User administration

\n {error &&

{error}

}\n {users === null ?

Loading…

: (\n \n \n \n \n \n \n \n \n \n \n \n \n {users.map((u) => (\n \n \n \n \n \n \n \n \n ))}\n \n

Name	Email	Role	Created	Last login	Actions
{u.first_name} {u.last_name}{u.id === me.id ? \" (you)\" : \"\"}	{u.email}{!u.active && (inactive)}	\n act(() =>\n fetch(`/api/users/${u.id}/role`, { method: \"PUT\", headers: auth, body: JSON.stringify({ role: e.target.value }) }),\n )}\n >\n {ROLES.map((r) => )}\n \n	{u.created_at?.slice(0, 10)}	{u.last_login?.slice(0, 16).replace(\"T\", \" \") \|\| \"never\"}	\n {\n const pw = prompt(`New password for ${u.email} (min 12 chars, upper+lower+special):`);\n if (pw) act(() => fetch(`/api/users/${u.id}/password`, { method: \"PUT\", headers: auth, body: JSON.stringify({ password: pw }) }));\n }}\n >\n set password\n \n act(() =>\n fetch(`/api/users/${u.id}/active`, { method: \"PUT\", headers: auth, body: JSON.stringify({ active: !u.active }) }),\n )}\n >\n {u.active ? \"deactivate\" : \"reactivate\"}\n \n

\n )}\n\n

Add user

\n setEmail(e.target.value)} />\n setFirst(e.target.value)} />\n setLast(e.target.value)} />\n \n setPassword(e.target.value)} />\n {\n const ok = await act(() => fetch(\"/api/users\", {\n method: \"POST\",\n headers: auth,\n body: JSON.stringify({ email, first_name: first, last_name: last, role, password }),\n }));\n if (ok) {\n setEmail(\"\"); setFirst(\"\"); setLast(\"\"); setPassword(\"\");\n }\n }}\n >\n Create user\n \n

\n Passwords must be at least 12 characters with upper & lower case letters and a special character.\n

\n );\n}\n","label",[178,179,65],"frontend","components","pulls","branches",1,"forks","envVars",{"_188":182,"_190":26},"connections",{"_188":26,"_189":26},"count","unfilledCount","emptyCount",{"_32":376,"_13":335,"_63":328,"_42":-5,"_34":35,"_171":236,"_172":89,"_36":377,"_38":26,"_66":318,"_174":-5,"_68":24,"_176":-5,"_220":378,"_17":379},{"_32":368,"_13":369,"_63":370,"_42":328,"_34":35,"_171":371,"_172":89,"_36":372,"_38":26,"_66":67,"_174":373,"_68":24,"_176":-5,"_220":374,"_17":375},{"_32":359,"_13":360,"_63":361,"_42":328,"_34":35,"_171":362,"_172":89,"_36":363,"_38":270,"_66":364,"_174":365,"_68":24,"_176":-5,"_220":366,"_17":367},{"_32":351,"_13":352,"_63":353,"_42":328,"_34":35,"_171":354,"_172":89,"_36":355,"_38":234,"_66":67,"_174":356,"_68":24,"_176":-5,"_220":357,"_17":358},{"_32":343,"_13":344,"_63":345,"_42":328,"_34":35,"_171":346,"_172":89,"_36":347,"_38":236,"_66":67,"_174":348,"_68":24,"_176":-5,"_220":349,"_17":350},{"_32":336,"_13":337,"_63":338,"_42":328,"_34":35,"_171":236,"_172":89,"_36":339,"_38":26,"_66":67,"_174":340,"_68":24,"_176":-5,"_220":341,"_17":342},{"_32":325,"_13":326,"_63":327,"_42":328,"_34":35,"_171":329,"_172":89,"_36":330,"_38":331,"_66":67,"_174":332,"_68":24,"_176":-5,"_220":333,"_17":334},{"_32":321,"_13":178,"_63":251,"_42":-5,"_34":35,"_171":182,"_172":89,"_36":322,"_38":26,"_66":318,"_174":-5,"_68":24,"_176":-5,"_220":323,"_17":324},{"_32":316,"_13":179,"_63":170,"_42":251,"_34":35,"_171":182,"_172":89,"_36":317,"_38":26,"_66":318,"_174":-5,"_68":24,"_176":-5,"_220":319,"_17":320},{"_32":169,"_13":65,"_63":64,"_42":170,"_34":35,"_171":39,"_172":89,"_36":313,"_38":26,"_66":67,"_174":175,"_68":24,"_176":-5,"_220":314,"_17":315},{"_32":305,"_13":306,"_63":307,"_42":170,"_34":35,"_171":116,"_172":89,"_36":308,"_38":309,"_66":67,"_174":310,"_68":24,"_176":-5,"_220":311,"_17":312},{"_32":297,"_13":298,"_63":299,"_42":170,"_34":35,"_171":300,"_172":89,"_36":301,"_38":236,"_66":67,"_174":302,"_68":24,"_176":-5,"_220":303,"_17":304},{"_32":289,"_13":290,"_63":291,"_42":170,"_34":35,"_171":292,"_172":89,"_36":293,"_38":270,"_66":67,"_174":294,"_68":24,"_176":-5,"_220":295,"_17":296},{"_32":281,"_13":282,"_63":283,"_42":170,"_34":35,"_171":284,"_172":89,"_36":285,"_38":26,"_66":67,"_174":286,"_68":24,"_176":-5,"_220":287,"_17":288},{"_32":274,"_13":275,"_63":276,"_42":251,"_34":35,"_171":182,"_172":89,"_36":277,"_38":26,"_66":21,"_174":278,"_68":24,"_176":-5,"_220":279,"_17":280},{"_32":265,"_13":266,"_63":267,"_42":251,"_34":35,"_171":268,"_172":89,"_36":269,"_38":270,"_66":21,"_174":271,"_68":24,"_176":-5,"_220":272,"_17":273},{"_32":258,"_13":259,"_63":260,"_42":251,"_34":35,"_171":182,"_172":89,"_36":261,"_38":26,"_66":67,"_174":262,"_68":24,"_176":-5,"_220":263,"_17":264},{"_32":248,"_13":249,"_63":250,"_42":251,"_34":35,"_171":252,"_172":89,"_36":253,"_38":254,"_66":67,"_174":255,"_68":24,"_176":-5,"_220":256,"_17":257},{"_32":240,"_13":241,"_63":242,"_42":-5,"_34":35,"_171":243,"_172":89,"_36":244,"_38":182,"_66":21,"_174":245,"_68":24,"_176":-5,"_220":246,"_17":247},{"_32":231,"_13":232,"_63":233,"_42":-5,"_34":35,"_171":234,"_172":89,"_36":235,"_38":236,"_66":21,"_174":237,"_68":24,"_176":-5,"_220":238,"_17":239},{"_32":223,"_13":224,"_63":225,"_42":-5,"_34":35,"_171":226,"_172":89,"_36":227,"_38":182,"_66":21,"_174":228,"_68":24,"_176":-5,"_220":229,"_17":230},{"_32":213,"_13":214,"_63":87,"_42":-5,"_34":35,"_171":215,"_172":89,"_36":216,"_38":217,"_66":218,"_174":219,"_68":24,"_176":14,"_220":221,"_17":222},"ea574d46-b2d0-428c-b431-07b9578d0aee","index.ts",127,["D",1789318317369],25,"http","import { parseVal, serveFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { Hono } from \"npm:hono\";\nimport {\n createListing,\n createResetToken,\n createSession,\n deleteListing,\n deleteSession,\n ensureTableAndSeed,\n getListing,\n getUserByEmail,\n getSessionUser,\n listListings,\n listUsers,\n ROLES,\n consumeResetToken,\n createUser,\n setUserActive,\n stampLogin,\n stripStaffFields,\n updateListing,\n updateUserPassword,\n updateUserRole,\n validateListingInput,\n recordHit,\n getHitStats,\n type Role,\n type User,\n} from \"./backend/db.ts\";\nimport {\n hashPassword,\n isEmail,\n newToken,\n normalizeEmail,\n requireRole,\n validatePasswordStrength,\n verifyPassword,\n} from \"./backend/auth.ts\";\nimport { extendedChecks, fetchPageText } from \"./backend/verify.ts\";\nimport { discoverByArea, filterNew } from \"./backend/discover.ts\";\n\nawait ensureTableAndSeed();\n\nconst app = new Hono();\n\napp.get(\"/\", () => serveFile(\"/frontend/index.html\"));\napp.get(\"/frontend/**/*\", (c) => serveFile(c.req.path));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// ---------- Listings (public read; staff-only fields stripped for non-staff) ----------\n\napp.get(\"/api/me\", async (c) => {\n const user = await getCurrent(c);\n return c.json({ user });\n});\n\napp.get(\"/api/listings\", async (c) => {\n const user = await getCurrent(c);\n const all = await listListings();\n let visible: any[];\n if (user) {\n // Staff see everything, including flagged listings and staff-only fields\n visible = all;\n } else {\n // Public: hide any listing flagged as unsuitable, and hide Private Landlord\n // entries (staff-only), then strip staff-only fields\n visible = all\n .filter((l) => !String(l.unsuitable_notes ?? \"\").trim())\n .filter((l) => l.type !== \"Private Landlord\")\n .map(stripStaffFields);\n }\n // Track a directory view (public vs staff)\n try { await recordHit(!!user); } catch { /* never block the page on tracking */ }\n return c.json(visible);\n});\n\n// Site activity report (any signed-in staff)\napp.get(\"/api/stats\", requireRole(\"viewer\"), async (c) => c.json(await getHitStats()));\n\n// CSV export (opens in Excel)\napp.get(\"/api/listings/export\", requireRole(\"viewer\"), async (c) => {\n const rows = await listListings();\n const headers = [\"id\", \"name\", \"type\", \"location\", \"phone\", \"contact_name\", \"website\", \"notes\",\n \"staff_notes\", \"unsuitable_notes\", \"date_validated\", \"validated_by\",\n \"created_at\", \"updated_at\"];\n const esc = (v: string) => `\"${String(v ?? \"\").replace(/\"/g, '\"\"')}\"`;\n const csv = [headers.join(\",\"), ...rows.map((r) => headers.map((h) => esc((r as any)[h])).join(\",\"))].join(\"\\r\\n\");\n return new Response(\"\\uFEFF\" + csv, {\n headers: {\n \"content-type\": \"text/csv; charset=utf-8\",\n \"content-disposition\": `attachment; filename=\"landlord-directory-${new Date().toISOString().slice(0, 10)}.csv\"`,\n },\n });\n});\n\n// ---------- Auth ----------\n\nasync function getCurrent(c: any): Promise {\n const auth = c.req.header(\"authorization\") ?? \"\";\n const token = auth.startsWith(\"Bearer \") ? auth.slice(7) : \"\";\n if (!token) return null;\n return await getSessionUser(token);\n}\n\napp.post(\"/api/login\", async (c) => {\n const { email, password } = await c.req.json();\n const user = await getUserByEmail(normalizeEmail(email));\n if (!user || !user.active || !verifyPassword(String(password ?? \"\"), user.password_hash)) {\n return c.json({ error: \"Invalid email or password\" }, 401);\n }\n const token = newToken();\n await createSession(token, user.id);\n await stampLogin(user.id);\n const { password_hash, ...safe } = user;\n return c.json({ token, user: safe });\n});\n\napp.post(\"/api/logout\", async (c) => {\n const auth = c.req.header(\"authorization\") ?? \"\";\n const token = auth.startsWith(\"Bearer \") ? auth.slice(7) : \"\";\n if (token) await deleteSession(token);\n return c.json({ ok: true });\n});\n\n// ---------- Password reset ----------\n\napp.post(\"/api/forgot-password\", async (c) => {\n const { email } = await c.req.json();\n const user = await getUserByEmail(normalizeEmail(email));\n if (user && user.active) {\n const token = newToken();\n await createResetToken(token, user.id);\n const origin = new URL(c.req.url).origin;\n const link = `${origin}/reset?token=${token}`;\n await import(\"https://esm.town/v/std/email/index.ts\").then((m) =>\n m.send({\n to: user.email,\n subject: \"Landlord Directory — password reset\",\n text: `Hi ${user.first_name || \"there\"},\\n\\nReset your Landlord Directory password using this link (valid 1 hour):\\n\\n${link}\\n\\nIf you didn't request this, you can ignore this email.`,\n }),\n );\n }\n // Always say ok — don't reveal whether the email exists\n return c.json({ ok: true, message: \"If that email is registered, a reset link has been sent.\" });\n});\n\napp.post(\"/api/reset-password\", async (c) => {\n const { token, password } = await c.req.json();\n const userId = await consumeResetToken(String(token ?? \"\"));\n if (!userId) return c.json({ error: \"Invalid or expired reset link\" }, 400);\n const pwError = validatePasswordStrength(String(password ?? \"\"));\n if (pwError) return c.json({ error: pwError }, 400);\n await updateUserPassword(userId, hashPassword(String(password)));\n return c.json({ ok: true });\n});\n\n// Bootstrap: create the first admin when no users exist yet\napp.get(\"/api/needs-bootstrap\", async (c) => c.json({ empty: (await listUsers()).length === 0 }));\napp.post(\"/api/bootstrap-admin\", async (c) => {\n const existing = await listUsers();\n if (existing.length > 0) return c.json({ error: \"Users already exist\" }, 400);\n const body = await c.req.json();\n const email = normalizeEmail(body.email);\n if (!isEmail(email)) return c.json({ error: \"Invalid email address\" }, 400);\n const pwError = validatePasswordStrength(String(body.password ?? \"\"));\n if (pwError) return c.json({ error: pwError }, 400);\n await createUser({\n email,\n password_hash: hashPassword(String(body.password)),\n first_name: String(body.first_name ?? \"\"),\n last_name: String(body.last_name ?? \"\"),\n role: \"admin\",\n });\n return c.json({ ok: true });\n});\n\n// ---------- User management (admin only) ----------\n\napp.get(\"/api/users\", requireRole(\"admin\"), async (c) => c.json(await listUsers()));\n\napp.post(\"/api/users\", requireRole(\"admin\"), async (c) => {\n const body = await c.req.json();\n const email = normalizeEmail(body.email);\n if (!isEmail(email)) return c.json({ error: \"Invalid email address\" }, 400);\n const pwError = validatePasswordStrength(String(body.password ?? \"\"));\n if (pwError) return c.json({ error: pwError }, 400);\n if (!(ROLES as readonly string[]).includes(body.role)) return c.json({ error: \"Invalid role\" }, 400);\n try {\n await createUser({\n email,\n password_hash: hashPassword(String(body.password)),\n first_name: String(body.first_name ?? \"\"),\n last_name: String(body.last_name ?? \"\"),\n role: body.role as Role,\n });\n } catch {\n return c.json({ error: \"A user with that email already exists\" }, 400);\n }\n return c.json({ ok: true });\n});\n\napp.put(\"/api/users/:id/role\", requireRole(\"admin\"), async (c) => {\n const id = Number(c.req.param(\"id\"));\n const { role } = await c.req.json();\n if (!(ROLES as readonly string[]).includes(role)) return c.json({ error: \"Invalid role\" }, 400);\n const me = c.get(\"user\") as User;\n if (me.id === id && role !== \"admin\") {\n return c.json({ error: \"You can't remove your own admin role\" }, 400);\n }\n await updateUserRole(id, role as Role);\n return c.json({ ok: true });\n});\n\napp.put(\"/api/users/:id/active\", requireRole(\"admin\"), async (c) => {\n const id = Number(c.req.param(\"id\"));\n const { active } = await c.req.json();\n const me = c.get(\"user\") as User;\n if (me.id === id && !active) return c.json({ error: \"You can't deactivate yourself\" }, 400);\n await setUserActive(id, Boolean(active));\n return c.json({ ok: true });\n});\n\napp.put(\"/api/users/:id/password\", requireRole(\"admin\"), async (c) => {\n const id = Number(c.req.param(\"id\"));\n const { password } = await c.req.json();\n const pwError = validatePasswordStrength(String(password ?? \"\"));\n if (pwError) return c.json({ error: pwError }, 400);\n await updateUserPassword(id, hashPassword(String(password)));\n return c.json({ ok: true });\n});\n\n// ---------- Listings CRUD (editor or admin) ----------\n\napp.post(\"/api/listings\", requireRole(\"editor\"), async (c) => {\n const input = await c.req.json();\n const err = validateListingInput(input);\n if (err) return c.json({ error: err }, 400);\n await createListing(input);\n return c.json({ ok: true });\n});\n\napp.put(\"/api/listings/:id\", requireRole(\"editor\"), async (c) => {\n const id = Number(c.req.param(\"id\"));\n const existing = await getListing(id);\n if (!existing) return c.json({ error: \"Not found\" }, 404);\n const input = await c.req.json();\n const err = validateListingInput(input);\n if (err) return c.json({ error: err }, 400);\n await updateListing(id, input);\n return c.json({ ok: true });\n});\n\n// Flag an existing entry as unsuitable (editor only) — requires a note\napp.post(\"/api/listings/:id/flag-unsuitable\", requireRole(\"editor\"), async (c) => {\n const id = Number(c.req.param(\"id\"));\n const existing = await getListing(id);\n if (!existing) return c.json({ error: \"Not found\" }, 404);\n const { note } = await c.req.json();\n if (!String(note ?? \"\").trim()) return c.json({ error: \"A note explaining the issue is required\" }, 400);\n await updateListing(id, {\n ...existing,\n unsuitable_notes: String(note),\n });\n return c.json({ ok: true });\n});\n\napp.delete(\"/api/listings/:id\", requireRole(\"editor\"), async (c) => {\n await deleteListing(Number(c.req.param(\"id\")));\n return c.json({ ok: true });\n});\n\n// ---------- Auto-verify (editor or admin) ----------\n\napp.post(\"/api/listings/:id/auto-verify\", requireRole(\"editor\"), async (c) => {\n const id = Number(c.req.param(\"id\"));\n const listing = await getListing(id);\n if (!listing) return c.json({ error: \"Not found\" }, 404);\n\n if (!listing.website) {\n return c.json({ verified: false, siteStatus: null, phoneFound: null, reason: \"no website listed\" });\n }\n\n const url = listing.website.startsWith(\"http\") ? listing.website : `https://${listing.website}`;\n const { text, status } = await fetchPageText(url);\n const today = new Date().toLocaleDateString(\"en-US\");\n\n if (text === null) {\n await updateListing(id, { ...listing, date_validated: \"\", validated_by: `Auto-check failed ${today}` });\n return c.json({ verified: false, siteStatus: status, phoneFound: null, reason: status === null ? \"website unreachable\" : `site responded ${status} (not OK)` });\n }\n\n const check = autoCheckFromText(listing, text, status);\n const ext = extendedChecks(text);\n\n const phone = !listing.phone && check.foundPhone ? check.foundPhone : listing.phone;\n\n // Note FMR/HUD references on the listing\n const fmrNote = ext.fmrReferences.length\n ? `${listing.notes ? listing.notes + \" | \" : \"\"}Site references: ${ext.fmrReferences.join(\", \")} (found ${today})`\n : listing.notes;\n\n const date_validated = check.verified ? today : \"\";\n const validated_by = check.verified ? \"auto-check\" : `Auto-check failed ${today}`;\n await updateListing(id, { ...listing, phone, notes: fmrNote, date_validated, validated_by });\n\n return c.json({\n verified: check.verified,\n siteStatus: status,\n phoneFound: check.phoneFound,\n foundPhone: check.foundPhone,\n phone,\n isRentalSite: ext.isRentalSite,\n rentalSignals: ext.rentalSignals,\n fmrReferences: ext.fmrReferences,\n reason: check.reason,\n date_validated,\n });\n});\n\nfunction autoCheckFromText(listing: any, text: string, status: number | null) {\n const digits = (s: string) => s.replace(/\\D/g, \"\");\n const phoneDigits = digits(String(listing.phone ?? \"\"));\n if (phoneDigits.length >= 7) {\n const phoneFound = digits(text).includes(phoneDigits);\n return {\n verified: phoneFound,\n phoneFound,\n foundPhone: null,\n reason: `site responded ${status}; phone ${phoneFound ? \"found\" : \"NOT found\"} on page`,\n };\n }\n const match = text.match(/(?:\\+?1[-.\\s]?)?\$?\\d{3}\$?[-.\\s]\\d{3}[-.\\s]\\d{4}/);\n return {\n verified: match !== null,\n phoneFound: match !== null,\n foundPhone: match ? match[0] : null,\n reason: match ? `site responded ${status}; phone found on page: ${match[0]}` : `site responded ${status}; no phone number found on page`,\n };\n}\n\n// ---------- AI discovery (editor or admin) ----------\n\napp.post(\"/api/discover-area\", requireRole(\"editor\"), async (c) => {\n const { area } = await c.req.json();\n if (!area || typeof area !== \"string\" || area.trim().length < 2) {\n return c.json({ error: \"Provide an area to search\" }, 400);\n }\n const existing = await listListings();\n const discovered = await discoverByArea(area.trim(), existing);\n const fresh = filterNew(discovered, existing);\n return c.json({ results: fresh, totalFound: discovered.length });\n});\n\n// Unwrap and rethrow Hono errors as the original error\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;\n","children",[],[214],"22169772-3a70-48b8-91f2-91459a02db51","STAFF-GUIDE.md","b55920e2-af82-11f1-b263-1607ee4eb77e",120,["D",1789311169624],"# The Haven — Housing Directory: Staff Guide\n\nThe Housing Directory is a website that lists rental properties, agencies, private\nlandlords, senior living, and support services in and around Charlottesville.\nIt replaces the old Excel spreadsheet.\n\n**Public site:** https://haven-housing-directory.val.run\n\nAnyone can browse and search the directory without logging in. Staff sign in to\nadd, edit, and manage listings, and to see a few extra features.\n\n---\n\n## For the public (no login needed)\n\nVisitors to the site can:\n\n- **Search** by name, phone number, contact, or notes\n- **Filter** by housing type (rental agency, private landlord, etc.)\n- **Filter** by area (Charlottesville, Albemarle, Louisa, Greene, Nelson, Fluvanna)\n- Click through to property websites\n- Download nothing — the \"Export to Excel\" button only appears for staff\n\n**Hidden records:** If a listing is flagged as \"unsuitable\" by staff (see below),\nit does **not** appear on the public site at all. Only logged-in staff can see it.\n\n---\n\n## Signing in as staff\n\n1. Click **staff sign in** at the top right of the page.\n2. Enter your email and password.\n3. Once signed in, you'll see extra buttons and staff-only information on each\n listing (staff notes, validation dates, etc.).\n\n**Forgot your password?** Click \"Forgot password?\" and enter your email. A reset\nlink will be sent to you (valid for 1 hour).\n\n**Roles:** There are three levels.\n\n| Role | Can do |\n|---|---|\n| **Viewer** | See everything, including flagged listings, and view site activity |\n| **Editor** | Everything above, plus add/edit/delete listings and flag records |\n| **Admin** | Everything above, plus create accounts and manage staff users |\n\nAsk an admin if you need a different role.\n\n---\n\n## Working with listings\n\n### Adding a listing\n\n1. Sign in and click **+ Add listing**.\n2. Fill in what you know — name, phone, website, contact, notes, and location\n (check all areas that apply, or none).\n3. Click **Save**.\n\n### Editing a listing\n\n1. Find the listing in the table and click **edit**.\n2. Make your changes and click **Save**.\n\n### Deleting a listing\n\nClick **delete** next to the listing and confirm. Deleted listings are gone for\ngood, so flagging as unsuitable (below) is usually the safer option if you just\nwant it hidden.\n\n### Flagging a listing as unsuitable\n\nIf a landlord or property should no longer be shown to the public (wrong info,\nunresponsive, inappropriate, etc.):\n\n1. Click **flag** next to the listing.\n2. Enter a note explaining why — this is required.\n3. Save.\n\nThe listing immediately disappears from the public site, but staff can still see\nit (with your note) while signed in. To un-hide a listing later, edit it and\nclear the Unsuitable notes field.\n\nYou can also flag a record by editing it directly and typing into the\n**Unsuitable notes** field.\n\n### Verifying a listing\n\nEach listing tracks when it was last verified and by whom.\n\n- Click **verify** next to a listing with a website — the system checks that the\n site is reachable and that the phone number appears on it, then stamps the\n date automatically.\n- For listings without a website, \"verify\" asks you to confirm you checked it\n manually, then stamps today's date.\n- If the check fails, it will tell you why (site down, phone not found) and offer\n to open the website so you can look yourself.\n\nAim to re-verify listings periodically so the directory stays accurate.\n\n---\n\n## Site activity report\n\nClick **📊 Site activity** (visible once signed in) to see how much the site is\nbeing used:\n\n- Views today, in the last 7 days, last 30 days, and all time\n- A day-by-day breakdown for the past month, split into **public** views vs.\n **staff** views\n\nA \"view\" is counted each time the directory page is loaded. Staff views are\ncounted separately, so you can tell general public interest apart from staff\nmaintenance visits.\n\n---\n\n## Exporting to Excel\n\nSigned-in staff can click **Export to Excel** to download the full directory\n(including staff notes and unsuitable flags) as a CSV file that opens in Excel.\nThis includes hidden/flagged records.\n\n---\n\n## Frequently asked questions\n\n**A listing I flagged still shows up for me — is that right?**\nYes. Flagged listings are only hidden from the public. Sign out (or check in a\nprivate/incognito window) to confirm what the public sees.\n\n**Can the public see staff notes or unsuitable notes?**\nNo. Those fields are only sent to logged-in staff, and they never appear in\nsearch results on the public site.\n\n**I made a mistake in an edit — can it be undone?**\nContact the site administrator; past versions of listings are kept in the system\nand can be restored.\n\n---\n\n*Questions or account requests? Contact your directory administrator.*\n",[],[224],"f7550f94-d3cf-4a91-a523-4e6b6ce98e34","README.md","019f4d88-ebd3-7218-9092-1474528366c9",16,["D",1784738706111],2,"# Charlottesville Area Landlord Directory\n\nA searchable directory of rental properties, apartment complexes, and property\nmanagers, maintained by [The Haven](https://thehaven.org) to help clients find\nhousing. Replaces a manually-updated Excel spreadsheet.\n\n- **Browse**: anyone with the link can search, filter by area, and print.\n- **Edit**: staff sign in with a shared password (`ADMIN_PASSWORD` env var) to\n add, edit, delete, or mark a listing's contact info as verified today.\n\nData was imported from the \"Landlord Directory FY25\" spreadsheet in July 2026\nand lives in this val's SQLite database (`backend/db.ts`).\n\n## Automated Discovery\n\nA weekly cron job (`backend/cron.ts`, runs Mondays 9 AM UTC) uses OpenAI's web\nsearch to find new rental properties and property management companies in the\nCharlottesville area that aren't already in the directory. New finds are:\n\n1. Inserted into the database automatically.\n2. Tagged with \"AI-discovered — verify contact info\" in the notes field.\n3. Left for staff to review and verify contact details.\n\nThe discovery logic lives in `backend/discover.ts` and uses\n[`std/openai`](https://www.val.town/v/std/openai) with the Responses API,\nthe `web_search` tool, and structured outputs.\n",[],[232],"f616a46f-a562-4800-a934-50384a01d12c","AGENTS.md","d017a62a-85ec-11f1-ab6d-1607ee4eb77e",28,["D",1784739454441],"# Haven Landlord Directory — AGENTS.md\n\nSearchable rental property directory for The Haven (Charlottesville, VA nonprofit).\nReplaces a manually-maintained Excel spreadsheet. Staff can browse, search, and\nedit listings via a password-protected web UI.\n\n## File Map\n\n```\nindex.ts # HTTP entrypoint — Hono router, serves frontend + API\nbackend/\n db.ts # SQLite schema, CRUD functions, seed-on-first-run\n seed.ts # Initial 93 listings imported from FY25 spreadsheet\n discover.ts # AI discovery logic — OpenAI web_search + structured outputs\n cron.ts # Weekly interval — discovers new listings, inserts into DB\nfrontend/\n index.html # Static HTML shell (loads React bundle)\n index.tsx # React entrypoint\n types.ts # Listing / ListingInput TypeScript interfaces\n favicon.svg\n components/\n App.tsx # Root component — search, filter, auth state\n ListingsTable.tsx # Table view with search, area filter & sortable columns\n ListingForm.tsx # Add/edit form (staff only)\n```\n\n## Architecture\n\n- **Backend**: Hono router in `index.ts` — serves static frontend files and a\n REST API (`/api/listings` CRUD). Staff auth via `x-admin-password` header\n checked against `ADMIN_PASSWORD` env var.\n- **Database**: Project-scoped SQLite (`listings_v1` table) accessed via\n `std/sqlite/main.ts`. Seeded from `backend/seed.ts` on first run.\n- **Frontend**: React SPA bundled in-browser, components in `frontend/components/`.\n- **Automated discovery**: Weekly cron (`backend/cron.ts`) uses `std/openai`\n Responses API with `web_search` tool and structured outputs to find new\n rental properties. New entries are tagged \"AI-discovered — verify contact info\".\n\n## Env Vars\n\n- `ADMIN_PASSWORD` — shared password for staff edit access\n",[],[241],"86642d09-889a-4896-8a14-a1544267f151","types.ts","d290824a-7c97-11f1-a7f6-1607ee4eb77e","019f4d88-ebd3-7218-9092-104a308a0db8",100,["D",1789303980812],5,"export interface Listing {\n id: number;\n location: string; // comma-separated list of AREAS, may be blank\n name: string;\n website: string;\n type: string;\n phone: string;\n contact_name: string;\n notes: string;\n // staff-only fields (omitted in API responses for non-logged-in users)\n staff_notes: string;\n unsuitable_notes: string;\n date_validated: string;\n validated_by: string;\n created_at: string;\n updated_at: string;\n}\n\nexport type ListingInput = Omit;\n\nexport const emptyListing: ListingInput = {\n location: \"\",\n name: \"\",\n website: \"\",\n type: \"Rental Property\",\n phone: \"\",\n contact_name: \"\",\n notes: \"\",\n staff_notes: \"\",\n unsuitable_notes: \"\",\n date_validated: \"\",\n validated_by: \"\",\n};\n\nexport const LISTING_TYPES = [\n \"Rental Agency\",\n \"Senior Living\",\n \"Rental Property\",\n \"Private Landlord\",\n \"Support Services\",\n];\n// Backwards-friendly alias\nexport const HOUSING_TYPES = LISTING_TYPES;\n\nexport const AREAS = [\n \"Charlottesville\",\n \"Albemarle\",\n \"Louisa\",\n \"Greene\",\n \"Nelson\",\n \"Fluvanna\",\n \"Multiple\",\n];\n\n/** Split a listing's comma-separated location into an array of area names. */\nexport function locationList(location: string): string[] {\n return String(location ?? \"\").split(\",\").map((s) => s.trim()).filter(Boolean);\n}\n\nexport interface StaffUser {\n id: number;\n email: string;\n first_name: string;\n last_name: string;\n role: \"admin\" | \"editor\" | \"viewer\";\n active: number;\n created_at: string;\n last_login: string;\n}\n\nexport interface DiscoveredListing {\n name: string;\n location: string;\n phone: string;\n website: string;\n notes: string;\n}",[],[178,249],"e59f18ed-e3f3-4ac7-8c1f-26dc148fb4f8","index.tsx","019f4d88-ebd3-7218-9092-0cf3304a67d4",["D",1783712246617],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { createRoot } from \"https://esm.sh/react-dom@18.2.0/client\";\nimport { App } from \"./components/App.tsx\";\n\nconst root = document.getElementById(\"root\");\nif (!root) {\n throw new Error(\"No root element found\");\n}\n\ncreateRoot(root).render();",[],[178,259],"a89bf690-f8b5-4e27-a4bc-47d96cfd2917","index.html","019f4d88-ebd3-7218-9092-0bf6e7622fee",117,["D",1789310905659],3,"\n\n \n \n \n The Haven — Housing Directory\n \n \n \n \n

\n \n \n \n\n",[],[178,266],"dcdea6f9-7810-432f-9ba2-4cc857d89a29","favicon.svg","019f4d88-ebd3-7218-9092-072314b1de7e",["D",1783712246617],"\n",[],[178,275],"e713b025-42df-4644-bf15-106a09f04cb3","StatsPanel.tsx","c5575790-af80-11f1-84d6-1607ee4eb77e",111,["D",1789310302348],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { useEffect, useState } from \"https://esm.sh/react@18.2.0\";\n\ninterface HitStats {\n total: number;\n totalPublic: number;\n totalStaff: number;\n last7: number;\n last30: number;\n today: number;\n byDay: { day: string; total: number; public: number; staff: number }[];\n}\n\nexport function StatsPanel({ token, onClose }: { token: string; onClose: () => void }) {\n const [stats, setStats] = useState(null);\n const [error, setError] = useState(\"\");\n\n useEffect(() => {\n fetch(\"/api/stats\", { headers: { authorization: `Bearer ${token}` } })\n .then(async (r) => {\n if (!r.ok) throw new Error(`Failed to load (${r.status})`);\n setStats(await r.json());\n })\n .catch((e) => setError(e.message));\n }, [token]);\n\n return (\n

Site activity

\n \n

\n\n {error &&

{error}

}\n {!stats && !error &&

Loading…

}\n\n {stats && (\n <>\n

\n \n \n \n \n \n

\n\n

\n \n \n \n \n \n \n \n \n \n \n {stats.byDay.map((d) => (\n \n \n \n \n \n \n ))}\n {stats.byDay.length === 0 && (\n \n )}\n \n

Day	Total views	Public	Staff
{d.day}	{d.total}	{d.public}	{d.staff}
No views recorded yet.

\n A \"view\" is counted each time the directory is loaded. Staff views are counted separately when signed in.\n

\n \n )}\n

\n );\n}\n\nfunction Stat({ label, value }: { label: string; value: number }) {\n return (\n

{value}

{label}

\n );\n}\n",[],[178,179,282],"ca8ee66c-07d8-42ed-8f35-ac002716acac","ListingsTable.tsx","ded182a2-7c97-11f1-8c37-1607ee4eb77e",87,["D",1789301792441],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport type { Listing } from \"../types.ts\";\nimport { locationList } from \"../types.ts\";\n\ntype SortKey = \"created_at\" | \"name\" | \"type\" | \"location\";\n\nfunction telHref(phone: string): string | null {\n const match = phone.match(/\$?\\d{3}\$?[-.\\s]?\\d{3}[-.\\s]?\\d{4}/);\n return match ? `tel:${match[0].replace(/\\D/g, \"\")}` : null;\n}\n\nfunction WebsiteCell({ listing }: { listing: Listing }) {\n if (listing.website) {\n const label = new URL(listing.website.startsWith(\"http\") ? listing.website : `https://${listing.website}`).hostname;\n return (\n \n {label}\n \n );\n }\n return null;\n}\n\nfunction SortHeader({\n label,\n sortKey,\n activeKey,\n sortDir,\n onSort,\n}: {\n label: string;\n sortKey: SortKey;\n activeKey: SortKey;\n sortDir: \"asc\" | \"desc\";\n onSort: (key: SortKey) => void;\n}) {\n const active = sortKey === activeKey;\n return (\n onSort(activeKey)}\n >\n {label}\n {active && {sortDir === \"asc\" ? \"↑\" : \"↓\"}}\n \n );\n}\n\ninterface Props {\n listings: Listing[];\n canEdit: boolean;\n isStaff: boolean;\n sortKey: SortKey;\n sortDir: \"asc\" | \"desc\";\n onSort: (key: SortKey) => void;\n onEdit?: (l: Listing) => void;\n onDelete?: (l: Listing) => void;\n onMarkVerified?: (l: Listing) => void;\n onFlagUnsuitable?: (l: Listing) => void;\n}\n\nexport function ListingsTable({\n listings,\n canEdit,\n isStaff,\n sortKey,\n sortDir,\n onSort,\n onEdit,\n onDelete,\n onMarkVerified,\n onFlagUnsuitable,\n}: Props) {\n return (\n \n \n \n \n \n \n \n \n \n \n {isStaff && }\n \n {canEdit && }\n \n \n \n {listings.map((l) => {\n const staffBits = [\n l.staff_notes && `Staff notes: ${l.staff_notes}`,\n l.unsuitable_notes && `⚠ Unsuitable: ${l.unsuitable_notes}`,\n (l.date_validated || l.validated_by) &&\n `Validated ${l.date_validated || \"?\"}${l.validated_by ? ` by ${l.validated_by}` : \"\"}`,\n ].filter(Boolean) as string[];\n return (\n \n \n \n \n \n \n \n \n {isStaff && (\n \n )}\n \n {canEdit && (\n \n )}\n \n );\n })}\n \n

Phone	Contact name	Website	Notes	Staff-only info	Actions
\n {l.name \|\| (no name)}\n	{l.type}	{locationList(l.location).join(\", \")}	\n {telHref(l.phone)\n ? {l.phone}\n : l.phone}\n	{l.contact_name}	\n \n	{l.notes}	\n {staffBits.length\n ? staffBits.map((b, i) => {b} )\n : —}\n	{l.created_at}	\n {onMarkVerified && (\n \n )}\n {onEdit && (\n \n )}\n {onFlagUnsuitable && (\n \n )}\n {onDelete && (\n \n )}\n

\n );\n}",[],[178,179,290],"9bffb1d0-e26b-4d27-bdde-215d4a7da5b9","ListingForm.tsx","e7ba4d72-7c97-11f1-9fef-1607ee4eb77e",86,["D",1789301635801],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { useState } from \"https://esm.sh/react@18.2.0\";\nimport { AREAS, LISTING_TYPES, locationList, type ListingInput } from \"../types.ts\";\n\ninterface Props {\n initial: ListingInput;\n title: string;\n onSave: (input: ListingInput) => Promise;\n onCancel: () => void;\n}\n\nconst inputClass = \"border border-gray-300 rounded px-2 py-1 w-full\";\n\nexport function ListingForm({ initial, title, onSave, onCancel }: Props) {\n const [form, setForm] = useState(initial);\n const [saving, setSaving] = useState(false);\n const [error, setError] = useState(\"\");\n\n const field = (label: string, key: keyof ListingInput, placeholder = \"\", type = \"text\") => (\n \n {label}\n setForm({ ...form, [key]: e.target.value })}\n />\n \n );\n\n const textarea = (label: string, key: keyof ListingInput, staffOnly = false) => (\n \n \n {label}{staffOnly && \" (staff only)\"}\n \n setForm({ ...form, [key]: e.target.value })}\n />\n \n );\n\n const selectedAreas = locationList(form.location);\n\n const toggleArea = (a: string) => {\n const next = selectedAreas.includes(a)\n ? selectedAreas.filter((x) => x !== a)\n : [...selectedAreas, a];\n setForm({ ...form, location: next.join(\", \") });\n };\n\n return (\n {\n e.preventDefault();\n setError(\"\");\n setSaving(true);\n try {\n await onSave(form);\n } finally {\n setSaving(false);\n }\n }}\n >\n

{title}

\n \n Type\n setForm({ ...form, type: e.target.value })}\n >\n \n {LISTING_TYPES.map((t) => )}\n \n \n {field(\"Name (rental, agency, or landlord)\", \"name\")}\n {field(\"Phone\", \"phone\")}\n\n {field(\"Website URL\", \"website\", \"https://…\")}\n {field(\"Contact name\", \"contact_name\")}\n\n

\n Location (choose any, or none)\n

\n {AREAS.map((a) => (\n \n toggleArea(a)}\n />\n {a}\n \n ))}\n

\n\n {textarea(\"Notes\", \"notes\")}\n\n

\n Staff-only — hidden from the public site\n

\n {textarea(\"Staff notes\", \"staff_notes\", true)}\n {textarea(\"Unsuitable notes\", \"unsuitable_notes\", true)}\n {field(\"Date validated\", \"date_validated\", \"e.g. 9/13/2026\")}\n {field(\"Validated by (staff name)\", \"validated_by\")}\n

\n {error &&

{error}

}\n

\n \n {saving ? \"Saving…\" : \"Save\"}\n \n \n

\n \n );\n}",[],[178,179,298],"a9fed38c-66d9-47eb-b622-85daf04cbd25","App.tsx","019f4d88-ebd3-7218-9091-fa024ee09187",["D",1789318325275],41,"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { useEffect, useMemo, useState } from \"https://esm.sh/react@18.2.0\";\nimport { emptyListing, AREAS, HOUSING_TYPES, locationList, type DiscoveredListing, type Listing, type ListingInput, type StaffUser } from \"../types.ts\";\nimport { ListingForm } from \"./ListingForm.tsx\";\nimport { ListingsTable } from \"./ListingsTable.tsx\";\nimport { AdminUsers } from \"./AdminUsers.tsx\";\nimport { StatsPanel } from \"./StatsPanel.tsx\";\n\nconst RANK: Record = { viewer: 1, editor: 2, admin: 3 };\n\nexport function App() {\n const [listings, setListings] = useState([]);\n const [loading, setLoading] = useState(true);\n const [query, setQuery] = useState(\"\");\n const [area, setArea] = useState(\"\");\n const [housing, setHousing] = useState(\"\");\n const [sortKey, setSortKey] = useState<\"created_at\" | \"name\" | \"type\" | \"location\">(\"type\");\n const [sortDir, setSortDir] = useState<\"asc\" | \"desc\">(\"asc\");\n const [token, setToken] = useState(localStorage.getItem(\"staffToken\") ?? \"\");\n const [user, setUser] = useState(null);\n const [editing, setEditing] = useState(null);\n const [showAdmin, setShowAdmin] = useState(false);\n const [showForgot, setShowForgot] = useState(false);\n const [showSignIn, setShowSignIn] = useState(false);\n const [showStats, setShowStats] = useState(false);\n const [areaResults, setAreaResults] = useState(null);\n const [searching, setSearching] = useState(false);\n const [added, setAdded] = useState>(new Set());\n\n const staff = !!user;\n const canEdit = staff && RANK[user.role] >= RANK.editor;\n\n // Restore session\n useEffect(() => {\n if (!token) { setLoading(false); return; }\n fetch(\"/api/me\", { headers: { authorization: `Bearer ${token}` } })\n .then((r) => r.json())\n .then((d) => {\n if (d.user) setUser(d.user);\n else { localStorage.removeItem(\"staffToken\"); setToken(\"\"); }\n })\n .finally(() => setLoading(false));\n }, []);\n\n async function refresh() {\n const res = await fetch(\"/api/listings\", staff ? { headers: { authorization: `Bearer ${token}` } } : undefined);\n setListings(await res.json());\n setLoading(false);\n }\n useEffect(() => {\n refresh();\n }, [token]);\n\n const filtered = useMemo(() => {\n const q = query.trim().toLowerCase();\n const result = listings.filter((l) => {\n if (housing && l.type !== housing) return false;\n if (area && !locationList(l.location).includes(area)) return false;\n if (!q) return true;\n return [l.name, l.type, l.location, l.phone, l.contact_name, l.notes, l.website,\n l.staff_notes, l.unsuitable_notes, l.date_validated, l.validated_by]\n .join(\" \")\n .toLowerCase()\n .includes(q);\n });\n const TYPE_RANK: Record = {\n \"rental property\": 1,\n \"rental agency\": 2,\n \"support services\": 3,\n \"private landlord\": 4,\n \"senior living\": 5,\n };\n const dir = sortDir === \"asc\" ? 1 : -1;\n return result.sort((a, b) => {\n let av = (a[sortKey] || \"\").toString().toLowerCase();\n let bv = (b[sortKey] || \"\").toString().toLowerCase();\n if (sortKey === \"type\") {\n const ar = TYPE_RANK[av] ?? 99;\n const br = TYPE_RANK[bv] ?? 99;\n if (ar !== br) return (ar - br) * dir;\n // Same type group: sort alphabetically by name\n av = (a.name || \"\").toString().toLowerCase();\n bv = (b.name || \"\").toString().toLowerCase();\n }\n if (av < bv) return -1 * dir;\n if (av > bv) return 1 * dir;\n return 0;\n });\n }, [listings, query, area, housing, sortKey, sortDir]);\n\n function onSort(key: \"created_at\" | \"name\" | \"type\" | \"location\") {\n if (sortKey === key) {\n setSortDir((d) => d === \"asc\" ? \"desc\" : \"asc\");\n } else {\n setSortKey(key);\n setSortDir(key === \"created_at\" ? \"desc\" : \"asc\");\n }\n }\n\n async function exportCsv() {\n const res = await fetch(\"/api/listings/export\", { headers: { authorization: `Bearer ${token}` } });\n if (!res.ok) {\n alert(`Export failed (${res.status}). If you were signed in a while ago, sign in again.`);\n return;\n }\n const blob = await res.blob();\n const url = URL.createObjectURL(blob);\n const a = document.createElement(\"a\");\n a.href = url;\n a.download = `housing-directory-${new Date().toISOString().slice(0, 10)}.csv`;\n a.click();\n URL.revokeObjectURL(url);\n }\n\n async function signIn(email: string, password: string): Promise {\n const res = await fetch(\"/api/login\", {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify({ email, password }),\n });\n const data = await res.json();\n if (!res.ok) return data.error ?? \"Sign in failed\";\n localStorage.setItem(\"staffToken\", data.token);\n setToken(data.token);\n setUser(data.user);\n setShowForgot(false);\n return null;\n }\n\n async function signOut() {\n await fetch(\"/api/logout\", { method: \"POST\", headers: { authorization: `Bearer ${token}` } });\n localStorage.removeItem(\"staffToken\");\n setToken(\"\");\n setUser(null);\n setShowAdmin(false);\n setEditing(null);\n }\n\n async function apiWrite(method: string, path: string, body?: any) {\n const res = await fetch(path, {\n method,\n headers: { authorization: `Bearer ${token}`, \"content-type\": \"application/json\" },\n body: body ? JSON.stringify(body) : undefined,\n });\n if (!res.ok) {\n const data = await res.json().catch(() => ({}));\n alert(`Action failed: ${data.error ?? res.status}. If you were signed in a while ago, sign in again.`);\n return false;\n }\n await refresh();\n return true;\n }\n\n async function save(input: ListingInput) {\n const ok = editing === \"new\"\n ? await apiWrite(\"POST\", \"/api/listings\", input)\n : await apiWrite(\"PUT\", `/api/listings/${(editing as Listing).id}`, input);\n if (ok) setEditing(null);\n }\n\n async function remove(l: Listing) {\n if (!confirm(`Delete \"${l.name || l.phone}\"?`)) return;\n await apiWrite(\"DELETE\", `/api/listings/${l.id}`);\n }\n\n async function flagUnsuitable(l: Listing) {\n const note = prompt(`Flag \"${l.name || l.phone}\" as unsuitable.\\nExplain the issue (required, staff-only note):`);\n if (note === null) return;\n if (!note.trim()) { alert(\"A note explaining the issue is required.\"); return; }\n await apiWrite(\"POST\", `/api/listings/${l.id}/flag-unsuitable`, { note });\n }\n\n async function searchArea() {\n if (!area) return;\n setSearching(true);\n try {\n const res = await fetch(\"/api/discover-area\", {\n method: \"POST\",\n headers: { authorization: `Bearer ${token}`, \"content-type\": \"application/json\" },\n body: JSON.stringify({ area }),\n });\n if (!res.ok) {\n alert(`Area search failed (${res.status}).`);\n return;\n }\n const data = await res.json();\n setAdded(new Set());\n setAreaResults(data.results);\n if (data.results.length === 0) {\n alert(`No new listings found for ${area} — everything found is already in the directory.`);\n }\n } finally {\n setSearching(false);\n }\n }\n\n async function addDiscovered(d: DiscoveredListing) {\n const dateStr = new Date().toISOString().slice(0, 10);\n const ok = await apiWrite(\"POST\", \"/api/listings\", {\n ...emptyListing,\n location: AREAS.includes(d.location) ? d.location : area,\n name: d.name,\n phone: d.phone || \"\",\n website: d.website || \"\",\n notes: d.notes\n ? `${d.notes} — AI-discovered ${dateStr}, verify contact info`\n : `AI-discovered ${dateStr}, verify contact info`,\n });\n if (ok) setAdded((s) => new Set(s).add(d.name));\n }\n\n async function markVerified(l: Listing) {\n if (!l.website) {\n const open = confirm(\"This listing has no website, so it can't be auto-checked. Verify it manually, then press OK to stamp today's date as verified.\");\n if (open) {\n const today = new Date().toLocaleDateString(\"en-US\");\n await apiWrite(\"PUT\", `/api/listings/${l.id}`, { ...l, date_validated: today, validated_by: user?.first_name || user?.email || \"staff\" });\n }\n return;\n }\n setLoading(true);\n try {\n const res = await fetch(`/api/listings/${l.id}/auto-verify`, {\n method: \"POST\",\n headers: { authorization: `Bearer ${token}` },\n });\n if (!res.ok) {\n alert(`Auto-check failed to run (${res.status}).`);\n return;\n }\n const result = await res.json();\n let msg = result.verified\n ? `✓ Auto-check passed: ${result.reason}`\n : `✗ Auto-check failed: ${result.reason}`;\n if (result.foundPhone) msg += `\\n\\nPhone \"${result.phone}\" was added from the website.`;\n msg += result.isRentalSite\n ? \"\\n\\n✓ Site looks like a rental/property site\"\n : \"\\n\\n⚠ Site may NOT be a rental/property site\";\n if (result.fmrReferences?.length) {\n msg += `\\n\\n⚠ Site references Fair Market Rent / HUD: ${result.fmrReferences.join(\", \")} (noted on listing)`;\n }\n if (result.verified) {\n alert(msg);\n } else {\n const open = confirm(msg + \"\\n\\nVerify manually. Open the website now?\");\n if (open) window.open(l.website, \"_blank\", \"noopener\");\n }\n } finally {\n setLoading(false);\n await refresh();\n }\n }\n\n // Password reset landing (staff clicks email link → /?reset=TOKEN)\n const params = new URLSearchParams(window.location.search);\n const resetToken = params.get(\"reset\");\n\n return (\n

The Haven — Housing Directory

\n Rental properties, agencies, private landlords, transitional & assisted living — maintained by{\" \"}\n The Haven.\n

\n\n {resetToken && (\n \n )}\n\n {showForgot && (\n setShowForgot(false)} />\n )}\n\n

\n setQuery(e.target.value)}\n />\n { setHousing(e.target.value); setAreaResults(null); }}\n >\n \n {HOUSING_TYPES\n .filter((h) => staff || h !== \"Private Landlord\")\n .map((h) => )}\n \n { setArea(e.target.value); setAreaResults(null); }}\n >\n \n {AREAS.map((a) => )}\n \n {canEdit && area && (\n \n {searching ? `Searching ${area}…` : `🔍 Search ${area}`}\n \n )}\n {staff && (\n \n Export to Excel\n \n )}\n {filtered.length} of {listings.length} listings\n \n {staff\n ? (\n <>\n \n {user.first_name || user.email} ({user.role})\n \n {user.role === \"admin\" && (\n \n )}\n {canEdit && (\n \n )}\n setShowStats((v) => !v)}\n className=\"border border-gray-300 rounded px-3 py-1.5 text-sm\"\n title=\"Views of the directory, public vs staff\"\n >\n 📊 Site activity\n \n \n 📖 Staff guide\n \n \n \n )\n : (\n <>\n \n \n )}\n

\n\n {!staff && showSignIn && (\n { setShowSignIn(false); setShowForgot(true); }}\n />\n )}\n\n {!staff && showSignIn && (\n \n )}\n\n {staff && showAdmin && user.role === \"admin\" && (\n \n )}\n\n {staff && showStats && (\n setShowStats(false)} />\n )}\n\n {areaResults !== null && (\n

\n AI search results: {area}{\" \"}\n ({areaResults.length} found)\n

\n \n

\n {areaResults.length === 0 && (\n

\n No new listings found — everything in this area may already be in the directory.\n

\n )}\n {areaResults.map((d) => {\n const isAdded = added.has(d.name);\n return (\n

\n {d.name} ({d.location})\n

{d.notes || \"No description\"}

\n {d.phone &&

{d.phone}

}\n

\n {d.website && (\n \n visit site\n \n )}\n addDiscovered(d)}\n disabled={isAdded}\n className={isAdded ? \"text-gray-400\" : \"text-green-700 hover:underline\"}\n >\n {isAdded ? \"added ✓\" : \"+ add\"}\n \n

\n );\n })}\n

\n )}\n\n {editing && (\n setEditing(null)}\n />\n )}\n\n {loading ?

Loading…

: (\n \n )}\n\n \n

\n );\n}\n\nfunction SignInForm({ onSignIn, onForgot }: { onSignIn: (e: string, p: string) => Promise; onForgot: () => void }) {\n const [email, setEmail] = useState(\"\");\n const [password, setPassword] = useState(\"\");\n const [error, setError] = useState(\"\");\n return (\n {\n e.preventDefault();\n const err = await onSignIn(email, password);\n if (err) setError(err);\n }}\n >\n

Staff sign in

\n setEmail(e.target.value)} />\n setPassword(e.target.value)} />\n {error &&

{error}

}\n

\n \n \n

\n \n );\n}\n\n// Exported so App can render it in place of the sign-in link\nexport function SignInPanel({ onSignIn }: { onSignIn: (e: string, p: string) => Promise }) {\n return null;\n}\n\nfunction ForgotForm({ onClose }: { onClose: () => void }) {\n const [email, setEmail] = useState(\"\");\n const [sent, setSent] = useState(false);\n return (\n

Reset your password

\n {sent ? (\n

If that email is registered, a reset link has been sent. Check your inbox.

\n ) : (\n <>\n setEmail(e.target.value)} />\n {\n await fetch(\"/api/forgot-password\", {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify({ email }),\n });\n setSent(true);\n }}\n >\n Send reset link\n \n \n )}\n \n

\n );\n}\n\nfunction ResetForm({ token }: { token: string }) {\n const [password, setPassword] = useState(\"\");\n const [error, setError] = useState(\"\");\n const [done, setDone] = useState(false);\n return (\n

Choose a new password

At least 12 characters with upper & lower case letters and a special character.

\n {done ? (\n

Password updated — you can sign in now.

\n ) : (\n <>\n setPassword(e.target.value)} />\n {error &&

{error}

}\n {\n const res = await fetch(\"/api/reset-password\", {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify({ token, password }),\n });\n const data = await res.json();\n if (!res.ok) setError(data.error ?? \"Failed\");\n else setDone(true);\n }}\n >\n Update password\n \n \n )}\n

\n );\n}\n\nfunction BootstrapForm() {\n const [empty, setEmpty] = useState(null);\n const [email, setEmail] = useState(\"\");\n const [first, setFirst] = useState(\"\");\n const [last, setLast] = useState(\"\");\n const [password, setPassword] = useState(\"\");\n const [msg, setMsg] = useState(\"\");\n\n useEffect(() => {\n fetch(\"/api/needs-bootstrap\")\n .then((r) => r.json())\n .then((d) => setEmpty(!!d.empty))\n .catch(() => setEmpty(false));\n }, []);\n\n if (empty === null || !empty) return null;\n\n return (\n

First-time setup

\n No users exist yet. Create the first administrator account (requires a strong password: 12+ chars, upper & lower case, special character).\n

\n {msg ? (\n

{msg}

\n ) : (\n <>\n setEmail(e.target.value)} />\n

\n setFirst(e.target.value)} />\n setLast(e.target.value)} />\n

\n setPassword(e.target.value)} />\n {\n const res = await fetch(\"/api/bootstrap-admin\", {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify({ email, first_name: first, last_name: last, password }),\n });\n const data = await res.json();\n if (!res.ok) setMsg(data.error ?? \"Failed\");\n else {\n setMsg(\"Admin created — you can sign in now.\");\n setEmpty(false);\n }\n }}\n >\n Create admin\n \n {msg &&

{msg}

}\n \n )}\n

\n );\n}\n",[],[178,179,306],["D",1788625075015],[],[178,179,65],"ae887443-2e14-4b3e-9163-23d32458cece",["D",1783712246617],"directory",[200,201,202,203,204],[178,179],"e500cffe-1cb9-4041-9dd5-9f74efd2410a",["D",1783712246617],[199,205,206,207,208],[178],"8ee023df-381b-4b36-b003-192319b90de3","verify.ts","dbb2adce-a6fb-11f1-8620-1607ee4eb77e","102650c1-16df-4425-91f4-ad09aa6fdd92",56,["D",1788624351394],4,"import type { Listing } from \"./db.ts\";\n\nexport interface AutoCheckResult {\n verified: boolean; // true only if site reachable AND phone found\n siteStatus: number | null; // HTTP status, null if request failed / no site\n phoneFound: boolean | null; // null = couldn't check (no site or no phone)\n foundPhone: string | null; // phone number discovered on the page (when listing had none)\n reason: string; // human-readable summary for the UI\n}\n\nfunction digits(s: string): string {\n return s.replace(/\\D/g, \"\");\n}\n\n/** Find a US-style phone number in raw page text, formatted like 434-555-1234. */\nfunction findPhoneOnPage(text: string): string | null {\n const match = text.match(/(?:\\+?1[-.\\s]?)?\$?\\d{3}\$?[-.\\s]\\d{3}[-.\\s]\\d{4}/);\n return match ? match[0] : null;\n}\n\n/** Fetch a listing's homepage (only) and return its text, capped at ~500 KB. */\nexport async function fetchPageText(url: string): Promise<{ text: string | null; status: number | null }> {\n let res: Response;\n try {\n res = await fetch(url, {\n redirect: \"follow\",\n signal: AbortSignal.timeout(10_000),\n headers: { \"user-agent\": \"Mozilla/5.0 (compatible; HavenDirectoryCheck/1.0)\" },\n });\n } catch {\n return { text: null, status: null };\n }\n\n if (!res.ok) return { text: null, status: res.status };\n\n try {\n const reader = res.body?.getReader();\n let text = \"\";\n if (reader) {\n const decoder = new TextDecoder();\n while (text.length < 500_000) {\n const { done, value } = await reader.read();\n if (done) break;\n text += decoder.decode(value, { stream: true });\n }\n reader.cancel().catch(() => {});\n } else {\n text = await res.text();\n }\n // Strip tags so numbers inside markup attributes don't skew matching\n return { text: text.replace(/<[^>]*>/g, \" \"), status: res.status };\n } catch {\n return { text: null, status: res.status };\n }\n}\n\n/**\n * Auto-verify a listing's contact info: fetch the homepage (only), confirm it\n * responds OK, then:\n * - if the listing has a phone number, confirm it appears on the page\n * (compared digits-only, so formatting differences don't matter)\n * - if the listing has NO phone number, look for one on the page and return it\n * so the caller can fill it in\n */\nexport async function autoCheckContact(listing: Listing): Promise {\n if (!listing.website) {\n return {\n verified: false,\n siteStatus: null,\n phoneFound: null,\n foundPhone: null,\n reason: \"no website listed\",\n };\n }\n\n const url = listing.website.startsWith(\"http\") ? listing.website : `https://${listing.website}`;\n const { text, status } = await fetchPageText(url);\n\n if (text === null) {\n return {\n verified: false,\n siteStatus: status,\n phoneFound: null,\n foundPhone: null,\n reason: status === null\n ? \"website unreachable\"\n : `site responded ${status} (not OK)`,\n };\n }\n\n const phoneDigits = digits(listing.phone);\n if (phoneDigits.length >= 7) {\n const phoneFound = digits(text).includes(phoneDigits);\n return {\n verified: phoneFound,\n siteStatus: status,\n phoneFound,\n foundPhone: null,\n reason: phoneFound\n ? `site responded ${status}; phone found on page`\n : `site responded ${status}; phone NOT found on page`,\n };\n }\n\n // No usable phone in the directory — try to pull one off the page\n const found = findPhoneOnPage(text);\n return {\n verified: found !== null,\n siteStatus: status,\n phoneFound: found !== null,\n foundPhone: found,\n reason: found\n ? `site responded ${status}; phone found on page: ${found}`\n : `site responded ${status}; no phone number found on page`,\n };\n}\n\n// ---------- Extended checks: rental-site detection & FMR/HUD references ----------\n\nconst RENTAL_KEYWORDS = [\n \"rent\", \"rental\", \"apartment\", \"lease\", \"tenant\", \"housing\", \"property\",\n \"unit\", \"vacancy\", \"landlord\", \"residency\", \"for rent\", \"available now\",\n];\n\nconst FMR_KEYWORDS = [\n \"fair market rent\", \"fmr\", \"hud guidelines\", \"housing choice voucher\",\n \"section 8\", \"hud.org\", \"hud.gov\",\n];\n\nfunction countKeywords(text: string, keywords: string[]): string[] {\n const lower = text.toLowerCase();\n return keywords.filter((k) => lower.includes(k));\n}\n\nexport interface ExtendedCheck {\n isRentalSite: boolean;\n rentalSignals: string[];\n fmrReferences: string[];\n}\n\n/**\n * Analyze already-fetched page text for:\n * - whether it looks like a rental/property site\n * - any references to Fair Market Rent / HUD guidelines\n */\nexport function extendedChecks(pageText: string): ExtendedCheck {\n const rentalSignals = countKeywords(pageText, RENTAL_KEYWORDS);\n const fmrReferences = countKeywords(pageText, FMR_KEYWORDS);\n return {\n isRentalSite: rentalSignals.length >= 2,\n rentalSignals,\n fmrReferences,\n };\n}\n",[],[335,326],"backend","b5fa7834-3e4a-4260-a261-7e1c83d58b2d","seed.ts","1b60461e-7c97-11f1-9075-1607ee4eb77e",["D",1783712386625],"// Initial data imported from The Haven's \"Landlord Directory FY25\" Google Sheet\n// (Properties and Property Mgt Companies List tab), July 2026.\n// website: real URL when the sheet had one; websiteLabel: hyperlink text whose\n// URL wasn't recoverable from the export; notes: descriptor text from the sheet.\n\nexport interface SeedListing {\n location: string;\n name: string;\n phone: string;\n website?: string;\n websiteLabel?: string;\n notes?: string;\n}\n\nexport const seedListings: SeedListing[] = [\n { location: \"Albemarle\", name: \"1st Dominon Realty - Various Properties\", phone: \"434-531-6688\", website: \"https://1stdominionrealty.com\" },\n { location: \"Albemarle\", name: \"Access Properties - Various Properties\", phone: \"(434) 296-7227\", websiteLabel: \"Explore Our Properties - Access Properties LLC\" },\n { location: \"Charlottesville/Albemarle\", name: \"Ally Properties - Various Properties\", phone: \"434-207-6557\", website: \"https://www.yourallypm.com\" },\n { location: \"Albemarle\", name: \"Wilton Farm Apartments\", phone: \"434-295-7368\", websiteLabel: \"Wilton Farm Apartments\" },\n { location: \"Albemarle\", name: \"Rio Hill Apartments\", phone: \"434-974-6377\", websiteLabel: \"Rio Hill Apartments\" },\n { location: \"Albemarle\", name: \"Spark Charlottesville\", phone: \"434-973-6432\", websiteLabel: \"Spark Charlottesville Apartments\" },\n { location: \"Albemarle\", name: \"Barracks West Apartments\", phone: \"434-542-8052\", websiteLabel: \"Barracks West\" },\n { location: \"Albemarle\", name: \"Braden Property Management - Various Properties\", phone: \"434-973-3003\", websiteLabel: \"Braden Property Management\" },\n { location: \"Charlottesville\", name: \"Carratt Apartments\", phone: \"434-979-7307\", websiteLabel: \"Carratt Apartments - Charlottesville\" },\n { location: \"Albemarle\", name: \"Cobalt Ridge\", phone: \"434-973-3620\", websiteLabel: \"Cobalt Ridge\" },\n { location: \"Charlottesville\", name: \"Carlton View Apartments\", phone: \"434-422-2110\", websiteLabel: \"Carlton Views\" },\n { location: \"Charlottesville\", name: \"Greenstone on 5th\", phone: \"434-295-3094\", websiteLabel: \"Greenstone on 5th Apartments | Community Housing Partners\" },\n { location: \"Orange\", name: \"Spicers Mill Apartments\", phone: \"540-672-3250\", websiteLabel: \"Community Housing Partners\" },\n { location: \"Charlottesville\", name: \"Community Service Housing - Various Properties\", phone: \"434-978-2007\", websiteLabel: \"Community Services Housing, Inc\" },\n { location: \"Charlottesville City, Albemarle County, Scottsville and Nelson County\", name: \"Various Properties (Piedmont Housing Alliance)\", phone: \"\", websiteLabel: \"Our Communities - Piedmont Housing Alliance\", notes: \"View website for contact information\" },\n { location: \"Charlottesville\", name: \"Spruce Street Group Home\", phone: \"434-971-2525\", websiteLabel: \"Community Services Housing, Inc\" },\n { location: \"Louisa\", name: \"Waverly Place\", phone: \"540-603-2477\", websiteLabel: \"Waverly Place - Louisa\" },\n { location: \"Charlottesville\", name: \"D.M. Rothwell - Various Properties\", phone: \"434-977-7676\", websiteLabel: \"D.M. Rothwell, Inc\" },\n { location: \"Charlottesville, Crozet and Lexington\", name: \"BMC Property Management - Various Properties\", phone: \"434-977-6400\", websiteLabel: \"BMC Property Management\" },\n { location: \"Charlottesville City/Albemarle County\", name: \"BlueSky Property Management - Various Properties\", phone: \"434-295-4663\", websiteLabel: \"BlueSky Property Management\" },\n { location: \"Charlottesville, Albemarle and Harrisonburg\", name: \"Barclay Place, Tarleton Square, WestGate Apartments, Solomon Court Apartments, Charlottesville Towers, Residence at 218 and Park Apartments (Harrisonburg)\", phone: \"434-296-4141\", website: \"https://www.gemc.com/residential.cfm\" },\n { location: \"Louisa\", name: \"Pine Ridge Apartments\", phone: \"540-967-9657\", notes: \"Website unavailable\" },\n { location: \"Albemarle\", name: \"Timberland Park Apartments\", phone: \"434-956-4784\", websiteLabel: \"Timberland Park | Apartments in Charlottesville, VA\" },\n { location: \"Nelson\", name: \"Lovingston Ridge Apartments\", phone: \"(434) 263-7724\", notes: \"Website unavailable\" },\n { location: \"Charlottesville and Albemarle\", name: \"Godfrey Property Management - Various Properties\", phone: \"434-979-8155\", websiteLabel: \"Godfrey Property Management\" },\n { location: \"Charlottesville\", name: \"Ephphatha Village Apartments\", phone: \"434-202-2265\", websiteLabel: \"Ephphatha Village Apartments | Community Housing Partners\" },\n { location: \"Albemarle\", name: \"Southwood\", phone: \"434-293-9066\", websiteLabel: \"Southwood Community | Find your Home\" },\n { location: \"Albemarle\", name: \"Hearthwood Apartments\", phone: \"434-260-1903\", websiteLabel: \"Hearthwood Apartments\" },\n { location: \"Louisa\", name: \"Club Hill Apartments\", phone: \"540-967-0965\", notes: \"Website unavailable\" },\n { location: \"Culpeper\", name: \"JHP Rental Properties - Various Properties\", phone: \"540-967-2641\", websiteLabel: \"Rental\" },\n { location: \"Orange\", name: \"Round Hill Meadows\", phone: \"540-672-4827\", websiteLabel: \"Round Hill Meadows\" },\n { location: \"Charlottesville and Albemarle\", name: \"Knight Realty and Investments - Various Properties\", phone: \"(434) 981-3919\", notes: \"Website unavailable\" },\n { location: \"Albemarle\", name: \"Berkshire and Barter Court Apts.\", phone: \"434-270-7771\", websiteLabel: \"Berkshire and Barter Court Apartments\" },\n { location: \"Albemarle\", name: \"The Meadows Apartments\", phone: \"434-328-5268\", website: \"https://www.themeadows-online.com/\" },\n { location: \"Greene\", name: \"Lily Ridge Apartments\", phone: \"(434) 939-9197\", websiteLabel: \"Lily Ridge\" },\n { location: \"Louisa\", name: \"Lloyd's Real Estate - Various Properties\", phone: \"540-967-0168\", websiteLabel: \"Lloyd's Real Estate\" },\n { location: \"Charlottesville\", name: \"MSC - Various Properties\", phone: \"434-423-5400\", websiteLabel: \"MSC UVA\" },\n { location: \"Charlottesville\", name: \"Midway Manor\", phone: \"434-971-6770\", website: \"https://midwaymanorapts.com/\" },\n { location: \"Charlottesville, Albemarle, Amherst and Orange\", name: \"Montague Miller and Co. - Various Properties\", phone: \"434-973-5393\", website: \"https://www.montaguemiller.com/results/?property_category=5&cidonly=1\" },\n { location: \"Charlottesville\", name: \"Nest Realty - Various Properties\", phone: \"434-566-0121\", websiteLabel: \"Nest Realty\" },\n { location: \"Charlottesville\", name: \"New House Company\", phone: \"434-978-7900\", websiteLabel: \"The New House Company\" },\n { location: \"Albemarle\", name: \"Brookdale Apartments\", phone: \"434-282-4986\", website: \"https://www.brookdalecville.com/\" },\n { location: \"Albemarle\", name: \"Treesdale Apartments\", phone: \"434-971-7368\", websiteLabel: \"Treesdale Apartments\" },\n { location: \"Various in Virginia\", name: \"Ruckersville Mobile Home Community\", phone: \"434-760-1994\", websiteLabel: \"Roseland Communities\" },\n { location: \"\", name: \"\", phone: \"434-465-8461\" },\n { location: \"Charlottesville\", name: \"\", phone: \"434-326-4786\", notes: \"Apartment Complex\" },\n { location: \"Charlottesville\", name: \"Mews on Little High\", phone: \"434-286-3792\", notes: \"Complex\" },\n { location: \"Albemarle\", name: \"Private units in Eagle's Landing\", phone: \"434-234-3813\", notes: \"Shared\" },\n { location: \"Albemarle\", name: \"Various Properties\", phone: \"434-971-1600 x295\", notes: \"Various\" },\n { location: \"Charlottesville\", name: \"The Gleason\", phone: \"434-202-1852\", notes: \"Agent\" },\n { location: \"\", name: \"University Forum\", phone: \"434-971-1600\" },\n { location: \"Charlottesville\", name: \"Various Properties\", phone: \"434-989-2121\", notes: \"Various\" },\n { location: \"\", name: \"Various Properties\", phone: \"434-951-5155\" },\n { location: \"Charlottesville\", name: \"\", phone: \"434-760-0659\" },\n { location: \"Charlottesville\", name: \"Cavalier Court Apartments\", phone: \"434-979-7307\", notes: \"Apartment Complex\" },\n { location: \"Charlottesville\", name: \"Shamrock Gardens Apartments\", phone: \"434-979-7307\", notes: \"Apartment Complex\" },\n { location: \"Charlottesville\", name: \"\", phone: \"434-979-7307\" },\n { location: \"\", name: \"\", phone: \"434-529-0471\" },\n { location: \"\", name: \"\", phone: \"757-617-3158\" },\n { location: \"Greene\", name: \"Jack Russell Apartments\", phone: \"540-948-3916\" },\n { location: \"Greene\", name: \"Skyline Apartments\", phone: \"540-948-3916\" },\n { location: \"Fluvanna\", name: \"Various Properties\", phone: \"434-245-0894\" },\n { location: \"Lake Monticello\", name: \"Various Properties\", phone: \"434-589-4507\" },\n { location: \"\", name: \"\", phone: \"434-326-2460\" },\n { location: \"Orange\", name: \"Meadow Run Apartments\", phone: \"540-832-5350\", notes: \"Complex\" },\n { location: \"Albemarle\", name: \"Turtle Creek Condos\", phone: \"434-295-4663\" },\n { location: \"Charlottesville\", name: \"Grand Marc\", phone: \"434-293-5358\", notes: \"Apartment Building\" },\n { location: \"Charlottesville/Albemarle County\", name: \"Wade Property Management - Various Properties\", phone: \"434-973-3294\", websiteLabel: \"Wade Rentals in Charlottesville, VA\" },\n { location: \"Charlottesville\", name: \"100 West South Street\", phone: \"434-971-8860\", notes: \"Apartment with shared kitchen\" },\n { location: \"Charlottesville\", name: \"Camden Plaza\", phone: \"434-971-8860\" },\n { location: \"Charlottesville\", name: \"Comyn Hall\", phone: \"434-971-8860\", notes: \"Apartment in House\" },\n { location: \"Charlottesville\", name: \"\", phone: \"434-971-8860\", notes: \"House with apartments\" },\n { location: \"Albemarle\", name: \"Arbor Crest\", phone: \"855-901-1116\" },\n { location: \"Orange\", name: \"Bellview Senior Apartments\", phone: \"(540) 661-3300\" },\n { location: \"Waynesboro\", name: \"Brandon Ladd Apartments\", phone: \"540-949-5000\" },\n { location: \"Albemarle\", name: \"Carriage Hill\", phone: \"434-971-8439\" },\n { location: \"Charlottesville\", name: \"Cavalier Crossing\", phone: \"434-363-9889\" },\n { location: \"Charlottesville\", name: \"Claremont at Carriage Hill\", phone: \"434-989-1559\" },\n { location: \"\", name: \"Eagle's Landing\", phone: \"434-984-5808\" },\n { location: \"Louisa/Gordonsville\", name: \"Eastgate Apartments\", phone: \"540-832-5837\" },\n { location: \"Albemarle\", name: \"Eastham Village\", phone: \"434-977-2650\" },\n { location: \"Charlottesville City/Albemarle County\", name: \"Various Properties (MSC)\", phone: \"434-423-5400\", websiteLabel: \"MSC UVA\" },\n { location: \"Louisa\", name: \"Epworth Manor Apartments\", phone: \"540-967-1696\", website: \"https://epworthmanorapartments.com\" },\n { location: \"Albemarle\", name: \"Fountain Court\", phone: \"434-977-2650\", websiteLabel: \"Fountain Court Apartments\" },\n { location: \"Charlottesville\", name: \"Ivy Gardens\", phone: \"434-220-6650\", websiteLabel: \"Ivy Garden Apartments\" },\n { location: \"Charlottesville\", name: \"Jeffersonian Apartments\", phone: \"434-977-3070 or 833-698-1081\", website: \"https://www.thejeffersonianapts.com\" },\n { location: \"Albemarle\", name: \"Mallside Forest Apartments\", phone: \"434-424-0371\", websiteLabel: \"Security Properties\" },\n { location: \"Albemarle\", name: \"North Woods at the Four Seasons\", phone: \"434-688-4966\", website: \"https://www.livewithnorthwoods.com\" },\n { location: \"Albemarle\", name: \"Park View at South Pantops\", phone: \"434-923-0200\", website: \"https://southpantops.enterpriseresidential.org\" },\n { location: \"Charlottesville\", name: \"The Crossings and Fourth and Preston\", phone: \"434-227-4251\", websiteLabel: \"Communities We Serve | SupportWorks Housing\" },\n { location: \"Charlottesville\", name: \"The Flats @ West Village\", phone: \"844-236-1118\", website: \"https://www.flatsatwestvillage.com\" },\n { location: \"Albemarle\", name: \"University Heights Apartments\", phone: \"434-326-1337\", website: \"https://www.uheights.net\" },\n { location: \"Albemarle\", name: \"Woodlands of Charlottesville\", phone: \"434-421-3191\", website: \"https://www.woodlandsofcharlottesville.com\" },\n];\n",[],[335,337],"f61c88ac-411d-4d7b-9982-d3ae52196919","discover.ts","8dc14ce0-85ec-11f1-a849-1607ee4eb77e",39,["D",1788374185326],"import { ValTownOpenAI } from \"https://esm.town/v/std/openai/main.ts\";\nimport type { Listing } from \"./db.ts\";\n\nexport interface DiscoveredListing {\n name: string;\n location: string;\n phone: string;\n website: string;\n notes: string;\n}\n\n/**\n * Build the system instructions that tell the model what we're looking for\n * and what's already in the directory so it doesn't duplicate.\n */\nfunction buildInstructions(existing: Listing[]): string {\n const names = existing\n .filter((l) => l.name.trim())\n .map((l) => `- ${l.name} (${l.location})`)\n .join(\"\\n\");\n\n const phones = existing\n .filter((l) => l.phone.trim())\n .map((l) => l.phone)\n .join(\", \");\n\n return `You are a housing researcher for The Haven, a nonprofit in Charlottesville, Virginia that helps clients find rental housing.\n\nYour job: search the web for rental properties, apartment complexes, and property management companies in the Charlottesville, VA region and nearby counties that are NOT already in our directory.\n\nTarget areas: Charlottesville, Albemarle County, Crozet, Louisa, Gordonsville, Orange, Greene, Fluvanna, Lake Monticello, Nelson, Lovingston, Waynesboro, Staunton, Culpeper, Ruckersville, Scottsville, and Harrisonburg.\n\nFor each new property or company you find, provide:\n- name: The name of the apartment complex or property management company\n- location: The city or county area (e.g. \"Charlottesville\", \"Albemarle\", \"Louisa\")\n- phone: A phone number with area code (e.g. \"434-555-1234\"). Use empty string if you can't find one.\n- website: The full URL (e.g. \"https://example.com\"). Use empty string if you can't find one.\n- notes: A brief description (e.g. \"Apartment complex\", \"Property management company\", \"Senior housing\"). Use empty string if nothing notable.\n\nRules:\n1. Only include properties you actually found via web search — do not make things up.\n2. CRITICAL — Do not return any property that is already in our directory. This includes near-matches:\n - \"The Flats @ West Village\" and \"The Flats at West Village\" are the SAME property\n - \"Carlton View Apartments\" and \"Carlton Views Apartments\" are the SAME property\n - \"Montague Miller & Co.\" and \"Montague Miller and Co.\" are the SAME company\n - Punctuation differences (@ vs at, & vs and), plural vs singular, and minor word variations are NOT different properties\n - When in doubt, skip it — it's better to miss one than to create a duplicate\n3. Do NOT include any property whose phone number matches an existing listing (compare digits only).\n4. Aim for 5-15 genuinely new listings. If you can't find that many new ones, return fewer — quality over quantity.\n5. Skip national listing sites (Zillow, Apartments.com, Trulia, etc.) — we want the actual property or management company.\n\nEXISTING LISTINGS (do not duplicate any of these, including near-matches):\n${names}\n\nEXISTING PHONE NUMBERS: ${phones}`;\n}\n\nconst SCHEMA = {\n type: \"object\",\n properties: {\n new_listings: {\n type: \"array\",\n items: {\n type: \"object\",\n properties: {\n name: { type: \"string\" },\n location: { type: \"string\" },\n phone: { type: \"string\" },\n website: { type: \"string\" },\n notes: { type: \"string\" },\n },\n required: [\"name\", \"location\", \"phone\", \"website\", \"notes\"],\n additionalProperties: false,\n },\n },\n },\n required: [\"new_listings\"],\n additionalProperties: false,\n} as const;\n\n/**\n * Calls OpenAI with web_search + structured outputs to discover new rental\n * listings not already in the directory.\n */\nexport async function discoverNewListings(\n existing: Listing[],\n): Promise {\n const openai = new ValTownOpenAI({});\n\n const response = await openai.responses.create({\n model: \"gpt-5.4-nano\",\n tools: [{ type: \"web_search\" }],\n instructions: buildInstructions(existing),\n input:\n \"Search the web for apartment complexes and property management companies in the Charlottesville, Virginia area that accept rentals. Find ones NOT already in our existing list above. Return up to 15 new listings.\",\n text: {\n format: {\n type: \"json_schema\",\n name: \"new_rental_listings\",\n schema: SCHEMA,\n },\n },\n });\n\n const parsed = JSON.parse(response.output_text) as {\n new_listings: DiscoveredListing[];\n };\n\n return parsed.new_listings;\n}\n\n/**\n * Deduplicate discovered listings against existing ones by name (case-insensitive)\n * or phone number. Also removes entries with empty names.\n */\nexport function filterNew(\n discovered: DiscoveredListing[],\n existing: Listing[],\n): DiscoveredListing[] {\n const existingNames = new Set(\n existing.map((l) => l.name.trim().toLowerCase()).filter(Boolean),\n );\n const existingPhones = new Set(\n existing.map((l) => l.phone.replace(/\\D/g, \"\")).filter(Boolean),\n );\n\n return discovered.filter((d) => {\n if (!d.name.trim()) return false;\n if (existingNames.has(d.name.trim().toLowerCase())) return false;\n const phoneDigits = d.phone.replace(/\\D/g, \"\");\n if (phoneDigits && existingPhones.has(phoneDigits)) return false;\n return true;\n });\n}\n/**\n * Area-scoped discovery for staff: search the web for rental properties in ONE\n * specific area, returning up to 10 candidates (not inserted — staff pick).\n */\nexport async function discoverByArea(\n area: string,\n existing: Listing[],\n): Promise {\n const openai = new ValTownOpenAI({});\n\n const response = await openai.responses.create({\n model: \"gpt-5.4-nano\",\n tools: [{ type: \"web_search\" }],\n instructions: `You are a housing researcher for The Haven, a nonprofit in Charlottesville, Virginia that helps clients find rental housing.\n\nYour job: search the web for apartment complexes, rental properties, and property management companies in ONE area: ${area} (in or near Charlottesville, VA).\n\nFor each property or company you find, provide:\n- name: The name of the apartment complex or property management company\n- location: \"${area}\" (or the most specific locality within it)\n- phone: A phone number with area code. Use empty string if you can't find one.\n- website: The full URL of the property or company site. Use empty string if you can't find one.\n- notes: A brief description (e.g. \"Apartment complex\", \"Property management company\", \"Senior housing\", \"3BR units starting $1,200/mo\"). Use empty string if nothing notable.\n\nRules:\n1. Only include properties you actually found via web search — do not make things up.\n2. CRITICAL — Do not return any property that is already in our directory. This includes near-matches:\n - Punctuation differences (@ vs at, & vs and), plural vs singular, and minor word variations are NOT different properties\n - When in doubt, skip it — it's better to miss one than to create a duplicate\n3. Skip national listing sites (Zillow, Apartments.com, Trulia, etc.) — we want the actual property or management company site.\n4. Return AT MOST 10 listings — quality over quantity. If the area is small, return fewer.\n\nEXISTING LISTINGS (do not duplicate any of these):\n${existing.filter((l) => l.name.trim()).map((l) => `- ${l.name} (${l.location})`).join(\"\\n\")}`,\n input: `Search the web for apartment complexes and rental property management companies in ${area}, Virginia. Return up to 10 that are NOT already in the existing list above.`,\n text: {\n format: {\n type: \"json_schema\",\n name: \"area_rental_listings\",\n schema: SCHEMA,\n },\n },\n });\n\n const parsed = JSON.parse(response.output_text) as {\n new_listings: DiscoveredListing[];\n };\n return parsed.new_listings.slice(0, 10);\n}",[],[335,344],"6415ea70-8baa-455a-981c-c26bad485335","db.ts","2c1523d0-7c97-11f1-83ac-1607ee4eb77e",108,["D",1789310196556],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst TABLE = \"listings_v2\";\nconst USERS = \"users_v1\";\nconst SESSIONS = \"sessions_v1\";\nconst RESETS = \"password_resets_v1\";\nconst HITS = \"site_hits_v1\";\n\nexport const LISTING_TYPES = [\n \"Rental Agency\",\n \"Senior Living\",\n \"Rental Property\",\n \"Private Landlord\",\n \"Support Services\",\n] as const;\nexport type ListingType = (typeof LISTING_TYPES)[number];\n// Backwards-friendly alias\nexport const HOUSING_TYPES = LISTING_TYPES;\n\nexport const AREAS = [\n \"Charlottesville\",\n \"Albemarle\",\n \"Louisa\",\n \"Greene\",\n \"Nelson\",\n \"Fluvanna\",\n \"Multiple\",\n] as const;\n\nexport const ROLES = [\"admin\", \"editor\", \"viewer\"] as const;\nexport type Role = (typeof ROLES)[number];\n\nexport interface Listing {\n id: number;\n location: string; // comma-separated list of AREAS, may be blank\n name: string;\n website: string;\n type: string;\n phone: string;\n contact_name: string;\n notes: string;\n // staff-only fields (never sent to non-logged-in users)\n staff_notes: string;\n unsuitable_notes: string;\n date_validated: string;\n validated_by: string;\n created_at: string;\n updated_at: string;\n}\n\nexport type ListingInput = Omit;\n\nconst LISTING_COLS =\n \"id, location, name, website, type, phone, contact_name, notes, staff_notes, unsuitable_notes, date_validated, validated_by, created_at, updated_at\";\n\nconst STAFF_ONLY_COLS: (keyof Listing)[] = [\n \"staff_notes\",\n \"unsuitable_notes\",\n \"date_validated\",\n \"validated_by\",\n];\n\n/** Remove staff-only fields before sending a listing to the public. */\nexport function stripStaffFields(listing: Listing): Partial {\n const copy: any = { ...listing };\n for (const col of STAFF_ONLY_COLS) delete copy[col];\n return copy;\n}\n\nexport async function ensureTableAndSeed() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS ${TABLE} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n location TEXT NOT NULL DEFAULT '',\n name TEXT NOT NULL DEFAULT '',\n website TEXT NOT NULL DEFAULT '',\n type TEXT NOT NULL DEFAULT 'Rental Property',\n phone TEXT NOT NULL DEFAULT '',\n contact_name TEXT NOT NULL DEFAULT '',\n notes TEXT NOT NULL DEFAULT '',\n staff_notes TEXT NOT NULL DEFAULT '',\n unsuitable_notes TEXT NOT NULL DEFAULT '',\n date_validated TEXT NOT NULL DEFAULT '',\n validated_by TEXT NOT NULL DEFAULT '',\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n updated_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`);\n\n // One-time migration: drop the old v1 table (restructured schema; data was cleared)\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS meta_v1 (key TEXT PRIMARY KEY, value TEXT)`);\n const done = await sqlite.execute({ sql: `SELECT value FROM meta_v1 WHERE key = 'v1_dropped'` });\n if (done.rows.length === 0) {\n try {\n await sqlite.execute(`DROP TABLE IF EXISTS listings_v1`);\n } catch {\n // ignore\n }\n await sqlite.execute({ sql: `INSERT INTO meta_v1 (key, value) VALUES ('v1_dropped', datetime('now'))` });\n }\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS ${USERS} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n email TEXT NOT NULL UNIQUE,\n password_hash TEXT NOT NULL,\n first_name TEXT NOT NULL DEFAULT '',\n last_name TEXT NOT NULL DEFAULT '',\n role TEXT NOT NULL DEFAULT 'viewer',\n active INTEGER NOT NULL DEFAULT 1,\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n last_login TEXT NOT NULL DEFAULT ''\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS ${SESSIONS} (\n token TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS ${HITS} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n ts TEXT NOT NULL DEFAULT (datetime('now')),\n kind TEXT NOT NULL DEFAULT 'directory_view',\n staff INTEGER NOT NULL DEFAULT 0\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS ${RESETS} (\n token TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL,\n expires_at TEXT NOT NULL,\n used INTEGER NOT NULL DEFAULT 0\n )`);\n}\n\n// ---------- Listings ----------\n\nexport async function listListings(): Promise {\n const result = await sqlite.execute(\n `SELECT ${LISTING_COLS} FROM ${TABLE} ORDER BY type, CASE WHEN name = '' THEN 1 ELSE 0 END, name COLLATE NOCASE`,\n );\n return result.rows as unknown as Listing[];\n}\n\nexport function validateListingInput(input: any): string | null {\n if (input.type && !(LISTING_TYPES as readonly string[]).includes(input.type)) {\n return `Invalid type: ${input.type}`;\n }\n if (input.location) {\n const parts = String(input.location).split(\",\").map((s: string) => s.trim()).filter(Boolean);\n const bad = parts.filter((p: string) => !(AREAS as readonly string[]).includes(p));\n if (bad.length) return `Invalid location — must be one or more of: ${AREAS.join(\", \")}`;\n }\n return null;\n}\n\nexport async function createListing(input: ListingInput): Promise {\n await sqlite.execute({\n sql: `INSERT INTO ${TABLE} (location, name, website, type, phone, contact_name, notes, staff_notes, unsuitable_notes, date_validated, validated_by)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n input.location ?? \"\", input.name ?? \"\", input.website ?? \"\",\n input.type ?? \"Rental Property\", input.phone ?? \"\", input.contact_name ?? \"\",\n input.notes ?? \"\", input.staff_notes ?? \"\", input.unsuitable_notes ?? \"\",\n input.date_validated ?? \"\", input.validated_by ?? \"\",\n ],\n });\n}\n\nexport async function getListing(id: number): Promise {\n const result = await sqlite.execute({ sql: `SELECT ${LISTING_COLS} FROM ${TABLE} WHERE id = ?`, args: [id] });\n return (result.rows[0] as Listing) ?? null;\n}\n\nexport async function updateListing(id: number, input: ListingInput): Promise {\n await sqlite.execute({\n sql: `UPDATE ${TABLE}\n SET location = ?, name = ?, website = ?, type = ?, phone = ?, contact_name = ?, notes = ?,\n staff_notes = ?, unsuitable_notes = ?, date_validated = ?, validated_by = ?,\n updated_at = datetime('now')\n WHERE id = ?`,\n args: [\n input.location ?? \"\", input.name ?? \"\", input.website ?? \"\",\n input.type ?? \"Rental Property\", input.phone ?? \"\", input.contact_name ?? \"\",\n input.notes ?? \"\", input.staff_notes ?? \"\", input.unsuitable_notes ?? \"\",\n input.date_validated ?? \"\", input.validated_by ?? \"\",\n id,\n ],\n });\n}\n\nexport async function deleteListing(id: number): Promise {\n await sqlite.execute({ sql: `DELETE FROM ${TABLE} WHERE id = ?`, args: [id] });\n}\n\n// ---------- Users / auth ----------\n\nexport interface User {\n id: number;\n email: string;\n first_name: string;\n last_name: string;\n role: Role;\n active: number;\n created_at: string;\n last_login: string;\n}\n\nconst USER_COLS = \"id, email, password_hash, first_name, last_name, role, active, created_at, last_login\";\n\nexport async function getUserByEmail(email: string): Promise<(User & { password_hash: string }) | null> {\n const r = await sqlite.execute({ sql: `SELECT ${USER_COLS} FROM ${USERS} WHERE email = ? COLLATE NOCASE`, args: [email.trim()] });\n return (r.rows[0] as any) ?? null;\n}\n\nexport async function getUserById(id: number): Promise {\n const r = await sqlite.execute({ sql: `SELECT id, email, first_name, last_name, role, active, created_at, last_login FROM ${USERS} WHERE id = ?`, args: [id] });\n return (r.rows[0] as User) ?? null;\n}\n\nexport async function listUsers(): Promise {\n const r = await sqlite.execute(`SELECT id, email, first_name, last_name, role, active, created_at, last_login FROM ${USERS} ORDER BY email COLLATE NOCASE`);\n return r.rows as unknown as User[];\n}\n\nexport async function createUser(u: { email: string; password_hash: string; first_name: string; last_name: string; role: Role }): Promise {\n await sqlite.execute({\n sql: `INSERT INTO ${USERS} (email, password_hash, first_name, last_name, role) VALUES (?, ?, ?, ?, ?)`,\n args: [u.email.trim(), u.password_hash, u.first_name, u.last_name, u.role],\n });\n}\n\nexport async function updateUserPassword(id: number, password_hash: string): Promise {\n await sqlite.execute({ sql: `UPDATE ${USERS} SET password_hash = ? WHERE id = ?`, args: [password_hash, id] });\n}\n\nexport async function updateUserRole(id: number, role: Role): Promise {\n await sqlite.execute({ sql: `UPDATE ${USERS} SET role = ? WHERE id = ?`, args: [role, id] });\n}\n\nexport async function setUserActive(id: number, active: boolean): Promise {\n await sqlite.execute({ sql: `UPDATE ${USERS} SET active = ? WHERE id = ?`, args: [active ? 1 : 0, id] });\n}\n\nexport async function stampLogin(id: number): Promise {\n await sqlite.execute({ sql: `UPDATE ${USERS} SET last_login = datetime('now') WHERE id = ?`, args: [id] });\n}\n\nexport async function countAdmins(): Promise {\n const r = await sqlite.execute(`SELECT COUNT(*) AS n FROM ${USERS} WHERE role = 'admin' AND active = 1`);\n return Number((r.rows[0] as any).n);\n}\n\n// ---------- Sessions ----------\n\nexport async function createSession(token: string, userId: number): Promise {\n await sqlite.execute({ sql: `INSERT INTO ${SESSIONS} (token, user_id) VALUES (?, ?)`, args: [token, userId] });\n}\n\nexport async function getSessionUser(token: string): Promise {\n const r = await sqlite.execute({\n sql: `SELECT u.id, u.email, u.first_name, u.last_name, u.role, u.active, u.created_at, u.last_login\n FROM ${SESSIONS} s JOIN ${USERS} u ON u.id = s.user_id WHERE s.token = ?`,\n args: [token],\n });\n const user = r.rows[0] as User | undefined;\n return user && user.active ? user : null;\n}\n\nexport async function deleteSession(token: string): Promise {\n await sqlite.execute({ sql: `DELETE FROM ${SESSIONS} WHERE token = ?`, args: [token] });\n}\n\n// ---------- Password resets ----------\n\nexport async function createResetToken(token: string, userId: number): Promise {\n await sqlite.execute({ sql: `DELETE FROM ${RESETS} WHERE user_id = ?`, args: [userId] });\n const expires = new Date(Date.now() + 60 * 60 * 1000).toISOString();\n await sqlite.execute({ sql: `INSERT INTO ${RESETS} (token, user_id, expires_at) VALUES (?, ?, ?)`, args: [token, userId, expires] });\n}\n\nexport async function consumeResetToken(token: string): Promise {\n const r = await sqlite.execute({ sql: `SELECT user_id, expires_at, used FROM ${RESETS} WHERE token = ?`, args: [token] });\n const row = r.rows[0] as any;\n if (!row || row.used) return null;\n if (new Date(row.expires_at) < new Date()) return null;\n await sqlite.execute({ sql: `UPDATE ${RESETS} SET used = 1 WHERE token = ?`, args: [token] });\n return row.user_id as number;\n}\n// ---------- Site hits (activity tracking) ----------\n\nexport async function recordHit(staff: boolean): Promise {\n await sqlite.execute({\n sql: `INSERT INTO site_hits_v1 (staff) VALUES (?)`,\n args: [staff ? 1 : 0],\n });\n}\n\nexport interface HitStats {\n total: number;\n totalPublic: number;\n totalStaff: number;\n last7: number;\n last30: number;\n today: number;\n byDay: { day: string; total: number; public: number; staff: number }[];\n}\n\nexport async function getHitStats(): Promise {\n const one = async (sql: string): Promise =>\n Number((await sqlite.execute(sql)).rows[0]?.n ?? 0);\n const total = await one(`SELECT COUNT(*) AS n FROM site_hits_v1`);\n const totalStaff = await one(`SELECT COUNT(*) AS n FROM site_hits_v1 WHERE staff = 1`);\n const last7 = await one(`SELECT COUNT(*) AS n FROM site_hits_v1 WHERE ts >= datetime('now', '-7 days')`);\n const last30 = await one(`SELECT COUNT(*) AS n FROM site_hits_v1 WHERE ts >= datetime('now', '-30 days')`);\n const today = await one(`SELECT COUNT(*) AS n FROM site_hits_v1 WHERE date(ts) = date('now')`);\n const byDayRes = await sqlite.execute(`\n SELECT date(ts) AS day, COUNT(*) AS total,\n SUM(CASE WHEN staff = 0 THEN 1 ELSE 0 END) AS public_hits,\n SUM(CASE WHEN staff = 1 THEN 1 ELSE 0 END) AS staff_hits\n FROM site_hits_v1\n WHERE ts >= datetime('now', '-30 days')\n GROUP BY date(ts) ORDER BY day DESC`);\n return {\n total,\n totalPublic: total - totalStaff,\n totalStaff,\n last7,\n last30,\n today,\n byDay: byDayRes.rows.map((r: any) => ({\n day: r.day,\n total: Number(r.total),\n public: Number(r.public_hits),\n staff: Number(r.staff_hits),\n })),\n };\n}\n",[],[335,352],"a8c90b95-ee12-4db6-82a9-453ab1431200","cron.ts","9124a6e8-85ec-11f1-9db7-1607ee4eb77e",98,["D",1789301968642],"interval","import {\n ensureTableAndSeed,\n listListings,\n createListing,\n} from \"./db.ts\";\nimport { AREAS } from \"./db.ts\";\nimport { discoverNewListings, filterNew } from \"./discover.ts\";\n\n/**\n * Weekly cron job: uses OpenAI web search to discover new rental properties\n * and property management companies in the Charlottesville, VA area that aren't\n * already in the directory. New finds are inserted into the database with a\n * \"AI-discovered — verify contact info\" note so staff can review them.\n */\nexport default async function (interval: Interval) {\n await ensureTableAndSeed();\n\n const existing = await listListings();\n console.log(`Existing listings: ${existing.length}`);\n\n console.log(\"Searching the web for new rental listings...\");\n const discovered = await discoverNewListings(existing);\n console.log(`AI returned ${discovered.length} candidate listings`);\n\n const fresh = filterNew(discovered, existing);\n console.log(\n `After dedup: ${fresh.length} new listings to add`,\n );\n\n if (fresh.length === 0) {\n console.log(\"No new listings found this run.\");\n return;\n }\n\n const today = new Date().toISOString().slice(0, 10);\n let added = 0;\n for (const l of fresh) {\n await createListing({\n location: AREAS.includes(l.location) ? l.location : \"\",\n name: l.name,\n phone: l.phone,\n website: l.website,\n type: \"Rental Property\",\n contact_name: \"\",\n notes: l.notes\n ? `${l.notes} — AI-discovered ${today}, verify contact info`\n : `AI-discovered ${today}, verify contact info`,\n staff_notes: \"\",\n unsuitable_notes: \"\",\n date_validated: \"\",\n validated_by: \"\",\n } as any);\n added++;\n console.log(` + ${l.name} (${l.location}) — ${l.phone}`);\n }\n\n console.log(`Done. Added ${added} new listings.`);\n}\n",[],[335,360],"f97307e7-6b4a-4014-93e9-e61c39e8d6de","auth.ts","903158a6-a943-11f1-97c0-1607ee4eb77e",54,["D",1788624307201],"import { scryptSync, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport { getSessionUser, type Role, type User } from \"./db.ts\";\n\n// ---------- Password hashing ----------\n\nexport function hashPassword(password: string): string {\n const salt = randomBytes(16).toString(\"hex\");\n const hash = scryptSync(password, salt, 64).toString(\"hex\");\n return `${salt}:${hash}`;\n}\n\nexport function verifyPassword(password: string, stored: string): boolean {\n const [salt, hash] = stored.split(\":\");\n if (!salt || !hash) return false;\n const candidate = scryptSync(password, salt, 64);\n const expected = Buffer.from(hash, \"hex\");\n return candidate.length === expected.length && timingSafeEqual(candidate, expected);\n}\n\n// ---------- Password policy ----------\n// At least 12 chars, upper + lower case, one special character\n\nexport function validatePasswordStrength(pw: string): string | null {\n if (pw.length < 12) return \"Password must be at least 12 characters long\";\n if (!/[a-z]/.test(pw)) return \"Password must contain a lowercase letter\";\n if (!/[A-Z]/.test(pw)) return \"Password must contain an uppercase letter\";\n if (!/[^A-Za-z0-9]/.test(pw)) return \"Password must contain a special character\";\n return null;\n}\n\n// ---------- Sessions & roles ----------\n\nexport function newToken(): string {\n return randomBytes(32).toString(\"hex\");\n}\n\nexport function normalizeEmail(email: unknown): string {\n return String(email ?? \"\").trim().toLowerCase();\n}\n\nexport function isEmail(email: string): boolean {\n return /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email);\n}\n\nconst RANK: Record = { viewer: 1, editor: 2, admin: 3 };\n\nexport async function currentUser(c: any): Promise {\n const auth = c.req.header(\"authorization\") ?? \"\";\n const token = auth.startsWith(\"Bearer \") ? auth.slice(7) : \"\";\n if (!token) return null;\n return await getSessionUser(token);\n}\n\n/** Middleware: user must be signed in with role >= minRole. Sets c.set(\"user\"). */\nexport function requireRole(minRole: Role) {\n return async (c: any, next: () => Promise) => {\n const user = await currentUser(c);\n if (!user) return c.json({ error: \"Sign in required\" }, 401);\n if (RANK[user.role] < RANK[minRole]) return c.json({ error: `Requires ${minRole} access` }, 403);\n c.set(\"user\", user);\n await next();\n };\n}\n",[],[335,369],"83688e9c-c04c-4cea-8600-2b3d4f973f05",["D",1783712386625],[192,193,194,195,196,197],[335],["D",1783712246617],["D",1789525245864],{"_11":12,"_134":-5},{"_11":12,"_129":130,"_71":-5,"_30":-5,"_131":132,"_133":89},{"_38":116,"_13":16,"_32":35,"_117":74,"_118":119,"_120":121,"_122":79,"_123":124,"_125":126,"_127":14,"_128":12},"ctx",{"_53":-5,"_155":418,"_419":420,"_421":422,"_423":24,"_424":24,"_425":24,"_426":89,"_427":-5,"_428":-7,"_429":-7,"_430":26,"_431":24,"_432":24,"_433":-5,"_434":24,"_435":24,"_436":24,"_437":-5},"ENV",{"_389":390,"_391":392,"_393":16,"_394":395,"_396":397,"_398":399,"_400":401,"_402":403,"_404":405,"_406":407,"_408":409,"_410":411,"_412":413,"_414":415,"_416":417},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · AdminUsers.tsx