29":56,"_137":-5,"_40":41,"_39":155,"_139":24,"_37":156,"_13":62,"_33":157,"_35":158,"_23":24,"_143":-5,"_26":159},{"_42":145,"_31":146,"_29":147,"_137":-5,"_40":41,"_39":148,"_139":24,"_37":149,"_13":62,"_33":150,"_35":151,"_23":24,"_143":-5,"_26":152},{"_42":134,"_31":135,"_29":136,"_137":-5,"_40":41,"_39":138,"_139":24,"_37":140,"_13":62,"_33":141,"_35":142,"_23":24,"_143":-5,"_26":144},"288768d8-c3ec-4fe2-a76c-e17329f1b652","judge.cron.tsx","e81164fa-ace8-11f1-b8ae-1607ee4eb77e","parentId",7,"latest",["D",1789025174988],"interval","/**\n * [2] The judge. Drains the queue the email handler filled.\n *\n * Budget: Val Town's free tier kills a run at 60 s, and *repeated* overruns temporarily pause\n * the val — so this keeps a 40 s deadline of its own, stops picking up posts once it is past,\n * and never takes more than MAX_POSTS in one run. Every outbound fetch carries its own\n * AbortSignal.timeout.\n *\n * Per post: one sapi detail call, the dedup ladder, then (only if it is genuinely new) up to\n * five images and exactly one LLM call. Good verdicts from one run go out as a single email.\n */\nimport {\n BlockedError,\n bodyText,\n fetchDetail,\n fetchImageBase64,\n imageUrl,\n resolveUuid,\n} from \"./lib/cl.ts\";\nimport * as db from \"./lib/db.ts\";\nimport { type DedupRow, findDuplicate, imageIdentity } from \"./lib/dedup.ts\";\nimport {\n buildSystem,\n buildUserText,\n criteriaFor,\n DEFAULT_MODEL,\n judge,\n loadCriteria,\n type Verdict,\n} from \"./lib/llm.ts\";\nimport { type DigestItem, feedbackLink, sendDigest } from \"./lib/mail.ts\";\nimport { sign } from \"./lib/sign.ts\";\n\nconst MAX_POSTS = 4;\nconst RUN_DEADLINE_MS = 40_000;\nconst MAX_IMAGES = 5;\nconst NOPE_EXAMPLES = 10;\nconst YES_EXAMPLES = 5;\n\nexport default async function (): Promise<void> {\n const started = Date.now();\n const left = () => RUN_DEADLINE_MS - (Date.now() - started);\n\n await db.init();\n const queue = await db.listQueued(MAX_POSTS);\n console.log(\"RUN\", JSON.stringify({ queued: queue.length, max: MAX_POSTS }));\n if (!queue.length) return;\n\n const apiKey = Deno.env.get(\"ANTHROPIC_API_KEY\") ?? \"\";\n const dryRun = !apiKey;\n const sendInDryRun = Deno.env.get(\"SEND_IN_DRY_RUN\") === \"1\";\n const model = Deno.env.get(\"JUDGE_MODEL\") || DEFAULT_MODEL;\n const criteria = loadCriteria(Deno.env.get(\"CRITERIA_JSON\"));\n if (!Deno.env.get(\"CRITERIA_JSON\")) console.log(\"CRITERIA_JSON unset — built-in default only\");\n if (dryRun) console.log(\"DRY_RUN: ANTHROPIC_API_KEY unset, no LLM call will be made\");\n\n const digest: DigestItem[] = [];\n\n for (const row of queue) {\n if (left() <= 8000) {\n console.log(\"DEADLINE\", JSON.stringify({ msLeft: left(), stoppedBefore: row.uuid }));\n break;\n }\n try {\n const item = await handleOne(row, { apiKey, dryRun, sendInDryRun, model, criteria });\n if (item) digest.push(item);\n } catch (err) {\n if (err instanceof BlockedError) {\n // Craigslist blocked us. Stop the run. Do not retry and do not change egress:\n // evading a block is the fact that turns scraping into a legal problem.\n console.error(\"BLOCKED_BY_CL\", JSON.stringify({ blockID: err.blockID, url: err.url }));\n await db.updatePost(String(row.uuid), {\n status: \"blocked_by_cl\",\n reason: `blockID=${err.blockID}`,\n });\n break;\n }\n console.error(\"POST_ERROR\", String(row.uuid), String(err));\n await db.updatePost(String(row.uuid), {\n status: \"error\",\n reason: String(err).slice(0, 200),\n });\n }\n }\n\n if (digest.length) {\n await sendDigest(digest);\n for (const it of digest) await db.updatePost(it.uuid, { emailed_at: db.now() });\n console.log(\n \"EMAILED\",\n JSON.stringify({ count: digest.length, uuids: digest.map((d) => d.uuid) }),\n );\n }\n console.log(\"DONE\", JSON.stringify({ ms: Date.now() - started, emailed: digest.length }));\n}\n\ninterface Cfg {\n apiKey: string;\n dryRun: boolean;\n sendInDryRun: boolean;\n model: string;\n criteria: ReturnType<typeof loadCriteria>;\n}\n\nasync function handleOne(row: db.Row, cfg: Cfg): Promise<DigestItem | null> {\n let uuid = String(row.uuid);\n const search = String(row.search ?? \"\");\n\n // Legacy pid-only rows: the old numeric URL 301s to the /view/d/<slug>/<uuid> form, which\n // is the only pid -> uuid oracle there is (the uuid is a random 128-bit token).\n if (uuid.startsWith(\"pid:\")) {\n const res = await resolveUuid(String(row.url), 10_000);\n if (res.status === 404) {\n await db.updatePost(uuid, { status: \"gone\", judged_at: db.now() });\n console.log(\"GONE\", JSON.stringify({ key: uuid, via: \"legacy-404\" }));\n return null;\n }\n if (!res.uuid) throw new Error(`no uuid from redirect (status ${res.status})`);\n const existing = await db.getPost(res.uuid);\n if (existing) {\n await db.updatePost(uuid, {\n status: \"dup\",\n dup_of: res.uuid,\n verdict: existing.verdict,\n score: existing.score,\n reason: existing.reason,\n judged_at: db.now(),\n });\n console.log(\"DUP\", JSON.stringify({ key: uuid, dupOf: res.uuid, rule: \"resolved-uuid\" }));\n return null;\n }\n await db.renameUuid(uuid, res.uuid);\n console.log(\"RESOLVED\", JSON.stringify({ from: uuid, to: res.uuid }));\n uuid = res.uuid;\n }\n\n const { status, item } = await fetchDetail(uuid, 10_000);\n if (status === 404 || !item) {\n if (status === 404) {\n await db.updatePost(uuid, { status: \"gone\", judged_at: db.now() });\n console.log(\"GONE\", JSON.stringify({ uuid }));\n return null;\n }\n throw new Error(`sapi status ${status}`);\n }\n if (item.notices?.length) {\n console.log(\"NOTICES\", JSON.stringify({ uuid, notices: item.notices }));\n }\n\n const images = item.images ?? [];\n const lat = item.location?.lat ?? null;\n const lon = item.location?.lon ?? null;\n const hood = item.location?.neighborhood || (row.hood === null ? null : String(row.hood));\n\n await db.updatePost(uuid, {\n pid: item.postingId ?? null,\n repost_of: item.repostOf ?? null,\n title: item.title ?? String(row.title ?? \"\"),\n price: item.price ?? (row.price === null ? null : Number(row.price)),\n hood,\n lat,\n lon,\n image_ids: images.join(\",\"),\n record_created: item.recordCreated ?? null,\n url: item.url ?? String(row.url ?? \"\"),\n status: \"fetched\",\n });\n\n // Anything he has already said no to, in any of its forms.\n const blockKeys = [\n `pid:${item.postingId}`,\n ...(item.repostOf ? [`pid:${item.repostOf}`] : []),\n ...images.map((i) => `img:${imageIdentity(i)}`),\n ];\n const blockedBy = await db.isBlocked(blockKeys);\n if (blockedBy) {\n await db.updatePost(uuid, {\n status: \"rejected\",\n verdict: \"bad\",\n score: 0,\n reason: `blocked by earlier nope (${blockedBy})`,\n judged_at: db.now(),\n });\n console.log(\"BLOCKED\", JSON.stringify({ uuid, key: blockedBy }));\n return null;\n }\n\n const cand: DedupRow = {\n uuid,\n pid: item.postingId ?? null,\n repostOf: item.repostOf ?? null,\n imageIds: images,\n title: item.title ?? \"\",\n price: item.price ?? null,\n lat,\n lon,\n };\n const known = (await db.dedupRows()).map(toDedupRow);\n const dup = findDuplicate(cand, known);\n if (dup) {\n const orig = await db.getPost(dup.uuid);\n await db.updatePost(uuid, {\n status: \"dup\",\n dup_of: dup.uuid,\n verdict: orig?.verdict ?? null,\n score: orig?.score ?? null,\n reason: `duplicate of ${dup.uuid} (${dup.rule})`,\n judged_at: db.now(),\n });\n console.log(\"DUP\", JSON.stringify({ uuid, dupOf: dup.uuid, rule: dup.rule }));\n return null;\n }\n\n // Only now, for a post we have never judged, do we spend images and a model call.\n const picked = images.slice(0, MAX_IMAGES);\n const fetched: { mediaType: string; data: string }[] = [];\n for (const raw of picked) {\n const img = await fetchImageBase64(raw, \"600x450\", 10_000);\n if (img) fetched.push(img);\n }\n\n const { prompt, fellBack } = criteriaFor(cfg.criteria, search);\n if (fellBack) console.log(\"CRITERIA_FALLBACK\", JSON.stringify({ search, uuid }));\n const nopes = await db.feedbackExamples(search, \"nope\", NOPE_EXAMPLES);\n const yeses = await db.feedbackExamples(search, \"yes\", YES_EXAMPLES);\n const system = buildSystem(prompt, nopes, yeses);\n const userText = buildUserText({\n title: item.title ?? \"\",\n priceString: item.priceString ?? null,\n hood,\n body: bodyText(item.body),\n attributes: (item.attributes ?? []).map((a) => `${a.label ?? \"\"}: ${a.value ?? \"\"}`),\n category: item.category ?? null,\n postedIso: iso(item.postedDate),\n createdIso: iso(item.recordCreated),\n search,\n });\n\n let verdict: Verdict;\n if (cfg.dryRun) {\n const promptLen = system.length + userText.length;\n verdict = {\n verdict: \"meh\",\n score: 0,\n reason: `DRY_RUN: no ANTHROPIC_API_KEY (prompt ${promptLen} chars, ${fetched.length} images)`,\n flags: [\"dry\"],\n };\n await db.updatePost(uuid, {\n status: \"judged\",\n verdict: \"dry\",\n score: 0,\n reason: verdict.reason,\n flags: \"dry\",\n prompt_len: promptLen,\n judged_at: db.now(),\n });\n console.log(\n \"DRY\",\n JSON.stringify({ uuid, promptLen, images: fetched.length, title: item.title }),\n );\n if (!cfg.sendInDryRun) return null;\n } else {\n verdict = await judge({\n apiKey: cfg.apiKey,\n model: cfg.model,\n system,\n userText,\n images: fetched,\n timeoutMs: 30_000,\n });\n await db.updatePost(uuid, {\n status: \"judged\",\n verdict: verdict.verdict,\n score: verdict.score,\n reason: verdict.reason,\n flags: verdict.flags.join(\",\"),\n prompt_len: system.length + userText.length,\n judged_at: db.now(),\n });\n console.log(\n \"JUDGED\",\n JSON.stringify({\n uuid,\n verdict: verdict.verdict,\n score: verdict.score,\n images: fetched.length,\n title: item.title,\n }),\n );\n if (verdict.verdict !== \"good\") return null;\n }\n\n return await digestItem(uuid, item, hood, verdict, picked[0] ?? null);\n}\n\nasync function digestItem(\n uuid: string,\n item: { title?: string; priceString?: string; url?: string },\n hood: string | null,\n verdict: Verdict,\n firstImage: string | null,\n): Promise<DigestItem> {\n const secret = Deno.env.get(\"FEEDBACK_SECRET\") ?? \"\";\n const base = feedbackBase();\n let nopeUrl: string | null = null;\n let yesUrl: string | null = null;\n if (secret && base) {\n nopeUrl = feedbackLink(base, uuid, \"nope\", await sign(secret, uuid, \"nope\"));\n yesUrl = feedbackLink(base, uuid, \"yes\", await sign(secret, uuid, \"yes\"));\n } else {\n console.log(\"NO_FEEDBACK_LINKS\", JSON.stringify({ hasSecret: !!secret, base }));\n }\n return {\n uuid,\n title: item.title ?? \"\",\n priceString: item.priceString ?? null,\n hood,\n score: verdict.score,\n reason: verdict.reason,\n flags: verdict.flags,\n url: item.url ?? `https://www.craigslist.org/view/d/x/${uuid}`,\n imageUrl: firstImage ? imageUrl(firstImage, \"600x450\") : null,\n nopeUrl,\n yesUrl,\n };\n}\n\n/**\n * The feedback endpoint's own URL. Val Town exposes the val's public HTTP origin to the\n * runtime; FEEDBACK_URL overrides it. If neither resolves, the digest still goes out, just\n * without buttons — see the NO_FEEDBACK_LINKS log line.\n */\nfunction feedbackBase(): string | null {\n const explicit = Deno.env.get(\"FEEDBACK_URL\");\n if (explicit) return explicit;\n const origin = Deno.env.get(\"VAL_URL\");\n return origin ? origin.replace(/\\/$/, \"\") : null;\n}\n\nfunction iso(epoch: number | undefined): string | null {\n return epoch ? new Date(epoch * 1000).toISOString().slice(0, 16).replace(\"T\", \" \") : null;\n}\n\nfunction toDedupRow(r: db.Row): DedupRow {\n return {\n uuid: String(r.uuid),\n pid: r.pid === null ? null : Number(r.pid),\n repostOf: r.repost_of === null ? null : Number(r.repost_of),\n imageIds: String(r.image_ids ?? \"\").split(\",\").filter(Boolean),\n title: String(r.title ?? \"\"),\n price: r.price === null ? null : Number(r.price),\n lat: r.lat === null ? null : Number(r.lat),\n lon: r.lon === null ? null : Number(r.lon),\n };\n}\n","label",[135],"d0e8b395-610f-42c0-8f2a-172464de03d1","inbox.email.tsx","e7fd2184-ace8-11f1-8bd6-1607ee4eb77e",5,["D",1789025174920],"email","/**\n * [1] Email trigger. Parses a Craigslist saved-search alert, does the cheap dedup that needs\n * no network, enqueues the survivors and returns. It must stay fast: judging inline would\n * put a 60-second hard cap between us and a val that gets temporarily paused for overrunning.\n *\n * Anyone can send mail to this address and the val is public, so the sender is checked here.\n */\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { parseAlert, parseSubject, resultKey } from \"./lib/parse.ts\";\nimport * as db from \"./lib/db.ts\";\n\nconst ALERTS_FROM = \"alerts@alerts.craigslist.org\";\n\ninterface Email {\n from: string;\n to: string[];\n cc?: string | string[];\n bcc?: string | string[];\n subject?: string;\n text?: string;\n html?: string;\n attachments?: File[];\n headers?: Record<string, string>;\n}\n\n/** \"craigslist <alerts@alerts.craigslist.org>\" -> \"alerts@alerts.craigslist.org\" */\nfunction addrOf(s: string | undefined): string {\n if (!s) return \"\";\n const m = s.match(/<([^>]+)>/);\n return (m ? m[1] : s).trim().toLowerCase();\n}\n\nexport default async function (e: Email): Promise<void> {\n const from = addrOf(e.from);\n const senderMatches = from === ALERTS_FROM;\n\n // Gmail filter-forwarding normally preserves the original From. If it ever wraps instead,\n // the original address survives in the forwarded headers or in the body text.\n const inHeaders = Object.values(e.headers ?? {}).some((v) =>\n String(v).toLowerCase().includes(ALERTS_FROM)\n );\n const inBody = `${e.text ?? \"\"}${e.html ?? \"\"}`.toLowerCase().includes(ALERTS_FROM);\n\n const sub = parseSubject(e.subject);\n const alert = parseAlert(e.subject, e.text, e.html);\n const looksLikeAlert = sub !== null && alert.results.length > 0;\n\n // A body mention alone is not enough: anyone can type that address into an email. It has to\n // parse as a real alert as well.\n const accept = senderMatches ? true : ((inHeaders || inBody) && looksLikeAlert);\n\n if (!accept) {\n const record = {\n at: new Date().toISOString(),\n from: e.from ?? \"\",\n subject: e.subject ?? \"\",\n text: (e.text ?? \"\").slice(0, 2000),\n };\n // Gmail's forwarding-verification code lands here; read it with blob.getJSON.\n await blob.setJSON(\"last-other-email\", record);\n console.log(\"OTHER_EMAIL\", JSON.stringify({ from: record.from, subject: record.subject }));\n return;\n }\n\n if (!looksLikeAlert) {\n await blob.setJSON(\"last-unparsed-alert\", {\n at: new Date().toISOString(),\n subject: e.subject ?? \"\",\n text: (e.text ?? \"\").slice(0, 2000),\n });\n console.log(\"ALERT_PARSE_EMPTY\", JSON.stringify({ subject: e.subject ?? \"\" }));\n return;\n }\n\n await db.init();\n let queued = 0;\n const skipped: string[] = [];\n\n for (const r of alert.results) {\n const key = resultKey(r);\n const reason = await skipReason(key, r.pid, r.thumbImgId);\n if (reason) {\n skipped.push(`${key}:${reason}`);\n continue;\n }\n await db.insertQueued({\n uuid: key,\n pid: r.pid,\n search: alert.search,\n title: r.title,\n price: r.price,\n hood: r.hood,\n thumbImgId: r.thumbImgId,\n url: r.url,\n });\n queued++;\n }\n\n console.log(\n \"ALERT\",\n JSON.stringify({\n search: alert.search,\n claimed: alert.count,\n parsed: alert.results.length,\n queued,\n skipped,\n }),\n );\n}\n\n/** Everything here is local to SQLite — no craigslist request is made before the cron runs. */\nasync function skipReason(\n key: string,\n pid: number | null,\n thumbImgId: string | null,\n): Promise<string | null> {\n if (await db.getPost(key)) return \"known\";\n if (pid !== null) {\n if (await db.existsPid(pid)) return \"pid-known\";\n if (await db.isBlocked([`pid:${pid}`])) return \"pid-blocked\";\n }\n if (thumbImgId) {\n if (await db.isBlocked([`img:${thumbImgId}`])) return \"img-blocked\";\n if (await db.existsImage(thumbImgId)) return \"img-known\";\n }\n return null;\n}\n",[146],"52088f85-8b11-4768-96af-395c64402f80","feedback.http.tsx",2,["D",1789025174785],"http","/**\n * [3] The nope / more-like-this buttons in the digest.\n *\n * GET ?u=<uuid>&v=nope|yes&t=<hex hmac-sha256(secret, uuid + \"|\" + v)>\n * POST same query string plus a form field `reason`\n *\n * The token is the only authentication: the val is public and these links travel by email.\n * Everything is idempotent — mail clients prefetch links, and he may click twice.\n */\nimport * as db from \"./lib/db.ts\";\nimport { imageIdentity } from \"./lib/dedup.ts\";\nimport { verify } from \"./lib/sign.ts\";\n\nexport default async function (req: Request): Promise<Response> {\n const secret = Deno.env.get(\"FEEDBACK_SECRET\");\n if (!secret) {\n return new Response(\"feedback is not configured: FEEDBACK_SECRET is unset\\n\", {\n status: 503,\n headers: { \"content-type\": \"text/plain; charset=utf-8\" },\n });\n }\n\n const url = new URL(req.url);\n const uuid = url.searchParams.get(\"u\") ?? \"\";\n const kind = url.searchParams.get(\"v\") ?? \"\";\n const token = url.searchParams.get(\"t\");\n\n if (!uuid || (kind !== \"nope\" && kind !== \"yes\") || !(await verify(secret, uuid, kind, token))) {\n return new Response(\"403 — bad or missing token\\n\", {\n status: 403,\n headers: { \"content-type\": \"text/plain; charset=utf-8\" },\n });\n }\n\n await db.init();\n const post = await db.getPost(uuid);\n if (!post) return page(\"Unknown post.\", null, 404);\n\n if (req.method === \"POST\") {\n const form = await req.formData();\n const reason = String(form.get(\"reason\") ?? \"\").slice(0, 300).trim();\n if (reason) {\n await db.setFeedbackReason(uuid, kind, reason);\n console.log(\"FEEDBACK_REASON\", JSON.stringify({ uuid, kind, reason }));\n }\n return page(\"Noted. Thanks.\", null, 200);\n }\n\n const title = String(post.title ?? uuid);\n\n if (kind === \"nope\") {\n const keys = [\n ...(post.pid ? [`pid:${Number(post.pid)}`] : []),\n ...(post.repost_of ? [`pid:${Number(post.repost_of)}`] : []),\n ...String(post.image_ids ?? \"\").split(\",\").filter(Boolean).map((i) =>\n `img:${imageIdentity(i)}`\n ),\n ...(post.thumb_img_id ? [`img:${String(post.thumb_img_id)}`] : []),\n ];\n await db.addBlocked(keys, uuid, null);\n await db.updatePost(uuid, { status: \"rejected\", verdict: \"bad\" });\n if (!(await db.hasFeedback(uuid, \"nope\"))) await db.addFeedback(uuid, \"nope\", null);\n console.log(\"NOPE\", JSON.stringify({ uuid, keys }));\n return page(\n `Blocked: ${title}`,\n `${keys.length} key(s) suppressed. Why, in one line? (optional)`,\n 200,\n { uuid, kind, token: token ?? \"\" },\n );\n }\n\n await db.updatePost(uuid, { status: \"liked\" });\n if (!(await db.hasFeedback(uuid, \"yes\"))) await db.addFeedback(uuid, \"yes\", null);\n console.log(\"YES\", JSON.stringify({ uuid }));\n return page(\n `More like this: ${title}`,\n \"What made it good? (optional)\",\n 200,\n { uuid, kind, token: token ?? \"\" },\n );\n}\n\nconst esc = (s: string) =>\n s.replace(/&/g, \"&\").replace(/</g, \"<\").replace(/>/g, \">\").replace(/\"/g, \""\");\n\nfunction page(\n heading: string,\n prompt: string | null,\n status: number,\n form?: { uuid: string; kind: string; token: string },\n): Response {\n const body = form && prompt\n ? `<form method=\"post\" action=\"?u=${encodeURIComponent(form.uuid)}&v=${\n encodeURIComponent(form.kind)\n }&t=${encodeURIComponent(form.token)}\">\n <p style=\"color:#555\">${esc(prompt)}</p>\n <input name=\"reason\" maxlength=\"300\" style=\"width:100%;padding:8px;font-size:15px\" autofocus>\n <button style=\"margin-top:8px;padding:8px 14px;font-size:15px\">save</button>\n</form>`\n : \"\";\n return new Response(\n `<!doctype html><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n<title>cl-triage\n\n

${esc(heading)}

\n${body}\n`,\n { status, headers: { \"content-type\": \"text/html; charset=utf-8\" } },\n );\n}\n",[154],"89487f85-bffb-445f-bc4d-263c04dae2d2",".vtignore","e7eae14a-ace8-11f1-8c88-1607ee4eb77e",3,["D",1789025174833],"# Never sync to Val Town. The val is PUBLIC (free tier = zero private vals), so\n# anything here is world-readable. Keep research notes, fixtures and secrets out.\n.env\n.env.*\n*.local\n\nPLAN.md\nCLAUDE.md\nresearch/\ntest/\nscratch/\n\n.git/\n\n# Lockfile is a local build artifact; Val Town resolves imports itself.\ndeno.lock\n",[161],"4afb64de-e43d-4e3a-85c7-c5448521df3a",".gitignore","e7f8b5a4-ace8-11f1-81ba-1607ee4eb77e",4,["D",1789025174910],".env\n.env.*\n*.local\n.vt/\nscratch/\n",[168],"c19b5d71-7c9f-4b31-8ff4-cbc4e764009a","lib","e7cae0ca-ace8-11f1-b8ae-1607ee4eb77e",1,["D",1789025174616],"directory",[175],"pulls","branches","forks","envVars",{"_188":163,"_190":62},"connections",{"_188":62,"_189":62},"count","unfilledCount","emptyCount",{"_42":174,"_31":175,"_29":176,"_137":-5,"_40":41,"_39":177,"_139":58,"_37":227,"_13":62,"_33":179,"_35":-5,"_23":24,"_143":-5,"_200":228,"_26":229},{"_42":223,"_31":32,"_29":30,"_137":176,"_40":41,"_39":14,"_139":58,"_37":224,"_13":62,"_33":34,"_35":36,"_23":24,"_143":-5,"_200":225,"_26":226},{"_42":215,"_31":216,"_29":217,"_137":176,"_40":41,"_39":218,"_139":58,"_37":219,"_13":62,"_33":34,"_35":220,"_23":24,"_143":-5,"_200":221,"_26":222},{"_42":167,"_31":168,"_29":169,"_137":-5,"_40":41,"_39":170,"_139":58,"_37":212,"_13":62,"_33":20,"_35":172,"_23":24,"_143":-5,"_200":213,"_26":214},{"_42":160,"_31":161,"_29":162,"_137":-5,"_40":41,"_39":163,"_139":24,"_37":209,"_13":62,"_33":20,"_35":165,"_23":24,"_143":-5,"_200":210,"_26":211},{"_42":153,"_31":154,"_29":56,"_137":-5,"_40":41,"_39":155,"_139":24,"_37":206,"_13":62,"_33":157,"_35":158,"_23":24,"_143":-5,"_200":207,"_26":208},{"_42":145,"_31":146,"_29":147,"_137":-5,"_40":41,"_39":148,"_139":24,"_37":203,"_13":62,"_33":150,"_35":151,"_23":24,"_143":-5,"_200":204,"_26":205},{"_42":134,"_31":135,"_29":136,"_137":-5,"_40":41,"_39":138,"_139":24,"_37":199,"_13":62,"_33":141,"_35":142,"_23":24,"_143":-5,"_200":201,"_26":202},["D",1789025174988],"children",[],[135],["D",1789025174920],[],[146],["D",1789025174785],[],[154],["D",1789025174833],[],[161],["D",1789025174910],[],[168],"826c2430-3a31-4d09-af53-d9cc981dbcb4","mail.ts","e8045df0-ace8-11f1-8828-1607ee4eb77e",6,["D",1789025174997],"/**\n * The outgoing digest. One email per cron run, carrying every 'good' verdict from that run.\n *\n * Gmail rules (learned the hard way in the sibling calendar-val project):\n * -

Diff · v8