${escapeHtml(form.name)} submitted a Date Me profile.

\n Manage in admin\n

\n ${htmlRows}

`;\n return { subject: `Date Me Doc Submit Success: ${form.name} [${publication.status}]`, text, html };\n}\n\nfunction requireEmail(c: any): string | Response {\n const email = c.get(\"user\")?.email;\n return email || c.redirect(\"/\", 302);\n}\n\nasync function userHasProfile(email: string): Promise {\n const { rows } = await sqlite.execute({\n sql: \"select 1 from DateMeDocs where UserEmail = ? limit 1\",\n args: [email],\n });\n return rows.length > 0;\n}\n\nfunction defaultsFromBody(body: Record): JoinDefaults {\n const arr = (k: string): string[] => {\n const v = body[k];\n return Array.isArray(v) ? v.map(String) : v ? [String(v)] : [];\n };\n // Re-hydrate chips that came in via locations[]= JSON entries so the form\n // can show them again on error.\n const rawLocs = body[\"locations[]\"];\n const locArr = Array.isArray(rawLocs) ? rawLocs : rawLocs ? [rawLocs] : [];\n const Locations = locArr\n .map((v: any) => {\n try { return JSON.parse(String(v)); } catch { return null; }\n })\n .filter((x: any) => x && typeof x.label === \"string\");\n const num = (k: string) => {\n const v = body[k];\n if (v == null || v === \"\") return undefined;\n const n = Number(v);\n return Number.isFinite(n) ? n : undefined;\n };\n return {\n Name: body.Name ? String(body.Name) : undefined,\n Profile: body.Profile ? String(body.Profile) : undefined,\n Birthday: body.Birthday ? String(body.Birthday) : undefined,\n Gender: arr(\"Gender[]\"),\n InterestedIn: arr(\"InterestedIn[]\"),\n Style: body.Style ? String(body.Style) : undefined,\n LocationFlexibility: body.LocationFlexibility ? String(body.LocationFlexibility) : undefined,\n Locations,\n LookingForAgeMin: num(\"LookingForAgeMin\"),\n LookingForAgeMax: num(\"LookingForAgeMax\"),\n LookingForRadiusMi: num(\"LookingForRadiusMi\"),\n };\n}\n\n\n\nexport const Form = async (c: any) => {\n const email = requireEmail(c);\n if (typeof email !== \"string\") return email;\n // If they already have a profile, send them to edit instead of creating a duplicate.\n if (await userHasProfile(email)) return c.redirect(\"/me/edit\", 302);\n return c.html(\n \n \n ,\n );\n};\n\nexport const Submit = async (c: any) => {\n const email = requireEmail(c);\n if (typeof email !== \"string\") return email;\n if (await userHasProfile(email)) return c.redirect(\"/me/edit\", 302);\n\n const body = await c.req.parseBody({ all: true });\n const defaults = defaultsFromBody(body);\n\n const renderError = (reason: any) =>\n c.html(\n \n \n ,\n );\n\n const parsed = await parseProfileForm(body);\n if (!parsed.ok) return renderError(parsed.reason);\n\n // Check for an existing row with this Profile URL before INSERT, so we can\n // give a human error instead of leaking a UNIQUE constraint failure.\n const existing = await findExistingProfileOwner(parsed.form.profile);\n if (existing) {\n return renderError(\n ,\n );\n }\n\n try {\n await createProfile(parsed.form, email);\n } catch (e) {\n console.error(\"[join] error:\", e);\n // Race condition fallback: if two submits raced past the pre-check above,\n // the second one hits a PRIMARY KEY/UNIQUE failure. Show the duplicate\n // message rather than the generic one.\n if (/UNIQUE|PRIMARY KEY/i.test(String(e))) {\n const after = await findExistingProfileOwner(parsed.form.profile);\n return renderError(\n ,\n );\n }\n await sendEmailBestEffort({\n subject: \"Date Me Doc Submit Error: \" + parsed.form.name,\n text: `${email}\\n\\n${String(e)}`,\n });\n return renderError(\"Something went wrong saving your submission. Try again or email steve@val.town.\");\n }\n // Profile saved. Notify Steve — but a failed notification must never break the\n // user's successful submission, so it's best-effort and lives outside the try\n // above (a thrown notification used to be misread as a save failure → 500).\n const publication = await loadPublicationStatus(email, parsed.form.profile);\n await sendEmailBestEffort(buildSubmitNotification(parsed.form, email, new URL(c.req.url).origin, publication));\n return c.redirect(\"/me\", 302);\n};\n\nexport const join = new Hono();\njoin.get(\"/\", Form);\njoin.post(\"/\", Submit);\nexport default join.fetch;\n","label",[353,83],"pages","pulls","branches",1,"forks","envVars",{"_362":364,"_365":26},"connections",{"_362":26,"_363":26},"count","unfilledCount",3,"emptyCount",{"_52":866,"_13":821,"_81":815,"_62":-5,"_54":55,"_345":153,"_346":273,"_56":867,"_58":26,"_84":475,"_349":-5,"_86":24,"_351":-5,"_434":868,"_17":869},{"_52":859,"_13":860,"_81":861,"_62":815,"_54":55,"_345":300,"_346":273,"_56":862,"_58":563,"_84":85,"_349":863,"_86":24,"_351":-5,"_434":864,"_17":865},{"_52":852,"_13":853,"_81":854,"_62":815,"_54":55,"_345":177,"_346":273,"_56":855,"_58":26,"_84":85,"_349":856,"_86":24,"_351":-5,"_434":857,"_17":858},{"_52":844,"_13":845,"_81":846,"_62":815,"_54":55,"_345":847,"_346":273,"_56":848,"_58":563,"_84":85,"_349":849,"_86":24,"_351":-5,"_434":850,"_17":851},{"_52":836,"_13":837,"_81":838,"_62":815,"_54":55,"_345":839,"_346":273,"_56":840,"_58":519,"_84":85,"_349":841,"_86":24,"_351":-5,"_434":842,"_17":843},{"_52":829,"_13":830,"_81":831,"_62":815,"_54":55,"_345":482,"_346":273,"_56":832,"_58":364,"_84":85,"_349":833,"_86":24,"_351":-5,"_434":834,"_17":835},{"_52":822,"_13":823,"_81":824,"_62":815,"_54":55,"_345":300,"_346":273,"_56":825,"_58":548,"_84":85,"_349":826,"_86":24,"_351":-5,"_434":827,"_17":828},{"_52":812,"_13":813,"_81":814,"_62":815,"_54":55,"_345":816,"_346":273,"_56":817,"_58":364,"_84":85,"_349":818,"_86":24,"_351":-5,"_434":819,"_17":820},{"_52":805,"_13":806,"_81":807,"_62":-5,"_54":55,"_345":808,"_346":273,"_56":809,"_58":26,"_84":475,"_349":-5,"_86":24,"_351":-5,"_434":810,"_17":811},{"_52":801,"_13":675,"_81":669,"_62":-5,"_54":55,"_345":153,"_346":273,"_56":802,"_58":26,"_84":475,"_349":-5,"_86":24,"_351":-5,"_434":803,"_17":804},{"_52":794,"_13":795,"_81":796,"_62":669,"_54":55,"_345":167,"_346":273,"_56":797,"_58":26,"_84":85,"_349":798,"_86":24,"_351":-5,"_434":799,"_17":800},{"_52":786,"_13":787,"_81":788,"_62":669,"_54":55,"_345":789,"_346":273,"_56":790,"_58":26,"_84":85,"_349":791,"_86":24,"_351":-5,"_434":792,"_17":793},{"_52":778,"_13":779,"_81":780,"_62":669,"_54":55,"_345":781,"_346":273,"_56":782,"_58":356,"_84":85,"_349":783,"_86":24,"_351":-5,"_434":784,"_17":785},{"_52":771,"_13":772,"_81":773,"_62":669,"_54":55,"_345":167,"_346":273,"_56":774,"_58":26,"_84":85,"_349":775,"_86":24,"_351":-5,"_434":776,"_17":777},{"_52":763,"_13":764,"_81":765,"_62":669,"_54":55,"_345":766,"_346":273,"_56":767,"_58":26,"_84":85,"_349":768,"_86":24,"_351":-5,"_434":769,"_17":770},{"_52":756,"_13":757,"_81":758,"_62":669,"_54":55,"_345":167,"_346":273,"_56":759,"_58":26,"_84":85,"_349":760,"_86":24,"_351":-5,"_434":761,"_17":762},{"_52":749,"_13":750,"_81":751,"_62":669,"_54":55,"_345":167,"_346":273,"_56":752,"_58":26,"_84":85,"_349":753,"_86":24,"_351":-5,"_434":754,"_17":755},{"_52":742,"_13":743,"_81":744,"_62":669,"_54":55,"_345":153,"_346":273,"_56":745,"_58":26,"_84":85,"_349":746,"_86":24,"_351":-5,"_434":747,"_17":748},{"_52":735,"_13":736,"_81":737,"_62":669,"_54":55,"_345":482,"_346":273,"_56":738,"_58":356,"_84":85,"_349":739,"_86":24,"_351":-5,"_434":740,"_17":741},{"_52":728,"_13":729,"_81":730,"_62":669,"_54":55,"_345":167,"_346":273,"_56":731,"_58":26,"_84":85,"_349":732,"_86":24,"_351":-5,"_434":733,"_17":734},{"_52":720,"_13":721,"_81":722,"_62":669,"_54":55,"_345":723,"_346":273,"_56":724,"_58":356,"_84":85,"_349":725,"_86":24,"_351":-5,"_434":726,"_17":727},{"_52":713,"_13":714,"_81":715,"_62":669,"_54":55,"_345":153,"_346":273,"_56":716,"_58":26,"_84":85,"_349":717,"_86":24,"_351":-5,"_434":718,"_17":719},{"_52":706,"_13":707,"_81":708,"_62":669,"_54":55,"_345":449,"_346":273,"_56":709,"_58":356,"_84":85,"_349":710,"_86":24,"_351":-5,"_434":711,"_17":712},{"_52":699,"_13":700,"_81":701,"_62":669,"_54":55,"_345":167,"_346":273,"_56":702,"_58":356,"_84":85,"_349":703,"_86":24,"_351":-5,"_434":704,"_17":705},{"_52":692,"_13":693,"_81":694,"_62":669,"_54":55,"_345":482,"_346":273,"_56":695,"_58":356,"_84":85,"_349":696,"_86":24,"_351":-5,"_434":697,"_17":698},{"_52":684,"_13":685,"_81":686,"_62":669,"_54":55,"_345":300,"_346":273,"_56":687,"_58":688,"_84":85,"_349":689,"_86":24,"_351":-5,"_434":690,"_17":691},{"_52":676,"_13":677,"_81":678,"_62":669,"_54":55,"_345":679,"_346":273,"_56":680,"_58":364,"_84":85,"_349":681,"_86":24,"_351":-5,"_434":682,"_17":683},{"_52":666,"_13":667,"_81":668,"_62":669,"_54":55,"_345":670,"_346":273,"_56":671,"_58":364,"_84":85,"_349":672,"_86":24,"_351":-5,"_434":673,"_17":674},{"_52":661,"_13":353,"_81":344,"_62":-5,"_54":55,"_345":662,"_346":273,"_56":663,"_58":356,"_84":475,"_349":-5,"_86":24,"_351":-5,"_434":664,"_17":665},{"_52":657,"_13":604,"_81":599,"_62":344,"_54":55,"_345":167,"_346":273,"_56":658,"_58":26,"_84":475,"_349":-5,"_86":24,"_351":-5,"_434":659,"_17":660},{"_52":649,"_13":650,"_81":651,"_62":599,"_54":55,"_345":652,"_346":273,"_56":653,"_58":356,"_84":85,"_349":654,"_86":24,"_351":-5,"_434":655,"_17":656},{"_52":642,"_13":643,"_81":644,"_62":599,"_54":55,"_345":167,"_346":273,"_56":645,"_58":26,"_84":85,"_349":646,"_86":24,"_351":-5,"_434":647,"_17":648},{"_52":635,"_13":636,"_81":637,"_62":599,"_54":55,"_345":167,"_346":273,"_56":638,"_58":26,"_84":85,"_349":639,"_86":24,"_351":-5,"_434":640,"_17":641},{"_52":628,"_13":629,"_81":630,"_62":599,"_54":55,"_345":167,"_346":273,"_56":631,"_58":26,"_84":85,"_349":632,"_86":24,"_351":-5,"_434":633,"_17":634},{"_52":621,"_13":622,"_81":623,"_62":599,"_54":55,"_345":167,"_346":273,"_56":624,"_58":26,"_84":85,"_349":625,"_86":24,"_351":-5,"_434":626,"_17":627},{"_52":613,"_13":614,"_81":615,"_62":599,"_54":55,"_345":616,"_346":273,"_56":617,"_58":563,"_84":85,"_349":618,"_86":24,"_351":-5,"_434":619,"_17":620},{"_52":605,"_13":606,"_81":607,"_62":599,"_54":55,"_345":608,"_346":273,"_56":609,"_58":356,"_84":85,"_349":610,"_86":24,"_351":-5,"_434":611,"_17":612},{"_52":596,"_13":597,"_81":598,"_62":599,"_54":55,"_345":167,"_346":273,"_56":600,"_58":26,"_84":85,"_349":601,"_86":24,"_351":-5,"_434":602,"_17":603},{"_52":589,"_13":590,"_81":591,"_62":344,"_54":55,"_345":300,"_346":273,"_56":592,"_58":356,"_84":85,"_349":593,"_86":24,"_351":-5,"_434":594,"_17":595},{"_52":582,"_13":583,"_81":584,"_62":344,"_54":55,"_345":167,"_346":273,"_56":585,"_58":26,"_84":85,"_349":586,"_86":24,"_351":-5,"_434":587,"_17":588},{"_52":574,"_13":575,"_81":576,"_62":344,"_54":55,"_345":300,"_346":273,"_56":577,"_58":578,"_84":85,"_349":579,"_86":24,"_351":-5,"_434":580,"_17":581},{"_52":567,"_13":568,"_81":569,"_62":344,"_54":55,"_345":449,"_346":273,"_56":570,"_58":548,"_84":85,"_349":571,"_86":24,"_351":-5,"_434":572,"_17":573},{"_52":559,"_13":560,"_81":561,"_62":344,"_54":55,"_345":449,"_346":273,"_56":562,"_58":563,"_84":85,"_349":564,"_86":24,"_351":-5,"_434":565,"_17":566},{"_52":552,"_13":553,"_81":554,"_62":344,"_54":55,"_345":167,"_346":273,"_56":555,"_58":519,"_84":85,"_349":556,"_86":24,"_351":-5,"_434":557,"_17":558},{"_52":543,"_13":544,"_81":545,"_62":344,"_54":55,"_345":546,"_346":273,"_56":547,"_58":548,"_84":85,"_349":549,"_86":24,"_351":-5,"_434":550,"_17":551},{"_52":534,"_13":535,"_81":536,"_62":344,"_54":55,"_345":537,"_346":273,"_56":538,"_58":539,"_84":85,"_349":540,"_86":24,"_351":-5,"_434":541,"_17":542},{"_52":343,"_13":83,"_81":82,"_62":344,"_54":55,"_345":255,"_346":273,"_56":531,"_58":348,"_84":85,"_349":350,"_86":24,"_351":-5,"_434":532,"_17":533},{"_52":523,"_13":524,"_81":525,"_62":344,"_54":55,"_345":167,"_346":273,"_56":526,"_58":527,"_84":85,"_349":528,"_86":24,"_351":-5,"_434":529,"_17":530},{"_52":514,"_13":515,"_81":516,"_62":344,"_54":55,"_345":517,"_346":273,"_56":518,"_58":519,"_84":85,"_349":520,"_86":24,"_351":-5,"_434":521,"_17":522},{"_52":507,"_13":508,"_81":509,"_62":344,"_54":55,"_345":167,"_346":273,"_56":510,"_58":26,"_84":85,"_349":511,"_86":24,"_351":-5,"_434":512,"_17":513},{"_52":500,"_13":501,"_81":502,"_62":344,"_54":55,"_345":167,"_346":273,"_56":503,"_58":26,"_84":85,"_349":504,"_86":24,"_351":-5,"_434":505,"_17":506},{"_52":495,"_13":487,"_81":481,"_62":-5,"_54":55,"_345":496,"_346":273,"_56":497,"_58":26,"_84":475,"_349":-5,"_86":24,"_351":-5,"_434":498,"_17":499},{"_52":488,"_13":489,"_81":490,"_62":481,"_54":55,"_345":482,"_346":273,"_56":491,"_58":26,"_84":85,"_349":492,"_86":24,"_351":-5,"_434":493,"_17":494},{"_52":478,"_13":479,"_81":480,"_62":481,"_54":55,"_345":482,"_346":273,"_56":483,"_58":356,"_84":85,"_349":484,"_86":24,"_351":-5,"_434":485,"_17":486},{"_52":473,"_13":472,"_81":466,"_62":-5,"_54":55,"_345":153,"_346":273,"_56":474,"_58":26,"_84":475,"_349":-5,"_86":24,"_351":-5,"_434":476,"_17":477},{"_52":463,"_13":464,"_81":465,"_62":466,"_54":55,"_345":467,"_346":273,"_56":468,"_58":356,"_84":21,"_349":469,"_86":24,"_351":-5,"_434":470,"_17":471},{"_52":455,"_13":456,"_81":457,"_62":-5,"_54":55,"_345":458,"_346":273,"_56":459,"_58":277,"_84":21,"_349":460,"_86":24,"_351":-5,"_434":461,"_17":462},{"_52":446,"_13":447,"_81":448,"_62":-5,"_54":55,"_345":449,"_346":273,"_56":450,"_58":451,"_84":21,"_349":452,"_86":24,"_351":-5,"_434":453,"_17":454},{"_52":437,"_13":438,"_81":271,"_62":-5,"_54":55,"_345":439,"_346":273,"_56":440,"_58":441,"_84":432,"_349":442,"_86":24,"_351":443,"_434":444,"_17":445},{"_52":426,"_13":427,"_81":428,"_62":-5,"_54":55,"_345":429,"_346":273,"_56":430,"_58":431,"_84":432,"_349":433,"_86":24,"_351":-5,"_434":435,"_17":436},"d08d58bc-47ca-11f1-ad6e-42b51c65c3df","rss","0022bb14-e591-11ef-9eb9-e6cdfca9ef9f",190,["D",1777907183273],15,"http","// Public RSS feed: metadata-only. We deliberately omit the doc URL and the\n// user's contact email, since the directory itself is sign-in only.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { ageFromBirthday, safeParse } from \"./lib/json_safe.ts\";\n\nconst PUBLIC_FIELDS = [\n \"Gender\",\n \"InterestedIn\",\n \"Location\",\n \"Style\",\n \"LocationFlexibility\",\n];\n\nconst HOME = \"https://dateme.directory\";\n\nfunction escapeXml(s: string): string {\n return String(s).replace(/[&<>\"']/g, (c) =>\n ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\", \"'\": \"'\" } as Record)[c]\n );\n}\n\nasync function profileGuid(profile: string): Promise {\n const buf = await crypto.subtle.digest(\n \"SHA-256\",\n new TextEncoder().encode(profile),\n );\n const hex = Array.from(new Uint8Array(buf))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n return `dateme-profile-${hex.slice(0, 16)}`;\n}\n\nexport async function rss(_req: Request) {\n const { rows } = await sqlite.execute(\n `select * from DateMeDocs\n where DeletedAt is null and blocked_at is null\n order by LastUpdated desc limit 20`,\n );\n\n const items = await Promise.all(rows.map(async (p: any) => {\n const title = escapeXml(safeParse(p.Name));\n const lines: string[] = [];\n const age = ageFromBirthday(p.Birthday);\n if (age != null) lines.push(`Age: ${age}`);\n for (const k of PUBLIC_FIELDS) {\n if (p[k]) lines.push(`${k}: ${safeParse(p[k])}`);\n }\n const description = escapeXml(lines.join(\"\\n\"));\n const guid = await profileGuid(safeParse(p.Profile));\n const pubDate = new Date(safeParse(p.LastUpdated)).toUTCString();\n return ` \n ${title}\n ${description}\n ${HOME}\n ${guid}\n ${pubDate}\n `;\n }));\n\n const xml = `\n\n\n Date Me Directory\n Recent profiles in the Date Me Directory. Sign in at ${HOME} to view full profiles.\n ${HOME}\n \n${items.join(\"\\n\")}\n\n`;\n\n return new Response(xml, { headers: { \"Content-type\": \"application/rss+xml\" } });\n}\n","children",[],[427],"568fb5bd-856f-4cff-8d14-feb708081947","index",264,["D",1783631995713],23,"import { Hono } from \"npm:hono@3.12.12\";\nimport { serveFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { auth } from \"./lib/auth.ts\";\nimport { admin } from \"./pages/admin/index.tsx\";\nimport apiBrowse from \"./pages/api_browse.ts\";\nimport banned from \"./pages/banned.tsx\";\nimport browse from \"./pages/browse\";\nimport { claim } from \"./pages/claim\";\nimport { contact } from \"./pages/contact\";\nimport faq from \"./pages/faq\";\nimport { flag } from \"./pages/flag.tsx\";\nimport home from \"./pages/home\";\nimport { join } from \"./pages/join\";\nimport { me } from \"./pages/me\";\nimport reportSpam from \"./pages/report_spam.tsx\";\nimport { rss } from \"./rss\";\nimport { signIn } from \"./pages/sign_in.tsx\";\n\ntype AppEnv = {\n Variables: {\n user: { id: string; email: string; name?: string } | null;\n };\n};\n\nconst app = new Hono();\n\n// ── Routes that don't need our session lookup ───────────────────────────────\n// Better Auth handles its own session reads; static + rss render no user UI.\n\napp.on([\"GET\", \"POST\"], \"/api/auth/*\", (c) => auth.handler(c.req.raw));\napp.get(\"/static/favicon.svg\", (c) => serveFile(c.req.path));\napp.get(\"/rss.xml\", (c) => rss(c.req.raw));\n// API-key authed, not cookie-session — deliberately outside userApp's guards.\napp.get(\"/api/browse\", apiBrowse);\n\n// ── Everything else hydrates the user once via middleware ───────────────────\n\nconst userApp = new Hono();\n\nuserApp.use(\"*\", async (c, next) => {\n const session = await auth.api.getSession({ headers: c.req.raw.headers });\n c.set(\"user\", (session?.user as any) ?? null);\n await next();\n});\n\nuserApp.post(\"/sign-out\", async (c) => {\n try {\n await auth.api.signOut({ headers: c.req.raw.headers });\n } catch (e) {\n console.error(\"[sign-out] error:\", e);\n }\n return c.redirect(\"/\", 302);\n});\n\nuserApp.get(\"/\", home);\nuserApp.route(\"/sign-in\", signIn);\nuserApp.get(\"/browse\", browse);\nuserApp.route(\"/join\", join);\nuserApp.route(\"/me\", me);\nuserApp.route(\"/claim\", claim);\nuserApp.route(\"/contact\", contact);\nuserApp.route(\"/flag\", flag);\nuserApp.route(\"/admin\", admin);\nuserApp.get(\"/report-spam\", reportSpam);\nuserApp.get(\"/banned\", banned);\nuserApp.get(\"/faq\", faq);\n\napp.route(\"/\", userApp);\n\napp.onError((e) => Promise.reject(e));\nexport default app.fetch;\n","date",[],[438],"445914a2-5c25-11f1-bbd5-ee650bb23af1","README.md","b0c1b956-e58d-11ef-b938-e6cdfca9ef9f",233,["D",1780145055495],11,"# Date Me Directory\n\nA directory of long-form, earnest dating profiles (\"Date Me Docs\"). People write their own profile on Google Docs, Notion, or a personal site — this app indexes them so others can browse, filter by location/age/gender preference, and reach out via a relayed contact form.\n\n**Live site**: \n\n## Architecture\n\n- **Routing**: [Hono](https://hono.dev/) with hono/jsx for server-rendered pages.\n- **Styling**: Tailwind via the [twind](https://github.com/tw-in-js/twind) CDN (runtime, no build step).\n- **Auth**: [Better Auth](https://www.better-auth.com/) with the magic-link plugin (no passwords). Session in an `httpOnly` cookie.\n- **DB**: SQLite via `std/sqlite` — project-scoped (not personal-org).\n- **Email**: `std/email`.\n- **Spam classifier + flag review**: `std/openai` (`gpt-4o-mini`), fail-open.\n- **Geocoding**: client-side autocomplete via [Photon](https://photon.komoot.io/) wrapped in the [`stevekrouse/location_input`](https://www.val.town/x/stevekrouse/location_input) form-associated web component; server-side single-shot geocode for legacy free-text queries.\n\n```mermaid\nerDiagram\n user ||--o{ session : \"has\"\n user ||--o| DateMeDocs : \"claims (UserEmail)\"\n DateMeDocs ||--o{ dateme_profile_locations : \"geocoded sidecar\"\n DateMeDocs ||--o{ dateme_messages : \"sender of\"\n DateMeDocs ||--o{ dateme_messages : \"recipient of\"\n DateMeDocs ||--o{ dateme_reports : \"target of\"\n dateme_messages ||--o{ dateme_reports : \"subject of (type=message_spam)\"\n```\n\n## Layout\n\n```\ndateme/\n├── index # App root: routes + session middleware\n├── pages/ # Hono route handlers + JSX pages\n│ ├── layout # Shared header/footer/twind/web-component bootstrap\n│ ├── home # / — public landing\n│ ├── sign_in.tsx # /sign-in (+ /sign-in/sent) — magic-link form\n│ ├── browse # /browse — filtered table, requires sign-in (profile optional)\n│ ├── join # /join — submit a new profile\n│ ├── claim # /claim — link an existing doc to your account via token-in-doc\n│ ├── me # /me, /me/edit, /me/pause, /me/republish, /me/delete\n│ ├── contact # /contact?profile=… — relayed first-contact email\n│ ├── flag.tsx # /flag?profile=… — flag a profile for admin review\n│ ├── report_spam.tsx # /report-spam?id=…&t=… — one-click recipient spam report\n│ ├── banned.tsx # /banned — suspended-account page\n│ ├── faq # /faq\n│ └── admin/ # admin-only pages, allowlist guarded (see lib/admin_guard.ts)\n│ ├── index.tsx # mounts the admin sub-app under /admin\n│ ├── layout.tsx # admin chrome\n│ ├── badges.tsx # shared badge components\n│ ├── dashboard.tsx # /admin — counts + recent reports\n│ ├── reports.tsx # /admin/reports[/:id] — review queue + decide\n│ ├── messages.tsx # /admin/messages — paginated message log\n│ ├── users.tsx # /admin/users — list of all claimed users\n│ └── user_detail.tsx # /admin/users/:email — actions (ban/unban/soft-delete/hard-delete)\n├── components/ # Pure JSX components\n│ ├── JoinForm.tsx\n│ ├── BrowseFilters.tsx\n│ ├── SearchHeader.tsx\n│ ├── ProfileTable.tsx\n│ ├── ProfileRow.tsx\n│ └── ProfileSummary.tsx\n├── lib/ # Domain helpers (no JSX)\n│ ├── auth.ts # Better Auth instance (magic link)\n│ ├── auth_schema.ts # Better Auth CREATE TABLEs (kept but no longer auto-run on cold start)\n│ ├── admin_guard.ts # ADMIN_EMAILS allowlist + requireAdmin() (returns 404, not 302)\n│ ├── profile_guard.ts # requireSignedIn() (browse/contact) + requireClaimedProfile() (flag)\n│ ├── profile_persist.ts # parseProfileForm / createProfile / updateProfile\n│ ├── profile_search.ts # gender/age + geo filtering, local-then-remote sort\n│ ├── profile_locations.ts # Bulk-load lat/lon rows for a set of profiles\n│ ├── doc_validator.ts # Direct-fetch + Jina fallback URL/page checks\n│ ├── claim_token.ts # SHA-256-derived 8-char doc-claim code\n│ ├── messages.ts # createMessage / banUser / unbanUser\n│ ├── reports.ts # unified create/decide/list for profile_flag + message_spam\n│ ├── openai_review.ts # checkSpam (pre-send) + reviewProfileFlag (post-flag)\n│ ├── photon.ts # Server-side single-shot geocode\n│ ├── haversine.ts # Great-circle distance\n│ └── json_safe.ts # safeParse, httpsIfy\n├── rss # /rss.xml — public, metadata-only feed\n├── scripts/\n│ └── smoke_test.ts # Read-only smoke test for endpoints + schema (run before merge)\n└── static/favicon.svg\n```\n\n## Database\n\n```\nDateMeDocs -- one row per profile. PK = Profile (the doc URL, JSON-encoded).\n -- Most string fields are JSON-wrapped (legacy schema).\n -- Status columns: DeletedAt (soft delete / pause), blocked_at + ban_reason (admin ban),\n -- UserEmail (the claim).\ndateme_profile_locations -- geocoded sidecar for DateMeDocs.Location. (profile, ord) PK.\n -- Holds latitude, longitude, is_remote — used by searchProfiles for radius filtering.\ndateme_messages -- first-contact relayed messages. id INTEGER PK, sender_email, recipient_email,\n -- body, sent_at, report_token (16-byte hex for the email's report link).\ndateme_reports -- unified report queue. type='message_spam' (auto-banned on insert) or\n -- 'profile_flag' (queued for admin). Holds AI verdict + admin decision.\n\nuser, session, account, verification -- Better Auth tables. user is the canonical auth record;\n -- DateMeDocs.UserEmail joins to it. account/verification are mostly\n -- empty on a magic-link-only setup but kept for Better Auth's queries.\n```\n\n## Auth flow\n\n1. `POST /sign-in` with email → Better Auth sends a magic link via `std/email`.\n2. Click → `/api/auth/magic-link/verify` → cookie session set → redirect to `/me`.\n3. `/me` finds the user's profile by `UserEmail`. If none, falls back to **auto-claim** for an unclaimed row whose `Contact` exactly matches the signed-in email (safe — magic-link auth proves ownership). Otherwise → `/claim`.\n\nManual claim flow (when auto-claim doesn't apply):\n\n1. `/claim/existing` → user pastes the doc URL.\n2. We hand them an 8-char code (HMAC of `docUrl + email`).\n3. They paste it into the doc, click **Verify**.\n4. We re-fetch (bypassing Jina cache) and confirm the code is in the body, then set `UserEmail`.\n\n## Reports + moderation\n\nThere are two paths into `dateme_reports`:\n\n- **`type='message_spam'`** — recipient clicks the report link in the message email. Auto-bans the sender; report row records the auto-decision for audit. Optional async OpenAI review for record-keeping.\n- **`type='profile_flag'`** — any signed-in user clicks the Flag button on a profile row, optionally with a reason. Synchronous OpenAI review (truncated to 100k chars of profile content) attaches a verdict, but **admin always decides** — AI is advisor, never judge. Steve gets an email per flag.\n\nThe admin queue (`/admin/reports`) shows both types unified. Decisions: ban (sets `DateMeDocs.blocked_at` + `ban_reason`) or dismiss.\n\n## Doc validation\n\n`lib/doc_validator.ts` enforces:\n\n- HTTP(S) only, no socials (Instagram / X / TikTok / Facebook).\n- Direct fetch (with `redirect: follow`, 20s timeout).\n- Google Docs `/document/d/{ID}/...` rewritten to `/export?format=txt`.\n- If the page is < 500 chars after `\n \n \n \n

\n {Object.entries(email ? SIGNED_IN_TABS : PUBLIC_TABS).map(([link, title]) => (\n \n {title === \"Home\" ? Date Me Directory : title}\n \n ))}\n \n {email\n ? (\n <>\n \n My profile\n \n \n \n )\n : Sign in}\n \n

{children}

\n \n \n \n );\n}\n",[],[353,524],["D",1780232480057],[],[353,83],"14b22b94-48c5-11f1-a98b-42b51c65c3df","home","6f0108b2-e58f-11ef-be74-e6cdfca9ef9f",218,["D",1778014671803],31,"/** @jsxImportSource npm:hono@3.12.12/jsx */\nimport Layout from \"./layout\";\n\nexport default async function Home(c) {\n const email = c.get(\"user\")?.email;\n\n return c.html(\n \n

Date thoughtfully

\n Date Me Docs are long-form, earnest dating profiles. People host them on Google Docs,\n Notion, or personal sites.\n

\n The directory is now sign-in only, to keep spam out and help members feel safer.\n

\n {email\n ? (\n \n Browse the directory\n \n )\n : (\n \n Sign in or sign up\n \n )}\n

\n ,\n );\n}",[],[353,535],"aa5ab4f6-fcf8-45a5-85ae-fcd81ff6ee33","flag.tsx","c2de1508-47b6-11f1-a161-42b51c65c3df",256,["D",1783359419353],7,"/** @jsxImportSource npm:hono@3.12.12/jsx */\nimport { email as sendEmail } from \"https://esm.town/v/std/email\";\nimport { FROM_ADDRESS } from \"../lib/send_email.ts\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { Hono } from \"npm:hono@3.12.12\";\nimport { safeParse } from \"../lib/json_safe.ts\";\nimport { requireClaimedProfile } from \"../lib/profile_guard.ts\";\nimport {\n createProfileFlag,\n flagsRecentForReporter,\n hasReporterFlaggedTarget,\n runAiReview,\n} from \"../lib/reports.ts\";\nimport Layout from \"./layout\";\n\nconst ADMIN_EMAIL = \"stevekrouse.dateme_contact@valtown.email\";\nconst FLAGS_PER_DAY_LIMIT = 5;\nconst MAX_REASON = 500;\n\nasync function findTarget(profileUrl: string) {\n const { rows } = await sqlite.execute({\n sql:\n \"select Name, Profile, UserEmail, blocked_at, DeletedAt from DateMeDocs where Profile = ? limit 1\",\n args: [JSON.stringify(profileUrl)],\n });\n return (rows[0] as any) ?? null;\n}\n\nconst Box = ({ children }: { children: any }) => (\n

{children}

\n);\n\nconst Err = ({ msg }: { msg: string }) => (\n

{msg}

\n);\n\nexport const flag = new Hono();\n\nflag.get(\"/\", async (c) => {\n const guard = await requireClaimedProfile(c);\n if (guard instanceof Response) return guard;\n const { email: reporterEmail } = guard;\n\n const profileUrl = c.req.query(\"profile\");\n const error = c.req.query(\"error\");\n if (!profileUrl) return c.redirect(\"/browse\", 302);\n\n const t = await findTarget(profileUrl);\n if (!t) {\n return c.html(\n \n \n

Profile not found

\n Couldn't find that profile.{\" \"}\n Back to browse.\n

\n \n ,\n );\n }\n\n if (t.UserEmail === reporterEmail) {\n return c.html(\n \n \n

Can't flag your own profile

\n Back to browse\n

\n \n ,\n );\n }\n\n const targetName = safeParse(t.Name);\n return c.html(\n \n \n

Flag {targetName}'s profile

\n Use this only for genuine concerns: spam pitches, harassment, illegal content,\n fake/joke profiles, or impersonation. An admin will review and take action.\n You won't hear back unless we have questions.\n

\n {error && }\n \n \n ,\n );\n});\n\nflag.post(\"/\", async (c) => {\n const guard = await requireClaimedProfile(c);\n if (guard instanceof Response) return guard;\n const { email: reporterEmail } = guard;\n\n const body = await c.req.parseBody();\n const profileUrl = String(body.profile_url ?? \"\").trim();\n let reason = String(body.reason ?? \"\").trim();\n if (reason.length > MAX_REASON) reason = reason.slice(0, MAX_REASON);\n if (!profileUrl) return c.redirect(\"/browse\", 302);\n\n const back = `/flag?profile=${encodeURIComponent(profileUrl)}`;\n const t = await findTarget(profileUrl);\n if (!t) {\n return c.redirect(`${back}&error=${encodeURIComponent(\"Profile not found.\")}`, 302);\n }\n if (t.UserEmail === reporterEmail) {\n return c.redirect(\n `${back}&error=${encodeURIComponent(\"You can't flag your own profile.\")}`,\n 302,\n );\n }\n\n // Rate limits.\n const recent = await flagsRecentForReporter(reporterEmail);\n if (recent >= FLAGS_PER_DAY_LIMIT) {\n return c.redirect(\n `${back}&error=${encodeURIComponent(\"You've submitted too many flags today. Try again tomorrow.\")}`,\n 302,\n );\n }\n if (await hasReporterFlaggedTarget(reporterEmail, profileUrl)) {\n return c.redirect(\n `${back}&error=${encodeURIComponent(\"You've already flagged this profile.\")}`,\n 302,\n );\n }\n\n const id = await createProfileFlag({\n flaggedProfileUrl: profileUrl,\n flaggedTargetEmail: t.UserEmail ?? null,\n reporterEmail,\n reason: reason || null,\n });\n\n // Synchronous AI review — total < 5s, acceptable in a POST handler.\n await runAiReview(id);\n\n // Re-read the row to grab AI verdict for the email.\n const { rows: rRows } = await sqlite.execute({\n sql: \"select ai_verdict, ai_reasoning from dateme_reports where id = ? limit 1\",\n args: [id],\n });\n const aiRow = (rRows[0] as any) ?? {};\n\n const targetName = safeParse(t.Name);\n const adminText =\n `New profile flag (id ${id})\\n\\n`\n + `Target: ${targetName} <${t.UserEmail ?? \"(unclaimed)\"}>\\n`\n + `Profile: ${profileUrl}\\n`\n + `Reporter: ${reporterEmail}\\n\\n`\n + `Reporter's reason:\\n${reason || \"(none)\"}\\n\\n`\n + `AI verdict: ${aiRow.ai_verdict ?? \"(none)\"}\\n`\n + `AI reasoning: ${aiRow.ai_reasoning ?? \"(none)\"}\\n\\n`\n + `Review: https://dateme.directory/admin/reports/${id}`;\n\n try {\n await sendEmail({\n from: FROM_ADDRESS,\n to: ADMIN_EMAIL,\n replyTo: reporterEmail,\n subject: `Date Me Directory: profile flagged (${targetName})`,\n text: adminText,\n } as any);\n } catch (e) {\n console.error(\"[flag] sendEmail error:\", e);\n }\n\n return c.html(\n \n \n

Thanks — we'll review it

\n We've logged your flag against {targetName}'s profile and an admin will look at it\n shortly. You won't hear back unless we have questions.\n

\n Back to browse\n

\n \n ,\n );\n});\n\nexport default flag.fetch;\n",[],[353,544],"c2dfc920-47b6-11f1-a161-42b51c65c3df","faq","2249512c-e595-11ef-8e1f-e6cdfca9ef9f",["D",1777898570362],"/** @jsxImportSource npm:hono@3.12.12/jsx */\nimport Layout from \"./layout\";\n\nconst linkClass = \"text-sky-600 hover:text-sky-500\";\n\nexport default function FAQ(c) {\n return c.html(\n \n

FAQ

Press

\n \n Tired of Dating Apps, Some Turn to ‘Date-Me Docs’ (New York Times)\n \n
\n \n ‘Date Me’ Google Docs and the Hyper-Optimized Quest for Love (Wired)\n \n
\n \n Four ways to find love - without the apps (The Guardian)\n \n

\n\n

Contact

\n Contact me by email at:{\" \"}\n \n stevekrouse.dateme_contact@valtown.email\n \n

\n This site was made with ❤️ by Steve Krouse using{\" \"}\n Val Town{\" \"}\n (view the code).\n Please reach out with questions, feedback, or suggestions!\n

\n This service is provided free of charge. All I ask is to be notified if you find love. \n

\n ,\n );\n}",[],[353,553],"4459d6f8-5c25-11f1-bbd5-ee650bb23af1","contact","c2dde1dc-47b6-11f1-a161-42b51c65c3df",["D",1780145055495],4,"/** @jsxImportSource npm:hono@3.12.12/jsx */\nimport { sendEmail } from \"../lib/send_email.ts\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { Hono } from \"npm:hono@3.12.12\";\nimport { safeParse } from \"../lib/json_safe.ts\";\nimport { createMessage, recentSendCount } from \"../lib/messages.ts\";\nimport { requireSignedIn } from \"../lib/profile_guard.ts\";\nimport { checkSpam } from \"../lib/openai_review.ts\";\nimport Layout from \"./layout\";\n\nconst DAILY_LIMIT = 1;\nconst MAX_BODY = 4000;\n\nasync function findRecipient(profileUrl: string) {\n const { rows } = await sqlite.execute({\n sql:\n \"select Name, Profile, UserEmail, blocked_at, DeletedAt from DateMeDocs where Profile = ? limit 1\",\n args: [JSON.stringify(profileUrl)],\n });\n return (rows[0] as any) ?? null;\n}\n\nconst Box = ({ children }: { children: any }) => (\n

{children}

\n);\n\n// Prominent, sticks to the top of the form so the user actually sees it.\n// Rendered as a yellow \"heads up\" banner with an icon — not the small inline red text it used to be.\nconst Err = ({ msg }: { msg: string }) => (\n \n

\n ⚠️\n

Message not sent

{msg}

\n Your message text is preserved below — copy it somewhere safe before leaving this page.\n

\n \n);\n\nexport const contact = new Hono();\n\n// Helper: build the redirect-back URL, preserving both the error message and\n// the user's typed message body so they don't lose what they wrote.\nfunction backTo(profileUrl: string, error: string, body?: string): string {\n const params = new URLSearchParams({ profile: profileUrl, error });\n if (body) params.set(\"body\", body);\n return `/contact?${params.toString()}`;\n}\n\ncontact.get(\"/\", async (c) => {\n const guard = await requireSignedIn(c);\n if (guard instanceof Response) return guard;\n const { email: senderEmail } = guard;\n\n const profileUrl = c.req.query(\"profile\");\n const error = c.req.query(\"error\");\n const preservedBody = c.req.query(\"body\") ?? \"\";\n if (!profileUrl) return c.redirect(\"/browse\", 302);\n\n const r = await findRecipient(profileUrl);\n if (!r || r.DeletedAt || r.blocked_at || !r.UserEmail) {\n return c.html(\n \n \n

Can't reach this profile

\n This profile has been removed or hasn't been claimed yet, so we can't pass on a\n message. Back to browse.\n

\n \n ,\n );\n }\n\n const recipientName = safeParse(r.Name);\n return c.html(\n \n \n

Send a message to {recipientName}

\n They'll get an email with your message. If they reply, your email is shared with them.\n
\n You can only send 1 message per 24 hours across the whole site{\" \"}\n — make it count.\n

\n {error && }\n \n ,\n );\n});\n\ncontact.post(\"/\", async (c) => {\n const guard = await requireSignedIn(c);\n if (guard instanceof Response) return guard;\n const { email: senderEmail } = guard;\n\n const body = await c.req.parseBody();\n const profileUrl = String(body.profile_url ?? \"\").trim();\n const text = String(body.body ?? \"\").trim();\n if (!profileUrl || !text) return c.redirect(\"/browse\", 302);\n\n if (text.length > MAX_BODY) {\n return c.redirect(backTo(profileUrl, \"Message is too long.\", text), 302);\n }\n\n const recent = await recentSendCount(senderEmail);\n if (recent >= DAILY_LIMIT) {\n return c.redirect(\n backTo(\n profileUrl,\n \"You can only send 1 message per 24 hours across the entire Date Me Directory — \"\n + \"this slows things down on purpose, to keep the site thoughtful and spam-free. \"\n + \"Try again tomorrow.\",\n text,\n ),\n 302,\n );\n }\n\n const r = await findRecipient(profileUrl);\n if (!r || r.DeletedAt || r.blocked_at || !r.UserEmail) {\n return c.redirect(backTo(profileUrl, \"That profile isn't reachable.\", text), 302);\n }\n const recipientName = safeParse(r.Name);\n const recipientEmail = r.UserEmail as string;\n\n const spam = await checkSpam(text, senderEmail, recipientName);\n if (spam.spam) {\n return c.redirect(\n backTo(\n profileUrl,\n \"Our spam filter flagged this message — please rephrase. (\" + (spam.reason ?? \"\") + \")\",\n text,\n ),\n 302,\n );\n }\n\n let id: number;\n let reportToken: string;\n try {\n const created = await createMessage({\n senderEmail,\n recipientEmail,\n recipientProfileUrl: profileUrl,\n body: text,\n openaiSpamFlag: false,\n openaiSpamReason: spam.reason,\n });\n id = created.id;\n reportToken = created.reportToken;\n } catch (e) {\n console.error(\"[contact] createMessage error:\", e);\n return c.redirect(\n backTo(profileUrl, \"Couldn't save your message — try again in a moment.\", text),\n 302,\n );\n }\n\n const reportLink = new URL(c.req.url);\n reportLink.pathname = \"/report-spam\";\n reportLink.search = `?id=${id}&t=${reportToken}`;\n const reportUrl = reportLink.toString();\n\n // Email body is HTML — built as a string here because email clients require\n // inline styles and a different rendering pipeline than our JSX pages.\n const escaped = (s: string) =>\n s.replace(/&/g, \"&\").replace(//g, \">\");\n\n const txt =\n `Hi ${recipientName},\\n\\n`\n + `Someone from the Date Me Directory sent you a message:\\n\\n`\n + `────────\\n${text}\\n────────\\n\\n`\n + `Hit reply to talk to them — replying will share your email address with them.\\n\\n`\n + `If this is spam, click here to report (one click, suspends the sender):\\n${reportUrl}\\n\\n`\n + `— Date Me Directory`;\n\n const html =\n `

Hi ${escaped(recipientName)},

`\n + `

Someone from the Date Me Directory sent you a message:

`\n + `

${escaped(text)}

`\n + `

Hit reply to talk to them — replying will share your email address with them.

`\n + `

If this is spam, click here to report (one click, suspends the sender).

`\n + `

— Date Me Directory

`;\n\n try {\n await sendEmail({\n to: recipientEmail,\n replyTo: senderEmail,\n subject: `Date Me Directory: someone wrote to you`,\n text: txt,\n html,\n } as any);\n } catch (e) {\n console.error(\"[contact] sendEmail error:\", e);\n return c.redirect(\n backTo(profileUrl, \"Couldn't send the message — try again later.\", text),\n 302,\n );\n }\n\n return c.html(\n \n \n

Message sent

\n We emailed your message to {recipientName}. If they reply, you'll hear from them at{\" \"}\n {senderEmail}.\n

\n Back to browse\n

\n \n ,\n );\n});\n\nexport default contact.fetch;\n",[],[353,560],"4459a714-5c25-11f1-bbd5-ee650bb23af1","claim","c2ddaef6-47b6-11f1-a161-42b51c65c3df",["D",1780145055495],"/** @jsxImportSource npm:hono@3.12.12/jsx */\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { Hono } from \"npm:hono@3.12.12\";\nimport { makeClaimToken } from \"../lib/claim_token.ts\";\nimport { docContainsToken, validateDoc } from \"../lib/doc_validator.ts\";\nimport Layout from \"./layout\";\n\nfunction requireEmail(c: any): string | Response {\n const email = c.get(\"user\")?.email;\n return email || c.redirect(\"/\", 302);\n}\n\n/** True if this user already owns a (claimed) profile. The DateMeDocs.UserEmail\n * unique partial index guarantees at most one row per email, so anything\n * beyond `claim/verify`'s final UPDATE on a *second* doc would crash with a\n * UNIQUE error. We catch that here by short-circuiting to /me. */\nasync function userHasProfile(email: string): Promise {\n const { rows } = await sqlite.execute({\n sql: \"select 1 from DateMeDocs where UserEmail = ? limit 1\",\n args: [email],\n });\n return rows.length > 0;\n}\n\nasync function findByProfile(url: string) {\n const { rows } = await sqlite.execute({\n sql: \"select Name, Profile, UserEmail, DeletedAt from DateMeDocs where Profile = ? limit 1\",\n args: [JSON.stringify(url)],\n });\n return (rows[0] as any) ?? null;\n}\n\nconst Box = ({ children }: { children: any }) => (\n

{children}

\n);\n\nconst Error_ = ({ msg }: { msg: string }) => (\n

{msg}

\n);\n\nexport const claim = new Hono();\n\nclaim.get(\"/\", async (c) => {\n const email = requireEmail(c);\n if (typeof email !== \"string\") return email;\n if (await userHasProfile(email)) return c.redirect(\"/me\", 302);\n return c.html(\n \n

Welcome

\n Signed in as {email}. What would you like to do?\n

\n\n {/* Get-listed options, grouped. */}\n

\n {/* Primary: create a new listing. */}\n \n

\n 📝\n

Create your profile

\n Write a Date Me Doc and get listed in the directory.\n

\n \n\n {/* Secondary: claim an existing doc. */}\n \n

\n 🔗\n

Claim an existing profile

\n Already have a Date Me Doc here? Link it to this account.\n

\n \n

\n\n {/* Divider before the no-commitment escape hatch. */}\n

\n or\n

\n\n {/* Tertiary: just browse — visually lightest, no border. */}\n \n

\n 👀\n

Just browse for now

\n Look around and message people. You can add your own profile anytime.\n

\n \n

\n ,\n );\n});\n\nclaim.get(\"/existing\", async (c) => {\n const email = requireEmail(c);\n if (typeof email !== \"string\") return email;\n if (await userHasProfile(email)) return c.redirect(\"/me\", 302);\n const error = c.req.query(\"error\");\n const prefill = c.req.query(\"url\") ?? \"\";\n return c.html(\n \n \n

Claim your profile

Paste the URL of the Date Me Doc you've already submitted:

\n {error && }\n \n ,\n );\n});\n\nclaim.post(\"/existing\", async (c) => {\n const email = requireEmail(c);\n if (typeof email !== \"string\") return email;\n if (await userHasProfile(email)) return c.redirect(\"/me\", 302);\n const body = await c.req.parseBody();\n const url = String(body.profile_url ?? \"\").trim();\n if (!url) return c.redirect(\"/claim/existing?error=Please+paste+a+URL\", 302);\n\n const row = await findByProfile(url);\n if (!row) {\n return c.redirect(\n `/claim/existing?error=${encodeURIComponent(\"That URL isn't in our directory. Want to submit it as new instead?\")}`,\n 302,\n );\n }\n if (row.UserEmail && row.UserEmail.toLowerCase() === email.toLowerCase()) {\n return c.redirect(\"/me\", 302);\n }\n if (row.UserEmail) {\n return c.redirect(\n `/claim/existing?error=${encodeURIComponent(\"That profile is already claimed by another account. Email steve@val.town if this is in error.\")}`,\n 302,\n );\n }\n\n const token = await makeClaimToken(url, email);\n return c.html(\n \n \n

Verify ownership

\n Open your doc and paste the code below anywhere in it. Save the doc, then click verify.\n You can remove the code from the doc once you're claimed.\n

{token}

\n \n \n ,\n );\n});\n\nclaim.post(\"/verify\", async (c) => {\n const email = requireEmail(c);\n if (typeof email !== \"string\") return email;\n if (await userHasProfile(email)) return c.redirect(\"/me\", 302);\n const body = await c.req.parseBody();\n const url = String(body.profile_url ?? \"\").trim();\n if (!url) return c.redirect(\"/claim/existing\", 302);\n\n const row = await findByProfile(url);\n if (!row || (row.UserEmail && row.UserEmail.toLowerCase() !== email.toLowerCase())) {\n return c.redirect(\"/claim/existing?error=Lookup+failed\", 302);\n }\n\n // Validate the doc is reachable at all (catches private docs, broken URLs).\n const validation = await validateDoc(url);\n if (!validation.ok) {\n return c.html(\n \n \n

Couldn't read your doc

\n \n Try again\n \n ,\n );\n }\n\n const token = await makeClaimToken(url, email);\n const result = await docContainsToken(url, token);\n if (!result.found) {\n const why = result.bodyLength === 0\n ? `We fetched the page but got nothing back (status ${result.status}). Make sure the page is public.`\n : `We read ${result.bodyLength.toLocaleString()} characters from your page (via ${result.via}) but didn't find the code.`;\n return c.html(\n \n \n

We couldn't find the code

{why}

\n Confirm the code {token} is saved in the doc body\n (not in a comment or hidden block), then try again. If your doc redirects (e.g.\n stevekrouse.com → notion.site), paste the final URL instead.\n

\n \n \n ,\n );\n }\n\n await sqlite.execute({\n sql: \"update DateMeDocs set UserEmail = ? where Profile = ?\",\n args: [email, JSON.stringify(url)],\n });\n return c.redirect(\"/me\", 302);\n});\n\nexport default claim.fetch;\n",[],[353,568],"b81dcb81-e3cc-4e2b-ba4c-5f21d75732de","browse","4a7c0892-e595-11ef-bbd6-e6cdfca9ef9f",["D",1788187875254],34,"/** @jsxImportSource npm:hono@3.12.12/jsx */\nimport BrowseFilters from \"../components/BrowseFilters.tsx\";\nimport ProfileTable from \"../components/ProfileTable.tsx\";\nimport SearchHeader from \"../components/SearchHeader.tsx\";\nimport { loadOwnPrefs, resolveBrowseParams } from \"../lib/browse_params.ts\";\nimport { requireSignedIn } from \"../lib/profile_guard.ts\";\nimport { searchProfiles } from \"../lib/profile_search.ts\";\nimport Layout from \"./layout\";\n\nexport default async function Browse(c) {\n // Signed-in is enough to browse. A claimed profile is optional — no-profile\n // members just don't get their search pre-filled and see a nudge to add one.\n const guard = await requireSignedIn(c);\n if (guard instanceof Response) return guard;\n const { email, hasProfile } = guard;\n\n const url = new URL(c.req.url);\n const prefs = await loadOwnPrefs(email);\n const params = resolveBrowseParams(url, prefs);\n\n const { local, remote, geo } = await searchProfiles(params);\n const count = local.length + remote.length;\n\n // Section headings: e.g. \"Within 25 miles of Kansas City, Missouri, United\n // States (3)\". Without a location filter, everything is local and no heading\n // is needed.\n const radiusLabel = params.radiusMi && geo.length\n ? `Within ${params.radiusMi} mile${params.radiusMi === 1 ? \"\" : \"s\"} of ${\n geo.map((g) => g.label).join(\" or \")\n }`\n : null;\n\n return c.html(\n \n

\n {!hasProfile && (\n

\n You're browsing without a listing, so others can't find you here.\n Add your profile\n

\n )}\n \n \n

\n {local.length > 0 && (\n

\n {radiusLabel && (\n

\n {radiusLabel} ({local.length})\n

\n )}\n \n

\n )}\n {remote.length > 0 && (\n

\n Flexible location ({remote.length})\n \n {\" \"}— open to travel or relocating, not based in your radius\n \n

\n \n

\n )}\n

\n ,\n );\n}\n",[],[353,575],"c2dda384-47b6-11f1-a161-42b51c65c3df","banned.tsx","c2dda44c-47b6-11f1-a161-42b51c65c3df",["D",1777898570362],"/** @jsxImportSource npm:hono@3.12.12/jsx */\nimport Layout from \"./layout\";\n\nconst ADMIN_EMAIL = \"stevekrouse.dateme_contact@valtown.email\";\n\nexport default function Banned(c: any) {\n const email = c.get(\"user\")?.email;\n return c.html(\n \n

Account suspended

\n Your account has been suspended after a message you sent was reported as spam. Your\n profile is no longer visible in the directory and you can't send or receive messages.\n

\n If you think this is in error, email{\" \"}\n {ADMIN_EMAIL}.\n

\n \n

\n ,\n );\n}\n",[],[353,583],"0a9b6301-89b7-454e-b02d-d24c369eb233","api_browse.ts","e97d7092-7bdb-11f1-914e-1607ee4eb77e",["D",1788187875254],"// GET /api/browse — machine-readable version of /browse for the \"authorized\n// URL\" flow: hand an AI agent https://date.val.run/api/browse?key=\n// and it sees exactly what you'd see browsing (your saved prefs by default,\n// or the same filter query params /browse accepts), as JSON instead of HTML.\n//\n// Auth is the API key, not the cookie session — so this route lives outside\n// requireSignedIn/requireClaimedProfile. Same visibility as a signed-in human:\n// no more fields than the /browse table already renders, and no Contact/email.\nimport { findEmailByApiKey } from \"../lib/api_key.ts\";\nimport { loadOwnPrefs, resolveBrowseParams } from \"../lib/browse_params.ts\";\nimport { ageFromBirthday, httpsIfy, safeParse } from \"../lib/json_safe.ts\";\nimport { searchProfiles } from \"../lib/profile_search.ts\";\n\nfunction listField(v: any): string[] {\n const x = safeParse(v);\n return Array.isArray(x) ? x : x ? [String(x)] : [];\n}\n\nfunction toJson(row: Record) {\n return {\n name: safeParse(row.Name) ?? null,\n profileUrl: httpsIfy(safeParse(row.Profile)),\n age: ageFromBirthday(row.Birthday),\n gender: listField(row.Gender),\n interestedIn: listField(row.InterestedIn),\n style: listField(row.Style),\n locations: listField(row.Location),\n locationFlexibility: safeParse(row.LocationFlexibility) ?? null,\n lastUpdated: safeParse(row.LastUpdated) ?? null,\n claimed: !!row.UserEmail,\n };\n}\n\nfunction extractKey(req: Request, url: URL): string {\n const auth = req.headers.get(\"Authorization\");\n if (auth?.startsWith(\"Bearer \")) return auth.slice(\"Bearer \".length).trim();\n return url.searchParams.get(\"key\") ?? \"\";\n}\n\nexport default async function apiBrowse(c: any) {\n const url = new URL(c.req.url);\n const key = extractKey(c.req.raw, url);\n const email = await findEmailByApiKey(key);\n if (!email) {\n return c.json({ error: \"Missing or invalid API key. Get yours at /me.\" }, 401);\n }\n\n const prefs = await loadOwnPrefs(email);\n const params = resolveBrowseParams(url, prefs);\n const { local, remote } = await searchProfiles(params);\n\n return c.json({\n count: local.length + remote.length,\n profiles: [...local, ...remote].map(toJson),\n });\n}\n",[],[353,590],"c2dd88ea-47b6-11f1-a161-42b51c65c3df","users.tsx","c2dd89b2-47b6-11f1-a161-42b51c65c3df","019df303-4279-72aa-a31b-fee7340fa058",["D",1777898570362],"/** @jsxImportSource npm:hono@3.12.12/jsx */\nimport { Hono } from \"npm:hono@3.12.12\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { requireAdmin } from \"../../lib/admin_guard.ts\";\nimport { safeParse } from \"../../lib/json_safe.ts\";\nimport AdminLayout from \"./layout.tsx\";\nimport { StatusBadge } from \"./badges.tsx\";\n\nconst PAGE_SIZE = 50;\n\nfunction statusOf(row: any): \"active\" | \"paused\" | \"banned\" {\n if (row.blocked_at) return \"banned\";\n if (row.DeletedAt) return \"paused\";\n return \"active\";\n}\n\nasync function loadPage(page: number) {\n const offset = Math.max(0, (page - 1) * PAGE_SIZE);\n const { rows } = await sqlite.execute({\n sql: `select d.*,\n (select count(*) from dateme_reports r\n where r.target_email = d.UserEmail) as report_count\n from DateMeDocs d\n where d.UserEmail is not null\n order by d.LastUpdated desc limit ? offset ?`,\n args: [PAGE_SIZE, offset],\n });\n const { rows: countRows } = await sqlite.execute(\n \"select count(*) as n from DateMeDocs where UserEmail is not null\",\n );\n return {\n rows: rows as any[],\n total: Number((countRows[0] as any).n ?? 0),\n };\n}\n\nexport const users = new Hono();\n\nusers.get(\"/\", async (c) => {\n const guard = requireAdmin(c);\n if (guard instanceof Response) return guard;\n const { email } = guard;\n\n const url = new URL(c.req.url);\n const page = Math.max(1, parseInt(url.searchParams.get(\"page\") ?? \"1\", 10) || 1);\n const { rows, total } = await loadPage(page);\n const totalPages = Math.max(1, Math.ceil(total / PAGE_SIZE));\n\n return c.html(\n \n \n \n \n \n \n \n \n \n \n \n \n \n {rows.map((r) => (\n \n \n \n \n \n \n \n \n ))}\n \n

Name	Email	Status	Reports	Updated
{safeParse(r.Name)}	{r.UserEmail}		{r.report_count > 0 ? r.report_count : \"—\"}	\n {r.LastUpdated ? String(r.LastUpdated).slice(0, 10) : \"—\"}\n	\n \n view →\n \n

\n Page {page} of {totalPages} · {total} total\n \n {page > 1 && (\n ← prev\n )}\n {page < totalPages && (\n next →\n )}\n \n

\n ,\n );\n});\n\nexport default users.fetch;\n",[],[353,604,597],"admin","69b8dcb4-47b7-11f1-8ecc-42b51c65c3df","user_detail.tsx","c2dd3a34-47b6-11f1-a161-42b51c65c3df",171,["D",1777898850335],"/** @jsxImportSource npm:hono@3.12.12/jsx */\nimport { Hono } from \"npm:hono@3.12.12\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport ProfileSummary from \"../../components/ProfileSummary.tsx\";\nimport { requireAdmin } from \"../../lib/admin_guard.ts\";\nimport { banUser, unbanUser } from \"../../lib/messages.ts\";\nimport { reportsAgainstTarget } from \"../../lib/reports.ts\";\nimport AdminLayout from \"./layout.tsx\";\nimport {\n DecisionBadge,\n ReportTypeBadge,\n StatusBadge,\n VerdictBadge,\n} from \"./badges.tsx\";\n\nasync function findUser(email: string) {\n const { rows } = await sqlite.execute({\n sql: \"select * from DateMeDocs where UserEmail = ? limit 1\",\n args: [email],\n });\n return (rows[0] as any) ?? null;\n}\n\nasync function loadMessages(email: string) {\n const { rows } = await sqlite.execute({\n sql: `select * from dateme_messages\n where sender_email = ? or recipient_email = ?\n order by sent_at desc limit 50`,\n args: [email, email],\n });\n return rows as any[];\n}\n\nfunction statusOf(row: any): \"active\" | \"paused\" | \"banned\" {\n if (row.blocked_at) return \"banned\";\n if (row.DeletedAt) return \"paused\";\n return \"active\";\n}\n\nexport const userDetail = new Hono();\n\nuserDetail.get(\"/:email\", async (c) => {\n const guard = requireAdmin(c);\n if (guard instanceof Response) return guard;\n const { email: adminEmail } = guard;\n\n const userEmail = decodeURIComponent(c.req.param(\"email\"));\n const user = await findUser(userEmail);\n if (!user) return c.notFound();\n\n const status = statusOf(user);\n const reports = await reportsAgainstTarget(userEmail);\n const messages = await loadMessages(userEmail);\n const safeKey = encodeURIComponent(userEmail);\n\n return c.html(\n \n ← back to users\n\n

\n \n {user.ban_reason && (\n \n ban reason: {user.ban_reason}\n \n )}\n

\n\n

\n \n

\n\n

Actions

\n {status === \"paused\"\n ? (\n \n )\n : (\n \n )}\n {status === \"banned\"\n ? (\n \n )\n : (\n \n Ban with reason\n \n )}\n \n Hard delete\n \n

\n\n

Reports against this user ({reports.length})

\n {reports.length === 0\n ?

None.

\n : (\n \n \n \n \n \n \n \n \n \n \n \n \n {reports.map((r) => (\n \n \n \n \n \n \n \n \n ))}\n \n

When	Type	Reporter	AI	Decision
\n {String(r.created_at).slice(0, 16).replace(\"T\", \" \")}\n		{r.reporter_email ?? \"—\"}			\n view →\n

\n )}\n\n

Messages ({messages.length})

\n {messages.length === 0\n ?

None.

\n : (\n \n \n \n \n \n \n \n \n \n \n {messages.map((m) => {\n const sent = m.sender_email === userEmail;\n const other = sent ? m.recipient_email : m.sender_email;\n return (\n \n \n \n \n \n \n );\n })}\n \n

When	Direction	Other party	Body
\n {String(m.sent_at).slice(0, 16).replace(\"T\", \" \")}\n	{sent ? \"sent →\" : \"← received\"}	{other}	\n {String(m.body).slice(0, 100)}\n

\n )}\n ,\n );\n});\n\nuserDetail.post(\"/:email/soft-delete\", async (c) => {\n const guard = requireAdmin(c);\n if (guard instanceof Response) return guard;\n const userEmail = decodeURIComponent(c.req.param(\"email\"));\n await sqlite.execute({\n sql:\n \"update DateMeDocs set DeletedAt = strftime('%Y-%m-%dT%H:%M:%fZ','now') where UserEmail = ? and DeletedAt is null\",\n args: [userEmail],\n });\n return c.redirect(`/admin/users/${encodeURIComponent(userEmail)}`, 302);\n});\n\nuserDetail.post(\"/:email/republish\", async (c) => {\n const guard = requireAdmin(c);\n if (guard instanceof Response) return guard;\n const userEmail = decodeURIComponent(c.req.param(\"email\"));\n await sqlite.execute({\n sql: \"update DateMeDocs set DeletedAt = null where UserEmail = ?\",\n args: [userEmail],\n });\n return c.redirect(`/admin/users/${encodeURIComponent(userEmail)}`, 302);\n});\n\nuserDetail.get(\"/:email/ban\", async (c) => {\n const guard = requireAdmin(c);\n if (guard instanceof Response) return guard;\n const { email: adminEmail } = guard;\n const userEmail = decodeURIComponent(c.req.param(\"email\"));\n const user = await findUser(userEmail);\n if (!user) return c.notFound();\n const safeKey = encodeURIComponent(userEmail);\n return c.html(\n \n ← back to user\n

\n Ban will hide this profile from the directory and block them from messaging.\n Provide a reason — it's stored on the DateMeDocs row for history.\n

\n ,\n );\n});\n\nuserDetail.post(\"/:email/ban\", async (c) => {\n const guard = requireAdmin(c);\n if (guard instanceof Response) return guard;\n const userEmail = decodeURIComponent(c.req.param(\"email\"));\n const body = await c.req.parseBody();\n const reason = String(body.reason ?? \"\").trim();\n if (!reason) {\n return c.redirect(`/admin/users/${encodeURIComponent(userEmail)}/ban`, 302);\n }\n await banUser(userEmail, reason);\n return c.redirect(`/admin/users/${encodeURIComponent(userEmail)}`, 302);\n});\n\nuserDetail.post(\"/:email/unban\", async (c) => {\n const guard = requireAdmin(c);\n if (guard instanceof Response) return guard;\n const userEmail = decodeURIComponent(c.req.param(\"email\"));\n await unbanUser(userEmail);\n return c.redirect(`/admin/users/${encodeURIComponent(userEmail)}`, 302);\n});\n\nuserDetail.get(\"/:email/hard-delete\", async (c) => {\n const guard = requireAdmin(c);\n if (guard instanceof Response) return guard;\n const { email: adminEmail } = guard;\n const userEmail = decodeURIComponent(c.req.param(\"email\"));\n const user = await findUser(userEmail);\n if (!user) return c.notFound();\n const safeKey = encodeURIComponent(userEmail);\n return c.html(\n \n ← back to user\n

Hard delete this user?

\n This permanently removes their profile, staging rows, and account row. It can't be\n undone. This is the same cascade as the user clicking \"Delete account\" themselves.\n

\n \n

\n ,\n );\n});\n\nuserDetail.post(\"/:email/hard-delete\", async (c) => {\n const guard = requireAdmin(c);\n if (guard instanceof Response) return guard;\n const userEmail = decodeURIComponent(c.req.param(\"email\"));\n const body = await c.req.parseBody();\n const confirm = String(body.confirm ?? \"\").trim();\n if (confirm !== userEmail) {\n return c.redirect(`/admin/users/${encodeURIComponent(userEmail)}/hard-delete`, 302);\n }\n // Same cascade as /me/delete\n await sqlite.execute({\n sql:\n \"delete from dateme_profile_locations where profile in (select Profile from DateMeDocs where UserEmail = ?)\",\n args: [userEmail],\n });\n await sqlite.execute({\n sql: \"delete from DateMeDocs where UserEmail = ?\",\n args: [userEmail],\n });\n await sqlite.execute({\n sql: \"delete from user where email = ?\",\n args: [userEmail],\n });\n return c.redirect(\"/admin/users\", 302);\n});\n\nexport default userDetail.fetch;\n",[],[353,604,606],"acf46340-5c2a-11f1-8ebc-ee650bb23af1","reports.tsx","c2dcfd94-47b6-11f1-a161-42b51c65c3df",241,["D",1780147378512],"/** @jsxImportSource npm:hono@3.12.12/jsx */\nimport { Hono } from \"npm:hono@3.12.12\";\nimport { requireAdmin } from \"../../lib/admin_guard.ts\";\nimport { safeParse } from \"../../lib/json_safe.ts\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { decideReport, getReport, listAllReports } from \"../../lib/reports.ts\";\nimport AdminLayout from \"./layout.tsx\";\nimport { DecisionBadge, ReportTypeBadge, VerdictBadge } from \"./badges.tsx\";\n\nconst PAGE_SIZE = 50;\n\nexport const reports = new Hono();\n\nreports.get(\"/\", async (c) => {\n const guard = requireAdmin(c);\n if (guard instanceof Response) return guard;\n const { email } = guard;\n\n const url = new URL(c.req.url);\n const statusParam = (url.searchParams.get(\"status\") ?? \"all\") as\n | \"pending\"\n | \"decided\"\n | \"all\";\n const page = Math.max(1, parseInt(url.searchParams.get(\"page\") ?? \"1\", 10) || 1);\n const status = statusParam === \"pending\" || statusParam === \"decided\" ? statusParam : \"all\";\n const { rows, total, limit } = await listAllReports({ page, limit: PAGE_SIZE, status });\n const totalPages = Math.max(1, Math.ceil(total / limit));\n\n const linkClass = (s: string) =>\n status === s\n ? \"font-medium text-black\"\n : \"text-gray-500 hover:text-gray-700\";\n\n return c.html(\n \n

\n All ({total})\n Pending\n Decided\n

\n {rows.length === 0\n ?

No reports.

\n : (\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n {rows.map((r: any) => (\n \n \n \n \n \n \n \n \n \n \n ))}\n \n

When	Type	Target	Reporter	Reason	AI	Decision
\n {String(r.created_at).slice(0, 16).replace(\"T\", \" \")}\n		\n {r.target_email ?? safeParse(r.target_profile)}\n	{r.reporter_email ?? \"—\"}	\n {r.reason ? String(r.reason).slice(0, 80) : \"—\"}\n			\n \n view →\n \n

\n )}\n

\n Page {page} of {totalPages} · {total} total\n \n {page > 1 && (\n \n ← prev\n \n )}\n {page < totalPages && (\n \n next →\n \n )}\n \n

\n ,\n );\n});\n\nreports.get(\"/:id\", async (c) => {\n const guard = requireAdmin(c);\n if (guard instanceof Response) return guard;\n const { email } = guard;\n\n const id = parseInt(c.req.param(\"id\"), 10);\n if (!Number.isFinite(id)) return c.notFound();\n const r = await getReport(id);\n if (!r) return c.notFound();\n\n // Pull related rows so the admin doesn't have to click around.\n const profileUrl = (() => {\n try {\n return JSON.parse(r.target_profile);\n } catch {\n return r.target_profile as string;\n }\n })();\n const { rows: docRows } = await sqlite.execute({\n sql: \"select * from DateMeDocs where Profile = ? limit 1\",\n args: [JSON.stringify(profileUrl)],\n });\n const doc = (docRows[0] as any) ?? null;\n\n let message: any = null;\n if (r.message_id) {\n const { rows: mRows } = await sqlite.execute({\n sql: \"select * from dateme_messages where id = ? limit 1\",\n args: [r.message_id],\n });\n message = (mRows[0] as any) ?? null;\n }\n\n const decided = !!r.admin_decision;\n\n const Field = ({ label, children }: { label: string; children: any }) => (\n <>\n

{label}

{children}

\n \n );\n\n return c.html(\n \n ← back to reports\n

\n {r.id}\n \n {String(r.created_at).replace(\"T\", \" \").slice(0, 19)}\n {r.target_email ?? \"—\"}\n \n {profileUrl}\n \n {r.reporter_email ?? \"—\"}\n \n

{r.reason ?? \"(none)\"}

\n \n \n \n

{r.ai_reasoning ?? \"(not run)\"}

\n \n \n {decided && (\n <>\n {r.admin_decided_by}\n \n {String(r.admin_decided_at).replace(\"T\", \" \").slice(0, 19)}\n \n \n

{r.admin_notes ?? \"(none)\"}

\n \n \n )}\n \n\n {message && (\n

Reported message

\n from {message.sender_email} → {message.recipient_email} ·{\" \"}\n {String(message.sent_at).replace(\"T\", \" \").slice(0, 19)}\n

{message.body}

\n )}\n\n {doc && (\n

Target's profile

\n \n {doc.UserEmail\n ? <>open user detail for {doc.UserEmail} →\n : <>(unclaimed profile — no user detail page)}\n \n

\n )}\n\n {!decided && (\n

Decide

\n \n

\n )}\n {decided && r.admin_decision === \"ban\" && r.target_email && (\n

\n \n

\n )}\n {decided && r.admin_decision === \"unpublish\" && (\n

\n \n

\n )}\n ,\n );\n});\n\nreports.post(\"/:id/decide\", async (c) => {\n const guard = requireAdmin(c);\n if (guard instanceof Response) return guard;\n const { email } = guard;\n\n const id = parseInt(c.req.param(\"id\"), 10);\n if (!Number.isFinite(id)) return c.notFound();\n const body = await c.req.parseBody();\n const decision = String(body.decision ?? \"\");\n const notes = String(body.notes ?? \"\").trim();\n\n const existing = await getReport(id);\n if (!existing) return c.notFound();\n // No-op if already decided — idempotent.\n if (existing.admin_decision) return c.redirect(`/admin/reports/${id}`, 302);\n\n if (decision !== \"ban\" && decision !== \"unpublish\" && decision !== \"dismiss\") {\n return c.redirect(`/admin/reports/${id}`, 302);\n }\n await decideReport(id, decision, email, notes || undefined);\n return c.redirect(`/admin/reports/${id}`, 302);\n});\n\n// Reverse an \"unpublish\" decision: clear the soft-delete on the report's target\n// profile. Gated on blocked_at is null so we never resurrect a banned row.\nreports.post(\"/:id/republish\", async (c) => {\n const guard = requireAdmin(c);\n if (guard instanceof Response) return guard;\n\n const id = parseInt(c.req.param(\"id\"), 10);\n if (!Number.isFinite(id)) return c.notFound();\n const r = await getReport(id);\n if (!r) return c.notFound();\n\n await sqlite.execute({\n sql: \"update DateMeDocs set DeletedAt = null where Profile = ? and blocked_at is null\",\n args: [r.target_profile],\n });\n return c.redirect(`/admin/reports/${id}`, 302);\n});\n\nexport default reports.fetch;\n",[],[353,604,614],"c2dceb38-47b6-11f1-a161-42b51c65c3df","messages.tsx","c2dcebb0-47b6-11f1-a161-42b51c65c3df",["D",1777898570362],"/** @jsxImportSource npm:hono@3.12.12/jsx */\nimport { Hono } from \"npm:hono@3.12.12\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { requireAdmin } from \"../../lib/admin_guard.ts\";\nimport AdminLayout from \"./layout.tsx\";\n\nconst PAGE_SIZE = 50;\n\nasync function loadPage(page: number) {\n const offset = Math.max(0, (page - 1) * PAGE_SIZE);\n const { rows } = await sqlite.execute({\n sql: `select m.*,\n (select count(*) from dateme_reports r\n where r.message_id = m.id) as report_count\n from dateme_messages m\n order by m.sent_at desc limit ? offset ?`,\n args: [PAGE_SIZE, offset],\n });\n const { rows: countRows } = await sqlite.execute(\n \"select count(*) as n from dateme_messages\",\n );\n return {\n rows: rows as any[],\n total: Number((countRows[0] as any).n ?? 0),\n };\n}\n\nexport const messages = new Hono();\n\nmessages.get(\"/\", async (c) => {\n const guard = requireAdmin(c);\n if (guard instanceof Response) return guard;\n const { email } = guard;\n\n const url = new URL(c.req.url);\n const page = Math.max(1, parseInt(url.searchParams.get(\"page\") ?? \"1\", 10) || 1);\n const { rows, total } = await loadPage(page);\n const totalPages = Math.max(1, Math.ceil(total / PAGE_SIZE));\n\n return c.html(\n \n {rows.length === 0\n ?

No messages yet.

\n : (\n \n \n \n \n \n \n \n \n \n \n \n {rows.map((r) => (\n \n \n \n \n \n \n \n ))}\n \n

When	Sender	Recipient	Body	Reports
\n {String(r.sent_at).slice(0, 16).replace(\"T\", \" \")}\n	\n \n {r.sender_email}\n \n	{r.recipient_email}	\n {String(r.body).slice(0, 100)}\n	\n {r.report_count > 0\n ? (\n \n {r.report_count}\n \n )\n : 0}\n

\n )}\n

\n Page {page} of {totalPages} · {total} total\n \n {page > 1 && (\n ← prev\n )}\n {page < totalPages && (\n next →\n )}\n \n

\n ,\n );\n});\n\nexport default messages.fetch;\n",[],[353,604,622],"c2dce2f0-47b6-11f1-a161-42b51c65c3df","layout.tsx","c2dce386-47b6-11f1-a161-42b51c65c3df",["D",1777898570362],"/** @jsxImportSource npm:hono@3.12.12/jsx */\nimport { PropsWithChildren } from \"npm:hono/jsx\";\nimport Layout from \"../layout\";\n\nconst TABS: { href: string; label: string }[] = [\n { href: \"/admin\", label: \"Dashboard\" },\n { href: \"/admin/reports\", label: \"Reports\" },\n { href: \"/admin/messages\", label: \"Messages\" },\n { href: \"/admin/users\", label: \"Users\" },\n];\n\ntype Props = PropsWithChildren<{ active: string; email: string; title: string }>;\n\nexport default function AdminLayout({ active, email, title, children }: Props) {\n return (\n \n

Admin · {title}

\n \n

{children}

\n \n );\n}\n",[],[353,604,629],"c2dcd850-47b6-11f1-a161-42b51c65c3df","index.tsx","c2dcd90e-47b6-11f1-a161-42b51c65c3df",["D",1777898570362],"/** @jsxImportSource npm:hono@3.12.12/jsx */\nimport { Hono } from \"npm:hono@3.12.12\";\nimport dashboard from \"./dashboard.tsx\";\nimport { messages } from \"./messages.tsx\";\nimport { reports } from \"./reports.tsx\";\nimport { userDetail } from \"./user_detail.tsx\";\nimport { users } from \"./users.tsx\";\n\n// Each subrouter does its OWN requireAdmin check; non-admins see 404 from\n// every page (we never disclose that /admin exists).\n//\n// /users is split across two sub-apps because the listing page (/) and the\n// detail / action endpoints (/:email/...) live in separate files. Mount the\n// detail app first so /users/:email is matched before /users falls through\n// to the index router.\n\nconst usersApp = new Hono();\nusersApp.route(\"/\", userDetail);\nusersApp.route(\"/\", users);\n\nexport const admin = new Hono();\nadmin.route(\"/users\", usersApp);\nadmin.route(\"/reports\", reports);\nadmin.route(\"/messages\", messages);\nadmin.get(\"/\", dashboard);\n\nexport default admin.fetch;\n",[],[353,604,636],"c2dcba82-47b6-11f1-a161-42b51c65c3df","dashboard.tsx","c2dcbb40-47b6-11f1-a161-42b51c65c3df",["D",1777898570362],"/** @jsxImportSource npm:hono@3.12.12/jsx */\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { requireAdmin } from \"../../lib/admin_guard.ts\";\nimport { safeParse } from \"../../lib/json_safe.ts\";\nimport AdminLayout from \"./layout.tsx\";\nimport { DecisionBadge, ReportTypeBadge, VerdictBadge } from \"./badges.tsx\";\n\nasync function loadCounts() {\n const sinceDay = new Date(Date.now() - 24 * 60 * 60 * 1000).toISOString();\n const sinceWeek = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000).toISOString();\n const { rows } = await sqlite.execute({\n sql: `select\n (select count(*) from DateMeDocs) as docs,\n (select count(*) from DateMeDocs where DeletedAt is null and blocked_at is null) as visible,\n (select count(*) from DateMeDocs where blocked_at is not null) as banned,\n (select count(*) from DateMeDocs where DeletedAt is not null and blocked_at is null) as paused,\n (select count(*) from dateme_reports where admin_decision is null) as pending,\n (select count(*) from dateme_reports where created_at > ?) as reports_day,\n (select count(*) from dateme_reports where created_at > ?) as reports_week,\n (select count(*) from dateme_messages) as messages`,\n args: [sinceDay, sinceWeek],\n });\n return rows[0] as Record;\n}\n\nasync function loadRecentReports(limit = 10) {\n const { rows } = await sqlite.execute({\n sql: \"select * from dateme_reports order by created_at desc limit ?\",\n args: [limit],\n });\n return rows as any[];\n}\n\nconst Stat = ({ label, value }: { label: string; value: number | string }) => (\n

{label}

{value}

\n);\n\nexport default async function dashboard(c: any) {\n const guard = requireAdmin(c);\n if (guard instanceof Response) return guard;\n const { email } = guard;\n\n const counts = await loadCounts();\n const recent = await loadRecentReports();\n\n return c.html(\n \n

\n \n \n \n \n \n \n \n \n

Recent reports

\n {recent.length === 0\n ?

No reports yet.

\n : (\n \n \n \n \n \n \n \n \n \n \n \n \n \n {recent.map((r) => (\n \n \n \n \n \n \n \n \n \n ))}\n \n

When	Type	Target	Reporter	AI	Decision
\n {String(r.created_at).slice(0, 16).replace(\"T\", \" \")}\n		\n {r.target_email ?? safeParse(r.target_profile)}\n	{r.reporter_email ?? \"—\"}			\n \n view →\n \n

\n )}\n ,\n );\n}\n",[],[353,604,643],"93d25e8a-5c2a-11f1-8468-ee650bb23af1","badges.tsx","c2dcad9e-47b6-11f1-a161-42b51c65c3df",236,["D",1780147336347],"/** @jsxImportSource npm:hono@3.12.12/jsx */\n\n// Shared badge / chip components used by the admin tables.\n\nexport function VerdictBadge({ verdict }: { verdict: string | null | undefined }) {\n if (!verdict) return —;\n const cls = verdict === \"violation\"\n ? \"bg-red-100 text-red-800\"\n : verdict === \"no-violation\"\n ? \"bg-green-100 text-green-800\"\n : \"bg-gray-100 text-gray-700\";\n return (\n {verdict}\n );\n}\n\nexport function DecisionBadge({ decision }: { decision: string | null | undefined }) {\n if (!decision) {\n return (\n \n pending\n \n );\n }\n const cls = decision === \"ban\"\n ? \"bg-red-100 text-red-800\"\n : decision === \"unpublish\"\n ? \"bg-yellow-100 text-yellow-800\"\n : \"bg-gray-100 text-gray-700\";\n return (\n {decision}\n );\n}\n\nexport function StatusBadge({ status }: { status: \"active\" | \"paused\" | \"banned\" }) {\n const cls = status === \"active\"\n ? \"bg-green-100 text-green-800\"\n : status === \"paused\"\n ? \"bg-yellow-100 text-yellow-800\"\n : \"bg-red-100 text-red-800\";\n return (\n {status}\n );\n}\n\nexport function ReportTypeBadge({ type }: { type: string }) {\n const cls = type === \"message_spam\"\n ? \"bg-orange-100 text-orange-800\"\n : \"bg-blue-100 text-blue-800\";\n return (\n {type}\n );\n}\n",[],[353,604,650],"c2deee2e-47b6-11f1-a161-42b51c65c3df",["D",1777898570362],[396,397,398,399,400,401,402,403],[353,604],"7b9de126-e58f-11ef-aa79-e6cdfca9ef9f",14,["D",1738958988872],[395,404,405,406,407,408,409,410,411,412,413,414,415,416],[353],"4358dceb-f2b6-49f9-a8b2-3ad72d9d302f","send_email.ts","d419bbae-5b63-11f1-b191-ee650bb23af1","019def11-0555-7418-a65a-4446aa38d3fb",253,["D",1783359396256],"// Resilient wrapper around std/email.\n//\n// std/email does `fetch(`${API_URL}/v1/email`).then(r => r.json())` with no\n// guard on the response. When Val Town's email backend hiccups and returns a\n// transient *non-JSON* body (e.g. \"Gateway Timeout\", a 502/503 HTML page), the\n// .json() parse throws — surfacing as either:\n// SyntaxError: Unexpected token 'G', \"Gateway Timeout\" is not valid JSON\n// TypeError: resp.body?.cancel is not a function\n// Left uncaught, that crashes the calling request (magic-link sign-in 500s, a\n// successful /join submit gets reported to the user as a failure, etc).\n//\n// We can't edit std/email (it's owned by `std`), so these helpers absorb that\n// flakiness:\n// - sendEmail(): retries transient failures with backoff, then\n// throws if every attempt failed (caller decides).\n// - sendEmailBestEffort(): never throws — for non-critical notifications\n// where a failed send must not break the user flow.\n\nimport { email as stdEmail } from \"https://esm.town/v/std/email\";\n\nexport type EmailArgs = Parameters[0];\n\n/**\n * From-address for all outbound Date Me Directory mail. This is the inbound\n * address of the `stevekrouse/dateme_contact` email-type val — Val Town only\n * lets you send `from` an address belonging to an email val you own, so we\n * reuse the existing contact val's address. Replies (and bounces) land back\n * in that val's inbox.\n */\nexport const FROM_EMAIL = \"stevekrouse.dateme_contact@valtown.email\";\n\n/** IAddress form (with a display name) — std/email accepts either a string or\n * an `{ email, name }` object. We use the object form everywhere so recipients\n * see \"Date Me Directory\" in their inbox instead of the raw valtown.email addr. */\nexport const FROM_ADDRESS = { email: FROM_EMAIL, name: \"Date Me Directory\" };\n\nconst sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));\n\n/** Default `from` applied to every outbound mail unless the caller overrides it. */\nfunction withFrom(args: EmailArgs): EmailArgs {\n return { from: FROM_ADDRESS, ...args };\n}\n\nexport async function sendEmail(\n args: EmailArgs,\n { retries = 3 }: { retries?: number } = {},\n): Promise {\n let lastErr: unknown;\n for (let attempt = 1; attempt <= retries; attempt++) {\n try {\n await stdEmail(withFrom(args));\n return;\n } catch (e) {\n lastErr = e;\n console.warn(`[email] send attempt ${attempt}/${retries} failed:`, String(e));\n if (attempt < retries) await sleep(250 * attempt);\n }\n }\n throw lastErr;\n}\n\n/** Send, but swallow failures (after retries). Returns whether it succeeded. */\nexport async function sendEmailBestEffort(args: EmailArgs): Promise {\n try {\n await sendEmail(args);\n return true;\n } catch (e) {\n console.error(\"[email] giving up after retries:\", String(e));\n return false;\n }\n}\n",[],[675,667],"lib","99275bb0-5c2a-11f1-8ebc-ee650bb23af1","reports.ts","c2dc74a0-47b6-11f1-a161-42b51c65c3df",238,["D",1780147345293],"// Unified report/flag system. Two report types share one table:\n//\n// - 'message_spam': one-click report from the email link sent with each\n// contact message. Auto-bans the sender on insert.\n// - 'profile_flag': signed-in users flagging a profile they're browsing.\n// Pending until an admin Bans / Dismisses.\n//\n// All rate-limit + AI-review + admin-decision logic lives here so pages stay\n// thin. Banning helpers are in lib/messages.ts (banUser/unbanUser).\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { fetchDocText } from \"./doc_validator.ts\";\nimport { banUser } from \"./messages.ts\";\nimport { reviewProfileFlag } from \"./openai_review.ts\";\n\nexport type ReportType = \"message_spam\" | \"profile_flag\";\n\nconst PROFILE_TEXT_LIMIT = 100_000;\n\n// ─── Insert: message-spam (one-click from email) ─────────────────────────────\n\nexport async function createMessageSpamReport({\n messageId,\n recipientEmail,\n senderEmail,\n senderProfileUrl,\n reason,\n}: {\n messageId: number;\n recipientEmail: string;\n senderEmail: string;\n senderProfileUrl: string;\n reason: string | null;\n}): Promise<{ id: number; alreadyExisted: boolean }> {\n // Idempotency: if a row already exists for (message_id, type='message_spam'),\n // return its id without creating another row OR re-banning.\n const existing = await sqlite.execute({\n sql:\n \"select id from dateme_reports where message_id = ? and type = 'message_spam' limit 1\",\n args: [messageId],\n });\n if (existing.rows.length > 0) {\n return { id: Number((existing.rows[0] as any).id), alreadyExisted: true };\n }\n\n const now = new Date().toISOString();\n const result = await sqlite.execute({\n sql: `insert into dateme_reports\n (type, target_email, target_profile, reporter_email, message_id, reason,\n created_at, admin_decision, admin_decided_by, admin_decided_at)\n values ('message_spam', ?, ?, ?, ?, ?, ?, 'ban', ?, ?)`,\n args: [\n senderEmail,\n JSON.stringify(senderProfileUrl),\n recipientEmail,\n messageId,\n reason,\n now,\n recipientEmail,\n now,\n ],\n });\n await banUser(senderEmail, \"Reported as spam by recipient\");\n return { id: Number(result.lastInsertRowid), alreadyExisted: false };\n}\n\n// ─── Insert: profile-flag ────────────────────────────────────────────────────\n\nexport async function createProfileFlag({\n flaggedProfileUrl,\n flaggedTargetEmail,\n reporterEmail,\n reason,\n}: {\n flaggedProfileUrl: string;\n flaggedTargetEmail: string | null;\n reporterEmail: string;\n reason: string | null;\n}): Promise {\n const now = new Date().toISOString();\n const result = await sqlite.execute({\n sql: `insert into dateme_reports\n (type, target_email, target_profile, reporter_email, reason, created_at)\n values ('profile_flag', ?, ?, ?, ?, ?)`,\n args: [\n flaggedTargetEmail,\n JSON.stringify(flaggedProfileUrl),\n reporterEmail,\n reason,\n now,\n ],\n });\n return Number(result.lastInsertRowid);\n}\n\n// ─── AI review (synchronous, fail-open) ──────────────────────────────────────\n\nexport async function runAiReview(reportId: number): Promise {\n const { rows } = await sqlite.execute({\n sql: \"select target_profile, reason from dateme_reports where id = ? limit 1\",\n args: [reportId],\n });\n if (rows.length === 0) return;\n const r = rows[0] as any;\n let profileUrl: string;\n try {\n profileUrl = JSON.parse(r.target_profile);\n } catch {\n profileUrl = r.target_profile;\n }\n let profileText = \"\";\n try {\n const fetched = await fetchDocText(profileUrl);\n profileText = fetched.text.slice(0, PROFILE_TEXT_LIMIT);\n } catch (e) {\n console.error(\"[runAiReview] fetchDocText failed:\", e);\n }\n // Whether we actually read the profile. If false (private/locked/broken doc),\n // we must not auto-act — an inaccessible link is not evidence of a violation.\n const loaded = profileText.length > 0;\n const review = await reviewProfileFlag({\n profileText: profileText || \"(profile content could not be loaded)\",\n flaggerReason: r.reason ?? undefined,\n });\n const now = new Date().toISOString();\n await sqlite.execute({\n sql: `update dateme_reports\n set ai_verdict = ?, ai_reasoning = ?, ai_confidence = ?, ai_checked_at = ?\n where id = ?`,\n args: [review.verdict, review.reasoning, review.confidence, now, reportId],\n });\n\n // Auto-unlist (reversible) only when the AI is confident about a violation it\n // could actually read. We hide the profile via DeletedAt rather than ban — a\n // human still confirms in /admin, and dismissing the report republishes it.\n // Never act on an unreadable profile, an already-hidden one, or a banned one.\n if (loaded && review.verdict === \"violation\" && review.confidence === \"high\") {\n await sqlite.execute({\n sql: `update DateMeDocs set DeletedAt = ?\n where Profile = ? and DeletedAt is null and blocked_at is null`,\n args: [now, r.target_profile],\n });\n await sqlite.execute({\n sql: \"update dateme_reports set ai_unlisted_at = ? where id = ?\",\n args: [now, reportId],\n });\n }\n}\n\n// ─── Admin decisions ─────────────────────────────────────────────────────────\n\nexport type Decision = \"ban\" | \"unpublish\" | \"dismiss\";\n\nexport async function decideReport(\n reportId: number,\n decision: Decision,\n adminEmail: string,\n notes?: string,\n): Promise {\n const { rows } = await sqlite.execute({\n sql:\n \"select target_email, target_profile, reason, ai_unlisted_at from dateme_reports where id = ? limit 1\",\n args: [reportId],\n });\n if (rows.length === 0) return;\n const r = rows[0] as any;\n\n await sqlite.execute({\n sql: `update dateme_reports\n set admin_decision = ?, admin_decided_by = ?, admin_decided_at = ?, admin_notes = ?\n where id = ?`,\n args: [decision, adminEmail, new Date().toISOString(), notes ?? null, reportId],\n });\n\n if (decision === \"ban\" && r.target_email) {\n const banReason = notes && notes.trim()\n ? notes.trim()\n : (r.reason && r.reason.trim() ? `Flagged: ${r.reason.trim()}` : \"Banned by admin via report\");\n await banUser(r.target_email, banReason);\n }\n\n // Unpublish (soft-delete): hide the profile from the directory WITHOUT banning\n // the person — the right call for duplicates, empty/placeholder docs, or wrong\n // links. Reversible (the report page exposes a Republish button, and a claimed\n // user can also be republished from their detail page). Works on unclaimed\n // profiles too. Skip rows that are already hidden or banned.\n if (decision === \"unpublish\") {\n await sqlite.execute({\n sql: `update DateMeDocs set DeletedAt = ?\n where Profile = ? and DeletedAt is null and blocked_at is null`,\n args: [new Date().toISOString(), r.target_profile],\n });\n }\n\n // If the AI auto-unlisted this profile and an admin is now dismissing the\n // report, the auto-action was a false positive — restore the listing. Gated\n // on ai_unlisted_at so we never republish a profile the user paused on their\n // own (DeletedAt set without an AI auto-unlist behind it).\n if (decision === \"dismiss\" && r.ai_unlisted_at) {\n await sqlite.execute({\n sql: \"update DateMeDocs set DeletedAt = null where Profile = ? and blocked_at is null\",\n args: [r.target_profile],\n });\n }\n}\n\n// ─── Listing / lookup ────────────────────────────────────────────────────────\n\nexport type ReportRow = Record;\n\nexport async function getReport(id: number): Promise {\n const { rows } = await sqlite.execute({\n sql: \"select * from dateme_reports where id = ? limit 1\",\n args: [id],\n });\n return (rows[0] as any) ?? null;\n}\n\nexport async function listPendingReports(): Promise {\n const { rows } = await sqlite.execute(\n \"select * from dateme_reports where admin_decision is null order by created_at desc\",\n );\n return rows as any[];\n}\n\nexport async function listAllReports(\n { page = 1, limit = 50, status = \"all\" }: {\n page?: number;\n limit?: number;\n status?: \"pending\" | \"decided\" | \"all\";\n } = {},\n): Promise<{ rows: ReportRow[]; total: number; page: number; limit: number }> {\n const offset = Math.max(0, (page - 1) * limit);\n const where = status === \"pending\"\n ? \"where admin_decision is null\"\n : status === \"decided\"\n ? \"where admin_decision is not null\"\n : \"\";\n const { rows } = await sqlite.execute({\n sql: `select * from dateme_reports ${where} order by created_at desc limit ? offset ?`,\n args: [limit, offset],\n });\n const { rows: countRows } = await sqlite.execute(\n `select count(*) as n from dateme_reports ${where}`,\n );\n return {\n rows: rows as any[],\n total: Number((countRows[0] as any).n ?? 0),\n page,\n limit,\n };\n}\n\nexport async function reportsAgainstTarget(targetEmail: string): Promise {\n const { rows } = await sqlite.execute({\n sql:\n \"select * from dateme_reports where target_email = ? order by created_at desc\",\n args: [targetEmail],\n });\n return rows as any[];\n}\n\nexport async function reportsForMessage(messageId: number): Promise {\n const { rows } = await sqlite.execute({\n sql:\n \"select * from dateme_reports where message_id = ? order by created_at desc\",\n args: [messageId],\n });\n return rows as any[];\n}\n\nexport async function countPendingByTarget(): Promise<{ target_email: string; n: number }[]> {\n const { rows } = await sqlite.execute(\n `select target_email, count(*) as n from dateme_reports\n where admin_decision is null group by target_email`,\n );\n return rows as any[];\n}\n\n// ─── Rate limits for /flag ───────────────────────────────────────────────────\n\nexport async function flagsRecentForReporter(reporterEmail: string): Promise {\n const since = new Date(Date.now() - 24 * 60 * 60 * 1000).toISOString();\n const { rows } = await sqlite.execute({\n sql:\n `select count(*) as n from dateme_reports\n where type = 'profile_flag' and reporter_email = ? and created_at > ?`,\n args: [reporterEmail, since],\n });\n return Number((rows[0] as any).n ?? 0);\n}\n\nexport async function hasReporterFlaggedTarget(\n reporterEmail: string,\n targetProfile: string,\n): Promise {\n const { rows } = await sqlite.execute({\n sql:\n `select 1 from dateme_reports\n where type = 'profile_flag' and reporter_email = ? and target_profile = ? limit 1`,\n args: [reporterEmail, JSON.stringify(targetProfile)],\n });\n return rows.length > 0;\n}\n",[],[675,677],"505dbbb8-0b26-43e5-9110-d4b14ce8d622","profile_search.ts","9c68b2f6-471c-11f1-acac-42b51c65c3df",["D",1788187875254],5,"// Orchestrates profile filtering: gender/age/style via SQL, geo via staging table.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { distanceKm } from \"./haversine.ts\";\nimport { geocode, type GeoHit } from \"./photon.ts\";\nimport { loadLocations } from \"./profile_locations.ts\";\n\nexport type SearchPoint = { label: string; lat?: number | null; lon?: number | null };\n\nexport type SearchParams = {\n gender?: string;\n desiredGender?: string;\n style?: string; // \"mono\" | \"poly\" | undefined (= any)\n minAge: number;\n maxAge: number;\n locations?: SearchPoint[]; // user may search multiple cities; OR-ed\n radiusMi?: number;\n};\n\nexport type SearchResult = {\n local: any[]; // profile has a real location within the requested radius\n remote: any[]; // matched only because they're location-flexible/anywhere\n geo: GeoHit[]; // resolved search points (one per input location)\n};\n\n/**\n * Build the Style WHERE clause. Profiles store Style as a JSON array like\n * '[\"mono\"]', '[\"poly\"]', or '[\"Any\"]'. A profile with style=\"Any\" should\n * match any user filter. SQLite LIKE is case-insensitive for ASCII, so\n * '%any%' matches '[\"Any\"]'.\n */\nfunction styleClause(style?: string): { sql: string; args: any[] } {\n if (!style || style === \"any\") return { sql: \"\", args: [] };\n if (style === \"mono\" || style === \"poly\") {\n return {\n sql: ` and (Style like ? or Style like '%any%')`,\n args: [`%${style}%`],\n };\n }\n return { sql: \"\", args: [] };\n}\n\n/** Resolve a search point to lat/lon — preferring the chip's coords, else geocoding. */\nasync function resolvePoint(p: SearchPoint): Promise {\n if (p.lat != null && p.lon != null) {\n return { label: p.label, lat: p.lat, lon: p.lon };\n }\n if (p.label) return await geocode(p.label);\n return null;\n}\n\nexport async function searchProfiles(p: SearchParams): Promise {\n // The form is \"I'm looking for \" from the searcher's\n // perspective, so the searcher's \"looking for\" filters the profile's Gender,\n // and the searcher's own gender filters the profile's InterestedIn.\n //\n // Age filter is computed from Birthday: someone is at least N years old when\n // their Birthday is on or before today−N years; at most N years old when\n // their Birthday is strictly after today−(N+1) years. Profiles without a\n // Birthday are excluded — they have no real age data anyway (legacy \"null\"\n // entries that were never collected).\n const sc = styleClause(p.style);\n const { rows } = await sqlite.execute({\n sql: `select * from DateMeDocs\n where DeletedAt is null\n and blocked_at is null\n and Birthday is not null\n and Birthday <= date('now', ? || ' years')\n and Birthday > date('now', ? || ' years')\n and Gender like ?\n and InterestedIn like ?\n ${sc.sql}\n order by LastUpdated desc`,\n args: [\n `-${p.minAge}`,\n `-${p.maxAge + 1}`,\n \"%\" + (p.desiredGender ?? \"\") + \"%\",\n \"%\" + (p.gender ?? \"\") + \"%\",\n ...sc.args,\n ],\n });\n\n const profiles = rows as any[];\n\n // Resolve every search point. Drop any that fail to geocode (but keep going\n // with whatever resolved).\n const points = p.locations ?? [];\n const resolved: GeoHit[] = [];\n for (const pt of points) {\n const hit = await resolvePoint(pt);\n if (hit) resolved.push(hit);\n }\n\n // No usable geo or no radius → everyone is \"local\" (no location filter in play).\n if (resolved.length === 0 || !p.radiusMi) {\n return { local: profiles, remote: [], geo: resolved };\n }\n\n const radiusKm = p.radiusMi * 1.609344;\n const pks = profiles.map((r) => r.Profile).filter(Boolean);\n const locsByProfile = await loadLocations(pks);\n\n // Annotate each matching profile as \"local\" (real lat/lon within radius of\n // any search point) or \"remote\" (only matched because they're flexible/\n // anywhere). Drop non-matches. Track location count so we can deboost\n // profiles that list many cities.\n const annotated: { row: any; kind: \"local\" | \"remote\"; locCount: number }[] = [];\n for (const r of profiles) {\n const locs = locsByProfile.get(r.Profile);\n if (!locs?.length) continue;\n const localMatch = locs.some((l) =>\n l.latitude != null && l.longitude != null\n && resolved.some((g) => distanceKm(g.lat, g.lon, l.latitude!, l.longitude!) <= radiusKm)\n );\n if (localMatch) {\n annotated.push({ row: r, kind: \"local\", locCount: locs.length });\n continue;\n }\n const remoteMatch = locs.some((l) => l.is_remote);\n if (remoteMatch) annotated.push({ row: r, kind: \"remote\", locCount: locs.length });\n }\n\n // Sort within each group: profiles with fewer locations rank higher (so\n // people who list one city beat people who list ten). V8's stable sort\n // preserves LastUpdated-desc as the tiebreaker.\n annotated.sort((a, b) => a.locCount - b.locCount);\n\n return {\n local: annotated.filter((x) => x.kind === \"local\").map((x) => x.row),\n remote: annotated.filter((x) => x.kind === \"remote\").map((x) => x.row),\n geo: resolved,\n };\n}\n",[],[675,685],"15254888-47c9-11f1-9865-42b51c65c3df","profile_persist.ts","c2dc3878-47b6-11f1-a161-42b51c65c3df",["D",1777906439362],"// Shared persistence + validation for /join (create) and /me/edit (update).\n// One source of truth so the form-error-recovery and DB shape stay aligned.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { ageFromBirthday } from \"./json_safe.ts\";\nimport { validateDoc } from \"./doc_validator.ts\";\n\nexport type ChipPayload = { label: string; lat?: number; lon?: number };\n\nexport type ProfileForm = {\n name: string;\n profile: string; // doc URL\n birthday: string; // YYYY-MM-DD\n age: number; // computed from birthday — kept in sync with the legacy Age column until it's dropped\n genders: string[];\n interestedIn: string[];\n styleArr: string[]; // legacy schema stores Style as JSON array\n locationFlexibility: string;\n chips: ChipPayload[];\n lookingForAgeMin: number;\n lookingForAgeMax: number;\n lookingForRadiusMi: number | null; // null = \"Anywhere\"\n};\n\nexport type ParseResult =\n | { ok: true; form: ProfileForm }\n | { ok: false; reason: string };\n\nexport function parseChips(body: Record): ChipPayload[] {\n const raw = body[\"locations[]\"];\n const arr = Array.isArray(raw) ? raw : raw ? [raw] : [];\n const chips: ChipPayload[] = [];\n for (const v of arr) {\n if (typeof v !== \"string\" || !v) continue;\n try {\n const obj = JSON.parse(v);\n if (obj && typeof obj.label === \"string\" && obj.label) {\n chips.push({\n label: obj.label,\n lat: typeof obj.lat === \"number\" ? obj.lat : undefined,\n lon: typeof obj.lon === \"number\" ? obj.lon : undefined,\n });\n }\n } catch {\n // skip malformed\n }\n }\n return chips;\n}\n\nfunction parseIntField(body: Record, key: string, fallback: number): number {\n const v = body[key];\n if (v == null || v === \"\") return fallback;\n const n = parseInt(String(v), 10);\n return Number.isFinite(n) ? n : fallback;\n}\n\n/** Parse + validate a /join or /me/edit form body. Doesn't write anything. */\nexport async function parseProfileForm(body: Record): Promise {\n const profile = String(body[\"Profile\"] ?? \"\").trim();\n const name = String(body[\"Name\"] ?? \"\").trim();\n const birthday = String(body[\"Birthday\"] ?? \"\").trim();\n const age = ageFromBirthday(birthday);\n if (age == null || age < 18 || age > 120) {\n return { ok: false, reason: \"Please enter a valid birthday (you must be 18 or older).\" };\n }\n if (!name) return { ok: false, reason: \"Please enter your name.\" };\n if (!profile) return { ok: false, reason: \"Please enter the URL of your profile.\" };\n\n const validation = await validateDoc(profile);\n if (!validation.ok) return { ok: false, reason: validation.reason };\n\n const styleRaw = String(body[\"Style\"] ?? \"\");\n const styleArr = styleRaw === \"mono\" ? [\"mono\"] : styleRaw === \"poly\" ? [\"poly\"] : [\"Any\"];\n const arr = (k: string): string[] => {\n const v = body[k];\n return Array.isArray(v) ? v.map(String) : v ? [String(v)] : [];\n };\n\n const lookingForAgeMin = Math.max(18, Math.min(120, parseIntField(body, \"LookingForAgeMin\", 18)));\n const lookingForAgeMaxRaw = parseIntField(body, \"LookingForAgeMax\", 70);\n const lookingForAgeMax = Math.max(lookingForAgeMin, Math.min(120, lookingForAgeMaxRaw));\n const radiusRaw = body[\"LookingForRadiusMi\"];\n const lookingForRadiusMi = radiusRaw == null || radiusRaw === \"\"\n ? null\n : Number.isFinite(Number(radiusRaw)) ? Number(radiusRaw) : null;\n\n return {\n ok: true,\n form: {\n name,\n profile,\n birthday,\n age,\n genders: arr(\"Gender[]\"),\n interestedIn: arr(\"InterestedIn[]\"),\n styleArr,\n locationFlexibility: String(body[\"LocationFlexibility\"] ?? \"Flexible\"),\n chips: parseChips(body),\n lookingForAgeMin,\n lookingForAgeMax,\n lookingForRadiusMi,\n },\n };\n}\n\n/** INSERT a new DateMeDocs row + mirror locations into the locations table.\n * We still write the legacy Age column alongside Birthday until it's dropped,\n * so a rollback to the previous code keeps reading correct values. */\nexport async function createProfile(form: ProfileForm, email: string): Promise {\n await sqlite.execute({\n sql: `INSERT INTO DateMeDocs (\n Name, Profile, Age, Gender, InterestedIn, Location, LocationFlexibility,\n Style, Contact, LastUpdated, UserEmail, Birthday,\n LookingForAgeMin, LookingForAgeMax, LookingForRadiusMi\n ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n JSON.stringify(form.name),\n JSON.stringify(form.profile),\n form.age,\n JSON.stringify(form.genders),\n JSON.stringify(form.interestedIn),\n JSON.stringify(form.chips.map((c) => c.label)),\n JSON.stringify(form.locationFlexibility),\n JSON.stringify(form.styleArr),\n JSON.stringify(email),\n new Date().toISOString(),\n email,\n form.birthday,\n form.lookingForAgeMin,\n form.lookingForAgeMax,\n form.lookingForRadiusMi,\n ],\n });\n await replaceProfileLocations(form.profile, form.chips);\n}\n\n/** UPDATE the DateMeDocs row for this user. Profile URL may be changed —\n * locations rows are migrated to the new key. */\nexport async function updateProfile(\n form: ProfileForm,\n email: string,\n oldProfileUrl: string,\n): Promise {\n await sqlite.execute({\n sql: `UPDATE DateMeDocs SET\n Name = ?, Profile = ?, Age = ?, Gender = ?, InterestedIn = ?,\n Location = ?, LocationFlexibility = ?, Style = ?,\n LastUpdated = ?, Birthday = ?,\n LookingForAgeMin = ?, LookingForAgeMax = ?, LookingForRadiusMi = ?\n WHERE UserEmail = ?`,\n args: [\n JSON.stringify(form.name),\n JSON.stringify(form.profile),\n form.age,\n JSON.stringify(form.genders),\n JSON.stringify(form.interestedIn),\n JSON.stringify(form.chips.map((c) => c.label)),\n JSON.stringify(form.locationFlexibility),\n JSON.stringify(form.styleArr),\n new Date().toISOString(),\n form.birthday,\n form.lookingForAgeMin,\n form.lookingForAgeMax,\n form.lookingForRadiusMi,\n email,\n ],\n });\n // If the profile URL changed, the old location rows are now orphaned. Just\n // wipe and re-mirror — locations is derived data, never a source of truth.\n if (oldProfileUrl !== form.profile) {\n await sqlite.execute({\n sql: \"DELETE FROM dateme_profile_locations WHERE profile = ?\",\n args: [JSON.stringify(oldProfileUrl)],\n });\n }\n await replaceProfileLocations(form.profile, form.chips);\n}\n\n/** Returns the existing claim-state for a profile URL, or null if free. Used\n * by /join to give a clearer error message on duplicate URLs. */\nexport async function findExistingProfileOwner(profileUrl: string): Promise<\n { userEmail: string | null } | null\n> {\n const { rows } = await sqlite.execute({\n sql: \"SELECT UserEmail FROM DateMeDocs WHERE Profile = ? LIMIT 1\",\n args: [JSON.stringify(profileUrl)],\n });\n if (rows.length === 0) return null;\n const userEmail = (rows[0] as any).UserEmail;\n return { userEmail: typeof userEmail === \"string\" ? userEmail : null };\n}\n\nasync function replaceProfileLocations(profileUrl: string, chips: ChipPayload[]): Promise {\n const profileKey = JSON.stringify(profileUrl);\n await sqlite.execute({\n sql: \"DELETE FROM dateme_profile_locations WHERE profile = ?\",\n args: [profileKey],\n });\n const now = new Date().toISOString();\n for (let i = 0; i < chips.length; i++) {\n const chip = chips[i];\n await sqlite.execute({\n sql: `INSERT INTO dateme_profile_locations\n (profile, ord, original_label, geocoded_label, latitude, longitude, is_remote, geocoded_at, status)\n VALUES (?, ?, ?, ?, ?, ?, 0, ?, 'ok')`,\n args: [profileKey, i, chip.label, chip.label, chip.lat ?? null, chip.lon ?? null, now],\n });\n }\n}\n",[],[675,693],"c2df8dca-47b6-11f1-a161-42b51c65c3df","profile_locations.ts","9c68a8d8-471c-11f1-acac-42b51c65c3df",["D",1777898570362],"// Load geocoded location rows for a set of profiles.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport type Location = {\n ord: number;\n original_label: string;\n geocoded_label: string | null;\n latitude: number | null;\n longitude: number | null;\n is_remote: boolean;\n};\n\nexport async function loadLocations(profiles: string[]): Promise> {\n const out = new Map();\n if (profiles.length === 0) return out;\n const placeholders = profiles.map(() => \"?\").join(\",\");\n const { rows } = await sqlite.execute({\n sql: `SELECT profile, ord, original_label, geocoded_label, latitude, longitude, is_remote\n FROM dateme_profile_locations\n WHERE profile IN (${placeholders})`,\n args: profiles,\n });\n for (const r of rows as any[]) {\n const list = out.get(r.profile) ?? [];\n list.push({\n ord: r.ord,\n original_label: r.original_label,\n geocoded_label: r.geocoded_label,\n latitude: r.latitude,\n longitude: r.longitude,\n is_remote: !!r.is_remote,\n });\n out.set(r.profile, list);\n }\n return out;\n}\n",[],[675,700],"4459712c-5c25-11f1-bbd5-ee650bb23af1","profile_guard.ts","c2dc2dd8-47b6-11f1-a161-42b51c65c3df",["D",1780145055495],"// Auth / profile guards for routes that show directory data.\n//\n// Two gates:\n// - requireSignedIn: signed-in is enough. Used by /browse and /contact\n// so anyone with an account can browse + message,\n// whether or not they've created their own profile.\n// - requireClaimedProfile: signed-in AND owns a profile. Used by /flag\n// (you must be a listed member to flag others).\n//\n// Both bounce anonymous → / and banned → /banned. A banned user is one whose\n// own DateMeDocs row has blocked_at set; someone with no profile has nothing to\n// ban, so they pass requireSignedIn.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport type GuardSuccess = { email: string; blocked: false };\nexport type SignedInSuccess = GuardSuccess & { hasProfile: boolean };\n\n// Look up the signed-in user's own profile row (if any) and its ban state.\nasync function ownProfile(email: string): Promise<{ exists: boolean; blocked: boolean }> {\n const { rows } = await sqlite.execute({\n sql: \"select blocked_at from DateMeDocs where UserEmail = ? limit 1\",\n args: [email],\n });\n if (rows.length === 0) return { exists: false, blocked: false };\n return { exists: true, blocked: !!(rows[0] as any).blocked_at };\n}\n\n// Signed-in only. A profile is optional. Banned (on your own profile) → /banned.\nexport async function requireSignedIn(c: any): Promise {\n const email = c.get(\"user\")?.email;\n if (!email) return c.redirect(\"/\", 302);\n const own = await ownProfile(email);\n if (own.blocked) return c.redirect(\"/banned\", 302);\n return { email, blocked: false, hasProfile: own.exists };\n}\n\n// Signed-in AND owns a (non-banned) profile. Profile-less → /claim.\n// Soft-deleted profiles (DeletedAt set) still pass — pausing your listing\n// shouldn't kick you out of the directory.\nexport async function requireClaimedProfile(c: any): Promise {\n const email = c.get(\"user\")?.email;\n if (!email) return c.redirect(\"/\", 302);\n const own = await ownProfile(email);\n if (!own.exists) return c.redirect(\"/claim\", 302);\n if (own.blocked) return c.redirect(\"/banned\", 302);\n return { email, blocked: false };\n}\n",[],[675,707],"9c68a16c-471c-11f1-acac-42b51c65c3df","photon.ts","9c68a1e4-471c-11f1-acac-42b51c65c3df",["D",1777832363353],"// Server-side single-shot geocode via Photon (https://photon.komoot.io).\n// Returns the top result, or null if no match.\n\nexport type GeoHit = { label: string; lat: number; lon: number };\n\nexport async function geocode(query: string): Promise {\n const q = query.trim();\n if (!q) return null;\n const url = \"https://photon.komoot.io/api/?limit=1&q=\" + encodeURIComponent(q);\n const resp = await fetch(url, {\n headers: { \"User-Agent\": \"DateMeDirectory/1.0 (steve@val.town)\" },\n });\n if (!resp.ok) return null;\n const data = await resp.json() as {\n features?: Array<{\n geometry?: { coordinates?: [number, number] };\n properties?: { name?: string; city?: string; state?: string; country?: string };\n }>;\n };\n const top = data.features?.[0];\n const coords = top?.geometry?.coordinates;\n const props = top?.properties;\n if (!top || !coords || !props) return null;\n const [lon, lat] = coords;\n const parts = [props.name, props.city, props.state, props.country].filter(\n (p, i, arr) => p && arr.indexOf(p) === i,\n );\n return { label: parts.join(\", \"), lat, lon };\n}\n",[],[675,714],"e3ff7ecc-5add-11f1-ab8d-ee650bb23af1","openai_review.ts","c2dc0fe2-47b6-11f1-a161-42b51c65c3df",219,["D",1780004448426],"// Server-side AI moderation helpers (gpt-4o-mini via std/openai).\n//\n// - checkSpam: classifies first-contact messages on the contact form.\n// - reviewProfileFlag: reviews a user-flagged profile against community rules.\n//\n// Both fail OPEN: on any error we return a non-blocking verdict so a classifier\n// outage never breaks the user flow.\n\nimport { OpenAI } from \"https://esm.town/v/std/openai\";\n\nconst openai = new OpenAI();\n\n// ─── Contact-message spam check ──────────────────────────────────────────────\n\nconst SPAM_SYSTEM_PROMPT = `You moderate first-contact messages on a small \"Date Me Doc\" directory.\nReply ONLY with JSON of shape {\"spam\": boolean, \"reason\": string}.\n\nMark spam when the message is:\n- a sales / marketing / commercial pitch\n- a phishing or impersonation attempt\n- threats, harassment, or sexual harassment\n- wildly off-topic for a dating directory\n\nDo NOT mark spam for messages that are just awkward, short, weirdly written,\noverly enthusiastic, or include compliments. Most messages should pass.\nReason should be a one-sentence justification.`;\n\nexport type SpamCheck = { spam: boolean; reason?: string };\n\nexport async function checkSpam(\n body: string,\n sender: string,\n recipientName: string,\n): Promise {\n try {\n const resp = await openai.chat.completions.create({\n model: \"gpt-4o-mini\",\n messages: [\n { role: \"system\", content: SPAM_SYSTEM_PROMPT },\n {\n role: \"user\",\n content: `Sender: ${sender}\\nRecipient name: ${recipientName}\\n\\nMessage:\\n${body}`,\n },\n ],\n response_format: { type: \"json_object\" },\n });\n const content = resp.choices[0]?.message?.content ?? \"{}\";\n const parsed = JSON.parse(content) as { spam?: unknown; reason?: unknown };\n return {\n spam: !!parsed.spam,\n reason: typeof parsed.reason === \"string\" ? parsed.reason : undefined,\n };\n } catch (e) {\n console.error(\"[spam-check] error:\", e);\n return { spam: false };\n }\n}\n\n// ─── Profile-flag review ─────────────────────────────────────────────────────\n\nconst FLAG_SYSTEM_PROMPT =\n `You review user-submitted reports against profiles in a small, friendly \"Date Me Doc\" directory. Each person lists a link to their own dating profile (a Google Doc, Notion page, personal website, etc.). Your job is to judge the PROFILE CONTENT, not the reporter's opinion.\n\nBe conservative: the default is \"no-violation\". Most reports should NOT be upheld.\n\nReply ONLY with JSON of shape:\n{\"verdict\": \"violation\" | \"no-violation\", \"confidence\": \"high\" | \"low\", \"reasoning\": \"\"}\n\nUphold a VIOLATION only when the profile content itself is clearly one of:\n- a commercial / sales / marketing pitch, advertisement, or promotion (not a person seeking a partner)\n- spam, an SEO/link farm, or content unrelated to dating (e.g. a product page, a company site, a card-game rulebook)\n- a fake, joke, placeholder, or impersonation profile (e.g. a celebrity, a brand, an AI persona, \"Jane Doe\"/lorem-ipsum filler)\n- illegal content, or harassment / threats\nSet \"confidence\":\"high\" ONLY when the profile content you were given makes the violation obvious and unambiguous. If you are even somewhat unsure, use \"low\".\n\nThese are NOT violations (return \"no-violation\"):\n- requests to remove a duplicate or old listing (\"please delete this\", \"I made a new one\", \"remove the dupe\")\n- \"no longer dating\" / \"I'm in a relationship now\" — that's a removal request, not abuse\n- the reporter merely dislikes, distrusts, or is suspicious of the person without concrete evidence (\"looks fake\", \"seems off\")\n- profiles that are short, sparse, awkward, oddly written, or just not to your taste\n- a genuine personal/dating profile that happens to live on an unusual or custom domain\n\nCRITICAL: If the profile content is empty, missing, or could not be loaded — for example it says it could not be loaded, requires a Google/Notion sign-in, or is access-restricted — that is NOT evidence of a violation. A private or broken link is a fixable access problem, not abuse. In that case return \"no-violation\" with \"confidence\":\"low\". NEVER return a high-confidence violation when you could not actually read the profile content.\n\nThe reporter's reason is only a hint — judge the profile content itself.`;\n\nexport type FlagReview = {\n verdict: \"violation\" | \"no-violation\" | \"error\";\n confidence: \"high\" | \"low\";\n reasoning: string;\n};\n\nexport async function reviewProfileFlag(\n { profileText, flaggerReason }: { profileText: string; flaggerReason?: string },\n): Promise {\n try {\n const resp = await openai.chat.completions.create({\n model: \"gpt-4o-mini\",\n messages: [\n { role: \"system\", content: FLAG_SYSTEM_PROMPT },\n {\n role: \"user\",\n content:\n `Flagger's reason: ${flaggerReason || \"(none provided)\"}\\n\\nProfile content:\\n${profileText}`,\n },\n ],\n response_format: { type: \"json_object\" },\n });\n const content = resp.choices[0]?.message?.content ?? \"{}\";\n const parsed = JSON.parse(content) as {\n verdict?: unknown;\n confidence?: unknown;\n reasoning?: unknown;\n };\n const verdict = parsed.verdict === \"violation\" ? \"violation\" : \"no-violation\";\n const confidence = parsed.confidence === \"high\" ? \"high\" : \"low\";\n const reasoning = typeof parsed.reasoning === \"string\" ? parsed.reasoning : \"\";\n return { verdict, confidence, reasoning };\n } catch (e) {\n console.error(\"[flag-review] error:\", e);\n return { verdict: \"error\", confidence: \"low\", reasoning: String(e) };\n }\n}\n",[],[675,721],"c2dbfa20-47b6-11f1-a161-42b51c65c3df","messages.ts","c2dbfade-47b6-11f1-a161-42b51c65c3df",["D",1777898570362],"// Helpers for the contact-form flow. (Spam-ban / report logic lives in lib/reports.ts.)\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport async function recentSendCount(senderEmail: string): Promise {\n const since = new Date(Date.now() - 24 * 60 * 60 * 1000).toISOString();\n const { rows } = await sqlite.execute({\n sql: \"select count(*) as n from dateme_messages where sender_email = ? and sent_at > ?\",\n args: [senderEmail, since],\n });\n return Number((rows[0] as any).n ?? 0);\n}\n\nfunction randomHex(bytes: number): string {\n const buf = new Uint8Array(bytes);\n crypto.getRandomValues(buf);\n return Array.from(buf).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport type CreateInput = {\n senderEmail: string;\n recipientEmail: string;\n recipientProfileUrl: string;\n body: string;\n openaiSpamFlag: boolean;\n openaiSpamReason?: string;\n};\n\nexport async function createMessage(m: CreateInput): Promise<{ id: number; reportToken: string }> {\n const reportToken = randomHex(16);\n const sentAt = new Date().toISOString();\n const result = await sqlite.execute({\n sql: `insert into dateme_messages\n (sender_email, recipient_email, recipient_profile_url, body, sent_at, report_token,\n openai_spam_flag, openai_spam_reason)\n values (?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n m.senderEmail,\n m.recipientEmail,\n m.recipientProfileUrl,\n m.body,\n sentAt,\n reportToken,\n m.openaiSpamFlag ? 1 : 0,\n m.openaiSpamReason ?? null,\n ],\n });\n return { id: Number(result.lastInsertRowid), reportToken };\n}\n\nexport async function findMessageForReport(id: number, token: string) {\n const { rows } = await sqlite.execute({\n sql: \"select * from dateme_messages where id = ? and report_token = ? limit 1\",\n args: [id, token],\n });\n return (rows[0] as any) ?? null;\n}\n\n/**\n * Set DateMeDocs.blocked_at = now (if not already) and ban_reason. Idempotent\n * — a second call with a new reason updates only the reason if you pass one.\n */\nexport async function banUser(email: string, reason?: string) {\n await sqlite.execute({\n sql: `update DateMeDocs\n set blocked_at = coalesce(blocked_at, ?),\n ban_reason = coalesce(?, ban_reason)\n where UserEmail = ?`,\n args: [new Date().toISOString(), reason ?? null, email],\n });\n}\n\nexport async function unbanUser(email: string) {\n // Leave ban_reason in place for history; only clear blocked_at.\n await sqlite.execute({\n sql: \"update DateMeDocs set blocked_at = null where UserEmail = ?\",\n args: [email],\n });\n}\n",[],[675,729],"15253bea-47c9-11f1-9865-42b51c65c3df","json_safe.ts","c2dbf16a-47b6-11f1-a161-42b51c65c3df",["D",1777906439362],"// Tiny helpers for the legacy DateMeDocs schema, which stores most string-ish\n// fields as JSON-encoded text (e.g. Name = '\"Steve\"', Gender = '[\"F\"]'). Both\n// helpers are pure / synchronous; safe to use from JSX.\n\n/** JSON.parse, falling back to the original value on any parse error. Use when\n * you don't know whether a column is wrapped JSON (\"\\\"Steve\\\"\") or raw text. */\nexport function safeParse(s: any): any {\n try { return JSON.parse(s); } catch { return s; }\n}\n\n/** Add `https://` if a URL is missing a scheme. */\nexport function httpsIfy(url: string): string {\n if (!url) return url;\n if (url.startsWith(\"http://\") || url.startsWith(\"https://\")) return url;\n return \"https://\" + url;\n}\n\n/** Compute age in whole years from a YYYY-MM-DD birthday. Returns null when\n * the input is missing or unparseable, so callers can render a placeholder. */\nexport function ageFromBirthday(birthday: any): number | null {\n if (!birthday) return null;\n const d = new Date(String(birthday));\n if (isNaN(d.getTime())) return null;\n const now = new Date();\n let age = now.getFullYear() - d.getFullYear();\n const m = now.getMonth() - d.getMonth();\n if (m < 0 || (m === 0 && now.getDate() < d.getDate())) age--;\n return age;\n}\n",[],[675,736],"9c689cbc-471c-11f1-acac-42b51c65c3df","haversine.ts","9c689d3e-471c-11f1-acac-42b51c65c3df",["D",1777832363353],"// Great-circle distance in kilometers between two lat/lon points.\nexport function distanceKm(lat1: number, lon1: number, lat2: number, lon2: number): number {\n const R = 6371; // Earth radius in km\n const toRad = (d: number) => (d * Math.PI) / 180;\n const dLat = toRad(lat2 - lat1);\n const dLon = toRad(lon2 - lon1);\n const a =\n Math.sin(dLat / 2) ** 2\n + Math.cos(toRad(lat1)) * Math.cos(toRad(lat2)) * Math.sin(dLon / 2) ** 2;\n return 2 * R * Math.asin(Math.sqrt(a));\n}\n",[],[675,743],"c2dbca50-47b6-11f1-a161-42b51c65c3df","doc_validator.ts","c2dbcb18-47b6-11f1-a161-42b51c65c3df",["D",1777898570362],"// Validate that a profile URL is fetch-able and looks like a real public doc.\n// Used by /claim (before token-in-doc verification) and /submit (new profiles).\n//\n// Strategy: try a direct fetch first (cheap, works for Google Docs export +\n// static personal sites). If the body is empty / JS-only, fall back to\n// Jina Reader (https://r.jina.ai), which renders JavaScript server-side.\n\nexport type FetchedDoc = { status: number; text: string; via: \"direct\" | \"jina\" };\nexport type ValidationResult = { ok: true } | { ok: false; reason: string };\n\n// Hosts whose pages aren't useful as public profiles (auth-walled feeds, etc.)\nconst BLOCKED_HOSTS = new Set([\n \"instagram.com\",\n \"www.instagram.com\",\n \"x.com\",\n \"twitter.com\",\n \"www.x.com\",\n \"www.twitter.com\",\n \"facebook.com\",\n \"www.facebook.com\",\n \"tiktok.com\",\n \"www.tiktok.com\",\n]);\n\nexport async function validateDoc(rawUrl: string): Promise {\n let url: URL;\n try {\n url = new URL(rawUrl);\n } catch {\n return { ok: false, reason: \"That doesn't look like a valid URL.\" };\n }\n if (!/^https?:$/.test(url.protocol)) {\n return { ok: false, reason: \"URL must start with http:// or https://\" };\n }\n if (BLOCKED_HOSTS.has(url.hostname)) {\n return {\n ok: false,\n reason:\n \"Social-media profiles aren't accepted — please use a Google Doc, Notion page, or personal site.\",\n };\n }\n const { status, text } = await fetchDocText(rawUrl);\n if (status === 401 || status === 403) {\n return {\n ok: false,\n reason: \"The page appears to be private. Make it public or share-with-anyone-with-link.\",\n };\n }\n if (status === 404 || status === 410 || status === 0) {\n return { ok: false, reason: \"Page not found — double-check the URL.\" };\n }\n if (status >= 500) {\n return { ok: false, reason: `The server returned an error (${status}). Try again later.` };\n }\n if (text.length < 200) {\n return {\n ok: false,\n reason: \"We couldn't read the page — it may require login or JavaScript to view.\",\n };\n }\n return { ok: true };\n}\n\nexport type TokenSearchResult = {\n found: boolean;\n via: \"direct\" | \"jina\";\n status: number;\n bodyLength: number;\n};\n\nexport async function docContainsToken(rawUrl: string, token: string): Promise {\n // Always bypass Jina cache for token verification — the user JUST pasted it.\n const fetched = await fetchDocText(rawUrl, { freshOnly: true });\n return {\n found: fetched.text.includes(token),\n via: fetched.via,\n status: fetched.status,\n bodyLength: fetched.text.length,\n };\n}\n\nexport async function fetchDocText(rawUrl: string, opts: { freshOnly?: boolean } = {}): Promise {\n const direct = await tryFetch(rewriteGoogleDocs(rawUrl));\n // Body large enough AND not a thin JS-redirect shell → trust the direct fetch.\n if (direct.status >= 400 || (direct.text.length > 200 && !looksThin(direct.text))) {\n return { ...direct, via: \"direct\" };\n }\n const jina = await tryFetch(`https://r.jina.ai/${rawUrl}`, opts.freshOnly ? { \"X-No-Cache\": \"true\" } : {});\n return jina.text.length > direct.text.length\n ? { ...jina, via: \"jina\" }\n : { ...direct, via: \"direct\" };\n}\n\nasync function tryFetch(url: string, extraHeaders: Record = {}): Promise<{ status: number; text: string }> {\n try {\n const r = await fetch(url, {\n redirect: \"follow\",\n signal: AbortSignal.timeout(20000),\n headers: {\n \"user-agent\": \"DateMeDirectoryValidator/1.0 (+https://dateme.directory)\",\n ...extraHeaders,\n },\n });\n return { status: r.status, text: stripHtml(await r.text()) };\n } catch {\n return { status: 0, text: \"\" };\n }\n}\n\nfunction rewriteGoogleDocs(rawUrl: string): string {\n const url = new URL(rawUrl);\n if (url.hostname !== \"docs.google.com\") return rawUrl;\n if (url.pathname.includes(\"/d/e/\")) return rawUrl; // already a /pub URL\n const m = url.pathname.match(/^\\/document\\/d\\/([^\\/]+)/);\n return m ? `https://docs.google.com/document/d/${m[1]}/export?format=txt` : rawUrl;\n}\n\nfunction stripHtml(html: string): string {\n return html\n .replace(//gi, \" \")\n .replace(//gi, \" \")\n .replace(/<[^>]+>/g, \" \")\n .replace(/\\s+/g, \" \")\n .trim();\n}\n\n// Heuristic: a page that *renders* in a browser but is mostly a JS-redirect\n// shell (window.location.href, meta-refresh) — too thin for our needs even\n// though it's > 200 chars after script-stripping. Force the Jina fallback.\nfunction looksThin(text: string): boolean {\n return text.length < 500;\n}\n",[],[675,750],"c2dbbfba-47b6-11f1-a161-42b51c65c3df","claim_token.ts","c2dbc078-47b6-11f1-a161-42b51c65c3df",["D",1777898570362],"// Verification token for the doc-claim flow. Deterministic from (url, email):\n// the user pastes this short code into their doc, we fetch the doc, and confirm\n// the code is present. A spammer can't paste a code into someone else's doc,\n// so claiming an existing profile requires real ownership.\n\nexport async function makeClaimToken(docUrl: string, email: string): Promise {\n const data = new TextEncoder().encode(`dateme-claim:${docUrl}:${email.toLowerCase()}`);\n const buf = await crypto.subtle.digest(\"SHA-256\", data);\n return Array.from(new Uint8Array(buf))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\")\n .slice(0, 8);\n}\n",[],[675,757],"f40b0afa-02bb-46b3-a5ec-4ca1983993c1","browse_params.ts","d897dd6c-7bdb-11f1-b32b-1607ee4eb77e",260,["D",1783631958699],"// Shared by pages/browse (HTML) and pages/api_browse (JSON): loads a user's\n// saved search prefs and resolves the effective SearchParams from a request URL,\n// falling back to those prefs when no filter query params are present.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { safeParse } from \"./json_safe.ts\";\nimport type { SearchParams } from \"./profile_search.ts\";\n\nexport type SearchChip = { label: string; lat: number | null; lon: number | null };\n\nconst DEFAULT_MIN_AGE = 18;\nconst DEFAULT_MAX_AGE = 70;\nconst DEFAULT_RADIUS_MI = 25;\n\nfunction firstOf(v: any): string | undefined {\n const x = safeParse(v);\n if (Array.isArray(x)) return x[0]?.toString().toLowerCase();\n return typeof x === \"string\" ? x.toLowerCase() : undefined;\n}\n\nfunction numOrUndef(v: any): number | undefined {\n if (v == null) return undefined;\n const n = Number(v);\n return Number.isFinite(n) ? n : undefined;\n}\n\nexport type OwnPrefs = {\n gender?: string;\n desiredGender?: string;\n style?: string;\n minAge?: number;\n maxAge?: number;\n // null = explicitly Anywhere; undefined = never set\n radiusMi: number | null | undefined;\n locations: SearchChip[];\n profileUrl?: string;\n};\n\nexport async function loadOwnPrefs(email: string): Promise {\n const { rows } = await sqlite.execute({\n sql: `select Gender, InterestedIn, Style, LookingForAgeMin, LookingForAgeMax,\n LookingForRadiusMi, Profile\n from DateMeDocs where UserEmail = ? limit 1`,\n args: [email],\n });\n const row = rows[0] as any;\n if (!row) return { radiusMi: undefined, locations: [] };\n // LookingForRadiusMi: null means user explicitly chose \"Anywhere\"; we keep null\n // distinct from undefined so we don't silently apply a default over their pick.\n const rawRadius = row.LookingForRadiusMi;\n const radiusMi = rawRadius === null ? null : numOrUndef(rawRadius);\n\n const profileUrl = safeParse(row.Profile);\n const locations: SearchChip[] = [];\n if (typeof profileUrl === \"string\" && profileUrl) {\n const locRows = await sqlite.execute({\n sql: `select original_label, latitude, longitude from dateme_profile_locations\n where profile = ? order by ord asc`,\n args: [JSON.stringify(profileUrl)],\n });\n for (const r of locRows.rows as any[]) {\n if (r.original_label) {\n locations.push({\n label: r.original_label,\n lat: typeof r.latitude === \"number\" ? r.latitude : null,\n lon: typeof r.longitude === \"number\" ? r.longitude : null,\n });\n }\n }\n }\n\n const styleVal = safeParse(row.Style);\n const styleStr = Array.isArray(styleVal) ? styleVal[0] : styleVal;\n const style = typeof styleStr === \"string\" ? styleStr.toLowerCase() : undefined;\n\n return {\n // Form's \"I'm\" = searcher's own gender. Search filters profile's InterestedIn\n // by this. Default to the user's own Gender so they see profiles open to them.\n gender: firstOf(row.Gender),\n // Form's \"Looking for\" = searcher's preference. Filters profile's Gender by this.\n desiredGender: firstOf(row.InterestedIn),\n style,\n minAge: numOrUndef(row.LookingForAgeMin),\n maxAge: numOrUndef(row.LookingForAgeMax),\n radiusMi,\n locations,\n profileUrl,\n };\n}\n\n/** Parse `locations[]=` repeated URL params into chips. */\nfunction parseLocationsFromUrl(url: URL): SearchChip[] {\n const raw = url.searchParams.getAll(\"locations[]\");\n const chips: SearchChip[] = [];\n for (const v of raw) {\n if (!v) continue;\n try {\n const obj = JSON.parse(v);\n if (obj && typeof obj.label === \"string\" && obj.label) {\n chips.push({\n label: obj.label,\n lat: typeof obj.lat === \"number\" ? obj.lat : null,\n lon: typeof obj.lon === \"number\" ? obj.lon : null,\n });\n }\n } catch {\n // skip malformed\n }\n }\n return chips;\n}\n\n/**\n * For each filter:\n * - if URL has the param, use the URL value (even if empty — empty radius\n * means \"Anywhere\", empty gender means \"any gender\")\n * - else if there's NO query string at all, fall back to user's prefs\n * - else (query string exists, e.g. \"Clear filters\" sets ?cleared=1) use\n * the hardcoded default (don't reapply prefs)\n */\nexport function resolveBrowseParams(url: URL, prefs: OwnPrefs): SearchParams {\n const hasQuery = [...url.searchParams.keys()].length > 0;\n const get = (k: string) => url.searchParams.get(k) ?? undefined;\n const has = (k: string) => url.searchParams.has(k);\n const num = (k: string) => {\n const v = get(k);\n return v ? parseFloat(v) || undefined : undefined;\n };\n const intFromUrl = (k: string, fallback: number) => {\n const v = get(k);\n if (v == null) return fallback;\n const n = parseInt(v, 10);\n return Number.isFinite(n) ? n : fallback;\n };\n\n const urlLocations = parseLocationsFromUrl(url);\n const hasLocationsParam = url.searchParams.getAll(\"locations[]\").length > 0;\n\n return {\n gender: has(\"gender\") ? get(\"gender\") : (hasQuery ? undefined : prefs.gender),\n desiredGender: has(\"desired-gender\")\n ? get(\"desired-gender\")\n : (hasQuery ? undefined : prefs.desiredGender),\n style: has(\"style\") ? get(\"style\") : (hasQuery ? undefined : prefs.style),\n minAge: has(\"min-age\")\n ? intFromUrl(\"min-age\", DEFAULT_MIN_AGE)\n : (hasQuery ? DEFAULT_MIN_AGE : (prefs.minAge ?? DEFAULT_MIN_AGE)),\n maxAge: has(\"max-age\")\n ? intFromUrl(\"max-age\", DEFAULT_MAX_AGE)\n : (hasQuery ? DEFAULT_MAX_AGE : (prefs.maxAge ?? DEFAULT_MAX_AGE)),\n locations: hasLocationsParam\n ? urlLocations\n : (hasQuery ? [] : prefs.locations),\n radiusMi: has(\"radius_mi\")\n ? num(\"radius_mi\") // undefined = Anywhere\n : (hasQuery\n ? DEFAULT_RADIUS_MI\n : (prefs.radiusMi === null\n ? undefined // explicit Anywhere\n : (prefs.radiusMi ?? DEFAULT_RADIUS_MI))),\n };\n}\n",[],[675,764],"c2db9d14-47b6-11f1-a161-42b51c65c3df","auth_schema.ts","c2db9dbe-47b6-11f1-a161-42b51c65c3df",["D",1777898570362],"// Better Auth's standard SQLite schema for core auth + magic link.\n// Idempotent; safe to call on every cold start.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport async function ensureAuthSchema() {\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS user (\n id TEXT PRIMARY KEY,\n name TEXT NOT NULL,\n email TEXT NOT NULL UNIQUE,\n emailVerified INTEGER NOT NULL DEFAULT 0,\n image TEXT,\n createdAt INTEGER NOT NULL,\n updatedAt INTEGER NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS session (\n id TEXT PRIMARY KEY,\n userId TEXT NOT NULL REFERENCES user(id) ON DELETE CASCADE,\n token TEXT NOT NULL UNIQUE,\n expiresAt INTEGER NOT NULL,\n ipAddress TEXT,\n userAgent TEXT,\n createdAt INTEGER NOT NULL,\n updatedAt INTEGER NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS account (\n id TEXT PRIMARY KEY,\n userId TEXT NOT NULL REFERENCES user(id) ON DELETE CASCADE,\n accountId TEXT NOT NULL,\n providerId TEXT NOT NULL,\n accessToken TEXT,\n refreshToken TEXT,\n accessTokenExpiresAt INTEGER,\n refreshTokenExpiresAt INTEGER,\n scope TEXT,\n idToken TEXT,\n password TEXT,\n createdAt INTEGER NOT NULL,\n updatedAt INTEGER NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS verification (\n id TEXT PRIMARY KEY,\n identifier TEXT NOT NULL,\n value TEXT NOT NULL,\n expiresAt INTEGER NOT NULL,\n createdAt INTEGER NOT NULL,\n updatedAt INTEGER NOT NULL\n )`,\n ]);\n}\n",[],[675,772],"d5ef5678-5b63-11f1-bd98-ee650bb23af1","auth.ts","c2dbab7e-47b6-11f1-a161-42b51c65c3df",225,["D",1780061977422],"// Better Auth instance for the Date Me Directory.\n// Magic-link only — no passwords, no social. Sends links via std/email.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { sendEmail } from \"./send_email.ts\";\nimport { parseVal } from \"https://esm.town/v/std/utils/index.ts\";\nimport { betterAuth } from \"npm:better-auth@1.6.9\";\nimport { magicLink } from \"npm:better-auth@1.6.9/plugins\";\nimport { LibsqlDialect } from \"npm:@libsql/kysely-libsql@0.4.1\";\n\n// Better Auth derives the actual baseURL from the request's Host + scheme on\n// each call (because we set protocol: \"auto\" + allowedHosts: [\"*\"]). The\n// `fallback` is only used in pathological cases where there's no request, so\n// hardcoding it lets us skip the cold-start httpEndpoint() round-trip.\nconst fallback = \"https://dateme.directory\";\nconst { username, name } = parseVal();\nconst secret = Deno.env.get(\"BETTER_AUTH_SECRET\") ?? `val-town-default-${username}-${name}`;\n\nexport const auth = betterAuth({\n baseURL: { allowedHosts: [\"*\"], protocol: \"auto\", fallback },\n secret,\n database: { dialect: new LibsqlDialect({ client: sqlite }), type: \"sqlite\" },\n emailAndPassword: { enabled: false },\n plugins: [\n magicLink({\n sendMagicLink: async ({ email, url }) => {\n // Always logged — Steve is the only one with log access, and pasting\n // the verify URL straight from logs is a useful fallback when std/email\n // delivery is slow / spam-foldered.\n console.log(\"[magic-link]\", email, \"→\", url);\n await sendEmail({\n to: email,\n subject: \"Date Me Directory sign-in\",\n text: `Click to sign in to the Date Me Directory:\\n\\n${url}\\n\\nThis link expires in 5 minutes.`,\n html:\n `

Click to sign in to Date Me Directory:

`\n + `

${url}

`\n + `

This link expires in 5 minutes.

`,\n });\n },\n }),\n ],\n});\n",[],[675,779],"b72fc581-197a-48f1-88cc-bb22f4e6cd8e","api_key.ts","cc2d6614-7bdb-11f1-abe1-1607ee4eb77e",259,["D",1783631937865],"// Per-user API key for the machine-readable /api/browse endpoint — lets someone\n// hand an \"authorized URL\" (with their key baked in) to an AI agent so it can\n// browse matches on their behalf, using their own saved search prefs.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nfunction randomKey(): string {\n const buf = new Uint8Array(24);\n crypto.getRandomValues(buf);\n const hex = Array.from(buf).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n return `dmd_${hex}`;\n}\n\nexport async function getApiKey(email: string): Promise {\n const { rows } = await sqlite.execute({\n sql: \"select api_key from dateme_api_keys where email = ? limit 1\",\n args: [email],\n });\n return (rows[0] as any)?.api_key ?? null;\n}\n\n/** Idempotent: returns the existing key, or mints and stores a new one. */\nexport async function getOrCreateApiKey(email: string): Promise {\n const existing = await getApiKey(email);\n if (existing) return existing;\n const key = randomKey();\n await sqlite.execute({\n sql: \"insert into dateme_api_keys (email, api_key) values (?, ?)\",\n args: [email, key],\n });\n return key;\n}\n\n/** Rotates the key, invalidating any previously shared authorized URL. */\nexport async function regenerateApiKey(email: string): Promise {\n const key = randomKey();\n await sqlite.execute({\n sql: `insert into dateme_api_keys (email, api_key) values (?, ?)\n on conflict(email) do update set api_key = excluded.api_key, created_at = dateme_api_keys.created_at`,\n args: [email, key],\n });\n return key;\n}\n\nexport async function findEmailByApiKey(key: string): Promise {\n if (!key) return null;\n const { rows } = await sqlite.execute({\n sql: \"select email from dateme_api_keys where api_key = ? limit 1\",\n args: [key],\n });\n return (rows[0] as any)?.email ?? null;\n}\n",[],[675,787],"c2db963e-47b6-11f1-a161-42b51c65c3df","admin_guard.ts","c2db9706-47b6-11f1-a161-42b51c65c3df",["D",1777898570362],"// Admin allowlist + guard. Non-admins get 404 (don't disclose admin existence).\nconst ADMIN_EMAILS = new Set([\n \"steve@val.town\",\n \"steviekrouse@gmail.com\",\n \"steveykrouse@gmail.com\",\n]);\n\nexport function isAdmin(email: string | null | undefined): boolean {\n return !!email && ADMIN_EMAILS.has(email.toLowerCase());\n}\n\nexport function requireAdmin(c: any): { email: string } | Response {\n const email = c.get(\"user\")?.email;\n if (!isAdmin(email)) return c.notFound();\n return { email };\n}\n",[],[675,795],"9c68cbe2-471c-11f1-acac-42b51c65c3df",["D",1777832363353],[376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393],[675],"e42ba7f2-5c24-11f1-9b84-ee650bb23af1","frontend","fae4ac7a-0dff-45b8-bb64-0f2707fb3028",231,["D",1780144894156],[],[806],"f4e7ba5c-47c2-11f1-8cbf-42b51c65c3df","SearchHeader.tsx","9c689460-471c-11f1-acac-42b51c65c3df","019def11-0555-7418-a65a-4034cfde2df5",186,["D",1777903808307],"/** @jsxImportSource npm:hono@3.12.12/jsx */\nimport type { SearchChip } from \"./BrowseFilters.tsx\";\nimport type { GeoHit } from \"../lib/photon.ts\";\n\ntype Props = {\n gender?: string;\n desiredGender?: string;\n style?: string;\n minAge: number;\n maxAge: number;\n locations?: SearchChip[];\n radiusMi?: number;\n geo: GeoHit[];\n count: number;\n};\n\nconst STYLE_LABELS: Record = {\n mono: \"monogamous\",\n poly: \"polyamorous\",\n};\n\nexport default function SearchHeader(p: Props) {\n const inputLocs = p.locations ?? [];\n const showLoc = inputLocs.length > 0;\n const resolved = p.geo ?? [];\n // The labels we successfully geocoded (fuzzy: a label is \"found\" if any\n // resolved geo's label matches the chip's label).\n const resolvedLabels = new Set(resolved.map((g) => g.label));\n const unresolved = inputLocs.filter((l) => !resolvedLabels.has(l.label));\n const styleLabel = p.style && STYLE_LABELS[p.style];\n\n return (\n

\n You are {p.gender || \"any gender\"} looking for{\" \"}\n {p.desiredGender || \"any gender\"}\n {styleLabel && (\n <>\n {\" \"}who are {styleLabel}\n \n )}{\" \"}\n between the ages of {p.minAge} and {p.maxAge}\n {showLoc && resolved.length > 0 && (\n <>\n , within {p.radiusMi ? `${p.radiusMi} mi` : \"any distance\"} of{\" \"}\n {resolved.map((g) => g.label).join(\" or \")}\n \n )}\n {showLoc && resolved.length === 0 && (\n <>\n , but we couldn't find a location matching{\" \"}\n {inputLocs.map((l) => `\"${l.label}\"`).join(\", \")}\n \n )}\n . There are {p.count} profiles for you.\n {unresolved.length > 0 && resolved.length > 0 && (\n

\n (Couldn't find: {unresolved.map((l) => `\"${l.label}\"`).join(\", \")})\n

\n )}\n

\n Redo search\n {/* `?cleared=1` makes hasQuery=true on the server so user prefs aren't\n re-applied; all filters reset to hardcoded defaults. */}\n Clear filters\n

\n );\n}\n",[],[821,813],"components","eac0d6b9-3b91-4374-bb7b-29c20e92a696","ProfileTable.tsx","9c688e98-471c-11f1-acac-42b51c65c3df",["D",1788187875254],"/** @jsxImportSource npm:hono@3.12.12/jsx */\nimport ProfileRow from \"./ProfileRow.tsx\";\n\n// `mobileHide: true` hides this column on small screens via `hidden sm:table-cell`\nconst HEADERS: { label: string; mobileHide?: boolean }[] = [\n { label: \"Name\" },\n { label: \"Age\" },\n { label: \"Gender\" },\n { label: \"Seeking\" },\n { label: \"Style\", mobileHide: true },\n { label: \"Location\" },\n { label: \"Flexibility\", mobileHide: true },\n { label: \"Updated\", mobileHide: true },\n { label: \"\" },\n];\n\nexport default function ProfileTable(\n { rows, viewerProfile }: { rows: any[]; viewerProfile?: string },\n) {\n return (\n // The table can be wider than its container (many nowrap columns);\n // scrolling it horizontally keeps the container — and the section heading\n // above it — at max-w-5xl so headings wrap correctly.\n

\n \n \n \n {HEADERS.map((h) => (\n \n \n \n {rows.map((r) => )}\n \n

\n );\n}\n",[],[821,823],"15252e2a-47c9-11f1-9865-42b51c65c3df","ProfileSummary.tsx","c2db7ea6-47b6-11f1-a161-42b51c65c3df",["D",1777906439362],"/** @jsxImportSource npm:hono@3.12.12/jsx */\nimport { ageFromBirthday, httpsIfy, safeParse } from \"../lib/json_safe.ts\";\n\nfunction fmt(v: any): string {\n const x = safeParse(v);\n return Array.isArray(x) ? x.join(\", \") : (x ?? \"\");\n}\n\nconst STYLE_LABELS: Record = {\n mono: \"Monogamous\",\n poly: \"Polyamorous\",\n any: \"Any\",\n};\n\nfunction fmtStyle(v: any): string {\n const x = safeParse(v);\n const arr = Array.isArray(x) ? x : x ? [x] : [];\n return arr\n .map((s) => typeof s === \"string\" ? (STYLE_LABELS[s.toLowerCase()] ?? s) : \"\")\n .filter(Boolean)\n .join(\", \");\n}\n\nfunction fmtRadius(v: any): string {\n if (v == null || v === \"\") return \"Anywhere\";\n return `${v} mi`;\n}\n\nfunction fmtAgeRange(min: any, max: any): string {\n if (min == null && max == null) return \"\";\n return `${min ?? \"?\"}–${max ?? \"?\"}`;\n}\n\nexport default function ProfileSummary(\n { row, email }: { row: Record; email?: string },\n) {\n const profileUrl = httpsIfy(safeParse(row.Profile));\n const age = ageFromBirthday(row.Birthday);\n return (\n

Name: {fmt(row.Name)}
Birthday: \n {row.Birthday ? String(row.Birthday) : \"\"}\n {age != null && (\n (age {age})\n )}\n
Gender: {fmt(row.Gender)}
Interested in: {fmt(row.InterestedIn)}
Style: {fmtStyle(row.Style)}
Locations: {fmt(row.Location)}
Flexibility: {fmt(row.LocationFlexibility)}
Looking for ages: {fmtAgeRange(row.LookingForAgeMin, row.LookingForAgeMax)}
Search radius: {fmtRadius(row.LookingForRadiusMi)}
Doc: \n \n {profileUrl}\n \n
Email: {email}

\n );\n}\n",[],[821,830],"bf426cd0-47ef-11f1-954b-42b51c65c3df","ProfileRow.tsx","9c68833a-471c-11f1-acac-42b51c65c3df",214,["D",1777923045562],"/** @jsxImportSource npm:hono@3.12.12/jsx */\nimport { ageFromBirthday, httpsIfy, safeParse } from \"../lib/json_safe.ts\";\n\nconst linkClass = \"text-sky-600 hover:text-sky-500\";\nconst cellClass = \"p-1 sm:p-2\";\nconst cellNowrap = \"p-1 sm:p-2 whitespace-nowrap\";\n\nfunction joinList(v: any): string {\n const x = safeParse(v);\n return Array.isArray(x) ? x.join(\", \") : (x ?? \"\");\n}\n\nfunction formatLastUpdated(v: any): string {\n const x = safeParse(v);\n if (!x) return \"\";\n const d = new Date(x);\n if (Number.isNaN(d.getTime())) return \"\";\n return d.toLocaleDateString(\"en-US\", { year: \"numeric\", month: \"short\", day: \"numeric\" });\n}\n\nfunction LocationCell({ value }: { value: any }) {\n const x = safeParse(value);\n const list = Array.isArray(x) ? x : x ? [x] : [];\n if (list.length === 0) return ;\n const first = list[0];\n const rest = list.length - 1;\n return (\n \n {first}\n {rest > 0 && +{rest}}\n \n );\n}\n\nexport default function ProfileRow(\n { row, viewerProfile }: { row: Record; viewerProfile?: string },\n) {\n const name = safeParse(row.Name);\n const profile = safeParse(row.Profile);\n const claimed = !!row.UserEmail;\n const isOwnRow = !!viewerProfile && viewerProfile === profile;\n const age = ageFromBirthday(row.Birthday);\n return (\n \n \n {name}\n \n {age ?? \"\"}\n {joinList(row.Gender)}\n {joinList(row.InterestedIn)}\n {joinList(row.Style)}\n \n {safeParse(row.LocationFlexibility) ?? \"\"}\n {formatLastUpdated(row.LastUpdated)}\n \n

\n {claimed\n ? (\n \n Contact\n \n )\n : (\n \n unclaimed\n \n )}\n {!isOwnRow && (\n \n Flag\n \n )}\n

\n \n \n );\n}\n",[],[821,837],"7eddf908-47ee-11f1-8c07-42b51c65c3df","JoinForm.tsx","9c685afe-471c-11f1-acac-42b51c65c3df",199,["D",1777922508125],"/** @jsxImportSource npm:hono@3.12.12/jsx */\n\nconst Link = ({ href, children }: { href: string; children: any }) => (\n {children}\n);\n\nconst inputClass =\n \"shadow appearance-none border rounded w-full py-2 px-3 text-gray-700 leading-tight focus:outline-none focus:shadow-outline\";\n\nconst selectClass =\n \"shadow border rounded w-full py-2 px-3 text-gray-700 bg-white focus:outline-none focus:shadow-outline\";\n\nconst numClass =\n \"shadow appearance-none border rounded w-20 py-2 px-3 text-gray-700 leading-tight focus:outline-none focus:shadow-outline\";\n\nconst RADII = [\n { v: \"10\", label: \"10 mi\" },\n { v: \"25\", label: \"25 mi\" },\n { v: \"50\", label: \"50 mi\" },\n { v: \"100\", label: \"100 mi\" },\n { v: \"\", label: \"Anywhere\" },\n];\n\nexport type JoinChip = { label: string; lat?: number | null; lon?: number | null };\n\nexport type JoinDefaults = {\n Name?: string;\n Profile?: string;\n Birthday?: string;\n Gender?: string[];\n InterestedIn?: string[];\n Style?: string;\n LocationFlexibility?: string;\n Locations?: JoinChip[]; // full chip data; rendered as hidden inputs and rehydrated by the web component\n LookingForAgeMin?: number;\n LookingForAgeMax?: number;\n LookingForRadiusMi?: number; // undefined = \"Anywhere\"\n};\n\nfunction CheckboxGroup({ name, values, checked }: { name: string; values: string[]; checked?: string[] }) {\n const set = new Set(checked ?? []);\n return (\n <>\n {values.map((v) => (\n <>\n \n {v}\n \n ))}\n \n );\n}\n\nexport default function JoinForm({\n error,\n defaults,\n title = \"Submit Your Date Me Doc\",\n submitLabel = \"Submit\",\n}: {\n // string for plain messages, or JSX so callers can embed inline links/buttons.\n error?: string | any;\n defaults?: JoinDefaults;\n title?: string;\n submitLabel?: string;\n}) {\n const d = defaults ?? {};\n const style = d.Style ?? \"mono\";\n const flex = d.LocationFlexibility ?? \"Flexible\";\n const chips = d.Locations ?? [];\n const ageMin = d.LookingForAgeMin ?? 18;\n const ageMax = d.LookingForAgeMax ?? 70;\n // Distinguish \"explicitly Anywhere\" (saved as null) from \"never set\" (undefined).\n // For new users (undefined), default to 25mi. For users who picked Anywhere\n // before, the row will have Anywhere (LookingForRadiusMi=null → undefined here);\n // we can't distinguish, so undefined → 25 default. Acceptable since the user\n // can re-pick Anywhere.\n const radiusStr = d.LookingForRadiusMi != null ? String(d.LookingForRadiusMi) : \"25\";\n return (\n

{title}

\n {error && (\n

\n {error}\n

\n )}\n\n

About you

\n\n

\n \n Name*\n \n \n

\n\n

\n \n Profile URL*\n \n

\n If you don't have a Date Me Doc yet, create one in Notion or{\" \"}\n Google Docs, and then copy its public link here.\n

\n \n

\n\n

\n \n Birthday*\n \n \n

\n\n

\n Your Gender\n \n

\n\n

\n Locations\n

\n Type a city or region and pick from the dropdown. Add as many as you like.\n

\n {/* @ts-ignore — custom element */}\n \n {chips.map((c) => (\n \n ))}\n {/* @ts-ignore */}\n \n

\n\n

\n Location Flexibility\n \n

\n\n

\n Relationship Style\n \n

\n\n

Who you're looking for

\n We'll use this to pre-fill your search filters when you browse the directory.\n

\n\n

\n Interested In\n \n

\n\n

\n Ages\n \n –\n \n

\n\n

\n \n Search radius\n \n \n

\n\n

\n \n

\n );\n}\n",[],[821,845],"8592074e-47ee-11f1-bc53-42b51c65c3df","DuplicateUrlError.tsx","85920834-47ee-11f1-bc53-42b51c65c3df",["D",1777922519373],"/** @jsxImportSource npm:hono@3.12.12/jsx */\n// Shared error UI shown when a submitted Profile URL is already in the\n// directory. Three cases:\n// - claimed by current user → tell them to edit instead\n// - claimed by another account → suggest signing out + back in\n// - unclaimed → offer the /claim flow with the URL pre-filled\n//\n// Used from both /join (creating a new profile) and /me/edit (changing the\n// URL on an existing profile to one that's already taken).\n\nconst linkClass = \"text-blue-600 hover:text-blue-800 underline\";\n\nexport default function DuplicateUrlError({\n url,\n ownerEmail,\n currentEmail,\n}: {\n url: string;\n ownerEmail: string | null; // null = unclaimed\n currentEmail: string;\n}) {\n if (ownerEmail && ownerEmail.toLowerCase() === currentEmail.toLowerCase()) {\n return (\n \n You've already submitted {url}. Use{\" \"}\n Edit profile to update it.\n \n );\n }\n\n if (ownerEmail) {\n return (\n \n There's already a profile with the URL {url}{\" \"}\n in the directory. It belongs to a different account — maybe{\" \"}\n {\" \"}\n and log back in to your existing account?\n \n );\n }\n\n return (\n \n An existing profile with the URL {url}{\" \"}\n already exists. Want to{\" \"}\n \n claim it\n \n ?\n \n );\n}\n",[],[821,853],"b2bf6f2f-b7eb-4c50-8b1e-5e93069defa2","BrowseFilters.tsx","c2db6236-47b6-11f1-a161-42b51c65c3df",["D",1788187875254],"/** @jsxImportSource npm:hono@3.12.12/jsx */\n\nconst RADII = [\n { v: \"10\", label: \"10 mi\" },\n { v: \"25\", label: \"25 mi\" },\n { v: \"50\", label: \"50 mi\" },\n { v: \"100\", label: \"100 mi\" },\n { v: \"\", label: \"Anywhere\" },\n];\n\nexport type SearchChip = { label: string; lat?: number | null; lon?: number | null };\n\ntype Props = {\n gender?: string;\n desiredGender?: string;\n style?: string;\n minAge: number;\n maxAge: number;\n locations?: SearchChip[];\n radiusMi?: number;\n};\n\nexport default function BrowseFilters(p: Props) {\n const chips = p.locations ?? [];\n return (\n \n \n I'm\n \n \n \n looking for\n \n \n \n style\n \n \n \n ages\n \n –\n \n \n \n near\n {/* @ts-ignore — custom element */}\n \n {chips.map((c) => (\n \n ))}\n {/* @ts-ignore */}\n \n \n \n within\n \n \n \n \n );\n}\n",[],[821,860],"9c68c6b0-471c-11f1-acac-42b51c65c3df",["D",1777832363353],[367,368,369,370,371,372,373],[821],["D",1738958108106],["D",1789687835965],{"_11":12,"_313":89},{"_11":12,"_309":-5,"_88":89,"_30":87,"_310":311,"_312":24},{"_58":300,"_13":16,"_52":55,"_301":261,"_302":-5,"_303":-5,"_304":-5,"_305":-5,"_306":-5,"_307":14,"_308":12},"ctx",{"_71":-5,"_332":908,"_909":910,"_911":912,"_913":24,"_914":24,"_915":24,"_916":273,"_917":-5,"_918":-7,"_919":-7,"_920":26,"_921":24,"_922":24,"_923":-5,"_924":24,"_925":24,"_926":24,"_927":-5},"ENV",{"_879":880,"_881":882,"_883":16,"_884":885,"_886":887,"_888":889,"_890":891,"_892":893,"_894":895,"_896":897,"_898":899,"_900":901,"_902":903,"_904":905,"_906":907},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","71c1b20804b3232a7e513be260cfffc1932a9e97","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · join